Name: News and Advice on the World's Latest Innovations | ZDNET
Brand: zdnet.com
SKU: zdnet-com-587
Availability: OnlineOnly

critic

News and Advice on the World's Latest Innovations | ZDNET

preview

/&gt;The vendor is urging customers to apply patches immediately.SonicWall is urging customers to apply patches to resolve three zero-day vulnerabilities in its email security solution that are being actively exploited in the wild.&nbsp; In a on Tuesday, the US company said fixes have been published to resolve three critical issues impacting "hosted and on-premises email security products."SonicWall ES is a solution designed to protect email traffic and communication, such as by preventing phishing emails and business email compromise (BEC) attempts.&nbsp; There is at least one known case of active exploitation in the appliance that has been recorded.&nbsp; "It is imperative that organizations using SonicWall Email Security (ES) hardware appliances, virtual appliances or software installation on Microsoft Windows Server immediately upgrade to the respective SonicWall Email Security version listed," SonicWall says.&nbsp; The vulnerabilities are tracked as CVE-2021-20021, CVE-2021-20022, and CVE-2021-20023, impacting SonicWall ES/Hosted Email Security (HES) versions 10.0.1 and above. FireEye's Mandiant team discovered and disclosed the bugs to the SonicWall Product Security Incident Response Team (PSIRT) through an investigation of post-exploitation web shell activity on a client's system that pointed to SonicWall ES as the original source of compromise. &nbsp; According to Josh Fleischer, Chris DiGiamo, and Alex Pennino, the vulnerabilities have been exploited in an attack chain to obtain administrative access and to execute code on vulnerable ES products, including the installation of a backdoor, file exposure, and to achieve lateral network movement.&nbsp; The team added that the explicit case shows "intimate knowledge of the SonicWall application." CVE-2021-20021 and CVE-2021-20022 were reported privately on March 26, acknowledged on March 21, and a hotfix was applied on April 9. CVE-2021-20023 was reported on April 7, leading to a patch becoming available on April 19.&nbsp; SonicWall is urging customers to update their Email Security builds to version 10.0.9.6173 (Windows) or 10.0.9.6177 (Hardware/ESXi Virtual Appliance), which contain hotfixes for the vulnerabilities.&nbsp; Clients signed up for SonicWall Hosted Email Security (HES) products do not need to take further action as patches have been automatically applied in version 10.0.9.6173.&nbsp; However, the vendor says the critical vulnerabilities also impact SonicWall ES versions 7.0.0-9.2.2, which are end-of-life, legacy products not entitled to security updates. For users of these versions, SonicWall also urges an immediate upgrade.&nbsp; SonicWall has provided a for applying security upgrades.&nbsp; Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0

/&gt;The vendor is urging customers to apply patches immediately.SonicWall is urging customers to apply patches to resolve three zero-day vulnerabilities in its email security solution that are being actively exploited in the wild.&nbsp; In a on Tuesday, the US company said fixes have been published to resolve three critical issues impacting "hosted and on-premises email security products."SonicWall ES is a solution designed to protect email traffic and communication, such as by preventing phishing emails and business email compromise (BEC) attempts.&nbsp; There is at least one known case...

public

Charlie Osborne

ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic. The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET Networks.

zdnet.com

Credible

Speculation

Anecdotal Evidence

Generalization

Stacking the Deck

Appeal to Authority

Straw Man

Slippery Slope

Emotional Appeal

Red Herring

False Dilemma

Illogical

Moral Equivalency

Ad Hominem

Correlation w/o Causation

Semantics

Begging the Question

Faulty Analogy

Non Sequitur

Bandwagon

Dogmatism

Failing Occam's Razor

Biased

Pure Opinion

Hit Piece

Racial Bias

National Bias

Religious Bias

Financial Incentive

Political Agenda

Gender Bias

Misused Image/Video

Study Misinterpreted

Mistake

Misused Term

Science Misrepresented

Factual Error

Satire

Surface Level

Lack of Reliable Sources

Sensational

Not Credible

Investigative

Balanced

Well Sourced

Great Context

sports

entertainment

U.S.

international

business

technology

science

culture

politics

media

health

News and Advice on the World's Latest Innovations | ZDNET

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS