US Urges Manufacturers to Tackle OS Vulnerabilities Amid Global Threats
The US government has stepped up its efforts to bolster software security. It has urged manufacturers to address operating system (OS) command injection vulnerabilities, following recent global threats. Meanwhile, Chinese state hackers have exploited a Cisco vulnerability, prompting a joint alert from CISA and FBI.
The US National Cybersecurity Strategy, published in March 2023, emphasizes promoting software security by design. This approach aligns with CISA's Secure by Design initiative, aiming to shift the cybersecurity burden from end users to technology manufacturers. However, it remains unclear which manufacturers have committed to these obligations.
Multiple threat actors have exploited zero day vulnerabilities in Ivanti products (CVE-2024-21887) and Palo Alto Networks' PAN-OS software (CVE-2024-3400). These incidents highlight the urgent need for manufacturers to address OS command injection vulnerabilities. To prevent such issues, manufacturers are advised to use built-in library functions, input parameterization, and limit user input in commands. Proper validation and sanitization of user input can also mitigate these risks.
In response to several threat actor campaigns exploiting OS command injection defects in network edge devices, CISA and FBI issued an alert. They urged technology manufacturers to analyze past vulnerabilities and develop a plan to eliminate them in the future.
The recent global threats and exploitation of vulnerabilities underscore the importance of proactive measures by software manufacturers. By adopting secure by design principles and addressing OS command injection vulnerabilities, manufacturers can significantly enhance software security and protect users from cyber threats.
Read also:
- Pablo Escobar's Former Estate 'Hacienda Nápoles' to Be Transformed by Women's Organization
- Emergency services of the future revealed by Renault with the introduction of the Vision 4Rescue vehicle.
- SonicWall executive Michael Crean discusses the current state of managed security
- Companies exercise prudence towards AI adoption, ensuring secure implementation: Exploring safeguards and strategies.
