VARIoT IoT vulnerabilities database

Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to read arbitrary files via a crafted pathname. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trihedral VTScada. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of Wireless Application Protocol requests. The issue lies in the failure to properly restrict the path from which images are retrieved. An attacker can leverage this vulnerability to disclose the contents of arbitrary files under the context of the user running the service. Trihedral VTScada (formerly known as VTS) is a SCADA system based on the Windows platform provided by Trihedral Engineering of Canada. VTScada is prone to multiple security vulnerabilities. Exploiting these issues will allow attackers to obtain sensitive information, cause denial-of-service conditions or to bypass certain security restrictions and perform unauthorized actions. VTScada versions 8 through 11.2.x are vulnerable

Cisco Aironet Access Point Software 8.2(100.0) on 1830e, 1830i, 1850e, 1850i, 2800, and 3800 access points allows local users to obtain Linux root access via crafted CLI command parameters, aka Bug ID CSCuy64037. The Cisco Aironet 1800/2800/3800 Series AccessPoint is a small to medium wireless network access point product. A security vulnerability exists in the command line interpreter for Cisco Aironet 1800/2800/3800 Series AccessPoint. This issue being tracked by Cisco Bug ID CSCuy64037

HPE Discovery and Dependency Mapping Inventory (DDMi) 9.30, 9.31, 9.32, 9.32 update 1, 9.32 update 2, and 9.32 update 3 allows remote authenticated users to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library. Supplementary information : CWE Vulnerability types by CWE-284: Improper Access Control ( Improper access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlCleverly serialized by a remotely authenticated user Java Arbitrary commands may be executed via the object. HP Discovery and Dependency Mapping Inventory is prone to a remote code-execution vulnerability. Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts may result in a denial-of-service condition. HP Discovery and Dependency Mapping Inventory 9.30, 9.31, 9.32, 9.32 update 1, 9.32 update 2, and 9.32 update 3 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05164819 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05164819 Version: 1 HPSBGN03619 rev.1 - HPE Discovery and Dependency Mapping Inventory (DDMi) using Java Deserialization, remote Code Execution NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. The vulnerability could be exploited remotely to allow remote code execution. References: CVE-2016-4369 CERT-VU#576313 SSRT110134 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP DDMI Inventory Software Series 9.30, 9.31, 9.32, 9.32 update 1, 9.32 update 2, and 9.32 update 3 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2016-4369 (AV:N/AC:M/Au:S/C:P/I:P/A:P) 6.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HPE has made the following mitigation information available to resolve the vulnerability for the impacted versions of Discovery and Dependency Mapping Inventory (DDMi): https://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facetse arch/document/KM02338864 HISTORY Version:1 (rev.1) - 6 June 2016 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJXVe/zAAoJEGIGBBYqRO9/XyYH/RN+luVOrPp2TmbmuY3oj4mQ oL/EyarFFRjjosIZVchsLuvhTXoE3BvMuzkmKL3aV9ScZjbEAf9h6jE289iicrvE Mi0JmerxIvfR0q8+3JirBjY/invDj6y/5WdHf3s/F9M5rQSKsJRv6k52RKeEVjtu fG1pwPHA/5fRGBoNpKpjaOVbkMkACqm7NmTFS9isYIsB1xMH41vjSbS5c1MTAhRb Elx7Zzy4nKXRDIlDoZwD6WaZ9rBZUS680lUZziOpxvD9liWQ+N1GPXI9Y5xDxFEs ngfRbETxVqomNwTIvoxWfGkUSGxXRZsDqIndOXeiIN+SlEnVSZqM8ISjaJo7MQw= =80Bg -----END PGP SIGNATURE-----

Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service (resource consumption and Traffic Management Microkernel restart) via an SSL alert during the handshake. BIG-IP SSL is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause excessive resource consumption, resulting in a denial-of-service condition. F5 BIG-IP Analytics and others are products of F5 Corporation of the United States. F5 BIG-IP Analytics is a suite of web application performance analysis software. APM is a set of solutions that provide secure and unified access to business-critical applications and networks. LTM is a local traffic manager. A security vulnerability exists in the Virtual Server of several F5 BIG-IP products. The following products and versions are affected: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM version 11.5.4

CISCO IP 8800 phones with software 11.0.1 and earlier allow local users to gain privileges for OS command execution via crafted CLI commands, aka Bug ID CSCuz03005. The Cisco IP8800phone is a telephone product that provides video and VoIP communication capabilities at Cisco. A permission acquisition vulnerability exists in the Cisco IP8800phone using version 11.0.1 and earlier software. A local attacker could exploit the vulnerability to gain permission to execute operating system commands with the help of specially crafted CLI commands. This may aid in further attacks. This issue being tracked by Cisco Bug ID CSCuz03005. Cisco IP 8800 Series Phones running versions 11.0.1 and prior are vulnerable

Midea M-Smart smart socket is a smart home appliance developed by Midea Group. Midea M-Smart smart sockets are vulnerable to man-in-the-middle attacks due to the insecure protocol used to transmit data and lack of verification of the content transmitted by the client and server. When the instruction is issued, the context lacks effective association information and verification, which causes a single packet to be bypassed to initiate a replay attack.

Developineo+220, bizhub283, Developinoo363, bizhubC220, bizhubC353 are several printer products of Konica Minolta Group. There is an unauthorized access vulnerability in the Konica Minolta printer. An attacker exploits a vulnerability to gain unauthorized access to a website to obtain sensitive information.

General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface. Supplementary information : CWE Vulnerability type by CWE-798: Use of Hard-coded Credentials ( Using hard-coded credentials ) Has been identified. http://cwe.mitre.org/data/definitions/798.htmlBy a third party Web Configuration settings may be changed through the interface. GEML800 and others are all Ethernet switches of General Electric (GE). GE MultiLink Series Switches are prone to an authentication-bypass vulnerability. An attacker can exploit this issue to gain unauthorized access or obtain sensitive information; this may lead to further attacks. The following products are affected : GE ML800 Switch, firmware versions prior to Version 5.5.0 GE ML810 Switch, firmware versions prior to Version 5.5.0k GE ML1200 Switch, firmware versions prior to Version 5.5.0 GE ML1600 Switch, firmware versions prior to Version 5.5.0 GE ML2400 Switch, firmware versions prior to Version 5.5.0 GE ML3000 Switch, firmware versions prior to Version 5.5.0k GE ML3100 Switch, firmware versions prior to Version 5.5.0k

Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow local users to obtain root access via crafted CLI input, aka Bug ID CSCuy21892. Multiple Cisco Products are prone to a local command-injection vulnerability. A local attacker can exploit this issue to execute arbitrary commands on the host operating system with root privileges. This issue being tracked by Cisco Bug ID CSCuy21892. A security vulnerability exists in Cisco Prime NAM and Prime vNAM

Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21889. Vendors have confirmed this vulnerability Bug ID CSCuy21889 It is released as.Skillfully crafted by a third party HTTP Any via request OS The command may be executed. Multiple Cisco products are are prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code on the affected system. This may aid in further attacks. This issue being tracked by Cisco Bug ID CSCuy21889

Cisco Prime Network Analysis Module (NAM) before 6.2(1-b) miscalculates IPv6 payload lengths, which allows remote attackers to cause a denial of service (mond process crash and monitoring outage) via crafted IPv6 packets, aka Bug ID CSCuy37324. Cisco Prime Network Analysis Module is prone to a denial-of-service vulnerability. A remote attacker can exploit this issue to cause denial-of-service conditions. This issue being tracked by Cisco Bug ID CSCuy37324. There is a security vulnerability in the IPv6 packet decoding function of Cisco NAM versions earlier than 6.2(1-b). The vulnerability is due to the fact that the program does not correctly calculate the length of the IPv6 payload

Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21882. Vendors have confirmed this vulnerability Bug ID CSCuy21882 It is released as. Supplementary information : CWE Vulnerability type by CWE-77: Improper Neutralization of Special Elements used in a Command ( Command injection ) Has been identified. http://cwe.mitre.org/data/definitions/77.htmlSkillfully crafted by a third party HTTP Any via request OS The command may be executed. Multiple Cisco Prime Products are prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code on the affected system. This may aid in further attacks. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP request to execute arbitrary commands in the underlying operating system of the affected device with Web server privileges

Buffer overflow in Huawei VP9660, VP9650, and VP9630 multipoint control unit devices with software before V500R002C00SPC200 and RSE6500 videoconference devices with software before V500R002C00SPC100, when an unspecified service is enabled, allows remote attackers to execute arbitrary code via a crafted packet, aka HWPSIRT-2016-05054. Vendors have confirmed this vulnerability HWPSIRT-2016-05054 It is released as.A third party may be able to execute arbitrary code via a crafted packet. HUAWEIVP9660 and RSE6500 are the next-generation video conferencing terminal products of China Huawei. HUAWEIVP9660 and RSE6500 have a buffer overflow vulnerability in handling malformed messages. Remote attackers can exploit the vulnerability to send special requests to crash the system. Multiple Huawei Videoconference Products are prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. The following products and versions are affected: HUAWEI VP9660 V200R001C01, V200R001C02, V200R001C30, and RSE6500 V100R001C00

WebKit/Source/devtools/front_end/devtools.js in the Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not ensure that the remoteFrontendUrl parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlSkillfully crafted by a third party URL Access restrictions may be circumvented via. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Maximum Security. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the analysis of web pages. By performing actions in script matching a large array against a RegEx, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Google Chrome is prone to multiple security vulnerabilities. Attackers can exploit these issues to bypass security restriction and perform unauthorized actions, cause denial-of-service conditions, retrieve sensitive information; other attacks may also be possible. Versions prior to Chrome 51.0.2704.79 are vulnerable. CVE-2016-1696 A cross-origin bypass was found in the bindings to extensions. CVE-2016-1698 Rob Wu discovered an information leak. CVE-2016-1700 Rob Wu discovered a use-after-free issue in extensions. CVE-2016-1701 Rob Wu discovered a use-after-free issue in the autofill feature. For the stable distribution (jessie), these problems have been fixed in version 51.0.2704.79-1~deb8u1. For the testing distribution (stretch), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 51.0.2704.79-1. We recommend that you upgrade your chromium-browser packages. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: chromium-browser security update Advisory ID: RHSA-2016:1201-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://access.redhat.com/errata/RHSA-2016:1201 Issue date: 2016-06-02 CVE Names: CVE-2016-1696 CVE-2016-1697 CVE-2016-1698 CVE-2016-1699 CVE-2016-1700 CVE-2016-1701 CVE-2016-1702 CVE-2016-1703 ===================================================================== 1. Summary: An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. This update upgrades Chromium to version 51.0.2704.79. (CVE-2016-1696, CVE-2016-1697, CVE-2016-1703, CVE-2016-1698, CVE-2016-1699, CVE-2016-1700, CVE-2016-1701, CVE-2016-1702) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Chromium must be restarted for the changes to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1342001 - CVE-2016-1696 chromium-browser: cross-origin bypass in extension bindings 1342002 - CVE-2016-1697 chromium-browser: cross-origin bypass in blink 1342003 - CVE-2016-1698 chromium-browser: information leak in extension bindings 1342004 - CVE-2016-1699 chromium-browser: parameter sanitization failure in devtools 1342005 - CVE-2016-1700 chromium-browser: use-after-free in extensions 1342007 - CVE-2016-1701 chromium-browser: use-after-free in autofill 1342008 - CVE-2016-1702 chromium-browser: out-of-bounds read in skia 1342009 - CVE-2016-1703 chromium-browser: various fixes from internal audits 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: chromium-browser-51.0.2704.79-1.el6.i686.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.i686.rpm x86_64: chromium-browser-51.0.2704.79-1.el6.x86_64.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: chromium-browser-51.0.2704.79-1.el6.i686.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.i686.rpm x86_64: chromium-browser-51.0.2704.79-1.el6.x86_64.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: chromium-browser-51.0.2704.79-1.el6.i686.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.i686.rpm x86_64: chromium-browser-51.0.2704.79-1.el6.x86_64.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXUICpXlSAg2UNWIIRAs1+AJ9Us24LC+Oop/AuL5JbTtWNW9e4dQCcC5/Y lbqCxyEQCwttZzdF4gEzJDA= =OPtc -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . From: Chris Coulson <chris.coulson@canonical.com> Reply-To: Ubuntu Security <security@ubuntu.com> To: ubuntu-security-announce@lists.ubuntu.com Message-ID: <9c9730ff-923d-99dc-e9ee-6867bc48bb31@canonical.com> Subject: [USN-2992-1] Oxide vulnerabilities ============================================================================ Ubuntu Security Notice USN-2992-1 June 06, 2016 oxide-qt vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 15.10 - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Oxide. Software Description: - oxide-qt: Web browser engine for Qt (QML plugin) Details: An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1673) An issue was discovered with Document reattachment in Blink in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1675) A type confusion bug was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-1677) A heap overflow was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1678) A use-after-free was discovered in the V8ValueConverter implementation in Chromium in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1679) A use-after-free was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1680) A security issue was discovered in ServiceWorker registration in Blink in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass Content Security Policy (CSP) protections. (CVE-2016-1682) An out-of-bounds memory access was discovered in libxslt. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1683) An integer overflow was discovered in libxslt. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash or resource consumption). (CVE-2016-1684) An out-of-bounds read was discovered in the regular expression implementation in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash). (CVE-2016-1688) A heap overflow was discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1689) A heap overflow was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1691) It was discovered that Blink permits cross-origin loading of stylesheets by a service worker even when the stylesheet download has an incorrect MIME type. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1695, CVE-2016-1703) It was discovered that Blink does not prevent frame navigation during DocumentLoader detach operations. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1697) A parameter sanitization bug was discovered in the devtools subsystem in Blink. An attacker could potentially exploit this to bypass intended access restrictions. (CVE-2016-1699) An out-of-bounds read was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash). (CVE-2016-1702) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: liboxideqtcore0 1.15.7-0ubuntu0.16.04.1 Ubuntu 15.10: liboxideqtcore0 1.15.7-0ubuntu0.15.10.1 Ubuntu 14.04 LTS: liboxideqtcore0 1.15.7-0ubuntu0.14.04.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2992-1 CVE-2016-1673, CVE-2016-1675, CVE-2016-1677, CVE-2016-1678, CVE-2016-1679, CVE-2016-1680, CVE-2016-1682, CVE-2016-1683, CVE-2016-1684, CVE-2016-1688, CVE-2016-1689, CVE-2016-1691, CVE-2016-1692, CVE-2016-1695, CVE-2016-1697, CVE-2016-1699, CVE-2016-1702, CVE-2016-1703 Package Information: https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.16.04.1 https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.15.10.1 https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.14.04.1 --8W6UvL1N3AKIHxvSN46PkVqsvg1CjmqQX

Stack-based buffer overflow in mchan.dll in the agent in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 allows remote attackers to execute arbitrary code via a long -server_name value, aka ZDI-CAN-3516. HPE LoadRunner and Performance Center Get important information, change data, or disrupt service (DoS) There are vulnerabilities that are put into a state. Zero Day Initiative Is vulnerable to this vulnerability ZDI-CAN-3516 Was numbered.A third party obtains important information, changes data, or interferes with service operations. (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise LoadRunner. Authentication is not required to exploit this vulnerability.The specific flaw exists within mchan.dll when constructing a shared memory file name. The issue lies in the failure to validate the size of a user-supplied string prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. HPE LoadRunner and Performance Center are performance load testing software from Hewlett Packard, USA. Multiple HP Products are prone to multiple remote code-execution and denial-of-service vulnerabilities. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05157423 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05157423 Version: 1 HPSBGN03609 rev.1 - HPE LoadRunner and Performance Center, Remote Code Execution, Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2016-05-31 Last Updated: 2016-05-31 Potential Security Impact: Remote Code Execution, Denial of Service (DoS) Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Several potential security vulnerabilities have been identified in HPE LoadRunner and Performance Center. These vulnerabilities could be exploited remotely to allow code execution, and Denial of Service (DoS). References: CVE-2016-4359 (PSRT110020, ZDI-CAN-3516) CVE-2016-4360 (PSRT110032, ZDI-CAN-3555) CVE-2016-4361 (SSRT102274) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. http://www.hpe.com/software/updates Performance Center v11.52, please update to Performance Center v12.53 or later. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJXTuaIAAoJEGIGBBYqRO9/2jsIANv3Bafqi6/Cl1UOgtPdLau8 FWnwoZnNUS8aEa33EKMMWQBZbNbLVSkILV/JmkgASHNY5nv2hAV7XPv+UsfEjMyv 99y6qa8ejcvI3E8L5nQFri6r7v9A8PqKfAedkUuZJrDZ3GTF7xX3jnmCmYezF843 PBvIF5/ZGu45xbWb7BavgsuXGmgnk2Ol6m6J9uJMTEKECwmRA1WH1lmbXXI5lxYT Let6E0F0dVyVly9avHZYkoQZbOxErVC00tUQUONCIEaYhlxhUJZxqAtjET/SwV+0 KCgliaNiCmbsBjXI+w2diYHI1QJALWUQ5gxdPhEmOfm/hT9LQ5G5Gj7PSp1unNo= =Yk9f -----END PGP SIGNATURE-----

Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of service via unspecified vectors. IBM WebSphere DataPower XC10 is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause a denial of service condition. IBM WebSphere DataPower XC10 2.1 and 2.5 are vulnerable. The platform enables distributed caching of data with little to no change to existing applications

libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document, aka Bug IDs CSCuv78533 and CSCuw60503. Vendors have confirmed this vulnerability Bug ID CSCuv78533 It is released as.Denial of service operations through crafted documents by third parties (AMP Restart process ) There is a possibility of being put into a state. Multiple Cisco products are prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause the AMP process to restart, resulting in a denial-of-service condition. This issue is being tracked by Cisco Bug IDs CSCuv78533, and CSCuw60503. This issue is fixed in: Cisco ClamAV 0.99 Cisco Email Security Appliance 9.7.0-125 Cisco Web Security Appliance 9.1.1-041, and 9.0.1-135. Clam AntiVirus (ClamAV) is a set of free and open-source antivirus software developed by the ClamAV team to detect Trojans, viruses, malware, and other malicious threats. A security vulnerability exists in libclamav in ClamAV in Cisco AMP for ESA and WSA due to the program not properly parsing input files. The following products and versions are affected: Cisco AMP for ESA before 9.7.0-125, Cisco AMP for WSA before 9.0.1-135, and Cisco AMP for WSA 9.1.x before 9.1.1-041. =========================================================================== Ubuntu Security Notice USN-3093-1 September 28, 2016 clamav vulnerabilities =========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: ClamAV could be made to crash or run programs if it processed a specially crafted file. Software Description: - clamav: Anti-virus utility for Unix Details: It was discovered that ClamAV incorrectly handled certain malformed files. In the default installation, attackers would be isolated by the ClamAV AppArmor profile. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: clamav 0.99.2+dfsg-0ubuntu0.16.04.1 Ubuntu 14.04 LTS: clamav 0.99.2+addedllvm-0ubuntu0.14.04.1 Ubuntu 12.04 LTS: clamav 0.99.2+addedllvm-0ubuntu0.12.04.1 This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-3093-1 CVE-2016-1371, CVE-2016-1372, CVE-2016-1405 Package Information: https://launchpad.net/ubuntu/+source/clamav/0.99.2+dfsg-0ubuntu0.16.04.1 https://launchpad.net/ubuntu/+source/clamav/0.99.2+addedllvm-0ubuntu0.14.04.1 https://launchpad.net/ubuntu/+source/clamav/0.99.2+addedllvm-0ubuntu0.12.04.1

Moxa UC-7408 LX-Plus devices allow remote authenticated users to write to the firmware, and consequently render a device unusable, by leveraging root access. Supplementary information : CWE Vulnerability type by CWE-254: Security Features ( Security function ) Has been identified. Moxa UC-7408 is an embedded industrial computer product from Moxa. A firmware rewrite vulnerability exists in Moxa UC-7408, which is caused by the program's failure to perform authentication on important functions. A remote attacker could use this vulnerability to cause an unrecoverable firmware rewrite. Moxa UC-7408 LX-Plus is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service condition

ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors. ABB PCM600 is a protection and control IED manager for the energy industry. A local attacker could exploit this vulnerability to access affected devices. ABB PCM600 is prone to following security vulnerabilities: 1. An insecure password-hash vulnerability 2. Multiple insecure password storage vulnerabilities Successful attacks can allow a local attacker to gain unauthorized access to the application's users' password information. ABB PCM600 prior to 2.7 are vulnerable. The vulnerability is caused by the program not storing the authentication certificate correctly

ABB PCM600 before 2.7 improperly stores OPC Server IEC61850 passwords in unspecified temporary circumstances, which allows local users to obtain sensitive information via unknown vectors. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlLocal users may get important information. ABB PCM600 is a protection and control IED manager for the energy industry. A local attacker could exploit this vulnerability to access affected devices. ABB PCM600 is prone to following security vulnerabilities: 1. An insecure password-hash vulnerability 2. Multiple insecure password storage vulnerabilities Successful attacks can allow a local attacker to gain unauthorized access to the application's users' password information. ABB PCM600 prior to 2.7 are vulnerable