Security News
Qualys researchers have discovered a critical vulnerability in OpenBSD's OpenSMTPD mail server, which can allow attackers to execute arbitrary shell commands on the underlying system as root. OpenSMTPD is an open source implementation of the Simple Mail Transfer Protocol.
Dave DeWalt, former CEO of FireEye and McAfee, has been appointed vice chair of the board of Onapsis, a vendor focused on securing business-critical applications, such as ERP and CRM. In this exclusive interview with Information Security Media Group, DeWalt opens up on business application vulnerabilities, the evolution of the nation-state threat and technologies to watch in 2020. "When you look at business-critical applications, they have become one of the main areas of attack," DeWalt says.
A critical vulnerability in the Cisco Firepower Management Center could allow a remote attacker to bypass authentication and execute arbitrary actions on affected devices as administrator. The issue, Cisco explains, emerges from the improper handling of Lightweight Directory Access Protocol authentication responses from an external server.
A collection of six cybersecurity vulnerabilities in a range of GE Healthcare devices for hospitals has been discovered. Dubbed "MDhex" by the researchers at CyberMDX who discovered them, the bugs would allow attackers to disable the devices, harvest personal health information, change alarm settings and alter device functionality.
A critical Cisco vulnerability exists in its administrative management tool for Cisco network security solutions. The flaw exists in the web-based management interface of the Cisco Firepower Management Center, which is its platform for managing Cisco network security solutions, like firewalls or its advanced malware protection service.
Most state CIOs see innovation as a major part of their job - 83% said innovation is an important or very important part of their day-to-day leadership responsibilities - while only 14% reported extensive innovation initiatives within their organizations, Accenture and the National Association of State Chief Information Officers reveal. Previously, NASCIO had highlighted innovation as a top ten current issue facing state CIOs.
Citrix has quickened its rollout of patches for a critical vulnerability in the Citrix Application Delivery Controller and Citrix Gateway products, on the heels of recent proof-of-concept exploits and skyrocketing exploitation attempts. While Citrix originally said some versions would get a patch Jan. 31, it has now also shortened that timeframe, saying fixes are forthcoming on Jan 24.
Citrix has started rolling out security patches for the recently revealed Citrix Application Delivery Controller and Citrix Gateway vulnerability. The issue impacts versions 13.0, 12.1, 12.0, 11.1, and 10.5 of both Citrix ADC and Gateway.
Some of the markets we are planning to expand into are rail transport and Building Automation Systems markets. Starting only one or two years ago, we saw the entire industry kind of look around and say "Safety is job one, and cybersecurity is essential to safety. Oh rats!" And we saw a lot of operators start looking seriously at cybersecurity.
Citrix has finally started rolling out security patches for a critical vulnerability in ADC and Gateway software that attackers started exploiting in the wild earlier this month after the company announced the existence of the issue without releasing any permanent fix. As explained earlier on The Hacker News, the vulnerability, tracked as CVE-2019-19781, is a path traversal issue that could allow unauthenticated remote attackers to execute arbitrary code on several versions of Citrix ADC and Gateway products, as well as on the two older versions of Citrix SD-WAN WANOP. Rated critical with CVSS v3.1 base score 9.8, the issue was discovered by Mikhail Klyuchnikov, a security researcher at Positive Technologies, who responsibly reported it to Citrix in early December.