Sunday, December 6, 2015

IT Security Alerts Weekly Digest (29 Nov ~ 5 Dec 2015)

1. Vulnerabilities in F5 Products (SOL05770600, SOL51841514, SOL90230486)
[04/12/2015] Vulnerabilities were identified in the F5 BIG-IP LTM, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator, BIG-IP WOM, Enterprise Manager, BIG-IQ Cloud, BIG-IQ Device, BIG-IQ Security, BIG-IQ ADC and Traffix SDC. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:support.f5.com/kb/en-us/solutions/public/k/05/sol05770600.html
URL:support.f5.com/kb/en-us/solutions/public/k/51/sol51841514.html
URL:support.f5.com/kb/en-us/solutions/public/k/90/sol90230486.html

2. Vulnerabilities in Huawei Wimax routers (HW-464086)
[04/12/2015] Vulnerabilities were identified in the Huawei Wimax routers. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products.

URL:www.huawei.com/en/security/psirt/security-bulletins/security-notices/archive/hw-464086.htm
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108438
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108440
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108441

3. Vulnerabilities in Honeywell Midas gas detector (ICSA-15-309-02)
[04/12/2015] Vulnerabilities were identified in the Honeywell Midas gas detector. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:ics-cert.us-cert.gov/advisories/ICSA-15-309-02

4. Vulnerabilities in SearchBlox (ICSA-15-337-01)
[04/12/2015] Vulnerabilities were identified in the SearchBlox. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect versions prior to 8.3.1 of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:ics-cert.us-cert.gov/advisories/ICSA-15-337-01

5. Vulnerabilities in OpenSSL
[04/12/2015] Vulnerabilities were identified in the OpenSSL. An attacker could bypass security restrictions, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:www.openssl.org/news/secadv/20151203.txt
URL:www.us-cert.gov/ncas/current-activity/2015/12/03/OpenSSL-Patches-Multiple-Vulnerabilities
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108502
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108503
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108504
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108505

6. Vulnerabilities in Drupal (DRUPAL-SA-CONTRIB-2015-167, DRUPAL-SA-CONTRIB-2015-168, DRUPAL-SA-CONTRIB-2015-169, DRUPAL-SA-CONTRIB-2015-171)
[04/12/2015] Vulnerabilities were identified in the RESTful, Mollom, Chat Room and Token Insert Entity modules for Drupal. An attacker could bypass security restrictions and obtain sensitive information. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:www.drupal.org/node/2627444
URL:www.drupal.org/node/2627448
URL:www.drupal.org/node/2627478
URL:www.drupal.org/node/2627638
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108491
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108492
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108493
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108494
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108495

7. Security Updates in Debian (DSA-3411-1)
[04/12/2015] Debian has released security update packages for fixing the vulnerability identified in the cups-filters packages for multiple versions of Debian GNU/Linux. An attacker could bypass security restrictions and execute arbitrary code on the system.

URL:www.debian.org/security/2015/dsa-3411

8. Security Updates in Red Hat Enterprise Linux (RHSA-2015:2545-1)
[04/12/2015] Red Hat has released security update packages for fixing the vulnerabilities identified in the chromium-browser packages for Red Hat Enterprise Linux 6. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:rhn.redhat.com/errata/RHSA-2015-2545.html

9. Security Updates in Slackware (SSA:2015-337-01, SSA:2015-337-02)
[04/12/2015] Slackware has released security update packages for fixing the vulnerabilities identified in the libpng and mozilla-thunderbird packages for multiple versions of Slackware Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.522940
URL:www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.359041

10. Security Updates in Ubuntu GNU/Linux (USN-2826-1, USN-2827-1, USN-2828-1)
[04/12/2015] Ubuntu has released security update packages for fixing the vulnerabilities identified in the linux-lts-trusty, openjdk-6, qemu and qemu-kvm packages for versions 12.04 LTS, 14.04 LTS, 15.04 and Ubuntu 15.10. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:www.ubuntu.com/usn/usn-2826-1/
URL:www.ubuntu.com/usn/usn-2827-1/
URL:www.ubuntu.com/usn/usn-2828-1/

11. Vulnerabilities in Cisco Products (cisco-sa-20151202-pca, cisco-sa-20151202-sip)
[03/12/2015] Vulnerabilities were identified in the Cisco Unity Connection and Cisco Unified SIP Phone 3905. An attacker could bypass security restrictions, execute arbitrary code, perform cross-site Scripting, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-pca
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151202-sip
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108447
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108449

12. Vulnerabilities in Huawei LogCenter (Huawei-SA-20151202-01-LogCenter, Huawei-SA-20151202-02-LogCenter)
[03/12/2015] Vulnerabilities were identified in the Huawei LogCenter. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect versions prior to V100R001C10SPC300B018 of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:www.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-464243.htm
URL:www.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-464247.htm

13. Vulnerabilities in ABRT (108426, 108437)
[03/12/2015] Vulnerabilities were identified in the ABRT. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. These vulnerabilities affect version 2.0.6 of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:exchange.xforce.ibmcloud.com/vulnerabilities/108426
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108437

14. Security Updates in Debian (DSA-3409-1, DSA-3410-1)
[03/12/2015] Debian has released security update packages for fixing the vulnerabilities identified in the putty and icedove packages for multiple versions of Debian GNU/Linux. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:www.debian.org/security/2015/dsa-3409
URL:www.debian.org/security/2015/dsa-3410

15. Security Updates in Red Hat Enterprise Linux (RHSA-2015:2538-1, RHSA-2015:2539-1, RHSA-2015:2542-1)
[03/12/2015] Red Hat has released security update packages for fixing the vulnerabilities identified in the Red Hat JBoss Enterprise Application Platform packages for Red Hat Enterprise Linux 5 and 6. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:rhn.redhat.com/errata/RHSA-2015-2538.html
URL:rhn.redhat.com/errata/RHSA-2015-2539.html
URL:rhn.redhat.com/errata/RHSA-2015-2542.html

16. Security Updates in SUSE (SUSE-SU-2015:2166-1, SUSE-SU-2015:2168-1, SUSE-SU-2015:2174-1)
[03/12/2015] SUSE has released security update packages for fixing the vulnerabilities identified in the java-1_6_0-ibm, java-1_7_1-ibm and dhcpcd packages of SUSE Linux Enterprise 11 and 12. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html
URL:lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.html
URL:lists.opensuse.org/opensuse-security-announce/2015-12/msg00002.html

17. Vulnerabilities in IBM Notes and Domino (1971361)
[02/12/2015] Vulnerabilities were identified in the IBM Notes and Domino. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:www.ibm.com/support/docview.wss?uid=swg21971361

18. Vulnerabilities in Cisco Products (cisco-sa-20151201-ucs, cisco-sa-20151201-ucs1, cisco-sa-20151201-wmc)
[02/12/2015] Vulnerabilities were identified in the Cisco Unified Computing System (UCS) Central Software and Cisco WebEx Meetings for Android. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, perform cross-site Scripting and server-side request forgery (SSRF) attacks . These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-ucs
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-ucs1
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151201-wmc
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108401

19. Vulnerabilities in Belkin N150 Wireless Home Router (108388, 108389, 108390, 108391)
[02/12/2015] Vulnerabilities were identified in the Belkin N150 Wireless Home Router. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. The affected version was not specified.

URL:exchange.xforce.ibmcloud.com/vulnerabilities/108388
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108389
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108390
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108391

20. Vulnerability in Saia Burgess Controls PCD Controller (ICSA-15-335-01)
[02/12/2015] Vulnerability was identified in multiple Saia Burgess Controls PCD Controllers. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code and compromise the system. This vulnerability affects multiple firmware versions of the mentioned products. Security patches are available to resolve this vulnerability.

URL:ics-cert.us-cert.gov/advisories/ICSA-15-335-01

21. Vulnerability in Siemens SIMATIC Communication Processor devices (ICSA-15-335-03)
[02/12/2015] Vulnerability was identified in multiple Siemens SIMATIC Communication Processor devices. An attacker could bypass security restrictions, gain elevated privileges, execute arbitrary code and compromise the system. This vulnerability affects multiple firmware versions of the mentioned products. Security patches are available to resolve this vulnerability.

URL:ics-cert.us-cert.gov/advisories/ICSA-15-335-03

22. Vulnerabilities in Google Chrome
[02/12/2015] Vulnerabilities were identified in the Google Chrome. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect versions prior to 47.0.2526.73 of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:googlechromereleases.blogspot.hk/2015/12/stable-channel-update.html
URL:www.us-cert.gov/ncas/current-activity/2015/12/01/Google-Releases-Security-Update-Chrome
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108403
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108404

23. Security Updates in Debian (DSA-3408-1)
[02/12/2015] Debian has released security update packages for fixing the vulnerability identified in the gnutls26 packages for multiple versions of Debian GNU/Linux. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system.

URL:www.debian.org/security/2015/dsa-3408

24. Security Updates in Ubuntu GNU/Linux (USN-2819-1, USN-2823-1, USN-2824-1)
[02/12/2015] Ubuntu has released security update packages for fixing the vulnerabilities identified in the thunderbird, linux and linux-lts-utopic packages for versions 12.04 LTS, 14.04 LTS, 15.04 and Ubuntu 15.10. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:www.ubuntu.com/usn/usn-2819-1/
URL:www.ubuntu.com/usn/usn-2823-1/
URL:www.ubuntu.com/usn/usn-2824-1/

25. Security Update in Microsoft Products (3119884)
[01/12/2015] Microsoft has released security updates for all support releases of Microsoft Windows to remove the trust of the unconstrained digital certificates from Dell. An attacker could make use of these certificates to spoof content, perform phishing attacks and perform man-in-the-middle attacks against Dell customers.

URL:technet.microsoft.com/library/security/3119884.aspx

26. Vulnerabilities in Cisco Products (cisco-sa-20151130-asa, cisco-sa-20151130-csr, isco-sa-20151130-wsa)
[01/12/2015] Vulnerabilities were identified in the Cisco Aggregation Services Routers (ASR) 1000 Series, Cisco Cloud Services Router 1000V Series and Cisco Web Security Appliance (WSA). An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system. These vulnerabilities affect multiple versions of the mentioned products. Security patches are available to resolve these vulnerabilities.

URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-asa
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-csr
URL:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-wsa

27. Vulnerabilities in Node.js (108360, 108361)
[01/12/2015] Vulnerabilities were identified in the Node.js. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:exchange.xforce.ibmcloud.com/vulnerabilities/108360
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108361

28. Vulnerabilities in Qemu (108331, 108362)
[01/12/2015] Vulnerabilities were identified in the Qemu. An attacker could bypass security restrictions, execute arbitrary code, cause a denial of service condition and crash the system. These vulnerabilities affect multiple versions of the mentioned product. Security patches are available to resolve these vulnerabilities.

URL:exchange.xforce.ibmcloud.com/vulnerabilities/108331
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108362

29. Vulnerability in Xen (XSA-162)
[01/12/2015] Vulnerability was identified in the Xen. An attacker could bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial of service condition and crash the system. This vulnerability affects multiple versions of the mentioned product. Security patches are available to resolve this vulnerability.

URL:xenbits.xen.org/xsa/advisory-162.html
URL:exchange.xforce.ibmcloud.com/vulnerabilities/108358

30. Security Updates in Oracle Linux (ELSA-2015-2521, ELSA-2015-2522)
[01/12/2015] Oracle has released security update packages for fixing the vulnerability identified in the jakarta-commons-collections and apache-commons-collections packages for Oracle Linux 6 and 7. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges and execute arbitrary code on the system.

URL:linux.oracle.com/errata/ELSA-2015-2521.html
URL:linux.oracle.com/errata/ELSA-2015-2522.html

31. Security Updates in Red Hat Enterprise Linux (RHSA-2015:2521-1, RHSA-2015:2522-1, RHSA-2015:2523-1)
[01/12/2015] Red Hat has released security update packages for fixing the vulnerability identified in the jakarta-commons-collections, apache-commons-collections and rh-java-common-apache-commons-collections packages for Red Hat Enterprise Linux 6 and 7, and Red Hat Software Collections 2. An attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges and execute arbitrary code on the system.

URL:rhn.redhat.com/errata/RHSA-2015-2521.html
URL:rhn.redhat.com/errata/RHSA-2015-2522.html
URL:rhn.redhat.com/errata/RHSA-2015-2523.html

32. Security Updates in Ubuntu GNU/Linux (USN-2821-1)
[01/12/2015] Ubuntu has released security update packages for fixing the vulnerability identified in the gnutls26 packages for versions 12.04 LTS and 14.04 LTS. An attacker could bypass security restrictions, execute arbitrary code and perform a padding oracle attack.

URL:www.ubuntu.com/usn/usn-2821-1/

33. Security Updates in Oracle Linux (ELSA-2015-2519, ELSA-2015-3101)
[30/11/2015] Oracle has released security update packages for fixing the vulnerabilities identified in the thunderbird and kernel packages for Oracle Linux 5, 6 and 7. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and crash the system.

URL:linux.oracle.com/errata/ELSA-2015-2519.html
URL:linux.oracle.com/errata/ELSA-2015-3101.html

34. Security Updates in Mageia (MGASA-2015-0460, MGASA-2015-0461, MGASA-2015-0462)
[30/11/2015] Mageia has released security update packages for fixing the vulnerabilities identified in the python-cryptography, python-cryptography-vectors, python-pyasn1, python-idna, python-ipaddress, python-cffi, lightdm, thunderbird and thunderbird-l10n packages for multiple versions of Mageia. Due to multiple errors, an attacker could bypass security restrictions, obtain sensitive information, gain elevated privileges, execute arbitrary code, cause a denial of service condition and compromise the system.

URL:advisories.mageia.org/MGASA-2015-0460.html
URL:advisories.mageia.org/MGASA-2015-0461.html
URL:advisories.mageia.org/MGASA-2015-0462.html

Malware Alert
1. Dorkbot
[04/12/2015] Dorkbot is a botnet used to steal sensitive information, launch distributed denial-of-service (DDoS) attacks and drop other types of malware on the compromised computers. It propagates through infected USB flash drives and malicious links sent via instant messaging programs and social networks.

A system infected with Dorkbot may be used to send spam, participate in DDoS attacks and harvest users' credentials for online services including banking services.

This malware runs on Microsoft Windows 95, 98, Me, NT, 2000, XP, Vista, 7, Windows Server 2003 and Windows Server 2008. Malware signatures and removal procedures are available from most anti-virus vendors. For more information about this malware, please refer to the following link:

URL:www.us-cert.gov/ncas/alerts/TA15-337A
URL:www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot
URL:www.symantec.com/security_response/writeup.jsp?docid=2011-040711-0927-99
URL:www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_dorkbot

No comments:

Post a Comment