VARIoT IoT vulnerabilities database

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. Cosminexus HTTP Server and Hitachi Web Server has a vulnerability (CVE-2016-8743) exists.May have unspecified impact. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. Security Fix(es): * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-2161) * A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys. (CVE-2016-7056) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. (CVE-2016-8740) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304. JIRA issues fixed (https://issues.jboss.org/): JBCS-319 - Errata for httpd 2.4.23 SP1 RHEL 7 7. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201701-36 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Apache: Multiple vulnerabilities Date: January 15, 2017 Bugs: #529130, #589226, #601736, #603130 ID: 201701-36 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Apache, the worst of which could lead to a Denial of Service condition. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-servers/apache < 2.4.25 >= 2.4.25 Description =========== Multiple vulnerabilities have been discovered in Apache. Please review the CVE identifiers, upstream Apache Software Foundation documentation, and HTTPoxy website referenced below for details. Impact ====== A remote attacker could cause a Denial of Service condition via multiple vectors or response splitting and cache pollution. Additionally, an attacker could intercept unsecured (HTTP) transmissions via the HTTPoxy vulnerability. Workaround ========== There is no known workaround at this time. Resolution ========== All Apache users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/apache-2.4.25" References ========== [ 1 ] Apache Software Foundation Projects and "httpoxy" CERT VU #797896 https://www.apache.org/security/asf-httpoxy-response.txt [ 2 ] CVE-2014-3583 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3583 [ 3 ] CVE-2016-0736 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0736 [ 4 ] CVE-2016-2161 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2161 [ 5 ] CVE-2016-5387 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5387 [ 6 ] CVE-2016-8073 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8073 [ 7 ] CVE-2016-8740 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8740 [ 8 ] CVE-2016-8743 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8743 [ 9 ] HTTPoxy Website https://httpoxy.org/ Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201701-36 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/httpd-2.4.25-i586-1_slack14.2.txz: Upgraded. This update fixes the following security issues: * CVE-2016-8740: mod_http2: Mitigate DoS memory exhaustion via endless CONTINUATION frames. * CVE-2016-5387: core: Mitigate [f]cgi "httpoxy" issues. * CVE-2016-2161: mod_auth_digest: Prevent segfaults during client entry allocation when the shared memory space is exhausted. * CVE-2016-8743: Enforce HTTP request grammar corresponding to RFC7230 for request lines and request headers, to prevent response splitting and cache pollution by malicious clients or downstream proxies. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8740 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5387 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2161 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0736 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8743 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.25-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.25-x86_64-1_slack14.0.txz Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/httpd-2.4.25-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/httpd-2.4.25-x86_64-1_slack14.1.txz Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/httpd-2.4.25-i586-1_slack14.2.txz Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/httpd-2.4.25-x86_64-1_slack14.2.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.25-i586-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.25-x86_64-1.txz MD5 signatures: +-------------+ Slackware 14.0 package: 186e15ba143536daa3314076002c7821 httpd-2.4.25-i486-1_slack14.0.txz Slackware x86_64 14.0 package: f9eb3bf2a68a9bc8637a8d53a26ab6dd httpd-2.4.25-x86_64-1_slack14.0.txz Slackware 14.1 package: e416a15941f2c8c0eaebbd63e69164ff httpd-2.4.25-i486-1_slack14.1.txz Slackware x86_64 14.1 package: f1b4ccd7391b58bf9f78648c8c3c86b4 httpd-2.4.25-x86_64-1_slack14.1.txz Slackware 14.2 package: 18e672179bd4136eea419fbcdf1d587b httpd-2.4.25-i586-1_slack14.2.txz Slackware x86_64 14.2 package: 250aa6c0782aefd28539e3c3f2ddde95 httpd-2.4.25-x86_64-1_slack14.2.txz Slackware -current package: 732e51e650d3287f4f415a0536c9c8fe n/httpd-2.4.25-i586-1.txz Slackware x86_64 -current package: ab4f1612c10531fce830aa1f562a9dd5 n/httpd-2.4.25-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg httpd-2.4.25-i586-1_slack14.2.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Wed, 12 Apr 2017 19:41:10 +0000 (UTC) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: httpd security and bug fix update Advisory ID: RHSA-2017:0906-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2017:0906 Issue date: 2017-04-12 CVE Names: CVE-2016-0736 CVE-2016-2161 CVE-2016-8743 ===================================================================== 1. Summary: An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 7) - aarch64, noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Security Fix(es): * It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack. (CVE-2016-0736) * It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication. (CVE-2016-2161) * It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743) Note: The fix for the CVE-2016-8743 issue causes httpd to return "400 Bad Request" error to HTTP clients which do not strictly follow HTTP protocol specification. A newly introduced configuration directive "HttpProtocolOptions Unsafe" can be used to re-enable the old less strict parsing. However, such setting also re-introduces the CVE-2016-8743 issue. Bug Fix(es): * When waking up child processes during a graceful restart, the httpd parent process could attempt to open more connections than necessary if a large number of child processes had been active prior to the restart. Consequently, a graceful restart could take a long time to complete. With this update, httpd has been fixed to limit the number of connections opened during a graceful restart to the number of active children, and the described problem no longer occurs. (BZ#1420002) * Previously, httpd running in a container returned the 500 HTTP status code (Internal Server Error) when a connection to a WebSocket server was closed. As a consequence, the httpd server failed to deliver the correct HTTP status and data to a client. With this update, httpd correctly handles all proxied requests to the WebSocket server, and the described problem no longer occurs. (BZ#1429947) * In a configuration using LDAP authentication with the mod_authnz_ldap module, the name set using the AuthLDAPBindDN directive was not correctly used to bind to the LDAP server for all queries. Consequently, authorization attempts failed. The LDAP modules have been fixed to ensure the configured name is correctly bound for LDAP queries, and authorization using LDAP no longer fails. (BZ#1420047) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto 1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest 1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects 1420002 - Backport fix for issue with graceful restart taking very long time sometimes 1420047 - AuthLDAPBindDN might not be used for some LDAP searches causing LDAP authz failures 1429947 - Backport: mod_proxy_wstunnel - AH02447: err/hup on backconn 6. Package List: Red Hat Enterprise Linux Client Optional (v. 7): Source: httpd-2.4.6-45.el7_3.4.src.rpm noarch: httpd-manual-2.4.6-45.el7_3.4.noarch.rpm x86_64: httpd-2.4.6-45.el7_3.4.x86_64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm httpd-devel-2.4.6-45.el7_3.4.x86_64.rpm httpd-tools-2.4.6-45.el7_3.4.x86_64.rpm mod_ldap-2.4.6-45.el7_3.4.x86_64.rpm mod_proxy_html-2.4.6-45.el7_3.4.x86_64.rpm mod_session-2.4.6-45.el7_3.4.x86_64.rpm mod_ssl-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: httpd-2.4.6-45.el7_3.4.src.rpm noarch: httpd-manual-2.4.6-45.el7_3.4.noarch.rpm x86_64: httpd-2.4.6-45.el7_3.4.x86_64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm httpd-devel-2.4.6-45.el7_3.4.x86_64.rpm httpd-tools-2.4.6-45.el7_3.4.x86_64.rpm mod_ldap-2.4.6-45.el7_3.4.x86_64.rpm mod_proxy_html-2.4.6-45.el7_3.4.x86_64.rpm mod_session-2.4.6-45.el7_3.4.x86_64.rpm mod_ssl-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: httpd-2.4.6-45.el7_3.4.src.rpm aarch64: httpd-2.4.6-45.el7_3.4.aarch64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.aarch64.rpm httpd-devel-2.4.6-45.el7_3.4.aarch64.rpm httpd-tools-2.4.6-45.el7_3.4.aarch64.rpm mod_ssl-2.4.6-45.el7_3.4.aarch64.rpm noarch: httpd-manual-2.4.6-45.el7_3.4.noarch.rpm ppc64: httpd-2.4.6-45.el7_3.4.ppc64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.ppc64.rpm httpd-devel-2.4.6-45.el7_3.4.ppc64.rpm httpd-tools-2.4.6-45.el7_3.4.ppc64.rpm mod_ssl-2.4.6-45.el7_3.4.ppc64.rpm ppc64le: httpd-2.4.6-45.el7_3.4.ppc64le.rpm httpd-debuginfo-2.4.6-45.el7_3.4.ppc64le.rpm httpd-devel-2.4.6-45.el7_3.4.ppc64le.rpm httpd-tools-2.4.6-45.el7_3.4.ppc64le.rpm mod_ssl-2.4.6-45.el7_3.4.ppc64le.rpm s390x: httpd-2.4.6-45.el7_3.4.s390x.rpm httpd-debuginfo-2.4.6-45.el7_3.4.s390x.rpm httpd-devel-2.4.6-45.el7_3.4.s390x.rpm httpd-tools-2.4.6-45.el7_3.4.s390x.rpm mod_ssl-2.4.6-45.el7_3.4.s390x.rpm x86_64: httpd-2.4.6-45.el7_3.4.x86_64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm httpd-devel-2.4.6-45.el7_3.4.x86_64.rpm httpd-tools-2.4.6-45.el7_3.4.x86_64.rpm mod_ssl-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): aarch64: httpd-debuginfo-2.4.6-45.el7_3.4.aarch64.rpm mod_ldap-2.4.6-45.el7_3.4.aarch64.rpm mod_proxy_html-2.4.6-45.el7_3.4.aarch64.rpm mod_session-2.4.6-45.el7_3.4.aarch64.rpm ppc64: httpd-debuginfo-2.4.6-45.el7_3.4.ppc64.rpm mod_ldap-2.4.6-45.el7_3.4.ppc64.rpm mod_proxy_html-2.4.6-45.el7_3.4.ppc64.rpm mod_session-2.4.6-45.el7_3.4.ppc64.rpm ppc64le: httpd-debuginfo-2.4.6-45.el7_3.4.ppc64le.rpm mod_ldap-2.4.6-45.el7_3.4.ppc64le.rpm mod_proxy_html-2.4.6-45.el7_3.4.ppc64le.rpm mod_session-2.4.6-45.el7_3.4.ppc64le.rpm s390x: httpd-debuginfo-2.4.6-45.el7_3.4.s390x.rpm mod_ldap-2.4.6-45.el7_3.4.s390x.rpm mod_proxy_html-2.4.6-45.el7_3.4.s390x.rpm mod_session-2.4.6-45.el7_3.4.s390x.rpm x86_64: httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm mod_ldap-2.4.6-45.el7_3.4.x86_64.rpm mod_proxy_html-2.4.6-45.el7_3.4.x86_64.rpm mod_session-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: httpd-2.4.6-45.el7_3.4.src.rpm noarch: httpd-manual-2.4.6-45.el7_3.4.noarch.rpm x86_64: httpd-2.4.6-45.el7_3.4.x86_64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm httpd-devel-2.4.6-45.el7_3.4.x86_64.rpm httpd-tools-2.4.6-45.el7_3.4.x86_64.rpm mod_ssl-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm mod_ldap-2.4.6-45.el7_3.4.x86_64.rpm mod_proxy_html-2.4.6-45.el7_3.4.x86_64.rpm mod_session-2.4.6-45.el7_3.4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-0736 https://access.redhat.com/security/cve/CVE-2016-2161 https://access.redhat.com/security/cve/CVE-2016-8743 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFY7n2lXlSAg2UNWIIRAn0EAJ95hoSJjNM/kZUXd8Ae6G5J3pXXHACfTIfP pb07muMthgb6w7tJ0kAuc4o= =gSHO -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 6) - i386, noarch, x86_64 3. Bug Fix(es): * Previously, httpd was unable to correctly check a boundary of an array, and in rare cases it attempted to access an element of an array that was out of bounds. Consequently, httpd terminated unexpectedly with a segmentation fault at proxy_util.c. With this update, bounds checking has been fixed, and httpd no longer crashes. (BZ#1463354) 4. 7) - noarch, x86_64 3. The httpd24 Software Collection has been upgraded to version 2.4.25, which provides a number of bug fixes and enhancements over the previous version. For detailed changes, see the Red Hat Software Collections 2.4 Release Notes linked from the References section. (CVE-2016-0736) * A denial of service flaw was found in httpd's mod_http2 module. A remote attacker could use this flaw to block server threads for long times, causing starvation of worker threads, by manipulating the flow control windows on streams. * A vulnerability was found in httpd's handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server's available memory, causing httpd to crash. (CVE-2016-8740) 4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbux03725en_us SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: hpesbux03725en_us Version: 1 HPESBUX03725 rev.1 - HPE HP-UX Web Server Suite running Apache, Multiple Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-03-29 Last Updated: 2017-03-29 Potential Security Impact: Remote: Denial of Service (DoS), Unauthorized Read Access to Data Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP-UX Web Server Suite running Apache on HP-UX 11iv3. - HP-UX Apache-based Web Server B.11.31 - httpd prior to B.2.4.18.02 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2016-0736 0.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P) CVE-2016-2161 0.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-8740 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-8743 0.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities with HP-UX Web Server Suite running Apache. Apache 2.4.18.02 for HP-UX Release B.11.31 (PA and IA): * 32 bit Depot: HP-UX 11.31(HPUXWS24ATW-B503-11-31-64.depot) * 64 bit Depot: HP-UX 11.31(HPUXWS24ATW-B503-11-31-32.depot) **Note:** The depot files can be found here: <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPUXWSATW503> MANUAL ACTIONS: Yes - Update Download and install the software update PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HPE and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=B6834AA> AFFECTED VERSIONS HP-UX B.11.31 IA/PA =================== hpuxws24APACHE.APACHE hpuxws24APACHE.APACHE2 hpuxws24APACHE.AUTH_LDAP hpuxws24APACHE.AUTH_LDAP2 hpuxws24APACHE.MOD_JK hpuxws24APACHE.MOD_JK2 hpuxws24APACHE.MOD_PERL hpuxws24APACHE.MOD_PERL2 hpuxws24APACHE.WEBPROXY hpuxws24APACHE.WEBPROXY2 action: install B.2.4.18.02 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 29 March 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners

The non-existent notification listener vulnerability was introduced in the initial Android 5.0.2 builds for the Samsung Galaxy S6 Edge devices, but the vulnerability can persist on the device even after the device has been upgraded to an Android 5.1.1 or 6.0.1 build. The vulnerable system app gives a non-existent app the ability to read the notifications from the device, which a third-party app can utilize if it uses a package name of com.samsung.android.app.portalservicewidget. This vulnerability allows an unprivileged third-party app to obtain the text of the user's notifications, which tend to contain personal data. AndroidforSamsungGalaxyS6Edge is a Linux-based open source operating system developed by Samsung and the Open Handheld Device Alliance (OHA) in the United States for smartphones released by South Korea's Samsung. An attacker could exploit this vulnerability to obtain sensitive information. Multiple Samsung Galaxy Product are prone to an information-disclosure vulnerability. Information obtained may aid in further attacks

Huawei Imagine 5 is the smartphone of China Huawei. Huawei enjoys an input verification vulnerability in the 5 mobile phone MTK platform. An attacker could convince a user to install a malicious application, and the application could exploit the vulnerability to send specific parameters and tamper with memory information, which in turn would lead to increased user rights.

HollySys, founded in 1993, is a provider of automation and information technology solutions. Hollysys' K-series main controller module K-CU01 has multiple denial of service vulnerabilities. (1) Distort the ulMessageSize field in the UdpComHeader structure and send a malformed packet. (2) Continuously sending data packets to the controller will cause the controller to deny service and cause the controller not to respond to normal requests.

TP-LINKTD-W8151N is a wireless router product of China TP-LINK. TP-LINKTD-W8151N has a denial of service vulnerability that could allow an attacker to cause a denial of service (program crash).

Huawei Imagine 5 is the smartphone of China Huawei. Huawei enjoys an input verification vulnerability in the 5 mobile phone MTK platform. An attacker could convince a user to install a malicious application, and the application could exploit the vulnerability to send specific parameters and tamper with memory information, which in turn would lead to increased user rights.

Huawei Imagine 5 is the smartphone of China Huawei. Huawei enjoys a memory leak vulnerability in the 5 mobile phone MTK platform. An attacker could convince a user to install a malicious application, and the application could exploit the vulnerability to send specific parameters, leaking system memory, and causing user information to leak.

Huawei Imagine 5 is the smartphone of China Huawei. There is an integer overflow vulnerability in Huawei's 5 mobile phone MTK platform. An attacker could convince a user to install a malicious application, and an application could exploit a vulnerability to send specific parameters, resulting in increased user rights.

An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating. WAGO 750-8202 / PFC200 and so on are all bus editable logic controller modules of German WAGO company. An authentication bypass vulnerability exists in several WAGO products. An attacker could use this vulnerability to bypass the authentication mechanism and perform unauthorized operations. This may lead to further attacks. The following products are vulnerable: WAGO 750-8202/PFC200 prior to FW04 WAGO 750-881 prior to FW09 WAGO 0758-0874-0000-0111. WAGO 750-8202/PFC200, etc

Huawei CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00 have a memory leak vulnerability. An unauthenticated attacker may send specific Label Distribution Protocol (LDP) packets to the devices. When the values of some parameters in the packet are abnormal, the LDP processing module does not release the memory to handle the packet, resulting in memory leak. Huawei CloudEngine 12800 Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. HuaweiCloudEngine12800 is the switch device of China Huawei. Multiple Huawei products are prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to cause denial-of-service condition. The following versions are affected: CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, and V100R006C00

An issue was discovered in Fidelix FX-20 series controllers, versions prior to 11.50.19. Arbitrary file reading via path traversal allows an attacker to access arbitrary files and directories on the server. FidelixFX-20seriescontrollers is the FX-20 series building controller from Fidelix, Finland. A directory traversal vulnerability exists in versions prior to FidelixFX-20seriescontrollers 11.50.19 that caused the program to fail to adequately filter user-submitted input. An attacker could exploit this vulnerability to obtain sensitive information. Fidelix FX-20 series controllers are prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input

A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco CloudCenter Orchestrator (CCO) deployments where the Docker Engine TCP port 2375 is open on the system and bound to local address 0.0.0.0 (any interface). Cisco CloudCenter Orchestrator is prone to a privilege-escalation vulnerability. An attacker may exploit this issue to gain root privileges on the affected device; this can also result in the attacker gaining complete control of the affected system. Cisco CloudCenter is a set of hybrid cloud management platform solutions from Cisco. The solution supports application migration, DevOps automation across multiple cloud environments, and dynamic expansion within or between clouds. Orchestrator is an orchestrator component used in it. Docker Engine is one of the container engine extensions. The vulnerability is caused by the incorrect configuration file of the program

A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to the database used by these products. More Information: CSCus99394. Known Affected Releases: 7.3(0)ZN(0.99). An attacker can exploit this issue to gain access to the device and obtain sensitive information that may lead to further attack. This issue is being tracked by Cisco Bug ID CSCus99394. The former is a service for managing host deployments, and the latter is a virtual appliance for deploying and managing cloud providers

A vulnerability in the Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to initiate connections to arbitrary hosts. More Information: CSCvc31635. Known Affected Releases: 10.6(9). Known Fixed Releases: 11.0(0). An attacker can leverage this issue to conduct phishing attacks; other attacks are possible. This issue is being tracked by Cisco bug ID CSCvc31635

NetgearR7000 is a wireless router product from Netgear. A cross-site scripting vulnerability exists in versions 1.0.7.2 through 1.1.93 of NetgearR7000 that caused the program to fail to adequately filter user-submitted input. An attacker could exploit the vulnerability to steal cookie-based authentication or inject malicious scripts.

MPSec-VPN3005S-AC is a security gateway developed by Maipu. The MPSec-VPN3005S-AC model has a weak password vulnerability. The MPSec-VPN3005S-AC model device has a default weak password vulnerability on port 23. An attacker can use the vulnerability to log in to the system and obtain server administrator permissions.

The TP-LINKTD-W8951ND is a wireless router product. A denial of service vulnerability exists in TP-LINKTD-W8951ND. Allows an attacker to exploit a vulnerability to initiate a denial of service attack.

Huawei Imagine 5 is the smartphone of China Huawei. Huawei Imagine 5 mobile Wi-Fi driver has an input verification vulnerability. An attacker could convince a user to install a malicious application that could be exploited by an application to send specific parameters to the phone, resulting in a system reboot or elevated user rights.

Interactive Wiki Open Source System (HDwiki) is a free Wiki website system launched by Interactive Online (Beijing) Technology Co., Ltd. hdwiki pms.php has a SQL injection vulnerability that allows attackers to use this vulnerability to obtain sensitive information about the website database.

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key. The SIEMENS building automation system Desigo PX programmable automation station provides a flexible solution that can issue alarm signals, time-based logging procedures and trends, and can be modified or expanded at any time. Remote attackers can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. This aids in other attacks. This could allow the attacker to gain unauthorized access to the system. PXA40-W0 etc. are the room operation unit modules. The following modules are affected: PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX Automation Controllers, PXC00-ED, PXC50-ED, PXC100-ED, PXC200-ED System Controllers; PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automatic controller, PXC00-U, PXC64-U, PXC128-U system controller