Sunday, February 1, 2015

IT Security Alerts Weekly Digest (25 Jan ~ 31 Jan 2015)

1. Vulnerabilities in Cisco Products (cisco-sa-20150128-ghost)
[30/01/2015] Vulnerabilities were identified in the Cisco Identity Services Engine (ISE), Cisco Prime Infrastructure 2.2, Cisco Connected Grid Routers (CGR), Cisco Unified Communications Manager (UCM) 10.0, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified SIP Proxy, Cisco DCM Series 9900-Digital Content Manager, Cisco Edge 300 Digital Media Player, Cisco Edge 340 Digital Media Player, Cisco SLIM and Cisco WebEx Meetings Server. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, perform cross-site request forgery attacks and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-ghost
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0595
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0596
URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0597

2. Vulnerabilities in Symantec Products (SYM15-002)
[30/01/2015] Vulnerabilities were identified in the Symantec Encryption Management Server and Symantec PGP Universal Server. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code and perform code injection attacks. These vulnerabilities affect versions prior to 3.3.2 MP7 of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150129_00

3. Security Updates in Oracle Linux (ELSA-2015-0092, ELSA-2015-3003, ELSA-2015-3004, ELSA-2015-3005)
[30/01/2015] Oracle has released security update packages for fixing the vulnerabilities identified in the glibc and kernel packages for Oracle Linux 6 and 7. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:linux.oracle.com/errata/ELSA-2015-0092.html
URL:linux.oracle.com/errata/ELSA-2015-3003.html
URL:linux.oracle.com/errata/ELSA-2015-3004.html
URL:linux.oracle.com/errata/ELSA-2015-3005.html

4. Security Updates in SUSE (SUSE-SU-2015:0171-1, SUSE-SU-2015:0173-1, openSUSE-SU-2015:0174-1)
[30/01/2015] SUSE has released security update packages for fixing the vulnerabilities identified in the Mozilla Firefox package of SUSE Linux Enterprise 10 and 11, and flash-player package of openSUSE 12.3. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00034.html

5. Vulnerability in Cisco Prime Service Catalog (cisco-sa-20150128-psc-xmlee)
[29/01/2015] Vulnerability was identified in the Cisco Prime Service Catalog. An attacker could bypass security restrictions, obtain sensitive information, cause a denial of service condition and crash the system. This vulnerability affects versions prior to 10.1 of the mentioned product. Security patches are available to resolve this vulnerability.

URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-psc-xmlee

6. Vulnerabilities in Novell iPrint Appliance (5199790)
[29/01/2015] Vulnerabilities were identified in the Novell iPrint Appliance. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect versions prior to 1.0.1 Security Update 2 of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:download.novell.com/Download?buildid=J8ldlyQO7Fg~

7. Vulnerability in F5 Products (SOL16057)
[29/01/2015] Vulnerability was identified in the F5 BIG-IP LTM, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator, BIG-IP WOM and ARX. An attacker could bypass security restrictions and obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. This vulnerability affects multiple versions of the mentioned products.

URL:support.f5.com/kb/en-us/solutions/public/16000/000/sol16057.html

8. Vulnerability in Juniper Products (JSA10671)
[29/01/2015] Vulnerability was identified in the Junos Space, CTP and CTPView. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. This vulnerability affects multiple versions of the mentioned products. Security patches are available to resolve this vulnerability.

URL:kb.juniper.net/InfoCenter/index?page=content&id=JSA10671

9. Security Updates in Oracle Linux (ELSA-2015-0087, ELSA-2015-0100, ELSA-2015-0102)
[29/01/2015] Oracle has released security update packages for fixing the vulnerabilities identified in the kernel and libyaml packages for Oracle Linux 6 and 7. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system.

URL:linux.oracle.com/errata/ELSA-2015-0087.html
URL:linux.oracle.com/errata/ELSA-2015-0100.html
URL:linux.oracle.com/errata/ELSA-2015-0102.html

10. Security Updates in Debian (DSA-3143-1)
[29/01/2015] Debian has released security update packages for fixing the vulnerabilities identified in the virtualbox package for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system.

URL:www.debian.org/security/2015/dsa-3143

11. Security Updates in Red Hat Enterprise Linux (RHSA-2015:0099-1, RHSA-2015:0100-1, RHSA-2015:0101-1, RHSA-2015:0102-1)
[29/01/2015] Red Hat has released security update packages for fixing the vulnerabilities identified in the glibc, libyaml and kernel packages for Red Hat Enterprise Linux 4, 5, 6 and 7. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:rhn.redhat.com/errata/RHSA-2015-0099.html
URL:rhn.redhat.com/errata/RHSA-2015-0100.html
URL:rhn.redhat.com/errata/RHSA-2015-0101.html
URL:rhn.redhat.com/errata/RHSA-2015-0102.html

12. Security Updates in Slackware (SSA:2015-028-01)
[29/01/2015] Slackware has released security update packages for fixing the vulnerability identified in the glibc package for multiple versions of Slackware Linux. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code and compromise the system.

URL:www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.1260924

13. Security Updates in SUSE (SUSE-SU-2015:0158-1, openSUSE-SU-2015:0161-1, openSUSE-SU-2015:0162-1, SUSE-SU-2015:0163-1)
[29/01/2015] SUSE has released security update packages for fixing the vulnerabilities identified in the glibc, libpng16 and flash-player package of SUSE Linux Enterprise 10, 11, openSUSE 13.1, 13.2, and openSUSE Evergreen 11.4. Due to multiple errors, an attacker could bypass security restriction, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system.

URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00028.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00029.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00030.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00031.html

14. Security Updates in Ubuntu GNU/Linux (USN-2487-1)
[29/01/2015] Ubuntu has released security update packages for fixing the vulnerabilities identified in the openjdk-7 packages for versions 14.04 LTS and 14.10 of Ubuntu GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system.

URL:www.ubuntu.com/usn/usn-2487-1/

15. Vulnerabilities in Adobe Flash Player (APSB15-03)
[28/01/2015] Vulnerabilities were identified in the Adobe Flash Player. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code and compromise the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:helpx.adobe.com/security/products/flash-player/apsb15-03.html
URL:technet.microsoft.com/library/security/2755801.aspx

16. Vulnerabilities in Apple Products (HT204243, HT204244, HT204245, HT204246)
[28/01/2015] Vulnerabilities were identified in the Apple Safari, Apple OS X, Apple iOS and Apple TV. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:support.apple.com/en-us/HT204243
URL:support.apple.com/en-us/HT204244
URL:support.apple.com/en-us/HT204245
URL:support.apple.com/en-us/HT204246
URL:prod.lists.apple.com/archives/security-announce/2015/Jan/msg00004.html

17. Vulnerability in GNU C Library
[28/01/2015] Vulnerability was identified in the GNU C Library (glibc). An attacker could bypass security restrictions and execute arbitrary code. This vulnerability affects versions prior to 2.18 of the mentioned product. Security patches are available to resolve this vulnerability.

URL:www.us-cert.gov/ncas/current-activity/2015/01/27/Linux-Ghost-Remote-Code-Execution-Vulnerability

18. Security Updates in Oracle Linux (ELSA-2015-0090, ELSA-2015-0092)
[28/01/2015] Oracle has released security update packages for fixing the vulnerability identified in the glibc package for Oracle Linux 5, 6 and 7. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system.

URL:linux.oracle.com/errata/ELSA-2015-0090.html
URL:linux.oracle.com/errata/ELSA-2015-0092.html

19. Security Updates in Debian (DSA-3140-1, DSA-3141-1, DSA-3142-1)
[28/01/2015] Debian has released security update packages for fixing the vulnerabilities identified in the xen, wireshark and eglibc packages for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system.

URL:www.debian.org/security/2015/dsa-3140
URL:www.debian.org/security/2015/dsa-3141
URL:www.debian.org/security/2015/dsa-3142

20. Security Updates in Mageia (MGASA-2015-0039, MGASA-2015-0040, MGASA-2015-0041, MGASA-2015-0042, MGASA-2015-0043)
[28/01/2015] Mageia has released security update packages for fixing the vulnerabilities identified in the python-pillow, php, php-apc, libgd, busybox, privoxy and flash-player-plugin packages for multiple versions of Mageia. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:advisories.mageia.org/MGASA-2015-0039.html
URL:advisories.mageia.org/MGASA-2015-0040.html
URL:advisories.mageia.org/MGASA-2015-0041.html
URL:advisories.mageia.org/MGASA-2015-0042.html
URL:advisories.mageia.org/MGASA-2015-0043.html

21. Security Updates in Red Hat Enterprise Linux (RHSA-2015:0087-1, RHSA-2015:0090-1, RHSA-2015:0092-1, RHSA-2015:0093-1, RHSA-2015:0094-1)
[28/01/2015] Red Hat has released security update packages for fixing the vulnerabilities identified in the kernel, glibc, chromium-browser and Adobe Flash Player packages for Red Hat Enterprise Linux 5, 6 and 7. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:rhn.redhat.com/errata/RHSA-2015-0087.html
URL:rhn.redhat.com/errata/RHSA-2015-0090.html
URL:rhn.redhat.com/errata/RHSA-2015-0092.html
URL:rhn.redhat.com/errata/RHSA-2015-0093.html
URL:rhn.redhat.com/errata/RHSA-2015-0094.html

22. Security Updates in SUSE (openSUSE-SU-2015:0150-1, SUSE-SU-2015:0151-1)
[28/01/2015] SUSE has released security update packages for fixing the vulnerabilities identified in the flash-player package of openSUSE 13.1, 13.2 and SUSE Linux Enterprise 12. Due to multiple errors, an attacker could bypass security restriction, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system.

URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00026.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00027.html

23. Security Updates in Ubuntu GNU/Linux (USN-2458-3, USN-2485-1, USN-2486-1)
[28/01/2015] Ubuntu has released security update packages for fixing the vulnerabilities identified in the firefox, eglibc and openjdk-6 packages for versions 10.04 LTS, 12.04 LTS, 14.04 LTS and 14.10 of Ubuntu GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:www.ubuntu.com/usn/usn-2458-3/
URL:www.ubuntu.com/usn/usn-2485-1/
URL:www.ubuntu.com/usn/usn-2486-1/

24. Vulnerability in Cisco 2900 Series Integrated Services Router
[27/01/2015] Vulnerability was identified in the Cisco 2900 Series Integrated Services Router. An attacker could bypass security restrictions, cause a denial of service condition and crash the system. This vulnerability affects multiple firmware versions of the mentioned product. Security patches are available to resolve this vulnerability.

URL:tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0586

25. Vulnerabilities in Novell NetIQ Access Manager (5198470)
[27/01/2015] Vulnerabilities were identified in the Novell NetIQ Access Manager. An attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code. These vulnerabilities affect versions prior to 3.2 Support Pack 3 Hot Fix 1 build (version 3.2.3-66) of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:download.novell.com/Download?buildid=Vh9FJbkrGdw~

26. Vulnerability in F5 Products (SOL16025)
[27/01/2015] Vulnerability was identified in the F5 BIG-IP LTM, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator, BIG-IP WOM, Enterprise Manager, BIG-IQ Cloud, BIG-IQ Device and BIG-IQ Security. An attacker could bypass security restrictions, cause a denial of service condition and crash the system. This vulnerability affects multiple versions of the mentioned products. Security patches are available to resolve this vulnerability.

URL:support.f5.com/kb/en-us/solutions/public/16000/000/sol16025.html

27. Vulnerabilities in PHP
[27/01/2015] Vulnerabilities were identified in the PHP. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect versions prior to 5.4.37, 5.5.21, 5.6.5 of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:php.net/archive/2015.php#id2015-01-22-3
URL:php.net/ChangeLog-5.php#5.4.37
URL:php.net/ChangeLog-5.php#5.5.21
URL:php.net/ChangeLog-5.php#5.6.5
URL:www.hkcert.org/my_url/en/alert/15012701

28. Security Updates in Oracle Linux (ELSA-2015-0085)
[27/01/2015] Oracle has released security update packages for fixing the vulnerabilities identified in the java-1.6.0-openjdk package for Oracle Linux 5, 6 and 7. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:linux.oracle.com/errata/ELSA-2015-0085.html

29. Security Updates in Debian (DSA-3139-1)
[27/01/2015] Debian has released security update packages for fixing the vulnerability identified in the squid packages for multiple versions of Debian GNU/Linux. An attacker could bypass security restrictions, cause a denial of service condition and crash the system.

URL:www.debian.org/security/2015/dsa-3139

30. Security Updates in Red Hat Enterprise Linux (RHSA-2015:0085-1, RHSA-2015:0086-1)
[27/01/2015] Red Hat has released security update packages for fixing the vulnerabilities identified in the java-1.6.0-openjdk and java-1.6.0-sun packages for Red Hat Enterprise Linux 5, 6 and 7. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:rhn.redhat.com/errata/RHSA-2015-0085.html
URL:rhn.redhat.com/errata/RHSA-2015-0086.html

31. Security Updates in SUSE (openSUSE-SU-2015:0147-1)
[27/01/2015] SUSE has released security update packages for fixing the vulnerabilities identified in the flash-player package of openSUSE Evergreen 11.4. Due to multiple errors, an attacker could bypass security restriction, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system.

URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00025.html

32. Security Updates in Ubuntu GNU/Linux (USN-2476-1, USN-2483-1, USN-2483-2, USN-2484-1)
[27/01/2015] Ubuntu has released security update packages for fixing the vulnerabilities identified in the oxide-qt, jasper, ghostscript and unbound packages for versions 10.04 LTS, 12.04 LTS, 14.04 LTS and 14.10 of Ubuntu GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:www.ubuntu.com/usn/usn-2476-1/
URL:www.ubuntu.com/usn/usn-2483-1/
URL:www.ubuntu.com/usn/usn-2483-2/
URL:www.ubuntu.com/usn/usn-2484-1/

33. Vulnerability in Adobe Flash Player (APSA15-01)
[26/01/2015] Vulnerability was identified in the Adobe Flash Player. An attacker could bypass security restrictions and compromise the system. This vulnerability affects multiple versions of the mentioned product. Security patches are available to resolve this vulnerability.

URL:helpx.adobe.com/security/products/flash-player/apsa15-01.html

34. Vulnerabilities in Google Chrome
[26/01/2015] Vulnerabilities were identified in the Google Chrome. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code and compromise an affected system. These vulnerabilities affect versions prior to 40.0.2214.91 of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:googlechromereleases.blogspot.hk/2015/01/stable-update.html
URL:www.us-cert.gov/ncas/current-activity/2015/01/23/Google-Releases-Security-Updates-Chrome

35. Vulnerabilities in Trend Micro OfficeScan
[26/01/2015] Vulnerabilities were identified in the Trend Micro OfficeScan. An attacker could bypass security restrictions, cause a denial of service condition and crash the system. These vulnerabilities affect versions prior to 10.6 Service Pack 3 Patch 1 Critical Patch 5712 of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:files.trendmicro.com/documentation/readme/OSCE%20docs/osce_106_sp3_patch1_win_en_criticalpatch_5712_R1_Readme.txt
URL:files.trendmicro.com/documentation/guides/osce/OSCE%2010.6%20SP3%20Smart%20Scan%20Enhancement%20Critical%20Patch%205712%20R1%20FAQ.pdf

36. Vulnerability in LabTech (VU#637068)
[26/01/2015] Vulnerability was identified in the LabTech. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code and compromise the system. This vulnerability affects versions prior to 100.237 of the mentioned product. Security patches are available to resolve this vulnerability.

URL:www.kb.cert.org/vuls/id/637068

37. Vulnerabilities in OpenSSL
[26/01/2015] Vulnerabilities were identified in the OpenSSL. An attacker could bypass security restrictions, obtain sensitive information and execute arbitrary code. These vulnerabilities affect versions prior to 1.0.2 of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:www.openssl.org/news/

38. Security Updates in Debian (DSA-3135-1, DSA-3136-1, DSA-3137-1, DSA-3138-1)
[26/01/2015] Debian has released security update packages for fixing the vulnerabilities identified in the mysql-5.5, polarssl, websvn and jasper packages for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system.

URL:www.debian.org/security/2015/dsa-3135
URL:www.debian.org/security/2015/dsa-3136
URL:www.debian.org/security/2015/dsa-3137
URL:www.debian.org/security/2015/dsa-3138

39. Security Updates in Mageia (MGASA-2015-0035, MGASA-2015-0036, MGASA-2015-0037, MGASA-2015-0038)
[26/01/2015] Mageia has released security update packages for fixing the vulnerabilities identified in the aircrack-ng, chromium-browser-stable, java-1.7.0-openjdk and jasper packages for multiple versions of Mageia. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:advisories.mageia.org/MGASA-2015-0035.html
URL:advisories.mageia.org/MGASA-2015-0036.html
URL:advisories.mageia.org/MGASA-2015-0037.html
URL:advisories.mageia.org/MGASA-2015-0038.html

40. Security Updates in SUSE (SUSE-SU-2015:0129-1, openSUSE-SU-2015:0130-1, SUSE-SU-2015:0135-1, SUSE-SU-2015:0136-1, openSUSE-SU-2015:0138-1)
[26/01/2015] SUSE has released security update packages for fixing the vulnerabilities identified in the flash-player and vsftpd packages of SUSE Linux Enterprise 11 and 12, openssl package of openSUSE 13.1 and 13.2, and Firefox 31ESR package of openSUSE Evergreen 11.4. Due to multiple errors, an attacker could bypass security restriction, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00020.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00022.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00023.html
URL:lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html

No comments:

Post a Comment