Sophos fixes critical firewall hole exploited by miscreants
(2022/09/28)
- Reference: 1664325337
- News link: https://www.theregister.co.uk/2022/09/28/sophos_firewall_code_injection/
- Source link:
A critical code-injection vulnerability in Sophos Firewall has been fixed — but not before miscreants found and exploited the bug.
The flaw, tracked as CVE-2022-3236, exists in the User Portal and Webadmin components of the firewall in versions 19.0 and older. While it hasn't been issued a CVSS severity score, Sophos deemed it "critical" and noted that it allowed for remote code execution.
"Sophos has observed this vulnerability being used to target a small set of specific organizations, primarily in the South Asia region," the vendor noted in an [1]advisory this month. "We have informed each of these organizations directly."
[2]
The British security software vendor issued hotfixes for supported versions (v17.0 through v19.0) last week, and also provided a workaround, which included [3]disabling WAN access to the User Portal and Webadmin.
[4]
[5]
Sophos also said it's continuing to investigate, and will provide additional details at a later date.
As of Tuesday, the security shop's blogs, which regularly detail vulnerabilities and exploits affecting other software vendors, hadn't mentioned its own critical firewall bug.
[6]
Other software vendors and security researchers, however, did [7]weigh in on the Sophos bug, with one warning that there's a "high" chance of mass exploitation. At least 28 of CISA's [8]Known Exploited Vulnerabilities involve code injection, Immanuel Chavoya [9]tweeted :
🚨 RCE In Sophos Firewall exploited in the wildCVE-2022-3236This has a HIGH chance of mass exploitation, given the vulnerability is based on Code Injection (CWE-94) and if we look at the [10]#CISA KEVs, at least 28 of those are Code Injection related... [11]https://t.co/TUtBLbBeRQ [12]pic.twitter.com/MgzXCWwgwr — Immanuel Chavoya (@FullM3talPacket) [13]September 23, 2022
And while Sophos hasn't yet said who it believes exploited the bug to target South Asian organizations, [14]Chinese state-sponsored criminals were behind earlier attacks this year that involved a critical flaw in Sophos Firewall.
[15]Check out this Android spyware, says Microsoft, the home of a gazillion Windows flaws
[16]Fake sites fool Zoom users into downloading deadly code
[17]China's infosec researchers obeyed Beijing and stopped reporting vulns ... or did they?
[18]Five Eyes nations reveal 2021's fifteen most-exploited flaws
Just last week, Recorded Future published [19]research on multiple campaigns it attributed to Beijing-linked crews, who were seen abusing a programming error in Sophos Firewall that the software vendor [20]fixed in April.
That earlier critical remote code execution vulnerability, tracked as CVE-2022-1040, was also used to target South Asian organizations. According to Recorded Future, at least three Chinese state-sponsored groups exploited this bug to gain initial unauthorized access into victims' networks.
Sophos, in its own [21]investigation published in June, reported at least two advanced persistent threat groups exploited CVE-2022-1040 before it was able to issue a patch. The flaw had been used to deploy malware on infected devices.
The software nasty, among other nefarious activities, allowed the attackers to install backdoor tools and steal sensitive data; write, read and manipulate files and settings on compromised devices; and, in some cases, gain complete control over the environment in which it was running. ®
Get our [22]Tech Resources
[1] https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YzPG3jxBq1kaPnVOVDbtcAAAAJg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Administration/DeviceAccess/index.html
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YzPG3jxBq1kaPnVOVDbtcAAAAJg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YzPG3jxBq1kaPnVOVDbtcAAAAJg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YzPG3jxBq1kaPnVOVDbtcAAAAJg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://twitter.com/AWNetworks/status/1574469213657468943
[8] https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[9] https://twitter.com/FullM3talPacket/status/1573372001104068608
[10] https://twitter.com/hashtag/CISA?src=hash&ref_src=twsrc%5Etfw
[11] https://t.co/TUtBLbBeRQ
[12] https://t.co/MgzXCWwgwr
[13] https://twitter.com/FullM3talPacket/status/1573372001104068608?ref_src=twsrc%5Etfw
[14] https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/
[15] https://www.theregister.com/2022/09/22/microsoft_android_spyware_endpoint/
[16] https://www.theregister.com/2022/09/22/zoom_malware_infosteal_cyble/
[17] https://www.theregister.com/2022/09/27/atlantic_council_china_vuln_research/
[18] https://www.theregister.com/2022/04/28/most_exploited_vulnerabilities_2021/
[19] https://www.recordedfuture.com/chinese-state-sponsored-group-ta413-adopts-new-capabilities-in-pursuit-of-tibetan-targets
[20] https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce
[21] https://news.sophos.com/en-us/2022/06/15/sophos-uncovers-how-apt-groups-carried-out-highly-targeted-attack/
[22] https://whitepapers.theregister.com/
The flaw, tracked as CVE-2022-3236, exists in the User Portal and Webadmin components of the firewall in versions 19.0 and older. While it hasn't been issued a CVSS severity score, Sophos deemed it "critical" and noted that it allowed for remote code execution.
"Sophos has observed this vulnerability being used to target a small set of specific organizations, primarily in the South Asia region," the vendor noted in an [1]advisory this month. "We have informed each of these organizations directly."
[2]
The British security software vendor issued hotfixes for supported versions (v17.0 through v19.0) last week, and also provided a workaround, which included [3]disabling WAN access to the User Portal and Webadmin.
[4]
[5]
Sophos also said it's continuing to investigate, and will provide additional details at a later date.
As of Tuesday, the security shop's blogs, which regularly detail vulnerabilities and exploits affecting other software vendors, hadn't mentioned its own critical firewall bug.
[6]
Other software vendors and security researchers, however, did [7]weigh in on the Sophos bug, with one warning that there's a "high" chance of mass exploitation. At least 28 of CISA's [8]Known Exploited Vulnerabilities involve code injection, Immanuel Chavoya [9]tweeted :
🚨 RCE In Sophos Firewall exploited in the wildCVE-2022-3236This has a HIGH chance of mass exploitation, given the vulnerability is based on Code Injection (CWE-94) and if we look at the [10]#CISA KEVs, at least 28 of those are Code Injection related... [11]https://t.co/TUtBLbBeRQ [12]pic.twitter.com/MgzXCWwgwr — Immanuel Chavoya (@FullM3talPacket) [13]September 23, 2022
And while Sophos hasn't yet said who it believes exploited the bug to target South Asian organizations, [14]Chinese state-sponsored criminals were behind earlier attacks this year that involved a critical flaw in Sophos Firewall.
[15]Check out this Android spyware, says Microsoft, the home of a gazillion Windows flaws
[16]Fake sites fool Zoom users into downloading deadly code
[17]China's infosec researchers obeyed Beijing and stopped reporting vulns ... or did they?
[18]Five Eyes nations reveal 2021's fifteen most-exploited flaws
Just last week, Recorded Future published [19]research on multiple campaigns it attributed to Beijing-linked crews, who were seen abusing a programming error in Sophos Firewall that the software vendor [20]fixed in April.
That earlier critical remote code execution vulnerability, tracked as CVE-2022-1040, was also used to target South Asian organizations. According to Recorded Future, at least three Chinese state-sponsored groups exploited this bug to gain initial unauthorized access into victims' networks.
Sophos, in its own [21]investigation published in June, reported at least two advanced persistent threat groups exploited CVE-2022-1040 before it was able to issue a patch. The flaw had been used to deploy malware on infected devices.
The software nasty, among other nefarious activities, allowed the attackers to install backdoor tools and steal sensitive data; write, read and manipulate files and settings on compromised devices; and, in some cases, gain complete control over the environment in which it was running. ®
Get our [22]Tech Resources
[1] https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YzPG3jxBq1kaPnVOVDbtcAAAAJg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Administration/DeviceAccess/index.html
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YzPG3jxBq1kaPnVOVDbtcAAAAJg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YzPG3jxBq1kaPnVOVDbtcAAAAJg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YzPG3jxBq1kaPnVOVDbtcAAAAJg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://twitter.com/AWNetworks/status/1574469213657468943
[8] https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[9] https://twitter.com/FullM3talPacket/status/1573372001104068608
[10] https://twitter.com/hashtag/CISA?src=hash&ref_src=twsrc%5Etfw
[11] https://t.co/TUtBLbBeRQ
[12] https://t.co/MgzXCWwgwr
[13] https://twitter.com/FullM3talPacket/status/1573372001104068608?ref_src=twsrc%5Etfw
[14] https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/
[15] https://www.theregister.com/2022/09/22/microsoft_android_spyware_endpoint/
[16] https://www.theregister.com/2022/09/22/zoom_malware_infosteal_cyble/
[17] https://www.theregister.com/2022/09/27/atlantic_council_china_vuln_research/
[18] https://www.theregister.com/2022/04/28/most_exploited_vulnerabilities_2021/
[19] https://www.recordedfuture.com/chinese-state-sponsored-group-ta413-adopts-new-capabilities-in-pursuit-of-tibetan-targets
[20] https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce
[21] https://news.sophos.com/en-us/2022/06/15/sophos-uncovers-how-apt-groups-carried-out-highly-targeted-attack/
[22] https://whitepapers.theregister.com/