Microsoft warns SolarWinds customers that Serv-U is under attack | #microsoft | #hacking | #cybersecurity


Hackers are triggering a vulnerability in the Serv-U Managed File Transfer (MFT) and Serv-U Secure File Transfer Protocol (FTP) products to attack SolarWinds customers. 

SolarWinds has released a hotfix to patch the remote code execution vulnerability – tracked as CVE-2021-35211 – after Microsoft researchers reported that it was involved in ongoing attacks against customers.

The company, which was at the centre of one of the biggest attacks in recent memory towards the end of last year, has urged its Serv-U customers to patch their systems immediately in order to benefit from the fix.

Serv-U is a suite of tools, maintained by SolarWinds, that allows customers to securely transfer files remotely across the web. Alongside Managed File Transfer and Secure FTP, the suite includes Serv-U Gateway, which adds a layer of security to file transfers.

Hackers can exploit the vulnerability to run arbitrary code with privileges on targeted systems, before installing programmes, altering or deleting data, and running programmes. The vulnerability exists in the latest Serv-U version 15.2.3 HF1, released on 5 May 2021, and all prior versions, with customers encouraged to update to Serv-U version 15.2.3 HF2.

No other SolarWinds products have been affected by this vulnerability, the company claims, with Microsoft providing evidence of limited, targeted customer impact by a single entity.

SolarWinds doesn’t have an estimate for how many customers have been affected, however, and it’s unaware of the identity of the current victims. 

The company has stressed this is a new vulnerability and not related to the supply chain attack that affected approximately 100 victims, at least. Investigations into that attack revealed that the hackers responsible had first infiltrated the company’s networks in September 2019, before injecting test code and beginning trial runs. 

SolarWinds had previously blamed an intern for setting a weak ‘solarwinds123’ password, which was publicly accessible on GitHub for more than a year, on a company server, which allowed hackers a route into the company’s networks.

Featured Resources

Medium business IT survey highlights

An online study to understand the state of medium businesses in Europe and South Africa

Download now

From B2B to D2C online sales

Create a direct-to-consumer web store with the potential to transform your business

Download now

The total economic impact of Nutanix for end user computing

Cost savings and business benefits enabled by Nutanix HCI for end user computing

Download now

The Total Economic Impact™ of IBM Spectrum Virtualize

Cost savings and business benefits enabled by storage built with IBM
Spectrum Virtualize

Download now



Original Source link

Leave a Reply

Your email address will not be published.

three + two =