Drupal issues emergency fix for critical bug with known exploits

Drupal issues emergency fix for critical bug with known exploits

Drupal has released emergency security updates to address a critical vulnerability with known exploits that could allow for arbitrary PHP code execution on some CMS versions.

“According to the regular security release window schedule, November 25th would not typically be a core security window,” Drupal said.

“However, this release is necessary because there are known exploits for one of core’s dependencies and some configurations of Drupal are vulnerable.”

Right now, over 944,000 websites are using vulnerable Drupal versions out of a total of 1,120,941 according to official stats. “These statistics are incomplete; only Drupal websites using the Update Status module are included in the data,” Drupal says.

Drupal is also used by 2.5% of all websites with content management systems, making it the fourth most popular CMS on the Internet, after WordPress (63.8%), Shopify (5.1%), and Joomla (3.6%).

Security updates for all affected versions

According to Drupal’s security advisory, the vulnerability is caused by two bugs in the PEAR Archive_Tar library used by the content management system (CMS) tracked as CVE-2020-28948 and CVE-2020-28949.

The critical Drupal code execution vulnerability can be exploited if the CMS is configured to allow and process .tar, .tar.gz, .bz2, or .tlz file uploads.

Multiple Drupal security updates were issued to fix the bug and to allow admins to quickly patch their servers to protect them from potential attacks.

Drupal recommends installing the following updates on affected servers:

“Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage,” Drupal’s security team said.

Mitigation measures also available

Mitigation measures are also available for admins who cannot immediately update the Drupal installation on their servers.

To do that, site admins are advised to block untrusted users from uploading .tar, .tar.gz, .bz2, or .tlz files to temporarily mitigate the issue.

Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has also issued an alert today urging admins and users to upgrade to the patched Drupal versions.

Last week, Drupal patched another critical remote code…


Cisco rolls out fix for Webex flaws that let hackers eavesdrop on meetings

Promotional image for video-conferencing software.

Cisco is rolling out fixes for three vulnerabilities in its Webex video-conference software that made it possible for interlopers to eavesdrop on meetings as a “ghost,” meaning being able to view, listen, and more without being seen by the organizer or any of the attendees.

The vulnerabilities were discovered by IBM Research and the IBM’s Office of the CISO, which analyzed Webex because it’s the company’s primary tool for remote meetings. The discovery comes as work-from-home routines have driven a more than fivefold increase in the use of Webex between February and June. At its peak, Webex hosted up to 4 million meetings in a single day.

The vulnerabilities made it possible for an attacker to:

  • Join a meeting as a ghost, in most cases with full access to audio, video, chat, and screen-sharing capabilities
  • Maintain an audio feed as a ghost even after being expelled by the meeting leader
  • Access full names, email addresses, and IP addresses of meeting attendees, even when not admitted to a conference room.

Cisco is in the process of rolling out a fix now for the vulnerabilities, which are tracked as CVE-2020-3441, CVE-2020-3471, and CVE-2020-3419. Below is a video demonstration and deeper explanation:

IBM Works with Cisco to Exorcise Ghosts from Webex Meetings.

Manipulating the handshake

Attacks work by exploiting the virtual handshake that Webex uses to establish a connection between meeting participants. The process works when an end user and server exchange join messages that include information about the attendees, the end-user application, meeting ID, and meeting-room details. In the process, Webex establishes a WebSocket connection between the user and the server.

“By manipulating some of the key fields about an attendee sent over a WebSocket when joining a meeting, the team was able to inject the carefully crafted values that allow someone to join as a ghost attendee,” IBM researchers wrote in a post published on Wednesday. “This worked because of improper handling of the values by the server and other participants’ client applications. For example,…


Old Android Phones Will Not Support These Websites: Here’s How To Fix It –

Old Android Phones Will Not Support These Websites: Here’s How To Fix It