Merge branch 'main' into main

LSerki · Feb 1, 2024 · a25275e · a25275e
2 parents f0e8cc7 + 5e89f96
commit a25275e
Show file tree

Hide file tree

Showing 3 changed files with 32 additions and 4 deletions.
diff --git a/docs/advisories/20240131002-Mitigation-Defend-Against-Exploitation-of-Ivanti.md b/docs/advisories/20240131002-Mitigation-Defend-Against-Exploitation-of-Ivanti.md
@@ -1,8 +1,8 @@
-# New Mitigations to Defend Against Exploitation of Ivanti Connect Secure and Policy Secure Gateways - 20240131002
+# Updated Mitigations to Defend Against Exploitation of Ivanti services - 20240131002
 
 ## Overview
 
-CISA has released new mitigations to defend against threat actors exploiting Ivanti Connect Secure and Policy Secure Gateways vulnerabilities in Ivanti devices ([CVE-2023-46805](https://nvd.nist.gov/vuln/detail/CVE-2023-46805) and [CVE-2024-21887](https://nvd.nist.gov/vuln/detail/CVE-2024-21887)).
+CISA has released new mitigations to defend against threat actors exploiting Ivanti Connect Secure and Policy Secure Gateways vulnerabilities in Ivanti devices [CVE-2023-46805](https://nvd.nist.gov/vuln/detail/CVE-2023-46805) and [CVE-2024-21887](https://nvd.nist.gov/vuln/detail/CVE-2024-21887).
 
 ## What is vulnerable?
 

diff --git a/docs/advisories/20240131003-Microsoft-Security-Updates.md b/docs/advisories/20240131003-Microsoft-Security-Updates.md
@@ -0,0 +1,28 @@
+# Microsoft Security Updates - 20240131003
+
+## Overview
+
+Microsoft has released security updates that addresses vulnerabilities in two of their products with security feature bypass vulnerability. An attacker could exploit this by creating a specially crafted X.509 certificate that intentionally introduce or intentionally induces a chain building failure.
+
+## What is vulnerable?
+
+| Product(s) Affected                                                                                                                | Summary                                                                                                                                                                                                                                | Severity     | CVSS |
+| ---------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ---- |
+| [Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056) | Security Feature Bypass vulnerability. An attacker who successfully exploited this vulnerability could carry out a machine-in-the-middle (MITM) attack and could decrypt and read or modify TLS traffic between the client and server. | **High**     | 8.7  |
+| [NET, .NET Framework, and Visual Studio](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057)                      | Security Feature Bypass Vulnerability. An attacker could exploit this by creating a specially crafted X.509 certificate that intentionally introduce or intentionally induces a chain building failure.                                | **Critical** | 9.8  |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *one month* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- [Microsoft security update guide CVE-2024-0056 ](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056)
+- [Microsoft security update guide CVE-2024-0057](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057)
+
+## Additional References
+
+- [NIST vulnerability CVE-2024-0056](https://nvd.nist.gov/vuln/detail/CVE-2024-0056)
+- [NIST vulnerability CVE-2024-0057](https://nvd.nist.gov/vuln/detail/CVE-2024-0057)
diff --git a/docs/markdown-templates/Advisory-vulnerability.md b/docs/markdown-templates/Advisory-vulnerability.md
@@ -1,8 +1,8 @@
-## \[Advisory Title\] - 2024MMDD000
+# \[Advisory Title\] - 2024MMDD000
 
 ## Overview
 
-The WA SOC has observed…
+The WA SOC has been made aware…
 
 Describe the threat to organisation's application/ environment/ security/ operational continuity