VARIoT IoT vulnerabilities database

Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi. Synology DiskStation Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. Synology DiskStation Manager 5.2-5565 is vulnerable. Synology DiskStation Manager (DSM) is an operating system developed by Synology for network storage servers (NAS). The operating system can manage data, documents, photos, music and other information

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header. Sendio ESP (Email Security Platform) is a network device that provides anti-spam and anti-virus solutions for enterprises in Sendio, USA. A security vulnerability exists in versions prior to Sendio ESP 7.2.4. Because there is a session identifier in the message. Sendio ESP is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to obtain sensitive information that may lead to further attacks

The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to obtain sensitive information from other users' sessions via a large number of requests. Sendio ESP (Email Security Platform) is a network device that provides anti-spam and anti-virus solutions for enterprises in Sendio, USA. A security vulnerability exists in the web interface of Sendio ESP prior to 7.2.4. The program failed to process the session correctly. Sendio ESP is prone to multiple information-disclosure vulnerabilities

The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786. An attacker can exploit this issue to execute system commands on the affected device. This issue being tracked by Cisco Bug ID CSCut02786. The solution includes products such as Cisco TelePresence, Customer Collaboration (Contact Center) and Unified Communications to support customers to use collaboration technology in public cloud, private cloud and hybrid cloud models

There are several remote code execution vulnerabilities in the Bohua Net Dragon Information Security Appliance. An attacker can exploit the vulnerability to gain remote control of the web server host.

A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker could exploit this vulnerability by convincing a user to follow a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. This issue is being tracked by Cisco Bug ID CSCut66725. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence. PostgreSQL Has a deficiency in freeing up memory twice, causing service disruption ( crash ) There are vulnerabilities that are put into a state. Supplementary information : CWE Vulnerability type by CWE-415: Double Free ( Double release ) Has been identified. PostgreSQL is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to crash the application, denying service to legitimate users. The system supports most SQL standards and provides many other features, such as foreign keys, triggers, views, etc. The following versions are affected: PostgreSQL prior to 9.0.20, 9.1.x prior to 9.1.16, 9.2.x prior to 9.2.11, 9.3.x prior to 9.3.7, 9.4 prior to 9.4.2. x version. CVE-2015-3166 (Information exposure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. Fix by using a one-size-fits-all message. For the stable distribution (jessie), these problems have been fixed in version 9.4.2-0+deb8u1. For the testing distribution (stretch), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 9.4.2-1. We recommend that you upgrade your postgresql-9.4 packages. ============================================================================ Ubuntu Security Notice USN-2621-1 May 25, 2015 postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.04 - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in PostgreSQL. (CVE-2015-3167) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.04: postgresql-9.4 9.4.2-0ubuntu0.15.04 Ubuntu 14.10: postgresql-9.4 9.4.2-0ubuntu0.14.10 Ubuntu 14.04 LTS: postgresql-9.3 9.3.7-0ubuntu0.14.04 Ubuntu 12.04 LTS: postgresql-9.1 9.1.16-0ubuntu0.12.04 This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: postgresql security update Advisory ID: RHSA-2015:1194-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1194.html Issue date: 2015-06-29 CVE Names: CVE-2015-3165 CVE-2015-3166 CVE-2015-3167 ===================================================================== 1. Summary: Updated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1221537 - CVE-2015-3165 postgresql: double-free after authentication timeout 1221539 - CVE-2015-3166 postgresql: unanticipated errors from the standard library 1221541 - CVE-2015-3167 postgresql: pgcrypto has multiple error messages for decryption with an incorrect key. 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: postgresql-8.4.20-3.el6_6.src.rpm i386: postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-libs-8.4.20-3.el6_6.i686.rpm x86_64: postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-debuginfo-8.4.20-3.el6_6.x86_64.rpm postgresql-libs-8.4.20-3.el6_6.i686.rpm postgresql-libs-8.4.20-3.el6_6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: postgresql-8.4.20-3.el6_6.i686.rpm postgresql-contrib-8.4.20-3.el6_6.i686.rpm postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-devel-8.4.20-3.el6_6.i686.rpm postgresql-docs-8.4.20-3.el6_6.i686.rpm postgresql-plperl-8.4.20-3.el6_6.i686.rpm postgresql-plpython-8.4.20-3.el6_6.i686.rpm postgresql-pltcl-8.4.20-3.el6_6.i686.rpm postgresql-server-8.4.20-3.el6_6.i686.rpm postgresql-test-8.4.20-3.el6_6.i686.rpm x86_64: postgresql-8.4.20-3.el6_6.i686.rpm postgresql-8.4.20-3.el6_6.x86_64.rpm postgresql-contrib-8.4.20-3.el6_6.x86_64.rpm postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-debuginfo-8.4.20-3.el6_6.x86_64.rpm postgresql-devel-8.4.20-3.el6_6.i686.rpm postgresql-devel-8.4.20-3.el6_6.x86_64.rpm postgresql-docs-8.4.20-3.el6_6.x86_64.rpm postgresql-plperl-8.4.20-3.el6_6.x86_64.rpm postgresql-plpython-8.4.20-3.el6_6.x86_64.rpm postgresql-pltcl-8.4.20-3.el6_6.x86_64.rpm postgresql-server-8.4.20-3.el6_6.x86_64.rpm postgresql-test-8.4.20-3.el6_6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: postgresql-8.4.20-3.el6_6.src.rpm x86_64: postgresql-8.4.20-3.el6_6.i686.rpm postgresql-8.4.20-3.el6_6.x86_64.rpm postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-debuginfo-8.4.20-3.el6_6.x86_64.rpm postgresql-libs-8.4.20-3.el6_6.i686.rpm postgresql-libs-8.4.20-3.el6_6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: postgresql-contrib-8.4.20-3.el6_6.x86_64.rpm postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-debuginfo-8.4.20-3.el6_6.x86_64.rpm postgresql-devel-8.4.20-3.el6_6.i686.rpm postgresql-devel-8.4.20-3.el6_6.x86_64.rpm postgresql-docs-8.4.20-3.el6_6.x86_64.rpm postgresql-plperl-8.4.20-3.el6_6.x86_64.rpm postgresql-plpython-8.4.20-3.el6_6.x86_64.rpm postgresql-pltcl-8.4.20-3.el6_6.x86_64.rpm postgresql-server-8.4.20-3.el6_6.x86_64.rpm postgresql-test-8.4.20-3.el6_6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: postgresql-8.4.20-3.el6_6.src.rpm i386: postgresql-8.4.20-3.el6_6.i686.rpm postgresql-contrib-8.4.20-3.el6_6.i686.rpm postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-devel-8.4.20-3.el6_6.i686.rpm postgresql-docs-8.4.20-3.el6_6.i686.rpm postgresql-libs-8.4.20-3.el6_6.i686.rpm postgresql-plperl-8.4.20-3.el6_6.i686.rpm postgresql-plpython-8.4.20-3.el6_6.i686.rpm postgresql-pltcl-8.4.20-3.el6_6.i686.rpm postgresql-server-8.4.20-3.el6_6.i686.rpm postgresql-test-8.4.20-3.el6_6.i686.rpm ppc64: postgresql-8.4.20-3.el6_6.ppc.rpm postgresql-8.4.20-3.el6_6.ppc64.rpm postgresql-contrib-8.4.20-3.el6_6.ppc64.rpm postgresql-debuginfo-8.4.20-3.el6_6.ppc.rpm postgresql-debuginfo-8.4.20-3.el6_6.ppc64.rpm postgresql-devel-8.4.20-3.el6_6.ppc.rpm postgresql-devel-8.4.20-3.el6_6.ppc64.rpm postgresql-docs-8.4.20-3.el6_6.ppc64.rpm postgresql-libs-8.4.20-3.el6_6.ppc.rpm postgresql-libs-8.4.20-3.el6_6.ppc64.rpm postgresql-plperl-8.4.20-3.el6_6.ppc64.rpm postgresql-plpython-8.4.20-3.el6_6.ppc64.rpm postgresql-pltcl-8.4.20-3.el6_6.ppc64.rpm postgresql-server-8.4.20-3.el6_6.ppc64.rpm postgresql-test-8.4.20-3.el6_6.ppc64.rpm s390x: postgresql-8.4.20-3.el6_6.s390.rpm postgresql-8.4.20-3.el6_6.s390x.rpm postgresql-contrib-8.4.20-3.el6_6.s390x.rpm postgresql-debuginfo-8.4.20-3.el6_6.s390.rpm postgresql-debuginfo-8.4.20-3.el6_6.s390x.rpm postgresql-devel-8.4.20-3.el6_6.s390.rpm postgresql-devel-8.4.20-3.el6_6.s390x.rpm postgresql-docs-8.4.20-3.el6_6.s390x.rpm postgresql-libs-8.4.20-3.el6_6.s390.rpm postgresql-libs-8.4.20-3.el6_6.s390x.rpm postgresql-plperl-8.4.20-3.el6_6.s390x.rpm postgresql-plpython-8.4.20-3.el6_6.s390x.rpm postgresql-pltcl-8.4.20-3.el6_6.s390x.rpm postgresql-server-8.4.20-3.el6_6.s390x.rpm postgresql-test-8.4.20-3.el6_6.s390x.rpm x86_64: postgresql-8.4.20-3.el6_6.i686.rpm postgresql-8.4.20-3.el6_6.x86_64.rpm postgresql-contrib-8.4.20-3.el6_6.x86_64.rpm postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-debuginfo-8.4.20-3.el6_6.x86_64.rpm postgresql-devel-8.4.20-3.el6_6.i686.rpm postgresql-devel-8.4.20-3.el6_6.x86_64.rpm postgresql-docs-8.4.20-3.el6_6.x86_64.rpm postgresql-libs-8.4.20-3.el6_6.i686.rpm postgresql-libs-8.4.20-3.el6_6.x86_64.rpm postgresql-plperl-8.4.20-3.el6_6.x86_64.rpm postgresql-plpython-8.4.20-3.el6_6.x86_64.rpm postgresql-pltcl-8.4.20-3.el6_6.x86_64.rpm postgresql-server-8.4.20-3.el6_6.x86_64.rpm postgresql-test-8.4.20-3.el6_6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: postgresql-8.4.20-3.el6_6.src.rpm i386: postgresql-8.4.20-3.el6_6.i686.rpm postgresql-contrib-8.4.20-3.el6_6.i686.rpm postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-devel-8.4.20-3.el6_6.i686.rpm postgresql-docs-8.4.20-3.el6_6.i686.rpm postgresql-libs-8.4.20-3.el6_6.i686.rpm postgresql-plperl-8.4.20-3.el6_6.i686.rpm postgresql-plpython-8.4.20-3.el6_6.i686.rpm postgresql-pltcl-8.4.20-3.el6_6.i686.rpm postgresql-server-8.4.20-3.el6_6.i686.rpm postgresql-test-8.4.20-3.el6_6.i686.rpm x86_64: postgresql-8.4.20-3.el6_6.i686.rpm postgresql-8.4.20-3.el6_6.x86_64.rpm postgresql-contrib-8.4.20-3.el6_6.x86_64.rpm postgresql-debuginfo-8.4.20-3.el6_6.i686.rpm postgresql-debuginfo-8.4.20-3.el6_6.x86_64.rpm postgresql-devel-8.4.20-3.el6_6.i686.rpm postgresql-devel-8.4.20-3.el6_6.x86_64.rpm postgresql-docs-8.4.20-3.el6_6.x86_64.rpm postgresql-libs-8.4.20-3.el6_6.i686.rpm postgresql-libs-8.4.20-3.el6_6.x86_64.rpm postgresql-plperl-8.4.20-3.el6_6.x86_64.rpm postgresql-plpython-8.4.20-3.el6_6.x86_64.rpm postgresql-pltcl-8.4.20-3.el6_6.x86_64.rpm postgresql-server-8.4.20-3.el6_6.x86_64.rpm postgresql-test-8.4.20-3.el6_6.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): Source: postgresql-9.2.13-1.el7_1.src.rpm x86_64: postgresql-9.2.13-1.el7_1.i686.rpm postgresql-9.2.13-1.el7_1.x86_64.rpm postgresql-contrib-9.2.13-1.el7_1.x86_64.rpm postgresql-debuginfo-9.2.13-1.el7_1.i686.rpm postgresql-debuginfo-9.2.13-1.el7_1.x86_64.rpm postgresql-devel-9.2.13-1.el7_1.i686.rpm postgresql-devel-9.2.13-1.el7_1.x86_64.rpm postgresql-docs-9.2.13-1.el7_1.x86_64.rpm postgresql-libs-9.2.13-1.el7_1.i686.rpm postgresql-libs-9.2.13-1.el7_1.x86_64.rpm postgresql-plperl-9.2.13-1.el7_1.x86_64.rpm postgresql-plpython-9.2.13-1.el7_1.x86_64.rpm postgresql-pltcl-9.2.13-1.el7_1.x86_64.rpm postgresql-server-9.2.13-1.el7_1.x86_64.rpm postgresql-test-9.2.13-1.el7_1.x86_64.rpm postgresql-upgrade-9.2.13-1.el7_1.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: postgresql-9.2.13-1.el7_1.src.rpm x86_64: postgresql-9.2.13-1.el7_1.x86_64.rpm postgresql-debuginfo-9.2.13-1.el7_1.i686.rpm postgresql-debuginfo-9.2.13-1.el7_1.x86_64.rpm postgresql-libs-9.2.13-1.el7_1.i686.rpm postgresql-libs-9.2.13-1.el7_1.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: postgresql-9.2.13-1.el7_1.i686.rpm postgresql-contrib-9.2.13-1.el7_1.x86_64.rpm postgresql-debuginfo-9.2.13-1.el7_1.i686.rpm postgresql-debuginfo-9.2.13-1.el7_1.x86_64.rpm postgresql-devel-9.2.13-1.el7_1.i686.rpm postgresql-devel-9.2.13-1.el7_1.x86_64.rpm postgresql-docs-9.2.13-1.el7_1.x86_64.rpm postgresql-plperl-9.2.13-1.el7_1.x86_64.rpm postgresql-plpython-9.2.13-1.el7_1.x86_64.rpm postgresql-pltcl-9.2.13-1.el7_1.x86_64.rpm postgresql-server-9.2.13-1.el7_1.x86_64.rpm postgresql-test-9.2.13-1.el7_1.x86_64.rpm postgresql-upgrade-9.2.13-1.el7_1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: postgresql-9.2.13-1.el7_1.src.rpm ppc64: postgresql-9.2.13-1.el7_1.ppc.rpm postgresql-9.2.13-1.el7_1.ppc64.rpm postgresql-contrib-9.2.13-1.el7_1.ppc64.rpm postgresql-debuginfo-9.2.13-1.el7_1.ppc.rpm postgresql-debuginfo-9.2.13-1.el7_1.ppc64.rpm postgresql-devel-9.2.13-1.el7_1.ppc.rpm postgresql-devel-9.2.13-1.el7_1.ppc64.rpm postgresql-docs-9.2.13-1.el7_1.ppc64.rpm postgresql-libs-9.2.13-1.el7_1.ppc.rpm postgresql-libs-9.2.13-1.el7_1.ppc64.rpm postgresql-plperl-9.2.13-1.el7_1.ppc64.rpm postgresql-plpython-9.2.13-1.el7_1.ppc64.rpm postgresql-pltcl-9.2.13-1.el7_1.ppc64.rpm postgresql-server-9.2.13-1.el7_1.ppc64.rpm postgresql-test-9.2.13-1.el7_1.ppc64.rpm s390x: postgresql-9.2.13-1.el7_1.s390.rpm postgresql-9.2.13-1.el7_1.s390x.rpm postgresql-contrib-9.2.13-1.el7_1.s390x.rpm postgresql-debuginfo-9.2.13-1.el7_1.s390.rpm postgresql-debuginfo-9.2.13-1.el7_1.s390x.rpm postgresql-devel-9.2.13-1.el7_1.s390.rpm postgresql-devel-9.2.13-1.el7_1.s390x.rpm postgresql-docs-9.2.13-1.el7_1.s390x.rpm postgresql-libs-9.2.13-1.el7_1.s390.rpm postgresql-libs-9.2.13-1.el7_1.s390x.rpm postgresql-plperl-9.2.13-1.el7_1.s390x.rpm postgresql-plpython-9.2.13-1.el7_1.s390x.rpm postgresql-pltcl-9.2.13-1.el7_1.s390x.rpm postgresql-server-9.2.13-1.el7_1.s390x.rpm postgresql-test-9.2.13-1.el7_1.s390x.rpm x86_64: postgresql-9.2.13-1.el7_1.i686.rpm postgresql-9.2.13-1.el7_1.x86_64.rpm postgresql-contrib-9.2.13-1.el7_1.x86_64.rpm postgresql-debuginfo-9.2.13-1.el7_1.i686.rpm postgresql-debuginfo-9.2.13-1.el7_1.x86_64.rpm postgresql-devel-9.2.13-1.el7_1.i686.rpm postgresql-devel-9.2.13-1.el7_1.x86_64.rpm postgresql-docs-9.2.13-1.el7_1.x86_64.rpm postgresql-libs-9.2.13-1.el7_1.i686.rpm postgresql-libs-9.2.13-1.el7_1.x86_64.rpm postgresql-plperl-9.2.13-1.el7_1.x86_64.rpm postgresql-plpython-9.2.13-1.el7_1.x86_64.rpm postgresql-pltcl-9.2.13-1.el7_1.x86_64.rpm postgresql-server-9.2.13-1.el7_1.x86_64.rpm postgresql-test-9.2.13-1.el7_1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: postgresql-9.2.13-1.ael7b_1.src.rpm ppc64le: postgresql-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-contrib-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-debuginfo-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-devel-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-docs-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-libs-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-plperl-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-plpython-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-pltcl-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-server-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-test-9.2.13-1.ael7b_1.ppc64le.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: postgresql-debuginfo-9.2.13-1.el7_1.ppc64.rpm postgresql-upgrade-9.2.13-1.el7_1.ppc64.rpm s390x: postgresql-debuginfo-9.2.13-1.el7_1.s390x.rpm postgresql-upgrade-9.2.13-1.el7_1.s390x.rpm x86_64: postgresql-debuginfo-9.2.13-1.el7_1.x86_64.rpm postgresql-upgrade-9.2.13-1.el7_1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64le: postgresql-debuginfo-9.2.13-1.ael7b_1.ppc64le.rpm postgresql-upgrade-9.2.13-1.ael7b_1.ppc64le.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: postgresql-9.2.13-1.el7_1.src.rpm x86_64: postgresql-9.2.13-1.el7_1.i686.rpm postgresql-9.2.13-1.el7_1.x86_64.rpm postgresql-contrib-9.2.13-1.el7_1.x86_64.rpm postgresql-debuginfo-9.2.13-1.el7_1.i686.rpm postgresql-debuginfo-9.2.13-1.el7_1.x86_64.rpm postgresql-devel-9.2.13-1.el7_1.i686.rpm postgresql-devel-9.2.13-1.el7_1.x86_64.rpm postgresql-docs-9.2.13-1.el7_1.x86_64.rpm postgresql-libs-9.2.13-1.el7_1.i686.rpm postgresql-libs-9.2.13-1.el7_1.x86_64.rpm postgresql-plperl-9.2.13-1.el7_1.x86_64.rpm postgresql-plpython-9.2.13-1.el7_1.x86_64.rpm postgresql-pltcl-9.2.13-1.el7_1.x86_64.rpm postgresql-server-9.2.13-1.el7_1.x86_64.rpm postgresql-test-9.2.13-1.el7_1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: postgresql-debuginfo-9.2.13-1.el7_1.x86_64.rpm postgresql-upgrade-9.2.13-1.el7_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-3165 https://access.redhat.com/security/cve/CVE-2015-3166 https://access.redhat.com/security/cve/CVE-2015-3167 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVkXYEXlSAg2UNWIIRAqPyAJ4+oNPb8x+Rv86xVfq+hr0l7wvbBgCgrstj JLgqt0VKrW96edx3scvrmV0= =I50/ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-09-16-4 OS X Server 5.0.3 OS X Server 5.0.3 is now available and addresses the following: apache Available for: OS X Yosemite v10.10.4 or later Impact: Multiple vulnerabilities in Apache, the most serious of which may allow a remote attacker to cause a denial of service Description: Multiple vulnerabilities existed in Apache versions prior to 2.4.16. These issues were addressed by updating Apache to version 2.4.16. CVE-ID CVE-2013-5704 CVE-2014-3581 CVE-2014-3583 CVE-2014-8109 CVE-2015-0228 CVE-2015-0253 CVE-2015-3183 CVE-2015-3185 BIND Available for: OS X Yosemite v10.10.4 or later Impact: Multiple vulnerabilities in BIND, the most severe of which may allow a remote attacker to cause a denial of service Description: Multiple vulnerabilities existed in BIND versions prior to 9.9.7. These issues were addressed by updating BIND to version 9.9.7. These issues were addressed by updating PostgreSQL to version 9.3.9. CVE-ID CVE-2014-0067 CVE-2014-8161 CVE-2015-0241 CVE-2015-0242 CVE-2015-0243 CVE-2015-0244 CVE-2015-3165 CVE-2015-3166 CVE-2015-3167 Wiki Server Available for: OS X Yosemite v10.10.4 or later Impact: Multiple XML security issues in Wiki Server Description: Multiple XML vulnerabilities existed in Wiki Server based on Twisted. This issue was addressed by removing Twisted. CVE-ID CVE-2015-5911 : Zachary Jones of WhiteHat Security Threat Research Center OS X Server 5.0.3 may be obtained from the Mac App Store. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201507-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PostgreSQL: Multiple vulnerabilities Date: July 18, 2015 Bugs: #539018, #550172 ID: 201507-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in PostgreSQL, the worst of which could result in execution of arbitrary code or privilege escalation. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-db/postgresql < 9.4.3 *>= 9.0.21 *>= 9.1.17 *>= 9.2.12 *>= 9.3.8 >= 9.4.3 Description =========== Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition or escalate privileges. Workaround ========== There is no known workaround at this time. Resolution ========== All PostgreSQL 9.0.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.0.21" All PostgreSQL 9.1.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.1.17" All PostgreSQL 9.2.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.2.12" All PostgreSQL 9.3.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.3.8" All PostgreSQL 9.4.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.4.3" References ========== [ 1 ] CVE-2014-8161 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8161 [ 2 ] CVE-2015-0241 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0241 [ 3 ] CVE-2015-0242 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0242 [ 4 ] CVE-2015-0243 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0243 [ 5 ] CVE-2015-0244 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0244 [ 6 ] CVE-2015-3165 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3165 [ 7 ] CVE-2015-3166 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3166 [ 8 ] CVE-2015-3167 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3167 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201507-20 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version. Schneider Electric OFS Contains a vulnerability related to uncontrolled search path elements.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Schneider Electric OPC Factory Server (OFS) is a data communication editing software. The software supports important information access, open page design, transparent architecture and interoperability, etc., to enable users to obtain good processes and communication effects. Schneider Electric OFS has security vulnerabilities in loading DLLs, allowing remote attackers to use the vulnerabilities to submit special files and load them to execute arbitrary code

SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes: 2152278. SAP Sybase Adaptive Server Enterprise is a relational database management system. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database

The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022. Vendors report this vulnerability Bug ID CSCut62022 Published as. Supplementary information : CWE Vulnerability types by CWE-254: Security Features ( Security features ) Has been identified. http://cwe.mitre.org/data/definitions/254.htmlDenial of service due to many requests sent by third parties (API Stop ) May be in a state. An attacker can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. The solution supports certification revocation list (CRL), device access permission setting and user profile verification, etc

SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input. Emerson Electric AMS Device Manager is a set of fixed asset management software. The software provides predictive diagnostics, device configuration management and more. The attacker can submit the malformed input to the affected software. This vulnerability can be used to access the application and its data files with administrator privileges. An authenticated attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database

The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack. python-kerberos Contains an authentication vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. python-kerberos is prone to an information disclosure vulnerability. Attackers can exploit this issue to disclose potentially sensitive information through man-in-the-middle attacks. This may aid in further attacks. python-kerberos is a plug-in for authenticating the Kerberos network protocol (computer network authorization protocol) in the open source cloud technology OpenStack client. There is a security vulnerability in the 'checkPassword' function in python-kerberos

ZTE AC3633R is a wireless modem product of China ZTE Corporation. An authentication bypass vulnerability and remote code execution vulnerability exist in ZTE AC3633R. An attacker could use these vulnerabilities to gain unauthorized access to an affected device and execute arbitrary code in the context of the affected device. It may also cause a denial of service. Failed exploit attempts may result in a denial-of-service condition

Hikvision DS-7108HWI-SH is a digital video recorder product of China Hikvision. Hikvision DS-7108HWI-SH has an XML external entity injection vulnerability. An attacker could use this vulnerability to obtain potentially sensitive information or cause a denial of service. This may lead to further attacks

Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596. Vendors have confirmed this vulnerability Bug ID CSCut04596 It is released as.A third party may be able to hijack the authentication of any user. Exploiting these issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected user. Other attacks are also possible. These issues are being tracked by Cisco bug ID's CSCut04596, CSCuw95626 and CSCva27600. The platform provides functions such as secure access authentication and real-time fault analysis

The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registration, which allows remote attackers to cause a denial of service (forwarding outage) via a crafted multicast packet, aka Bug ID CSCus74398. Vendors have confirmed this vulnerability Bug ID CSCus74398 It is released as. Supplementary information : CWE Vulnerability type by CWE-17: Code ( code ) Has been identified. http://cwe.mitre.org/data/definitions/17.htmlDenial of service operation via a specially crafted multicast packet by a third party ( Transfer stop ) There is a possibility of being put into a state. Cisco Adaptive Security Appliance Software is prone to a denial-of-service vulnerability. An attacker can exploit this issue to trigger a denial-of condition, denying service to legitimate users. Protocol Independent Multicast (PIM) application is a collection of multicast routing protocols. The vulnerability stems from the program not properly implementing the multicast-forwarding registration function. The following releases are affected: Cisco ASA Software Release 9.2(0.0), Release 9.2(0.104), Release 9.2(3.1), Release 9.2(3.4), Release 9.3(1.105), Release 9.3(2.100), Release 9.4(0.115), 100.13(0.21) version, 100.13(20.3) version, 100.13(21.9) version, 100.14(1.1) version

The tzdriver module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users to gain privileges or cause a denial of service (memory corruption) via an unspecified input. Huawei Mate 7 (Mate7-TL10) Smartphones contain a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Huawei Mate 7 is a smartphone developed by Huawei in China. Huawei Mate 7 Smartphone is prone to multiple local privilege escalation vulnerabilities. The tzdriver module is one of the driver modules

The TEEOS module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users with root permissions to gain privileges or cause a denial of service (memory corruption) via a crafted application. Huawei Mate 7 (Mate7-TL10) Smartphones contain a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Huawei Mate 7 is a smartphone developed by Huawei in China. A security vulnerability exists on the Huawei Mate 7 TEEOS module, allowing local attackers to exploit the vulnerability to increase privileges. Huawei Mate 7 Smartphone is prone to multiple local privilege escalation vulnerabilities. TEEOS module is one of the TEEOS modules. Attackers can use this vulnerability to cause denial of service (TEEOS crash) or implant and execute malicious code in TEEOS by obtaining the root privilege of the Android system and passing an abnormal address to TEEOS

Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR products, TP-LINK products, and other products, allows remote attackers to execute arbitrary code by providing a long computer name in a session on TCP port 20005. KCodes NetUSB is vulnerable to a buffer overflow via the network that may result in a denial of service or code execution. KCodes NetUSB The kernel driver contains a buffer overflow vulnerability. KCodes NetUSB Is Linux Connected to base embedded devices (home router products, etc.) USB Share devices on the network "USB over IP" To realize the function, Linux Kernel module. Buffer overflow (CWE-120) - CVE-2015-3036 http://cwe.mitre.org/data/definitions/120.html The client NetUSB The data to send when connecting to the server NetUSB A buffer overflow can occur because the kernel driver does not validate properly. For more information SEC Consult Please check the advisory for. SEC Consult Vulnerability Lab Security Advisory < 20150519-0 > https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150519-0_KCodes_NetUSB_Kernel_Stack_Buffer_Overflow_v10.txt In addition, National Vulnerability Database (NVD) Then CWE-119 It is published as CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer ( Buffer error ) http://cwe.mitre.org/data/definitions/119.htmlAn attacker on the local network caused a buffer overflow, resulting in a denial of service operation (DoS) An attacker may be able to attack or execute arbitrary code. Depending on the default settings of the device, a remote attack may be possible. KCodes NetUSB is prone to a buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition. SEC Consult Vulnerability Lab Security Advisory < 20150519-0 > ======================================================================= title: Kernel Stack Buffer Overflow product: KCodes NetUSB vulnerable version: see Vulnerable / tested versions fixed version: see Solution CVE number: CVE-2015-3036, VU#177092 impact: Critical homepage: http://www.kcodes.com/ found: 2015-02-23 by: Stefan Viehböck (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult Berlin - Frankfurt/Main - Montreal - Singapore Vienna (HQ) - Vilnius - Zurich https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "The world's premier technology provider of mobile printing, audio and video communication, file sharing, and USB applications for iPhones, iPads, smart phones and tablets (Android and Windows), MacBooks, and Ultrabooks." Source: http://www.kcodes.com/ Vulnerability overview/description: ----------------------------------- NetUSB suffers from a remotely exploitable kernel stack buffer overflow. Because of insufficient input validation, an overly long computer name can be used to overflow the "computer name" kernel stack buffer. This results in memory corruption which can be turned into arbitrary remote code execution. Furthermore, a more detailed summary of this advisory has been published at our blog: http://blog.sec-consult.com Proof of concept: ----------------- Below is an excerpt from the vulnerable run_init_sbus() function (pseudo code): int computername_len; char computername_buf[64]; // connection initiation, handshake len = ks_recv(sock, &computername_len, 4, 0); // ... len = ks_recv(sock, computername_buf, computername_len, 0); // boom! A proof of concept "netusb_bof.py" has been developed which exploits the vulnerability. The PoC DoS exploit will not be published as many vendors did not patch the vulnerability yet. Example use that results in denial-of-service (kernel memory corruption that results in a device reboot): ./netusb_bof.py 192.168.1.1 20005 500 Vulnerable / tested versions: ----------------------------- The vulnerability has been verified to exist in most recent firmware versions of the following devives: TP-Link TL-WDR4300 V1 TP-Link WR1043ND v2 NETGEAR WNDR4500 Furthermore we've identified NetUSB in the most recent firmware version of the following products (list is not necessarily complete!): D-Link DIR-615 C NETGEAR AC1450 NETGEAR CENTRIA (WNDR4700/4720) NETGEAR D6100 NETGEAR D6200 NETGEAR D6300 NETGEAR D6400 NETGEAR DC112A NETGEAR DC112A (Zain) NETGEAR DGND4000 NETGEAR EX6200 NETGEAR EX7000 NETGEAR JNR3000 NETGEAR JNR3210 NETGEAR JR6150 NETGEAR LG6100D NETGEAR PR2000 NETGEAR R6050 NETGEAR R6100 NETGEAR R6200 NETGEAR R6200v2 NETGEAR R6220 NETGEAR R6250 NETGEAR R6300v1 NETGEAR R6300v2 NETGEAR R6700 NETGEAR R7000 NETGEAR R7500 NETGEAR R7900 NETGEAR R8000 NETGEAR WN3500RP NETGEAR WNDR3700v5 NETGEAR WNDR4300 NETGEAR WNDR4300v2 NETGEAR WNDR4500 NETGEAR WNDR4500v2 NETGEAR WNDR4500v3 NETGEAR XAU2511 NETGEAR XAUB2511 TP-LINK Archer C2 V1.0 (Fix planned before 2015/05/22) TP-LINK Archer C20 V1.0 (Not affected) TP-LINK Archer C20i V1.0 (Fix planned before 2015/05/25) TP-LINK Archer C5 V1.2 (Fix planned before 2015/05/22) TP-LINK Archer C5 V2.0 (Fix planned before 2015/05/30) TP-LINK Archer C7 V1.0 (Fix planned before 2015/05/30) TP-LINK Archer C7 V2.0 (Fix already released) TP-LINK Archer C8 V1.0 (Fix planned before 2015/05/30) TP-LINK Archer C9 V1.0 (Fix planned before 2015/05/22) TP-LINK Archer D2 V1.0 (Fix planned before 2015/05/22) TP-LINK Archer D5 V1.0 (Fix planned before 2015/05/25) TP-LINK Archer D7 V1.0 (Fix planned before 2015/05/25) TP-LINK Archer D7B V1.0 (Fix planned before 2015/05/31) TP-LINK Archer D9 V1.0 (Fix planned before 2015/05/25) TP-LINK Archer VR200v V1.0 (Fix already released) TP-LINK TD-VG3511 V1.0 (End-Of-Life) TP-LINK TD-VG3631 V1.0 (Fix planned before 2015/05/30) TP-LINK TD-VG3631 V1.0 (Fix planned before 2015/05/31) TP-LINK TD-W1042ND V1.0 (End-Of-Life) TP-LINK TD-W1043ND V1.0 (End-Of-Life) TP-LINK TD-W8968 V1.0 (Fix planned before 2015/05/30) TP-LINK TD-W8968 V2.0 (Fix planned before 2015/05/30) TP-LINK TD-W8968 V3.0 (Fix planned before 2015/05/25) TP-LINK TD-W8970 V1.0 (Fix planned before 2015/05/30) TP-LINK TD-W8970 V3.0 (Fix already released) TP-LINK TD-W8970B V1.0 (Fix planned before 2015/05/30) TP-LINK TD-W8980 V3.0 (Fix planned before 2015/05/25) TP-LINK TD-W8980B V1.0 (Fix planned before 2015/05/30) TP-LINK TD-W9980 V1.0 (Fix already released) TP-LINK TD-W9980B V1.0 (Fix planned before 2015/05/30) TP-LINK TD-WDR4900 V1.0 (End-Of-Life) TP-LINK TL-WR1043ND V2.0 (Fix planned before 2015/05/30) TP-LINK TL-WR1043ND V3.0 (Fix planned before 2015/05/30) TP-LINK TL-WR1045ND V2.0 (Fix planned before 2015/05/30) TP-LINK TL-WR3500 V1.0 (Fix planned before 2015/05/22) TP-LINK TL-WR3600 V1.0 (Fix planned before 2015/05/22) TP-LINK TL-WR4300 V1.0 (Fix planned before 2015/05/22) TP-LINK TL-WR842ND V2.0 (Fix planned before 2015/05/30) TP-LINK TL-WR842ND V1.0 (End-Of-Life) TP-LINK TX-VG1530(GPON) V1.0 (Fix planned before 2015/05/31) Trendnet TE100-MFP1 (v1.0R) Trendnet TEW-632BRP (A1.0R) Trendnet TEW-632BRP (A1.1R/A1.2R) Trendnet TEW-632BRP (A1.1R/A1.2R/A1.3R) Trendnet TEW-634GRU (v1.0R) Trendnet TEW-652BRP (V1.0R) Trendnet TEW-673GRU (v1.0R) Trendnet TEW-811DRU (v1.0R) Trendnet TEW-812DRU (v1.0R) Trendnet TEW-812DRU (v2.xR) Trendnet TEW-813DRU (v1.0R) Trendnet TEW-818DRU (v1.0R) Trendnet TEW-823DRU (v1.0R) Trendnet TEW-MFP1 (v1.0R) Zyxel NBG-419N v2 Zyxel NBG4615 v2 Zyxel NBG5615 Zyxel NBG5715 Based on information embedded in KCodes drivers we believe the following vendors are affected: Allnet Ambir Technology AMIT Asante Atlantis Corega Digitus D-Link EDIMAX Encore Electronics Engenius Etop Hardlink Hawking IOGEAR LevelOne Longshine NETGEAR PCI PROLiNK Sitecom Taifa TP-LINK TRENDnet Western Digital ZyXEL Vendor contact timeline: ------------------------ 2015-02-28: Contacting vendor through support@kcodes.com 2015-03-04: No response, contacting various KCodes addresses found on the web. 2015-03-05: Vendor responds, requests more information. 2015-03-05: Providing advisory and proof of concept exploit. 2015-03-16: No response, requesting status update. 2015-03-16: Vendor responds, asks about fix verification(?) 2015-03-16: Requesting clarification about fixing status and information about next steps. Proposing conference call dates. 2015-03-19: No response, informing that notification of CERT/CC and selected vendors will start shortly. Requesting clarification about fixing status and information about next steps again. 2015-03-19: Vendor responds, confirms conference call date (2015-03-25). No further information provided. 2015-03-19: Providing advisory and proof of concept exploit to TP-LINK and NETGEAR. 2015-03-25: Vendor cancels conference call on short notice (sudden week-long business trip). 2015-03-26: Asking for support of CERT/CC regarding vendor coordination. 2015-03 - 2015-05: Coordination between CERT & vendors, NETGEAR and TP-LINK 2015-05-13: Notifying German CERT-Bund and Austrian CERT.at 2015-05-19: Coordinated release of security advisory Solution: --------- TP-LINK has started releasing fixed firmware. The status of affected products can be found in the affected product list above. For additional information also see CERT/CC vulnerability notice: http://www.kb.cert.org/vuls/id/177092 Workaround: ----------- Sometimes NetUSB can be disabled via the web interface, but at least on NETGEAR devices this does not mitigate the vulnerability. NETGEAR told us, that there is no workaround available, the TCP port can't be firewalled nor is there a way to disable the service on their devices. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/Career.htm Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/About/Contact.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF Stefan Viehböck / @2015

racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests. Supplementary information : CWE Vulnerability type by CWE-476: NULL Pointer Dereference (NULL Pointer dereference ) Has been identified. IPsec-Tools is a user-space implementation of different IPSec. It is ported from KAME's libipsec, setkey and racoon, and supports various BSD systems. A remote attacker could use this vulnerability to cause a program to deny legitimate users. IPsec-Tools is prone to a denial-of-service vulnerability caused by a NULL-pointer dereference error. A security vulnerability exists in the racoon/gssapi.c file of IPsec-Tools version 0.8.2. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3272-1 security@debian.org http://www.debian.org/security/ Salvatore Bonaccorso May 23, 2015 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : ipsec-tools CVE ID : CVE-2015-4047 Debian Bug : 785778 Javantea discovered a NULL pointer dereference flaw in racoon, the Internet Key Exchange daemon of ipsec-tools. For the oldstable distribution (wheezy), this problem has been fixed in version 1:0.8.0-14+deb7u1. For the stable distribution (jessie), this problem has been fixed in version 1:0.8.2+20140711-2+deb8u1. For the testing distribution (stretch) and the unstable distribution (sid), this problem will be fixed soon. We recommend that you upgrade your ipsec-tools packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJVYJAbAAoJEAVMuPMTQ89E5RUP/j3MueAGYFpUSwLT3P+kHrSS pxdL5RBqQSXytrcejPyFkaKuva9juPLznlkeXGC5QsTRV/ROAq7ZAVWeIH2qD3X0 BPtF4vILr+5kSrDYbd0dSTx8Wl4Ykk678JSzFQ3lHdzK+4703X5YzT0/YJJaBbEh lWb2QuoDw8eHOGHpGJkRVZYp9nOTllZUmj2IasDFB9IQgQxnAoMmAaQ47MrOYhk3 R+UO9A5eYX1Rs4hiTu0+hhfkYG+DbrtN5uAh205SgLoOHf3lEAhRXifJiBMtKO72 tWsXSZ4Tks89hg6++DSIdsH4l6i56bolHid9DOD4/ivnZzB61k0XjCb8Qn/g850h 0Kxge2kmuQZk2VvomzddWAQLaij6fHSZqgZsL37L46158UJE9Q199oshK+3Mbzoc dq2VbwClQKYcGSBB+AoxwXGVd4JLMGDQxbDKGELlGF4JROfSmMtYbhKpVNnm9+32 o/dqr3BHqLf297uUzsTer92Vc5pfYZEU1lMo1KjleNSRjeWBo91IqsNODrxr6rXw L0ewYQBSRKx9Vg8SRviNCE/muVN+u2HULNZytoiEaI3GXrPbAqjdOi3yVP+PSYEr hISRrhZgGQgADT1gBExBnbSf2C7R00M7jRHhpRdVsqETpMlb2LgKEiCBFRYSMMw5 LCzQhezRPnKq4umUHL0n =Ksk8 -----END PGP SIGNATURE----- . ============================================================================ Ubuntu Security Notice USN-2623-1 June 01, 2015 ipsec-tools vulnerability ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS Summary: ipsec-tools could be made to crash if it received specially crafted network traffic. Software Description: - ipsec-tools: IPsec tools for Linux Details: It was discovered that racoon, the ipsec-tools IKE daemon, incorrectly handled certain UDP packets. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: racoon 1:0.8.0-9ubuntu1.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2623-1 CVE-2015-4047 Package Information: https://launchpad.net/ubuntu/+source/ipsec-tools/1:0.8.0-9ubuntu1.1