Resumo Semanal 2021.04 – Alertas e Recomendações de Cibersegurança

Em retrospectiva, esteja a par dos principais alertas e recomendações de segurança emitidos durante a última semana e adopte as medidas correctivas para salvaguardar os seus sistemas.

Alertas emitidos entre 25 à 31 de Janeiro de 2021

Adobe (01), Amazon Linux (10), CentOS (04), Cisco (03), Debian (17), Druide Antidote (01), Fedora (02), Gentoo Linux (01), GnuPG (01), Gpg4win (01), IBM (01), Mozilla (03), NeoMutt (01), Node.js (02), OpenSUSE (02), Oracle (04), Oracle Enterprise Linux (03), PeerCast (01), PHP (01), Red Hat (08), Sudo (01), SUSE (15), Ubuntu (05)

Adobe

(Total: 01)

Criticidade: Média

Adobe Captivate Privilege Escalation Vulnerability(APSB21-06)

CVE-2021-21011

Amazon Linux

(Total: 10)

Criticidade: Média

Amazon Linux Security Advisory for python-rtslib: ALAS2-2021-1589

CVE-2020-14019

Amazon Linux Security Advisory for dnsmasq: ALAS2-2021-1587

CVE-2020-25684,CVE-2020-25685,CVE-2020-25686

Amazon Linux Security Advisory for targetcli: ALAS2-2021-1591

CVE-2020-13867

Criticidade: Alta

Amazon Linux Security Advisory for sudo: ALAS2-2021-1590 (Baron Samedit)

CVE-2021-3156

Amazon Linux Security Advisory for sudo: ALAS-2021-1478 (Baron Samedit)

CVE-2021-3156

Amazon Linux Security Advisory for xstream: ALAS2-2021-1593

CVE-2020-26217

Amazon Linux Security Advisory for xorg-x11-server: ALAS2-2021-1592

CVE-2020-14347,CVE-2020-14360,CVE-2020-25712

Amazon Linux Security Advisory for kernel: ALAS2-2021-1588

CVE-2019-19813,CVE-2019-19816,CVE-2020-27815,CVE-2020-29568,

CVE-2020-29569,CVE-2020-29660,CVE-2020-29661

Amazon Linux Security Advisory for sudo: AL2012-2021-335 (Baron Samedit)

CVE-2021-3156

Criticidade: Crítica

Amazon Linux Security Advisory for thunderbird: ALAS2-2021-1594

CVE-2020-16044

CentOS

(Total:04)

Criticidade: Alta

CentOS Security Update for net-snmp (CESA-2020:5350)

CVE-2020-15862

CentOS Security Update for xstream (CESA-2021:0162)

CVE-2020-26217

CentOS Security Update for dnsmasq (CESA-2021:0153)

CVE-2020-25684,CVE-2020-25685,CVE-2020-25686

CentOS Security Update for sudo Security Update (CESA-2021:0221)(Baron Samedit)

CVE-2021-3156

Cisco

(Total: 03)

Criticidade: Média

Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability(cisco-sa-vmanage-cql-inject-72EhnUc)

CVE-2021-1349

Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability(cisco-sa-wsa-xss-RuB5WGqL)

CVE-2021-1271

Cisco SD-WAN Information Disclosure Vulnerability(cisco-sa-sdwan-infodis-2-UPO232DG)

CVE-2021-1233

Debian

(Total: 17)

Criticidade: Baixa

Debian Security Update for python-apt (DLA 2488-1)

CVE-2020-27351

Criticidade: Média

Debian Security Update for libzypp (DLA 2132-1)

CVE-2019-18900

Debian Security Update for tika (DLA 2161-1)

CVE-2020-1950,CVE-2020-1951

Debian Security Update for gst-plugins-base0.10 (DLA 2126-1)

CVE-2016-9811,CVE-2017-5837,CVE-2017-5844

Debian Security Update for openssl1.0 (DLA 2378-1)

CVE-2020-1968

Debian Security Update for ruby-gon (DLA 2380-1)

CVE-2020-25739

Debian Security Update for flac (DLA 2514-1)

CVE-2017-6888,CVE-2020-0499

Debian Security Update for golang-websocket (DLA 2520-1)

CVE-2020-27813

Debian Security Update for vlc (DSA 4834-1)

CVE-2020-26664

Debian Security Update for tomcat9 (DSA 4835-1)

CVE-2020-13943,CVE-2020-17527

Debian Security Update for openvswitch (DSA 4836-1)

CVE-2015-8011,CVE-2020-27827

Debian Security Update for salt (DSA 4837-1)

CVE-2020-16846,CVE-2020-17490,CVE-2020-25592

Debian Security Update for mutt (DSA 4838-1)

CVE-2021-3181

Criticidade: Alta

Debian Security Update for tzdata (DLA 2424-1)

(em branco)

Debian Security Update for libonig (DLA 2431-1)

CVE-2019-13224,CVE-2019-16163,CVE-2019-19012,CVE-2019-19203,

CVE-2019-19204,CVE-2019-19246,CVE-2020-26159,CVE-2019-13224,

CVE-2019-16163,CVE-2019-19012,CVE-2019-19203,CVE-2019-19204,

CVE-2019-19246,CVE-2020-26159

Debian Security Update for sudo (DSA 4839-1) (Baron Samedit)

CVE-2021-3156

Debian Security Update for sudo (DLA 2534-1)(Baron Samedit)

CVE-2021-3156

Druide Antidote

(Total: 01)

Criticidade: Crítica

Druide Antidote Remote Code Execution Vulnerability

CVE-2018-13140

Fedora

(Total: 02)

Criticidade: Alta

Fedora Security Update for sudo (FEDORA-2021-8840cbdccd)(Baron Samedit)

CVE-2021-3156,CVE-2021-23239

Fedora Security Update for sudo (FEDORA-2021-2cb63d912a)(Baron Samedit)

CVE-2021-3156

Gentoo Linux

(Total: 01)

Criticidade: Alta

Gentoo Linux Sudo Multiple Vulnerabilities (GLSA 202101-33) (Baron Samedit)

CVE-2021-23239,CVE-2021-23240,CVE-2021-3156,CVE-2020-23240

GnuPG

(Total: 01)

Criticidade: Média

GnuPG Array Overflow Vulnerability

CVE-2020-25125

Gpg4win

(Total: 01)

Criticidade: Média

Gpg4win Array Overflow Vulnerability

CVE-2020-25125

IBM

(Total: 01)

Criticidade: Média

IBM DB2 Denial of Service Vulnerability

CVE-2020-4642

Mozilla

(Total: 03)

Criticidade: Alta

Mozilla Firefox ESR Multiple Vulnerabilities (MFSA2021-04)

CVE-2021-23953,CVE-2021-23954,CVE-2020-26976,CVE-2021-23960,

CVE-2021-23964

Mozilla Thunderbird Multiple Vulnerabilities (MFSA2021-05)

CVE-2021-23953,CVE-2021-23954,CVE-2020-15685,CVE-2020-26976,

CVE-2021-23960,CVE-2021-23964

Mozilla Firefox Multiple Vulnerabilities (MFSA2021-03)

CVE-2021-23953,CVE-2021-23954,CVE-2021-23955,CVE-2021-23956,

CVE-2021-23957,CVE-2021-23958,CVE-2021-23959,CVE-2021-23960,

CVE-2021-23961,CVE-2021-23962,CVE-2021-23963,CVE-2021-23964,

CVE-2021-23965

NeoMutt

(Total: 01)

Criticidade: Média

NeoMutt Man In The Middle Vulnerability

CVE-2020-28896

Node.js

(Total: 02)

Criticidade: Média

Node.js OpenSSL Vulnerability

CVE-2020-1971

Node.js Multiple Vulnerabilities

CVE-2020-8287,CVE-2020-8265

OpenSUSE

(Total: 02)

Criticidade: Alta

OpenSUSE Security Update for sudo (openSUSE-SU-2021:0169-1) (Baron Samedit)

CVE-2021-23239,CVE-2021-23240,CVE-2021-3156

OpenSUSE Security Update for sudo (openSUSE-SU-2021:0170-1) (Baron Samedit)

CVE-2021-23239,CVE-2021-23240,CVE-2021-3156

Oracle

(Total: 04)

Criticidade: Média

CVE-2020-12912,CVE-2020-29534

Oracle VM VirtualBox Multiple Vulnerabilities(CPUJAN2021)

CVE-2021-2074,CVE-2021-2129,CVE-2021-2128,CVE-2021-2086,

CVE-2021-2111,CVE-2021-2112,CVE-2021-2121,CVE-2021-2124,

CVE-2021-2119,CVE-2021-2120,CVE-2021-2126,CVE-2021-2131,

CVE-2021-2125,CVE-2021-2073,CVE-2021-2127,CVE-2021-2130,

CVE-2021-2123

Criticidade: Alta

Oracle VM Server for x86 Security Update for sudo (OVMSA-2021-0003)(Baron Samedit)

CVE-2021-3156

Criticidade: Crítica

Oracle Solaris PAM Remote Code Execution Vulnerability (Unauthenticated check)

CVE-2020-14871

Oracle Enterprise Linux

(Total: 03)

Criticidade: Alta

Oracle Enterprise Linux Security Update for sudo (ELSA-2021-0221)(Baron Samedit)

CVE-2021-3156

Oracle Enterprise Linux Security Update for sudo (ELSA-2021-0218)(Baron Samedit)

CVE-2021-3156

Oracle Enterprise Linux Security Update for sudo (ELSA-2021-9019)(Baron Samedit)

CVE-2021-3156

PeerCast

(Total: 01)

Criticidade: Crítica

PeerCast Heap Buffer Overflow Vulnerability

CVE-2007-6454

PHP

(Total: 01)

Criticidade: Média

PHP Input Validation Error Vulnerability

CVE-2020-7071

Red Hat

(Total: 08)

Criticidade: Alta

Red Hat Update for sudo (RHSA-2021:0218)(Baron Samedit)

CVE-2021-3156

Red Hat Update for sudo (RHSA-2021:0219)(Baron Samedit)

CVE-2021-3156

Red Hat Update for sudo (RHSA-2021:0220)(Baron Samedit)

CVE-2021-3156

Red Hat Update for sudo (RHSA-2021:0221)(Baron Samedit)

CVE-2021-3156

Red Hat Update for sudo (RHSA-2021:0222)(Baron Samedit)

CVE-2021-3156

Red Hat Update for sudo (RHSA-2021:0223)(Baron Samedit)

CVE-2021-3156

Red Hat Update for sudo (RHSA-2021:0227)(Baron Samedit)

CVE-2021-3156

Criticidade: Crítica

EOL/Obsolete Software: JBoss Enterprise Application Platform (EAP) 6.x Detected

(em branco)

Sudo

(Total: 01)

Criticidade: Alta

Sudo Heap-based Buffer Overflow Vulnerability (Baron Samedit) (Generic)

CVE-2021-3156

SUSE

(Total: 15)

Criticidade: Média

SUSE Enterprise Linux Security Update for perl-Convert-ASN1 (SUSE-SU-2021:0183-1)

CVE-2013-7488

SUSE Enterprise Linux Security Update for gdk-pixbuf (SUSE-SU-2021:0184-1)

CVE-2020-29385

SUSE Enterprise Linux Security Update for wavpack (SUSE-SU-2021:0186-1)

CVE-2018-10536,CVE-2018-10537,CVE-2018-10538,CVE-2018-10539,

CVE-2018-10540,CVE-2018-19840,CVE-2018-19841,CVE-2018-6767,

CVE-2018-7253,CVE-2018-7254,CVE-2019-1010319,CVE-2019-11498,

CVE-2020-35738

SUSE Enterprise Linux Security Update for stunnel (SUSE-SU-2021:0194-1)

(em branco)

SUSE Enterprise Linux Security Update for mutt (SUSE-SU-2021:0195-1)

CVE-2021-3181

SUSE Enterprise Linux Security Update for mutt (SUSE-SU-2021:0196-1)

CVE-2021-3181

SUSE Enterprise Linux Security Update for permissions (SUSE-SU-2021:0197-1)

CVE-2020-8025

SUSE Enterprise Linux Security Update for go1.15 (SUSE-SU-2021:0223-1)

CVE-2021-3114,CVE-2021-3115

SUSE Enterprise Linux Security Update for nodejs8 (SUSE-SU-2021:0224-1)

CVE-2020-8287

SUSE Enterprise Linux Security Update for go1.14 (SUSE-SU-2021:0222-1)

CVE-2021-3114,CVE-2021-3115

Criticidade: Alta

SUSE Enterprise Linux Security Update for ImageMagick (SUSE-SU-2021:0199-1)

CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,CVE-2020-25666,

CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27750,

CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,

CVE-2020-27755,CVE-2020-27757,CVE-2020-27759,CVE-2020-27760,

CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,

CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,

CVE-2020-27769,CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,

CVE-2020-27773,CVE-2020-27774,CVE-2020-27775,CVE-2020-27776

SUSE Enterprise Linux Security Update for postgresql, postgresql12, postgresql13 (SUSE-SU-2021:0217-1)

CVE-2020-25694,CVE-2020-25695,CVE-2020-25696

SUSE Enterprise Linux Security Update for sudo (SUSE-SU-2021:0226-1) (Baron Samedit)

CVE-2021-23239,CVE-2021-23240,CVE-2021-3156

SUSE Enterprise Linux Security Update for sudo (SUSE-SU-2021:0227-1) (Baron Samedit)

CVE-2021-23239,CVE-2021-23240,CVE-2021-3156

SUSE Enterprise Linux Security Update for sudo (SUSE-SU-2021:0225-1) (Baron Samedit)

CVE-2021-23239,CVE-2021-23240,CVE-2021-3156

Ubuntu

(Total: 04)

Criticidade: Média

Ubuntu Security Notification for Linux, Linux-aws, Linux-aws-hwe, Linux-azure, Linux-azure-4.15, Linux-gcp, (USN-4680-1)

CVE-2019-19770,CVE-2020-0423,CVE-2020-10135,CVE-2020-25656,

CVE-2020-25668,CVE-2020-25705,CVE-2020-27675,CVE-2020-27777,

CVE-2020-28974

Ubuntu Security Notification for Linux, Linux-aws, Linux-kvm, Linux-lts-xenial, Linux-raspi2, (USN-4681-1)

CVE-2019-0148,CVE-2020-25656,CVE-2020-25668,CVE-2020-27675,

CVE-2020-28974,CVE-2020-4788

Ubuntu Security Notification for Linux-oem-5.6 Vulnerability (USN-4683-1)

CVE-2020-28974

Ubuntu Security Notification for Edk2 Vulnerabilities (USN-4684-1)

CVE-2019-14562,CVE-2019-14584

Criticidade: Alta

Ubuntu Security Notification for Sudo Vulnerabilities : USN-4705-1(Baron Samedit)

CVE-2021-23239,CVE-2021-3156