Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : php5 vulnerabilities (USN-2126-1)

Bernd Melchers discovered that PHP's embedded libmagic library incorrectly handled indirect offset values. An attacker could use this issue to cause PHP to consume resources or crash, resulting in a denial of service. CVE-2014-1943 It was discovered that PHP incorrectly handled certain values whe...

Fedora 19 : xen-4.2.4-2.fc19 (2014-2862)

32-bit fix for 'Guest triggerable AMD CPU erratum may cause host hang', xen-4.2.4 also fixes XSA-60, CVE-2013-2212 update to xen-4.2.4 use-after-free in xccpupoolgetinfo under memory pressure Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

[Ncrack] High-Speed Network Authentication Cracker

Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed using a...

Barracuda Networks Firewall Bug Bounty #32 - Filter Bypass & Persistent Web Vulnerabilities

Document Title: =============== Barracuda Networks Firewall Bug Bounty 32 - Filter Bypass & Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1069 Barracuda Networks Security ID BNSEC: BNSEC-2069 Release Date: =============...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : freeradius vulnerabilities (USN-2122-1)

It was discovered that FreeRADIUS incorrectly handled unix authentication. A remote user could successfully authenticate with an expired password. CVE-2011-4966 Pierre Carrier discovered that FreeRADIUS incorrectly handled rlmpap hash processing. An authenticated user could use this issue to caus...

Fedora 19 : mingw-gnutls-3.1.21-1.fc19 (2014-2565)

Version 3.1.21 released 2014-02-13 - libgnutls: Tolerate servers that sent the SUPPORTED ECC extension. - libgnutls: Reduced the TLS and DTLS version requirements for all ciphersuites that are not GCM. - libgnutls: When two initial keywords are specified then treat the second as having the '+'...

Apple Fixes Certificate Validation Flaw in iOS

Apple on Friday quietly pushed out a security update to iOS that restores some certificate-validation checks that had apparently been missing from the operating system for an unspecified amount of time. Apple released iOS 7.06 on Friday and the only content in the update was a small security fix...

Apple Releases Security Updates for iOS devices and Apple TV

Apple has released updates for iOS and Apple TV devices to address a vulnerability that allows an attacker with a privileged network position to capture or modify data in protected SSL/TLS sessions. Updates are available: iOS 6.1.6 for iPhone 3GS and iPod touch 4th generation. iOS 7.0.6 for iPhon...

Ubuntu 12.04 LTS / 12.10 / 13.10 : thunderbird vulnerabilities (USN-2119-1)

Christian Holler, Terrence Cole, Jesse Ruderman, Gary Kwong, Eric Rescorla, Jonathan Kew, Dan Gohman, Ryan VanderMeulen and Sotaro Ikeda discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker...

Healthcare IT Security Practices Poor, Systems Compromised

A new report from the SANS Institute warns that the push to digitize all health care records along with the emergence of HealthCare.gov and the general proliferation of electronic protected health information ePHI online will only exacerbate the security problems faced by those that store sensiti...

Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-2112-1)

Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. CVE-2013-2929 Dave Jones and Vince Weaver reported a flaw in the Linux kernel's perf event subsystem that allows...

Unsupported Cisco Operating System

According to its version, the remote Cisco operating system is obsolete and is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. TRUSTED...

Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2108-1)

A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. CVE-2013-6383 mpd reported an information leak in the recvfrom,...

Fedora 20 : kernel-3.13.3-201.fc20 (2014-2576)

The 3.13.3 stable update contains a number of important fixes across the tree. The 3.13.2 rebase contains support for additional hardware, some new features and a number of important bug fixes across the tree. Fixes CVE-2014-0069 cifs: incorrect handling of bogus user pointers Note that Tenable...

Microsoft Windows SMB Registry : Windows 8.1 / Server 2012 R2 Service Pack Detection

It was possible to determine the service pack version of the Windows 8.1 / Server 2012 R2 system by reading the registry key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion'. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid72543; scriptversion"1.5";...

Fedora 20 : python-2.7.5-10.fc20 (2014-2394)

Buffer overflow fix. See upstream issue: http://bugs.python.org/issue20246 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducin...

CSWorks Software SQL Injection Vulnerability

OVERVIEW Researcher John Leitch, working with HP’s Zero Day Initiative ZDI, has identified an SQL injection vulnerability in CSWorks’ CSWorks software framework. CSWorks has produced an updated version that mitigates this vulnerability. This vulnerability could be exploited remotely. AFFECTED...

Phony SSL Certs Spoof Google, Facebook, GoDaddy, others

Dozens of phony SSL certificates were discovered this week mocking legitimate certs from banks, e-commerce sites, ISPs and social networks. If a user stumbled over one of the bogus certificates on a mobile device it could put them at risk for a man-in-the-middle attack. Disguised as official...

400 Gbps NTP Amplification DDoS Attack Alarmingly Simple

The largest distributed denial of service attack on public record was reported this week, and with it came many alarming numbers, not only in the volume of traffic generated 400 Gbps at its peak, but in the number of Network Time Protocol servers involved 4,592 on 1,298 networks as well as the...

Fedora 19 : firefox-27.0-1.fc19 / xulrunner-27.0-1.fc19 (2014-2051)

See following page for changes: http://www.mozilla.org/en-US/firefox/27.0/releasenotes/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible witho...