VARIoT IoT vulnerabilities database
| VAR-201201-0023 | CVE-2011-3926 | Used in multiple products Webkit Heap-based buffer overflow vulnerability |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Heap-based buffer overflow in the tree builder in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. This vulnerability Webkit Vulnerability in Google Chrome Other than Webkit Products that use may also be affected.Service disruption by a third party (DoS) You may be put into a state or affected by other details. Google Chrome is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code in the context of the browser or cause denial-of-service conditions; other attacks may also be possible.
Versions prior to Chrome 16.0.912.77 are vulnerable. Google Chrome is a web browser developed by Google (Google). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201201-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Chromium: Multiple vulnerabilities
Date: January 28, 2012
Bugs: #400551
ID: 201201-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Chromium, some of which
may allow execution of arbitrary code.
Background
==========
Chromium is an open source web browser project.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 16.0.912.77 >= 16.0.912.77
Description
===========
Multiple vulnerabilities have been discovered in Chromium. Please
review the CVE identifiers and release notes referenced below for
details.
Impact
======
A remote attacker could entice a user to open a specially crafted web
site using Chromium, possibly resulting in the execution of arbitrary
code with the privileges of the process, or a Denial of Service
condition.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Chromium users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-client/chromium-16.0.912.77"
References
==========
[ 1 ] CVE-2011-3924
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3924
[ 2 ] CVE-2011-3925
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3925
[ 3 ] CVE-2011-3926
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3926
[ 4 ] CVE-2011-3927
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3927
[ 5 ] CVE-2011-3928
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3928
[ 6 ] Release Notes 16.0.912.77
http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23=
.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201201-17.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Google Chrome Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA47694
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47694/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47694
RELEASE DATE:
2012-01-24
DISCUSS ADVISORY:
http://secunia.com/advisories/47694/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47694/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47694
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Some vulnerabilities have been reported in Google Chrome, which
potentially can be exploited by malicious people to compromise a
user's system.
1) A use-after-free error exists within the handling of DOM
selections.
2) A use-after-free error exists within the DOM handling.
3) An uninitialised value exists within Skia.
SOLUTION:
Update to version 16.0.912.77.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1, 4) Arthur Gerkis
2) wushi of team509 via ZDI
3) miaubiz
ORIGINAL ADVISORY:
http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201201-0021 | CVE-2011-3924 | Used in multiple products Webkit Service disruption in (DoS) Vulnerabilities |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Use-after-free vulnerability in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM selections. This vulnerability Webkit Vulnerability in Google Chrome Other than Webkit Products that use may also be affected.Service disruption by a third party (DoS) You may be put into a state or affected by other details. Google Chrome is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code in the context of the browser or cause denial-of-service conditions; other attacks may also be possible.
Versions prior to Chrome 16.0.912.77 are vulnerable. Google Chrome is a web browser developed by Google (Google). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201201-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Chromium: Multiple vulnerabilities
Date: January 28, 2012
Bugs: #400551
ID: 201201-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Chromium, some of which
may allow execution of arbitrary code.
Background
==========
Chromium is an open source web browser project.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 16.0.912.77 >= 16.0.912.77
Description
===========
Multiple vulnerabilities have been discovered in Chromium. Please
review the CVE identifiers and release notes referenced below for
details.
Impact
======
A remote attacker could entice a user to open a specially crafted web
site using Chromium, possibly resulting in the execution of arbitrary
code with the privileges of the process, or a Denial of Service
condition.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Chromium users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-client/chromium-16.0.912.77"
References
==========
[ 1 ] CVE-2011-3924
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3924
[ 2 ] CVE-2011-3925
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3925
[ 3 ] CVE-2011-3926
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3926
[ 4 ] CVE-2011-3927
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3927
[ 5 ] CVE-2011-3928
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3928
[ 6 ] Release Notes 16.0.912.77
http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23=
.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201201-17.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Google Chrome Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA47694
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47694/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47694
RELEASE DATE:
2012-01-24
DISCUSS ADVISORY:
http://secunia.com/advisories/47694/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47694/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47694
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Some vulnerabilities have been reported in Google Chrome, which
potentially can be exploited by malicious people to compromise a
user's system.
1) A use-after-free error exists within the handling of DOM
selections.
2) A use-after-free error exists within the DOM handling.
3) An uninitialised value exists within Skia.
4) An error within the tree builder can be exploited to cause a
heap-based buffer overflow.
SOLUTION:
Update to version 16.0.912.77.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1, 4) Arthur Gerkis
2) wushi of team509 via ZDI
3) miaubiz
ORIGINAL ADVISORY:
http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201201-0025 | CVE-2011-3928 | Used in multiple products Webkit Service disruption in (DoS) Vulnerabilities |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Use-after-free vulnerability in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM handling. Google Chrome Used in Webkit Is DOM Service operation is interrupted due to incomplete processing (DoS) There are vulnerabilities that can be in a state or are otherwise unaffected. plural Apple Product Webkit A similar vulnerability exists for. Detail is Apple See vendor information for.Service disruption by a third party (DoS) You may be put into a state or affected by other details. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of WebKit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The flaw exists within the WebCore component as used by WebKit. Specifically within the handling of element properties. When importing a node having a nonattribute property such as an attached event, an object is improperly freed and accessed. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser. Google Chrome is prone to multiple vulnerabilities.
Versions prior to Chrome 16.0.912.77 are vulnerable. Failed exploit attempts will result in a denial-of-service condition.
NOTE: This issue was previously covered in BID 51641 (Google Chrome Prior to 16.0.912.77 Multiple Security Vulnerabilities) but has been given its own record to better document it. Google Chrome is a web browser developed by Google (Google).
These could be used in a malicious web site to direct the user to a
spoofed site that visually appears to be a legitimate domain. This
issue is addressed through an improved domain name validity check.
This issue does not affect OS X systems. Third-party websites could set cookies if the "Block Cookies"
preference in Safari was set to the default setting of "From third
parties and advertisers".
CVE-ID
CVE-2012-0640 : nshah
WebKit
Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7.3, OS X Lion Server v10.7.3, Windows 7, Vista,
XP SP2 or later
Impact: HTTP authentication credentials may be inadvertently
disclosed to another site
Description: If a site uses HTTP authentication and redirects to
another site, the authentication credentials may be sent to the other
site. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201201-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Chromium: Multiple vulnerabilities
Date: January 28, 2012
Bugs: #400551
ID: 201201-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Chromium, some of which
may allow execution of arbitrary code.
Background
==========
Chromium is an open source web browser project.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 16.0.912.77 >= 16.0.912.77
Description
===========
Multiple vulnerabilities have been discovered in Chromium. Please
review the CVE identifiers and release notes referenced below for
details.
Impact
======
A remote attacker could entice a user to open a specially crafted web
site using Chromium, possibly resulting in the execution of arbitrary
code with the privileges of the process, or a Denial of Service
condition.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Chromium users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-client/chromium-16.0.912.77"
References
==========
[ 1 ] CVE-2011-3924
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3924
[ 2 ] CVE-2011-3925
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3925
[ 3 ] CVE-2011-3926
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3926
[ 4 ] CVE-2011-3927
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3927
[ 5 ] CVE-2011-3928
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3928
[ 6 ] Release Notes 16.0.912.77
http://googlechromereleases.blogspot.com/2012/01/stable-channel-update_23=
.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201201-17.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
.
- -- Vendor Response:
WebKit.Org has issued an update to correct this vulnerability. More
details can be found at:
http://prod.lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
- -- Disclosure Timeline:
2011-12-22 - Vulnerability reported to vendor
2012-04-09 - Coordinated public release of advisory
- -- Credit:
This vulnerability was discovered by:
* wushi of team509
- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-03-07-2 iOS 5.1 Software Update
iOS 5.1 Software Update is now available and addresses the following:
CFNetwork
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to the
disclosure of sensitive information
Description: An issue existed in CFNetwork's handling of malformed
URLs. When accessing a maliciously crafted URL, CFNetwork could send
unexpected request headers.
CVE-ID
CVE-2012-0641 : Erling Ellingsen of Facebook
HFS
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Mounting a maliciously crafted disk image may lead to a
device shutdown or arbitrary code execution
Description: An integer underflow existed with the handling of HFS
catalog files.
CVE-ID
CVE-2012-0642 : pod2g
Kernel
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: A malicious program could bypass sandbox restrictions
Description: A logic issue existed in the handling of debug system
calls. This may allow a malicious program to gain code execution in
other programs with the same user privileges.
CVE-ID
CVE-2012-0643 : 2012 iOS Jailbreak Dream Team
libresolv
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Applications that use the libresolv library may be
vulnerable to an unexpected application termination or arbitrary code
execution
Description: An integer overflow existed in the handling of DNS
resource records, which may lead to heap memory corruption.
CVE-ID
CVE-2011-3453 : Ilja van Sprundel of IOActive
Passcode Lock
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: A race condition issue existed in the handling of slide
to dial gestures. This may allow a person with physical access to the
device to bypass the Passcode Lock screen.
CVE-ID
CVE-2012-0644 : Roland Kohler of the German Federal Ministry of
Economics and Technology
Safari
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Web page visits may be recorded in browser history even when
Private Browsing is active
Description: Safari's Private Browsing is designed to prevent
recording of a browsing session. Pages visited as a result of a site
using the JavaScript methods pushState or replaceState were recorded
in the browser history even when Private Browsing mode was active.
This issue is addressed by not recording such visits when Private
Browsing is active.
CVE-ID
CVE-2012-0585 : Eric Melville of American Express
Siri
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: An attacker with physical access to a locked phone could get
access to frontmost email message
Description: A design issue existed in Siri's lock screen
restrictions. If Siri was enabled for use on the lock screen, and
Mail was open with a message selected behind the lock screen, a voice
command could be used to send that message to an arbitrary recipient.
This issue is addressed by disabling forwarding of active messages
from the lock screen.
CVE-ID
CVE-2012-0645
VPN
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: A maliciously crafted system configuration file may lead to
arbitrary code execution with system privileges
Description: A format string vulnerability existed in the handling
of racoon configuration files.
CVE-ID
CVE-2012-0646 : pod2g
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to the
disclosure of cookies
Description: A cross-origin issue existed in WebKit, which may allow
cookies to be disclosed across origins.
CVE-ID
CVE-2011-3887 : Sergey Glazunov
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website and dragging content
with the mouse may lead to a cross-site scripting attack
Description: A cross-origin issue existed in WebKit, which may allow
content to be dragged and dropped across origins.
CVE-ID
CVE-2012-0590 : Adam Barth of Google Chrome Security Team
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: Multiple cross-origin issues existed in WebKit.
CVE-ID
CVE-2011-3881 : Sergey Glazunov
CVE-2012-0586 : Sergey Glazunov
CVE-2012-0587 : Sergey Glazunov
CVE-2012-0588 : Jochen Eisinger of Google Chrome Team
CVE-2012-0589 : Alan Austin of polyvore.com
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
CVE-ID
CVE-2011-2825 : wushi of team509 working with TippingPoint's Zero Day
Initiative
CVE-2011-2833 : Apple
CVE-2011-2846 : Arthur Gerkis, miaubiz
CVE-2011-2847 : miaubiz, Abhishek Arya (Inferno) of Google Chrome
Security Team using AddressSanitizer
CVE-2011-2854 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2011-2855 : Arthur Gerkis, wushi of team509 working with iDefense
VCP
CVE-2011-2857 : miaubiz
CVE-2011-2860 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2011-2867 : Dirk Schulze
CVE-2011-2868 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2011-2869 : Cris Neckar of Google Chrome Security Team using
AddressSanitizer
CVE-2011-2870 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2011-2871 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2011-2872 : Abhishek Arya (Inferno) and Cris Neckar of Google
Chrome Security Team using AddressSanitizer
CVE-2011-2873 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2011-2877 : miaubiz
CVE-2011-3885 : miaubiz
CVE-2011-3888 : miaubiz
CVE-2011-3897 : pa_kt working with TippingPoint's Zero Day Initiative
CVE-2011-3908 : Aki Helin of OUSPG
CVE-2011-3909 : Google Chrome Security Team (scarybeasts) and Chu
CVE-2011-3928 : wushi of team509 working with TippingPoint's Zero Day
Initiative
CVE-2012-0591 : miaubiz, and Martin Barbella
CVE-2012-0592 : Alexander Gavrun working with TippingPoint's Zero Day
Initiative
CVE-2012-0593 : Lei Zhang of the Chromium development community
CVE-2012-0594 : Adam Klein of the Chromium development community
CVE-2012-0595 : Apple
CVE-2012-0596 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0597 : miaubiz
CVE-2012-0598 : Sergey Glazunov
CVE-2012-0599 : Dmytro Gorbunov of SaveSources.com
CVE-2012-0600 : Marshall Greenblatt, Dharani Govindan of Google
Chrome, miaubiz, Aki Helin of OUSPG, Apple
CVE-2012-0601 : Apple
CVE-2012-0602 : Apple
CVE-2012-0603 : Apple
CVE-2012-0604 : Apple
CVE-2012-0605 : Apple
CVE-2012-0606 : Apple
CVE-2012-0607 : Apple
CVE-2012-0608 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0609 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0610 : miaubiz, Martin Barbella using AddressSanitizer
CVE-2012-0611 : Martin Barbella using AddressSanitizer
CVE-2012-0612 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0613 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0614 : miaubiz, Martin Barbella using AddressSanitizer
CVE-2012-0615 : Martin Barbella using AddressSanitizer
CVE-2012-0616 : miaubiz
CVE-2012-0617 : Martin Barbella using AddressSanitizer
CVE-2012-0618 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0619 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0620 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0621 : Martin Barbella using AddressSanitizer
CVE-2012-0622 : Dave Levin and Abhishek Arya of the Google Chrome
Security Team
CVE-2012-0623 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0624 : Martin Barbella using AddressSanitizer
CVE-2012-0625 : Martin Barbella
CVE-2012-0626 : Abhishek Arya (Inferno) of Google Chrome Security
Team using AddressSanitizer
CVE-2012-0627 : Apple
CVE-2012-0628 : Slawomir Blazek, miaubiz, Abhishek Arya (Inferno) of
Google Chrome Security Team using AddressSanitizer
CVE-2012-0629 : Abhishek Arya (Inferno) of Google Chrome Security
Team
CVE-2012-0630 : Sergio Villar Senin of Igalia
CVE-2012-0631 : Abhishek Arya (Inferno) of Google Chrome Security
Team
CVE-2012-0632 : Cris Neckar of the Google Chrome Security Team using
AddressSanitizer
CVE-2012-0633 : Apple
CVE-2012-0635 : Julien Chaffraix of the Chromium development
community, Martin Barbella using AddressSanitizer
Installation note:
This update is only available through iTunes, and will not appear
in your computer's Software Update application, or in the Apple
Downloads site. Make sure you have an Internet connection and have
installed the latest version of iTunes from www.apple.com/itunes/
iTunes will automatically check Apple's update server on its weekly
schedule. When an update is detected, it will download it. When
the iPhone, iPod touch or iPad is docked, iTunes will present the
user with the option to install the update. We recommend applying
the update immediately if possible. Selecting Don't Install will
present the option the next time you connect your iPhone, iPod touch,
or iPad.
The automatic update process may take up to a week depending on the
day that iTunes checks for updates. You may manually obtain the
update via the Check for Updates button within iTunes. After doing
this, the update can be applied when your iPhone, iPod touch, or iPad
is docked to your computer.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update will be "5.1".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.16 (Darwin)
iQEcBAEBAgAGBQJPV6M3AAoJEGnF2JsdZQeef/cIAKBSn0czLzJO9fu6ZyjLRvxq
4pIZgfyEVGBzpn+9IeiGFTkkVf+bOsA+Q3RlcsG5g0RlbyFgnuWu59HHsnkrElbM
bCfnnTF5eYZX/3fnLzxpX7BUsEona3nf1gHfR24OeEn36C8rZ6rZJfMLqCJNNZGY
RDSga1oeMN/AbgZuR9sYKudkE0GOmkLZfR2G4WXmrU+JncR6XoROUwoJBPhg8z90
HAxgDEbduuLLOSe7CHLS3apbh0L2tmxPCWpiBmEMg6PTlFF0HhJQJ0wusrUc8nX6
7TDsAho73wCOpChzBGQeemc6+UEN2uDmUgwVkN6n4D/qN1u6E+d3coUXOlb8hIY=
=qPeE
-----END PGP SIGNATURE-----
| VAR-201301-0158 | CVE-2012-6441 | Rockwell Automation ControlLogix Information Disclosure Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confidentiality.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400. plural Rockwell Automation There are vulnerabilities in products that can capture important information.Skillfully crafted by a third party CIP Important information may be obtained through the packet. Rockwell Automation MicroLogix is a programmable controller platform. When the device receives a special request, it will disclose sensitive information. Rockwell's products are affected by this vulnerability: all EtherNet/IP products that comply with CIP and EtherNet/IP specifications. Allow arbitrary code execution or denial of service attacks. Rockwell Automation Controllogix has an input validation attack that allows an attacker to submit a malformed request to crash an application and require a physical restart for normal functionality. A security vulnerability exists in the Rockwell Automation Controllogix module startup code. Allow leaks of data.
An attacker can exploit these issues to crash the affected application, denying service to legitimate users. Information obtained may aid in further attacks. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Rockwell Automation ControlLogix Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA47737
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47737/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47737
RELEASE DATE:
2012-01-23
DISCUSS ADVISORY:
http://secunia.com/advisories/47737/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47737/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47737
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Rockwell Automation
ControlLogix, which can be exploited by malicious people to disclose
system information, cause a DoS (Denial of Service), and compromise a
vulnerable device.
1) An input validation error when processing certain commands can be
exploited to cause a device to stop responding.
2) An input validation error when processing certain packets can be
exploited to cause a device to stop responding.
3) An error when processing interface control commands can be
exploited to cause a device to stop responding.
4) An error when processing the stop command can be exploited to
cause a device to stop responding.
5) An error when processing the dump command can be exploited to
disclose the device's boot code, which may contain sensitive
information.
6) An error when processing the reset command can be exploited to
cause a device to stop responding.
SOLUTION:
Restrict access to trusted hosts only.
PROVIDED AND/OR DISCOVERED BY:
ICS-CERT credits Ruben Santamarta via Digital Bond\x92s SCADA Security
Scientific Symposium (S4).
ORIGINAL ADVISORY:
ICS-CERT:
http://www.us-cert.gov/control_systems/pdf/ICS-Alert-12-020-02.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201201-0148 | CVE-2012-0931 |
Schneider Electric Modicon Quantum PLC Service disruption in (DoS) Vulnerabilities
Related entries in the VARIoT exploits database: VAR-E-201201-0278 |
CVSS V2: 7.5 CVSS V3: 9.8 Severity: CRITICAL |
Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors. Schneider Electric Modicon Quantum is an automated control platform with a full range of complete processors for complex process control and infrastructure. (2) There is a backdoor account that allows access to the system with user or administrator privileges. (3) The HTTP server has a buffer overflow, and the remote attacker can exploit the vulnerability for the denial of service attack. (4) There is a buffer overflow in the FTP server, and a remote attacker can exploit the vulnerability for a denial of service attack. (5) There is also a cross-site scripting attack. Schneider Electric Modicon Quantum is prone to multiple vulnerabilities including:
1. A remote code-execution vulnerability.
2. Multiple buffer-overflow vulnerabilities.
3. A security-bypass vulnerability.
4. A cross site-scripting vulnerability.
Attackers can exploit these issues to execute arbitrary code in the context of the affected application, cause denial-of-service conditions, bypass some security restrictions, allow an attacker to steal cookie-based information, or execute script code in the context of the browser of an unsuspecting user; other attacks may also be possible. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Schneider Electric Modicon Quantum Cross-Site Scripting and Buffer
Overflow Vulnerabilities
SECUNIA ADVISORY ID:
SA47723
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47723/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47723
RELEASE DATE:
2012-01-23
DISCUSS ADVISORY:
http://secunia.com/advisories/47723/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47723/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47723
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Schneider Electric
Modicon Quantum Series Modules, which can be exploited by malicious
people to conduct cross-site scripting attacks and cause a DoS
(Denial of Service).
1) Certain unspecified input is not properly sanitised before being
returned to the user.
SOLUTION:
Filter malicious characters and character sequences in a proxy.
Restrict access to trusted hosts only.
PROVIDED AND/OR DISCOVERED BY:
ICS-CERT credits Ruben Santamarta via Digital Bond\x92s SCADA Security
Scientific Symposium (S4).
ORIGINAL ADVISORY:
ICS-CERT:
http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201201-0147 | CVE-2012-0930 |
Schneider Electric Modicon Quantum PLC Cross-Site Scripting Vulnerability
Related entries in the VARIoT exploits database: VAR-E-201201-0278 |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in Schneider Electric Modicon Quantum PLC allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Schneider Electric Modicon Quantum is an automated control platform with a full range of complete processors for complex process control and infrastructure. (2) There is a backdoor account that allows access to the system with user or administrator privileges. (3) The HTTP server has a buffer overflow, and the remote attacker can exploit the vulnerability for the denial of service attack. (4) There is a buffer overflow in the FTP server, and a remote attacker can exploit the vulnerability for a denial of service attack. (5) There is also a cross-site scripting attack. Schneider Electric Modicon Quantum is prone to multiple vulnerabilities including:
1. A remote code-execution vulnerability.
2. Multiple buffer-overflow vulnerabilities.
3. A security-bypass vulnerability.
4. A cross site-scripting vulnerability.
Attackers can exploit these issues to execute arbitrary code in the context of the affected application, cause denial-of-service conditions, bypass some security restrictions, allow an attacker to steal cookie-based information, or execute script code in the context of the browser of an unsuspecting user; other attacks may also be possible. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Schneider Electric Modicon Quantum Cross-Site Scripting and Buffer
Overflow Vulnerabilities
SECUNIA ADVISORY ID:
SA47723
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47723/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47723
RELEASE DATE:
2012-01-23
DISCUSS ADVISORY:
http://secunia.com/advisories/47723/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47723/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47723
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Schneider Electric
Modicon Quantum Series Modules, which can be exploited by malicious
people to conduct cross-site scripting attacks and cause a DoS
(Denial of Service).
1) Certain unspecified input is not properly sanitised before being
returned to the user.
SOLUTION:
Filter malicious characters and character sequences in a proxy.
Restrict access to trusted hosts only.
PROVIDED AND/OR DISCOVERED BY:
ICS-CERT credits Ruben Santamarta via Digital Bond\x92s SCADA Security
Scientific Symposium (S4).
ORIGINAL ADVISORY:
ICS-CERT:
http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201210-0405 | CVE-2012-5311 | ComponentOne FlexGrid ActiveX Control Buffer Overflow Vulnerability |
CVSS V2: 9.3 CVSS V3: - Severity: High |
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-0227. Reason: This candidate is a duplicate of CVE-2012-0227. Notes: All CVE users should reference CVE-2012-0227 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Open Automation Software OPC Systems.NET Used in ComponentOne FlexGrid of VSFlex7.VSFlexGrid ActiveX The control contains a buffer overflow vulnerability.By a third party Archive Denial of service via an excessively long archive filename argument to the method (DoS) Could be put into a state and execute arbitrary code. OPC Systems.NET is a .NET product for SCADA, HMI. The ComponentOne FlexGrid ActiveX control has a buffer overflow that allows an attacker to exploit a vulnerability to construct a malicious link that tricks the user into parsing and executing arbitrary code in the context of the application. ComponentOne FlexGrid ActiveX Control is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
ComponentOne FlexGrid 7.1 is vulnerable; other versions may also be affected
| VAR-201201-0165 | CVE-2011-4053 | 7-Technologies Interactive Graphical SCADA System Vulnerability gained in |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Untrusted search path vulnerability in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) before 9.0.0.11291 allows local users to gain privileges via a Trojan horse DLL in the current working directory. DLL It may be possible to get permission through the file. The 7T Interactive Graphical SCADA System is an automated monitoring and control system. Applications can't safely load parts of the library, and an attacker can build malicious files that entice a user to open on a remote WebDAV or SMB share, and can execute arbitrary code in the user context. 7T Interactive Graphical SCADA System is prone to a vulnerability which allows attackers to execute arbitrary code. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
7-Technologies Interactive Graphical SCADA System Insecure Library
Loading Vulnerability
SECUNIA ADVISORY ID:
SA47558
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47558/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47558
RELEASE DATE:
2012-01-17
DISCUSS ADVISORY:
http://secunia.com/advisories/47558/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47558/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47558
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in 7-Technologies Interactive
Graphical SCADA System, which can be exploited by malicious people to
compromise a user's system.
Successful exploitation may allow execution of arbitrary code.
The vulnerability is reported in versions prior to 9.0.0.11291.
SOLUTION:
Update to version 9.0.0.11291.
PROVIDED AND/OR DISCOVERED BY:
ICS-CERT credits Kuang-Chun Hung, Information and Communication
Security Technology Center.
ORIGINAL ADVISORY:
ICS-CERT (ICSA-11-353-01):
http://www.us-cert.gov/control_systems/pdf/ICSA-11-353-01.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201201-0275 | CVE-2011-4787 | HP Easy Printer Care Software Vulnerable to downloading arbitrary programs |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and CVE-2011-4786. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the XMLSimpleAccessor ActiveX control (CLSID: {466576F3-19B6-4FF1-BD48-3E0E1BFB96E9}). By passing an overlong string to the LoadXML() method it is possible to trigger a heap corruption vulnerability. A remote attacker could exploit this vulnerability to execute arbitrary code on the affected machine under the context of the user running the Internet Explorer process.
- -- Vendor Response:
Hewlett-Packard has issued an update to correct this vulnerability. More
details can be found at:
http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02949847
- -- Disclosure Timeline:
2011-04-04 - Vulnerability reported to vendor
2012-01-12 - Coordinated public release of advisory
- -- Credit:
This vulnerability was discovered by:
* Andrea Micalizzi aka rgod
- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c02949847
Version: 2
HPSBPI02698 SSRT100404 rev.2 - HP Easy Printer Care Software Running on Windows, Remote Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. The vulnerability can be remotely exploited to write arbitrary files to the system and execute them via the browser.
References: CVE-2011-2404 , ZDI-CAN-1092, CVE-2011-4786, ZDI-CAN-1093, CVE-2011-4787, ZDI-CAN-1117
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. This Windows software could be used in conjunction with the following Laser Jet and Color Laser Jet printer models:
Laser Jet P1005 / P1006 / P1007 / P1008
Laser Jet 1010 / 1012 / 1015
Laser Jet P1102 / P1102w
Laser Jet M1120 / M1120n
Laser Jet Pro M1132 / M1134 / M1136 / M1137 / M1138 / M1139
Laser Jet 1150
Laser Jet 1160
Laser Jet Pro M1212nf / M1213nf / N1214nfh / M1216nfh / M1217nfw / M1219nf
Laser Jet 1300
Laser Jet 1320
Laser Jet P1505
Laser Jet 2100
Laser Jet 2200
Laser Jet 2300 / 2300L
Laser Jet 2410 / 2420 / 2430
Laser Jet 3015 All-in-one
Laser Jet 3020/3030 All-in-one
Laser Jet 3050Z All-in-one
Laser Jet 3380 All-in-one
Laser Jet M3035mfp
Laser Jet 4000
Laser Jet 4050
Laser Jet 4100
Laser Jet 4100mfp
Laser Jet 4200 / 4240 / 4250
Laser Jet 4300 / 4350
Laser Jet M4345mfp
Laser Jet 4345mfp
Laser Jet 5000
Laser Jet M5035mfp
Laser Jet 5100
Laser Jet 5200 / Laser Jet 5200L
Laser Jet 8000
Laser Jet 8000mfp
Laser Jet 8100 / 8150
Laser Jet 9000
Laser Jet 9000mfp / 9000Lmfp
Laser Jet 9040 / 9050
Laser Jet 9040mfp / 9050mfp / 9055mfp / 9065mfp
Color Laser Jet CP 1215 / 1217
Color Laser Jet CP 1514n / 1515n / 1518ni
Color Laser Jet 2500
Color Laser Jet 2550
Color Laser Jet 2820 / 2840 All-in-one
Color Laser Jet 3000*
Color Laser Jet 3500 / 3550
Color Laser Jet 3600
Color Laser Jet 3700
Color Laser Jet 3800*
Color Laser Jet4500
Color Laser Jet 4550
Color Laser Jet 4600 / 4610 / 4650
Color Laser Jet 4700*
Color Laser Jet 4730mfp*
Color Laser Jet 5500 / 5550
Color Laser Jet 8500
Color Laser Jet 8550
Color Laser Jet 9500
Color Laser Jet 9500mfp
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2011-2404 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2011-4786 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2011-4787 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP Easy Printer Care Software v2.5 and earlier for Windows XP and Vista is no longer available from HP.
HP Recommends this software be uninstalled from the system as soon as possible. The kill bit is set by modifying the data value of the Compatibility Flags DWORD value for the CLSID of this ActiveX control to 0x00000400. This is explained in Microsoft's article KB240797 or subsequent. http://support.microsoft.com/kb/240797
HISTORY
Version:1 (rev.1) - 8 August 2011 Initial release
Version:2 (rev.2) - 11 Jan 2012 Added additional ZDI issues impacted in Easy Printer Care
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02964430
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
Copyright 2012 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAk8ODhAACgkQ4B86/C0qfVm6dwCfQLt0J9NhagY3TShIE2wi8ORc
N+YAoKipdhM6KpyCOvQuHtSEFXGowR5M
=1Ant
-----END PGP SIGNATURE-----
| VAR-201201-0274 | CVE-2011-4786 | HP Easy Printer Care Software Vulnerable to downloading arbitrary programs |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and CVE-2011-4787. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the XMLCacheMgr class ActiveX control (CLSID 6F255F99-6961-48DC-B17E-6E1BCCBC0EE3). The CacheDocumentXMLWithId() method is vulnerable to directory traversal and arbitrary write, which allows an attacker to write malicious content to the filesystem. A remote attacker could leverage this vulnerability to gain code execution under the context of the web browser.
An attacker could exploit this issue to write arbitrary data to a local file and execute that data in the context of the application using the affected control (typically Internet Explorer). -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c02949847
Version: 2
HPSBPI02698 SSRT100404 rev.2 - HP Easy Printer Care Software Running on Windows, Remote Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. The vulnerability can be remotely exploited to write arbitrary files to the system and execute them via the browser.
References: CVE-2011-2404 , ZDI-CAN-1092, CVE-2011-4786, ZDI-CAN-1093, CVE-2011-4787, ZDI-CAN-1117
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. This Windows software could be used in conjunction with the following Laser Jet and Color Laser Jet printer models:
Laser Jet P1005 / P1006 / P1007 / P1008
Laser Jet 1010 / 1012 / 1015
Laser Jet P1102 / P1102w
Laser Jet M1120 / M1120n
Laser Jet Pro M1132 / M1134 / M1136 / M1137 / M1138 / M1139
Laser Jet 1150
Laser Jet 1160
Laser Jet Pro M1212nf / M1213nf / N1214nfh / M1216nfh / M1217nfw / M1219nf
Laser Jet 1300
Laser Jet 1320
Laser Jet P1505
Laser Jet 2100
Laser Jet 2200
Laser Jet 2300 / 2300L
Laser Jet 2410 / 2420 / 2430
Laser Jet 3015 All-in-one
Laser Jet 3020/3030 All-in-one
Laser Jet 3050Z All-in-one
Laser Jet 3380 All-in-one
Laser Jet M3035mfp
Laser Jet 4000
Laser Jet 4050
Laser Jet 4100
Laser Jet 4100mfp
Laser Jet 4200 / 4240 / 4250
Laser Jet 4300 / 4350
Laser Jet M4345mfp
Laser Jet 4345mfp
Laser Jet 5000
Laser Jet M5035mfp
Laser Jet 5100
Laser Jet 5200 / Laser Jet 5200L
Laser Jet 8000
Laser Jet 8000mfp
Laser Jet 8100 / 8150
Laser Jet 9000
Laser Jet 9000mfp / 9000Lmfp
Laser Jet 9040 / 9050
Laser Jet 9040mfp / 9050mfp / 9055mfp / 9065mfp
Color Laser Jet CP 1215 / 1217
Color Laser Jet CP 1514n / 1515n / 1518ni
Color Laser Jet 2500
Color Laser Jet 2550
Color Laser Jet 2820 / 2840 All-in-one
Color Laser Jet 3000*
Color Laser Jet 3500 / 3550
Color Laser Jet 3600
Color Laser Jet 3700
Color Laser Jet 3800*
Color Laser Jet4500
Color Laser Jet 4550
Color Laser Jet 4600 / 4610 / 4650
Color Laser Jet 4700*
Color Laser Jet 4730mfp*
Color Laser Jet 5500 / 5550
Color Laser Jet 8500
Color Laser Jet 8550
Color Laser Jet 9500
Color Laser Jet 9500mfp
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2011-2404 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2011-4786 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2011-4787 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP Easy Printer Care Software v2.5 and earlier for Windows XP and Vista is no longer available from HP.
HP Recommends this software be uninstalled from the system as soon as possible. The kill bit is set by modifying the data value of the Compatibility Flags DWORD value for the CLSID of this ActiveX control to 0x00000400. This is explained in Microsoft's article KB240797 or subsequent. http://support.microsoft.com/kb/240797
HISTORY
Version:1 (rev.1) - 8 August 2011 Initial release
Version:2 (rev.2) - 11 Jan 2012 Added additional ZDI issues impacted in Easy Printer Care
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02964430
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
Copyright 2012 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAk8ODhAACgkQ4B86/C0qfVm6dwCfQLt0J9NhagY3TShIE2wi8ORc
N+YAoKipdhM6KpyCOvQuHtSEFXGowR5M
=1Ant
-----END PGP SIGNATURE-----
.
- -- Vendor Response:
Hewlett-Packard has issued an update to correct this vulnerability. More
details can be found at:
http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02949847
- -- Disclosure Timeline:
2011-04-01 - Vulnerability reported to vendor
2012-01-12 - Coordinated public release of advisory
- -- Credit:
This vulnerability was discovered by:
* Andrea Micalizzi aka rgod
- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product
| VAR-201201-0117 | CVE-2012-0309 | Cogent DataHub/Cascade DataHub/OPC DataHub Cross-Site Scripting Vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in Cogent DataHub 7.1.2 and earlier, Cascade DataHub 6.4.20 and earlier, and OPC DataHub 6.4.20 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Cogent DataHub provided by Cogent Real-Time Systems Inc. contains a cross-site scripting vulnerability. Kuang-Chun Hung of Security Research and Service Institute - Information and Communication Security Technology Center (ICST), Taiwan R.O.C. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An arbitrary script may be executed on the user's web browser. A remote attacker can send a specially crafted HTTP header to the affected system, forging information displayed on the user's web browser or performing an HTTP response fragmentation attack. Cogent DataHub is the latest version of DataHub's long-line product, which sets performance ratings for real-time data solutions.
By inserting arbitrary headers into an HTTP response, attackers may be able to launch various attacks, including cross-site request forgery, cross-site scripting, and HTTP-request smuggling.
The following versions are vulnerable:
OPC DataHub
Cascade DataHub
Cogent DataHub. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Cogent DataHub Cross-Site Scripting and HTTP Header Injection
Vulnerabilities
SECUNIA ADVISORY ID:
SA47496
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47496/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47496
RELEASE DATE:
2012-01-11
DISCUSS ADVISORY:
http://secunia.com/advisories/47496/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47496/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47496
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two vulnerabilities have been reported in Cogent DataHub, which can
be exploited by malicious people to conduct cross-site scripting
attacks and HTTP response splitting attacks.
1) Certain unspecified input is not properly sanitised before being
returned to the user.
2) Certain unspecified input is not properly sanitised before being
used to display HTTP headers. This can be exploited to include
arbitrary HTTP headers in a response sent to the user.
SOLUTION:
Update to version 7.2.0.
ORIGINAL ADVISORY:
JVN:
http://jvn.jp/en/jp/JVN63249231/index.html
http://jvn.jp/en/jp/JVN12983784/index.html
http://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000002.html
http://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000001.html
Cogent:
http://www.cogentdatahub.com/ReleaseNotes.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201201-0118 | CVE-2012-0310 | Cogent DataHub vulnerable to HTTP header injection |
CVSS V2: 5.8 CVSS V3: - Severity: MEDIUM |
CRLF injection vulnerability in Cogent DataHub 7.1.2 and earlier, Cascade DataHub 6.4.20 and earlier, and OPC DataHub 6.4.20 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Cogent DataHub provided by Cogent Real-Time Systems Inc. contains a HTTP header injection vulnerability (also known as CRLF, carriage return line feed, injection vulnerability). Kuang-Chun Hung of Security Research and Service Institute - Information and Communication Security Technology Center (ICST), Taiwan R.O.C. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a remote attacker sends a crafted HTTP header to a vulnerable system, forged information may be displayed on the user's web browser or an HTTP response splitting attack may be conducted.
The following versions are vulnerable:
OPC DataHub
Cascade DataHub
Cogent DataHub. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Cogent DataHub Cross-Site Scripting and HTTP Header Injection
Vulnerabilities
SECUNIA ADVISORY ID:
SA47496
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47496/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47496
RELEASE DATE:
2012-01-11
DISCUSS ADVISORY:
http://secunia.com/advisories/47496/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47496/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47496
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two vulnerabilities have been reported in Cogent DataHub, which can
be exploited by malicious people to conduct cross-site scripting
attacks and HTTP response splitting attacks.
1) Certain unspecified input is not properly sanitised before being
returned to the user. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site.
2) Certain unspecified input is not properly sanitised before being
used to display HTTP headers. This can be exploited to include
arbitrary HTTP headers in a response sent to the user.
SOLUTION:
Update to version 7.2.0.
ORIGINAL ADVISORY:
JVN:
http://jvn.jp/en/jp/JVN63249231/index.html
http://jvn.jp/en/jp/JVN12983784/index.html
http://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000002.html
http://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000001.html
Cogent:
http://www.cogentdatahub.com/ReleaseNotes.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201201-0143 | CVE-2012-0917 | Hitachi IT Operations Analyzer Cross-Site Scripting Vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Analyzer 02-01, 02-51 through 02-51-01, and 02-53 through 02-53-02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Hitachi IT Operation is used for system management. Hitachi IT Operation has cross-site scripting attacks on multiple products. Remote attackers can use the vulnerabilities to obtain sensitive information or hijack user sessions.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Hitachi IT Operations Analyzer Unspecified Cross-Site Scripting
Vulnerability
SECUNIA ADVISORY ID:
SA47467
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47467/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47467
RELEASE DATE:
2012-01-10
DISCUSS ADVISORY:
http://secunia.com/advisories/47467/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47467/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47467
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Hitachi IT Operations Analyzer,
which can be exploited by malicious people to conduct cross-site
scripting attacks.
Certain unspecified input is not properly sanitised before being
returned to the user.
The vulnerability is reported in versions 02-01, 02-51 through
02-51-01, and 02-53 through 02-53-02.
SOLUTION:
Filter malicious characters and character sequences using a proxy.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
Hitachi (English):
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-001/index.html
Hitachi (Japanese):
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/./vuls/HS12-001/index.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
SOLUTION:
Update or upgrade to version 03-00-06
| VAR-201201-0079 | CVE-2011-4373 | Adobe Reader and Acrobat Vulnerable to arbitrary code execution |
CVSS V2: 7.5 CVSS V3: 9.8 Severity: CRITICAL |
Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4370 and CVE-2011-4372. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within 2d.x3d, which is Adobe Reader's code responsible for processing BMP files. When passing a negative size parameter in the 'colors' field, a series of signed comparisons will be averted, and the overly large size parameter is passed to a memcpy(). Failed exploit attempts will likely cause denial-of-service conditions. Adobe Reader and Acrobat Both Adobe Adobe ) company's products. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ZDI-12-021 : Adobe Reader BMP Resource Signedness Remote Code
Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-12-021
February 8, 2012
- -- CVE ID:
CVE-2011-4373
- -- CVSS:
7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
- -- Affected Vendors:
Adobe
- -- Affected Products:
Adobe Reader
- -- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 12017.
- -- Vendor Response:
Adobe has issued an update to correct this vulnerability. More details
can be found at:
http://www.adobe.com/support/security/bulletins/apsb12-01.html
- -- Disclosure Timeline:
2011-10-28 - Vulnerability reported to vendor
2012-02-08 - Coordinated public release of advisory
- -- Credit:
This vulnerability was discovered by:
* Alin Rad Pop
- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
iQEcBAEBAgAGBQJPMq81AAoJEFVtgMGTo1scKo0H/RBf8xeNOSi+vB165I6YTW/O
06jR18N54qnTH37TRIptj3n0UdgcGoFpDjGMFWEfEt0yTc1gG8fEEtO0Q/m6bOJN
6oaHav+VdyAPDcw13VRiRL7QnvR5NqAGvdzYikO7QpiVEOmTvWetK8/ODPqziNHc
5jWQB9p7bCkXxgNrY9PkyWkE9seFa1G8apYX4rdJC/DUXJIcPHy7YgdFykrcw4c/
r84LSfPBAuLPuZnHVBcxPlx21LIYYJdZuF0zHkqGx0x1WG04GatJmzNsLiruVzNt
+EKgjt9XUFmuZa7ovYvHiDkyFtGWCSgmrOM3Iy5EOdpfexKhUltel7qHYzTE3QA=
=nWOH
-----END PGP SIGNATURE-----
.
Background
==========
Adobe Reader is a closed-source PDF reader.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-text/acroread < 9.5.1 >= 9.5.1
Description
===========
Multiple vulnerabilities have been found in Adobe Reader, including an
integer overflow in TrueType Font handling (CVE-2012-0774) and multiple
unspecified errors which could cause memory corruption.
Impact
======
A remote attacker could entice a user to open a specially crafted PDF
file, possibly resulting in execution of arbitrary code with the
privileges of the process or a Denial of Service condition.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Reader users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.5.1"
References
==========
[ 1 ] CVE-2011-4370
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4370
[ 2 ] CVE-2011-4371
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4371
[ 3 ] CVE-2011-4372
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4372
[ 4 ] CVE-2011-4373
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4373
[ 5 ] CVE-2012-0774
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0774
[ 6 ] CVE-2012-0775
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0775
[ 7 ] CVE-2012-0776
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0776
[ 8 ] CVE-2012-0777
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0777
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201206-14.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
| VAR-201201-0273 | CVE-2011-4785 | plural HP Product HP-ChaiSOE Web Server traversal vulnerability |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Directory traversal vulnerability in the HP-ChaiSOE/1.0 web server on the HP LaserJet P3015 printer with firmware before 07.080.3, LaserJet 4650 printer with firmware 07.006.0, and LaserJet 2430 printer with firmware 08.113.0_I35128 allows remote attackers to read arbitrary files via unspecified vectors, a different vulnerability than CVE-2008-4419. plural HP Product HP-ChaiSOE Web The server contains a directory traversal vulnerability. This vulnerability CVE-2008-4419 Is a different vulnerability.A third party may be able to read arbitrary files. HP LaserJet printers is prone to a directory-traversal vulnerability.
Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.
HP LaserJet P3015 with firmware 07.080.3 or later is vulnerable. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
HP LaserJet P3015 Unspecified Security Bypass Vulnerability
SECUNIA ADVISORY ID:
SA47457
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/47457/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=47457
RELEASE DATE:
2012-01-09
DISCUSS ADVISORY:
http://secunia.com/advisories/47457/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/47457/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=47457
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in HP LaserJet P3015, which can be
exploited by malicious people to bypass certain security
restrictions.
The vulnerability is reported in versions prior to 07.080.3.
SOLUTION:
Update to version 07.080.3.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Digital Defense, Inc. Vulnerability Research Team
ORIGINAL ADVISORY:
HPSBPI02733 SSRT100646:
http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03140700
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
Solution Description:
At this time, the vendor has been notified of the vulnerability and has
released a patch which addresses the issue for HP LaserJet P3015. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03140700
Version: 1
HPSBPI02733 SSRT100646 rev.1 - Certain HP LaserJet Printers, Remote Unauthorized Access to Files
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2012-01-09
Last Updated: 2012-01-09
Potential Security Impact: Remote unauthorized access to files
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with certain HP LaserJet printers. The vulnerability could be exploited remotely to gain unauthorized access to files.
References: CVE-2011-4785, DDIVRT-2011-37
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP LaserJet P3015 with firmware prior to 07.080.3
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2011-4785 (AV:N/AC:L/Au:N/C:C/I:N/A:N) 7.8
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
The Hewlett-Packard Company thanks the Digital Defense, Inc. (DDI) Vulnerability Research Team (VRT) for reporting this vulnerability to security-alert@hp.com. Firmware updates can also be downloaded as follows.
Browse to www.hp.com/go/support then:
Select "Drivers & Software"
Enter the product name listed in the table above into the search field
Click on "Search"
If the search returns a list of products click on the appropriate product
Under "Select operating system" click on "Cross operating system (BIOS, Firmware, Diagnostics, etc.)"
If the "Cross operating system ..." link is not present, select any Windows operating system from the list.
Select the appropriate firmware update under "Firmware"
HISTORY
Version:1 (rev.1) - 9 January 2012 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02964430
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
Copyright 2012 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAk8KzyYACgkQ4B86/C0qfVkUfACg+xhdrs2B1yUnAAvOXn+DgnIw
+3EAoKpo/OWY5GB47Mi4pgYUVml50iXO
=tpQT
-----END PGP SIGNATURE-----
| VAR-201201-0323 | No CVE | JP1/Cm2/Network Node Manager i Denial of Service (DoS) Vulnerability |
CVSS V2: 7.8 CVSS V3: - Severity: High |
JP1/Cm2/Network Node Manager i (NNMi) contains vulnerabilities could allow a remote attacker to cause a denial of service (DoS) condition or execute arbitrary code.A remote attacker could cause a denial of service (DoS) condition or execute arbitrary code.
| VAR-201201-0018 | CVE-2011-3919 | libxml2 Heap-based buffer overflow vulnerability |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. libxml2 Contains a heap-based buffer overflow vulnerability.Service disruption by a third party (DoS) You may be put into a state or affected by other details. Google Chrome is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code in the context of the browser or cause denial-of-service conditions; other attacks may also be possible.
Versions prior to Chrome 16.0.912.75 are vulnerable. Libxml2 is a C language-based function library for parsing XML documents developed by the GNOME project team. It supports multiple encoding formats, XPath analysis, Well-formed and valid verification, etc. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-05-09-1 OS X Lion v10.7.4 and Security Update 2012-002
OS X Lion v10.7.4 and Security Update 2012-002 is now available and
addresses the following:
Login Window
Available for: OS X Lion v10.7.3, OS X Lion Server v10.7.3
Impact: Remote admins and persons with physical access to the system
may obtain account information
Description: An issue existed in the handling of network account
logins. The login process recorded sensitive information in the
system log, where other users of the system could read it. The
sensitive information may persist in saved logs after installation of
this update. See http://support.apple.com/kb/TS4272 for more
information on how to securely remove any remaining records. This
issue only affects systems running OS X Lion v10.7.3 with users of
Legacy File Vault and/or networked home directories.
CVE-ID
CVE-2012-0652 : Terry Reeves and Tim Winningham of the Ohio State
University, Markus 'Jaroneko' Raty of the Finnish Academy of Fine
Arts, Jaakko Pero of Aalto University, Mark Cohen of Oregon State
University, Paul Nelson
Bluetooth
Available for: OS X Lion v10.7 to v10.7.3,
OS X Lion Server v10.7 to v10.7.3
Impact: A local user may be able to execute arbitrary code with
system privileges
Description: A temporary file race condition issue existed in
blued's initialization routine.
CVE-ID
CVE-2012-0649 : Aaron Sigel of vtty.com
curl
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: An attacker may be able to decrypt data protected by SSL
Description: There are known attacks on the confidentiality of SSL
3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode.
curl disabled the 'empty fragment' countermeasure which prevented
these attacks. This issue is addressed by enabling empty fragments.
CVE-ID
CVE-2011-3389 : Apple
curl
Available for: OS X Lion v10.7 to v10.7.3,
OS X Lion Server v10.7 to v10.7.3
Impact: Using curl or libcurl with a maliciously crafted URL may
lead to protocol-specific data injection attacks
Description: A data injection issue existed in curl's handling of
URLs. This issue is addressed through improved validation of URLs.
This issue does not affect systems prior to OS X Lion.
CVE-ID
CVE-2012-0036
Directory Service
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: A remote attacker may obtain sensitive information
Description: Multiple issues existed in the directory server's
handling of messages from the network. By sending a maliciously
crafted message, a remote attacker could cause the directory server
to disclose memory from its address space, potentially revealing
account credentials or other sensitive information. This issue does
not affect OS X Lion systems. The Directory Server is disabled by
default in non-server installations of OS X.
CVE-ID
CVE-2012-0651 : Agustin Azubel
HFS
Available for: OS X Lion v10.7 to v10.7.3,
OS X Lion Server v10.7 to v10.7.3
Impact: Mounting a maliciously crafted disk image may lead to a
system shutdown or arbitrary code execution
Description: An integer underflow existed in the handling of HFS
catalog files.
CVE-ID
CVE-2012-0642 : pod2g
ImageIO
Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact: Viewing a maliciously crafted TIFF file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in ImageIO's handling of
CCITT Group 4 encoded TIFF files. This issue does not affect OS X
Lion systems.
CVE-ID
CVE-2011-0241 : Cyril CATTIAUX of Tessi Technologies
ImageIO
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: Multiple vulnerabilities in libpng
Description: libpng is updated to version 1.5.5 to address multiple
vulnerabilities, the most serious of which may lead to information
disclosure. Further information is available via the libpng website
at http://www.libpng.org/pub/png/libpng.html
CVE-ID
CVE-2011-2692
CVE-2011-3328
ImageIO
Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact: Viewing a maliciously crafted TIFF file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in libtiff's handling of
ThunderScan encoded TIFF images. This issue is addressed by updating
libtiff to version 3.9.5.
CVE-ID
CVE-2011-1167
Kernel
Available for: OS X Lion v10.7 to v10.7.3,
OS X Lion Server v10.7 to v10.7.3
Impact: When FileVault is used, the disk may contain unencrypted
user data
Description: An issue in the kernel's handling of the sleep image
used for hibernation left some data unencrypted on disk even when
FileVault was enabled. This issue is addressed through improved
handling of the sleep image, and by overwriting the existing sleep
image when updating to OS X v10.7.4. This issue does not affect
systems prior to OS X Lion.
CVE-ID
CVE-2011-3212 : Felix Groebert of Google Security Team
libarchive
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: Extracting a maliciously crafted archive may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple buffer overflows existed in the handling of
tar archives and iso9660 files.
CVE-ID
CVE-2011-1777
CVE-2011-1778
libsecurity
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: Verifying a maliciously crafted X.509 certificate, such as
when visiting a maliciously crafted website, may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access issue existed in the
handling of X.509 certificates.
CVE-ID
CVE-2012-0654 : Dirk-Willem van Gulik of WebWeaving.org, Guilherme
Prado of Conselho da Justica Federal, Ryan Sleevi of Google
libsecurity
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: Support for X.509 certificates with insecure-length RSA keys
may expose users to spoofing and information disclosure
Description: Certificates signed using RSA keys with insecure key
lengths were accepted by libsecurity. This issue is addressed by
rejecting certificates containing RSA keys less than 1024 bits.
CVE-ID
CVE-2012-0655
libxml
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: Viewing a maliciously crafted web page may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple vulnerabilities existed in libxml, the most
serious of which may lead to an unexpected application termination or
arbitrary code execution. These issues are addressed by applying the
relevant upstream patches.
CVE-ID
CVE-2011-1944 : Chris Evans of Google Chrome Security Team
CVE-2011-2821 : Yang Dingning of NCNIPC, Graduate University of
Chinese Academy of Sciences
CVE-2011-2834 : Yang Dingning of NCNIPC, Graduate University of
Chinese Academy of Sciences
CVE-2011-3919 : Juri Aedla
LoginUIFramework
Available for: OS X Lion v10.7 to v10.7.3,
OS X Lion Server v10.7 to v10.7.3
Impact: If the Guest user is enabled, a user with physical access to
the computer may be able to log in to a user other than the Guest
user without entering a password
Description: A race condition existed in the handling of Guest user
logins. This issue does not affect systems prior to OS X Lion.
CVE-ID
CVE-2012-0656 : Francisco Gomez (espectalll123)
PHP
Available for: OS X Lion v10.7 to v10.7.3,
OS X Lion Server v10.7 to v10.7.3
Impact: Multiple vulnerabilities in PHP
Description: PHP is updated to version 5.3.10 to address several
vulnerabilities, the most serious of which may lead to arbitrary code
execution. Further information is available via the PHP web site at
http://www.php.net
CVE-ID
CVE-2011-4566
CVE-2011-4885
CVE-2012-0830
Quartz Composer
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: A user with physical access to the computer may be able to
cause Safari to launch if the screen is locked and the RSS Visualizer
screen saver is used
Description: An access control issue existed in Quartz Composer's
handling of screen savers. This issue is addressed through improved
checking for whether or not the screen is locked.
CVE-ID
CVE-2012-0657 : Aaron Sigel of vtty.com
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: Viewing a maliciously crafted movie file during progressive
download may lead to an unexpected application termination or
arbitrary code execution
Description: A buffer overflow existed in the handling of audio
sample tables.
CVE-ID
CVE-2012-0658 : Luigi Auriemma working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: Viewing a maliciously crafted MPEG file may lead to an
unexpected application termination or arbitrary code execution
Description: An integer overflow existed in the handling of MPEG
files.
CVE-ID
CVE-2012-0659 : An anonymous researcher working with HP's Zero Day
Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: Viewing a maliciously crafted MPEG file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer underflow existed in the handling of MPEG
files.
CVE-ID
CVE-2012-0660 : Justin Kim at Microsoft and Microsoft Vulnerability
Research
QuickTime
Available for: OS X Lion v10.7 to v10.7.3,
OS X Lion Server v10.7 to v10.7.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the handling of
JPEG2000 encoded movie files. This issue does not affect systems
prior to OS X Lion.
CVE-ID
CVE-2012-0661 : Damian Put working with HP's Zero Day Initiative
Ruby
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: Multiple vulnerabilities in Ruby
Description: Ruby is updated to 1.8.7-p357 to address multiple
vulnerabilities.
CVE-ID
CVE-2011-1004
CVE-2011-1005
CVE-2011-4815
Samba
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: If SMB file sharing is enabled, an unauthenticated remote
attacker may cause a denial of service or arbitrary code execution
with system privileges
Description: Multiple buffer overflows existed in Samba's handling
of remote procedure calls. By sending a maliciously crafted packet,
an unauthenticated remote attacker could cause a denial of service or
arbitrary code execution with system privileges. These issues do not
affect OS X Lion systems.
CVE-ID
CVE-2012-0870 : Andy Davis of NGS Secure
CVE-2012-1182 : An anonymous researcher working with HP's Zero Day
Initiative
Security Framework
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
Impact: A remote attacker may cause an unexpected application
termination or arbitrary code execution
Description: An integer overflow existed in the Security framework.
Processing untrusted input with the Security framework could result
in memory corruption. This issue does not affect 32-bit processes.
CVE-ID
CVE-2012-0662 : aazubel working with HP's Zero Day Initiative
Time Machine
Available for: OS X Lion v10.7 to v10.7.3,
OS X Lion Server v10.7 to v10.7.3
Impact: A remote attacker may access a user's Time Machine backup
credentials
Description: The user may designate a Time Capsule or remote AFP
volume attached to an AirPort Base Station to be used for Time
Machine backups. Beginning with AirPort Base Station and Time Capsule
Firmware Update 7.6, Time Capsules and Base Stations support a secure
SRP-based authentication mechanism over AFP. However, Time Machine
did not require that the SRP-based authentication mechanism was used
for subsequent backup operations, even if Time Machine was initially
configured or had ever contacted a Time Capsule or Base Station that
supported it. An attacker who is able to spoof the remote volume
could gain access to user's Time Capsule credentials, although not
backup data, sent by the user's system. This issue is addressed by
requiring use of the SRP-based authentication mechanism if the backup
destination has ever supported it.
CVE-ID
CVE-2012-0675 : Renaud Deraison of Tenable Network Security, Inc.
X11
Available for: OS X Lion v10.7 to v10.7.3,
OS X Lion Server v10.7 to v10.7.3
Impact: Applications that use libXfont to process LZW-compressed
data may be vulnerable to an unexpected application termination or
arbitrary code execution
Description: A buffer overflow existed in libXfont's handling of
LZW-compressed data. This issue is addressed by updating libXfont to
version 1.4.4.
CVE-ID
CVE-2011-2895 : Tomas Hoger of Red Hat
Note: Additionally, this update filters dynamic linker environment
variables from a customized environment property list in the user's
home directory, if present.
OS X Lion v10.7.4 and Security Update 2012-002 may be obtained from
the Software Update pane in System Preferences, or Apple's Software
Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
Security Update 2012-002 or OS X v10.7.4.
For OS X Lion v10.7.3
The download file is named: MacOSXUpd10.7.4.dmg
Its SHA-1 digest is: 04c53a6148ebd8c5733459620b7c1e2172352d36
For OS X Lion v10.7 and v10.7.2
The download file is named: MacOSXUpdCombo10.7.4.dmg
Its SHA-1 digest is: b11d511a50d9b728532688768fcdee9c1930037f
For OS X Lion Server v10.7.3
The download file is named: MacOSXServerUpd10.7.4.dmg
Its SHA-1 digest is: 3cb5699c8ecf7d70145f3692555557f7206618b2
For OS X Lion Server v10.7 and v10.7.2
The download file is named: MacOSXServerUpdCombo10.7.4.dmg
Its SHA-1 digest is: 917207e922056718b9924ef73caa5fcac06b7240
For Mac OS X v10.6.8
The download file is named: SecUpd2012-002Snow.dmg
Its SHA-1 digest is: 9669fbd9952419e70ac20109cf4db37f9932e9f8
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2012-002.dmg
Its SHA-1 digest is: 34da2dcbc8d45362f1d5e3b1b218112a729ae1c3
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.16 (Darwin)
iQEcBAEBAgAGBQJPqtkzAAoJEGnF2JsdZQeee2MIAKAcBIY6k0LU2fDLThFoAgKh
WkYpGmCwa7L6n02geHzWrUCK/P/0yGWzDDqLfKlKuKbXdEIRP2wZTlvrqZHLzNO/
nXgz3HN1Xbll8yVXrGMEsoTD23Q+2/ZKLGMlSDw3vgBTVi/g4Rcer4Eew5mTkaoA
j4WkrzgVUIxCMrsWMMwu1SVaizBuTYbNVzCzV3JPF1H0zVtVKgwWjhTdOJ/RDksD
sjZG1XIEqVyv1rNk5BtjxVPFaJGpf9mcHiH8XyKQ0bC6ToM2r3B++Layoc5k1K0V
OxKGSfWOEbWi/KR6vlXyVbe7JnU7a/V0C25HXhnoMEtoTCleZACEByLVtBC87LU=
=6Eiz
-----END PGP SIGNATURE-----
.
CVE-2011-2821:
A memory corruption (double free) bug has been identified in libxml2's XPath
engine. This vulnerability does not
affect the oldstable distribution (lenny).
CVE-2011-2834:
Yang Dingning discovered a double free vulnerability related to XPath handling.
For the oldstable distribution (lenny), this problem has been fixed in
version 2.6.32.dfsg-5+lenny5.
For the stable distribution (squeeze), this problem has been fixed in
version 2.7.8.dfsg-2+squeeze2.
For the testing distribution (wheezy), this problem has been fixed in
version 2.7.8.dfsg-7.
For the unstable distribution (sid), this problem has been fixed in
version 2.7.8.dfsg-7. The advisory will be
updated when a patch is available. Summary
VMware ESX updates to ESX Service Console. Problem Description
a. ESX third party update for Service Console kernel
The ESX Service Console Operating System (COS) kernel is updated
which addresses several security issues in the COS kernel.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2011-3191, CVE-2011-4348 and CVE-2012-0028 to
these issues.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX ESX410-201204401-SG
ESX 4.0 ESX patch pending **
ESX 3.5 ESX not applicable
* hosted products are VMware Workstation, Player, ACE, Fusion. See
VMSA-2012-0006 for details.
b.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2010-4008, CVE-2011-0216, CVE-2011-1944,
CVE-2011-2834, CVE-2011-3905, CVE-2011-3919 to these issues.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX ESX410-201204402-SG
ESX 4.0 ESX patch pending
ESX 3.5 ESX not applicable
* hosted products are VMware Workstation, Player, ACE, Fusion. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
ESX 4.1
-------
ESX410-201204001
md5sum: 7994635547b375b51422b1a166c6e214
sha1sum: 9d5f3c9cbc53a9e03524b9bf0935c71f3dadf620
http://kb.vmware.com/kb/2013057
ESX410-201204001 contains ESX410-201204401-SG and
ESX410-201204402-SG
5. Change log
2012-04-26 VMSA-2012-0008
Initial security advisory in conjunction with the release of
patches for ESX 4.1 on 2012-04-26. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2012 VMware Inc. All rights reserved. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: libxml2 security update
Advisory ID: RHSA-2012:0017-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0017.html
Issue date: 2012-01-11
CVE Names: CVE-2010-4008 CVE-2011-0216 CVE-2011-1944
CVE-2011-2834 CVE-2011-3905 CVE-2011-3919
=====================================================================
1. Summary:
Updated libxml2 packages that fix several security issues are now available
for Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
3. Description:
The libxml2 library is a development toolbox providing the implementation
of various XML standards. One of those standards is the XML Path Language
(XPath), which is a language for addressing parts of an XML document. A remote attacker could provide a
specially-crafted XML file that, when opened in an application linked
against libxml2, would cause the application to crash or, potentially,
execute arbitrary code with the privileges of the user running the
application. A remote attacker could provide a
specially-crafted XML file that, when opened in an application linked
against libxml2, would cause the application to crash or, potentially,
execute arbitrary code with the privileges of the user running the
application. If an attacker
were able to supply a specially-crafted XML file to an application using
libxml2, as well as an XPath expression for that application to run against
the crafted file, it could cause the application to crash or, possibly,
execute arbitrary code. (CVE-2011-1944)
Flaws were found in the way libxml2 parsed certain XPath expressions. If an
attacker were able to supply a specially-crafted XML file to an application
using libxml2, as well as an XPath expression for that application to run
against the crafted file, it could cause the application to crash.
(CVE-2010-4008, CVE-2011-2834)
An out-of-bounds memory read flaw was found in libxml2. A remote attacker
could provide a specially-crafted XML file that, when opened in an
application linked against libxml2, would cause the application to crash.
(CVE-2011-3905)
Note: Red Hat does not ship any applications that use libxml2 in a way that
would allow the CVE-2011-1944, CVE-2010-4008, and CVE-2011-2834 flaws to be
exploited; however, third-party applications may allow XPath expressions to
be passed which could trigger these flaws.
Red Hat would like to thank the Google Security Team for reporting the
CVE-2010-4008 issue. Upstream acknowledges Bui Quang Minh from Bkis as the
original reporter of CVE-2010-4008.
All users of libxml2 are advised to upgrade to these updated packages,
which contain backported patches to correct these issues. The desktop must
be restarted (log out, then log back in) for this update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
645341 - CVE-2010-4008 libxml2: Crash (stack frame overflow or NULL pointer dereference) by traversal of XPath axis
709747 - CVE-2011-1944 libxml, libxml2: Heap-based buffer overflow by adding new namespace node to an existing nodeset or merging nodesets
724906 - CVE-2011-0216 libxml2: Off-by-one error leading to heap-based buffer overflow in encoding
735751 - CVE-2011-2834 libxml2: double-free caused by malformed XPath expression in XSLT
767387 - CVE-2011-3905 libxml2 out of bounds read
771896 - CVE-2011-3919 libxml2: Heap-based buffer overflow when decoding an entity reference with a long name
6. Package List:
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/libxml2-2.6.26-2.1.12.el5_7.2.src.rpm
i386:
libxml2-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-python-2.6.26-2.1.12.el5_7.2.i386.rpm
x86_64:
libxml2-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-2.6.26-2.1.12.el5_7.2.x86_64.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.x86_64.rpm
libxml2-python-2.6.26-2.1.12.el5_7.2.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/libxml2-2.6.26-2.1.12.el5_7.2.src.rpm
i386:
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.i386.rpm
x86_64:
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.x86_64.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/libxml2-2.6.26-2.1.12.el5_7.2.src.rpm
i386:
libxml2-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-python-2.6.26-2.1.12.el5_7.2.i386.rpm
ia64:
libxml2-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-2.6.26-2.1.12.el5_7.2.ia64.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.ia64.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.ia64.rpm
libxml2-python-2.6.26-2.1.12.el5_7.2.ia64.rpm
ppc:
libxml2-2.6.26-2.1.12.el5_7.2.ppc.rpm
libxml2-2.6.26-2.1.12.el5_7.2.ppc64.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.ppc.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.ppc64.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.ppc.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.ppc64.rpm
libxml2-python-2.6.26-2.1.12.el5_7.2.ppc.rpm
s390x:
libxml2-2.6.26-2.1.12.el5_7.2.s390.rpm
libxml2-2.6.26-2.1.12.el5_7.2.s390x.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.s390.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.s390x.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.s390.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.s390x.rpm
libxml2-python-2.6.26-2.1.12.el5_7.2.s390x.rpm
x86_64:
libxml2-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-2.6.26-2.1.12.el5_7.2.x86_64.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-debuginfo-2.6.26-2.1.12.el5_7.2.x86_64.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.i386.rpm
libxml2-devel-2.6.26-2.1.12.el5_7.2.x86_64.rpm
libxml2-python-2.6.26-2.1.12.el5_7.2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2010-4008.html
https://www.redhat.com/security/data/cve/CVE-2011-0216.html
https://www.redhat.com/security/data/cve/CVE-2011-1944.html
https://www.redhat.com/security/data/cve/CVE-2011-2834.html
https://www.redhat.com/security/data/cve/CVE-2011-3905.html
https://www.redhat.com/security/data/cve/CVE-2011-3919.html
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFPDc8yXlSAg2UNWIIRAp0FAKCr3G8qJvCfqK4BJBzJsMWlSYXXFQCgxNs7
ZcFDHRyFhx22yjGNtU/I5SA=
=FALM
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
| VAR-201201-0314 | CVE-2011-4619 | Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL (0.9.8o). OpenSSL prone to multiple security vulnerabilities.
An attacker may leverage these issues to obtain sensitive information, cause a denial-of-service condition and perform unauthorized actions. Summary:
Updated openssl packages that fix two security issues are now available for
Red Hat Enterprise Linux 4.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3.
An information leak flaw was found in the SSL 3.0 protocol implementation
in OpenSSL.
(CVE-2011-4619)
All OpenSSL users should upgrade to these updated packages, which contain
backported patches to resolve these issues. For the update to take effect,
all services linked to the OpenSSL library must be restarted, or the system
rebooted. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
771775 - CVE-2011-4576 openssl: uninitialized SSL 3.0 padding
771780 - CVE-2011-4619 openssl: SGC restart DoS attack
6. Package List:
Red Hat Enterprise Linux AS version 4:
Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/openssl-0.9.7a-43.18.el4.src.rpm
i386:
openssl-0.9.7a-43.18.el4.i386.rpm
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i386.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-devel-0.9.7a-43.18.el4.i386.rpm
openssl-perl-0.9.7a-43.18.el4.i386.rpm
ia64:
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-0.9.7a-43.18.el4.ia64.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.ia64.rpm
openssl-devel-0.9.7a-43.18.el4.ia64.rpm
openssl-perl-0.9.7a-43.18.el4.ia64.rpm
ppc:
openssl-0.9.7a-43.18.el4.ppc.rpm
openssl-0.9.7a-43.18.el4.ppc64.rpm
openssl-debuginfo-0.9.7a-43.18.el4.ppc.rpm
openssl-debuginfo-0.9.7a-43.18.el4.ppc64.rpm
openssl-devel-0.9.7a-43.18.el4.ppc.rpm
openssl-devel-0.9.7a-43.18.el4.ppc64.rpm
openssl-perl-0.9.7a-43.18.el4.ppc.rpm
s390:
openssl-0.9.7a-43.18.el4.s390.rpm
openssl-debuginfo-0.9.7a-43.18.el4.s390.rpm
openssl-devel-0.9.7a-43.18.el4.s390.rpm
openssl-perl-0.9.7a-43.18.el4.s390.rpm
s390x:
openssl-0.9.7a-43.18.el4.s390.rpm
openssl-0.9.7a-43.18.el4.s390x.rpm
openssl-debuginfo-0.9.7a-43.18.el4.s390.rpm
openssl-debuginfo-0.9.7a-43.18.el4.s390x.rpm
openssl-devel-0.9.7a-43.18.el4.s390.rpm
openssl-devel-0.9.7a-43.18.el4.s390x.rpm
openssl-perl-0.9.7a-43.18.el4.s390x.rpm
x86_64:
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-0.9.7a-43.18.el4.x86_64.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i386.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.x86_64.rpm
openssl-devel-0.9.7a-43.18.el4.i386.rpm
openssl-devel-0.9.7a-43.18.el4.x86_64.rpm
openssl-perl-0.9.7a-43.18.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/openssl-0.9.7a-43.18.el4.src.rpm
i386:
openssl-0.9.7a-43.18.el4.i386.rpm
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i386.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-devel-0.9.7a-43.18.el4.i386.rpm
openssl-perl-0.9.7a-43.18.el4.i386.rpm
x86_64:
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-0.9.7a-43.18.el4.x86_64.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i386.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.x86_64.rpm
openssl-devel-0.9.7a-43.18.el4.i386.rpm
openssl-devel-0.9.7a-43.18.el4.x86_64.rpm
openssl-perl-0.9.7a-43.18.el4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/openssl-0.9.7a-43.18.el4.src.rpm
i386:
openssl-0.9.7a-43.18.el4.i386.rpm
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i386.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-devel-0.9.7a-43.18.el4.i386.rpm
openssl-perl-0.9.7a-43.18.el4.i386.rpm
ia64:
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-0.9.7a-43.18.el4.ia64.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.ia64.rpm
openssl-devel-0.9.7a-43.18.el4.ia64.rpm
openssl-perl-0.9.7a-43.18.el4.ia64.rpm
x86_64:
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-0.9.7a-43.18.el4.x86_64.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i386.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.x86_64.rpm
openssl-devel-0.9.7a-43.18.el4.i386.rpm
openssl-devel-0.9.7a-43.18.el4.x86_64.rpm
openssl-perl-0.9.7a-43.18.el4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/openssl-0.9.7a-43.18.el4.src.rpm
i386:
openssl-0.9.7a-43.18.el4.i386.rpm
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i386.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-devel-0.9.7a-43.18.el4.i386.rpm
openssl-perl-0.9.7a-43.18.el4.i386.rpm
ia64:
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-0.9.7a-43.18.el4.ia64.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.ia64.rpm
openssl-devel-0.9.7a-43.18.el4.ia64.rpm
openssl-perl-0.9.7a-43.18.el4.ia64.rpm
x86_64:
openssl-0.9.7a-43.18.el4.i686.rpm
openssl-0.9.7a-43.18.el4.x86_64.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i386.rpm
openssl-debuginfo-0.9.7a-43.18.el4.i686.rpm
openssl-debuginfo-0.9.7a-43.18.el4.x86_64.rpm
openssl-devel-0.9.7a-43.18.el4.i386.rpm
openssl-devel-0.9.7a-43.18.el4.x86_64.rpm
openssl-perl-0.9.7a-43.18.el4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Note: the current version of the following document is available here:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03360041
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c03360041
Version: 1
HPSBMU02786 SSRT100877 rev.1 - HP System Management Homepage (SMH) Running on
Linux and Windows, Remote Unauthorized Access, Disclosure of Information,
Data Modification, Denial of Service (DoS), Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
Release Date: 2012-06-26
Last Updated: 2012-06-26
Potential Security Impact: Remote unauthorized access, disclosure of
information, data modification, Denial of Service (DoS), execution of
arbitrary code
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP System
Management Homepage (SMH) running on Linux and Windows. The vulnerabilities
could be exploited remotely resulting in unauthorized access, disclosure of
information, data modification, Denial of Service (DoS), and execution of
arbitrary code.
References: CVE-2011-1944, CVE-2011-2821, CVE-2011-2834, CVE-2011-3379,
CVE-2011-3607, CVE-2011-4078, CVE-2011-4108, CVE-2011-4153, CVE-2011-4317,
CVE-2011-4415, CVE-2011-4576, CVE-2011-4577, CVE-2011-4619, CVE-2011-4885,
CVE-2012-0021, CVE-2012-0027, CVE-2012-0031, CVE-2012-0036, CVE-2012-0053,
CVE-2012-0057, CVE-2012-0830, CVE-2012-1165, CVE-2012-1823,
CVE-2012-2012 (AUTOCOMPLETE enabled), CVE-2012-2013 (DoS),
CVE-2012-2014 (Improper input validation), CVE-2012-2015 (Privilege
Elevation),
CVE-2012-2016 (Information disclosure),
SSRT100336, SSRT100753, SSRT100669, SSRT100676,
SSRT100695, SSRT100714, SSRT100760, SSRT100786,
SSRT100787, SSRT100815, SSRT100840, SSRT100843, SSRT100869
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP System Management Homepage (SMH) before v7.1.1 running on Linux and
Windows.
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2012-2012 (AV:N/AC:L/Au:N/C:C/I:C/A:P) 9.7
CVE-2012-2013 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8
CVE-2012-2014 (AV:N/AC:M/Au:S/C:N/I:N/A:N) 6.8
CVE-2012-2015 (AV:N/AC:M/Au:S/C:P/I:N/A:N) 6.5
CVE-2012-2016 (AV:L/AC:M/Au:S/C:C/I:N/A:N) 4.4
CVE-2011-1944 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3
CVE-2011-2821 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2011-2834 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8
CVE-2011-3379 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2011-3607 (AV:L/AC:M/Au:N/C:P/I:P/A:P) 4.4
CVE-2011-4078 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
CVE-2011-4108 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3
CVE-2011-4153 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
CVE-2011-4317 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3
CVE-2011-4415 (AV:L/AC:H/Au:N/C:N/I:N/A:P) 1.2
CVE-2011-4576 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
CVE-2011-4577 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3
CVE-2011-4619 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
CVE-2011-4885 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
CVE-2012-0021 (AV:N/AC:H/Au:N/C:N/I:N/A:P) 2.6
CVE-2012-0027 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
CVE-2012-0031 (AV:L/AC:L/Au:N/C:P/I:P/A:P) 4.6
CVE-2012-0036 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2012-0053 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3
CVE-2012-0057 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4
CVE-2012-0830 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
CVE-2012-1165 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
CVE-2012-1823 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided HP System Management Homepage v7.1.1 or subsequent to resolve
the vulnerabilities. HP System Management Homepage v7.1.1 is available here:
HP System Management Homepage for Windows x64
[Download here] or enter the following URL into the browser address window.
http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetail
s/?sp4ts.oid=4091409&spf_p.tpst=psiSwdMain&spf_p.prp_psiSwdMain=wsrp-navigati
onalState%3Dlang%253Den%257Ccc%253DUS%257CprodSeriesId%253D4091408%257CprodNa
meId%253D4091409%257CswEnvOID%253D4064%257CswLang%253D8%257CswItem%253DMTX-ab
0d4e9bb4654a8da503eccfd9%257Cmode%253D3%257Caction%253DdriverDocument&javax.p
ortlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vign
ette.cachetoken
HP System Management Homepage for Windows x86
[Download here] or enter the following URL into the browser address window.
http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetail
s/?sp4ts.oid=4091409&spf_p.tpst=psiSwdMain&spf_p.prp_psiSwdMain=wsrp-navigati
onalState%3Dlang%253Den%257Ccc%253DUS%257CprodSeriesId%253D4091408%257CprodNa
meId%253D4091409%257CswEnvOID%253D4022%257CswLang%253D8%257CswItem%253DMTX-f7
c0d15d28474255bd0ec23136%257Cmode%253D3%257Caction%253DdriverDocument&javax.p
ortlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vign
ette.cachetoken
HP System Management Homepage for Linux (AMD64/EM64T)
[Download here] or enter the following URL into the browser address window.
http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetail
s/?sp4ts.oid=4091409&spf_p.tpst=psiSwdMain&spf_p.prp_psiSwdMain=wsrp-navigati
onalState%3Dlang%253Den%257Ccc%253DUS%257CprodSeriesId%253D4091408%257CprodNa
meId%253D4091409%257CswEnvOID%253D4035%257CswLang%253D8%257CswItem%253DMTX-18
d373dd1361400fbaca892942%257Cmode%253D3%257Caction%253DdriverDocument&javax.p
ortlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vign
ette.cachetoken
HP System Management Homepage for Linux (x86)
[Download here] or enter the following URL into the browser address window.
http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetail
s/?sp4ts.oid=4091409&spf_p.tpst=psiSwdMain&spf_p.prp_psiSwdMain=wsrp-navigati
onalState%3Dlang%253Den%257Ccc%253DUS%257CprodSeriesId%253D4091408%257CprodNa
meId%253D4091409%257CswEnvOID%253D4006%257CswLang%253D8%257CswItem%253DMTX-9e
8a0188f97d48139dcb466509%257Cmode%253D3%257Caction%253DdriverDocument&javax.p
ortlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vign
ette.cachetoken
HISTORY
Version:1 (rev.1) 26 June 2012 Initial release
Third Party Security Patches: Third party security patches that are to be
installed on systems running HP software products should be applied in
accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HP Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported
product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin
alerts via Email:
http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin List: A list of HP Security Bulletins, updated
periodically, is contained in HP Security Notice HPSN-2011-001:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c02964430
Security Bulletin Archive: A list of recently released Security Bulletins is
available here:
http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
Copyright 2012 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors
or omissions contained herein. The information provided is provided "as is"
without warranty of any kind. To the extent permitted by law, neither HP or
its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits;damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice.
Hewlett-Packard Company and the names of Hewlett-Packard products referenced
herein are trademarks of Hewlett-Packard Company in the United States and
other countries. Other product and company names mentioned herein may be
trademarks of their respective owners. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=============================================================================
FreeBSD-SA-12:01.openssl Security Advisory
The FreeBSD Project
Topic: OpenSSL multiple vulnerabilities
Category: contrib
Module: openssl
Announced: 2012-05-03
Credits: Adam Langley, George Kadianakis, Ben Laurie,
Ivan Nestlerode, Tavis Ormandy
Affects: All supported versions of FreeBSD.
Corrected: 2012-05-03 15:25:11 UTC (RELENG_7, 7.4-STABLE)
2012-05-03 15:25:11 UTC (RELENG_7_4, 7.4-RELEASE-p7)
2012-05-03 15:25:11 UTC (RELENG_8, 8.3-STABLE)
2012-05-03 15:25:11 UTC (RELENG_8_3, 8.3-RELEASE-p1)
2012-05-03 15:25:11 UTC (RELENG_8_2, 8.2-RELEASE-p7)
2012-05-03 15:25:11 UTC (RELENG_8_1, 8.1-RELEASE-p9)
2012-05-03 15:25:11 UTC (RELENG_9, 9.0-STABLE)
2012-05-03 15:25:11 UTC (RELENG_9_0, 9.0-RELEASE-p1)
CVE Name: CVE-2011-4576, CVE-2011-4619, CVE-2011-4109,
CVE-2012-0884, CVE-2012-2110
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/>.
I. Background
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is
a collaborative effort to develop a robust, commercial-grade, full-featured
Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols as well as a full-strength
general purpose cryptography library.
II. Problem Description
OpenSSL failes to clear the bytes used as block cipher padding in SSL 3.0
records when operating as a client or a server that accept SSL 3.0
handshakes. As a result, in each record, up to 15 bytes of uninitialized
memory may be sent, encrypted, to the SSL peer. This could include
sensitive contents of previously freed memory. [CVE-2011-4576]
OpenSSL support for handshake restarts for server gated cryptograpy (SGC)
can be used in a denial-of-service attack. [CVE-2011-4619]
If an application uses OpenSSL's certificate policy checking when
verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK
flag, a policy check failure can lead to a double-free. [CVE-2011-4109]
A weakness in the OpenSSL PKCS #7 code can be exploited using
Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the
million message attack (MMA). [CVE-2012-0884]
The asn1_d2i_read_bio() function, used by the d2i_*_bio and d2i_*_fp
functions, in OpenSSL contains multiple integer errors that can cause
memory corruption when parsing encoded ASN.1 data. This error can occur
on systems that parse untrusted ASN.1 data, such as X.509 certificates
or RSA public keys. [CVE-2012-2110]
III. Impact
Sensitive contents of the previously freed memory can be exposed
when communicating with a SSL 3.0 peer. However, FreeBSD OpenSSL
version does not support SSL_MODE_RELEASE_BUFFERS SSL mode and
therefore have a single write buffer per connection. That write buffer
is partially filled with non-sensitive, handshake data at the beginning
of the connection and, thereafter, only records which are longer than
any previously sent record leak any non-encrypted data. This, combined
with the small number of bytes leaked per record, serves to limit to
severity of this issue. [CVE-2011-4619]
The double-free, when an application performs X509 certificate policy
checking, can lead to denial of service in that application.
[CVE-2011-4109]
A weakness in the OpenSSL PKCS #7 code can lead to a successful
Bleichenbacher attack. Only users of PKCS #7 decryption operations are
affected. A successful attack needs on average 2^20 messages. In
practice only automated systems will be affected as humans will not be
willing to process this many messages. SSL/TLS applications are not
affected. [CVE-2012-0884]
The vulnerability in the asn1_d2i_read_bio() OpenSSL function can lead
to a potentially exploitable attack via buffer overflow. The SSL/TLS
code in OpenSSL is not affected by this issue, nor are applications
using the memory based ASN.1 functions. There are no applications in
FreeBSD base system affected by this issue, though some 3rd party
consumers of these functions might be vulnerable when processing
untrusted ASN.1 data. [CVE-2012-2110]
IV. Workaround
No workaround is available.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to 7-STABLE, 8-STABLE or 9-STABLE,
or to the RELENG_7_4, RELENG_8_3, RELENG_8_2, RELENG_8_1, RELENG_9_0
security branch dated after the correction date.
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to FreeBSD 7.4, 8.3,
8.2, 8.1, and 9.0 systems.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch http://security.FreeBSD.org/patches/SA-12:01/openssl.patch
# fetch http://security.FreeBSD.org/patches/SA-12:01/openssl.patch.asc
b) Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system as described in
<URL: http://www.freebsd.org/handbook/makeworld.html> and reboot the
system.
NOTE: Any third-party applications, including those installed from the
FreeBSD ports collection, which are statically linked to libcrypto(3)
should be recompiled in order to use the corrected code.
3) To update your vulnerable system via a binary patch:
Systems running 7.4-RELEASE, 8.3-RELEASE, 8.2-RELEASE, 8.1-RELEASE or
9.0-RELEASE on the i386 or amd64 platforms can be updated via the
freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
VI. Correction details
The following list contains the revision numbers of each file that was
corrected in FreeBSD.
CVS:
Branch Revision
Path
- - -------------------------------------------------------------------------
RELENG_7
src/crypto/openssl/crypto/pkcs7/pk7_doit.c 1.1.1.13.2.2
src/crypto/openssl/crypto/mem.c 1.1.1.8.2.2
src/crypto/openssl/crypto/x509v3/pcy_map.c 1.1.1.1.2.2
src/crypto/openssl/crypto/x509v3/pcy_tree.c 1.1.1.2.2.2
src/crypto/openssl/crypto/asn1/a_d2i_fp.c 1.1.1.3.2.1
src/crypto/openssl/crypto/buffer/buffer.c 1.1.1.4.2.2
src/crypto/openssl/ssl/ssl_err.c 1.1.1.11.2.3
src/crypto/openssl/ssl/s3_srvr.c 1.1.1.17.2.7
src/crypto/openssl/ssl/ssl.h 1.1.1.16.2.3
src/crypto/openssl/ssl/s3_enc.c 1.1.1.13.2.2
src/crypto/openssl/ssl/ssl3.h 1.1.1.6.2.2
RELENG_7_4
src/UPDATING 1.507.2.36.2.9
src/sys/conf/newvers.sh 1.72.2.18.2.12
src/crypto/openssl/crypto/pkcs7/pk7_doit.c 1.1.1.13.2.1.2.1
src/crypto/openssl/crypto/mem.c 1.1.1.8.2.1.2.1
src/crypto/openssl/crypto/x509v3/pcy_map.c 1.1.1.1.2.1.2.1
src/crypto/openssl/crypto/x509v3/pcy_tree.c 1.1.1.2.2.1.2.1
src/crypto/openssl/crypto/asn1/a_d2i_fp.c 1.1.1.3.20.1
src/crypto/openssl/crypto/buffer/buffer.c 1.1.1.4.2.1.2.1
src/crypto/openssl/ssl/ssl_err.c 1.1.1.11.2.2.2.1
src/crypto/openssl/ssl/s3_srvr.c 1.1.1.17.2.5.2.1
src/crypto/openssl/ssl/ssl.h 1.1.1.16.2.2.2.1
src/crypto/openssl/ssl/s3_enc.c 1.1.1.13.2.1.2.1
src/crypto/openssl/ssl/ssl3.h 1.1.1.6.2.1.2.1
RELENG_8
src/crypto/openssl/crypto/pkcs7/pk7_doit.c 1.1.1.13.10.2
src/crypto/openssl/crypto/mem.c 1.2.2.1
src/crypto/openssl/crypto/x509v3/pcy_map.c 1.2.2.1
src/crypto/openssl/crypto/x509v3/pcy_tree.c 1.2.2.2
src/crypto/openssl/crypto/asn1/a_d2i_fp.c 1.1.1.3.10.1
src/crypto/openssl/crypto/buffer/buffer.c 1.2.2.1
src/crypto/openssl/ssl/ssl_err.c 1.2.2.2
src/crypto/openssl/ssl/s3_srvr.c 1.3.2.5
src/crypto/openssl/ssl/ssl.h 1.2.2.2
src/crypto/openssl/ssl/s3_enc.c 1.2.2.2
src/crypto/openssl/ssl/ssl3.h 1.2.2.2
RELENG_8_3
src/UPDATING 1.632.2.26.2.3
src/sys/conf/newvers.sh 1.83.2.15.2.5
src/crypto/openssl/crypto/pkcs7/pk7_doit.c 1.1.1.13.10.1.4.1
src/crypto/openssl/crypto/mem.c 1.2.14.1
src/crypto/openssl/crypto/x509v3/pcy_map.c 1.2.14.1
src/crypto/openssl/crypto/x509v3/pcy_tree.c 1.2.2.1.6.1
src/crypto/openssl/crypto/asn1/a_d2i_fp.c 1.1.1.3.26.1
src/crypto/openssl/crypto/buffer/buffer.c 1.2.14.1
src/crypto/openssl/ssl/ssl_err.c 1.2.2.1.6.1
src/crypto/openssl/ssl/s3_srvr.c 1.3.2.4.2.1
src/crypto/openssl/ssl/ssl.h 1.2.2.1.6.1
src/crypto/openssl/ssl/s3_enc.c 1.2.2.1.4.1
src/crypto/openssl/ssl/ssl3.h 1.2.2.1.6.1
RELENG_8_2
src/UPDATING 1.632.2.19.2.9
src/sys/conf/newvers.sh 1.83.2.12.2.12
src/crypto/openssl/crypto/pkcs7/pk7_doit.c 1.1.1.13.10.1.2.1
src/crypto/openssl/crypto/mem.c 1.2.8.1
src/crypto/openssl/crypto/x509v3/pcy_map.c 1.2.8.1
src/crypto/openssl/crypto/x509v3/pcy_tree.c 1.2.2.1.4.1
src/crypto/openssl/crypto/asn1/a_d2i_fp.c 1.1.1.3.18.1
src/crypto/openssl/crypto/buffer/buffer.c 1.2.8.1
src/crypto/openssl/ssl/ssl_err.c 1.2.2.1.4.1
src/crypto/openssl/ssl/s3_srvr.c 1.3.2.3.2.1
src/crypto/openssl/ssl/ssl.h 1.2.2.1.4.1
src/crypto/openssl/ssl/s3_enc.c 1.2.2.1.2.1
src/crypto/openssl/ssl/ssl3.h 1.2.2.1.4.1
RELENG_8_1
src/UPDATING 1.632.2.14.2.12
src/sys/conf/newvers.sh 1.83.2.10.2.13
src/crypto/openssl/crypto/pkcs7/pk7_doit.c 1.1.1.13.16.1
src/crypto/openssl/crypto/mem.c 1.2.6.1
src/crypto/openssl/crypto/x509v3/pcy_map.c 1.2.6.1
src/crypto/openssl/crypto/x509v3/pcy_tree.c 1.2.2.1.2.1
src/crypto/openssl/crypto/asn1/a_d2i_fp.c 1.1.1.3.16.1
src/crypto/openssl/crypto/buffer/buffer.c 1.2.6.1
src/crypto/openssl/ssl/ssl_err.c 1.2.2.1.2.1
src/crypto/openssl/ssl/s3_srvr.c 1.3.2.2.2.1
src/crypto/openssl/ssl/ssl.h 1.2.2.1.2.1
src/crypto/openssl/ssl/s3_enc.c 1.2.6.1
src/crypto/openssl/ssl/ssl3.h 1.2.2.1.2.1
RELENG_9
src/crypto/openssl/crypto/pkcs7/pk7_doit.c 1.2.2.1
src/crypto/openssl/crypto/mem.c 1.2.10.1
src/crypto/openssl/crypto/x509v3/pcy_map.c 1.2.10.1
src/crypto/openssl/crypto/x509v3/pcy_tree.c 1.3.2.1
src/crypto/openssl/crypto/asn1/a_d2i_fp.c 1.1.1.3.22.1
src/crypto/openssl/crypto/buffer/buffer.c 1.2.10.1
src/crypto/openssl/ssl/ssl_err.c 1.3.2.1
src/crypto/openssl/ssl/s3_srvr.c 1.7.2.1
src/crypto/openssl/ssl/ssl.h 1.3.2.1
src/crypto/openssl/ssl/s3_enc.c 1.3.2.1
src/crypto/openssl/ssl/ssl3.h 1.3.2.1
RELENG_9_0
src/UPDATING 1.702.2.4.2.3
src/sys/conf/newvers.sh 1.95.2.4.2.5
src/crypto/openssl/crypto/pkcs7/pk7_doit.c 1.2.4.1
src/crypto/openssl/crypto/mem.c 1.2.12.1
src/crypto/openssl/crypto/x509v3/pcy_map.c 1.2.12.1
src/crypto/openssl/crypto/x509v3/pcy_tree.c 1.3.4.1
src/crypto/openssl/crypto/asn1/a_d2i_fp.c 1.1.1.3.24.1
src/crypto/openssl/crypto/buffer/buffer.c 1.2.12.1
src/crypto/openssl/ssl/ssl_err.c 1.3.4.1
src/crypto/openssl/ssl/s3_srvr.c 1.7.4.1
src/crypto/openssl/ssl/ssl.h 1.3.4.1
src/crypto/openssl/ssl/s3_enc.c 1.3.4.1
src/crypto/openssl/ssl/ssl3.h 1.3.4.1
- - -------------------------------------------------------------------------
Subversion:
Branch/path Revision
- - -------------------------------------------------------------------------
stable/7/ r234954
releng/7.4/ r234954
stable/8/ r234954
releng/8.3/ r234954
releng/8.2/ r234954
releng/8.1/ r234954
stable/9/ r234954
releng/9.0/ r234954
- - -------------------------------------------------------------------------
VII. References
http://www.openssl.org/news/secadv_20120419.txt
http://www.openssl.org/news/secadv_20120312.txt
http://www.openssl.org/news/secadv_20120104.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4576
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4109
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110
http://lists.openwall.net/full-disclosure/2012/04/19/4
The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-12:01.openssl.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (FreeBSD)
iEYEARECAAYFAk+ipzUACgkQFdaIBMps37I7pACeI7zZ21vj+6AVz5+15OP4foXm
N1IAn2rMThkptUz62e0QDCv3tJKW6N9i
=ko2h
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201203-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: OpenSSL: Multiple vulnerabilities
Date: March 06, 2012
Bugs: #397695, #399365
ID: 201203-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in OpenSSL, allowing remote
attackers to cause a Denial of Service or obtain sensitive information.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-libs/openssl < 1.0.0g *>= 0.9.8t
>= 1.0.0g
Description
===========
Multiple vulnerabilities have been found in OpenSSL:
* Timing differences for decryption are exposed by CBC mode encryption
in OpenSSL's implementation of DTLS (CVE-2011-4108).
* Assertion errors can occur during the handling of malformed X.509
certificates when OpenSSL is built with RFC 3779 support
(CVE-2011-4577).
* An incorrect fix for CVE-2011-4108 creates an unspecified
vulnerability for DTLS applications using OpenSSL (CVE-2012-0050).
Resolution
==========
All OpenSSL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.0g"
References
==========
[ 1 ] CVE-2011-4108
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4108
[ 2 ] CVE-2011-4109
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4109
[ 3 ] CVE-2011-4576
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4576
[ 4 ] CVE-2011-4577
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4577
[ 5 ] CVE-2011-4619
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4619
[ 6 ] CVE-2012-0027
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0027
[ 7 ] CVE-2012-0050
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0050
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201203-12.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. Content-Disposition: inline
==========================================================================Ubuntu Security Notice USN-1357-1
February 09, 2012
openssl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
Multiple vulnerabilities exist in OpenSSL that could expose
sensitive information or cause applications to crash.
Software Description:
- openssl: Secure Socket Layer (SSL) binary and related cryptographic tools
Details:
It was discovered that the elliptic curve cryptography (ECC) subsystem
in OpenSSL, when using the Elliptic Curve Digital Signature Algorithm
(ECDSA) for the ECDHE_ECDSA cipher suite, did not properly implement
curves over binary fields. This could allow an attacker to determine
private keys via a timing attack. This issue only affected Ubuntu 8.04
LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-1945)
Adam Langley discovered that the ephemeral Elliptic Curve
Diffie-Hellman (ECDH) functionality in OpenSSL did not ensure thread
safety while processing handshake messages from clients. This
could allow a remote attacker to cause a denial of service via
out-of-order messages that violate the TLS protocol. This issue only
affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu
11.04. (CVE-2011-3210)
Nadhem Alfardan and Kenny Paterson discovered that the Datagram
Transport Layer Security (DTLS) implementation in OpenSSL performed a
MAC check only if certain padding is valid. This could allow a remote
attacker to recover plaintext. (CVE-2011-4108)
Antonio Martin discovered that a flaw existed in the fix to address
CVE-2011-4108, the DTLS MAC check failure. This could allow a remote
attacker to cause a denial of service. (CVE-2012-0050)
Ben Laurie discovered a double free vulnerability in OpenSSL that could
be triggered when the X509_V_FLAG_POLICY_CHECK flag is enabled. This
could allow a remote attacker to cause a denial of service. This
issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10
and Ubuntu 11.04. (CVE-2011-4109)
It was discovered that OpenSSL, in certain circumstances involving
ECDH or ECDHE cipher suites, used an incorrect modular reduction
algorithm in its implementation of the P-256 and P-384 NIST elliptic
curves. This could allow a remote attacker to obtain the private
key of a TLS server via multiple handshake attempts. This issue only
affected Ubuntu 8.04 LTS. (CVE-2011-4576)
Andrew Chi discovered that OpenSSL, when RFC 3779 support is enabled,
could trigger an assert when handling an X.509 certificate containing
certificate-extension data associated with IP address blocks or
Autonomous System (AS) identifiers. This could allow a remote attacker
to cause a denial of service. This could allow a remote attacker to cause a denial of
service. (CVE-2011-4619)
Andrey Kulikov discovered that the GOST block cipher engine in OpenSSL
did not properly handle invalid parameters. This could allow a remote
attacker to cause a denial of service via crafted data from a TLS
client. This issue only affected Ubuntu 11.10. (CVE-2012-0027)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
libssl1.0.0 1.0.0e-2ubuntu4.2
openssl 1.0.0e-2ubuntu4.2
Ubuntu 11.04:
libssl0.9.8 0.9.8o-5ubuntu1.2
openssl 0.9.8o-5ubuntu1.2
Ubuntu 10.10:
libssl0.9.8 0.9.8o-1ubuntu4.6
openssl 0.9.8o-1ubuntu4.6
Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.8
openssl 0.9.8k-7ubuntu8.8
Ubuntu 8.04 LTS:
libssl0.9.8 0.9.8g-4ubuntu3.15
openssl 0.9.8g-4ubuntu3.15
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1357-1
CVE-2011-1945, CVE-2011-3210, CVE-2011-4108, CVE-2011-4109,
CVE-2011-4354, CVE-2011-4576, CVE-2011-4577, CVE-2011-4619,
CVE-2012-0027, CVE-2012-0050
Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.0e-2ubuntu4.2
https://launchpad.net/ubuntu/+source/openssl/0.9.8o-5ubuntu1.2
https://launchpad.net/ubuntu/+source/openssl/0.9.8o-1ubuntu4.6
https://launchpad.net/ubuntu/+source/openssl/0.9.8k-7ubuntu8.8
https://launchpad.net/ubuntu/+source/openssl/0.9.8g-4ubuntu3.15
. The Common Vulnerabilities and
Exposures project identifies the following vulnerabilities:
CVE-2011-4108
The DTLS implementation performs a MAC check only if certain
padding is valid, which makes it easier for remote attackers
to recover plaintext via a padding oracle attack.
CVE-2011-4109
A double free vulnerability when X509_V_FLAG_POLICY_CHECK is
enabled, allows remote attackers to cause applications crashes
and potentially allow execution of arbitrary code by
triggering failure of a policy check.
CVE-2011-4354
On 32-bit systems, the operations on NIST elliptic curves
P-256 and P-384 are not correctly implemented, potentially
leaking the private ECC key of a TLS server.
For the oldstable distribution (lenny), these problems have been fixed
in version 0.9.8g-15+lenny15.
For the stable distribution (squeeze), these problems have been fixed
in version 0.9.8o-4squeeze5.
For the testing distribution (wheezy) and the unstable distribution
(sid), these problems have been fixed in version 1.0.0f-1.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-201201-0170 | CVE-2011-4109 | Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL (0.9.8o). OpenSSL prone to multiple security vulnerabilities.
An attacker may leverage these issues to obtain sensitive information, cause a denial-of-service condition and perform unauthorized actions. Description:
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.
Multiple numeric conversion errors, leading to a buffer overflow, were
found in the way OpenSSL parsed ASN.1 (Abstract Syntax Notation One) data
from BIO (OpenSSL's I/O abstraction) inputs. Specially-crafted DER
(Distinguished Encoding Rules) encoded data read from a file or other BIO
input could cause an application using the OpenSSL library to crash or,
potentially, execute arbitrary code.
Warning: Before applying this update, back up your JBoss Enterprise
Application Platform's "server/[PROFILE]/deploy/" directory, along with all
other customized configuration files.
All users of JBoss Enterprise Application Platform 5.1.2 for Solaris and
Microsoft Windows as provided from the Red Hat Customer Portal are advised
to apply this update. Solution:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Application Platform installation (including all
applications and configuration files).
JBoss server instances configured to use the Tomcat Native library must be
restarted for this update to take effect. Bugs fixed (http://bugzilla.redhat.com/):
771770 - CVE-2011-4108 openssl: DTLS plaintext recovery attack
771771 - CVE-2011-4109 openssl: double-free in policy checks
771775 - CVE-2011-4576 openssl: uninitialized SSL 3.0 padding
771780 - CVE-2011-4619 openssl: SGC restart DoS attack
802489 - CVE-2012-1165 openssl: mime_param_cmp NULL dereference crash
802725 - CVE-2012-0884 openssl: CMS and PKCS#7 Bleichenbacher attack
814185 - CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
820686 - CVE-2012-2333 openssl: record length handling integer underflow
5.
HP SSL for OpenVMS v 1.4-453 (based on OpenSSL 0.9.8o stream) and earlier. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: rhev-hypervisor5 security and bug fix update
Advisory ID: RHSA-2012:0168-01
Product: Red Hat Enterprise Virtualization
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0168.html
Issue date: 2012-02-21
CVE Names: CVE-2011-4109 CVE-2011-4576 CVE-2011-4619
CVE-2012-0029 CVE-2012-0207
=====================================================================
1. Summary:
An updated rhev-hypervisor5 package that fixes several security issues and
various bugs is now available.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
2. Relevant releases/architectures:
RHEV Hypervisor for RHEL-5 - noarch
3. Description:
The rhev-hypervisor5 package provides a Red Hat Enterprise Virtualization
Hypervisor ISO disk image. The Red Hat Enterprise Virtualization
Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor.
It includes everything necessary to run and manage virtual machines: A
subset of the Red Hat Enterprise Linux operating environment and the Red
Hat Enterprise Virtualization Agent.
Note: Red Hat Enterprise Virtualization Hypervisor is only available for
the Intel 64 and AMD64 architectures with virtualization extensions.
A heap overflow flaw was found in the way QEMU-KVM emulated the e1000
network interface card. A privileged guest user in a virtual machine whose
network interface is configured to use the e1000 emulated driver could use
this flaw to crash the host or, possibly, escalate their privileges on the
host. (CVE-2012-0029)
A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query()
function. An attacker able to send certain IGMP (Internet Group Management
Protocol) packets to a target system could use this flaw to cause a denial
of service. (CVE-2011-4109)
An information leak flaw was found in the SSL 3.0 protocol implementation
in OpenSSL. Incorrect initialization of SSL record padding bytes could
cause an SSL client or server to send a limited amount of possibly
sensitive data to its SSL peer via the encrypted connection.
(CVE-2011-4576)
It was discovered that OpenSSL did not limit the number of TLS/SSL
handshake restarts required to support Server Gated Cryptography. A remote
attacker could use this flaw to make a TLS/SSL server using OpenSSL consume
an excessive amount of CPU by continuously restarting the handshake.
(CVE-2011-4619)
Red Hat would like to thank Nicolae Mogoreanu for reporting CVE-2012-0029,
and Simon McVittie for reporting CVE-2012-0207.
This updated package provides updated components that include fixes for
various security issues. These issues have no security impact on Red Hat
Enterprise Virtualization Hypervisor itself, however. The security fixes
included in this update address the following CVE numbers:
CVE-2006-1168 and CVE-2011-2716 (busybox issues)
CVE-2009-5029, CVE-2009-5064, CVE-2010-0830 and CVE-2011-1089 (glibc
issues)
CVE-2011-1083, CVE-2011-3638, CVE-2011-4086, CVE-2011-4127 and
CVE-2012-0028 (kernel issues)
CVE-2011-1526 (krb5 issue)
CVE-2011-4347 (kvm issue)
CVE-2010-4008, CVE-2011-0216, CVE-2011-2834, CVE-2011-3905, CVE-2011-3919
and CVE-2011-1944 (libxml2 issues)
CVE-2011-1749 (nfs-utils issue)
CVE-2011-4108 (openssl issue)
CVE-2011-0010 (sudo issue)
CVE-2011-1675 and CVE-2011-1677 (util-linux issues)
CVE-2010-0424 (vixie-cron issue)
This updated rhev-hypervisor5 package fixes various bugs. Documentation of
these changes will be available shortly in the Technical Notes document:
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization_for_Servers/2.2/html/Technical_Notes/index.html
Users of Red Hat Enterprise Virtualization Hypervisor are advised to
upgrade to this updated package, which fixes these issues.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
606191 - after upgrade , reboot can't shut off network successfully and back to firstboot menu again
627538 - System will not boot sometimes when using rhevm to do upgrade twice.
650179 - rhevm bridge came up instead of breth0 after fail to configure network
675325 - Changes to networking always clear the contents of resolv.conf
696875 - RHEVH bootup hanging in ovirt-early when doing LVM scanning
717535 - [RFE] No confirm message for ntp server setting
728895 - RHEV-H rpm should include a versions text file
732948 - CCISS: Auto install fail at creating physical volume.
734110 - rhevh - upgrade ovirt node fails due to nonexistent breth0
734480 - [RFE] Add virt-who package to RHEVH
734710 - Register RHN satellite will fail if RHN satellite password include space.
740127 - Provide our CPE name in a new system file
743938 - Make rhev-hypervisor RPM multi-installable like the kernel
747519 - RHEV-H 5.8 register to RHN will fail.
747647 - Change rhev-hypervisor RPM to be rhev-hypervisor5 to allow coinstallations with rhev-hypervisor6
756178 - remove redundant brcm-iscsi.log rotation from ovirt-node now that it is in iscsi-initiator-utils
758465 - RHEV-H 5.8 register to RHN will fail if password contains quotes or spaces
759462 - Can not retrieve running guests UUID in RHEVH node.
759632 - virt-who debugging output going to stderr always
759635 - Revert workaround of virt-who output
761357 - Multipathd service is stopped by default cause change password failed in single mode.
768256 - network layout is incorrect when configure network with nic up
771771 - CVE-2011-4109 openssl: double-free in policy checks
771775 - CVE-2011-4576 openssl: uninitialized SSL 3.0 padding
771780 - CVE-2011-4619 openssl: SGC restart DoS attack
772075 - CVE-2012-0029 qemu-kvm: e1000: process_tx_desc legacy mode packets heap overflow
772867 - CVE-2012-0207 kernel: igmp: Avoid zero delay when receiving odd mixture of IGMP queries
783625 - The setup command should only allow password setting and viewing logs in single mode.
6. Package List:
RHEV Hypervisor for RHEL-5:
noarch:
rhev-hypervisor5-5.8-20120202.0.el5.noarch.rpm
rhev-hypervisor5-tools-5.8-20120202.0.el5.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-4109.html
https://www.redhat.com/security/data/cve/CVE-2011-4576.html
https://www.redhat.com/security/data/cve/CVE-2011-4619.html
https://www.redhat.com/security/data/cve/CVE-2012-0029.html
https://www.redhat.com/security/data/cve/CVE-2012-0207.html
https://access.redhat.com/security/updates/classification/#important
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization_for_Servers/2.2/html/Technical_Notes/index.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFPQ1yHXlSAg2UNWIIRAl9/AJ9JmPpSO5U2xwDBKDZA8y5To8EVcwCfZFGN
bzF952CZ/r5T3LUF9kY6X8c=
=IdNq
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
.
_______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been found and corrected in openssl:
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f
performs a MAC check only if certain padding is valid, which makes
it easier for remote attackers to recover plaintext via a padding
oracle attack (CVE-2011-4108).
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle
invalid parameters for the GOST block cipher, which allows remote
attackers to cause a denial of service (daemon crash) via crafted
data from a TLS client (CVE-2012-0027).
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4108
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4109
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4576
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0027
http://www.openssl.org/news/secadv_20120104.txt
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2011:
2291c13c44539a5e25f58750a5d6bf8f 2011/i586/libopenssl1.0.0-1.0.0d-2.2-mdv2011.0.i586.rpm
c610330d2c4c7397feb126247b1fa94f 2011/i586/libopenssl-devel-1.0.0d-2.2-mdv2011.0.i586.rpm
36c86a84320e1c8a17a74e4e68bc7d5a 2011/i586/libopenssl-engines1.0.0-1.0.0d-2.2-mdv2011.0.i586.rpm
4b8054f2c169d2b3223195053bd15802 2011/i586/libopenssl-static-devel-1.0.0d-2.2-mdv2011.0.i586.rpm
3c48b209b941a83a6acfef439c3f78b7 2011/i586/openssl-1.0.0d-2.2-mdv2011.0.i586.rpm
7af9d175d066db069aeb82248df9772b 2011/SRPMS/openssl-1.0.0d-2.2.src.rpm
Mandriva Linux 2011/X86_64:
21a50bd2be83839266f033c9a0f0fabc 2011/x86_64/lib64openssl1.0.0-1.0.0d-2.2-mdv2011.0.x86_64.rpm
7e80ee8e2d445c5f1985cd52d2316658 2011/x86_64/lib64openssl-devel-1.0.0d-2.2-mdv2011.0.x86_64.rpm
e1f4faa3162a6bbc14b37e4cb8d1e8e2 2011/x86_64/lib64openssl-engines1.0.0-1.0.0d-2.2-mdv2011.0.x86_64.rpm
6e3ac6d57cf0f4e13ed8e275a9bd2ff8 2011/x86_64/lib64openssl-static-devel-1.0.0d-2.2-mdv2011.0.x86_64.rpm
e9e0306f8dc9f398915a646547e262e2 2011/x86_64/openssl-1.0.0d-2.2-mdv2011.0.x86_64.rpm
7af9d175d066db069aeb82248df9772b 2011/SRPMS/openssl-1.0.0d-2.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFPFFiBmqjQ0CJFipgRAkIUAJ9foScZELNgGkHUEaaSx9sgdWNMFwCgnsst
eph27yO3eEECVX28+SNUKyw=
=wTFq
-----END PGP SIGNATURE-----
.
Release Date: 2012-01-19
Last Updated: 2012-01-19
------------------------------------------------------------------------------
Potential Security Impact: Remote Denial of Service (DoS), unauthorized access
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP-UX OpenSSL. This vulnerability could be exploited remotely to create a Denial of Service (DoS) or to gain unauthorized access.
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.11, B.11.23, B.11.31 running OpenSSL before vA.00.09.08s.
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2011-3210 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
CVE-2011-4108 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3
CVE-2011-4109 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 9.3
CVE-2011-4576 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
CVE-2011-4577 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3
CVE-2011-4619 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided upgrades to resolve this vulnerability.
The upgrades are available from the following location
ftp://ossl098s:Secure12@ftp.usa.hp.com
HP-UX Release / Depot Name
B.11.11 PA (32 and 64) / OpenSSL_A.00.09.08s.001_HP-UX_B.11.11_32+64.depot
B.11.23 (PA and IA) / OpenSSL_A.00.09.08s.002_HP-UX_B.11.23_IA-PA.depot
B.11.31 (PA and IA) / OpenSSL_A.00.09.08s.003_HP-UX_B.11.31_IA-PA.depot
MANUAL ACTIONS: Yes - Update
Install OpenSSL A.00.09.08s or subsequent
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS
HP-UX B.11.11
==================
openssl.OPENSSL-CER
openssl.OPENSSL-CONF
openssl.OPENSSL-DOC
openssl.OPENSSL-INC
openssl.OPENSSL-LIB
openssl.OPENSSL-MAN
openssl.OPENSSL-MIS
openssl.OPENSSL-PRNG
openssl.OPENSSL-PVT
openssl.OPENSSL-RUN
openssl.OPENSSL-SRC
action: Install revision A.00.09.08s.001 or subsequent
HP-UX B.11.23
==================
openssl.OPENSSL-CER
openssl.OPENSSL-CONF
openssl.OPENSSL-DOC
openssl.OPENSSL-INC
openssl.OPENSSL-LIB
openssl.OPENSSL-MAN
openssl.OPENSSL-MIS
openssl.OPENSSL-PRNG
openssl.OPENSSL-PVT
openssl.OPENSSL-RUN
openssl.OPENSSL-SRC
action: Install revision A.00.09.08s.002 or subsequent
HP-UX B.11.31
==================
openssl.OPENSSL-CER
openssl.OPENSSL-CONF
openssl.OPENSSL-DOC
openssl.OPENSSL-INC
openssl.OPENSSL-LIB
openssl.OPENSSL-MAN
openssl.OPENSSL-MIS
openssl.OPENSSL-PRNG
openssl.OPENSSL-PVT
openssl.OPENSSL-RUN
openssl.OPENSSL-SRC
action: Install revision A.00.09.08s.003 or subsequent
END AFFECTED VERSIONS
HISTORY
Version:1 (rev.1) 19 January 2012 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02964430
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
Copyright 2012 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
| VAR-201201-0030 | CVE-2011-4576 | Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL (0.9.8o). OpenSSL prone to multiple security vulnerabilities.
An attacker may leverage these issues to obtain sensitive information, cause a denial-of-service condition and perform unauthorized actions.
HP System Management Homepage (SMH) before v7.1.1 running on Linux, Windows
and VMware ESX. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201203-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: OpenSSL: Multiple vulnerabilities
Date: March 06, 2012
Bugs: #397695, #399365
ID: 201203-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in OpenSSL, allowing remote
attackers to cause a Denial of Service or obtain sensitive information.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-libs/openssl < 1.0.0g *>= 0.9.8t
>= 1.0.0g
Description
===========
Multiple vulnerabilities have been found in OpenSSL:
* Timing differences for decryption are exposed by CBC mode encryption
in OpenSSL's implementation of DTLS (CVE-2011-4108).
* A policy check failure can result in a double-free error when
X509_V_FLAG_POLICY_CHECK is set (CVE-2011-4109).
* Assertion errors can occur during the handling of malformed X.509
certificates when OpenSSL is built with RFC 3779 support
(CVE-2011-4577).
* Invalid parameters in the GOST block cipher are not properly handled
by the GOST ENGINE(CVE-2012-0027).
* An incorrect fix for CVE-2011-4108 creates an unspecified
vulnerability for DTLS applications using OpenSSL (CVE-2012-0050).
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All OpenSSL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.0g"
References
==========
[ 1 ] CVE-2011-4108
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4108
[ 2 ] CVE-2011-4109
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4109
[ 3 ] CVE-2011-4576
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4576
[ 4 ] CVE-2011-4577
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4577
[ 5 ] CVE-2011-4619
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4619
[ 6 ] CVE-2012-0027
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0027
[ 7 ] CVE-2012-0050
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0050
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201203-12.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: openssl security update
Advisory ID: RHSA-2012:0059-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0059.html
Issue date: 2012-01-24
CVE Names: CVE-2011-4108 CVE-2011-4576 CVE-2011-4577
CVE-2011-4619
=====================================================================
1. Summary:
Updated openssl packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
3. Description:
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.
It was discovered that the Datagram Transport Layer Security (DTLS)
protocol implementation in OpenSSL leaked timing information when
performing certain operations. A remote attacker could possibly use this
flaw to retrieve plain text from the encrypted packets by using a DTLS
server as a padding oracle. (CVE-2011-4108)
An information leak flaw was found in the SSL 3.0 protocol implementation
in OpenSSL.
(CVE-2011-4576)
A denial of service flaw was found in the RFC 3779 implementation in
OpenSSL. A remote attacker could use this flaw to make an application using
OpenSSL exit unexpectedly by providing a specially-crafted X.509
certificate that has malformed RFC 3779 extension data. (CVE-2011-4577)
It was discovered that OpenSSL did not limit the number of TLS/SSL
handshake restarts required to support Server Gated Cryptography. A remote
attacker could use this flaw to make a TLS/SSL server using OpenSSL consume
an excessive amount of CPU by continuously restarting the handshake.
(CVE-2011-4619)
All OpenSSL users should upgrade to these updated packages, which contain
backported patches to resolve these issues. For the update to take effect,
all services linked to the OpenSSL library must be restarted, or the system
rebooted.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
771770 - CVE-2011-4108 openssl: DTLS plaintext recovery attack
771775 - CVE-2011-4576 openssl: uninitialized SSL 3.0 padding
771778 - CVE-2011-4577 openssl: malformed RFC 3779 data can cause assertion failures
771780 - CVE-2011-4619 openssl: SGC restart DoS attack
6. Package List:
Red Hat Enterprise Linux Desktop (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/openssl-1.0.0-20.el6_2.1.src.rpm
i386:
openssl-1.0.0-20.el6_2.1.i686.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
x86_64:
openssl-1.0.0-20.el6_2.1.i686.rpm
openssl-1.0.0-20.el6_2.1.x86_64.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/openssl-1.0.0-20.el6_2.1.src.rpm
i386:
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-devel-1.0.0-20.el6_2.1.i686.rpm
openssl-perl-1.0.0-20.el6_2.1.i686.rpm
openssl-static-1.0.0-20.el6_2.1.i686.rpm
x86_64:
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.x86_64.rpm
openssl-devel-1.0.0-20.el6_2.1.i686.rpm
openssl-devel-1.0.0-20.el6_2.1.x86_64.rpm
openssl-perl-1.0.0-20.el6_2.1.x86_64.rpm
openssl-static-1.0.0-20.el6_2.1.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/openssl-1.0.0-20.el6_2.1.src.rpm
x86_64:
openssl-1.0.0-20.el6_2.1.i686.rpm
openssl-1.0.0-20.el6_2.1.x86_64.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/openssl-1.0.0-20.el6_2.1.src.rpm
x86_64:
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.x86_64.rpm
openssl-devel-1.0.0-20.el6_2.1.i686.rpm
openssl-devel-1.0.0-20.el6_2.1.x86_64.rpm
openssl-perl-1.0.0-20.el6_2.1.x86_64.rpm
openssl-static-1.0.0-20.el6_2.1.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/openssl-1.0.0-20.el6_2.1.src.rpm
i386:
openssl-1.0.0-20.el6_2.1.i686.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-devel-1.0.0-20.el6_2.1.i686.rpm
ppc64:
openssl-1.0.0-20.el6_2.1.ppc.rpm
openssl-1.0.0-20.el6_2.1.ppc64.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.ppc.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.ppc64.rpm
openssl-devel-1.0.0-20.el6_2.1.ppc.rpm
openssl-devel-1.0.0-20.el6_2.1.ppc64.rpm
s390x:
openssl-1.0.0-20.el6_2.1.s390.rpm
openssl-1.0.0-20.el6_2.1.s390x.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.s390.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.s390x.rpm
openssl-devel-1.0.0-20.el6_2.1.s390.rpm
openssl-devel-1.0.0-20.el6_2.1.s390x.rpm
x86_64:
openssl-1.0.0-20.el6_2.1.i686.rpm
openssl-1.0.0-20.el6_2.1.x86_64.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.x86_64.rpm
openssl-devel-1.0.0-20.el6_2.1.i686.rpm
openssl-devel-1.0.0-20.el6_2.1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/openssl-1.0.0-20.el6_2.1.src.rpm
i386:
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-perl-1.0.0-20.el6_2.1.i686.rpm
openssl-static-1.0.0-20.el6_2.1.i686.rpm
ppc64:
openssl-debuginfo-1.0.0-20.el6_2.1.ppc64.rpm
openssl-perl-1.0.0-20.el6_2.1.ppc64.rpm
openssl-static-1.0.0-20.el6_2.1.ppc64.rpm
s390x:
openssl-debuginfo-1.0.0-20.el6_2.1.s390x.rpm
openssl-perl-1.0.0-20.el6_2.1.s390x.rpm
openssl-static-1.0.0-20.el6_2.1.s390x.rpm
x86_64:
openssl-debuginfo-1.0.0-20.el6_2.1.x86_64.rpm
openssl-perl-1.0.0-20.el6_2.1.x86_64.rpm
openssl-static-1.0.0-20.el6_2.1.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/openssl-1.0.0-20.el6_2.1.src.rpm
i386:
openssl-1.0.0-20.el6_2.1.i686.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-devel-1.0.0-20.el6_2.1.i686.rpm
x86_64:
openssl-1.0.0-20.el6_2.1.i686.rpm
openssl-1.0.0-20.el6_2.1.x86_64.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-debuginfo-1.0.0-20.el6_2.1.x86_64.rpm
openssl-devel-1.0.0-20.el6_2.1.i686.rpm
openssl-devel-1.0.0-20.el6_2.1.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/openssl-1.0.0-20.el6_2.1.src.rpm
i386:
openssl-debuginfo-1.0.0-20.el6_2.1.i686.rpm
openssl-perl-1.0.0-20.el6_2.1.i686.rpm
openssl-static-1.0.0-20.el6_2.1.i686.rpm
x86_64:
openssl-debuginfo-1.0.0-20.el6_2.1.x86_64.rpm
openssl-perl-1.0.0-20.el6_2.1.x86_64.rpm
openssl-static-1.0.0-20.el6_2.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-4108.html
https://www.redhat.com/security/data/cve/CVE-2011-4576.html
https://www.redhat.com/security/data/cve/CVE-2011-4577.html
https://www.redhat.com/security/data/cve/CVE-2011-4619.html
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFPHySOXlSAg2UNWIIRAlYpAKCQCY5k4gZ5VKOHZekEaWFHDNjGZwCZAdR3
CJl5iUxU4cxJLOsSBESSRVs=
=PMiS
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
. (CVE-2011-4108)
A double free flaw was discovered in the policy checking code in OpenSSL. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFPFFPomqjQ0CJFipgRAl3XAJ98ku9J45p5DbU9rrN6ysGe/RplGQCg1ueY
rXmxnKKkthEOaOLbMi8jRlg=
=HfOo
-----END PGP SIGNATURE-----
.
Release Date: 2012-01-19
Last Updated: 2012-01-19
------------------------------------------------------------------------------
Potential Security Impact: Remote Denial of Service (DoS), unauthorized access
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP-UX OpenSSL. This vulnerability could be exploited remotely to create a Denial of Service (DoS) or to gain unauthorized access.
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.11, B.11.23, B.11.31 running OpenSSL before vA.00.09.08s.
BACKGROUND
CVSS 2.0 Base Metrics
===========================================================
Reference Base Vector Base Score
CVE-2011-3210 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
CVE-2011-4108 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3
CVE-2011-4109 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 9.3
CVE-2011-4576 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
CVE-2011-4577 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3
CVE-2011-4619 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0
===========================================================
Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided upgrades to resolve this vulnerability.
The upgrades are available from the following location
ftp://ossl098s:Secure12@ftp.usa.hp.com
HP-UX Release / Depot Name
B.11.11 PA (32 and 64) / OpenSSL_A.00.09.08s.001_HP-UX_B.11.11_32+64.depot
B.11.23 (PA and IA) / OpenSSL_A.00.09.08s.002_HP-UX_B.11.23_IA-PA.depot
B.11.31 (PA and IA) / OpenSSL_A.00.09.08s.003_HP-UX_B.11.31_IA-PA.depot
MANUAL ACTIONS: Yes - Update
Install OpenSSL A.00.09.08s or subsequent
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS
HP-UX B.11.11
==================
openssl.OPENSSL-CER
openssl.OPENSSL-CONF
openssl.OPENSSL-DOC
openssl.OPENSSL-INC
openssl.OPENSSL-LIB
openssl.OPENSSL-MAN
openssl.OPENSSL-MIS
openssl.OPENSSL-PRNG
openssl.OPENSSL-PVT
openssl.OPENSSL-RUN
openssl.OPENSSL-SRC
action: Install revision A.00.09.08s.001 or subsequent
HP-UX B.11.23
==================
openssl.OPENSSL-CER
openssl.OPENSSL-CONF
openssl.OPENSSL-DOC
openssl.OPENSSL-INC
openssl.OPENSSL-LIB
openssl.OPENSSL-MAN
openssl.OPENSSL-MIS
openssl.OPENSSL-PRNG
openssl.OPENSSL-PVT
openssl.OPENSSL-RUN
openssl.OPENSSL-SRC
action: Install revision A.00.09.08s.002 or subsequent
HP-UX B.11.31
==================
openssl.OPENSSL-CER
openssl.OPENSSL-CONF
openssl.OPENSSL-DOC
openssl.OPENSSL-INC
openssl.OPENSSL-LIB
openssl.OPENSSL-MAN
openssl.OPENSSL-MIS
openssl.OPENSSL-PRNG
openssl.OPENSSL-PVT
openssl.OPENSSL-RUN
openssl.OPENSSL-SRC
action: Install revision A.00.09.08s.003 or subsequent
END AFFECTED VERSIONS
HISTORY
Version:1 (rev.1) 19 January 2012 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02964430
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
Copyright 2012 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners