kernel security, bug fix, and enhancement update

2.6.32-573.22.1 - mm always decrement anonvma degree when the vma list is empty Jerome Marchand 1318364 1309898 2.6.32-573.21.1 - fs pipe: fix offset and len mismatch on pipeiovcopytouser failure Seth Jennings 1310148 1302223 CVE-2016-0774 - fs gfs2: Add missing else in transaddmeta/data Robert S...

The vulnerability of the Moodle learning management system allows a hacker to escalate their privileges.

The vulnerability of the enrolmetasync function in the Moodle learning management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain more privileges by manipulating role assignments during long-running synchronization scripts...

[SECURITY] Fedora 22 Update: ntp-4.2.6p5-36.fc22

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl...

CVE-2016-2509

The password-sync feature on Belden Hirschmann Classic Platform switches L2B before 05.3.07 and L2E, L2P, L3E, and L3P before 09.0.06 sets an SNMP community to the same string as the administrator password, which allows remote attackers to obtain sensitive information by sniffing the network...

RHEL 6 / 7 : Satellite 6.1.7 (RHSA-2016:0174)

Updated Satellite 6.1 packages that fix one security issue, add one enhancement, and fix several bugs are available for Satellite 6.1.7. Red Hat Product Security has rated this update as having Moderate Security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Moderate: Red Hat Security Advisory: Satellite 6.1.7 security, bug and enhancement fix update

Updated Satellite 6.1 packages that fix one security issue, add one enhancement, and fix several bugs are available for Satellite 6.1.7. Red Hat Product Security has rated this update as having Moderate Security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

MGASA-2016-0039 Updated ntp packages fix security vulnerability

In ntpd before 4.2.8p6, when used with symmetric key encryption, the client would accept packets encrypted with keys for any configured server, allowing a server to impersonate other servers to clients, thus performing a man-in-the-middle attack. A server can be attacked by a client in a similar...

Scientific Linux Security Update : ntp on SL6.x, SL7.x i386/x86_64 (20160125)

It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or push arbitrary offset/delay measurements...

CentOS 6 / 7 : ntp (CESA-2016:0063)

Updated ntp packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

ntp, ntpdate, sntp security update

CentOS Errata and Security Advisory CESA-2016:0063 Updated ntp packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score,...

Important: Red Hat Security Advisory: ntp security update

Updated ntp packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

ntp: missing check for zero originate timestamp

It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or push arbitrary offset/delay measurements...

[SECURITY] Fedora 22 Update: rsync-3.1.1-7.fc22

Rsync uses a reliable algorithm to bring remote and host files into sync very quickly. Rsync is fast because it just sends the differences in the files over the network instead of sending the complete files. Rsync is often used as a very powerful mirroring process or just as a more capable...

The vulnerabilities of the BIG-IP Access Policy Manager, a device for access control and remote authentication; the BIG-IP Analytics, devices for analyzing infrastructure status; the BIG-IP Policy Enforcement Manager, a system for controlling and managing network traffic; the BIG-IP DNS, a DNS server; the BIG-IP Application Security Manager, devices for application protection; the BIG-IP Local Traffic Manager, systems for balancing local traffic; the BIG-IP Application Acceleration Manager, devices for accelerating applications; the BIG-IP Link Controller, a system for balancing internet traffic; the BIG-IP Advanced Firewall Manager, a network gateway that allows unauthorized users to gain authorized access to the Always-On Management subsystem.

The vulnerabilities of the BIG-IP Access Policy Manager, a tool for access control and remote authentication; the BIG-IP Analytics, a tool for analyzing infrastructure status; the BIG-IP Policy Enforcement Manager, a system for controlling and managing network traffic; the BIG-IP DNS, a DNS serve...

Network Time Protocol Deja Vu: Broadcast Mode Replay Vulnerability

Summary Expected Behavior: RFC 5905 page 29 Section 8 states that the on-wire protocol resists replay of server response packet in broadcast mode. Also on page 55 section 15, the RFC claims security in authenticated mode against on-path attackers where an attacker can: a Intercept and archive...

Security Bypass Vulnerability in Multiple F5 BIG-IP Products

F5 BIG-IP is an equipment product manufactured by F5 Network for application delivery services, mainly used for load balancing, service acceleration optimization and other purposes. Several F5 BIG-IP products failed to properly synchronize passwords with the Always-On Management AOM subsystem,...

CVE-2015-8611

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management AOM subsystem, which might allow remote attackers to obtain login access to AOM via an 1 expir...

[SECURITY] Fedora 23 Update: rsync-3.1.1-8.fc23

Rsync uses a reliable algorithm to bring remote and host files into sync very quickly. Rsync is fast because it just sends the differences in the files over the network instead of sending the complete files. Rsync is often used as a very powerful mirroring process or just as a more capable...

SOL05272632 - BIG-IP AOM password sync vulnerability CVE-2015-8611

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

[SECURITY] Fedora 23 Update: conntrack-tools-1.4.2-9.fc23

With conntrack-tools you can setup a High Availability cluster and synchronize conntrack state between multiple firewalls. The conntrack-tools package contains two programs: - conntrack: the command line interface to interact with the connection tracking system. - conntrackd: the connection...