Pierluigi Paganini
March 01, 2024
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) the (CVSS Score 8.4) Microsoft Streaming Service Untrusted pointer dereference vulnerability to its .
An attacker can exploit this to gain SYSTEM privileges. The vulnerability was discovered by Thomas Imbert (@masthoon) from Synacktiv (@Synacktiv) through the .
The availability of proof-of-concept () codes allowed multiple threat actors to include the malicious code in their attack chain.
In February, the analysis of some Raspberry Robin samples before October 2023, revealed that the operators also used an exploit for CVE-2023-29360. The exploit for the vulnerability CVE-2023-29360 was publicly disclosed in June, and Raspberry Robin employed it in August.
According to , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by March 21, 2024.
Follow me on Twitter: and and Mastodon
(SecurityAffairs – Hacking, Known Exploited Vulnerabilities catalog)
