VARIoT IoT vulnerabilities database

The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an improper resource release vulnerability, which allows attackers to cause a system restart or privilege elevation. Huawei P9, P9Lite, and P8Lite are Huawei smartphones. Some of Huawei's mobile phone TrustZone drivers have privilege escalation vulnerabilities. An attacker could convince a user to install a malicious application that could be exploited by an application to send specific parameters to the TrustZone driver, resulting in a system reboot or elevated user rights. Multiple Huawei Products are prone to the following multiple security vulnerabilities. 1. A denial-of-service vulnerability. 2. 3. A security bypass vulnerability. Attackers can exploit these issues to perform certain unauthorized actions or gain elevated privileges. Failed exploit attempts will likely cause denial-of-service conditions

The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an input validation vulnerability, which allows attackers to read and write user-mode memory data anywhere in the TrustZone driver. Huawei P9, P9Lite, and P8Lite are Huawei smartphones. Some of Huawei's mobile secure storage trusted applications (SecureStorageTrustedApp) have security bypass vulnerabilities. An attacker who has obtained root access to the Android system can exploit the vulnerability to read and write user-state memory data at any location in TrustZone. Multiple Huawei Products are prone to the following multiple security vulnerabilities. 1. A denial-of-service vulnerability. 2. A privilege escalation vulnerability. 3. Attackers can exploit these issues to perform certain unauthorized actions or gain elevated privileges. Failed exploit attempts will likely cause denial-of-service conditions

The HIFI driver in Huawei Mate 8 phones with software versions before NXT-AL10C00B386, versions before NXT-CL00C92B386, versions before NXT-DL00C17B386, versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368, Versions before CRR-CL20C92B368, Versions before CRR-TL00C01B368, Versions before CRR-UL00C00B368, Versions before CRR-UL20C00B368; P8 phones with software Versions before GRA-TL00C01B366, Versions before GRA-CL00C92B366, Versions before GRA-CL10C92B366, Versions before GRA-UL00C00B366, Versions before GRA-UL10C00B366; and P9 phones with software Versions before EVA-AL10C00B190, Versions before EVA-DL10C00B190, Versions before EVA-TL10C00B190, Versions before EVA-CL10C00B190 allows attackers to get root privilege or crash the system or execute arbitrary code, related to a buffer overflow. plural Huawei Smartphone software HIFI The driver has a deficiency in processing related to buffer overflow. root There are vulnerabilities that can be used to gain privileges, crash the system, or execute arbitrary code.By the attacker, root It may be possible to gain privileges, crash the system, or execute arbitrary code. HuaweiMate8, MateS, P8, and P9 are Huawei smartphones. Because some HIFI drivers of Huawei mobile phones lack parameter checking, the attacker uses the vulnerability to construct specific parameters to the HIFI driver after obtaining root privileges, resulting in system restart or arbitrary code execution. Multiple Huawei Products are prone to a local buffer-overflow vulnerability because they fail to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will likely result in denial-of-service conditions. The Huawei Mate 8 and others are smartphones from the Chinese company Huawei

The mDNIe system service on Samsung Mobile S7 devices with M(6.0) software does not properly restrict setmDNIeScreenCurtain API calls, enabling attackers to control a device's screen. This can be exploited via a crafted application to eavesdrop after phone shutdown or record a conversation. The Samsung ID is SVE-2016-6343. SamsungMobile is a series of smart mobile devices released by South Korea's Samsung. Multiple Samsung Galaxy products are prone to a security-bypass vulnerability. An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Samsung Galaxy devices with Marshmallow 6.0 are vulnerable

TP-LINKTDDP is a device debugging protocol. A buffer overflow vulnerability exists in TP-LINKTDDP. The attacker exploits the vulnerability by sending a \"setconfiguration\" message containing the v1 package to the TDDP service by hand to execute arbitrary code.

TP-LINKTDDP is a device debugging protocol. TP-LINKTDDP has an information disclosure vulnerability. An attacker can exploit the vulnerability to obtain a web interface configuration file, including web login credentials.

Huawei CloudEngine 12800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 5800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 6800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 7800 with software V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 8800 with software V100R006C00; and Secospace USG6600 with software V500R001C00 allow remote unauthenticated attackers to craft specific IPFPM packets to trigger an integer overflow and cause the device to reset. HuaweiCloudEngine12800, CloudEngine5800, CloudEngine6800, CloudEngine7800, and CloudEngine8800 are Huawei switch devices. An integer overflow vulnerability exists in some Huawei switches. Multiple Huawei CloudEngine Products are prone to an integer-overflow vulnerability. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed. Huawei CloudEngine 5800 and others are data center switches of China's Huawei (Huawei). The vulnerability is caused by the fact that the programs do not check specific fields in IPFPM packets. The following products and versions are affected: versions earlier than Huawei CloudEngine 12800 V200R001C00, versions earlier than CloudEngine 5800 V200R001C00, versions earlier than CloudEngine 6800 V200R001C00, versions earlier than CloudEngine 7800 V200R001C00, versions earlier than CloudEngine 8800 V200R001C

Touch Panel (TP) driver in Huawei NEM phones with software Versions before NEM-AL10C00B130, Versions before NEM-UL10C17B160, Versions before NEM-UL10C00B160, Versions before NEM-TL00C01B160 allows attackers to get root privilege or crash the system or execute arbitrary code, related to a buffer overflow. Huawei Play 5C is Huawei's smartphone. There is a buffer overflow vulnerability in Huawei's 5C mobile phone TP touch screen driver. Huawei NEM is prone to a local buffer-overflow vulnerability. Local attackers can exploit this issue to run arbitrary code, elevate root privilege or crash the system causing a denial of service condition. The following versions are vulnerable: Huawei NEM versions prior to AL10C00B130 are affected. Huawei NEM versions prior to UL10C17B160 are affected. Huawei NEM versions prior to UL10C00B160 are affected. Huawei NEM versions prior to TL00C01B160 are affected. Huawei NEM versions prior to TL00HC00B160 are affected. Huawei NEM is a smartphone product of China's Huawei (Huawei)

The maintenance module in Huawei FusionStorage V100R003C30U1 allows attackers to create documents according to special rules to obtain the OS root privilege of FusionStorage. Huawei FusionStorage is prone to a local privilege-escalation vulnerability. Local attackers may exploit this issue to gain elevated privileges. Huawei FusionStorage is a set of distributed block storage software specially designed for the storage infrastructure of cloud computing data centers by Huawei in China. There is a privilege escalation vulnerability in Huawei FusionStorage

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible. The Apache Software Foundation From Apache Tomcat Updates for the following multiple vulnerabilities have been released: * * HTTP Response falsification (CVE-2016-6816) * * Service operation interruption (DoS) (CVE-2016-6817) * * Arbitrary code execution (CVE-2016-8735)Expected impact varies depending on each vulnerability, but information leakage, service operation interruption (DoS) May be affected by arbitrary code execution. Apache Tomcat is prone to a denial-of-service vulnerability. Attackers may leverage this issue to cause denial-of-service conditions. The following versions are affected: Apache Tomcat 9.0.0.M1 through 9.0.0.M11 Apache Tomcat 8.5.0 through 8.5.6

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. The Apache Software Foundation From Apache Tomcat Updates for the following multiple vulnerabilities have been released: * * HTTP Response falsification (CVE-2016-6816) * * Service operation interruption (DoS) (CVE-2016-6817) * * Arbitrary code execution (CVE-2016-8735)Expected impact varies depending on each vulnerability, but information leakage, service operation interruption (DoS) May be affected by arbitrary code execution. (CVE-2016-6816) * An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired. (CVE-2016-8627) * It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Optional (v. 6) - noarch Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Enterprise Linux Workstation Optional (v. 6) - noarch 3. Description: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded. (CVE-2016-8745) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Package List: Red Hat Enterprise Linux Desktop Optional (v. 6): Source: tomcat6-6.0.24-105.el6_8.src.rpm noarch: tomcat6-6.0.24-105.el6_8.noarch.rpm tomcat6-admin-webapps-6.0.24-105.el6_8.noarch.rpm tomcat6-docs-webapp-6.0.24-105.el6_8.noarch.rpm tomcat6-el-2.1-api-6.0.24-105.el6_8.noarch.rpm tomcat6-javadoc-6.0.24-105.el6_8.noarch.rpm tomcat6-jsp-2.1-api-6.0.24-105.el6_8.noarch.rpm tomcat6-lib-6.0.24-105.el6_8.noarch.rpm tomcat6-servlet-2.5-api-6.0.24-105.el6_8.noarch.rpm tomcat6-webapps-6.0.24-105.el6_8.noarch.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: tomcat6-6.0.24-105.el6_8.src.rpm noarch: tomcat6-admin-webapps-6.0.24-105.el6_8.noarch.rpm tomcat6-docs-webapp-6.0.24-105.el6_8.noarch.rpm tomcat6-javadoc-6.0.24-105.el6_8.noarch.rpm tomcat6-webapps-6.0.24-105.el6_8.noarch.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: tomcat6-6.0.24-105.el6_8.src.rpm noarch: tomcat6-6.0.24-105.el6_8.noarch.rpm tomcat6-el-2.1-api-6.0.24-105.el6_8.noarch.rpm tomcat6-jsp-2.1-api-6.0.24-105.el6_8.noarch.rpm tomcat6-lib-6.0.24-105.el6_8.noarch.rpm tomcat6-servlet-2.5-api-6.0.24-105.el6_8.noarch.rpm Red Hat Enterprise Linux Workstation Optional (v. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. Note: the current version of the following document is available here: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03302206 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: KM03302206 Version: 1 MFSBGN03837 rev.1 - Network Node Manager i, Multiple Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2018-12-12 Last Updated: 2018-12-12 Potential Security Impact: Remote: Cross-Site Scripting (XSS), Disclosure of Information Source: Micro Focus, Product Security Response Team VULNERABILITY SUMMARY A vulnerabilities in Apache Tomcat was addressed by Micro Focus Network Node Manager i. The vulnerability could be exploited Remote Cross-Site Scripting (XSS) and Remote Disclosure of Information References: - PSRT110650 - CVE-2016-6816 - CVE-2017-5664 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HPE Network Node Manager I (NNMi) Software 9.2x, 10.0x, 10.00 Patch 1, 10.00 Patch 2, 10.00 Patch 3, 10.00 Patch 4, 10.00 Patch 5, 10.1x, 10.10 Patch 1, 10.10 Patch 2, 10.10 Patch 3, 10.10 Patch 4, 10.2x, 10.20 Patch 1, 10.20 Patch 2, 10.20 Patch 3, 10.30, 10.30 Patch 1 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector RESOLUTION Micro Focus has made the following software updates and mitigation information to resolve the vulnerability in Micro Focus Network Node Manager i: Customers using v9.X must upgrade to v10.x and then install the patch below. Patches are available to address the vulnerabilities: For v10.0x: Network Node Manager i 10.00 Patch 8 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139745](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139745) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139763](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139763) For v10.1x: Network Node Manager i 10.10 Patch 7 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139729](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139729) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139781](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139781) For v10.2x: Network Node Manager i 10.20 Patch 6 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139701](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139701) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139715](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139715) For v10.3x: Network Node Manager i 10.30 Patch 2 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139685](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139685) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139693](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139693) HISTORY Version:1 (rev.1) - 12 December 2018 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Micro Focus products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal Micro Focus services support channel. For other issues about the content of this Security Bulletin, send e-mail to security@microfocus.com. Report: To report a potential security vulnerability for any supported product: Web form: https://softwaresupport.softwaregrp.com/psrt Email: security@microfocus.com Subscribe: To initiate receiving subscriptions for future Micro Focus Security Bulletin alerts via Email, please subscribe here - https://softwaresupport.softwaregrp.com/group/softwaresupport/email-notification/-/subscriptions/registerdocumentnotification Once you are logged in to the portal, please choose security bulletins under product and document types. Please note that you will need to sign in using a Passport account. If you do not have a Passport account yet, you can create one- its free and easy https://cf.passport.softwaregrp.com/hppcf/createuser.do Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://softwaresupport.softwaregrp.com/security-vulnerability Software Product Category: The Software Product Category is represented in the title by the two characters following Micro Focus Security Bulletin. 3P = 3rd Party Software GN = Micro Focus General Software MU = Multi-Platform Software System management and security procedures must be reviewed frequently to maintain system integrity. Micro Focus is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "Micro Focus is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected Micro Focus products the important security information contained in this Bulletin. Micro Focus recommends that all users determine the applicability of this information to their individual situations and take appropriate action. Micro Focus does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, Micro Focus will not be responsible for any damages resulting from user's use or disregard of the information provided in this Security Bulletin. To the extent permitted by law, Micro Focus disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." Copyright Micro Focus Micro Focus shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither Micro Focus nor its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Micro Focus and the names of Micro Focus products referenced herein are trademarks of Micro Focus in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Web Server security and enhancement update Advisory ID: RHSA-2017:0457-01 Product: Red Hat JBoss Web Server Advisory URL: https://rhn.redhat.com/errata/RHSA-2017-0457.html Issue date: 2017-03-07 CVE Names: CVE-2016-0762 CVE-2016-1240 CVE-2016-3092 CVE-2016-5018 CVE-2016-6325 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 CVE-2016-8745 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss Web Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3, and includes enhancements. Security Fix(es): * It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. (CVE-2016-1240) * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325) * The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735) * A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-6816) * A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745) * The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762) * It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. (CVE-2016-5018) * It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. (CVE-2016-6794) * It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796) * It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. (CVE-2016-6797) The CVE-2016-6325 issue was discovered by Red Hat Product Security. Enhancement(s): * This enhancement update adds the Red Hat JBoss Web Server 3.1.0. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement. 3. Solution: Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service 1367447 - CVE-2016-6325 tomcat: tomcat writable config files allow privilege escalation 1376712 - CVE-2016-1240 tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation 1390493 - CVE-2016-6797 tomcat: unrestricted access to global resources 1390515 - CVE-2016-6796 tomcat: security manager bypass via JSP Servlet config parameters 1390520 - CVE-2016-6794 tomcat: system property disclosure 1390525 - CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function 1390526 - CVE-2016-0762 tomcat: timing attack in Realm implementation 1397484 - CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests 1397485 - CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener 1403824 - CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing 5. References: https://access.redhat.com/security/cve/CVE-2016-0762 https://access.redhat.com/security/cve/CVE-2016-1240 https://access.redhat.com/security/cve/CVE-2016-3092 https://access.redhat.com/security/cve/CVE-2016-5018 https://access.redhat.com/security/cve/CVE-2016-6325 https://access.redhat.com/security/cve/CVE-2016-6794 https://access.redhat.com/security/cve/CVE-2016-6796 https://access.redhat.com/security/cve/CVE-2016-6797 https://access.redhat.com/security/cve/CVE-2016-6816 https://access.redhat.com/security/cve/CVE-2016-8735 https://access.redhat.com/security/cve/CVE-2016-8745 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=webserver&version=3.1.0 https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.1_Release_Notes/index.html https://access.redhat.com/security/vulnerabilities/httpoxy https://access.redhat.com/solutions/2435491 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYvwzSXlSAg2UNWIIRAtstAKC5zAokXNBQnXe+hb9GvSKpngKrSQCgqXa2 zb+BJhQtiHDygDSa59EWVvE= =ZskZ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . =========================================================================== Ubuntu Security Notice USN-3177-2 February 02, 2017 tomcat6, tomcat7 regression =========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: USN-3177-1 introduced a regression in Tomcat. The update introduced a regression in environments where Tomcat is started with a security manager. This update fixes the problem. We apologize for the inconvenience. A remote attacker could possibly use this issue to enumerate usernames. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. A malicious application could possibly use this to bypass Security Manager restrictions. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5018) It was discovered that Tomcat did not protect applications from untrusted data in the HTTP_PROXY environment variable. A remote attacker could possibly use this issue to redirect outbound traffic to an arbitrary proxy server. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5388) It was discovered that Tomcat incorrectly controlled reading system properties. A malicious application could possibly use this to bypass Security Manager restrictions. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. A malicious application could possibly use this to bypass Security Manager restrictions. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6816) Pierre Ernst discovered that the Tomcat JmxRemoteLifecycleListener did not implement a recommended fix. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2016-8745) Paul Szabo discovered that the Tomcat package incorrectly handled upgrades and removals. A local attacker could possibly use this issue to obtain root privileges. (CVE-2016-9774, CVE-2016-9775) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: libtomcat7-java 7.0.52-1ubuntu0.9 tomcat7 7.0.52-1ubuntu0.9 Ubuntu 12.04 LTS: libtomcat6-java 6.0.35-1ubuntu3.10 tomcat6 6.0.35-1ubuntu3.10 In general, a standard system update will make all the necessary changes

Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could violate a security policy during IPS signature updates when the FortiGate's IPSengine is configured in flow mode. All FortiGate versions with IPS configured in proxy mode (the default mode) are not affected. FortiOS Contains vulnerabilities related to security features.Information may be tampered with. FortiGate FortiOS is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. Fortinet FortiOS is a set of security operating systems developed by Fortinet Corporation for the FortiGate network security platform. The system provides users with various security functions such as firewall, anti-virus, IPSec/SSL VPN, Web content filtering and anti-spam. Fortinet has a security vulnerability in FortiOS versions 5.2.x prior to 5.2.10 GA and Long lived sessions in versions 5.4.x prior to 5.4.2 GA

The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption. Fortinet FortiOS is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Fortinet FortiOS 4.3.0 through 4.3.18 are vulnerable. Fortinet FortiWLC is a wireless controller produced by Fortinet. A security vulnerability exists in the ANSI X9.31 RNG implementation in Fortinet FortiWLC

A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server at port 80/TCP or port 443/TCP of the affected devices could allow remote attackers to perform actions with the permissions of an authenticated user, provided the targeted user has an active session and is induced to trigger the malicious request. plural Siemens SIMATIC Product integration Web The server contains a cross-site request forgery vulnerability.A remote attacker could hijack an arbitrary user's authentication. SiemensSIMATICCP343-1Advanceddevices is an Ethernet communication module from Siemens AG to support PROFINET, the next generation of industrial bus technology-based automation bus standard. A cross-site request forgery vulnerability exists in SiemensSIMATICCP343-1Advanceddevices. A successful exploit may allow an attacker to obtain sensitive information, and perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could exploit this vulnerability to send unexpected requests to the server through an affected client

Huawei is a Chinese provider of information and communication solutions. The HuaweiFlybox B660Router is a router device of Huawei. HuaweiFlyboxB660Router has a bypass validation vulnerability. Due to a vulnerability in the local path \"./htmlcode/html/\" module and \"indexdefault.asp\" file, an unauthenticated remote attacker exploited the vulnerability to log in to the management background of the Huawei Flybox B660 router.

siemens 840D is a numerical control system of Siemens, which has a wide range of application environments, including: packaging printing industry, such as: food packaging wheel cutting positioning, plastic rubber industry, such as: plastic tableware production line, white goods industry, can be used in fixed power production lines, CNC machine tool industry, suitable for small lathes, milling machines, etc. siemens 840D has a buffer overflow vulnerability. Allowing an attacker to exploit the vulnerability and obtain system administrator permissions, they can perform arbitrary operations on the host computer, such as shutting down, operating configuration software, obtaining configuration software files, and sending arbitrary instructions to the controller

Shanghai Guangsheng Information Technology Co., Ltd. is a leading global provider of terminal management cloud platforms. FOTA (Wireless Upgrade) provides professional wireless upgrade solutions for IoT devices (smart cars, wearables, homes, VR, etc.). A number of mtk platform mobile phone Guangsheng FOTA services have system privilege elevation vulnerabilities. Because the mobile phone using the Guangsheng FOTA service has a vulnerability in the system app of a certain binding service, it is possible to execute commands with system permissions. An attacker could exploit the vulnerability to elevate permissions to system permissions.

40NOE77101 is an Ethernet communication module for Schneider's Quantum series PLC. The Schneider 140NOE77101 Ethernet module's TCP / IP protocol stack has a Land attack vulnerability. As the program sends a TCP SYN packet with the same source and destination IP (both the IP address of the 140NOE7710 module) to the 140NOE7710 module at a rate greater than 15kpps, the attacker can use The vulnerability can cause the module protocol stack to crash and the system to become unresponsive. The module needs to be powered off and restarted to return to normal

A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the "secure" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission. plural Siemens SIMATIC Product integration Web The server https Session unspecified Cookie Against secure Because the flag is not set, Cookie There is a vulnerability that will be captured.By a remote attacker, http By intercepting transmissions within a session, Cookie May be captured. SiemensSIMATICS7-300/S7-400CPUfamilies are used to provide discrete and continuous control in industrial environments such as manufacturing, food and beverage, and the global chemical industry. An information disclosure vulnerability exists in the SIMATICS7-300/S7-400CPUfamily. Attackers exploit vulnerabilities to obtain sensitive information. Multiple Siemens Products are prone to a cross-site request-forgery vulnerability and an information-disclosure vulnerability. Other attacks are also possible. Siemens SIMATIC CP 343-1 Advanced and so on are the Ethernet communication modules used by German Siemens to support PROFINET (a new generation of automation bus standard based on industrial Ethernet technology). This vulnerability stems from configuration errors in network systems or products during operation. The following vulnerabilities have been reported to Siemens CERT and are now covered by by Siemens Security Advisory SSA-603476, published today (2016-11-21) and available at the following URL: http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-603476.pdf -- CVE-016-8672 --------------------------------------------------------- Summary: Lack of cookie protection for management web interface. The HttpOnly flag prevents client side scripts from accessing a cookie, mitigating cross-site scripting (XSS) attacks. The session cookie weaknesses, with particular reference to the lack of the Secure flag, highlight the need for a forced encrypted connection to the exposed web interface, in order to mitigate any hijacking of its credentials Credit: Inverse Path auditors in collaboration with AIRBUS ICT Industrial Security team -- CVE-016-8673 --------------------------------------------------------- Summary: Cross-site request forgery for management web interface. Affected products: SIMATIC CP 343-1 Advanced: All versions < V3.0.53 SIMATIC CP 443-1 Advanced: All versions SIMATIC S7-300 CPU family: All firmware versions SIMATIC S7-400 CPU family: All firmware versions Description: The Cross-site request forgery (CSRF) class of attacks leverages on the trust that a logged in user gives to HTML content of unrelated origins, by triggering unauthorized commands via HTML links or scripts injected by the attacker in the browser context. The web management interface does not take advantage of any CSRF protection mechanism. This omission allows unauthorized POST requests to be issued by any JavaScript loaded in the user browser execution context, regardless of their origin. Given the fact that the affected products support POST requests, to upload Access Control List (ACL) configuration or customer specific actions, the lack of CSRF protection exposes the risk of unauthenticated management actions. Credit: Inverse Path auditors in collaboration with AIRBUS ICT Industrial Security team ------------------------------------------------------------------------- -- Andrea Barisani Inverse Path Srl Chief Security Engineer -----> <-------- <andrea@inversepath.com> http://www.inversepath.com 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate"

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "FaceTime" component, which allows remote attackers to trigger memory corruption and obtain audio data from a call that appeared to have ended. Apple iOS and Mac OS are prone to multiple security-bypass vulnerabilities. Attackers can exploit these issues to bypass security restrictions and perform unauthorized actions. Both Apple iOS and macOS are operating systems of Apple Inc. in the United States. A security vulnerability exists in the FaceTime component of Apple iOS prior to 10.1 and Apple macOS Sierra prior to 10.12.1. An attacker could exploit this vulnerability to cause a transferred call to continue to transmit audio