December 15, 2021

The Summary section was updated to include more confirmed impacted products and remove non-vulnerable products.

The Recommendation section was modified to recommend updating to log4j 2.16.0 as a related vulnerability was discovered in 2.15.0.

The content of the Mitigation sub-section was modified, and two more related vulnerabilities’ mitigations were added.

There is an authentication bypass vulnerability (CVE-2021-44515) in ManageEngine Desktop Central Product that has been exploited in the wild. Moreover, there is a patch released for (CVE-202144526), another authentication bypass vulnerability in ServiceDesk Plus (help desk application and asset management tool).

An attacker could bypass authentication and execute arbitrary code in the Desktop Central Product server and ServiceDesk Plus by exploiting mentioned vulnerability. 

As of October 2021, Google has updated Chrome to address high and critical vulnerabilities. The Stable channel has been updated to 95.0.4638.69 for Windows, Mac, and Linux. This update fixes two zeroday vulnerabilities numbered as CVE-2021-38000 and CVE-2021-38003.

As Google reports, the update will roll out over the coming days or weeks.

A path traversal and file disclosure vulnerability is found in Apache HTTP Server version 2.4.49. Reported vulnerability is exploited in wild and tracked as CVE-2021-41773. 

This vulnerability was introduced due to change made in path normalization in version 2.4.49.

An attacker could exploit this weakness to gain access to arbitrary files outside of the document root, as well as leak the source code of interpreted files like CGI scripts that may contain sensitive information.

Autodiscover is a protocol used by Microsoft Exchange for automatic configuration of clients such as Microsoft Outlook.

It has a design flaw that causes the protocol to “leak” web requests to Autodiscover domains outside of the user’s domain but in the same TLD (i.e. Autodiscover.com).

This is a severe security issue, since if an attacker can control such domains or has the ability to “sniff” traffic in the same network, they can capture domain credentials in plain text (HTTP basic authentication) that are being transferred over the wire.

The vulnerabilities, which are collectively referred to as “OMIGOD,” are found within OMI agents that are installed on Microsoft’s Azure Linux virtual machines (VMs) by default.

An unauthenticated, remote attacker can exploit the vulnerability (CVE-2021-38647) by sending a specially crafted request to a vulnerable host over a publicly accessible remote management port (ports 5986, 5985 and 1270). Successful exploitation would grant an attacker the ability to execute arbitrary code with root privileges on the vulnerable Linux VM. 

 In a security update of September 2021, Google issued security fixes for 11 flaws total, including two zero-day vulnerabilities that have already been exploited in the wild. The first, tracked as CVE-202130632, is described as an "out of bounds write in V8," an open-source JavaScript engine for Chrome. The second is being tracked as CVE-2021-30633 and affects the "use after free indexed DB application programming interface (API)."