Published: 2020-07-29
MITRE CVE-2020-10713

GRUB 2 is a “boot loader”, it precedes the actual operating system and allows for multiple options in what operating system to load and with what parameters given. An attacker with administrative privileges on a system, or physical access, can use this vulnerability to bypass the check of cryptographic signatures and run arbitrary code. GRUB 2 is the default boot loader for most popular GNU/Linux distributions, but it is independent of any OS so this vulnerability can also be exploited against Windows systems.

Some might say that game is over anyway if an attacker has administrative privileges or physical access, but this attack method provides a way for an attacker to establish persistence on a system perhaps invisible for an OS and its endpoint security platform.

RedHat reports “In CVE-2020-10713, an attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB.”

And for remediation “Red Hat recommends all customers to update their grub2 packages. Red Hat customers using Secure Boot need to update kernel, fwupdate, fwupd, shim and dbxtool packages containing newly validated keys and certificates. Users running Secure Boot with Red Hat Enterprise Linux 8 need to take additional steps to boot into previously released RHEL 8 kernels after applying the grub2 package updates.”

This vulnerability has a CVSS Base score of 8.2 with the CVSS vectors CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Basefarm is currently evaluating this vulnerability and its consequences for the continued secure operations of our customers and our own systems. Internally this is tracked in BF-VLN-2089662. At this early point we refer to the individual vendors for more information:

Microsoft ADV200011 | Microsoft Guidance for Addressing Security Feature Bypass in GRUB

Red Hat Boot Hole Vulnerability – GRUB 2 boot loader – CVE-2020-10713

This vulnerability was discovered and responsibly disclosed by Eclypsium, see their in depth technical writeup “There’s a Hole in the Boot”

Update 2020-07-31: There are some reports about the RHEL grub2 security update rendering systems unbootable. Patching for vulnerabilities IS important, but doing so in a responsible manner is also a priority.

Published: 2020-07-14
MITRE CVE-2020-1350

“A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability.”

The tricky part about this is that a lot of systems normally closed of from direct access to the internet has an indirect access to the internet via the forwarding capabilities built in to DNS. If you are able to resolve regular domains like “basefarm.com”, “microsoft.com” and “google.com”, and you are asking your Windows Domain Controller, that Domain Controller is vulnerable.

The recommended cause of action is to upgrade as soon as possible. This requires a reboot. There exists a workaround, if a reboot is not something you can do right now. This is a registry edit and only requires a restart of the DNS Service. We refer to official documentation for information about this workaround.

In our experience, and based on information currently available, we expect to see working exploits in the wild within a week, and see it likely that there will be widespread active attacks within 2 weeks.

Basefarm is tracking this vulnerability internally as BF-VLN-2084547, with the highest priority. All internal Basefarm servers vulnerable is scheduled to receive patches within 2020-07-15 18:00. We are currently chasing customer-specific servers and organizing emergency patching.

Update 2020-07-17 21:00 – All change-tickets for customer-specific servers have attention. 4% of the tickets is still in implementation status, 96% is either in Post-implementation Review status or Closed status. We continue to monitor intelligence sources for signs of active exploitation and will ensure priority for the remaining 4% of customers.

Update 2020-07-21 – All servers are patched or have implemented workarounds for this vulnerability.

Official Microsoft Security Advisory

Published: 2020-04-24
MITRE CVE-2020-4415

“IBM Spectrum Protect server is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker to execute arbitrary code on the system with the privileges of an administrator or user associated with the Spectrum Protect server or cause the Spectrum Protect server to crash.”

CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/179990 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

This vulnerability is remedied by upgrading to version 8.1.9.300 or 7.1.10.100. Basefarm recommends upgrading to these version as soon as possible, at least within a week. Internally in Basefarm this progress is tracked as BF-VLN-2031464. (update 2020-04-27, Basefarm has fully upgraded all IBM Spectrum Protect Servers.)