米国土安全保障省サイバーセキュリティ・インフラストラクチャセキュリティ庁(CISA: Cybersecurity and Infrastructure Security Agency)は10月24日(米国時間)、「CISA Adds Six Known Exploited Vulnerabilities to Catalog｜CISA」において、「Known Exploited Vulnerabilities Catalog」に6個の脆弱性を追加したと伝えた。これら脆弱性は、サイバー犯罪者によって積極的に悪用されていることが確認されており注意が必要。

  • CISA Adds Six Known Exploited Vulnerabilities to Catalog｜CISA

    CISA Adds Six Known Exploited Vulnerabilities to Catalog｜CISA

影響を受ける主な製品やサービスは次のとおり。

脆弱性の主な内容は次のとおり。

CVE番号 脆弱性内容
CVE-2020-3433 Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.
CVE-2020-3153 Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
CVE-2018-19323 The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
CVE-2018-19322 The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CVE-2018-19321 The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
CVE-2018-19320 The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

今回カタログに追加された脆弱性は2018年に発行されたものと2020年に発行されたもの。カタログにはアクティブに悪用されている脆弱性が追加される仕組みになっており、脆弱性自体は古いものが含まれることがある。

詳細が明らかになった脆弱性はサイバー犯罪者によって悪用されやすい。脆弱性は発表されるとともに直ちに内容を確認するとともに、適切に緩和策の適用やアップデートの適用を実施することが望まれる。