CISA Adds Six Known Exploited Vulnerabilities to Catalog (CVE-2015-3246, CVE-2015-5287, CVE-2019-1068 +3 more)

What Happened

CISA, the US cybersecurity agency, added six security flaws to its list of known exploited vulnerabilities. These flaws affect various software products, including Red Hat, Microsoft SQL Server, and Citrix NetScaler. The agency urges federal agencies and all other organizations to patch these issues quickly, especially on internet-facing systems, as attackers are actively using them. Organizations should check if their systems were compromised before applying the patches.

Key Takeaways

• CISA added six vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
• The vulnerabilities span multiple products including Red Hat, Microsoft SQL Server, Ajax.NET Professional, Linux Kernel, and Citrix NetScaler.
• BOD 26-04 requires FCEB agencies to prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets.
• CISA encourages all organizations to apply risk-based vulnerability management and prioritize remediation of these vulnerabilities.

Affected Systems

• Red Hat Libuser
• Red Hat Automatic Bug Reporting Tool (ABRT)
• Microsoft SQL Server
• Ajax.NET Professional
• Linux Kernel
• Citrix NetScaler ADC
• Citrix NetScaler Gateway

Vulnerabilities (CVEs)

Attack Chain

1. Reconnaissance: Attacker identifies internet-facing systems running vulnerable versions of Red Hat, Microsoft SQL Server, Ajax.NET Professional, Linux Kernel, or Citrix NetScaler.
2. Exploitation: Attacker exploits one of the six listed CVEs to gain access, escalate privileges, or execute code.
3. Post-Exploitation: Attacker establishes persistence, moves laterally, or exfiltrates data depending on the specific vulnerability exploited.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules are provided in the article.

Detection Engineering Assessment

Required Log Sources

• Web application firewall logs
• EDR telemetry
• System logs for privilege escalation events
• Network flow data

Hunting Hypotheses

Control Gaps

• Signature-based network controls may miss exploitation of these vulnerabilities if attacks use encrypted channels or legitimate application protocols.
• Endpoint controls may not detect post-exploitation activity if it blends with normal application behavior.

Key Behavioral Indicators

• Unexpected child processes from web application or database service accounts
• Anomalous network connections from Citrix NetScaler or Microsoft SQL Server processes
• Unexpected privilege escalation events on Linux systems involving ABRT or libuser

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether vulnerable services need to be internet-facing and restrict access where possible.
• Consider implementing enhanced monitoring on systems running the affected software versions.
• Ensure vulnerability scanning is configured to detect all six CVEs across the environment.

User Protection

• Ensure endpoint protection is active and updated on all systems running vulnerable software.
• Consider implementing application allow-listing to limit the impact of potential post-exploitation activity.

Security Awareness

• Communicate the addition of these CVEs to the KEV catalog to relevant IT and security teams.
• Reinforce the importance of timely patching, especially for internet-facing systems.

MITRE ATT&CK Mapping