Hello and welcome to the Tuesday, December 13, 2022 edition of the Sandstone Storm Center's Stormcast.

My name is Johannes Ulrich.

And today I'm recording from Jacksonville, Florida.

In Diaries, we got a quick one today by Didi, just showing how to sort strings in Cyber Chef by length.

If you are considering CyberChef, your go-to tool when it comes to converting encodings and

such, well, it can do way more, almost sort of a little string-processing suite now.

And Fortygaard released an advisory that vulnerability in the SSL VPN

demon, and that's CVE 2022-475, is already exploited in the wild. They say they saw a one attempt or a one successful exploitation

using that vulnerability. Interesting, the vulnerability was actually patched a couple weeks ago,

at least according to the affected products list here for the OS 723, which is the patched version, was released,

I believe about three, maybe four weeks ago.

They now release this advisory announcing that this version of 40 OS also patches this critical

vulnerability. CVSS score of 9.3. The problem with these

hidden patches, of course, is that you often don't take the update too serious. And actually,

I came across a discussion on Reddit when I was looking for when it was actually being released

where they essentially just sort of asked that question, should I apply, should I not apply the patch?

Is this version of 40 OS stable enough without knowing that a critical already exploited vulnerability is being patched, of course you're going to treat an update like this a lot less urgently.

As far as affected versions go, well, for 40OS, the 6.2, 6.4, 7.0 and 7 7.2 version are vulnerable. For the US 6K, 7K, you also got the 6.0 branch that is also vulnerable.

And as I said, updates were released a couple weeks ago. Now, with his advisory, Fortigate also lists various indicators of compromise that they found on this system that was actually compromised.

Of course, no guarantee that this is of the only set of indicators of compromise that you will see, but probably a good place to start.

And of course, 48 is not alone with vulnerable VPN's Pulse Secure is a VPN solution that had its share of vulnerabilities.

And according to a report from census,

...