SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1253-1)

This update for the Linux Kernel 4.4.74-9229 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. - CVE-2017-0861:...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1220-1)

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. bsc1087088 - CVE-2018-8897: ...

RHEL 7 : qemu-kvm-rhev (RHSA-2018:1369)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1369 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provi...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1272-1)

This update for the Linux Kernel 4.4.74-9232 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. - CVE-2017-0861:...

Fedora 27 : kubernetes (2018-16c8fdf9b8)

Update to 1.10.1 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Fedora 27 : drupal8 (2018-1ba93b3144) (Drupalgeddon 2)

https://www.drupal.org/project/drupal/releases/8.4.8 - https://www.drupal.org/SA-CORE-2018-004 - https://www.drupal.org/project/drupal/releases/8.4.7 - https://www.drupal.org/sa-core-2018-003 RPM update: drupal8-rpmbuild package dependencies fixed Note that Tenable Network Security has extracted...

Ubuntu 18.04 LTS : DPDK vulnerability (USN-3642-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3642-1 advisory. Maxime Coquelin discovered that DPDK incorrectly handled guest physical ranges. A malicious guest could use this issue to possibly access sensitive information...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Wget vulnerability (USN-3643-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3643-1 advisory. It was discovered that Wget incorrectly handled certain inputs. An attacker could possibly use this to inject arbitrary cookie values...

EulerOS 2.0 SP1 : kernel (EulerOS-SA-2018-1119)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual SDM was mishandled in the...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-3641-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3641-1 advisory. Nick Peterson discovered that the Linux kernel did not properly handle debug exceptions following a MOV/POP to SS instruction. A local attack...

Ubuntu 16.04 LTS / 18.04 LTS : LibRaw vulnerabilities (USN-3639-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3639-1 advisory. It was discovered that LibRaw incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. CVE-2018-1052...

Potential RCE in Nessus 7 and attacks on Vulnerability Scanners

A few days ago I saw an interesting youtube video UPD. 14.05.18 Not available anymore in my Facebook feed. It is demonstrating the exploitation of the RCE vulnerability in Tenable Nessus Professional 7.0.3. Currently we have very few information about this vulnerability: only youtube video, which...

[R1] OpenSSL Stand-alone Patch Available for SecurityCenter versions 5.0 or Later

SecurityCenter leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted to...

Debian DLA-1372-1 : libdatetime-timezone-perl new upstream release

This update includes the changes in tzdata 2018e for the Perl bindings. For the list of changes, see DLA-1371-1. For Debian 7 'Wheezy', these problems have been fixed in version 1:1.58-1+2018e. We recommend that you upgrade your libdatetime-time zone-perl packages. NOTE: Tenable Network Security...

Oracle WebLogic T3 Protocol Detection

The remote host is running the WebLogic t3 Protocol. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109552; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"Oracle WebLogic T3 Protocol Detection";...

Oracle WebLogic HTTP Detection

Oracle formerly BEA WebLogic, a Java EE application server, is running on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109553; scriptversion"1.4"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"Oracle WebLogic HTTP Detection";...

Schneider Electric Patches Critical RCE Vulnerability

Researchers discovered a critical remote code execution vulnerability in two Schneider Electric industrial control related products that could give attackers the ability to disrupt or shut down plant operations. Tenable Research, who discovered the vulnerability CVE-2018-8840 and created a...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition - Denial of Service

What do you need to know? Tenable Research has discovered a critical remote code execution vulnerability in Schneider Electric’s InduSoft Web Studio and InTouch Machine Edition. What's the attack vector? The vulnerability can be remotely exploited without authentication to execute arbitrary...

EulerOS 2.0 SP2 : dhcp (EulerOS-SA-2018-1073)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use...

EulerOS 2.0 SP1 : kernel (EulerOS-SA-2018-1085)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the Linux kernel's client-side implementation of the cifs protocol. This flaw allows an attacker controlling the server to...