F5 Networks BIG-IP : OpenSSH vulnerability (K14845276)

When SSHD tries to authenticate a non-existing user, it will pick up a fake password structure hard-coded in the SSHD source code. An attacker can measure timing information to determine if a user exists when verifying a password. CVE-2016-6210 C Tenable Network Security, Inc. The descriptive tex...

Ubuntu 16.10 : linux vulnerability (USN-3152-1)

Philip Pettersson discovered a race condition in the afpacket implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service system crash or run arbitrary code with administrative privileges. Note that Tenable Network Security has extracted the...

Slackware 14.1 / 14.2 / current : mozilla-thunderbird (SSA:2016-336-02)

New mozilla-thunderbird packages are available for Slackware 14.1, 14.2, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2016-336-02. The text itself is...

Fedora 25 : 32:bind (2016-76bd94ca9e)

Update to latest upstream version due to CVE-2016-2776 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Default Password '1234' for 'administrator' Account

The account 'administrator' on the remote host has the default password '1234'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "administrator"; password = "1234";...

Default Password 'realtek' for 'root' Account

The account 'root' on the remote host has the default password 'realtek'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "realtek"; include'deprecatednasllevel.inc';...

Default Password 'dreambox' for 'root' Account

The account 'root' on the remote host has the default password 'anko'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "dreambox"; include'deprecatednasllevel.inc';...

Fedora 22 : pypy3 (2016-b046b56518)

Security fixes for CVE-2016-0772 and CVE-2016-5699 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Oracle Linux 7 : openssh (ELSA-2016-0465)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0465 advisory. - CVE-2016-1908: possible fallback from untrusted to trusted X11 forwarding 1298741 Tenable has extracted the preceding description block directly from...

Fedora 22 : kernel-4.3.6-201.fc22 (2016-e7162262b0)

Update to the latest upstream stable release, Linux v4.3.6 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0006) (remote check)

The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components : - Kernel - krb5 telnet daemon %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

openSUSE Security Update : flash-player (openSUSE-2016-183)

This update for flash-player fixes the following issues : - Security update to 11.2.202.569 boo965901 : - APSB16-04, CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0971, CVE-2016-0972, CVE-2016-0973, CVE-2016-0974, CVE-2016-0975,...

F5 Networks BIG-IP : LZO vulnerability (K95698826)

An integer overflow flaw was found in the way the lzo library decompressed certain archives compressed with the LZO algorithm. An attacker could create a specially crafted LZO-compressed input that, when decompressed by an application using the lzo library, would cause that application to crash o...

F5 Networks BIG-IP : OpenSSH vulnerabilities (SOL6736)

The remote BIG-IP device is missing a patch required by a security advisory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL6736. The text description of this plugin is C F5 Networks...

FreeBSD : Adobe Flash Player -- critical vulnerabilities (348bfa69-25a2-11e5-ade1-0011d823eebd) (Underminer)

Adobe reports : Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit targeting CVE-2015-5119 has been publicly publishe...

Slackware 14.0 / 14.1 / current : php (SSA:2015-162-02)

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2015-162-02. The text itself is copyright C...

openSUSE Security Update : qemu (openSUSE-2015-363) (Venom)

qemu was updated to fix a security issue : - CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

MS15-034: Vulnerability in HTTP.sys Could Allow Remote Code Execution (3042553) (uncredentialed check)

The version of Windows running on the remote host is affected by an integer overflow condition in the HTTP protocol stack HTTP.sys due to improper parsing of crafted HTTP requests. An unauthenticated, remote attacker can exploit this to execute arbitrary code with System privileges. C Tenable...

Oracle Linux 5 : samba3x (ELSA-2015-0249)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-0249 advisory. - related: 1191608 - Update patchset for CVE-2015-0240. Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Fedora 20 : nrpe-2.15-2.fc20 (2014-5897)

Add patch to mitigate CVE-2014-2913 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...