Skip to content

Author: webmaster

IT Consulting Melbourne

IT Consulting

Are you frustrated with technology problems that consume your working hours? With our IT Consulting services, you’ll know the technology you rely on will be matched to your specific business needs, so you can focus on what really matters.

At CTS we provide IT Consulting services in the Greater Melbourne Area for businesses that want a single technology company that handles all of their technology requirements and needs.

Continue reading

Domain Name and Web Hosting

Domain Name and Web Hosting

At CTS we offer a complete Digital Presence Solution for new businesses.

Register the domain name
Create a Website
Host the Website
Promote the Website on Google Search Engine
For existing businesses we offer a complete managed solution for their domain names and website hosting management.

Continue reading

Best Managed IT Support

Best Managed IT Support

Our Business IT Support plans are designed and tailored specifically to your business.

After our initial assessment of your current infrastructure and business critical applications we then determine the best fit IT Support Plan for your business.
On Demand IT Support can be either Remote or Onsite Support.

Continue reading

Disaster Recovery

Disaster Recovery

How quickly will your business recover from an IT disaster?
Digital Scams today can reach more people than ever before as criminals manipulate digital technology and online platforms to access a larger pool of potential victims. As a result the continuity of your business depends highly on a resilient, robust and adaptable IT System.

Continue reading

Remote code execution vulnerability

Atlassian logo

Remote code execution vulnerability

On June 3 2022, Atlassian published a security advisory regarding a critical unauthenticated remote code execution (RCE) vulnerability (CVE-2022-26134) in all supported versions of Atlassian Confluence Server and Data Center. 

Exploitation of this RCE vulnerability could allow a malicious actor to remotely install malware or otherwise control the affected device without authentication. 

The ACSC is aware of malicious actors successfully exploiting the vulnerability prior to Atlassian’s disclosure, however at this time the ACSC is not aware of successful exploitation within Australia.

Atlassian has released version updates (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 and 7.18.1) to fix the vulnerability. Atlassian recommends vendors upgrade Confluence immediately.

The ACSC recommends Atlassian Confluence Server and Data Center users continue to monitor the Atlassian website for updates as well as future vulnerabilities.

Remote code execution vulnerability

Multiple vulnerabilities present in F5 products

CTS Managed Cyber Security

Multiple vulnerabilities present in F5 products

Alert status HIGH

Update

This is an update to an Alert the ACSC issued on 09 May 2022.

Multiple Critical and High risk vulnerabilities exist in certain versions of F5 products.

As of 10 May 2022, the ACSC is aware of malicious cyber actors actively exploiting vulnerable versions of  F5 products  in Australia and globally.

Given the widespread exploitation of this vulnerability, the ACSC encourages all organisations to assume their F5 products may have been compromised and initiate investigative procedures in addition to applying security patches.

Background / What has happened?

In May 2022, F5 released a security advisory relating to multiple Critical and High rated CVE’s, including CVE-2022-1388 with a CVSS score of 9.8, on multiple versions of their BIG-IP product line.  

CVE-2022-1388 allows malicious actors to bypass authentication on internet-exposed iControl interfaces, potentially executing arbitrary commands, creating or deleting files, or disabling services.

The ACSC is aware of Proof of Concept code exploiting CVE-2022-1388, and attempts by malicious actors to exploit this vulnerability on Australian networks.

Mitigation / How do I stay secure?

Patches are available for all High and Critical rated CVE’s in F5’s Security advisory, and most have mitigation actions in the event immediate patching is not possible.

The ACSC recommend that F5 users continue to monitor the F5 website for updates and future vulnerabilities.

Assistance / Where can I go for help?

The ACSC is monitoring the situation and is able to provide assistance and advice as required. Organisations that have been impacted or require assistance can contact the ACSC via cyber.gov.au/report, or 1300 CYBER1.

Multiple vulnerabilities present in F5 products