Syxsense Experiences Record-Breaking Growth As Millions of Remote Workers Create Cyber Security Demand

By bmhumePress Release

Syxsense Experiences Record-Breaking Growth As Millions of Remote Workers Create Cyber Security Demand

Syxsense has experienced record-breaking growth driven by the demand of secure IT infrastructure to manage the remote workforce.

Remote Work Creates Demand for Cyber Security Solutions

ALISO VIEJO, Calif., October 29, 2020 – Syxsense, a global leader in IT and security management solutions, announces today it has seen record-breaking growth driven by the demand of secure IT infrastructure to manage the remote workforce.

According to a recent Cisco survey on the Future of Secure Remote Work, most companies were only somewhat prepared to support remote working. This has accelerated technologies, such as Syxsense that allow employees to work remotely and securely, providing businesses with greater flexibility.

Syxsense was the first to provide complete IT management, patching, and security vulnerability scans in a single cloud solution. Syxsense Secure includes malicious process monitoring, automated device quarantine, real-time alerting, and live data that indicates the health of all endpoints in your network or roaming devices. With real-time cloud endpoint management technology, Syxsense creates a baseline defense against known threats by ensuring devices are current with the latest software updates and security patches.

How Syxsense Keeps Remote Workers Secure

Several clients recently reviewed Syxsense on Gartner-owned Capterra, commenting on Syxsense’s ability to manage and secure remote workers:

“I’ve been able to address Windows patching for staff who no longer come into our network due to Covid-19, as well as software patching capabilities. Remote management has also been helpful as well as basic system review/maintenance in the background without the user’s input.” – Director of IT, Hospital & Health Care
“Being able to monitor inventory, processes, patching and queries in real-time have really helped keep our environment secure and up to date. This has been very important as remote working has increased across the board.” – IT Desktop Administrator, Non-Profit Organization Management
“We were starting to see issues keeping our devices up to date prior to Covid but when Covid hit and we were no longer seeing devices in the office. Syxsense was a life saver! It has allowed us to keep eyes on our devices and ensure that they are fully patched against vulnerabilities. The remote-control feature has allowed us to get to devices that we can’t access via VPN.” – Systems Administrator, Utilities
“Our company had a problem with management of users working from home. If they did not connect to VPN there was not a lot we could do to keep the machine patched and secure. Ever since we installed the Syxsense agent on all our machines we can keep them up to date and connect to them with one click from the dashboard.” – Systems Administrator, Computer Software

Syxsense is offering free, fully-featured trials for up to 100 devices for 14 days. More information on the software and trial can be found here.

Experience the Power of Syxsense

Start a trial of Syxsense, which helps organizations from 100 to 100,000 endpoints secure and manage their environment, all from just a web browser.

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo

October 28, 2020

Love0

New Chrome Zero-Day Under Active Attack

By bmhumeNews, Patch Management

New Chrome Zero-Day Under Active Attack

Google has released Chrome 86.0.4240.111 to patch high-severity issues, including a zero-day vulnerability being exploited in the wild.

Google Chrome Zero-Day Vulnerability

Google has released Chrome 86.0.4240.111 today to patch high-severity issues, including a zero-day vulnerability that has been exploited in the wild. This is currently impacting Windows, Linux and Mac OS.

The vulnerability (CVE-2020-15999) is a memory-corruption flaw called heap buffer overflow in Freetype, an open-source software development library for rendering fonts included with Chrome.

According to researchers, the vulnerability is in the FreeType’s function “Load_SBit_Png,” which processes PNG images embedded into fonts. It can be exploited by attackers to execute arbitrary code through specific fonts with embedded PNG images.

Patching the Chrome Vulnerabilities

Google released Chrome 86.0.4240.111 as Chrome’s “stable” version, which is available to all users. The company stated that “an exploit for CVE-2020-15999 exists in the wild,” but did not reveal the latest attack details.

Besides the FreeType zero-day vulnerability, Google also patched four other severe flaws in the latest Chrome update.

The following issues have been resolved:

CVE-2020-16000: Inappropriate implementation in Blink
CVE-2020-16001: Use after free in media
CVE-2020-15999: Heap buffer overflow in Freetype
CVE-2020-16003: Use after free in printing

Keep Your Organization Protected

Customers of Syxsense Manage and Syxsense Secure can find these updates within the console.

Syxsense allows you to manage and secure vulnerabilities exposed by open ports, disabled firewalls, ineffective user account policies, and security compliance violations from remote workers.

Detecting software vulnerabilities isn’t enough—traditional security scanners only do half the job by identifying and tracking possible vulnerabilities and exposure without eliminating the risk.

With security scanning and patch management in a single console, our vulnerability scanning feature not only shows you what’s wrong, but also deploys the solution. Gain visibility into OS and third-party vulnerabilities while increasing cyber resilience through automated patching and security scans.

Experience the Power of Syxsense

Start a trial of Syxsense, which helps organizations from 100 to 100,000 endpoints secure and manage their environment, all from just a web browser.

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo

October 23, 2020

Love0

Watch the Webcast: October Patch Tuesday

By bmhumePatch Management, Patch Tuesday, Video

Watch the Webcast: What You Need to Know For October Patch Tuesday

Watch this week's webcast to hear IT industry experts discuss strategies for tackling Microsoft's October Patch Tuesday updates.

October Patch Tuesday 2020

What’s your September patch strategy?

Our webcast will show you how to prioritize the latest updates for this month’s Microsoft Patch Tuesday. We’ll do a deep dive into each of the bulletins and show you how to navigate the risks of newly-identified vulnerabilities.

Our team of IT management experts have deployed over 100 million patches. Watch our free webinar to get industry-leading patch management strategies delivered right to your desk.

View the Webcast

What You Need to Know: October Patch Tuesday

Experience the Power of Syxsense

Syxsense has created innovative and intuitive technology that sees and knows everything. Manage and secure your environment with a simple and powerful solution.

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo

October 14, 2020

Love0

October Patch Tuesday: Microsoft Fixes a Near Zero-Day Vulnerability

By bmhumePatch Management, Patch Tuesday

October Patch Tuesday: Microsoft Fixes a Near Zero-Day Vulnerability

Microsoft has fixed 87 vulnerabilities for this month's Patch Tuesday, including one flaw so severe that it should be considered zero-day.

October Patch Tuesday Fixes 87 Vulnerabilities

With 87 vulnerabilities remediated, October Patch Tuesday includes 11 Critical, 75 Important and 1 patch marked as Important.

Microsoft fixed less vulnerabilities this month, but we have identified 6 vulnerabilities that are publicly awareone is so severe it should be considered Zero Day. There is still urgent work to do.

Additionally, there has been many Windows 7 and Windows Server 2008 (including R2) vulnerabilities for those subscribed to the ESU extension: Windows 7 has 23 vulnerabilities, 2 Critical, and 21 Important. Windows Server 2008 R2 also has 23 vulnerabilities: 2 Critical and 21 Important fixed.

Top October Patches and Vulnerabilities

CVE-2020-16898: Windows TCP/IP Remote Code Execution Vulnerability has a CVSS Score of 9.8 making this as close to a zero-day vulnerability, however there is a countermeasure available:

Affects Windows 10, Windows Server 2016, Windows Server 2019 and Server Core
Workaround: Disable ICMPv6 RDNSS using a Powershell command. Microsoft strongly recommends that you install the updates for this vulnerability as soon as possible even if you plan to leave this workaround in place
No reboot is needed after implementing the workaround

CVE-2020-16891: Windows Hyper-V Remote Code Execution Vulnerability has a CVSS score of 8.8 making this one of the top 3 highest vulnerabilities to prioritize this month, no countermeasure is available

Affects Windows 7 through Windows Server 2019 including Server Core
With so many IT users working from home and depending on their virtual environments, you really cannot afford not to patch this update

CVE-2020-16909: Windows Error Reporting Elevation of Privilege Vulnerability has a CVSS score of 7.8 with no countermeasure.

This vulnerability is publicly aware meaning weaponization could happen quickly
The vulnerability affects Windows 10, Windows Server 2016, Windows Server 2019 and Server Core
An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. This has been exploited previously with fileless attacks, also known as zero-footprint attacks
These types of attacks don’t install software or copy binaries on a user’s devices, so even some next-generation antivirus tools are more likely to miss it

Syxsense Recommendations

Based on the Vendor Severity and CVSS Score, we have made a few recommendations below which you should prioritize this month; please pay close attention to any of these which are Publicly Aware and / or Weaponized.

CVE	Description	Vendor Severity	CVSS Score	Publicly Aware	Weaponised	Countermeasure	Syxsense Recommended
CVE-2020-16909	Windows Error Reporting Elevation of Privilege Vulnerability	Important	7.8	Yes	No	No	Yes
CVE-2020-16908	Windows Setup Elevation of Privilege Vulnerability	Important	7.8	Yes	No	No	Yes
CVE-2020-16885	Windows Storage VSP Driver Elevation of Privilege Vulnerability	Important	7.8	Yes	No	No	Yes
CVE-2020-16938	Windows Kernel Information Disclosure Vulnerability	Important	5.5	Yes	No	No	Yes
CVE-2020-16901	Windows Kernel Information Disclosure Vulnerability	Important	5	Yes	No	No	Yes
CVE-2020-16937	.NET Framework Information Disclosure Vulnerability	Important	4.7	Yes	No	No	Yes
CVE-2020-16898	Windows TCP/IP Remote Code Execution Vulnerability	Critical	9.8	No	No	Yes	Yes
CVE-2020-16911	GDI+ Remote Code Execution Vulnerability	Critical	8.8	No	No	No	Yes
CVE-2020-16891	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.8	No	No	No	Yes
CVE-2020-16951	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	8.6	No	No	No	Yes
CVE-2020-16952	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	8.6	No	No	No	Yes
CVE-2020-16947	Microsoft Outlook Remote Code Execution Vulnerability	Critical	8.1	No	No	No	Yes
CVE-2020-17003	Base3D Remote Code Execution Vulnerability	Critical	7.8	No	No	No	Yes
CVE-2020-16915	Media Foundation Memory Corruption Vulnerability	Critical	7.8	No	No	No	Yes
CVE-2020-16923	Microsoft Graphics Components Remote Code Execution Vulnerability	Critical	7.8	No	No	No	Yes
CVE-2020-16967	Windows Camera Codec Pack Remote Code Execution Vulnerability	Critical	7.8	No	No	No	Yes
CVE-2020-16968	Windows Camera Codec Pack Remote Code Execution Vulnerability	Critical	7.8	No	No	No	Yes
CVE-2020-1080	Windows Hyper-V Elevation of Privilege Vulnerability	Important	8.8	No	No	No	Yes
CVE-2020-16945	Microsoft Office SharePoint XSS Vulnerability	Important	8.7	No	No	No	Yes
CVE-2020-16946	Microsoft Office SharePoint XSS Vulnerability	Important	8.7	No	No	No	Yes
CVE-2020-16944	Microsoft SharePoint Reflective XSS Vulnerability	Important	8.7	No	No	No	Yes
CVE-2020-16918	Base3D Remote Code Execution Vulnerability	Important	7.8	No	No	No
CVE-2020-16939	Group Policy Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16924	Jet Database Engine Remote Code Execution Vulnerability	Important	7.8	No	No	No
CVE-2020-16978	Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability	Important	7.8	No	No	No
CVE-2020-16929	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	No
CVE-2020-16930	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	No
CVE-2020-16931	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	No
CVE-2020-16932	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	No
CVE-2020-1167	Microsoft Graphics Components Remote Code Execution Vulnerability	Important	7.8	No	No	No
CVE-2020-16957	Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability	Important	7.8	No	No	No
CVE-2020-16928	Microsoft Office Click-to-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16955	Microsoft Office Click-to-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16954	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	No
CVE-2020-16995	Network Watcher Agent virtual machine extension for Linux Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16907	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16913	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16940	Windows – User Profile Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16920	Windows Application Compatibility Client Library Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16912	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16936	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16972	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16973	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16974	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16975	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16976	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16916	Windows COM Server Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16935	Windows COM Server Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16895	Windows Error Reporting Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-1243	Windows Hyper-V Denial of Service Vulnerability	Important	7.8	No	No	No
CVE-2020-1047	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16892	Windows Image Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16902	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16980	Windows iSCSI Target Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16890	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16887	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-0764	Windows Storage Services Elevation of Privilege Vulnerability	Important	7.8	No	No	No
CVE-2020-16894	Windows NAT Remote Code Execution Vulnerability	Important	7.7	No	No	No
CVE-2020-16927	Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability	Important	7.5	No	No	No
CVE-2020-16896	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	7.5	No	No	Yes
CVE-2020-16863	Windows Remote Desktop Service Denial of Service Vulnerability	Important	7.5	No	No	No
CVE-2020-16899	Windows TCP/IP Denial of Service Vulnerability	Important	7.5	No	No	Yes
CVE-2020-16969	Microsoft Exchange Information Disclosure Vulnerability	Important	7.1	No	No	No
CVE-2020-16876	Windows Application Compatibility Client Library Elevation of Privilege Vulnerability	Important	7.1	No	No	No
CVE-2020-16877	Windows Elevation of Privilege Vulnerability	Important	7.1	No	No	No
CVE-2020-16934	Microsoft Office Click-to-Run Elevation of Privilege Vulnerability	Important	7	No	No	No
CVE-2020-16933	Microsoft Word Security Feature Bypass Vulnerability	Important	7	No	No	No
CVE-2020-16977	Visual Studio Code Python Extension Remote Code Execution Vulnerability	Important	7	No	No	No
CVE-2020-16900	Windows Event System Elevation of Privilege Vulnerability	Important	7	No	No	No
CVE-2020-16905	Windows Error Reporting Elevation of Privilege Vulnerability	Important	6.8	No	No	No
CVE-2020-16943	Dynamics 365 Commerce Elevation of Privilege Vulnerability	Important	6.5	No	No	No
CVE-2020-16948	Microsoft SharePoint Information Disclosure Vulnerability	Important	6.5	No	No	No
CVE-2020-16953	Microsoft SharePoint Information Disclosure Vulnerability	Important	6.5	No	No	No
CVE-2020-16910	Windows Security Feature Bypass Vulnerability	Important	6.2	No	No	No
CVE-2020-16897	NetBT Information Disclosure Vulnerability	Important	5.5	No	No	No
CVE-2020-16919	Windows Enterprise App Management Service Information Disclosure Vulnerability	Important	5.5	No	No	No
CVE-2020-16914	Windows GDI+ Information Disclosure Vulnerability	Important	5.5	No	No	No
CVE-2020-16889	Windows Kernel Stream Information Disclosure Vulnerability	Important	5.5	No	No	No
CVE-2020-16956	Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability	Important	5.4	No	No	No
CVE-2020-16904	Azure Functions Elevation of Privilege Vulnerability	Important	5.3	No	No	No
CVE-2020-16886	Power Shell Get Module WDAC Security Feature Bypass Vulnerability	Important	5.3	No	No	No
CVE-2020-16922	Windows Spoofing Vulnerability	Important	5.3	No	No	No
CVE-2020-16950	Microsoft SharePoint Information Disclosure Vulnerability	Important	5	No	No	No
CVE-2020-16949	Microsoft Outlook Denial of Service Vulnerability	Moderate	4.7	No	No	No
CVE-2020-16941	Microsoft SharePoint Information Disclosure Vulnerability	Important	4.1	No	No	No
CVE-2020-16942	Microsoft SharePoint Information Disclosure Vulnerability	Important	4.1	No	No	No
CVE-2020-16921	Windows Text Services Framework Information Disclosure Vulnerability	Important	TBC	No	No	No

Experience the Power of Syxsense

Syxsense is a cloud-based solution that helps organizations manage and secure their endpoints with ease. Automatically deploy OS and third-party patches as well as Windows 10 Feature Updates for Microsoft, Mac, and Linux devices.

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo

October 13, 2020

Love0

Google Chrome 86 Brings Massive Security Fixes

By bmhumePatch Management

Google Chrome 86 Brings Massive Security Fixes

Google’s latest version of Chrome has been released with 35 security fixes, including a critical bug and a new password feature.

Google Releases Chrome 86 with Critical Fixes

Google has leased its Stable channel version of Google Chrome 86. Contained within this release includes a massive amount of updates and bug fixes for security, features and API. This version is supported on both Windows, Android, Mac and Linux.

However, a critical flaw (CVE-2020-15967) in Chrome’s payments component has a CVSS score of 9.8, making this a Zero Day vulnerability. This severity rating means Google is recommending you deploy this version as soon as possible.

The flaw is a use-after-free bug. Use after free is a memory-corruption flaw where an attempt is made to access memory after it has been freed. This can cause malicious impacts, from making a program to crash to potentially leading to arbitrary code execution.

Use-after-free bugs have been a frequent threat to the browser. Seven high-severity vulnerabilities fixed in Chrome 86 were use-after-free flaws, from ones affecting Chrome’s printing (CVE-2020-15971), audio (CVE-2020-15972), password manager (CVE-2020-15991) and WebRTC (CVE-2020-15969) components.

Keep Your Organization Protected

Customers of Syxsense Manage and Syxsense Secure can find these updates within the console.

Syxsense allows you to manage and secure vulnerabilities exposed by open ports, disabled firewalls, ineffective user account policies, and security compliance violations from remote workers.

Detecting software vulnerabilities isn’t enough—traditional security scanners only do half the job by identifying and tracking possible vulnerabilities and exposure without eliminating the risk.

With security scanning and patch management in a single console, our vulnerability scanning feature not only shows you what’s wrong, but also deploys the solution. Gain visibility into OS and third-party vulnerabilities while increasing cyber resilience through automated patching and security scans. Insights into the OS misconfigurations and compliance violations reduce your attack surface and increase peace of mind.

Experience the Power of Syxsense

Start a trial of Syxsense, which helps organizations from 100 to 100,000 endpoints secure and manage their environment, all from just a web browser.

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo

October 12, 2020

Love0

October 2020