米国土安全保障省サイバーセキュリティ・インフラストラクチャセキュリティ庁(CISA: Cybersecurity and Infrastructure Security Agency)は5月24日(米国時間)、「CISA Adds 20 Known Exploited Vulnerabilities to Catalog｜CISA」において、「Known Exploited Vulnerabilities Catalog」に20個の脆弱性を追加したと伝えた。これら脆弱性はサイバー犯罪者によって積極的に悪用されていることが確認されている。

  • CISA Adds 20 Known Exploited Vulnerabilities to Catalog｜CISA

    CISA Adds 20 Known Exploited Vulnerabilities to Catalog｜CISA

20個の脆弱性の影響を受ける主な製品やサービスは次のとおり。

脆弱性の概要は次のとおり。

CVE番号 脆弱性の概要
CVE-2018-8611 A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.
CVE-2018-19953 A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
CVE-2018-19949 A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
CVE-2018-19943 A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
CVE-2017-0147 The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
CVE-2017-0022 Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
CVE-2017-0005 The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.
CVE-2017-0149 Microsoft Internet Explorer allows remote attackers to execute code or cause a denial-of-service (memory corruption) via a crafted web site.
CVE-2017-0210 A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.
CVE-2017-8291 Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
CVE-2017-8543 Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.
CVE-2017-18362 ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
CVE-2016-0162 An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.
CVE-2016-3351 An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.
CVE-2016-4655 The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.
CVE-2016-4656 A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service via a crafted application.
CVE-2016-4657 WebKit in Apple iOS contains a memory corruption vulnerability which allows attackers to execute remote code or cause a denial-of-service via a crafted web site.
CVE-2016-6366 A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.
CVE-2016-6367 A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service condition or potentially execute code.
CVE-2016-3298 An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.

今回カタログに追加された脆弱性は、最も古いもので2016年に、最も新しいもので2018年に発行されたものとなっている。すでにアップデート情報は提供されており、アップデートを適用することで問題を回避することができる。

カタログにはアクティブに悪用されている脆弱性が追加される仕組みになっており、こうした製品が古いバージョンのまま使われていることが示されている。カタログに追加された製品に関して、再度情報を確認するとともに、必要に応じてアップデートを適用することが望まれる。