Lexmark released a security firmware update to fix a remote code execution flaw, tracked as CVE-2023-23560, that impacts more than 100 printer models.

Lexmark has released a security firmware update to address a remote code execution vulnerability, tracked as CVE-2023-23560, that impacts more than 100 printer models.

The CVE-2023-23560 flaw is a server-side request forgery (SSRF) in the Web Services feature of Lexmark printers, it received a CVSS score 9.0.

“A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices. This vulnerability can be leveraged by an attacker to gain arbitrary code execution on the device.” reads the advisory published by the company.

The compromise of a vulnerable printer can be exploited by threat actors to achieve an initial foothold in the target network. Once compromised a printer, an attacker can access the print spooler exposing sensitive documents, or obtain the credentials to the network the device is connected to.

The good news is that the company is not aware of attacks in the wild exploiting the CVE-2023-23560 vulnerability.

However, we cannot exclude that threat actors will start to exploit this flaw due to the public availability of a proof of concept (PoC) exploit code.

“Lexmark is not aware of any malicious use against Lexmark products of the vulnerability described in this advisory, but proof of concept code has been publicly published.” continues the advisory.

The list of impacted devices is impressive, according to the advisory, more than 100 printer models are affected by this vulnerability.

To determine if your device is running a vulnerable firmware version, select the “Settings”->“Reports”->”Menu Setting Page” menu item from the operator panel. If the firmware level listed under “Device Information” matches any level under “Affected Releases” reported in the advisory, then upgrade to a “Fixed Release”.

Customers are recommended to download the latest firmware version for their printer model by visiting Lexmark’s Suppoet Center portal.

The company also provides a workaround in case it is not possible to immediately update the firmware:

“Disabling the Web-Services service on the printer (TCP port 65002) blocks the ability to exploit this vulnerability. The port can be blocked by following process: “Settings”->”Network/Ports”- > “TCP/IP”- > “TCP/IP Port Access” then uncheck “TCP 65002 ( WSD Print Service )” and save.” states the advisory.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, printer)

The post CVE-2023-23560 flaw exposes 100 Lexmark printer models to hack appeared first on Security Affairs.

Indian shares fell more than 1% to an over three-month low on Friday as some Adani Group companies plunged 20% and hit their lower circuits in the wake of a short-seller attack on the conglomerate, which also dragged down financials.

The Nifty 50 index (.NSEI) was down 1.68% at 17,591.25 as of 1:23 p.m. IST, while the S&P BSE Sensex (.BSESN) fell 1.51% to 59,294.20.

The indexes have slid more than 2% each in the truncated week, triggered by U.S. short-seller Hindenburg Research’s report on Wednesday that flagged concerns about the Adani Group’s debt levels and use of tax havens.

Stocks of the Adani Transmission (ADAI.NS), Adani Green Energy (ADNA.NS) tumbled 20% each, while Adani Power (ADAN.NS) dropped 5%, with all three stock hitting their lower circuit.

Adani Ports and Adani Enterprises (ADEL.NS) were the worst performers on the Nifty 50, plunging more than 20% each.

Adani Enterprises was trading at 2,877.10 rupees, well below the lower end of the price band for its $2.45 billion follow-on public offering (FPO).

“The selloff is seriously extreme in the sense that day before yesterday Adani Group stocks saw a huge fall in market cap and today the same kind of episode is repeated,” said Saurabh Jain, assistant vice-president, research, SMC Global Securities.

“It has clearly dented overall investor sentiment. The nervousness has led to a fall in stocks across the board. When a selloff of this kind of magnitude is seen in a very short span of time, investors sell other stocks where they are in the money.”

Financials sector (.NIFTYFIN) led the slide, falling 2.8% even though brokerages said banks’ exposure to the Adani Group was within manageable limits.

Source link

The post Russians attack Ukrainian positions in Zaporizhzhia region 148 times appeared first on Ukraine Intelligence.

Your daily news brief direct from Ukraine’s capital.

Shares of India’s Adani Enterprises (ADEL.NS) sank 15% on Friday as a scathing report by a U.S. short seller triggered a rout in the conglomerate’s listed firms, casting doubts on how investors will respond to the company’s record $2.45 billion secondary sale.

Seven listed companies of the Adani conglomerate – controlled by one of the world’s richest men Gautam Adani – have lost a combined $43.5 billion in market capitalisation since Wednesday, with U.S. bonds of Adani firms also falling after Hindenburg Research flagged concerns in a Jan. 24 report about debt levels and the use of tax havens.

Adani Group has dismissed the report as baseless and said it is considering whether to take legal action against the New York-based firm.

“There were heavy positions in Adani group (shares), the way they have risen in the last couple of years,” said Neeraj Dewan, director at Quantum Securities in New Delhi.

“This is a classic case of panic selling…,” he said, noting the concerns were also spreading to Indian banks with exposure to Adani group’s debt.

The index tracking state-run banks (.NIFTYPSU) was down 4.6%, while the main Nifty Bank index (.NSEBANK) fell 2.7%.

CLSA estimates that Indian banks were exposed to about 40% of the 2 trillion Indian rupees ($24.53 billion) of Adani group debt in the fiscal year to March 2022.

The stunning selloff has cast a shadow over Adani Enterprises’ secondary sale which began on Friday. The anchor portion of the sale saw participation from investors including the Abu Dhabi Investment Authority on Wednesday.

The firm has set a floor price of 3,112 rupees ($38.22) a share and a cap of 3,276 rupees. But by midday on Friday, the stock had slumped to 2,875 rupees – well below the lower end of the price offering.

As of 0700 GMT, investors, mostly retail, had bid for around 200,000 shares, compared with the 45.5 million on offer, according to BSE exchange data. Bidding for retail investors will close on Jan. 31.

Shares of other listed Adani firms also plummetted, with Adani Transmission Ltd (ADAI.NS) Adani Total Gas (ADAG.NS), Adani Green Energy (ADNA.NS) and Adani Ports (APSE.NS) sinking 20% each.

In its report, Hindenburg said key listed Adani Group companies had “substantial debt”, putting the conglomerate on a “precarious financial footing”, and that “sky-high valuations” had pushed the share prices of seven listed Adani companies as much as 85% beyond actual value.

Billionaire U.S. investor Bill Ackman said on Thursday that he found the Hindenburg report “highly credible and extremely well researched.”

Hindenburg said it held short positions in Adani through its U.S.-traded bonds and non-Indian-traded derivative instruments, meaning it is betting that their price would fall.

Adani Group has repeatedly faced and dismissed concern about debt levels. It defended itself in a presentation titled “Myths of Short Seller” on Thursday, saying deleveraging by promoters – or key shareholders – was “in a high growth phase”.

Jefferies in a client note said Adani Group had shared details of debt and leverage levels, and that it does not “see material risk arising to the Indian banking sector”.

Adani Group’s consolidated gross debt stood at 1.9 trillion rupees ($23.34 billion), Jefferies said.

Adani has said its debt is at a manageable level and that no investor has raised any concern.

Adani Enterprises’ net profit for the period ended Sept. 30, 2022 doubled to 9 billion Indian rupees ($110.31 million) while its total income nearly tripled to 795 billion Indian rupees, according to its share sale prospectus.

The company’s total liabilities as of September 2022 stood at 869 billion rupees ($10.64 billion), the prospectus showed.

The Adani conglomerate has been diversifying its business interests and last year bought cement firms ACC (ACC.NS) and Ambuja Cements (ABUJ.NS) from Switzerland’s Holcim (HOLN.S) for $10.5 billion. ACC was down 15% on Friday, while Ambuja plunged up to 25%.

The idea of allowing Russian and Belarusian athletes to compete as “neutrals” is currently being explored.

Shares of Tata Motors Ltd (TAMO.NS), India’s No.3 carmaker by volume, rose as much as 8.2% to a more-than-four-month high on Friday after the company reported its first quarterly profit in two years.

The stock posted its biggest intraday jump in over 8 months, before easing to trade up about 5.2% at 440 rupees as of 12:45 p.m. IST. It was among the top gainers on the benchmark Nifty 50 index (.NSEI), which was down 1.8% on the day.

Tata Motors swung to a surprise profit of 29.58 billion rupees in the October-December quarter, from a loss of 15.16 billion rupees a year before. Analysts were expecting a narrower loss of 185.6 million rupees.

Improving semiconductor supplies and rising demand helped Tata Motors’ luxury car unit, Jaguar Land Rover (JLR), turn profitable. JLR contributes more than 60% of overall revenue.

Goldman Sachs said the chips were allotted to the Range Rover and Defender sports utility vehicles (SUV) that have a higher average selling price.

They are also the most profitable models at JLR and helped rake in free cash flow of 490 million pounds, beating the company’s target of 400 million pounds.

Goldman expects that as supplies improve, JLR’s volumes will gradually improve to about 30,000-35,000 units per month from 27,000 currently.

Nomura said besides the healthier sales mix JLR also benefited from a demand rebound in China – a key market for the British automaker.

Goldman rates Tata Motors’ stock “neutral”, while Nomura rates it “buy”, which is also the average rating of the 30 analyst covering the stock, according to Refinitiv data.

Bajaj Auto Ltd (BAJA.NS), among India’s top motorcycles and three-wheelers maker, also reported a bigger-than-expected quarterly profit due to strong domestic demand and higher prices.

The danger of Russian air attacks remained high on Friday, Ukraine’s military said, a day after Russian missiles and drones killed at least 11 people in what appeared to be a response to promises by Western allies to supply Ukraine with tanks..

* Ukraine’s military said it shot down 47 of 59 Russian missiles – some fired from Tu-95 strategic bombers in the Russian Arctic. Russia also launched 37 air strikes, 17 of them using Iranian-made Shahed-136 drones. All drones were downed, the military general staff said.

* Explosions were heard near Ukraine’s Russian-occupied Zaporizhzhia nuclear power station, U.N. nuclear watchdog IAEA said. A Russian official dismissed the comments as suggesting Moscow could not uphold nuclear safety.

* A former commander of Russia’s Wagner mercenary group who fled to Norway has spoken about how he witnessed some of his comrades being shot as they were trying to flee from the frontline in Ukraine, his Norwegian lawyer said.

* Reuters was unable to independently verify battlefield reports.

* Canada will send four Leopard 2 battle tanks to Ukraine, the Canadian defence minister said, after Germany this week allowed other countries to re-export the German-built tank.

* France and Italy are close to finalising the technical details to supply an SAMP/T air defence system to Ukraine, two diplomatic sources said.

* The Kremlin said it saw the promised delivery of Western tanks as evidence of growing “direct involvement” of the United States and Europe in the 11-month-old war, something both deny.

* Ukrainian skeleton racer Vladyslav Heraskevych criticised the International Olympic Committee for considering allowing Russian and Belarusian athletes to return to international competitions in Asia.

* Japan tightened sanctions against Russia following its latest wave of missile attacks in Ukraine, adding goods to an export ban list and freezing the assets of Russian officials and entities.

* The United States stepped up sanctions against the Wagner Group, labelling it a transnational criminal organization responsible for widespread human rights abuses.

* Russia said on Friday that new U.S. sanctions were “absurd”, and that they would make it more difficult for foreign companies to do business.

* Ukrainian government officials who shirk their duties during wartime will be quickly removed, a top aide to President Zelenskiy said amid a crack down on corruption.

Related Galleries:

---

Source link

The post Six civilians killed in Russia’s shelling of Donetsk region appeared first on Ukraine Intelligence.