Week of June 10, 2024

CVE-2024-5671 is a critical remote code execution vulnerability in Trellix IPS Manager caused by insecure deserialization. Unauthenticated attackers can exploit this flaw to execute arbitrary code on affected systems. Immediate patching is required to prevent potential compromise of security infrastructure.

Researchers disclosed two vulnerabilities in the Palo Alto Networks Cortex XDR agent on Windows. CVE-2024-5907 is a local privilege escalation via a race condition in support file generation that allows arbitrary folder deletion, potentially leading to SYSTEM privileges. CVE-2024-9469 allows a low-privileged user to disable the agent by manipulating CPU usage checks in the Adaptive Policy module.

Fortinet released patches for multiple vulnerabilities in FortiOS and other products, including a high-severity stack-based buffer overflow (CVE-2024-23110) that could allow authenticated attackers to execute unauthorized code via crafted CLI arguments. Additional medium-severity flaws could lead to remote code execution, JavaScript injection, or backup decryption. No active exploitation was reported, but Fortinet products have been targeted in the past.

A security researcher developed a custom malware artifact that successfully evaded detection by a major EDR vendor. The technique involves unhooking Windows API functions and using direct system calls to bypass user-mode hooks. This demonstrates that EDRs alone cannot stop determined attackers without active human analysis.

A time-of-check time-of-use (TOCTOU) race condition in the Trend Micro Apex One Security Agent's NT RealTime Scan service allows local low-privileged attackers to escalate privileges to SYSTEM. The vulnerability arises from improper locking during object operations. Trend Micro has released a patch to address the issue.

A vulnerability in Trend Micro Apex One Security Agent allows local attackers to disclose sensitive information. The flaw exists in the VsApiNT module and can be triggered by creating a mount point, leading to file content disclosure in the context of SYSTEM. Trend Micro has released a patch to address this issue.

Cylance confirmed a data breach involving old marketing data from a third-party platform, with a threat actor selling 34 million customer and employee emails. The company states no current customers or sensitive data are impacted, and the data predates BlackBerry's acquisition. The incident is linked to broader Snowflake credential attacks.