Merge branch 'wagov:main' into main

docs/advisories/20240219001-SolarWinds-Releases-Patches-for-Access-Rights-Manager-vulnerabilities.md

@@ -0,0 +1,26 @@
+# SolarWinds Releases Patches for Vulnerabilities - 20240219001
+
+## Overview
+
+SolarWinds has patched five remote code execution (RCE) flaws in its Access Rights Manager (ARM) solution, including three critical severity vulnerabilities that allow unauthenticated exploitation.
+
+## What is vulnerable?
+
+| Product(s) Affected                                 | Summary                                                                                      | Severity     | CVSS |
+| --------------------------------------------------- | -------------------------------------------------------------------------------------------- | ------------ | ---- |
+| SolarWinds Access Rights Manager (ARM) **2023.2.2** | [CVE-2024-23476](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-23476) | **Critical** | 9.6  |
+| SolarWinds Access Rights Manager (ARM) **2023.2.2** | [CVE-2024-23479](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-23479) | **Critical** | 9.6  |
+| SolarWinds Access Rights Manager (ARM) **2023.2.2** | [CVE-2023-40057](https://www.solarwinds.com/trust-center/security-advisories/cve-2023-40057) | **Critical** | 9.0  |
+| SolarWinds Access Rights Manager (ARM) **2023.2.2** | [CVE-2024-23478](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-23478) | **High**     | 8.0  |
+| SolarWinds Access Rights Manager (ARM) **2023.2.2** | [CVE-2024-23477](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-23477) | **High**     | 7.9  |
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe (refer [Patch Management](../guidelines/patch-management.md)):
+
+- [SolarWinds Security Vulnerablities](https://www.solarwinds.com/trust-center/security-advisories)
+- [ARM 2023.2.3 Release Notes](https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-3_release_notes.htm)
+
+## Additional References
+
+- [SolarWinds fixes critical RCE bugs in access rights audit solution](https://www.bleepingcomputer.com/news/security/solarwinds-fixes-critical-rce-bugs-in-access-rights-audit-solution/)

docs/advisories/20240221001-VMware-EAP-vuln.md

@@ -0,0 +1,28 @@
+# Critical Vulnerability in Deprecated VMware EAP - 20240221001
+
+## Overview
+
+The VMware Enhanced Authentication Plug-in (EAP) contains an Arbitrary Authentication Relay vulnerability. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of **9.6**. There are no workarounds, if installed, the plug-in should be removed immediately.
+
+A malicious actor could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).
+
+## What is vulnerable?
+
+| Product(s) Affected                                            | Summary                                       | Severity     | CVSS |
+| -------------------------------------------------------------- | --------------------------------------------- | ------------ | ---- |
+| VMware Enhanced Authentication Plug-in (EAP) - **Any version** | Component is deprecated and should be removed | **Critical** | 9.6  |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of **48 hours** (refer [Patch Management](../guidelines/patch-management.md)):
+
+- [Removing the deprecated VMware Enhanced Authentication Plugin (EAP) to address CVE-2024-22245 and CVE-2024-22250](https://kb.vmware.com/s/article/96442)
+
+## Additional References
+
+- [VMware Secuity Advisory - VMSA-2024-0003](https://www.vmware.com/security/advisories/VMSA-2024-0003.html)
+- [BleepingComputer - VMware urges admins to remove deprecated, vulnerable auth plug-in](https://www.bleepingcomputer.com/news/security/vmware-urges-admins-to-remove-deprecated-vulnerable-auth-plug-in/)

docs/advisories/20240221002-Zyxel-security-advisory.md

@@ -0,0 +1,29 @@
+# Zyxel security advisory for multiple vulnerabilities in firewalls and APs - 20240221002
+
+## Overview
+
+Zyxel has released a security advisory relating to multiple vulnerabilities present in select firewall and access point models. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.
+
+## What is vulnerable?
+
+| Product(s) Affected                                             | Summary         | Severity                                                                                                                                                                | CVSS |
+| --------------------------------------------------------------- | --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- |
+| [CVE-2023-6397](https://www.cve.org/CVERecord?id=CVE-2023-6397) | Firewalls       | **[MEDIUM](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-6397&vector=AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1&source=Zyxel%20Corporation)** | 6.5  |
+| [CVE-2023-6398](https://www.cve.org/CVERecord?id=CVE-2023-6398) | Firewalls & APs | **[HIGH](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-6398&vector=AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H&version=3.1&source=Zyxel%20Corporation)**   | 7.2  |
+| [CVE-2023-6399](https://www.cve.org/CVERecord?id=CVE-2023-6399) | Firewalls       | **[MEDIUM](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-6399&vector=AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1&source=Zyxel%20Corporation)** | 5.7  |
+| [CVE-2023-6764](https://www.cve.org/CVERecord?id=CVE-2023-6764) | Firewalls       | **[HIGH](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-6764&vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1&source=Zyxel%20Corporation)**   | 8.1  |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *one month...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- [Zyxel security advisory for multiple vulnerabilities in firewalls and APs](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024)
+
+## Additional References
+
+- [Multiple vulnerabilities in Zyxel firewalls and APs](https://www.cybersecurity-help.cz/vdb/SB2024022031)
+- [Zyxel Security Vulnerabilities: DoS, Command Injection & More](https://securityonline.info/zyxel-security-vulnerabilities-dos-command-injection-more/)

docs/advisories/20240221003-Apache-Dolphinscheduler-RCE-Vulnerability.md

@@ -0,0 +1,25 @@
+# Apache Dolphinscheduler RCE Vulnerability - 20240221003
+
+## Overview
+
+Apache Software Foundation has disclosed an exposure of Remote Code Execution in Apache Dolphinscheduler.
+
+## What is vulnerable?
+
+| Product(s) Affected                               | CVE                                                                                                 | Severity | CVSS |
+| ------------------------------------------------- | --------------------------------------------------------------------------------------------------- | -------- | ---- |
+| Apache DolphinScheduler **versions before 3.2.1** | [CVE-2023-49109](https://nvd.nist.gov/vuln/detail/CVE-2023-49109) <br/> currently awaiting analysis | **N/A**  | N/A  |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *one month* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- [Apache Vendor Advisory](https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8)
+
+## Additional References
+
+- [OSS Security](https://www.openwall.com/lists/oss-security/2024/02/20/4)

docs/advisories/20240221004-ConnectWise-Patches-Critical-ScreenConnect-Vulnerability.md

@@ -0,0 +1,25 @@
+# CISA Adds ConnectWise ScreenConnect Known Exploited Vulnerability - 20240221004
+
+## Overview
+
+ConnectWise ScreenConnect reports two critical vulnerability with one being exploited. The vulnerability could allow the ability to execute remote code or directly impact confidential data or critical systems.
+
+## What is vulnerable?
+
+| Product(s) Affected                                                                                                                        | CVE                                                             | Severity     | CVSS | Updated    | Exploited |
+| ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------------ | ---- | ---------- | --------- |
+| ConnectWise ScreenConnect **versions before 23.9.7** affected by path-traversal vulnerability                                              | [CVE-2024-1708](https://nvd.nist.gov/vuln/detail/CVE-2024-1708) | **High**     | 8.4  | 22/02/2024 | No        |
+| ConnectWise ScreenConnect **versions before 23.9.7** affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability | [CVE-2024-1709](https://nvd.nist.gov/vuln/detail/CVE-2024-1709) | **Critical** | 10.0 | 22/02/2024 | Yes       |
+
+## What has been observed?
+
+CISA added this vulnerability in their [Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) catalog. There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendations
+
+The WA SOC recommends agencies to upgrade to version 23.9.8 and proactively engage with vendor management/supply chain on the patch of these services. (refer [Patch Management](../guidelines/patch-management.md)):
+
+## Additional References
+
+- [**ConnectWise Security Bullentin**](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8)
+- [Huntress Blogs](https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass)

docs/advisories/20240222001-Mozilla-Firefox-Thunderbird-Security-Updates.md

@@ -0,0 +1,23 @@
+# Mozilla Releases Security Updates for Firefox and Thunderbird - 20240222001
+
+## Overview
+
+Mozilla released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system.
+
+## What is vulnerable?
+
+- [MFSA 2024-05 for Firefox](https://www.mozilla.org/en-US/security/advisories/mfsa2024-05/)
+- [MFSA 2024-06 for Firefox ESR](https://www.mozilla.org/en-US/security/advisories/mfsa2024-06/)
+- [MFSA 2024-07 for Thunderbird](https://www.mozilla.org/en-US/security/advisories/mfsa2024-07/)
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *two weeks...* (refer [Patch Management](../guidelines/patch-management.md)).
+
+## Additional References
+
+- [CISA: Mozilla Releases Security Updates for Firefox and Thunderbird ](https://www.cisa.gov/news-events/alerts/2024/02/21/mozilla-releases-security-updates-firefox-and-thunderbird)

docs/advisories/20240223001-Progress-Kemp-products-vulnerability.md

@@ -0,0 +1,27 @@
+# Critical Vulnerability in Progress Kemp products - 20240223001
+
+## Overview
+
+The WA SOC has been made aware of a critical vulnerability in Progress Kemp products that allows unauthenticated, remote attackers who have access to the management interface of LoadMaster to issue a crafted API command that will allow execution of arbitrary system commands. This also impacts Progress Kemp’s ECS Connection Manager Product.
+
+## What is vulnerable?
+
+| Product(s) Affected                                                                                                                                                                                                             | CVE                                                             | Severity     | CVSS |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | ------------ | ---- |
+| Progress Kemp Loadmaster Version **from** 7.2.48.1 **before** 7.2.48.10 <br> Progress Kemp Loadmaster Version **from** 7.2.54.0 **before** 7.2.54.8 <br> Progress Kemp Loadmaster Version **from** 7.2.55.0 **before** 7.2.59.2 | [CVE-2024-1212](https://nvd.nist.gov/vuln/detail/CVE-2024-1212) | **Critical** | 10.0 |
+| ECS Content Manager Version **before** 7.2.59.2                                                                                                                                                                                 | [CVE-2024-1212](https://nvd.nist.gov/vuln/detail/CVE-2024-1212) | **Critical** | 10.0 |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *one month.* (refer [Patch Management](../guidelines/patch-management.md))
+
+- https://support.kemptechnologies.com/hc/en-us/articles/23901649582477-ECS-Connection-Manager-Security-Vulnerability-CVE-2024-1212
+
+## Additional References
+
+- [ACSC Alert](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/vulnerability-in-progress-kemp-products)
+- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2024-1212)

docs/advisories/20240223002-Zero-Click-Apple-Shortcuts-Vulnerability.md

@@ -0,0 +1,22 @@
+# Zero-Click Apple Shortcuts Vulnerability - 20240223002
+
+## Overview
+
+Apple iOS released a number of vulnerabilities that could potentially execute arbitrary code on Apple products. Apple was made aware of a report indicating potential exploitation of this vulnerability.
+
+## What is vulnerable?
+
+| Product(s) Affected                                                                                                                                                                          | CVE                                                                   | Severity | CVSS    | Exploit exists |
+| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | -------- | ------- | -------------- |
+| **versions before <br> tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, <br> Safari 17.3, macOS Ventura 13.6.4, macOS Monterey 12.7.3, visionOS 1.0.2** | **[CVE-2024-23222](https://nvd.nist.gov/vuln/detail/CVE-2024-23222)** | **High** | **8.8** | Yes            |
+| **versions before <br> macOS Sonoma 14.3, watchOS 10.3, iOS 17.3 and iPadOS 17.3**                                                                                                           | **[CVE-2024-23204](https://nvd.nist.gov/vuln/detail/CVE-2024-23204)** | **High** | **7.5** | No             |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *one month...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- [Apple security releases](https://support.apple.com/en-us/HT201222)