CVE-2015-4322

Cisco Content Security Management Appliance SMA 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, a...

Authentication flaw

Cisco Content Security Management Appliance SMA 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, a...

CVE-2015-4322

Cisco Content Security Management Appliance SMA 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, a...

CVE-2015-4322

Cisco SMA exposes a privilege-escalation flaw in LDAP auth handling. Affected: SMA 8.3.6-039, 9.1.0-31, 9.1.0-103. An authenticated remote attacker can read/write another user’s Spam Quarantine via the spam-notification URL due to improper authentication privileges. Advisory Cisco-SA-20150814-CVE...

Palo Alto Networks PAN-OS 7.0.0 LDAP Authentication Bypass (PAN-SA-2015-0005)

The remote host is running Palo Alto Networks PAN-OS version 7.0.0. It is, therefore, affected by an unspecified flaw in the LDAP authentication process. A remote attacker can exploit this to bypass authentication checks presented by the captive portal component or the device management interface...

CVE-2015-1816

Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate...

Code injection

Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate...

Cisco Security Mail Appliance Email Spam Quarantine Privilege Escalation Vulnerability

A vulnerability in the email Spam Quarantine, Lightweight Directory Access Protocol LDAP authentication of the Cisco Content Security Management Appliance SMA could allow an authenticated, remote attacker to escalate privileges to those of the Spam Quarantine. The vulnerability is due to improper...

CVE-2015-1816

Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate...

CVE-2015-1816

CVE-2015-1816 affects Foreman/Foreman Proxy (Forman) before 1.7.4, where SSL certificates were not verified for LDAP connections, enabling MITM spoofing of LDAP servers via crafted certificates. Impact: potential credential exposure through LDAP authentication; base score 5.0 (Medium) per NVD. Re...

[SECURITY] Fedora 22 Update: pure-ftpd-1.0.36-7.fc22

Pure-FTPd is a fast, production-quality, standard-comformant FTP server, based upon Troll-FTPd. Unlike other popular FTP servers, it has no known security flaw, it is really trivial to set up and it is especially designed for modern Linux and FreeBSD kernels setfsuid, sendfile, capabilities...

Important: Red Hat Security Advisory: Red Hat Satellite 6.1.1 on RHEL 6

Red Hat Satellite 6.1 now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having an important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each vulnerability from the CVE...

foreman: lack of SSL certificate validation when performing LDAPS authentication

It was found that when making an SSL connection to an LDAP authentication source in Foreman, the remote server certificate was accepted without any verification against known certificate authorities, potentially making TLS connections vulnerable to man-in-the-middle attacks...

Important: Red Hat Security Advisory: Red Hat Satellite 6.1.1 on RHEL 7

Red Hat Satellite 6.1 now available for Red Hat Enterprise Linux 7. Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning...

foreman: lack of SSL certificate validation when performing LDAPS authentication

It was found that when making an SSL connection to an LDAP authentication source in Foreman, the remote server certificate was accepted without any verification against known certificate authorities, potentially making TLS connections vulnerable to man-in-the-middle attacks...

Moderate: Red Hat Bug Fix Advisory: 389-ds-base bug fix update

Updated 389-ds-base packages that fix several bugs are now available for Red Hat Enterprise Linux 7. The 389 Directory Server is an LDAPv3 compliant server. The base packages include the LDAP server and command-line utilities for server administration. This update fixes the following bugs:...

Scientific Linux Security Update : ipa on SL6.x i386/x86_64 (20150722)

Note: The IdM version provided by this update no longer uses jQuery. Bug fixes : - The ipa-server-install, ipa-replica-install, and ipa-client-install utilities are not supported on machines running in FIPS-140 mode. Previously, IdM did not warn users about this. Now, IdM does not allow running t...

OracleVM 3.3 : sudo (OVMSA-2015-0103)

The remote OracleVM system is missing necessary patches to address critical security updates : - RHEL-6.7 erratum - modified the authlogicfix patch to fix 1144448 - fixed a bug in the ldapusermatchfix patch Resolves: rhbz1144448 Resolves: rhbz1142122 - RHEL-6.7 erratum - fixed the...

Oracle Linux 6 : ipa (ELSA-2015-1462)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1462 advisory. - Resolves: 1166241 - CVE-2010-5312 CVE-2012-6662 ipa: various flaws Tenable has extracted the preceding description block directly from the Oracle Lin...

CVE-2015-4288

The LDAP implementation on the Cisco Web Security Appliance WSA 8.5.0-000, Email Security Appliance ESA 8.5.7-042, and Content Security Management Appliance SMA 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain...