EMC Patches Serious Flaws in Data Protection Suite

EMC has released security fixes for three vulnerabilities that, when combined, can be used to take full control of products from its Data Protection Suite: the Avamar Server, the NetWorker Virtual Edition and the Integrated Data Protection Appliance.

All three products contain a component called the Avamar Installation Manager (AVI), which is vulnerable to the flaws found by researchers from Digital Defense. One of the vulnerabilities allows for authentication to be bypassed and the other two allow for arbitrary file access and file uploads with root privileges.

“All three vulnerabilities can be combined to fully compromise the virtual appliance by modifying the sshd_config file to allow root login, uploading a new authorized_keys file for root, and a web shell to restart the SSH service,” the Digital Defense researchers said in a blog post. “The web shell can also run commands with the same privileges as the ‘admin’ user.”

The affected products are Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4. x, 7.5.0; NetWorker Virtual Edition 0.x, 9.1.x, 9.2.x and Integrated Data Protection Appliance 2.0. EMC has released an advisory for customers with support contracts.

Apple Devices Are Protected Against Meltdown, But Not Yet Against Spectre

Apple had already released software updates to protect Mac and iOS devices against the Meltdown attack that affects Intel processors before it became public this week. However, the devices have not yet been patched against Spectre, a related attack that could allow attackers to steal secrets from applications.

“All Mac systems and iOS devices are affected, but there are no known exploits impacting customers at this time,” Apple said in a support document. “Since exploiting many of these issues requires a malicious app to be loaded on your Mac or iOS device, we recommend downloading software only from trusted sources such as the App Store.”

A defense against Meltdown, which can be exploited by malicious apps to access information from the kernel’s memory, was included in macOS 10.13.2, iOS 11.2 and tvOS 11.2, which were released in early December.

The company plans to include defenses against Spectre, which can be exploited through JavaScript, in the Safari browser for macOS and iOS over the coming days. The performance impact of the patches will be less than 2.5%, so it won’t be noticeable.

“We continue to develop and test further mitigations within the operating system for the Spectre techniques, and will release them in upcoming updates of iOS, macOS, tvOS, and watchOS,” Apple said.

Word Feature Can Be Abused to Steal Credentials

Security researchers from Rhino Security Labs have found that a little-known Microsoft Word feature can be abused to phish credentials and automatically steal NTLMv2 authentication hashes.

The feature is called subDoc and allows users to load information from one document directly into the body of another document. It is supported in all Microsoft Word versions since 2007.

The Rhino researchers found that subDoc can be used to display a credible Windows-style authentication prompt that could trick users into inputting their login credentials. A very similar phishing technique has been used in the past through another Word feature called attachedTemplate.

However, it turns out that subDoc can load content from a document hosted on a remote server on the internet and this can be used to force the document to make an SMB request when opened.

“We’ve found some organizations are not filtering egress SMB requests, and therefore would leak the NTLMv2 hash in the initial SMB request,” Rhino researcher Hector Monsegur said in a blog post.

Monsegur has created a proof-of-concept tool called the SubDoc Injector that can be used to include a user-defined URL into a parent document so that an SMB request is triggered when the document is opened. The attacker the only has to run a listener program on the remote server in order to harvest the NTLMv2 hashes.

Featured eBook
The State of Security RSA Special Report

The State of Security RSA Special Report

The big trends shaping cybersecurity today. Security teams face enormous challenges. Not only from attackers who are always looking for new ways to get to their applications and data, but also the constant evolution of the very technologies security professionals must defend. This complimentary download is offered by Security Boulevard. Download Now ... Read More
Security Boulevard

Lucian Constantin

Lucian has been covering computer security and the hacker culture for almost a decade, his work appearing in many technology publications including PCWorld, Computerworld, Network World, CIO, CSO, Forbes and The Inquirer. He has a bachelor's degree in political science, but has been passionate about computers and cybersecurity from an early age. Before he chose a career in journalism, Lucian worked as a system and network administrator. He enjoys attending security conferences and delving into interesting research papers. You can reach him at lucian@constantinsecurity.com or @lconstantin on Twitter. For encrypted email, his PGP key's fingerprint is: 7A66 4901 5CDA 844E 8C6D 04D5 2BB4 6332 FC52 6D42

lucian-constantin has 184 posts and counting.See all posts by lucian-constantin