Alerts and Advisories - Cybersecurity | WALLIX Safety Information

DECEMBER 2023

Potential sensitive information disclosure CVE-2023-49961

SUMMARY

A vulnerability has been discovered in the WALLIX products that may allow an attacker to access sensitive information. The attacker could use this vulnerability to gain illegitimate accesses.

WALLIX recommends to immediately apply the published fixes, or before it is applied, the workaround described below.

Affected Products

All supported versions of WALLIX Bastion and Access Manager as an appliance.

Workarounds

The following article of our knowledge base provides you with the mitigation procedure.

Access Manager As Appliance: https://wallix.lightning.force.com/lightning/r/Knowledge__kav/ka0Sb00000007O5IAI/view
Bastion: https://wallix.lightning.force.com/lightning/r/Knowledge__kav/ka0Sb00000005irIAA/view

Fixed Software

Hotfixes versions and patches are available on our download portal:

Bastion 9.0.9 : https://cloud.wallix.com/index.php/s/DBkJWdtsPjW7BSn (SHA256: dc5e3fda310a94cd54835800718cc1ec02084a126f79c82dde465eff40d698a4 )
Bastion 10.0.5 : https://cloud.wallix.com/index.php/s/PYjdncJSTaEBRSg (SHA256: 65cdc9b49dfa2160a4a8489fd1c61cad1a48444dbb86cb4a9ac0f4ff527d1197 )

Exploitation and Public Annoncements

WALLIX is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

However, it is recommended to look for any abnormal activity on the WALLIX Bastions and WALLIX Access Manager. It is recommended also to ensure that Bastion and Access Manager firewall are enabled.

FEBRUARY 2023

Access Manager privilege escalation CVE-2023-23592

February 2023

Access Manager privilege escalation CVE-2023-23592

SUMMARY

A vulnerability has been discovered in the WALLIX Access Manager product that may allow an attacker to access sensitive information. The attacker could use this vulnerability to gain illegitimate accesses.

WALLIX recommends to immediately apply the published fixes, or before it is applied, the workaround described below.

Affected Products

All versions of WALLIX Access Manager.

Workarounds

The following article of our knowledge base provides you with the workaround procedure.

https://support.wallix.com/s/article/How-can-I-mitigate-CVE-2023-23592

Fixed Software

Hotfixes versions are available on our download portal:

· Version 3.0.16

· Version 4.0.3

Exploitation and Public Announcements

WALLIX is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. However, it is recommended to look for any abnormal activity on the WALLIX Bastions that are connected to WALLIX Access Manager. In particular it is recommended to look for unusual IP used by privileged users that may be used by multiple user accounts.

Source

Internal security checks

DECEMBER 2021

Log4J remote code execution vulnerability (CVE-2021-44228)

SUMMARY

Alibaba Cloud Security Team published a vulnerability in log4j, a common Java logging library on the 9th of December 2021. (CVE-2021-44228) This vulnerability allows for unauthenticated remote code execution on Java applications.

Affected Products

All versions of WALLIX Access Manager

Workarounds

The default configuration of WALLIX Access Manager prevents from exploiting the said vulnerability on the login field.

However, in order to prevent any possibility to find an exploit in the event of a modification of the default configuration of the WALLIX Access Manager, the WALLIX team proposes a patch which deactivates the faulty class of the log4j library.

This patch applies to all releases of Access Manager from 2.0 version on.

The following article of our knowledge base provides you with the access to the patch as well as the procedure to install it.

https://support.wallix.com/s/article/CVE-2021-44228-Mitigation-procedure

Fixed Software

An update of the Log4J version is planned alongside the Access Manager version 3.0.11.

This version is planned to be released by the end of December 2021.

Exploitation and Public Announcements

WALLIX is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. However, it is recommended to look for any abnormal activity on the WALLIX Bastions that are connected to WALLIX Access Manager. In particular it is recommended to look for creation of new users or authorizations especially since the publication of the CVE

Source

Alibaba Cloud Security Team published a vulnerability in log4j, a common Java logging library on the 9th of December 2021. (CVE-2021-44228)

JANUARY 2021

Sudo Privilege Escalation affecting WALLIX Products – CVE-2021-3156

SUMMARY

The Qualys Research Team has discovered a heap overflow vulnerability in sudo (CVE-2021-3156), any local unprivileged user can gain root privileges on a vulnerable host using a default sudo configuration by exploiting this vulnerability.

sudo can only be exploited locally. This means that either :

The user is connected on the WALLIX Bastion, through the wabadmin account, on the administration interface. This user can then exploit sudo to become root and bypass all securities of WALLIX Bastion
A Remote Code Exploitation (RCE) vulnerability exists in another piece of WALLIX software or third party, that will provides a local shell. After successfully exploiting this vulnerability, the attacker will be able to exploit sudo to become root. To WALLIX knowledge, an up-to-date Bastion does not have such vulnerability

Affected Products

All versions prior to WALLIX Bastion 8.0.6 (included)
All versions 8.1 and 8.2

Workarounds

There is no workaround to this vulnerability

Fixed Software

This vulnerability is fixed from the WALLIX Bastion 8.0.7 on, and 7.0.14 on.

A Fix Patch is available for version 8.0.6 and before (it applies for 8.1 and 8.2 versions)
A Fix patch is available for version 7.0.13 and before

These elements are available on our download site : WALLIX Support: Patches

Exploitation and Public Announcements

WALLIX is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

On January 26, 2021, Qualys publicly disclosed this vulnerability in a security bulletin at the following link: https://blog.qualys.com

WALLIX SUPPORT & SERVICES

WALLIX
CONSULTING

Think, design and secure complex or large implementations

CONSULTING

CUSTOMER SUPPORT

Get in touch
with the customer team

CUSTOMER SUPPORT

PROFESSIONAL SERVICES

Implementation, audit and support for WALLIX solutions

PROFESSIONAL SERVICES

WALLIX
ACADEMY

Training and certifications for partners and end users

TRAINING

Cookie	Duration	Description
IDE	1 year 24 days	Used by Google DoubleClick and stores information about how the user uses the website and any other advertisement before visiting the website. This is used to present users with ads that are relevant to them according to the user profile.
test_cookie	15 minutes	This cookie is set by doubleclick.net. The purpose of the cookie is to determine if the user's browser supports cookies.
VISITOR_INFO1_LIVE	5 months 27 days	This cookie is set by Youtube. Used to track the information of the embedded YouTube videos on a website.

Cookie	Duration	Description
__hstc	1 year 24 days	This cookie is set by Hubspot and is used for tracking visitors. It contains the domain, utk, initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session).
_ga	2 years	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.
_gid	1 day	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
hubspotutk	1 year 24 days	This cookie is used by HubSpot to keep track of the visitors to the website. This cookie is passed to Hubspot on form submission and used when deduplicating contacts.
trackalyzer	1 year	This cookie is used by Leadlander. The cookie is used to analyse the website visitors and monitor traffic patterns.

Cookie	Duration	Description
__hssc	30 minutes	This cookie is set by HubSpot. The purpose of the cookie is to keep track of sessions. This is used to determine if HubSpot should increment the session number and timestamps in the __hstc cookie. It contains the domain, viewCount (increments each pageView in a session), and session start timestamp.
bcookie	2 years	This cookie is set by linkedIn. The purpose of the cookie is to enable LinkedIn functionalities on the page.
lang	session	This cookie is used to store the language preferences of a user to serve up content in that stored language the next time user visit the website.
lidc	1 day	This cookie is set by LinkedIn and used for routing.
messagesUtk	1 year 24 days	This cookie is set by hubspot. This cookie is used to recognize the user who have chatted using the messages tool. This cookies is stored if the user leaves before they are added as a contact. If the returning user visits again with this cookie on the browser, the chat history with the user will be loaded.

Cookie	Duration	Description
__cfduid	1 month	The cookie is used by cdn services like CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.
__hssrc	session	This cookie is set by Hubspot. According to their documentation, whenever HubSpot changes the session cookie, this cookie is also set to determine if the visitor has restarted their browser. If this cookie does not exist when HubSpot manages cookies, it is considered a new session.
cookielawinfo-checbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
JSESSIONID	session	Used by sites written in JSP. General purpose platform session cookies that are used to maintain users' state across page requests.
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Cookie	Duration	Description
_gat_UA-12183334-1	1 minute	No description
AnalyticsSyncHistory	1 month	No description
CONSENT	16 years 9 months 23 days 12 hours 13 minutes	No description
UserMatchHistory	1 month	Linkedin - Used to track visitors on multiple websites, in order to present relevant advertisement based on the visitor's preferences.
wp-wpml_current_language	1 day	No description

DECEMBER 2023

FEBRUARY 2023

DECEMBER 2021

JANUARY 2021

SUMMARY

Affected Products

Workarounds

Fixed Software

Exploitation and Public Announcements

Source

WALLIX SUPPORT & SERVICES

WALLIX
CONSULTING

CUSTOMER SUPPORT

PROFESSIONAL SERVICES

WALLIX
ACADEMY

PRODUCTS

RESOURCES

SUPPORT

ABOUT

FOLLOW US

DECEMBER 2023

FEBRUARY 2023

DECEMBER 2021

JANUARY 2021

SUMMARY

Affected Products

Workarounds

Fixed Software

Exploitation and Public Announcements

Source

WALLIX SUPPORT & SERVICES

WALLIXCONSULTING

CUSTOMER SUPPORT

PROFESSIONAL SERVICES

WALLIX ACADEMY

PRODUCTS

RESOURCES

SUPPORT

ABOUT

FOLLOW US

WALLIX
CONSULTING

WALLIX
ACADEMY