Key Takeaways

• CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog with three critical vulnerabilities: CVE-2016-3714, CVE-2017-1000253, and CVE-2024-40766.
• These vulnerabilities are being actively exploited by cybercriminals, posing significant risks to both federal and private sector organizations.
• CISA urges all organizations to prioritize the remediation of these vulnerabilities to strengthen their cybersecurity defenses.
• Organizations should update software with the latest patches, implement multi-factor authentication (MFA), and continuously monitor for unusual activities.
• For detailed information and support, organizations should consult CISA’s advisories and the relevant vendor resources.

Overview

The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities (KEV) Catalog by adding three new vulnerabilities. These newly identified flaws represent significant security risks and are actively being exploited by malicious actors.

The newly added vulnerabilities include CVE-2016-3714, which affects ImageMagick due to improper input validation; CVE-2017-1000253, a Linux kernel vulnerability involving stack buffer corruption in position-independent executables (PIE); and CVE-2024-40766, a severe access control issue in SonicWall SonicOS.

These vulnerabilities are known to be frequent targets for cyberattacks and present significant risks to both federal and private sector organizations. CISA urges all organizations to prioritize remediation of these vulnerabilities to enhance their cybersecurity posture.

Details of the Vulnerabilities

CVE-2016-3714, also known as “ImageTragick,” affects ImageMagick versions prior to 6.9.3-10 and 7.x before 7.0.1-1. This vulnerability arises from improper input validation, which impacts various coders within ImageMagick.

Exploiting this flaw allows attackers to execute arbitrary code via shell metacharacters in a specially crafted image, potentially leading to remote code execution. To mitigate this risk, users should ensure that image files are validated for correct “magic bytes” and configure ImageMagick’s policy file to disable the vulnerable coders. Comprehensive guidance on configuration and additional mitigations is available for users.

CVE-2017-1000253 affects multiple versions of the Linux kernel, including those used in RedHat Enterprise Linux and CentOS. This vulnerability involves stack buffer corruption in the load_elf_binary() function, which can be exploited by local attackers to escalate privileges through issues with position-independent executables (PIE). Users are advised to apply the available patches to correct this buffer corruption flaw. Further details and patches are provided for addressing this issue.

CVE-2024-40766 is a critical vulnerability affecting SonicWall Firewalls Gen 5, Gen 6, and Gen 7 devices running SonicOS 7.0.1-5035 and older. This flaw in SonicWall SonicOS Management Access and SSLVPN allows unauthenticated attackers to gain unauthorized access to the management interface, which could result in unauthorized resource access or even firewall crashes.

To mitigate this vulnerability, it is essential to restrict firewall management to trusted sources or disable WAN management and SSLVPN access from the Internet. Users should download and apply the latest patches from SonicWall’s official site, and detailed security measures and patch links are available for further guidance.

Conclusion

The addition of CVE-2016-3714, CVE-2017-1000253, and CVE-2024-40766 to CISA’s KEV Catalog highlights the critical nature of these vulnerabilities. Organizations must act promptly to address these issues by applying patches and implementing recommended security practices. For additional information and support, refer to the official advisories and technical resources provided by CISA and relevant vendors.

Mitigation and Recommendations

• Ensure all software, firmware, and systems are updated with the latest patches.
• Restrict access to critical systems to authorized users only and implement multi-factor authentication (MFA).
• Continuously monitor systems for unusual activities and conduct regular security audits and vulnerability assessments.
• Maintain and regularly update an incident response plan to manage potential security breaches effectively.
• Develop a comprehensive strategy for patch management, including inventory, assessment, testing, and deployment.
• Implement proper network segmentation to protect critical assets from internet exposure.

Related