Hauv kev txhim kho tsis ntev los no, US Cybersecurity and Infrastructure Security Agency (CISA) tau txheeb xyuas qhov muaj kev cuam tshuam tseem ceeb hauv Roundcube email software, raug xaiv los ua CVE-2023-43770. Qhov teeb meem no, categorized li cross-site scripting (XSS) flaw nrog CVSS tus qhab nia ntawm 6.1, tau nquag siv hauv cov qus. Tsab ntawv xov xwm no yuav piav qhia txog cov ntsiab lus ntawm CVE-2023-43770, nws cov txiaj ntsig zoo, cov qauv cuam tshuam, thiab cov kauj ruam kho kho tau pom zoo los ntawm cybersecurity cov tub ceev xwm.
Cov ntsiab lus ntawm CVE-2023-43770
CVE-2023-43770 nyob ib ncig ntawm kev ua tsis ncaj ncees ntawm linkrefs hauv cov ntawv xov xwm dawb hauv Roundcube Webmail platform. Qhov kev tsis txaus siab no ua rau muaj peev xwm ua rau muaj peev xwm ua rau muaj kev cuam tshuam tsis tu ncua ntawm qhov chaw sau ntawv (XSS), ua rau muaj kev pheej hmoo tseem ceeb ntawm kev nthuav tawm cov ntaub ntawv los ntawm kev siv tsis zoo txuas. Txawm hais tias cov ntsiab lus tshwj xeeb ntawm kev siv dag zog tsis tau nthuav tawm, qhov hnyav ntawm XSS qhov tsis muaj peev xwm ua rau muaj kev kub ntxhov rau kev ua tam sim.
Qhov tsis zoo cuam tshuam rau Roundcube versions ua ntej 1.4.14, 1.5.x ua ntej 1.5.4, thiab 1.6.x ua ntej 1.6.3. Cov neeg saib xyuas Roundcube tau teb tam sim ntawd los ntawm kev tso tawm version 1.6.3 thaum lub Cuaj Hlis 15, 2023, uas hais txog thiab txo qhov muaj qhov tsis zoo. Credit rau kev tshawb pom thiab kev tshaj tawm ntawm CVE-2023-43770 mus rau Zscaler tus kws tshawb fawb kev ruaj ntseg Niraj Shivtarkar.
Kev tshwm sim thiab muaj peev xwm hem neeg ua yeeb yam
Cov xwm txheej yav dhau los tau pom tias lub vev xaib email tus neeg siv khoom tsis zoo tuaj yeem dhau los ua riam phom xaiv rau cov neeg ua phem hem. Cov pab pawg tseem ceeb, xws li APT28 thiab Winter Vivern, tau siv qhov tsis zoo sib xws yav dhau los. Tej yam tshwm sim ntawm kev siv CVE-2023-43770 suav nrog kev nkag tsis tau, cov ntaub ntawv tub sab, thiab muaj peev xwm cuam tshuam txog cov ntaub ntawv rhiab heev. Qhov ceev ceev rau cov neeg siv thiab cov koom haum los siv kev ntsuas kev nyab xeeb tsis tuaj yeem hais dhau.
Teb thiab Mitigation
Hauv kev teb rau qhov kev hem thawj uas tau txheeb pom, Tsoomfwv Meskas Lub Tsev Haujlwm Saib Xyuas Kev Ua Haujlwm Hauv Pej Xeem (FCEB) tau tshaj tawm cov lus qhia rau kev ua raws li cov neeg muag khoom muab kev kho los ntawm Lub Peb Hlis 4, 2024. Cov lus qhia no yog txhawm rau txhawb kev ruaj ntseg network thiab tiv thaiv cov kev hem thawj uas muaj peev xwm los ntawm cyber. qhov tsis muaj zog CVE-2023-43770.
Cov kev coj ua zoo tshaj plaws rau kev tiv thaiv
Kev tiv thaiv kev kis kab mob yav tom ntej yuav tsum muaj txoj hauv kev zoo rau cybersecurity. Xav txog cov kev coj ua zoo tshaj plaws hauv qab no:
- Khaws Software Hloov Kho Tshiab: Tsis tu ncua hloov tshiab Roundcube thiab lwm yam software mus rau qhov tseeb versions los kho qhov tsis zoo thiab txhim kho kev ruaj ntseg.
- Siv Kev Ruaj Ntseg Patches: Siv thaj ua rau thaj thiab hloov kho tshiab los ntawm cov neeg muag khoom software sai sai los daws cov teeb meem uas pom tau.
- Kev cob qhia neeg paub txog: Qhia cov neeg siv kom paub txog thiab tshaj tawm cov email tsis txaus ntseeg lossis kev ua ub no kom txo qis kev pheej hmoo ntawm kev poob raug tsim txom los ntawm kev siv dag zog.
- Network Segmentation: Ua raws li kev sib koom ua ke hauv lub network kom txwv tsis pub muaj feem cuam tshuam ntawm kev ua tiav kev tawm tsam thiab muaj kev sib kis ntawm kev hem thawj.
xaus
Kev siv CVE-2023-43770 hauv Roundcube email software qhia txog kev hloov pauv ntawm thaj chaw hem thawj thiab xav tau kev ntsuas kev ruaj ntseg cybersecurity. Cov neeg siv thiab cov koom haum yuav tsum ua nrawm nrawm los siv cov kev ruaj ntseg tsim nyog, hloov kho software, thiab txhawb kev paub ntawm cov neeg siv kom txo tau qhov kev pheej hmoo ntawm kev poob rau cov neeg tsis muaj zog. Kev sib koom tes ntawm cov kws tshawb nrhiav kev ruaj ntseg, cov neeg muag khoom software, thiab cybersecurity cov tub ceev xwm ua lub luag haujlwm tseem ceeb hauv kev tiv thaiv ib puag ncig digital tiv thaiv kev tshwm sim. kev hem hem cyber.