Pierluigi Paganini
January 03, 2024
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Qlik Sense vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
Below is the list of the issues added to the catalog:
CVE-2023-7024 – The vulnerability is a Heap buffer overflow issue in WebRTC. The flaw was reported by Clément Lecigne and Vlad Stolyarov of Google’s Threat Analysis Group on 2023-12-19 and fixed in just one day. Google released emergency updates to address this zero-day vulnerability. The fact that the issue was discovered by Google TAG suggests it was exploited by a nation-state actor or by a surveillance firm.
CVE-2023-7101 – The flaw is Spreadsheet::ParseExcel Remote Code Execution Vulnerability. The issue stems from the evaluation of Number format strings within the Excel parsing logic.
On December 21, network and email cybersecurity firm Barracuda started releasing security updates to address a zero-day, tracked as CVE-2023-7102, in Email Security Gateway (ESG) appliances. The vulnerability has been actively exploited by the Chinese hacker group UNC4841 Chinese. The root cause of the problem is a weakness in the Spreadsheet::ParseExcel third-party library. This library is used by the Amavis virus scanner that runs on Barracuda ESG appliances. An attacker can trigger the vulnerability to execute arbitrary code on vulnerable ESG appliances through parameter injection.
Barracuda has also filed CVE-2023-7101 for a vulnerability in the open-source library which is used in several products of multiple organizations. At the time of this writing the issue has yet to be addressed.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix these vulnerabilities by January 23, 2024.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
