VARIoT IoT vulnerabilities database

EcoSense Digital Video Recorder (DVR) is a digital hard disk video recorder from Dedicated Micros, USA. A remote authentication bypass vulnerability exists in EcoSense DVR. An attacker could use this vulnerability to bypass the authentication mechanism and gain access to view video streams

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c. OpenSSL is prone to multiple security-bypass vulnerabilities. Successfully exploiting these issues may allow attackers to obtain sensitive information by conducting a man-in-the-middle attack. This may lead to other attacks. OpenSSL versions 0.9.8y, and 1.0.0 through 1.0.1e are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04239372 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04239372 Version: 4 HPSBMU02998 rev.4 - HP System Management Homepage (SMH) running OpenSSL on Linux and Windows, Remote Disclosure of Information, Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2014-04-13 Last Updated: 2014-05-13 Potential Security Impact: Remote disclosure of information, Denial of Service (DoS) Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP System Management Homepage (SMH) running on Linux and Windows. The vulnerabilities could be exploited remotely resulting in Denial of Service (DoS). Also included is the OpenSSL vulnerability known as "Heartbleed" which could be exploited remotely resulting in disclosure of information. References: CVE-2014-0160 (SSRT101501) Disclosure of Information - "Heartbleed" CVE-2013-4353 Denial of Service (DoS) CVE-2013-6449 Denial of Service (DoS) CVE-2013-6450 Denial of Service (DoS) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP System Management Homepage (SMH) v7.1.2, v7.2, v7.2.1, v7.2.2, v7.3, v7.3.1 for Linux and Windows. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2013-4353 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 CVE-2013-6449 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 CVE-2013-6450 (AV:N/AC:M/Au:N/C:N/I:P/A:P) 5.8 CVE-2014-0160 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has made the following software updates available to resolve the vulnerabilities for the impacted versions of HP System Management Homepage (SMH): Product version/Platform Download Location SMH 7.2.3 Windows x86 http://www.hp.com/swpublishing/MTX-d1488fd987894bc4ab3fe0ef52 SMH 7.2.3 Windows x64 http://www.hp.com/swpublishing/MTX-4575754bbb614b58bf0ae1ac37 SMH 7.3.2.1(B) Windows x86 http://www.hp.com/swpublishing/MTX-27e03b2f9cd24e77adc9dba94a SMH 7.3.2.1(B) Windows x64 http://www.hp.com/swpublishing/MTX-37075daeead2433cb41b59ae76 SMH 7.3.2 Linux x86 http://www.hp.com/swpublishing/MTX-3d92ccccf85f404e8ba36a8178 SMH 7.3.2 Linux x64 http://www.hp.com/swpublishing/MTX-bfd3c0fb11184796b9428ced37 Notes SMH 7.2.3 recommended for customers running Windows 2003 OS Updated OpenSSL to version 1.0.1g Note: If you believe your SMH installation was exploited while it was running components vulnerable to heartbleed, there are some steps to perform after youve upgraded to the non-vulnerable components. These steps include revoking, recreating, and re-importing certificates and resetting passwords that might have been harvested by a malicious attacker using the heartbleed vulnerability. Impact on VCA - VCRM communication: VCA configures VCRM by importing the SMH certificate from the SMH of VCA into the SMH of VCRM. When this certificate is deleted & regenerated (as suggested before), it needs to be (re)imported if the user wants to continue with Trust by Certificate option, and the outdated certificate should be revoked (deleted) from each location where it was previously imported. If you use HPSIMs 2-way trust feature, and have imported SMH certificates into HPSIM, you will also need to revoke those SMH certificated from HPSIM and reimport the newly created SMH certificates. Though SMH uses OS credentials using OS-based APIs, user provided credentials are passed from the client (browser) to the server (SMH) using the HTTPS protocol. If you suspect your systems using SMH were exploited while they were vulnerable to heartbleed, these passwords need to be reset. Frequently Asked Questions Will updated systems require a reboot after applying the SMH patch? No, reboot of the system will not be required. Installing the new build is sufficient to get back to the normal state. Is a Firmware Update necessary in addition to the SMH patch? No, only the SMH update is sufficient to remove the heartbleed-vulnerable version of SMH. Will new certificates be issued along with the patch, or need to be handled separately? If you suspect the certificate has been compromised due to this vulnerability, we do recommend to delete and revoke the certificate, or SMH will reuse the existing certificate. New certificate will be created when SMH service starts (at the end of the fresh / upgrade installation). Instructions on deleting the certificate are in the notes above. Where can I get SMH documentation? All major documents are available at: http://h17007.www1.hp.com/us/en/enterprise/servers/solutions/info-library Select HP Insight Management under Product and Solutions & check HP System Management Homepage to get SMH related documents. What are the recommended upgrade paths? See the table below: SMH DVD SPP Recommended SMH update for Linux Recommended SMH update for Windows 2003 and Widows 2003 R2 Recommended SMH update for other Windows OS versions v7.1.2 v7.1.2 2012.10.0 v7.3.2 v7.2.3 v7.3.2 v7.2.0 v7.2.0 2013.02.0(B) v7.3.2 v7.2.3 v7.3.2 v7.2.1 v7.2u1 v7.3.2 v7.2.3 v7.3.2 v7.2.2 v7.2u2 2013.09.0(B) v7.3.2 v7.2.3 v7.3.2 v7.3.0 v7.3.0 v7.3.2 not supported v7.3.2 v7.3.1 v7.3.1 2014.02.0 v7.3.2 not supported v7.3.2 How can I verify whether my setup is patched successfully? SMH version can be verified by executing following command on: Windows: hp\hpsmh\bin\smhlogreader version Linux: /opt/hp/hpsmh/bin/smhlogreader version Will VCA-VCRM communication be impacted due to the SMH certificate being deleted? VCA configures VCRM by importing the SMH certificate (sslshare\cert.pem) from the SMH of VCA to the SMH of VCRM. When this certificate is deleted & regenerated (as suggested before), it needs to be (re)imported if user wants to continue with Trust by Certificate option, and remove the old, previously imported certificate. Should I reset password on all managed nodes, where SMH was/is running? Though SMH uses OS credentials using OS based APIs, user-provided credentials are passed from the client (browser) to the server (SMH) using the HTTPS protocol. Passwords need to be reset if you suspect the vulnerable version of SMH was exploited by malicious users/ hackers. HISTORY Version:1 (rev.1) - 13 April 2014 Initial release Version:2 (rev.2) - 17 April 2014 SMH 7.2.3 and 7.3.2 released Version:3 (rev.3) - 30 April 2014 SMH 7.3.2.1(B) released Version:4 (rev.4) - 13 May 2014 Added additional remediation steps for post update installation Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2014 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. ========================================================================== Ubuntu Security Notice USN-2079-1 January 09, 2014 openssl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.10 - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS Summary: Several security issues were fixed in OpenSSL. (CVE-2013-4353) Ron Barber discovered that OpenSSL used an incorrect data structure to obtain a version number. (CVE-2013-6449) Dmitry Sobinov discovered that OpenSSL incorrectly handled certain DTLS retransmissions. (CVE-2013-6450) This update also disables the default use of the RdRand feature of certain Intel CPUs as the sole source of entropy. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.10: libssl1.0.0 1.0.1e-3ubuntu1.1 Ubuntu 13.04: libssl1.0.0 1.0.1c-4ubuntu8.2 Ubuntu 12.10: libssl1.0.0 1.0.1c-3ubuntu2.6 Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.11 After a standard system update you need to reboot your computer to make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:03.openssl Security Advisory The FreeBSD Project Topic: OpenSSL multiple vulnerabilities Category: contrib Module: openssl Announced: 2014-01-14 Affects: FreeBSD 10.0 prior to 10.0-RC5 Corrected: 2014-01-07 20:04:41 UTC (stable/10, 10.0-PRERELEASE) 2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC5) 2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC4-p1) 2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC3-p1) 2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC2-p1) 2014-01-07 20:06:20 UTC (releng/10.0, 10.0-RC1-p1) CVE Name: CVE-2013-4353, CVE-2013-6449, CVE-2013-6450 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://security.FreeBSD.org/>. Background FreeBSD includes software from the OpenSSL Project. II. [CVE-2013-6449] III. IV. Workaround No workaround is available. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch http://security.FreeBSD.org/patches/SA-14:03/openssl.patch # fetch http://security.FreeBSD.org/patches/SA-14:03/openssl.patch.asc # gpg --verify openssl.patch.asc b) Execute the following commands as root: # cd /usr/src # patch < /path/to/patch Recompile the operating system using buildworld and installworld as described in <URL:http://www.FreeBSD.org/handbook/makeworld.html>. Restart all deamons using the library, or reboot the system. 3) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/10/ r260404 releng/10.0/ r260405 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: <URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN> VII. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201412-39 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: OpenSSL: Multiple vulnerabilities Date: December 26, 2014 Bugs: #494816, #519264, #525468 ID: 201412-39 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in OpenSSL, the worst of which could result in Denial of Service or Man-in-the-Middle attacks. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/openssl < 1.0.1j *>= 0.9.8z_p2 >= 1.0.1j Description =========== Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details. Resolution ========== All OpenSSL 1.0.1 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.1j" All OpenSSL 0.9.8 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8z_p2" Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages. References ========== [ 1 ] CVE-2013-6449 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6449 [ 2 ] CVE-2013-6450 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6450 [ 3 ] CVE-2014-3505 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3505 [ 4 ] CVE-2014-3506 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3506 [ 5 ] CVE-2014-3507 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3507 [ 6 ] CVE-2014-3509 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3509 [ 7 ] CVE-2014-3510 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3510 [ 8 ] CVE-2014-3511 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3511 [ 9 ] CVE-2014-3512 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3512 [ 10 ] CVE-2014-3513 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3513 [ 11 ] CVE-2014-3567 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3567 [ 12 ] CVE-2014-3568 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3568 [ 13 ] CVE-2014-5139 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5139 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201412-39.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . For the stable distribution (wheezy), these problems have been fixed in version 1.0.1e-2+deb7u1. For the unstable distribution (sid), these problems have been fixed in version 1.0.1e-5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: openssl security update Advisory ID: RHSA-2014:0015-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-0015.html Issue date: 2014-01-08 CVE Names: CVE-2013-4353 CVE-2013-6449 CVE-2013-6450 ===================================================================== 1. Summary: Updated openssl packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. A flaw was found in the way OpenSSL determined which hashing algorithm to use when TLS protocol version 1.2 was enabled. This could possibly cause OpenSSL to use an incorrect hashing algorithm, leading to a crash of an application using the library. A lost or discarded renegotiation handshake packet could cause a DTLS client or server using OpenSSL to crash. (CVE-2013-6450) A NULL pointer dereference flaw was found in the way OpenSSL handled TLS/SSL protocol handshake packets. A specially crafted handshake packet could cause a TLS/SSL client using OpenSSL to crash. (CVE-2013-4353) All OpenSSL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1045363 - CVE-2013-6449 openssl: crash when using TLS 1.2 caused by use of incorrect hash algorithm 1047840 - CVE-2013-6450 openssl: crash in DTLS renegotiation after packet loss 1049058 - CVE-2013-4353 openssl: client NULL dereference crash on malformed handshake packets 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/openssl-1.0.1e-16.el6_5.4.src.rpm i386: openssl-1.0.1e-16.el6_5.4.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm x86_64: openssl-1.0.1e-16.el6_5.4.i686.rpm openssl-1.0.1e-16.el6_5.4.x86_64.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/openssl-1.0.1e-16.el6_5.4.src.rpm i386: openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-devel-1.0.1e-16.el6_5.4.i686.rpm openssl-perl-1.0.1e-16.el6_5.4.i686.rpm openssl-static-1.0.1e-16.el6_5.4.i686.rpm x86_64: openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.x86_64.rpm openssl-devel-1.0.1e-16.el6_5.4.i686.rpm openssl-devel-1.0.1e-16.el6_5.4.x86_64.rpm openssl-perl-1.0.1e-16.el6_5.4.x86_64.rpm openssl-static-1.0.1e-16.el6_5.4.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/openssl-1.0.1e-16.el6_5.4.src.rpm x86_64: openssl-1.0.1e-16.el6_5.4.i686.rpm openssl-1.0.1e-16.el6_5.4.x86_64.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/openssl-1.0.1e-16.el6_5.4.src.rpm x86_64: openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.x86_64.rpm openssl-devel-1.0.1e-16.el6_5.4.i686.rpm openssl-devel-1.0.1e-16.el6_5.4.x86_64.rpm openssl-perl-1.0.1e-16.el6_5.4.x86_64.rpm openssl-static-1.0.1e-16.el6_5.4.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/openssl-1.0.1e-16.el6_5.4.src.rpm i386: openssl-1.0.1e-16.el6_5.4.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-devel-1.0.1e-16.el6_5.4.i686.rpm ppc64: openssl-1.0.1e-16.el6_5.4.ppc.rpm openssl-1.0.1e-16.el6_5.4.ppc64.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.ppc.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.ppc64.rpm openssl-devel-1.0.1e-16.el6_5.4.ppc.rpm openssl-devel-1.0.1e-16.el6_5.4.ppc64.rpm s390x: openssl-1.0.1e-16.el6_5.4.s390.rpm openssl-1.0.1e-16.el6_5.4.s390x.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.s390.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.s390x.rpm openssl-devel-1.0.1e-16.el6_5.4.s390.rpm openssl-devel-1.0.1e-16.el6_5.4.s390x.rpm x86_64: openssl-1.0.1e-16.el6_5.4.i686.rpm openssl-1.0.1e-16.el6_5.4.x86_64.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.x86_64.rpm openssl-devel-1.0.1e-16.el6_5.4.i686.rpm openssl-devel-1.0.1e-16.el6_5.4.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/openssl-1.0.1e-16.el6_5.4.src.rpm i386: openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-perl-1.0.1e-16.el6_5.4.i686.rpm openssl-static-1.0.1e-16.el6_5.4.i686.rpm ppc64: openssl-debuginfo-1.0.1e-16.el6_5.4.ppc64.rpm openssl-perl-1.0.1e-16.el6_5.4.ppc64.rpm openssl-static-1.0.1e-16.el6_5.4.ppc64.rpm s390x: openssl-debuginfo-1.0.1e-16.el6_5.4.s390x.rpm openssl-perl-1.0.1e-16.el6_5.4.s390x.rpm openssl-static-1.0.1e-16.el6_5.4.s390x.rpm x86_64: openssl-debuginfo-1.0.1e-16.el6_5.4.x86_64.rpm openssl-perl-1.0.1e-16.el6_5.4.x86_64.rpm openssl-static-1.0.1e-16.el6_5.4.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/openssl-1.0.1e-16.el6_5.4.src.rpm i386: openssl-1.0.1e-16.el6_5.4.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-devel-1.0.1e-16.el6_5.4.i686.rpm x86_64: openssl-1.0.1e-16.el6_5.4.i686.rpm openssl-1.0.1e-16.el6_5.4.x86_64.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-debuginfo-1.0.1e-16.el6_5.4.x86_64.rpm openssl-devel-1.0.1e-16.el6_5.4.i686.rpm openssl-devel-1.0.1e-16.el6_5.4.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/openssl-1.0.1e-16.el6_5.4.src.rpm i386: openssl-debuginfo-1.0.1e-16.el6_5.4.i686.rpm openssl-perl-1.0.1e-16.el6_5.4.i686.rpm openssl-static-1.0.1e-16.el6_5.4.i686.rpm x86_64: openssl-debuginfo-1.0.1e-16.el6_5.4.x86_64.rpm openssl-perl-1.0.1e-16.el6_5.4.x86_64.rpm openssl-static-1.0.1e-16.el6_5.4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-4353.html https://www.redhat.com/security/data/cve/CVE-2013-6449.html https://www.redhat.com/security/data/cve/CVE-2013-6450.html https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSzZgHXlSAg2UNWIIRAofWAJ0UK4cssiN2fV0WOt0Ui+wDi/A1BwCfUSDk njgv4mXCZgK/Bf84S2BcZl8= =j7J/ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6450 _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 0a21492e02429e199dfc88e8d502de88 mbs1/x86_64/lib64openssl1.0.0-1.0.0k-1.1.mbs1.x86_64.rpm 13eaad31a74bb167ce0d661eb25b5ca1 mbs1/x86_64/lib64openssl-devel-1.0.0k-1.1.mbs1.x86_64.rpm fca41114d79983a4d7600ba9a97cea3f mbs1/x86_64/lib64openssl-engines1.0.0-1.0.0k-1.1.mbs1.x86_64.rpm acaf2f9638cf2bafeeb3a0aebc173e85 mbs1/x86_64/lib64openssl-static-devel-1.0.0k-1.1.mbs1.x86_64.rpm 8d7142a0c95315a29de750e2e29f2174 mbs1/x86_64/openssl-1.0.0k-1.1.mbs1.x86_64.rpm 35c5ec534b80c03ae237526e75c52c18 mbs1/SRPMS/openssl-1.0.0k-1.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security

LINE 3.2.1.83 and earlier on Windows and 3.2.1 and earlier on OS X does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. LINE is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks. NHN PlayArt LINE is a set of instant chat software developed by Japan NHN PlayArt Company. The software supports free calls, sending text messages and more. There are security vulnerabilities in NHN PlayArt LINE 3.2.1.83 and earlier versions based on Windows platform and NHN PlayArt LINE 3.2.1 and earlier versions based on OS X platform

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. (dot dot) in the (1) path parameter to file_delete.cgi or (2) folder_path parameter to file_share.cgi in webapi/FileStation/; (3) dlink parameter to fbdownload/; or unspecified parameters to (4) html5_upload.cgi, (5) file_download.cgi, (6) file_sharing.cgi, (7) file_MVCP.cgi, or (8) file_rename.cgi in webapi/FileStation/. Synology DiskStation Manager (DSM) of FileBrowser The component contains a directory traversal vulnerability.By a third party .. ( Dot dot ) including webapi/FileStation/ Arbitrary files may be read, written, and deleted via the following parameters in. Synology DiskStation Manager is prone to a multiple directory-traversal vulnerabilities. Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to bypass security restrictions and perform unauthorized actions on system and configuration files in the context of the application. Synology DiskStation Manager 4.3-3810 and prior are vulnerable. The operating system can manage data, documents, photos, music and other information. The vulnerability is caused by (1) the file_delete.cgi script does not filter the 'path' parameter correctly; (2) the file_share in the webapi/FileStation/ directory .cgi script does not filter 'folder_path' parameter correctly; (3) fbdownload/ directory does not filter 'dlink' parameter correctly; (4) html5_upload.cgi, file_download.cgi, file_sharing.cgi, file_MVCP.cgi and The file_rename.cgi script did not properly filter parameters. ************************************************************** Title: Synology DSM multiple directory traversal Version affected: <= 4.3-3810 Vendor: Synology Discovered by: Andrea Fabrizi Email: andrea.fabrizi@gmail.com Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status: patched CVE: 2013-6987 ************************************************************** I'm again here with a Synology DSM vulnerability. Synology DiskStation Manager (DSM) it's a Linux based operating system, used for the DiskStation and RackStation products. This kind of vulnerability allows any authenticated user, even if not administrative, to access, create, delete, modify system and configuration files. The only countermeasure implemented against this vulnerability is the check that the path starts with a valid shared folder, so is enough to put the "../" straight after, to bypass the security check. Vulnerables CGIs: - /webapi/FileStation/html5_upload.cgi - /webapi/FileStation/file_delete.cgi - /webapi/FileStation/file_download.cgi - /webapi/FileStation/file_sharing.cgi - /webapi/FileStation/file_share.cgi - /webapi/FileStation/file_MVCP.cgi - /webapi/FileStation/file_rename.cgi Not tested all the CGI, but I guess that many others are vulnerable, so don't take my list as comprehensive. Following some examples ("test" is a valid folder name): - Delete /etc/passwd =========================================== POST /webapi/FileStation/file_delete.cgi HTTP/1.1 Host: 192.168.56.101:5000 X-SYNO-TOKEN: XXXXXXXX Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Content-Length: 103 Cookie: stay_login=0; id=kjuYI0HvD92m6 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache path=/test/../../etc/passwd&accurate_progress=true&api=SYNO.FileStation.Delete&method=start&version=1 =========================================== - Arbitrary file download: =========================================== GET /fbdownload/?dlink=2f746573742f2e2e2f2e2e2f6574632f706173737764 HTTP/1.1 Host: 192.168.56.101:5000 Connection: keep-alive Authorization: Basic XXXXXXXX =========================================== 2f746573742f2e2e2f2e2e2f6574632f706173737764 -> /test/../../etc/passwd - Remote file list: ========================= POST /webapi/FileStation/file_share.cgi HTTP/1.1 Host: 192.168.56.101:5000 X-SYNO-TOKEN: XXXXXXXX Content-Length: 75 Cookie: stay_login=0; id=f9EThJSyRaqJM; BCSI-CS-36db57a1c38ce2f6=2 folder_path=/test/../../tmp&api=SYNO.FileStation.List&method=list&version=1 ========================== Timeline: - 05/12/2013: First contact with the vendor - 06/12/2013: Vulnerability details sent to the vendor - 20/12/2013: Patch released by the vendor . http://www.synology.com/en-global/company/news/article/437 February 14, 2014\x97Synology\xae confirmed known security issues (reported as CVE-2013-6955 and CVE-2013-6987) which would cause compromise to file access authority in DSM. An updated DSM version resolving these issues has been released accordingly. The followings are possible symptoms to appear on affected DiskStation and RackStation: Exceptionally high CPU usage detected in Resource Monitor: CPU resource occupied by processes such as dhcp.pid, minerd, synodns, PWNED, PWNEDb, PWNEDg, PWNEDm, or any processes with PWNED in their names Appearance of non-Synology folder: An automatically created shared folder with the name \x93startup\x94, or a non-Synology folder appearing under the path of \x93/root/PWNED\x94 Redirection of the Web Station: \x93Index.php\x94 is redirected to an unexpected page Appearance of non-Synology CGI program: Files with meaningless names exist under the path of \x93/usr/syno/synoman\x94 Appearance of non-Synology script file: Non-Synology script files, such as \x93S99p.sh\x94, appear under the path of \x93/usr/syno/etc/rc.d\x94 If users identify any of above situation, they are strongly encouraged to do the following: For DiskStation or RackStation running on DSM 4.3, please follow the instruction here (http://www.synology.com/en-global/support/faq/348) to REINSTALL DSM 4.3-3827. For DiskStation or RackStation running on DSM 4.0, it\x92s recommended to REINSTALL DSM 4.0-2259 or onward from Synology Download Center. For DiskStation or RackStation running on DSM 4.1 or DSM 4.2, it\x92s recommended to REINSTALL DSM 4.2-3243 or onward from Synology Download Center (http://www.synology.com/en-global/support/download). Confidentiality Impact Complete (There is total information disclosure, resulting in all system files being revealed.) Integrity Impact Complete (There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised.) Availability Impact Complete (There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.) Access Complexity Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. ) Authentication Not required (Authentication is not required to exploit the vulnerability.) Gained Access None Vulnerability Type(s) Execute Code This is also known as the /PWNED or /lolz hack

Directory traversal vulnerability in tar in Cisco NX-OS allows local users to access arbitrary files via crafted command-line arguments, aka Bug IDs CSCty07157, CSCty07159, CSCty07162, and CSCty07164. Cisco NX-OS of tar Contains a directory traversal vulnerability. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Since the program fails to properly filter the input submitted by the user, the local attacker can access any file through the tar command. Cisco NX-OS is prone to a local arbitrary file-access vulnerability because it fails to sanitize user-supplied input. Local attackers can exploit this issue to access arbitrary files using directory-traversal strings. This may lead to further attacks. This issue is being tracked by Cisco Bug IDs CSCty07157, CSCty07159, CSCty07162, and CSCty07164

Directory traversal vulnerability in filesys in Cisco NX-OS 6.1(2) and earlier allows local users to access arbitrary files via crafted command-line arguments during a delete action, aka Bug IDs CSCty07270, CSCty07271, CSCty07273, and CSCty07275. Cisco NX-OS of filesys Contains a directory traversal vulnerability. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Cisco NX-OS is prone to a local arbitrary file-access vulnerability because it fails to sanitize user-supplied input. Local attackers can exploit this issue to delete arbitrary files using directory-traversal strings. This may lead to further attacks. This issue is being tracked by Cisco Bug IDs CSCty07270, CSCty07271, CSCty07273, and CSCty07275. The vulnerability is caused by the program not adequately filtering the input submitted by the user

The UPC Ireland Cisco EPC 2425 router (aka Horizon Box) does not have a sufficiently large number of possible WPA-PSK passphrases, which makes it easier for remote attackers to obtain access via a brute-force attack. Cisco EPC 2425 (also known as Horizon Box) is a wireless router device of Cisco (Cisco)

D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 have a hardcoded account of username gkJ9232xXyruTRmY, which makes it easier for remote attackers to obtain access by leveraging knowledge of the username. plural D-Link Router product firmware is user name gkJ9232xXyruTRmY There is a vulnerability that can be obtained because it has a hard-coded account.An access right may be obtained by using the user name information by a third party. D-Link DSR is a wireless service router product developed by D-Link. D-Link DSR Router Series are prone to a security-bypass vulnerability. A trust management vulnerability exists in several D-Link products. The vulnerability stems from the fact that the program has a hard-coded user account named 'gkJ9232xXyruTRmY'. The following products and versions are affected: DSR-150 with firmware version 1.08B29 and earlier; DSR-150N with firmware version 1.05B51 and earlier; DSR-250 and DSR-250N with firmware version 1.08B39 and earlier; DSR-500, DSR-500N, DSR-1000, DSR-1000N with previous firmware versions

Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003B015D02SP08C1014 (23.015.02.08.1014) use a weak ACL for the "Mobile Partner" directory, which allows remote attackers to gain SYSTEM privileges by compromising a low privilege account and modifying Mobile Partner.exe. Huawei EC156 , EC176 ,and EC177 USB Modem product software contains an unreliable search path vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. du Mobile Broadband is a wireless bandwidth device from China's Huawei. There is a local elevation of privilege vulnerability in du Mobile broadband. A local attacker could use this vulnerability to execute arbitrary code with SYSTEM privileges. There are vulnerabilities in du Mobile broadband 16.002.03.16.124, other versions may also be affected. This may aid in further attacks. It lets you access du wireless internetwherever you are and whenever you need it, all powered throughyour mobile data SIM or simply by connecting your 3G USB stickto your device.The application is vulnerable to an elevation of privilegesvulnerability which can be used by a simple user that can changethe executable file with a binary of choice. The vulnerabilityexist due to the improper permissions, with the 'F' flag (full)for the 'Everyone' and 'Users' group, for the 'du Mobile Broadband.exe'binary file. The files are installed in the 'du Mobile Broadband'directory which has the Everyone group assigned to it with fullpermissions making every single file inside vulnerable to changeby any user on the affected machine. After you replace the binarywith your rootkit, on reboot you get SYSTEM privileges.Tested on: Microsoft Windows 7 Ultimate SP1 (EN) 64bit. Huawei EC156, EC176 and EC177 are wireless network card products of China Huawei (Huawei). The following versions are affected: Huawei EC156 UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) Version; EC176 UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) Version; EC177 UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) Version

Untrusted search path vulnerability in Huawei Mobile Partner for Windows 23.009.05.03.1014 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll in the Mobile Partner directory. du Mobile Broadband is a wireless bandwidth device from China's Huawei. There is a local elevation of privilege vulnerability in du Mobile broadband. A local attacker could use this vulnerability to execute arbitrary code with SYSTEM privileges. There are vulnerabilities in du Mobile broadband 16.002.03.16.124, other versions may also be affected. Attackers can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. It lets you access du wireless internetwherever you are and whenever you need it, all powered throughyour mobile data SIM or simply by connecting your 3G USB stickto your device.The application is vulnerable to an elevation of privilegesvulnerability which can be used by a simple user that can changethe executable file with a binary of choice. The vulnerabilityexist due to the improper permissions, with the 'F' flag (full)for the 'Everyone' and 'Users' group, for the 'du Mobile Broadband.exe'binary file. The files are installed in the 'du Mobile Broadband'directory which has the Everyone group assigned to it with fullpermissions making every single file inside vulnerable to changeby any user on the affected machine. After you replace the binarywith your rootkit, on reboot you get SYSTEM privileges.Tested on: Microsoft Windows 7 Ultimate SP1 (EN) 64bit. Huawei Mobile Partner for Windows is a 3G network card client for Windows platform of China Huawei (Huawei), which is mainly used for 3G dial-up Internet access

D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 stores account passwords in cleartext, which allows local users to obtain sensitive information by reading the Users[#]["Password"] fields in /tmp/teamf1.cfg.ascii. D-Link DSR is a wireless service router product. There are multiple information disclosure vulnerabilities in the D-Link DSR Router Series account credentials. Allows an attacker to access sensitive information. The information obtained may lead to further attacks. The following products and versions are affected: DSR-150 with firmware version 1.08B29 and earlier; DSR-150N with firmware version 1.05B51 and earlier; DSR-250 and DSR-250N with firmware version 1.08B39 and earlier; DSR-500, DSR-500N, DSR-1000, DSR-1000N with previous firmware versions

lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf. Cups is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges on affected computers. Apple CUPS (Common Unix Printing System) is an open source printing system for OS X and Unix-like systems developed by Apple. The system is based on the Internet Printing Protocol (IPP) and provides most PostScript and raster printer services. A security vulnerability exists in Apple CUPS versions prior to 1.7.1 that stems from a bug in the configuration of the lppasswd application. A local attacker could use this to read sensitive information from certain files, bypassing access restrictions (CVE-2013-6891). ========================================================================== Ubuntu Security Notice USN-2082-1 January 15, 2014 cups vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.10 - Ubuntu 13.04 - Ubuntu 12.10 Summary: CUPS could be made to expose sensitive information. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.10: cups-client 1.7.0~rc1-0ubuntu5.2 Ubuntu 13.04: cups-client 1.6.2-1ubuntu8 Ubuntu 12.10: cups-client 1.6.1-0ubuntu11.5 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2082-1 CVE-2013-6891 Package Information: https://launchpad.net/ubuntu/+source/cups/1.7.0~rc1-0ubuntu5.2 https://launchpad.net/ubuntu/+source/cups/1.6.2-1ubuntu8 https://launchpad.net/ubuntu/+source/cups/1.6.1-0ubuntu11.5 . Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_absolute function (CVE-2014-2856). The updated packages have been patched to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6891 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2856 _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: 8143b2a3b767ee960c28f10516d55d2a mes5/i586/cups-1.3.10-0.7mdvmes5.2.i586.rpm bc9a8e5908dc217cb7e985dcaa090948 mes5/i586/cups-common-1.3.10-0.7mdvmes5.2.i586.rpm 64176366b00b7c3e7f7f35f35aafe26d mes5/i586/cups-serial-1.3.10-0.7mdvmes5.2.i586.rpm c4926d589017411ae66815746ee6c6ba mes5/i586/libcups2-1.3.10-0.7mdvmes5.2.i586.rpm 2e2ba1cd0bfa7dcd21276255ff4d747c mes5/i586/libcups2-devel-1.3.10-0.7mdvmes5.2.i586.rpm 5171a744370db45781755f21d3f56f7c mes5/i586/php-cups-1.3.10-0.7mdvmes5.2.i586.rpm 1658bb3253e9d923361e9a078be83a5b mes5/SRPMS/cups-1.3.10-0.7mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 9030814a190e5e1892e9a0d08e88f645 mes5/x86_64/cups-1.3.10-0.7mdvmes5.2.x86_64.rpm 27119afd41865890903bf904130ee425 mes5/x86_64/cups-common-1.3.10-0.7mdvmes5.2.x86_64.rpm e9bdae3ea58237d04e1b0696bc792113 mes5/x86_64/cups-serial-1.3.10-0.7mdvmes5.2.x86_64.rpm cae11ff7c5eac9fdd9716526dbcb179d mes5/x86_64/lib64cups2-1.3.10-0.7mdvmes5.2.x86_64.rpm 91bbc04883ddcf7c1b7e4f9609a81fd6 mes5/x86_64/lib64cups2-devel-1.3.10-0.7mdvmes5.2.x86_64.rpm 160961b924ac72272951552d3641a7ec mes5/x86_64/php-cups-1.3.10-0.7mdvmes5.2.x86_64.rpm 1658bb3253e9d923361e9a078be83a5b mes5/SRPMS/cups-1.3.10-0.7mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFTddX2mqjQ0CJFipgRAtgAAKCXOPqgzFuMZiQtBTaVqF1CQ+qspACfRw2C GRomzZDVSFilfqhmbpIJHDU= =ZAUC -----END PGP SIGNATURE-----

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow physically proximate attackers to cause a denial of service (driver crash and process restart) via crafted input over a serial line. The NovaTech Orion Substation Automation Platform is a SCADA RTU system using the DNP3 protocol. NovaTech Orion DNP3 Driver is prone to a local denial-of-service vulnerability. Successfully exploiting this issue can cause denial-of-service conditions

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow remote attackers to cause a denial of service (driver crash and process restart) via a crafted DNP3 TCP packet. The NovaTech Orion Substation Automation Platform is a SCADA RTU system using the DNP3 protocol. Successfully exploiting this issue can cause denial-of-service conditions

Schneider Electric Accutech Manager is a real-time monitoring and management software based on windows services. Schneider Electric Accutech Manager failed to properly filter the input submitted to the RFManagerService service listening on port 2536, allowing remote attackers to use the vulnerability to submit specially crafted SQL queries that can obtain or manipulate database data. Accutech Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Versions prior to Accutech Manager 2.00.4 are vulnerable

The disaster recovery system (DRS) component in Cisco Unified Communications Manager (UCM) 9.1(1) and earlier allows remote authenticated users to obtain sensitive device information by reading "extraneous information" in HTML source code, aka Bug ID CSCuj39249. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. This issue is being tracked by Cisco BugId CSCuj39249. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

SAP Customer Relationship Management is a customer relationship management solution. SAP Customer Relationship Management The SAP XML parser (/sap/crm/crm_flex_data) has an error in processing XML entities and no detailed vulnerability details are available

The tNetTaskLimit process on the Transport Node Controller (TNC) on Cisco ONS 15454 devices with software 9.6 and earlier does not properly prioritize health pings, which allows remote attackers to cause a denial of service (watchdog timeout and TNC reset) via a flood of network traffic, aka Bug ID CSCud97155. Vendors have confirmed this vulnerability Bug ID CSCud97155 It is released as.Service disruption by a third party through a large amount of network traffic (watchdog Timeout and TNC reset ) There is a possibility of being put into a state. Cisco ONS 15454 Transport Node Controller is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause an affected device to reload due to a watchdog timeout, denying service to legitimate users. This issue is being tracked by Cisco bug ID CSCud97155. Cisco ONS 15454 is a set of optical network multi-service transmission platform of American Cisco (Cisco). The platform provides the industry standard for metro and regional dense wavelength division multiplexing (DWDM) solutions

The Beetel TC1-450 Wireless Router has multiple cross-site request forgery vulnerabilities that allow remote attackers to build malicious URIs, entice users to resolve, and perform malicious actions in the target user context. Such as changing the WPA password, router reset, change management password, etc. Beetel TC1-450 wireless Router is a wireless router equipment of Beetel Company in India. There is a cross-site request forgery vulnerability in Beetel TC1-450 wireless routers using TM4-0Q-020 and earlier firmware. A remote attacker could use this vulnerability to perform administrator actions to control the affected device

Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of administrators for requests that change a password via the Password and PasswordReEnter parameters, aka Bug ID CSCuh37496. Cisco EPC3925 Device goform/Quick_setup Contains a cross-site request forgery vulnerability. The Cisco EPC3925 Router is a home router device. Such as changing the management password. The Cisco EPC3925 failed to properly filter user-submitted 'DdnsHostName' parameter data, allowing remote attackers to exploit vulnerabilities for persistent cross-site scripting vulnerabilities to obtain sensitive information or hijack user sessions. Cisco EPC3925 is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. Cisco EPC3925 epc3925-E10-5-v302r125572-130520c is affected. Exploiting this issue may allow a remote attacker to perform certain administrative actions and compromise the affected device. This issue is being tracked by Cisco Bug IDs CSCuh37496. The vulnerability stems from the fact that the goform/Quick_setup URL does not properly validate the request