For some time, we have heard rumours circulating in some of the darker parts of the web about issues with Oracle’s WebLogic, exploitable issues with proof of concept attacks being tested, sold and shared.
On Tuesday this week, Oracle issued a critical advisory for CVE-2019–2729, which is a remote code execution (RCE) vulnerability for the aforementioned WebLogic platform, which many of you are probably running somewhere.
Unlike the advisory they released on Monday for another RCE, CVE-2019–2725, 2729, which will almost certainly get a name and a cute little picture, is under serious attack the world over and needs to be patched in the now timeframe.
The fantastic ITC SOC crew released a Threat Horizon about the issue which tells you what to do. If you have any questions or need any advice about this, do contact us. Our managed services customers will have been contacted directly.
The Pythia (Welease Woger) was the High Priestess of the Temple of Apollo at Delphi aka the Delphic Oracle who according to some scholars ingested water and gas tainted with bad stuff (ethylene) and then spewed forth output, so we should have all seen this coming, she almost certainly did (in technicolour).
In other news, Microsoft has patched an issue with the Outlook App for Android which enables cross site scripting and subsequent further infection by just sending you an email (there are 100 meeelion users of this client, no biggy). Your client should upgrade automatically but if it hasn’t, do it from the Play Store manually.
If you remember this missive from a couple weeks ago, you may remember the sorry tale of LabCorp who announced that it had exposed the details of 7.7 meeeeeelion users because of a breach at a third party, the American Medical Collection Agency. This week the collection agency filed for bankruptcy on account of the huge costs involved in contacting the victims and the loss of business from LabCorp and two other major customers. We rarely see smiting delivered so immediately, but confidently predict that there will be more of this to come.
On the face of it, this looks like the third party is taking the rap entirely, however imagine the stress and work levels at the customer side as they are forced to negotiate new deals with new suppliers in record time to keep their businesses going. A sellers market if ever there was one.
The economic fallout from this breach will be enormous and could probably have been prevented by better, if not awesome, third-party supply chain management, you know the sort that our brilliant consultants can help you with.
If you would like a prophecy or a consultation, contact us at: [email protected] or call 020 7517 3900.
