CISA orders federal agencies to patch Looney Tunables Linux bug

Today, CISA ordered U.S. federal agencies to defended their systems adjoin an actively exploited vulnerability that lets attackers accretion basis privileges on abounding above Linux distributions.

Dubbed 'Looney Tunables' by Qualys' Threat Research Unit (who apparent the bug) and tracked as CVE-2023-4911, this aegis vulnerability is due to a absorber overflow weakness in the GNU C Library's ld.so activating loader.

The aegis blemish impacts systems active the latest releases of broadly acclimated Linux platforms, including Fedora, Ubuntu, and Debian in their absence configurations.

Administrators are apprenticed to application their systems as anon as possible, seeing that the vulnerability is now actively exploited and several proof-of-concept (PoC) exploits accept been appear online back its acknowledgment in aboriginal October.

"With the adequacy to accommodate abounding basis acceptance on accepted platforms like Fedora, Ubuntu, and Debian, it's acute for arrangement administrators to act swiftly," Qualys' Saeed Abbasi warned.

CISA additionally added the actively exploited Linux blemish to its Known Exploited Vulnerabilities Catalog today, including it in its account of "frequent advance vectors for awful cyber actors" and assuming "significant risks to the federal enterprise."

Following its admittance in CISA's KEV list, U.S. Federal Civilian Executive Branch Agencies (FCEB) charge application Linux accessories on their networks by December 12, as allowable by a bounden operational charge (BOD 22-01) issued one year ago.

Although the BOD 22-01 primarily targets U.S. federal agencies, CISA additionally audacious all organizations (including clandestine companies) to accent patching the Looney Tunables aegis blemish immediately.

Exploited in Kinsing malware attacks

While CISA didn't aspect the advancing Looney Tunables exploitation, aegis advisers with billow aegis aggregation Aqua Nautilus revealed two weeks ago that Kinsing malware operators are application the blemish in attacks targeting billow environments.

The attacks alpha with base a accepted vulnerability aural the PHP testing framework 'PHPUnit.' This antecedent aperture allows them to authorize a cipher beheading foothold, followed by leveraging the 'Looney Tunables' affair to amplify their privileges.

After accepting basis acceptance to compromised Linux devices, blackmail actors install a JavaScript web carapace for backdoor access. This carapace allows them to assassinate commands, administer files, and conduct arrangement and server reconnaissance.

The Kinsing attackers' ultimate ambition is to abduct billow account provider (CSP) credentials, aiming for acceptance to AWS instance character data.

Kinsing is accepted for breaching and deploying crypto mining software cloud-based systems, including Kubernetes, Docker APIs, Redis, and Jenkins.

Microsoft has additionally afresh empiric the accumulation targeting Kubernetes clusters via misconfigured PostgreSQL containers, while TrendMicro spotted them exploiting the analytical CVE-2023-46604 Apache ActiveMQ bug to accommodation Linux systems.