Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

SolarWinds Confirms New Zero-Day Flaw Under Attack

Security responders at SolarWinds are scrambling to contain a new zero-day vulnerability being actively exploited in what is being described as “limited, targeted attacks.”

Security responders at SolarWinds are scrambling to contain a new zero-day vulnerability being actively exploited in what is being described as “limited, targeted attacks.”

In an advisory issued over the weekend, SolarWinds said a single threat actor exploited security flaws in its Serv-U Managed File Transfer and Serv-U Secure FTP products against “a limited, targeted set of customers.”

This zero-day is new and completely unrelated to the SUNBURST supply chain attacks, the company said.

The embattled company said the attacks were discovered by threat hunters at Microsoft who noticed live, in-the-wild attacks hitting a remote code execution flaw in the SolarWinds Serv-U product. 

Microsoft provided a proof of concept of the exploit along with evidence of the zero-day attacks. 

“Microsoft has provided evidence of limited, targeted customer impact, though SolarWinds does not currently have an estimate of how many customers may be directly affected by the vulnerability. SolarWinds is unaware of the identity of the potentially affected customers,” the company said.

[ Related: Everything You Need to Know About the SolarWinds Attack ]

“While Microsoft’s research indicates this vulnerability exploit involves a limited, targeted set of customers and a single threat actor, our joint teams have mobilized to address it quickly,” SolarWinds added.

Advertisement. Scroll to continue reading.

SolarWinds has shipped an urgent hotfix  — available at the customer portal — to address the vulnerability, which affects Serv-U 15.2.3 HF1 and all prior Serv-U versions.

The company has released some Indicators of Compromise (IOCs) to help detect signs of compromise but full technical details of the vulnerability will be kept under wraps to give customers time to test and deploy the newest patches.

From the SolarWinds advisory:

The vulnerability exists in the latest Serv-U version 15.2.3 HF1 released May 5, 2021, and all prior versions. A threat actor who successfully exploited this vulnerability could run arbitrary code with privileges. An attacker could then install programs; view, change, or delete data; or run programs on the affected system.

Serv-U version 15.2.3 hotfix (HF) 2 has been released. Please see the Security Updates table for the applicable update for your system. We recommend you install these updates immediately. If you are unable to install these updates, see the FAQ in this Security Advisory for information on how to help protect your system from this vulnerability.

The company pointed out that this vulnerability is not related to the supply chain attack discovered last year. SolarWinds’ most recent announcement regarding that attack, which has been attributed to Russian threat actors, claimed that while thousands of customers received malicious updates from its systems following a breach, less than 100 were actually compromised

Threat actors linked to China have also targeted SolarWinds. However, they did not breach the company’s systems — they exploited a vulnerability in SolarWinds’ Orion product and only delivered malware after gaining access to the targeted networks. At least one U.S. government agency was targeted in this operation. 

Related: Everything You Need to Know About the SolarWinds Attack 

Related: ‘Sunspot’ Malware Used to Insert Backdoor Into SolarWinds Product

Related: Kaspersky Connects SolarWinds Attack Code to Known Russian APT Group 

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.