SaltStack 3004.1 Security Issue

SaltStack released an update today:
https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/

Security Onion currently uses SaltStack 3004.1. However, we don't use PAM authentication from within Salt so this security issue should not affect our installations.

We do have plans to update to Salt 3004.2 in the upcoming 2.3.140 release:
https://github.com/Security-Onion-Solutions/securityonion/issues/8166

New securityonion-capme package resolves a remote command injection vulnerability

Summary
A remote command injection vulnerability in capme was discovered by Kevin Breen and James Hall and responsibly disclosed.  An updated capme package is available now which resolves this vulnerability.  You should install this update as soon as possible.

Thanks
Thanks to Kevin Breen and James Hall for finding this issue and disclosing it responsibly!

Updating
The new package version is as follows:
securityonion-capme - 20121213-0ubuntu0securityonion24precise

This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Additional mitigations
Security Onion management interfaces should be on dedicated management networks and/or locked down to only allow connections from known good IP addresses:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Firewall

Timeline

2016/01/12 1:03PM Eastern
Received detailed disclosure from Kevin Breen and James Hall via email.

2016/01/12 1:19PM Eastern
Acknowledged receipt of email.

2016/01/12 1:56PM Eastern
Confirmed issue and began working on fix.

2016/01/12 5:12PM Eastern
Completed fix and started testing.

2016/01/12 9:20PM Eastern
Completed testing and sent fix to Kevin Breen and James Hall for additional testing.

2016/01/13 6:40AM Eastern
Received confirmation from Kevin Breen and James Hall that the fix works as expected and stops all the attacks they had considered.

2016/01/13 7:26AM Eastern
Added fix to securityonion-capme package.

2016/01/13 7:35AM Eastern
Submitted securityonion-capme package to build farm.

2016/01/13 7:51AM Eastern
Package build complete.  Initiated copy to stable PPA.

2016/01/13 8:01AM Eastern
Copy to stable PPA complete.

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://github.com/Security-Onion-Solutions/security-onion/wiki/MailingLists

UPDATE 2016/02/02 - Changed "code execution" to "command injection".

Keep All Your Windows Software Updated with Secunia PSI

These days, it's imperative to keep all your software updated. Not only is it extremely important that you update your Microsoft software, but all third-party software must be kept updated as well (Adobe Reader and Flash, for example). You could open each application and look for its "Check for Updates" menu entry, but this can be time consuming. This method of updating may also miss some software. For example, you may have multiple installations of the Java JRE on your system in different locations. Many Java applications bundle their own JRE in their own directory and never update it.

What to do?

Secunia PSI (Personal Software Inspector) scans all files on your Windows system and, using Secunia's database of fingerprints, is able to determine the software versions installed on your system (including the multiple installations of Java in the example above). It then makes recommendations for any vulnerable software, including links to download the patched version of the software or to uninstall the program. I recommend switching from the default "simple" interface to the "advanced" interface to see all vulnerabilities on your system.

I've been using Secunia PSI on my personal systems for a few months now. It has saved me a lot of time in trying to keep track of all the different software versions on my systems. It also comes in quite handy when performing tech support for relatives--just install Secunia PSI and let it tell you what exactly needs to be updated.

Secunia PSI is free for personal use and I wholeheartedly recommend you try it today and see what vulnerabilities it finds on your system.