.webp)
Microsoft has identified several vulnerabilities in Perforce Helix Core Server, the most critical of which is CVE-2023-45849. With a CVSS score of 9.8, this vulnerability allows arbitrary code execution which results in privilege escalation. This vulnerability manifests if the administrator setting up the server does not run the “p4 protect” command immediately after installing the server. Without this command, an unauthenticated anonymous attacker could run arbitrary command lines (powershell) as LocalSystem when Perforce Server is installed in its default configuration.
This very high impact, high severity vulnerability impacts Perforce Helix Core Server Up to version 2023.2. It allows an unauthenticated remote attacker to perform arbitrary commands in the context of LocalSystem. Microsoft has also provided a detailed explanation of the vulnerability with examples on how to exploit it.
If your organization uses Perforce Helix Core Server, update to the latest version and be sure to run the p4 protect command at installation. Following the vendor instructions for installation is always a best practice and in this case, would have resolved the vulnerability.
Update Perforce Helix Core Server to 2023.2
Follow vendor instructions for installation.
Exploitation of this vulnerability could have consequences detrimental to the business. It can result in data loss from data exfiltration, loss of access to a core server, possibility of lateral movement, monetary loss because of incident response, etc. This all depends on the attacker’s intention and ability as well as your organization’s defensive posture.
Patch: There is a patch for this vulnerability available from the vendor. Update as soon as possible, there is no evidence of exploitation yet, but that tends to change when vendors release detailed vulnerability analysis like Microsoft has done with this vulnerability.
Follow vendor recommendations: This patch could have been mitigated if vendor recommendations were followed during installation as this vulnerability is a result of not following installation instructions and leaving a default configuration. It is always best practice to follow vendor instructions/documentation as well as change default passwords/settings to more secure variants that work for your business.
https://nvd.nist.gov/vuln/detail/CVE-2023-45849
https://www.perforce.com/manuals/p4sag/Content/P4SAG/Home-p4sag.html
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
