NCCIC Weekly Vulnerability Summary: October 21, 2021.pdf

October 21, 2021

This bulletin highlights critical vulnerabilities discovered in various software products during the week of October 21, 2021. The Common Vulnerability Scoring System (CVSS) ratings indicate the severity of each issue, with High being the most severe.

### High-Severity Vulnerabilities:

1. Adobe Ops CLI:
- Vendor: Adobe
- Product: Ops CLI
- Description: Deserialization of untrusted data vulnerability enabling arbitrary code execution.
- CVSS Score: 7.0
- Source & Patch: A patch is available, addressing the issue in versions 2.0.4 and earlier.

2. Advantech WebAccess:
- Vendor: Advantech
- Product: WebAccess (versions 9.02 and prior)
- Descriptions: Two separate buffer overflow vulnerabilities allowing remote code execution.
- CVSS Scores: 7.5 for both
- Source & Patch: Patches are available for these critical issues.

### Medium-Severity Vulnerabilities:

1. Apple iOS/iPadOS/macOS:
- Vendor: Apple
- Products: iPadOS, iOS, macOS, watchOS, tvOS
- Descriptions: Multiple memory corruption and logic issues leading to potential arbitrary code execution with kernel privileges.
- CVSS Scores: 9.3 (iOS/iPadOS), 7.5 (macOS)
- Source & Patch: Apple has released patches for the affected operating systems.

### Low-Severity Vulnerabilities:

1. Arubanetworks ClearPass Policy Manager:
- Vendor: Aruba Networks
- Product: ClearPass Policy Manager (various versions prior to 6.10.2, 6.9.7-HF1, or 6.8.9-HF1)
- Descriptions: A series of vulnerabilities including arbitrary command execution, directory traversal, authentication bypass, and escalation of privilege.
- CVSS Scores: Range from 7.2 to 9
- Source & Patch: Aruba has released patches for all identified issues.

2. evm crate (Ethereum Virtual Machine):
- Vendor: evm_project
- Product: evm (a Rust implementation of Ethereum Virtual Machine)
- Description: A condition check issue in the `JUMPI` opcode, potentially allowing malicious execution.
- CVSS Score: Not specified in the provided text (but likely < 7 based on the version range).