Security firm FireEye has patched a serious, remotely exploitable bug in several products that can be caused simply by receiving an email.
After its recent debacle over efforts to silence a security researcher, FireEye probably won’t be doing the same to the two Google researchers who reported its latest security bug that can be exploited by a target simply receiving an email.
FireEye revealed today that Monday last week it patched a high severity remote code execution bug affecting its NX, EX, AX ad FX series devices, crediting Google’s Project Zero bug hunters, Tavis Ormandy and Natalie Silvanovich.
As Ormandy explained on Wednesday: “An attacker would only have to send an email to a user to gain access to a persistent network tap - the recipient wouldn’t even have to read the email, just receiving it would be enough.”
FireEye’s devices, typically sold to large enterprise or government agencies, often hold a trusted position on a network and are deployed to protect customers’ data from so-called advanced persistent attackers such as government sponsored hackers.
Ormandy notes that as a “network tap”, FireEye devices gain access to employee passwords, downloads, browsing history and attachments. Depending on the configuration, an attacker could tamper with traffic or insert backdoors. If the now-fixed bug was exploited, it would be a “nightmare scenario”, Ormandy said.
FireEye on Monday said it was notified by Ormandy of the problem on December 5 and due to the severity of the issue decided to immediately issue emergency measures to mitigate risks to customers. Two days later it pushed out a permanent fix.
The bug, which existed in a module that analyses Java jar files, “could allow an attacker to execute code remotely on a FireEye appliance”, said FireEye.
While it does offer automatic updates, FireEye urged customers who opt to manually apply them to do so immediately. The company said severity of the bug warranted offering the fix to customers whose subscriptions have lapsed.
“Given that remote code execution could be possible, we have concluded in our analysis that this vulnerability posed a high risk to our customers,” it said.
Ormandy noted that following a number of steps, including a separate privilege escalation bug, he was able to gain root access and complete control over the FireEye device in his test set-up.
“Putting these steps together, an attacker can send an email to a user or get them to click a link, and completely compromise one of the most privileged machines on the network,” he said.
That means an attacker could load a rootkit, and remain on a network after reboots or factory resets to inspect, modify traffic, and perform any other action.
FireEye users can expect another update in future that will close off the bug reported by Ormandy with the company requesting more time to fix the privilege escalation flaw.
FireEye was scorned by many security researchers after it sued a German researcher to suppress details about a bug in its security appliances this September. The researcher, Kristian Erik Hermansen, controversially demanded payment from FireEye if he was to disclose the bug to it and threatened to reveal it to anyone that was willing to pay.
Security ALERT!
Need help making the right choice for you business? Need to update your system but don't know where to start? CSO can help, check out our security hub today.