ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Nov 9, 2023 · ZeroDay Catalog

    Critical Path Traversal Vulnerability in SysAid Server

    A significant path traversal vulnerability has been identified in SysAid Server, allowing potential code execution through file manipulation.

    What changed

    A path traversal vulnerability has been discovered in SysAid On-Premise versions prior to 23.3.36. This flaw allows attackers to write files to the Tomcat webroot, which can lead to unauthorized code execution.

    The vulnerability has been actively exploited in the wild since November 2023, highlighting the urgency for affected users to take immediate action.

    Who is affected

    Organizations using SysAid On-Premise versions earlier than 23.3.36 are at risk due to this vulnerability. The following groups should be particularly vigilant:

    IT departments managing SysAid installations, security teams monitoring for potential breaches, and any users relying on SysAid for IT service management.

    • SysAid On-Premise users prior to version 23.3.36
    • IT departments utilizing SysAid for service management
    • Organizations with exposed web applications relying on Tomcat

    What to do

    It is critical for affected organizations to upgrade their SysAid installations to version 23.3.36 or later immediately. This update addresses the path traversal vulnerability and mitigates the risk of exploitation.

    Additionally, security teams should conduct a thorough review of logs and access patterns to identify any unauthorized activity that may have occurred due to this vulnerability.

    • Upgrade to SysAid On-Premise version 23.3.36 or later
    • Review security logs for suspicious activity
    • Implement additional security measures to protect web applications

    Original report

  2. Nov 6, 2023 · ZeroDay Catalog

    Performance Issues with X9.42 DH Key Generation and Validation

    Applications utilizing X9.42 DH key generation and validation functions may face significant performance delays, potentially leading to Denial of Service scenarios.

    What changed

    Recent findings indicate that generating or validating excessively long X9.42 Diffie-Hellman (DH) keys can result in substantial performance degradation. This issue arises when applications utilize specific functions for key generation and validation.

    Functions such as DH_generate_key(), DH_check_pub_key(), DH_check_pub_key_ex(), and EVP_PKEY_public_check() are particularly affected, leading to potential Denial of Service (DoS) conditions.

    Who is affected

    The performance issues primarily impact applications that rely on the X9.42 DH key generation and validation processes. This includes a wide range of software solutions across various sectors.

    Organizations using cryptographic libraries that implement these functions may experience significant slowdowns, especially when handling keys or parameters from untrusted sources.

    • Developers using cryptographic libraries that implement X9.42 DH standards.
    • Organizations that depend on secure key exchange mechanisms in their applications.
    • Service providers offering cryptographic services or APIs utilizing DH key generation.
    • Any entity that processes X9.42 DH keys from untrusted sources.

    What to do

    To mitigate the impact of these performance issues, security operators should review their applications for reliance on the affected DH functions. Implementing checks on key lengths and sources can help prevent potential DoS scenarios.

    Consider updating or patching cryptographic libraries to ensure they handle key generation and validation more efficiently.

    • Evaluate the use of DH_generate_key() and related functions in your applications.
    • Implement input validation to restrict excessively long keys or parameters.
    • Monitor application performance and response times to identify potential slowdowns.
    • Stay informed about updates from cryptographic library vendors regarding performance improvements.

    Original report