CERT-In, on Thursday, issued alerts for vulnerabilities detected in Chrome allowing remote attackers to execute arbitrary code and bypass security restrictions, in Cisco vulnerabilities can be exploited to perform cross-site scripting and disclose sensitive information
CERT-In, on Thursday, issued alerts for vulnerabilities detected in Chrome allowing remote attackers to execute arbitrary code and bypass security restrictions, in Cisco vulnerabilities can be exploited to perform cross-site scripting and disclose sensitive information
In Google Chrome
These vulnerabilities can be exploited by remote attackers by sending specially crafted requests to the targeted systems. Allowing to execute arbitrary code on the targeted systems and bypass security restrictions.
(Sign up to our Technology newsletter, Today’s Cache, for insights on emerging themes at the intersection of technology, business and policy. Click here to subscribe for free.)
The vulnerabilities exist in Chrome due to the use of after-free in FedCm, SwiftShader, Angle, Blink, sign-in flow, and Chrome OS shell.
Buffer overflow in downloads, insufficient validation of untrusted inputs, insufficient policy enforcement in cookies and inappropriate implementation in extensions API.
CERT-In advised users to urgently apply available security patches from Google as the vulnerabilities are being actively exploited.
In Cisco networking software
The vulnerabilities in multiple Cisco products have reportedly been used by attackers to execute arbitrary code, access and disclose information and perform cross site scripting attacks on affected systems.
The vulnerability that allows attackers to run arbitrary codes on the software exists in Cisco Adaptive security Device Manager (ADM) due to lack of proper signature verification that exists between the ADM and the launcher.
This vulnerability is exploited by attackers by leveraging a man-in-the-middle position on the network to intercept traffic between the launcher and ADM and injecting arbitrary code.
Exploiting this vulnerability could allow attackers to make additions to the codes of the software with the same privileges granted to the ADM launcher, thus compromising their security.
The vulnerability that can allow attackers to disclose information on systems running Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) exists in the handling of RSA keys due to logic error.
Attackers can use this vulnerability to retrieve RSA private keys by using a Lenstra side-channel attack against the targeted devices.
The cross site scripting vulnerability exists in a web VPN component of ASA due to improper validation of input. It can be exploited by convincing users to visit a website that can send malicious requests to the targeted device.
Vulnerabilities in Cisco software can also be exploited by attackers by installing maliciously crafted images on devices which when accessed by users can allow attackers to execute arbitrary code on the affected system. This allows attackers to gain privileges that are only granted to the user.
CERT-In has advised users to apply appropriate security patches available on Cisco’s website to fix these vulnerabilities.
