VARIoT IoT vulnerabilities database

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue. OpenSSL of s23_srvr.c Inside ssl23_get_client_hello Functions include TLS1.0 A vulnerability exists that forces the use of. OpenSSL is prone to security-bypass vulnerability. Successfully exploiting these issues may allow attackers to perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks. OpenSSL 1.0.1 versions prior to 1.0.1i are vulnerable. OpenSSL Security Advisory [6 Aug 2014] ======================================== Information leak in pretty printing functions (CVE-2014-3508) ============================================================= A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex et al. to leak some information from the stack. Applications may be affected if they echo pretty printing output to the attacker. OpenSSL SSL/TLS clients and servers themselves are not affected. OpenSSL 0.9.8 users should upgrade to 0.9.8zb OpenSSL 1.0.0 users should upgrade to 1.0.0n. OpenSSL 1.0.1 users should upgrade to 1.0.1i. Thanks to Ivan Fratric (Google) for discovering this issue. This issue was reported to OpenSSL on 19th June 2014. The fix was developed by Emilia Käsper and Stephen Henson of the OpenSSL development team. This can be exploited through a Denial of Service attack. OpenSSL 1.0.1 SSL/TLS client users should upgrade to 1.0.1i. Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for discovering and researching this issue. This issue was reported to OpenSSL on 2nd July 2014. The fix was developed by Stephen Henson of the OpenSSL core team. OpenSSL 1.0.0 SSL/TLS client users should upgrade to 1.0.0n. OpenSSL 1.0.1 SSL/TLS client users should upgrade to 1.0.1i. Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this issue. This issue was reported to OpenSSL on 8th July 2014. The fix was developed by Gabor Tyukasz. Double Free when processing DTLS packets (CVE-2014-3505) ======================================================== An attacker can force an error condition which causes openssl to crash whilst processing DTLS packets due to memory being freed twice. This can be exploited through a Denial of Service attack. OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8zb OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0n. OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1i. Thanks to Adam Langley and Wan-Teh Chang (Google) for discovering and researching this issue. This issue was reported to OpenSSL on 6th June 2014. The fix was developed by Adam Langley. This can be exploited through a Denial of Service attack. OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8zb OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0n. OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1i. Thanks to Adam Langley (Google) for discovering and researching this issue. This issue was reported to OpenSSL on 6th June 2014. The fix was developed by Adam Langley. This can be exploited through a Denial of Service attack. OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8zb OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0n. OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1i. Thanks to Adam Langley (Google) for discovering and researching this issue. This issue was reported to OpenSSL on 6th June 2014. The fix was developed by Adam Langley. OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) =============================================================== OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an anonymous (EC)DH ciphersuite and sending carefully crafted handshake messages. OpenSSL 0.9.8 DTLS client users should upgrade to 0.9.8zb OpenSSL 1.0.0 DTLS client users should upgrade to 1.0.0n. OpenSSL 1.0.1 DTLS client users should upgrade to 1.0.1i. Thanks to Felix Gröbert (Google) for discovering and researching this issue. This issue was reported to OpenSSL on 18th July 2014. The fix was developed by Emilia Käsper of the OpenSSL development team. OpenSSL 1.0.1 SSL/TLS server users should upgrade to 1.0.1i. Thanks to David Benjamin and Adam Langley (Google) for discovering and researching this issue. This issue was reported to OpenSSL on 21st July 2014. The fix was developed by David Benjamin. SRP buffer overrun (CVE-2014-3512) ================================== A malicious client or server can send invalid SRP parameters and overrun an internal buffer. Only applications which are explicitly set up for SRP use are affected. OpenSSL 1.0.1 SSL/TLS users should upgrade to 1.0.1i. Thanks to Sean Devlin and Watson Ladd (Cryptography Services, NCC Group) for discovering this issue. This issue was reported to OpenSSL on 31st July 2014. The fix was developed by Stephen Henson of the OpenSSL core team. References ========== URL for this Security Advisory: https://www.openssl.org/news/secadv_20140806.txt Note: the online version of the advisory may be updated with additional details over time. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04512909 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04512909 Version: 2 HPSBMU03216 rev.2 - HP Service Manager running SSLv3, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2015-01-22 Last Updated: 2015-01-23 Potential Security Impact: Remote Denial of Service (DoS), unauthorized access, disclosure of information Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP Service Manager running SSLv3. The vulnerabilities could be exploited remotely resulting in Denial of Service (DoS), unauthorized access or disclosure of information. References: CVE-2014-0224 Remote Unauthorized Access, Disclosure of Information CVE-2014-3509 Remote Denial of Service (DoS) CVE-2014-3511 Remote Unauthorized Access, Disclosure of Information CVE-2014-5139 Remote Denial of Service (DoS) SSRT101818 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. ServiceCenter 6.2 Service Manager 7.10 Service Manager 7.11 Service Manager 9.20 Service Manager 9.21 Service Manager 9.30 Service Manager 9.31 Service Manager 9.32 Service Manager 9.33 Service Manager 9.34 Note: not impacted by CVE-2014-0224 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-0224 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8 CVE-2014-3509 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8 CVE-2014-3511 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2014-5139 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has released the following software updates for HP Service Manager to resolve these vulnerabilities. Note: For versions not listed, please contact support: Note: ServiceCenter 6.2 is impacted only if using the Directory Services integration feature with the SC LDAP over SSL (LDAPS) protocol. If this feature is in use, HP recommends that ServiceCenter 6.2 customers upgrade to Service Manager 7.11, 9.21, or 9.34, and then apply the patches listed below. Patch Version Package Name / SSO URL SM711P22 AIX Server 7.11.720 p22 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00614 HP Itanium Server 7.11.720 p22 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00615 HP parisc Server 7.11.720 p22 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00616 Linux x86 Server 7.11.720 p22 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00617 Solaris Server 7.11.720 p22 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00618 Windows Server 7.11.720 p22 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00619 SM921P9 AIX server 9.21.706 P9 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00621 HPUX/IA server 9.21.706 P9 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00622 HPUX/PA server 9.21.706 P9 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00623 Linux server 9.21.706 P9 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00624 Solaris server 9.21.706 P9 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00625 Windows server 9.21.706 P9 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00626 SM934P2 AIX Server 9.34.2003 p2 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00605 HP Itanium Server 9.34.2003 p2 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00606 Linux Server 9.34.2003 p2 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00607 Solaris Server 9.34.2003 p2 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00608 Windows Server 9.34.2003 p2 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/LID/HPSM_00609 HISTORY Version:1 (rev.1) - 22 January 2015 Initial release Version:2 (rev.2) - 23 January 2015 added note for versions not listed in table. Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2015 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. Corrected: 2014-08-07 21:04:42 UTC (stable/10, 10.0-STABLE) 2014-09-09 10:09:46 UTC (releng/10.0, 10.0-RELEASE-p8) 2014-08-07 21:06:34 UTC (stable/9, 9.3-STABLE) 2014-09-09 10:13:46 UTC (releng/9.3, 9.3-RELEASE-p1) 2014-09-09 10:13:46 UTC (releng/9.2, 9.2-RELEASE-p11) 2014-09-09 10:13:46 UTC (releng/9.1, 9.1-RELEASE-p18) 2014-08-07 21:06:34 UTC (stable/8, 8.4-STABLE) 2014-09-09 10:13:46 UTC (releng/8.4, 8.4-RELEASE-p15) CVE Name: CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3510, CVE-2014-3509, CVE-2014-3511, CVE-2014-3512, CVE-2014-5139 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://security.FreeBSD.org/>. Background FreeBSD includes software from the OpenSSL Project. II. [CVE-2014-5139] III. Additionally, a remote attacker may be able to run arbitrary code on a vulnerable system if the application has been set up for SRP. IV. Workaround No workaround is available. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 10.0] # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-10.0.patch # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-10.0.patch.asc # gpg --verify openssl-10.0.patch.asc [FreeBSD 9.3] # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-9.3.patch # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-9.3.patch.asc # gpg --verify openssl-9.3.patch.asc [FreeBSD 9.2, 9.1, 8.4] # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-9.patch # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-9.patch.asc # gpg --verify openssl-9.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in <URL:http://www.FreeBSD.org/handbook/makeworld.html>. Restart all deamons using the library, or reboot the system. 3) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/8/ r269687 releng/8.4/ r271305 stable/9/ r269687 releng/9.1/ r271305 releng/9.2/ r271305 releng/9.3/ r271305 stable/10/ r269686 releng/10.0/ r271304 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: <URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN> VII. Detailed descriptions of the vulnerabilities can be found at: https://www.openssl.org/news/secadv_20140806.txt It's important that you upgrade the libssl1.0.0 package and not just the openssl package. Alternatively, you may reboot your system. For the stable distribution (wheezy), these problems have been fixed in version 1.0.1e-2+deb7u12. For the testing distribution (jessie), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 1.0.1i-1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: openssl security update Advisory ID: RHSA-2014:1052-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1052.html Issue date: 2014-08-13 CVE Names: CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 ===================================================================== 1. Summary: Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL), Transport Layer Security (TLS), and Datagram Transport Layer Security (DTLS) protocols, as well as a full-strength, general purpose cryptography library. A race condition was found in the way OpenSSL handled ServerHello messages with an included Supported EC Point Format extension. A malicious server could possibly use this flaw to cause a multi-threaded TLS/SSL client using OpenSSL to write into freed memory, causing the client to crash or execute arbitrary code. (CVE-2014-3509) It was discovered that the OBJ_obj2txt() function could fail to properly NUL-terminate its output. This could possibly cause an application using OpenSSL functions to format fields of X.509 certificates to disclose portions of its memory. (CVE-2014-3508) A flaw was found in the way OpenSSL handled fragmented handshake packets. (CVE-2014-3511) Multiple flaws were discovered in the way OpenSSL handled DTLS packets. A remote attacker could use these flaws to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory. (CVE-2014-3505, CVE-2014-3506, CVE-2014-3507) A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman (DH) key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled. (CVE-2014-3510) All OpenSSL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library (such as httpd and other SSL-enabled services) must be restarted or the system rebooted. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1127490 - CVE-2014-3508 openssl: information leak in pretty printing functions 1127498 - CVE-2014-3509 openssl: race condition in ssl_parse_serverhello_tlsext 1127499 - CVE-2014-3505 openssl: DTLS packet processing double free 1127500 - CVE-2014-3506 openssl: DTLS memory exhaustion 1127502 - CVE-2014-3507 openssl: DTLS memory leak from zero-length fragments 1127503 - CVE-2014-3510 openssl: DTLS anonymous (EC)DH denial of service 1127504 - CVE-2014-3511 openssl: TLS protocol downgrade attack 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: openssl-1.0.1e-16.el6_5.15.src.rpm i386: openssl-1.0.1e-16.el6_5.15.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm x86_64: openssl-1.0.1e-16.el6_5.15.i686.rpm openssl-1.0.1e-16.el6_5.15.x86_64.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: openssl-1.0.1e-16.el6_5.15.src.rpm i386: openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-devel-1.0.1e-16.el6_5.15.i686.rpm openssl-perl-1.0.1e-16.el6_5.15.i686.rpm openssl-static-1.0.1e-16.el6_5.15.i686.rpm x86_64: openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.x86_64.rpm openssl-devel-1.0.1e-16.el6_5.15.i686.rpm openssl-devel-1.0.1e-16.el6_5.15.x86_64.rpm openssl-perl-1.0.1e-16.el6_5.15.x86_64.rpm openssl-static-1.0.1e-16.el6_5.15.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: openssl-1.0.1e-16.el6_5.15.src.rpm x86_64: openssl-1.0.1e-16.el6_5.15.i686.rpm openssl-1.0.1e-16.el6_5.15.x86_64.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: openssl-1.0.1e-16.el6_5.15.src.rpm x86_64: openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.x86_64.rpm openssl-devel-1.0.1e-16.el6_5.15.i686.rpm openssl-devel-1.0.1e-16.el6_5.15.x86_64.rpm openssl-perl-1.0.1e-16.el6_5.15.x86_64.rpm openssl-static-1.0.1e-16.el6_5.15.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: openssl-1.0.1e-16.el6_5.15.src.rpm i386: openssl-1.0.1e-16.el6_5.15.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-devel-1.0.1e-16.el6_5.15.i686.rpm ppc64: openssl-1.0.1e-16.el6_5.15.ppc.rpm openssl-1.0.1e-16.el6_5.15.ppc64.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.ppc.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.ppc64.rpm openssl-devel-1.0.1e-16.el6_5.15.ppc.rpm openssl-devel-1.0.1e-16.el6_5.15.ppc64.rpm s390x: openssl-1.0.1e-16.el6_5.15.s390.rpm openssl-1.0.1e-16.el6_5.15.s390x.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.s390.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.s390x.rpm openssl-devel-1.0.1e-16.el6_5.15.s390.rpm openssl-devel-1.0.1e-16.el6_5.15.s390x.rpm x86_64: openssl-1.0.1e-16.el6_5.15.i686.rpm openssl-1.0.1e-16.el6_5.15.x86_64.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.x86_64.rpm openssl-devel-1.0.1e-16.el6_5.15.i686.rpm openssl-devel-1.0.1e-16.el6_5.15.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: openssl-1.0.1e-16.el6_5.15.src.rpm i386: openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-perl-1.0.1e-16.el6_5.15.i686.rpm openssl-static-1.0.1e-16.el6_5.15.i686.rpm ppc64: openssl-debuginfo-1.0.1e-16.el6_5.15.ppc64.rpm openssl-perl-1.0.1e-16.el6_5.15.ppc64.rpm openssl-static-1.0.1e-16.el6_5.15.ppc64.rpm s390x: openssl-debuginfo-1.0.1e-16.el6_5.15.s390x.rpm openssl-perl-1.0.1e-16.el6_5.15.s390x.rpm openssl-static-1.0.1e-16.el6_5.15.s390x.rpm x86_64: openssl-debuginfo-1.0.1e-16.el6_5.15.x86_64.rpm openssl-perl-1.0.1e-16.el6_5.15.x86_64.rpm openssl-static-1.0.1e-16.el6_5.15.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: openssl-1.0.1e-16.el6_5.15.src.rpm i386: openssl-1.0.1e-16.el6_5.15.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-devel-1.0.1e-16.el6_5.15.i686.rpm x86_64: openssl-1.0.1e-16.el6_5.15.i686.rpm openssl-1.0.1e-16.el6_5.15.x86_64.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.15.x86_64.rpm openssl-devel-1.0.1e-16.el6_5.15.i686.rpm openssl-devel-1.0.1e-16.el6_5.15.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: openssl-1.0.1e-16.el6_5.15.src.rpm i386: openssl-debuginfo-1.0.1e-16.el6_5.15.i686.rpm openssl-perl-1.0.1e-16.el6_5.15.i686.rpm openssl-static-1.0.1e-16.el6_5.15.i686.rpm x86_64: openssl-debuginfo-1.0.1e-16.el6_5.15.x86_64.rpm openssl-perl-1.0.1e-16.el6_5.15.x86_64.rpm openssl-static-1.0.1e-16.el6_5.15.x86_64.rpm Red Hat Enterprise Linux Client (v. 7): Source: openssl-1.0.1e-34.el7_0.4.src.rpm x86_64: openssl-1.0.1e-34.el7_0.4.x86_64.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.i686.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.x86_64.rpm openssl-libs-1.0.1e-34.el7_0.4.i686.rpm openssl-libs-1.0.1e-34.el7_0.4.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: openssl-debuginfo-1.0.1e-34.el7_0.4.i686.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.x86_64.rpm openssl-devel-1.0.1e-34.el7_0.4.i686.rpm openssl-devel-1.0.1e-34.el7_0.4.x86_64.rpm openssl-perl-1.0.1e-34.el7_0.4.x86_64.rpm openssl-static-1.0.1e-34.el7_0.4.i686.rpm openssl-static-1.0.1e-34.el7_0.4.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: openssl-1.0.1e-34.el7_0.4.src.rpm x86_64: openssl-1.0.1e-34.el7_0.4.x86_64.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.i686.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.x86_64.rpm openssl-libs-1.0.1e-34.el7_0.4.i686.rpm openssl-libs-1.0.1e-34.el7_0.4.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: openssl-debuginfo-1.0.1e-34.el7_0.4.i686.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.x86_64.rpm openssl-devel-1.0.1e-34.el7_0.4.i686.rpm openssl-devel-1.0.1e-34.el7_0.4.x86_64.rpm openssl-perl-1.0.1e-34.el7_0.4.x86_64.rpm openssl-static-1.0.1e-34.el7_0.4.i686.rpm openssl-static-1.0.1e-34.el7_0.4.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: openssl-1.0.1e-34.el7_0.4.src.rpm ppc64: openssl-1.0.1e-34.el7_0.4.ppc64.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.ppc.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.ppc64.rpm openssl-devel-1.0.1e-34.el7_0.4.ppc.rpm openssl-devel-1.0.1e-34.el7_0.4.ppc64.rpm openssl-libs-1.0.1e-34.el7_0.4.ppc.rpm openssl-libs-1.0.1e-34.el7_0.4.ppc64.rpm s390x: openssl-1.0.1e-34.el7_0.4.s390x.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.s390.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.s390x.rpm openssl-devel-1.0.1e-34.el7_0.4.s390.rpm openssl-devel-1.0.1e-34.el7_0.4.s390x.rpm openssl-libs-1.0.1e-34.el7_0.4.s390.rpm openssl-libs-1.0.1e-34.el7_0.4.s390x.rpm x86_64: openssl-1.0.1e-34.el7_0.4.x86_64.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.i686.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.x86_64.rpm openssl-devel-1.0.1e-34.el7_0.4.i686.rpm openssl-devel-1.0.1e-34.el7_0.4.x86_64.rpm openssl-libs-1.0.1e-34.el7_0.4.i686.rpm openssl-libs-1.0.1e-34.el7_0.4.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: openssl-debuginfo-1.0.1e-34.el7_0.4.ppc.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.ppc64.rpm openssl-perl-1.0.1e-34.el7_0.4.ppc64.rpm openssl-static-1.0.1e-34.el7_0.4.ppc.rpm openssl-static-1.0.1e-34.el7_0.4.ppc64.rpm s390x: openssl-debuginfo-1.0.1e-34.el7_0.4.s390.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.s390x.rpm openssl-perl-1.0.1e-34.el7_0.4.s390x.rpm openssl-static-1.0.1e-34.el7_0.4.s390.rpm openssl-static-1.0.1e-34.el7_0.4.s390x.rpm x86_64: openssl-debuginfo-1.0.1e-34.el7_0.4.i686.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.x86_64.rpm openssl-perl-1.0.1e-34.el7_0.4.x86_64.rpm openssl-static-1.0.1e-34.el7_0.4.i686.rpm openssl-static-1.0.1e-34.el7_0.4.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: openssl-1.0.1e-34.el7_0.4.src.rpm x86_64: openssl-1.0.1e-34.el7_0.4.x86_64.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.i686.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.x86_64.rpm openssl-devel-1.0.1e-34.el7_0.4.i686.rpm openssl-devel-1.0.1e-34.el7_0.4.x86_64.rpm openssl-libs-1.0.1e-34.el7_0.4.i686.rpm openssl-libs-1.0.1e-34.el7_0.4.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: openssl-debuginfo-1.0.1e-34.el7_0.4.i686.rpm openssl-debuginfo-1.0.1e-34.el7_0.4.x86_64.rpm openssl-perl-1.0.1e-34.el7_0.4.x86_64.rpm openssl-static-1.0.1e-34.el7_0.4.i686.rpm openssl-static-1.0.1e-34.el7_0.4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-3505.html https://www.redhat.com/security/data/cve/CVE-2014-3506.html https://www.redhat.com/security/data/cve/CVE-2014-3507.html https://www.redhat.com/security/data/cve/CVE-2014-3508.html https://www.redhat.com/security/data/cve/CVE-2014-3509.html https://www.redhat.com/security/data/cve/CVE-2014-3510.html https://www.redhat.com/security/data/cve/CVE-2014-3511.html https://access.redhat.com/security/updates/classification/#moderate https://www.openssl.org/news/secadv_20140806.txt 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFT69raXlSAg2UNWIIRAiQAAKCbp6Iou4mHuootBfgs0jm7zP/wWACgt50C pHXxupQnHYYH+zJFOmk5u8o= =DwUW -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ============================================================================ Ubuntu Security Notice USN-2308-1 August 07, 2014 openssl vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in OpenSSL. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. When OpenSSL is used with certain applications, an attacker may use this issue to possibly gain access to sensitive information. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-5139) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.5 Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.17 Ubuntu 10.04 LTS: libssl0.9.8 0.9.8k-7ubuntu8.20 After a standard system update you need to reboot your computer to make all the necessary changes. Relevant releases/architectures: RHEV-M 3.5 - noarch 3. Description: Red Hat Enterprise Virtualization Manager provides access to virtual machines using SPICE. These SPICE client packages provide the SPICE client and usbclerk service for both Windows 32-bit operating systems and Windows 64-bit operating systems. (CVE-2014-3511) This update also fixes the following bugs: * Previously, various clipboard managers, operating on the client or on the guest, would occasionally lose synchronization, which resulted in clipboard data loss and the SPICE console freezing. Now, spice-gtk have been patched, such that clipboard synchronization does not freeze the SPICE console anymore. (BZ#1083489) * Prior to this update, when a SPICE console was launched from the Red Hat Enterprise Virtualization User Portal with the 'Native Client' invocation method and 'Open in Full Screen' selected, the displays of the guest virtual machine were not always configured to match the client displays. After this update, the SPICE console will show a full-screen guest display for each client monitor. (BZ#1076243) * A difference in behavior between Linux and Windows clients caused an extra nul character to be sent when pasting text in a guest machine from a Windows client. This invisible character was visible in some Java applications. With this update, the extra nul character is removed from text strings and no more extraneous character would appear. (BZ#1090122) * Previously, If the clipboard is of type image/bmp, and the data is of 0 size, GTK+ will crash. With this update, the data size is checked first, and GTK+ no longer crashes when clipboard is of type image/bmp, and the data is of 0 size. (BZ#1090433) * Modifier-only key combinations cannot be registered by users as hotkeys so if a user tries to set a modifier-only key sequence (for example, 'ctrl+alt') as the hotkey for releasing the cursor, it will fail, and the user will be able to release the cursor from the window. With this update, when a modifier-only hotkey is attempted to be registered, it will fall back to the default cursor-release sequence (which happens to be 'ctrl+alt'). (BZ#985319) * Display configuration sometimes used outdated information about the position of the remote-viewer windows in order to align and configure the guest displays. Occasionally, this caused the guest displays to became unexpectedly swapped when a window is resized. With this update, remote-viewer will always use the current window locations to align displays, rather than using a possibly outdated cached location information. Bugs fixed (https://bugzilla.redhat.com/): 1018145 - --full-screen=auto-conf sometimes (but frequently) doesn't work correctly 1018182 - primary monitor is switched if some screen gets bigger then current primary screen 1076243 - [BUG] RHEV SPICE console not opening in full screen or detecting resolution by default 1083489 - [SPICE][BUG] Spice session freezes randomly 1090122 - Pasting into java apps inserts unprintable character 1090433 - [GTK][BUG] win32: add more clipboard data checks to avoid crash 1103366 - Rebase virt-viewer to 0.6.0 1105650 - Fix windows productversion to fit -z releases 1115445 - in About dialog, hyphen version-build dividing hyphen is missing 1127498 - CVE-2014-3509 openssl: race condition in ssl_parse_serverhello_tlsext 1127504 - CVE-2014-3511 openssl: TLS protocol downgrade attack 6. References: CVE-2014-3508 CVE-2014-3509 CVE-2014-3511 CVE-2014-3513 CVE-2014-3566 CVE-2014-3567 CVE-2014-3568 CVE-2014-5139 SSRT101894 SSRT101916 SSRT101918 SSRT101920 SSRT101921 SSRT101922 SSRT101923 SSRT101925 SSRT101926 SSRT101927 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. The HP Matrix Operating Environment v7.2.3 Update kit applicable to HP Matrix Operating Environment v7.2.x installations is available at the following location: https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber =HPID NOTE: Please read the readme.txt file before proceeding with the installation

The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions. OpenSSL is prone to an information disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. The following versions are vulnerable: OpenSSL 0.9.8 versions prior to 0.9.8zb. OpenSSL 1.0.0 versions prior to 1.0.0n. OpenSSL 1.0.1 versions prior to 1.0.1i. Applications may be affected if they echo pretty printing output to the attacker. OpenSSL SSL/TLS clients and servers themselves are not affected (CVE-2014-3508). The updated packages have been upgraded to the 1.0.0n version where these security flaws has been fixed. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3508 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3509 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3505 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3506 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3507 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3510 http://www.openssl.org/news/secadv_20140806.txt _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 17007f558e739eb863c8507d520ffbc9 mbs1/x86_64/lib64openssl1.0.0-1.0.0n-1.mbs1.x86_64.rpm f810bbe20b2de26cb99d13ddaf0ac2fa mbs1/x86_64/lib64openssl-devel-1.0.0n-1.mbs1.x86_64.rpm 54d87a61ca0440dc5f344931de1ff43e mbs1/x86_64/lib64openssl-engines1.0.0-1.0.0n-1.mbs1.x86_64.rpm 5b1748370e5a855cc31d3eec7673da5e mbs1/x86_64/lib64openssl-static-devel-1.0.0n-1.mbs1.x86_64.rpm 7e19a555629b4a2d3d4533be7786ce5e mbs1/x86_64/openssl-1.0.0n-1.mbs1.x86_64.rpm a9e74f2bab2878f601cfb44620c76dbb mbs1/SRPMS/openssl-1.0.0n-1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFT5HsDmqjQ0CJFipgRAhA5AJ0ZoDe2+SA7K7xk+NZLedQBVoFVvgCffPW9 5geoq7aMnxbnw5eTuuH+iIs= =CK7e -----END PGP SIGNATURE----- . Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. Solution: The References section of this erratum contains a download link (you must log in to download the update). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04424322 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04424322 Version: 1 HPSBGN03099 rev.1 - HP IceWall SSO Dfw, SSO Agent and MCRP running OpenSSL, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2014-09-01 Last Updated: 2014-09-01 Potential Security Impact: Remote disclosure of information Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP IceWall SSO Dfw, SSO Agent and MCRP running OpenSSL. HP IceWall SSO Agent Option v8.0, v8.0 2007 Update Release 2, and v10.0 HP IceWall MCRP v2.1, v3.0 HP IceWall SSO Dfw v8.0, v8.0 R1, v8.0 R2, v8.0 R3, and v10.0 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-3508 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP recommends the following software update options to resolve this vulnerability for HP IceWall SSO Dfw, SSO Agent and MCRP. HP IceWall SSO Agent and MCRP - OpenSSL patches are available for RHEL: https://access.redhat.com/security/cve/CVE-2014-3508 - OpenSSL patches are available for HP-UX. Please refer to HP Security Bulletin HPSBUX03095: https://h20564.www2.h p.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c04404655 2. HP IceWall SSO Dfw Updated OpenSSL is available for the HP IceWall SSO Dfw Bundle: http://www.hp.com/jp/icewall/_patchaccess HP recommends the following mitigation information to protect against potential risk for the following HP IceWall products. HP IceWall SSO Dfw and MCRP If possible, do not use SHOST setting which allows IceWall SSO Dfw or MCRP to use SSL/TLS for back-end web server connection. HP IceWall SSO Dfw If possible, do not use SHOST and set CC_DECODE_FLG to 0 which will disable certificate decode by HP IceWall SSO Dfw . Note: The HP IceWall product is only available in Japan. HISTORY Version:1 (rev.1) - 2 September 2014 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2014 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: openssl security update Advisory ID: RHSA-2014:1053-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1053.html Issue date: 2014-08-13 CVE Names: CVE-2014-0221 CVE-2014-3505 CVE-2014-3506 CVE-2014-3508 CVE-2014-3510 ===================================================================== 1. Summary: Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop Workstation (v. 5 client) - i386, x86_64 3. Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL), Transport Layer Security (TLS), and Datagram Transport Layer Security (DTLS) protocols, as well as a full-strength, general purpose cryptography library. It was discovered that the OBJ_obj2txt() function could fail to properly NUL-terminate its output. This could possibly cause an application using OpenSSL functions to format fields of X.509 certificates to disclose portions of its memory. (CVE-2014-3508) Multiple flaws were discovered in the way OpenSSL handled DTLS packets. A remote attacker could use these flaws to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory. (CVE-2014-0221, CVE-2014-3505, CVE-2014-3506) A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman (DH) key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled. (CVE-2014-3510) Red Hat would like to thank the OpenSSL project for reporting CVE-2014-0221. Upstream acknowledges Imre Rad of Search-Lab as the original reporter of this issue. All OpenSSL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library (such as httpd and other SSL-enabled services) must be restarted or the system rebooted. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1103593 - CVE-2014-0221 openssl: DoS when sending invalid DTLS handshake 1127490 - CVE-2014-3508 openssl: information leak in pretty printing functions 1127499 - CVE-2014-3505 openssl: DTLS packet processing double free 1127500 - CVE-2014-3506 openssl: DTLS memory exhaustion 1127503 - CVE-2014-3510 openssl: DTLS anonymous (EC)DH denial of service 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: openssl-0.9.8e-27.el5_10.4.src.rpm i386: openssl-0.9.8e-27.el5_10.4.i386.rpm openssl-0.9.8e-27.el5_10.4.i686.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i386.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i686.rpm openssl-perl-0.9.8e-27.el5_10.4.i386.rpm x86_64: openssl-0.9.8e-27.el5_10.4.i686.rpm openssl-0.9.8e-27.el5_10.4.x86_64.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i686.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.x86_64.rpm openssl-perl-0.9.8e-27.el5_10.4.x86_64.rpm Red Hat Enterprise Linux Desktop Workstation (v. 5 client): Source: openssl-0.9.8e-27.el5_10.4.src.rpm i386: openssl-debuginfo-0.9.8e-27.el5_10.4.i386.rpm openssl-devel-0.9.8e-27.el5_10.4.i386.rpm x86_64: openssl-debuginfo-0.9.8e-27.el5_10.4.i386.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.x86_64.rpm openssl-devel-0.9.8e-27.el5_10.4.i386.rpm openssl-devel-0.9.8e-27.el5_10.4.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: openssl-0.9.8e-27.el5_10.4.src.rpm i386: openssl-0.9.8e-27.el5_10.4.i386.rpm openssl-0.9.8e-27.el5_10.4.i686.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i386.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i686.rpm openssl-devel-0.9.8e-27.el5_10.4.i386.rpm openssl-perl-0.9.8e-27.el5_10.4.i386.rpm ia64: openssl-0.9.8e-27.el5_10.4.i686.rpm openssl-0.9.8e-27.el5_10.4.ia64.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i686.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.ia64.rpm openssl-devel-0.9.8e-27.el5_10.4.ia64.rpm openssl-perl-0.9.8e-27.el5_10.4.ia64.rpm ppc: openssl-0.9.8e-27.el5_10.4.ppc.rpm openssl-0.9.8e-27.el5_10.4.ppc64.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.ppc.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.ppc64.rpm openssl-devel-0.9.8e-27.el5_10.4.ppc.rpm openssl-devel-0.9.8e-27.el5_10.4.ppc64.rpm openssl-perl-0.9.8e-27.el5_10.4.ppc.rpm s390x: openssl-0.9.8e-27.el5_10.4.s390.rpm openssl-0.9.8e-27.el5_10.4.s390x.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.s390.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.s390x.rpm openssl-devel-0.9.8e-27.el5_10.4.s390.rpm openssl-devel-0.9.8e-27.el5_10.4.s390x.rpm openssl-perl-0.9.8e-27.el5_10.4.s390x.rpm x86_64: openssl-0.9.8e-27.el5_10.4.i686.rpm openssl-0.9.8e-27.el5_10.4.x86_64.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i386.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.i686.rpm openssl-debuginfo-0.9.8e-27.el5_10.4.x86_64.rpm openssl-devel-0.9.8e-27.el5_10.4.i386.rpm openssl-devel-0.9.8e-27.el5_10.4.x86_64.rpm openssl-perl-0.9.8e-27.el5_10.4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2014-0221.html https://www.redhat.com/security/data/cve/CVE-2014-3505.html https://www.redhat.com/security/data/cve/CVE-2014-3506.html https://www.redhat.com/security/data/cve/CVE-2014-3508.html https://www.redhat.com/security/data/cve/CVE-2014-3510.html https://access.redhat.com/security/updates/classification/#moderate https://www.openssl.org/news/secadv_20140605.txt https://www.openssl.org/news/secadv_20140806.txt 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFT69sGXlSAg2UNWIIRAuZjAJ9R5VuNKxbsx8+T/WGZrkH1VheAqgCdHHXN vrHSSMIJuncazkJWPE/LOyQ= =/f7Y -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ============================================================================ Ubuntu Security Notice USN-2308-1 August 07, 2014 openssl vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in OpenSSL. (CVE-2014-3505) Adam Langley discovered that OpenSSL incorrectly handled memory when processing DTLS handshake messages. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-3507) Ivan Fratric discovered that OpenSSL incorrectly leaked information in the pretty printing functions. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-3510) David Benjamin and Adam Langley discovered that OpenSSL incorrectly handled fragmented ClientHello messages. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-3511) Sean Devlin and Watson Ladd discovered that OpenSSL incorrectly handled certain SRP parameters. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-3512) Joonas Kuorilehto and Riku Hietam=C3=A4ki discovered that OpenSSL incorrectly handled certain Server Hello messages that specify an SRP ciphersuite. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-5139) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.5 Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.17 Ubuntu 10.04 LTS: libssl0.9.8 0.9.8k-7ubuntu8.20 After a standard system update you need to reboot your computer to make all the necessary changes. A race condition was found in the way OpenSSL handled ServerHello messages with an included Supported EC Point Format extension. The HP Matrix Operating Environment v7.2.3 Update kit applicable to HP Matrix Operating Environment 7.2.x installations is available at the following location: https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber =HPID NOTE: Please read the readme.txt file before proceeding with the installation. Detailed descriptions of the vulnerabilities can be found at: https://www.openssl.org/news/secadv_20140806.txt It's important that you upgrade the libssl1.0.0 package and not just the openssl package. You can use the "checkrestart" tool from the debian-goodies package to detect affected programs. Alternatively, you may reboot your system. For the testing distribution (jessie), these problems will be fixed soon. Corrected: 2014-08-07 21:04:42 UTC (stable/10, 10.0-STABLE) 2014-09-09 10:09:46 UTC (releng/10.0, 10.0-RELEASE-p8) 2014-08-07 21:06:34 UTC (stable/9, 9.3-STABLE) 2014-09-09 10:13:46 UTC (releng/9.3, 9.3-RELEASE-p1) 2014-09-09 10:13:46 UTC (releng/9.2, 9.2-RELEASE-p11) 2014-09-09 10:13:46 UTC (releng/9.1, 9.1-RELEASE-p18) 2014-08-07 21:06:34 UTC (stable/8, 8.4-STABLE) 2014-09-09 10:13:46 UTC (releng/8.4, 8.4-RELEASE-p15) CVE Name: CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3510, CVE-2014-3509, CVE-2014-3511, CVE-2014-3512, CVE-2014-5139 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://security.FreeBSD.org/>. Background FreeBSD includes software from the OpenSSL Project. II. [CVE-2014-3506] The receipt of a specifically crafted DTLS packet could cause OpenSSL to leak memory. [CVE-2014-3507] A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex et al. to leak some information from the stack. [CVE-2014-3508] OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to a denial of service attack. [CVE-2014-3510] The following problems affect FreeBSD 10.0-RELEASE and later: If a multithreaded client connects to a malicious server using a resumed session and the server sends an ec point format extension it could write up to 255 bytes to freed memory. [CVE-2014-3509] A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate TLS 1.0 instead of higher protocol versions when the ClientHello message is badly fragmented. [CVE-2014-3511] A malicious client or server can send invalid SRP parameters and overrun an internal buffer. [CVE-2014-5139] III. Additionally, a remote attacker may be able to run arbitrary code on a vulnerable system if the application has been set up for SRP. IV. Workaround No workaround is available. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 10.0] # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-10.0.patch # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-10.0.patch.asc # gpg --verify openssl-10.0.patch.asc [FreeBSD 9.3] # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-9.3.patch # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-9.3.patch.asc # gpg --verify openssl-9.3.patch.asc [FreeBSD 9.2, 9.1, 8.4] # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-9.patch # fetch http://security.FreeBSD.org/patches/SA-14:18/openssl-9.patch.asc # gpg --verify openssl-9.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in <URL:http://www.FreeBSD.org/handbook/makeworld.html>. Restart all deamons using the library, or reboot the system. 3) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/8/ r269687 releng/8.4/ r271305 stable/9/ r269687 releng/9.1/ r271305 releng/9.2/ r271305 releng/9.3/ r271305 stable/10/ r269686 releng/10.0/ r271304 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: <URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN> VII. References: CVE-2009-3555 Unauthorized Modification CVE-2014-0160 Heartbleed - Disclosure of Information CVE-2014-0195 Remote Code Execution, Denial of Service (DoS) CVE-2014-3505 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3506 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3507 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3508 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3509 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3510 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3511 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3512 Heartbleed - Remote Denial of Service (DoS) CVE-2014-3566 POODLE - Remote Disclosure of Information CVE-2014-5139 Shellshock - Remote Denial of Service (DoS) SSRT101846 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlBy a third party with certain rights, Virtual Host Confusion An attack may be executed. nginx is prone to a session-fixation vulnerability. An attacker can exploit this issue to hijack an arbitrary session or gain access to the sensitive information. This may aid in further attacks. nginx 0.5.6 through 1.7.4 are vulnerable. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. For the stable distribution (wheezy), this problem has been fixed in version 1.2.1-2.2+wheezy3. For the testing distribution (jessie), this problem has been fixed in version 1.6.2-1. For the unstable distribution (sid), this problem has been fixed in version 1.6.2-1. We recommend that you upgrade your nginx packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJUHRscAAoJEAVMuPMTQ89EGuUP/iedSRE21l/sSyJRUxP5GIoC GjKzrIsbFFDHY9gKH0JUJbVc5ayeEciHLWY7cY119Rlim6/IPpd4T246y4QzPyYd W0tI7eAmmg2zOjCIafubvLHii+FYQ93xSn6Y09CEL9XiHmVxDHS/uDdCBcQKhKaI rXaVc+VAg+I396RcyE6houS1GTPoUmkhJkMKOu4HCutx6foXjT78wLFJEiFLAy9I vVPhZ1+En1PqaJgqry8FEwkreiNF+Lzjb1VLpQzvNzi21uRhz3sPDCy6Y2nkMEhV 4fdYZJKEJGHWC/cdZXCwu5T4lnAZWSB7QYa26yiaUraWO9SrqJw20HgN1YnuGTFf YbeG3qdhMjEYVsdyi0VARtw3yZXfy122/yE0vvaYv0HKFp4Nrzm/5NBysuO+Zcg2 zt422dH9O0bLasJp6lm3tcSzGkfME7Fz63X6/CNupzoFnXcVP+IQpEHYD53+S1mf 3CUPp8sFxauuWuCpMb7hbD8hzYzrPRxB6cRsdAoKxSqTUn+dPOZRFp84tRuW0U5c mBs7DfmfWnnscmTJ/gUbeES+Ac8Tfbrr1Rsz12vAs7onuXxHHH/NSihtsLGYQ17N xzgGSXfgAfnky2J5ZkTOTVE+LvKkoWQX3cq8a+t5JaZjGJZinDkU5CSTOyik80Nr dGeskBuPPhZC1qYrJkyI =XURr -----END PGP SIGNATURE----- . ============================================================================ Ubuntu Security Notice USN-2351-1 September 22, 2014 nginx vulnerability ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: nginx could be made to expose sensitive information over the network. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: nginx-core 1.4.6-1ubuntu3.1 nginx-extras 1.4.6-1ubuntu3.1 nginx-full 1.4.6-1ubuntu3.1 nginx-light 1.4.6-1ubuntu3.1 nginx-naxsi 1.4.6-1ubuntu3.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2351-1 CVE-2014-3616 Package Information: https://launchpad.net/ubuntu/+source/nginx/1.4.6-1ubuntu3.1 . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201502-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: nginx: Information disclosure Date: February 07, 2015 Bugs: #522994 ID: 201502-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== An SSL session fixation vulnerability in nginx may allow remote attackers to obtain sensitive information. Background ========== nginx is a robust, small, and high performance HTTP and reverse proxy server. Workaround ========== There is no known workaround at this time. Resolution ========== All nginx users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.7.6" References ========== [ 1 ] CVE-2014-3616 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3616 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-06.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0133 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3616 http://advisories.mageia.org/MGASA-2014-0136.html http://advisories.mageia.org/MGASA-2014-0427.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 2/X86_64: f859044a48eda0b859c931bce3688184 mbs2/x86_64/nginx-1.4.7-1.mbs2.x86_64.rpm 36f49f7a1ca40c8546e82d514023b3f4 mbs2/SRPMS/nginx-1.4.7-1.mbs2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security

Cisco NX-OS 6.1(2)I2(1) on Nexus 9000 switches does not properly process packet-drop policy checks for logged packets, which allows remote attackers to bypass intended access restrictions via a flood of packets matching a policy that contains the log keyword, aka Bug ID CSCuo02489. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. A security bypass vulnerability exists in Cisco Nexus 9000 Series Switches that allows an attacker to exploit the vulnerability to bypass an access control list and perform unauthorized operations. This issue is being tracked by Cisco Bug ID CSCuo02489

The TP-LINK TL-WR740N is a wireless router device. The TP-Link TL-WR740N has a command injection vulnerability that allows the attacker to execute arbitrary shell commands.

Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string. (DoS) It may be put into a state. Barracuda Web Application Firewall is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and gain access to the appliance. This may aid in further attacks. Barracuda Web Application Firewall 7.8.1.013 is vulnerable; other versions may also be affected. A code issue vulnerability exists in version 7.8.1.013 of Barracuda Networks Barracuda WAF

Hikvision video network monitoring system iVMS-8100 is a set of video network monitoring platform software used in the financial industry. The Hikvision video network monitoring system ivms-8100 has a struts2 remote command execution vulnerability, allowing an attacker to use the vulnerability to obtain system administrator system permissions, send remote instructions to the server system, and check, add, and Delete, modify, etc.

The GPT library in the Telegyr 8979 Master Protocol application in SUBNET SubSTATION Server 2 before SSNET 2.12 HF18808 allows remote attackers to cause a denial of service (persistent service crash) via a long RTU-to-Master message. SubSTATION Server is a versatile software for intelligent substation intelligence and IT networks for data aggregation, protocol translation, automation logic and more. A security vulnerability exists in the SubSTATION Server protocol. An attacker can trigger a buffer overflow by sending a specially crafted RTU message to the Telegyr 8979 master, causing a denial of service attack. SubSTATION Server is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data. Attackers may be able to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions

Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. Apache Subversion is prone to an insecure authentication weakness. This may aid in further attacks. The system is compatible with the Concurrent Versions System (CVS). Ben Reser discovered that Subversion did not correctly validate SSL certificates containing wildcards. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications (CVE-2014-3522). Bert Huijben discovered that Subversion did not properly handle cached credentials. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFVFl6JmqjQ0CJFipgRAgkVAJ4xKUzteqhyYcBC4AuYoZ7Lv3oQZQCfROhl NaJSaZq4W6qIMwD8fhQF5Ls= =R/mF -----END PGP SIGNATURE----- . ============================================================================ Ubuntu Security Notice USN-2316-1 August 14, 2014 subversion vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in Subversion. Software Description: - subversion: Advanced version control system Details: Lieven Govaerts discovered that the Subversion mod_dav_svn module incorrectly handled certain request methods when SVNListParentPath was enabled. This issue only affected Ubuntu 12.04 LTS. (CVE-2014-3528) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: libsvn1 1.8.8-1ubuntu3.1 subversion 1.8.8-1ubuntu3.1 Ubuntu 12.04 LTS: libapache2-svn 1.6.17dfsg-3ubuntu3.4 libsvn1 1.6.17dfsg-3ubuntu3.4 subversion 1.6.17dfsg-3ubuntu3.4 In general, a standard system update will make all the necessary changes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201610-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Subversion, Serf: Multiple Vulnerabilities Date: October 11, 2016 Bugs: #500482, #518716, #519202, #545348, #556076, #567810, #581448, #586046 ID: 201610-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Subversion and Serf, the worst of which could lead to execution of arbitrary code. Background ========== Subversion is a version control system intended to eventually replace CVS. Like CVS, it has an optional client-server architecture (where the server can be an Apache server running mod_svn, or an ssh program as in CVS's :ext: method). In addition to supporting the features found in CVS, Subversion also provides support for moving and copying files and directories. The serf library is a high performance C-based HTTP client library built upon the Apache Portable Runtime (APR) library. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-vcs/subversion < 1.9.4 >= 1.9.4 *> 1.8.16 2 net-libs/serf < 1.3.7 >= 1.3.7 ------------------------------------------------------------------- 2 affected packages Description =========== Multiple vulnerabilities have been discovered in Subversion and Serf. Please review the CVE identifiers referenced below for details Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, conduct a man-in-the-middle attack, obtain sensitive information, or cause a Denial of Service Condition. Workaround ========== There is no known workaround at this time. Resolution ========== All Subversion users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/subversion-1.9.4" All Serf users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/serf-1.3.7" References ========== [ 1 ] CVE-2014-0032 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0032 [ 2 ] CVE-2014-3504 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3504 [ 3 ] CVE-2014-3522 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3522 [ 4 ] CVE-2014-3528 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3528 [ 5 ] CVE-2015-0202 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0202 [ 6 ] CVE-2015-0248 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0248 [ 7 ] CVE-2015-0251 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0251 [ 8 ] CVE-2015-3184 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3184 [ 9 ] CVE-2015-3187 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3187 [ 10 ] CVE-2015-5259 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5259 [ 11 ] CVE-2016-2167 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2167 [ 12 ] CVE-2016-2168 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2168 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201610-05 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . 6) - i386, noarch, x86_64 3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: subversion security update Advisory ID: RHSA-2015:0166-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0166.html Issue date: 2015-02-10 CVE Names: CVE-2014-3528 CVE-2014-3580 CVE-2014-8108 ===================================================================== 1. Summary: Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP. A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn. (CVE-2014-3580) A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-3528) Red Hat would like to thank the Subversion project for reporting CVE-2014-3580 and CVE-2014-8108. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter. All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1125799 - CVE-2014-3528 subversion: credentials leak via MD5 collision 1174054 - CVE-2014-3580 subversion: NULL pointer dereference flaw in mod_dav_svn when handling REPORT requests 1174057 - CVE-2014-8108 subversion: NULL pointer dereference flaw in mod_dav_svn when handling URIs for virtual transaction names 6. Package List: Red Hat Enterprise Linux Client Optional (v. 7): Source: subversion-1.7.14-7.el7_0.src.rpm x86_64: mod_dav_svn-1.7.14-7.el7_0.x86_64.rpm subversion-1.7.14-7.el7_0.i686.rpm subversion-1.7.14-7.el7_0.x86_64.rpm subversion-debuginfo-1.7.14-7.el7_0.i686.rpm subversion-debuginfo-1.7.14-7.el7_0.x86_64.rpm subversion-devel-1.7.14-7.el7_0.i686.rpm subversion-devel-1.7.14-7.el7_0.x86_64.rpm subversion-gnome-1.7.14-7.el7_0.i686.rpm subversion-gnome-1.7.14-7.el7_0.x86_64.rpm subversion-javahl-1.7.14-7.el7_0.i686.rpm subversion-javahl-1.7.14-7.el7_0.x86_64.rpm subversion-kde-1.7.14-7.el7_0.i686.rpm subversion-kde-1.7.14-7.el7_0.x86_64.rpm subversion-libs-1.7.14-7.el7_0.i686.rpm subversion-libs-1.7.14-7.el7_0.x86_64.rpm subversion-perl-1.7.14-7.el7_0.i686.rpm subversion-perl-1.7.14-7.el7_0.x86_64.rpm subversion-python-1.7.14-7.el7_0.x86_64.rpm subversion-ruby-1.7.14-7.el7_0.i686.rpm subversion-ruby-1.7.14-7.el7_0.x86_64.rpm subversion-tools-1.7.14-7.el7_0.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: subversion-1.7.14-7.el7_0.src.rpm x86_64: mod_dav_svn-1.7.14-7.el7_0.x86_64.rpm subversion-1.7.14-7.el7_0.i686.rpm subversion-1.7.14-7.el7_0.x86_64.rpm subversion-debuginfo-1.7.14-7.el7_0.i686.rpm subversion-debuginfo-1.7.14-7.el7_0.x86_64.rpm subversion-devel-1.7.14-7.el7_0.i686.rpm subversion-devel-1.7.14-7.el7_0.x86_64.rpm subversion-gnome-1.7.14-7.el7_0.i686.rpm subversion-gnome-1.7.14-7.el7_0.x86_64.rpm subversion-javahl-1.7.14-7.el7_0.i686.rpm subversion-javahl-1.7.14-7.el7_0.x86_64.rpm subversion-kde-1.7.14-7.el7_0.i686.rpm subversion-kde-1.7.14-7.el7_0.x86_64.rpm subversion-libs-1.7.14-7.el7_0.i686.rpm subversion-libs-1.7.14-7.el7_0.x86_64.rpm subversion-perl-1.7.14-7.el7_0.i686.rpm subversion-perl-1.7.14-7.el7_0.x86_64.rpm subversion-python-1.7.14-7.el7_0.x86_64.rpm subversion-ruby-1.7.14-7.el7_0.i686.rpm subversion-ruby-1.7.14-7.el7_0.x86_64.rpm subversion-tools-1.7.14-7.el7_0.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: subversion-1.7.14-7.el7_0.src.rpm ppc64: mod_dav_svn-1.7.14-7.el7_0.ppc64.rpm subversion-1.7.14-7.el7_0.ppc64.rpm subversion-debuginfo-1.7.14-7.el7_0.ppc.rpm subversion-debuginfo-1.7.14-7.el7_0.ppc64.rpm subversion-libs-1.7.14-7.el7_0.ppc.rpm subversion-libs-1.7.14-7.el7_0.ppc64.rpm s390x: mod_dav_svn-1.7.14-7.el7_0.s390x.rpm subversion-1.7.14-7.el7_0.s390x.rpm subversion-debuginfo-1.7.14-7.el7_0.s390.rpm subversion-debuginfo-1.7.14-7.el7_0.s390x.rpm subversion-libs-1.7.14-7.el7_0.s390.rpm subversion-libs-1.7.14-7.el7_0.s390x.rpm x86_64: mod_dav_svn-1.7.14-7.el7_0.x86_64.rpm subversion-1.7.14-7.el7_0.x86_64.rpm subversion-debuginfo-1.7.14-7.el7_0.i686.rpm subversion-debuginfo-1.7.14-7.el7_0.x86_64.rpm subversion-libs-1.7.14-7.el7_0.i686.rpm subversion-libs-1.7.14-7.el7_0.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: subversion-1.7.14-7.el7_0.ppc.rpm subversion-debuginfo-1.7.14-7.el7_0.ppc.rpm subversion-debuginfo-1.7.14-7.el7_0.ppc64.rpm subversion-devel-1.7.14-7.el7_0.ppc.rpm subversion-devel-1.7.14-7.el7_0.ppc64.rpm subversion-gnome-1.7.14-7.el7_0.ppc.rpm subversion-gnome-1.7.14-7.el7_0.ppc64.rpm subversion-javahl-1.7.14-7.el7_0.ppc.rpm subversion-javahl-1.7.14-7.el7_0.ppc64.rpm subversion-kde-1.7.14-7.el7_0.ppc.rpm subversion-kde-1.7.14-7.el7_0.ppc64.rpm subversion-perl-1.7.14-7.el7_0.ppc.rpm subversion-perl-1.7.14-7.el7_0.ppc64.rpm subversion-python-1.7.14-7.el7_0.ppc64.rpm subversion-ruby-1.7.14-7.el7_0.ppc.rpm subversion-ruby-1.7.14-7.el7_0.ppc64.rpm subversion-tools-1.7.14-7.el7_0.ppc64.rpm s390x: subversion-1.7.14-7.el7_0.s390.rpm subversion-debuginfo-1.7.14-7.el7_0.s390.rpm subversion-debuginfo-1.7.14-7.el7_0.s390x.rpm subversion-devel-1.7.14-7.el7_0.s390.rpm subversion-devel-1.7.14-7.el7_0.s390x.rpm subversion-gnome-1.7.14-7.el7_0.s390.rpm subversion-gnome-1.7.14-7.el7_0.s390x.rpm subversion-javahl-1.7.14-7.el7_0.s390.rpm subversion-javahl-1.7.14-7.el7_0.s390x.rpm subversion-kde-1.7.14-7.el7_0.s390.rpm subversion-kde-1.7.14-7.el7_0.s390x.rpm subversion-perl-1.7.14-7.el7_0.s390.rpm subversion-perl-1.7.14-7.el7_0.s390x.rpm subversion-python-1.7.14-7.el7_0.s390x.rpm subversion-ruby-1.7.14-7.el7_0.s390.rpm subversion-ruby-1.7.14-7.el7_0.s390x.rpm subversion-tools-1.7.14-7.el7_0.s390x.rpm x86_64: subversion-1.7.14-7.el7_0.i686.rpm subversion-debuginfo-1.7.14-7.el7_0.i686.rpm subversion-debuginfo-1.7.14-7.el7_0.x86_64.rpm subversion-devel-1.7.14-7.el7_0.i686.rpm subversion-devel-1.7.14-7.el7_0.x86_64.rpm subversion-gnome-1.7.14-7.el7_0.i686.rpm subversion-gnome-1.7.14-7.el7_0.x86_64.rpm subversion-javahl-1.7.14-7.el7_0.i686.rpm subversion-javahl-1.7.14-7.el7_0.x86_64.rpm subversion-kde-1.7.14-7.el7_0.i686.rpm subversion-kde-1.7.14-7.el7_0.x86_64.rpm subversion-perl-1.7.14-7.el7_0.i686.rpm subversion-perl-1.7.14-7.el7_0.x86_64.rpm subversion-python-1.7.14-7.el7_0.x86_64.rpm subversion-ruby-1.7.14-7.el7_0.i686.rpm subversion-ruby-1.7.14-7.el7_0.x86_64.rpm subversion-tools-1.7.14-7.el7_0.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: subversion-1.7.14-7.el7_0.src.rpm x86_64: mod_dav_svn-1.7.14-7.el7_0.x86_64.rpm subversion-1.7.14-7.el7_0.x86_64.rpm subversion-debuginfo-1.7.14-7.el7_0.i686.rpm subversion-debuginfo-1.7.14-7.el7_0.x86_64.rpm subversion-libs-1.7.14-7.el7_0.i686.rpm subversion-libs-1.7.14-7.el7_0.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: subversion-1.7.14-7.el7_0.i686.rpm subversion-debuginfo-1.7.14-7.el7_0.i686.rpm subversion-debuginfo-1.7.14-7.el7_0.x86_64.rpm subversion-devel-1.7.14-7.el7_0.i686.rpm subversion-devel-1.7.14-7.el7_0.x86_64.rpm subversion-gnome-1.7.14-7.el7_0.i686.rpm subversion-gnome-1.7.14-7.el7_0.x86_64.rpm subversion-javahl-1.7.14-7.el7_0.i686.rpm subversion-javahl-1.7.14-7.el7_0.x86_64.rpm subversion-kde-1.7.14-7.el7_0.i686.rpm subversion-kde-1.7.14-7.el7_0.x86_64.rpm subversion-perl-1.7.14-7.el7_0.i686.rpm subversion-perl-1.7.14-7.el7_0.x86_64.rpm subversion-python-1.7.14-7.el7_0.x86_64.rpm subversion-ruby-1.7.14-7.el7_0.i686.rpm subversion-ruby-1.7.14-7.el7_0.x86_64.rpm subversion-tools-1.7.14-7.el7_0.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2014-3528 https://access.redhat.com/security/cve/CVE-2014-3580 https://access.redhat.com/security/cve/CVE-2014-8108 https://access.redhat.com/security/updates/classification/#moderate https://subversion.apache.org/security/CVE-2014-3528-advisory.txt https://subversion.apache.org/security/CVE-2014-3580-advisory.txt https://subversion.apache.org/security/CVE-2014-8108-advisory.txt 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFU2pCEXlSAg2UNWIIRAmlpAJ4o2MhM6glIBctGbU52rfN8EZXCDgCdEIll KM6EsnQkXd09uLTe1k+tQaU= =CuZg -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . These issues were addressed by updating Apache Subversion to version 1.7.19. CVE-ID CVE-2014-3522 CVE-2014-3528 CVE-2014-3580 CVE-2014-8108 Git Available for: OS X Mavericks v10.9.4 or later Impact: Synching with a malicious git repository may allow unexpected files to be added to the .git folder Description: The checks involved in disallowed paths did not account for case insensitivity or unicode characters. This issue was addressed by adding additional checks. CVE-ID CVE-2014-9390 : Matt Mackall of Mercurial and Augie Fackler of Mercurial Xcode 6.2 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "6.2"

There are several vulnerabilities in the D-Link AP 3200: 1. D-Link AP 3200 is a wireless access device from D-Link. D-Link AP 3200 has a security bypass and information disclosure vulnerability. Attackers can use these vulnerabilities to bypass security restrictions or gain access to sensitive information to perform unauthorized operations in user sessions. D-Link DWL-3200AP is prone to the following security vulnerabilities: 1. A security-bypass vulnerability 2. Other attacks are also possible

The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors. SAP NetWeaver Business Warehouse is prone to an unauthorized-access vulnerability. Successfully exploiting this issue may allow an attacker to obtain sensitive information that may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory 2014-026: Missing authorization check in function modules of BW-SYS-DB-DB4 This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will gain access to beforehand information on upcoming advisories, presentations and new research projects from the Onapsis Research Labs, as well as exclusive access to special promotions for upcoming trainings and conferences. 1. Impact on Business By exploiting this vulnerability a remote authenticated attacker would be able to perform activities for which he is not authorized. Risk Level: Low 2. Advisory Information - - Public Release Date: 2014-07-29 - - Subscriber Notification Date: 2014-07-29 - - Last Revised: 2014-07-25 - - Security Advisory ID: ONAPSIS-2014-026 - - Onapsis SVS ID: ONAPSIS-00114 - - Researcher: Nahuel D. S\xe1nchez - - Initial Base CVSS v2: 3.5 (AV:N/AC:M/AU:S/C:P/I:N/A:N) 3. (Check SAP Note 1974016 for detailed information on affected releases) - - Vulnerability Class: Improper Access Control (CWE-284) - - Remotely Exploitable: Yes - - Locally Exploitable: No - - Authentication Required: Yes - - Original Advisory: http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-026 4. Affected Components Description SAP BW-SYS-DB-DB4 component contains a remote-enabled RFC function that does not perform authorization checks prior to retrieving sensitive information. 5. Vulnerability Details A remote authenticated attacker could execute the vulnerable RFC functions in function group BW-SYS-DB-DB4. Technical details about this issue are not disclosed at this moment with the purpose of providing enough time to affected customers to patch their systems and protect against the exploitation of the described vulnerability. 6. Solution SAP has released SAP Note 1974016 which provides patched versions of the affected components. The patches can be downloaded from https://service.sap.com/sap/support/notes/1974016 Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks. 7. Report Timeline 2014-01-20: Onapsis provides vulnerability information to SAP AG. 2014-04-08: SAP releases security patches. 2014-07-29: Onapsis notifies availability of security advisory. About Onapsis, Inc. Onapsis provides innovative security software solutions to protect ERP systems from cyber-attacks. Through unmatched ERP security, compliance and continuous monitoring products, Onapsis secures the business-critical infrastructure of its global customers against espionage, sabotage and financial fraud threats. Onapsis X1, the company's flagship product, is the industry's first comprehensive solution for the automated security assessment of SAP platforms. Being the first and only SAP-certified solution of its kind, Onapsis X1 allows customers to perform automated Vulnerability Assessments, Security & Compliance Audits and Penetration Tests over their entire SAP platform. Onapsis is backed by the Onapsis Research Labs, a world-renowned team of SAP & ERP security experts who are continuously invited to lecture at the leading IT security conferences, such as RSA and BlackHat, and featured by mainstream media such as CNN, Reuters, IDG and New York Times. For further information about our solutions, please contact us at info@onapsis.com and visit our website at www.onapsis.com. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Onapsis Research Team iEYEARECAAYFAlPXtbgACgkQz3i6WNVBcDWN+wCcDSS2XQZ9ekEahFTHMRuvsxNk VwYAoN3qbuKsw2fS6yVjKc5KZ4qzhoW7 =MqQo -----END PGP SIGNATURE-----

Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. SAP HANA is a combination of software and hardware that provides high-performance data query functions. Users can directly query and analyze large amounts of real-time business data without modeling and aggregating business data. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. By downloading this advisory from the Onapsis Resource Center, you will gain access to beforehand information on upcoming advisories, presentations and new research projects from the Onapsis Research Labs, as well as exclusive access to special promotions for upcoming trainings and conferences. 1. Risk Level: Medium 2. Advisory Information - - Public Release Date: 2014-07-29 - - Subscriber Notification Date: 2014-07-29 - - Last Revised: 2014-07-25 - - Security Advisory ID: ONAPSIS-2014-025 - - Onapsis SVS ID: ONAPSIS-00128/129/130 - - Researcher: Will Vandevanter - - Initial Base CVSS v2: 4.3 (AV:N/AC:M/AU:N/C:N/I:P/A:N) 3. Vulnerability Information - - Vendor: SAP - - Affected Components: - SAP HANA (Check SAP Note 1993349 for detailed information on affected releases) - - Vulnerability Class: Improper Neutralization of Input During Web Page Generation - Reflected Cross Site Scripting (CWE-9) - - Remotely Exploitable: Yes - - Locally Exploitable: No - - Authentication Required: No - - Detection Module available in Onapsis X1: Yes - - Original Advisory: http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-025 4. 5. Reflected cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session. An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised. Technical details about this issue are not disclosed at this moment with the purpose of providing enough time to affected customers to patch their systems and protect against the exploitation of the described vulnerability. 6. Solution SAP has released SAP Note 1993349 which provides patched versions of the affected components. The patches can be downloaded from https://service.sap.com/sap/support/notes/1993349. Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks. 7. Report Timeline 2014-03-05: Onapsis provides vulnerability information to SAP AG. 2014-03-06: SAP confirms having the information of vulnerability. 2014-04-08: SAP releases security patches. 2014-07-29: Onapsis notifies availability of security advisory. About Onapsis, Inc. Onapsis provides innovative security software solutions to protect ERP systems from cyber-attacks. Through unmatched ERP security, compliance and continuous monitoring products, Onapsis secures the business-critical infrastructure of its global customers against espionage, sabotage and financial fraud threats. Onapsis X1, the company's flagship product, is the industry's first comprehensive solution for the automated security assessment of SAP platforms. Being the first and only SAP-certified solution of its kind, Onapsis X1 allows customers to perform automated Vulnerability Assessments, Security & Compliance Audits and Penetration Tests over their entire SAP platform. Onapsis is backed by the Onapsis Research Labs, a world-renowned team of SAP & ERP security experts who are continuously invited to lecture at the leading IT security conferences, such as RSA and BlackHat, and featured by mainstream media such as CNN, Reuters, IDG and New York Times. For further information about our solutions, please contact us at info@onapsis.com and visit our website at www.onapsis.com. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Onapsis Research Team iEYEARECAAYFAlPXtbEACgkQz3i6WNVBcDUm6ACgx0Q/LGvyZZI3o4zgdO9jISby r8oAnj4cEwjlkzycvD4il3z0e/JujVH2 =aEdj -----END PGP SIGNATURE-----

Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request. Innominate mGuard is prone to a remote information-disclosure vulnerability. Attackers can exploit this issue to gain access to sensitive information. This may aid in further attacks. Innominate mGuard is a series of products including network security equipment such as firewall and VPN from German Innominate Company

The I-O DATA TS-WLCAM camera with firmware 1.06 and earlier, TS-WLCAM/V camera with firmware 1.06 and earlier, TS-WPTCAM camera with firmware 1.08 and earlier, TS-PTCAM camera with firmware 1.08 and earlier, TS-PTCAM/POE camera with firmware 1.08 and earlier, and TS-WLC2 camera with firmware 1.02 and earlier allow remote attackers to bypass authentication, and consequently obtain sensitive credential and configuration data, via unspecified vectors. Multiple IP Cameras provided by I-O DATA contain an authentication bypass vulnerability.An attacker who can access the product may be able to gain access to configuration and credential information. As a result, the attacker may take control of the product. I-O DATA DEVICE I-O DATA TS-WLCAM and others are camera products of Japan I-O DATA DEVICE. Security vulnerabilities exist in several I-O DATA DEVICE I-O DATA IP Cameras products. This may aid in further attacks

The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS. SAP Solution Manager is a system management platform that integrates system monitoring, SAP support desktop, self-service, and ASAP implementation. Attackers exploit vulnerabilities to bypass certain security restrictions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory2014-023: HTTP verb tampering issue in SAP_JTECHS This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will gain access to beforehand information on upcoming advisories, presentations and new research projects from the Onapsis Research Labs, as well as exclusive access to special promotions for upcoming trainings and conferences. 1. Impact on Business By exploiting this vulnerability a remote unauthenticated attacker would be able to access restricted functionality and information. Risk Level: Medium 2. Advisory Information - - Public Release Date: 2014-07-29 - - Subscriber Notification Date: 2014-07-29 - - Last Revised: 2014-07-25 - - Security Advisory ID: ONAPSIS-2012-023 - - Onapsis SVS ID: ONAPSIS-00061 - - Researcher: Nahuel D. S\xe1nchez - - Initial Base CVSS v2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 3. Vulnerability Information - - Vendor: SAP - - Affected Components: - SAP Solution Manager 7.1 (Check SAP Note 1778940 for detailed information on affected releases) - - Vulnerability Class: Authentication Bypass (CWE-302) - - Remotely Exploitable: Yes - - Locally Exploitable: No - - Authentication Required: No - - Detection Module available in Onapsis X1: Yes - - Original Advisory: http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-023 4. Affected Components Description The License Measurement Servlet allows system administrators to review System's license usage and perform system tests. 5. Technical details about this issue are not disclosed at this moment with the purpose of providing enough time to affected customers to patch their systems and protect against the exploitation of the described vulnerability. 6. Solution SAP has released SAP Note 1778940 which provides patched versions of the affected components. The patches can be downloaded from https://service.sap.com/sap/support/notes/1778940 . Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks. 7. Report Timeline 2012-07-30: Onapsis provides vulnerability information to SAP AG. 2014-04-08: SAP releases security patches. 2014-07-29: Onapsis notifies availability of security advisory. About Onapsis, Inc. Onapsis provides innovative security software solutions to protect ERP systems from cyber-attacks. Through unmatched ERP security, compliance and continuous monitoring products, Onapsis secures the business-critical infrastructure of its global customers against espionage, sabotage and financial fraud threats. Onapsis X1, the company's flagship product, is the industry's first comprehensive solution for the automated security assessment of SAP platforms. Being the first and only SAP-certified solution of its kind, Onapsis X1 allows customers to perform automated Vulnerability Assessments, Security & Compliance Audits and Penetration Tests over their entire SAP platform. Onapsis is backed by the Onapsis Research Labs, a world-renowned team of SAP & ERP security experts who are continuously invited to lecture at the leading IT security conferences, such as RSA and BlackHat, and featured by mainstream media such as CNN, Reuters, IDG and New York Times. For further information about our solutions, please contact us at info@onapsis.com and visit our website at www.onapsis.com. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Onapsis Research Team iEYEARECAAYFAlPXtaIACgkQz3i6WNVBcDXjLwCggwu7sLoMy8KuSuZVAnlSR/7j DrUAoNp3hUvPzYg8+zQ0vRpnGtjTEHeR =vdlU -----END PGP SIGNATURE-----

Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter. Silver Peak VX is a virtual WAN optimization solution. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks

Cross-site scripting (XSS) vulnerability in the web-server component in Cisco Prime Data Center Network Manager (DCNM) 6.3(2) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum86620. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCum86620. The manager provides multi-protocol management of the network and provides troubleshooting capabilities for switch health and performance

Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors. Attackers can exploit this issue to cause denial-of-service conditions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03993467 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03993467 Version: 1 HPSBGN02936 rev.1 - HP and H3C VPN Firewall Module Products, Remote Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. The vulnerability could be remotely exploited resulting in a Denial of Service (DoS). References: CVE-2013-4840 (SSRT101341) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Please refer to the RESOLUTION section below for a list of impacted products. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2014 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iEYEARECAAYFAlPSvrQACgkQ4B86/C0qfVkZDACeKwOBFv2gsebln3WHlNhYV4QK pKYAoJrFJIwsRxrPIN4DQCn4D3cTsYyW =zq6e -----END PGP SIGNATURE-----

Parallels Tools is a set of virtual machine tools of Parallels Corporation in the United States. A local elevation of privilege vulnerability exists in Parallels Tools. An attacker could use this vulnerability to execute arbitrary code in the context of an affected application with local access. Vulnerabilities exist in Parallels Tools version 9.0, other versions may also be affected

Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts. Silver Peak VX is a virtual WAN optimization solution