[CISA-2023:0512] CISA Adds 7 Known Exploited Vulnerabilities to Catalog

Severity Critical

CVEs 7

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

[CVE-2010-3904] Linux Kernel Improper Input Validation Vulnerability

Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Action The impacted product is end-of-life and should be disconnected if still in use.
Known To Be Used in Ransomware Campaigns?: Unknown
Vendor: Linux
Product: Kernel
Due Date: Fri Jun 2 00:00:00 2023
Notes: https://lkml.iu.edu/hypermail/linux/kernel/1601.3/06474.html; https://nvd.nist.gov/vuln/detail/CVE-2010-3904

[CVE-2014-0196] Linux Kernel Race Condition Vulnerability

Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.

Action The impacted product is end-of-life and should be disconnected if still in use.
Known To Be Used in Ransomware Campaigns?: Unknown
Vendor: Linux
Product: Kernel
Due Date: Fri Jun 2 00:00:00 2023
Notes: https://lkml.iu.edu/hypermail/linux/kernel/1609.1/02103.html; https://nvd.nist.gov/vuln/detail/CVE-2014-0196

[CVE-2015-5317] Jenkins User Interface (UI) Information Disclosure Vulnerability

Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.

Action Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns?: Unknown
Vendor: Jenkins
Product: Jenkins User Interface (UI)
Due Date: Fri Jun 2 00:00:00 2023
Notes: https://www.jenkins.io/security/advisory/2015-11-11/; https://nvd.nist.gov/vuln/detail/CVE-2015-5317

[CVE-2016-3427] Oracle Java SE and JRockit Unspecified Vulnerability

Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

Action Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns?: Unknown
Vendor: Oracle
Product: Java SE and JRockit
Due Date: Fri Jun 2 00:00:00 2023
Notes: https://www.oracle.com/security-alerts/cpuapr2016v3.html; https://nvd.nist.gov/vuln/detail/CVE-2016-3427

[CVE-2016-8735] Apache Tomcat Remote Code Execution Vulnerability

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Action Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns?: Unknown
Vendor: Apache
Product: Tomcat
Due Date: Fri Jun 2 00:00:00 2023
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

[CVE-2021-3560] Red Hat Polkit Incorrect Authorization Vulnerability

Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.

Action Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns?: Unknown
Vendor: Red Hat
Product: Polkit
Due Date: Fri Jun 2 00:00:00 2023
Notes: https://bugzilla.redhat.com/show_bug.cgi?id=1961710; https://nvd.nist.gov/vuln/detail/CVE-2021-3560

[CVE-2023-25717] Multiple Ruckus Wireless Products CSRF and RCE Vulnerability

Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.

Action Apply updates per vendor instructions or disconnect product if it is end-of-life.
Known To Be Used in Ransomware Campaigns?: Unknown
Vendor: Ruckus Wireless
Product: Multiple Products
Due Date: Fri Jun 2 00:00:00 2023
Notes: https://support.ruckuswireless.com/security_bulletins/315; https://nvd.nist.gov/vuln/detail/CVE-2023-25717