VERT Reads All About It: Cybersecurity News for the Week of August 8

All of us at Tripwire’s Vulnerability Exposure and Research Team (VERT) are constantly looking out for interesting stories and developments in the infosec world. Here’s what cybersecurity news stood out to us during the week of August 8^st, 2022. I’ve also included some comments on these stories.

Slack leaked hashed passwords from its servers for years

Did Slack send you a password reset link last week? The company has admitted to accidentally exposing the hashed passwords of workspace users, reported The Register. The issue occurred when a user created or revoked a shared invitation link for their workspace.

Andrew Swoboda | Senior Security Researcher at Tripwire

Slack exposed password hashes when requesting a password reset link. The password hashes were salted. Depending on how the passwords are salted, they might be difficult to crack. This issue was discovered by an independent security researcher. Users that created these links between April 17, 2017, and July 17, 2022, are affected.

VU#309662: Signed third party UEFI bootloaders are vulnerable to Secure Boot bypass

A security feature bypass vulnerability exists in signed 3rd party UEFI bootloaders that allows bypass of the UEFI Secure Boot feature. An attacker who successfully exploits this vulnerability can bypass the UEFI Secure Boot feature and execute unsigned code during the boot process, notes Carnegie Mellon’s CERT Coordination Center.

Andrew Swoboda | Senior Security Researcher at Tripwire

UEFI bootloaders are subject to a secure boot bypass vulnerability. This vulnerability exists in signed 3rd party UEFI bootloaders. An attacker could execute unsigned code during the boot process upon successful exploitation of this vulnerability. Security researchers at Eclypsion found CVE-2022-34302, CVE-2022-34301, and CVE-2022-34303.

Microsoft Patches Dogwalk Zero Day And 17 Critical Flaws

Microsoft is urging users to patch a zero-day vulnerability dubbed Dogwalk that is actively being exploited in the wild. The bug (CVE-2022-34713) is tied to a Microsoft Windows Support Diagnostic Tool and allows a remote attacker to execute code on a vulnerable system, cites Threatpost.

Andrew Swoboda | Senior Security Researcher at Tripwire

Dogwalk was initially discovered in January 2022 by Imre Rad. A separate researcher began tracking a flaw dubbed Follina (CVE-2022-30190) which led to the rediscovery of Dogwalk. Microsoft has finally patched the vulnerability in the August patches. The vulnerability is present in the Microsoft Windows Support Diagnostic Tool. CVE-2022-34713 is a variant of Dogwalk and requires the attacker to have psychical access to a vulnerable system.

CVE-2022-2590: Linux kernel privilege escalation vulnerability

A newly discovered flaw (CVE-2022-2590) that affects the Linux kernel can be leveraged to write malicious code directly into processes, Security Online reports.

Andrew Swoboda | Senior Security Researcher at Tripwire

Linux greater than and equal to version 5.16 and prior to version 5.19 are subject to a privilege escalation vulnerability. An attacker could gain access to memory mappings upon successful exploitation of this vulnerability. An unprivileged user could modify shmem (tmpfs) file when they do not have write permissions.

Keep in Touch with Tripwire VERT

Want more insights from Tripwire VERT before our next cybersecurity news roundup comes out? Subscribe to our newsletter here.

Previous VERT Cybersecurity News Roundups