- "기밀 VM의 빈틈을 메운다" 마이크로소프트의 오픈소스 파라바이저 '오픈HCL'란?
- The best early Black Friday AirPods deals: Shop early deals
- The 19 best Black Friday headphone deals 2024: Early sales live now
- I tested the iPad Mini 7 for a week, and its the ultraportable tablet to beat at $100 off
- The best Black Friday deals 2024: Early sales live now
Three More Vulnerabilities Found in SolarWinds Products
Security researchers have discovered three more vulnerabilities in SolarWinds products, including a critical remote code execution bug.
The IT management software provider has been in the news regularly over recent weeks after its Orion product was targeted by alleged Russian state hackers, in a major supply chain attack aimed at the US government.
A vulnerability patched in December was at the center of a new report this week claiming that Chinese state-sponsored threat actors exploited it as part of a cyber-espionage attack on a US federal payroll agency.
Now Trustwave is urging customers to address three “severe” flaws it found in SolarWinds products. The vendor fixed the issues promptly and there have been no reports of “in the wild” exploitation, but prompt patching is recommended.
Two of the software flaws are found in the SolarWinds Orion User Device Tracker and one is in the firm’s Serv-U FTP product.
The most critical vulnerability, CVE-2021-25274, is found in the former. It relates to the legacy Microsoft Message Queue (MSMQ) technology which is set up on installation, and could allow any remote unprivileged user to execute any arbitrary code with the highest privileges.
The second bug, CVE-2021-25275, affects the same product. Trustwave claimed that SolarWinds credentials are stored in an insecure manner which could allow local users to take complete control over the SOLARWINDS_ORION database. In so doing, they could steal data or add a new admin-level user inside SolarWinds Orion products, it said.
Finally, there’s CVE-2021-2527, in the SolarWinds Serv-U FTP for Windows product.
“Any local user, regardless of privilege, can create a file that can define a new Serv-U FTP admin account with full access to the C: drive. This account can then be used to login via FTP and read or replace any file on the drive,” explained Trustwave.
The security vendor said it is giving customers an extra week to patch before it releases proof-of-concept code.