VARIoT IoT vulnerabilities database

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. SSL A vulnerability that impersonates a server exists. Python is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from the server. An attacker can exploit this issue to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks. CVE-2014-1912 Ryan Smith-Roberts discovered a buffer overflow in the socket.recvfrom_into() function. For the stable distribution (wheezy), these problems have been fixed in version 2.7.3-6+deb7u2. For the unstable distribution (sid), these problems have been fixed in version 2.7.6-7. We recommend that you upgrade your python2.7 packages. Summary VMware vSphere product updates address a Cross Site Scripting issue, a certificate validation issue and security vulnerabilities in third-party libraries. Relevant releases VMware vCenter Server Appliance 5.1 Prior to Update 3 VMware vCenter Server 5.5 prior to Update 2 VMware vCenter Server 5.1 prior to Update 3 VMware vCenter Server 5.0 prior to Update 3c VMware ESXi 5.1 without patch ESXi510-201412101-SG 3. Problem Description a. VMware vCSA cross-site scripting vulnerability VMware vCenter Server Appliance (vCSA) contains a vulnerability that may allow for Cross Site Scripting. Exploitation of this vulnerability in vCenter Server requires tricking a user to click on a malicious link or to open a malicious web page while they are logged in into vCenter. VMware would like to thank Tanya Secker of Trustwave SpiderLabs for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-3797 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======= ======= ================= vCSA 5.5 any Not Affected vCSA 5.1 any 5.1 Update 3 vCSA 5.0 any Not Affected b. vCenter Server certificate validation issue vCenter Server does not properly validate the presented certificate when establishing a connection to a CIM Server residing on an ESXi host. This may allow for a Man-in-the-middle attack against the CIM service. VMware would like to thank The Google Security Team for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2014-8371 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======= ======= ============== vCenter Server 5.5 any 5.5 Update 2 vCenter Server 5.1 any 5.1 Update 3 vCenter Server 5.0 any 5.0 Update 3c c. Update to ESXi libxml2 package libxml2 is updated to address multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2013-2877 and CVE-2014-0191 to these issues. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======= ======= ================= ESXi 5.5 any Patch Pending ESXi 5.1 any ESXi510-201412101-SG ESXi 5.0 any No patch planned d. Update to ESXi Curl package Curl is updated to address multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2014-0015 and CVE-2014-0138 to these issues. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ========= ======= ======= ================= ESXi 5.5 any Patch Pending ESXi 5.1 any ESXi510-201412101-SG ESXi 5.0 any No patch planned e. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2013-1752 and CVE-2013-4238 to these issues. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======= ======= ================= ESXi 5.5 any Patch Pending ESXi 5.1 any ESXi510-201412101-SG ESXi 5.0 any Patch Pending f. vCenter and Update Manager, Oracle JRE 1.6 Update 81 Oracle has documented the CVE identifiers that are addressed in JRE 1.6.0 update 81 in the Oracle Java SE Critical Patch Update Advisory of July 2014. The References section provides a link to this advisory. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======= ======= ================= vCenter Server 5.5 any not applicable * vCenter Server 5.1 any 5.1 Update 3 vCenter Server 5.0 any patch pending vCenter Update Manager 5.5 any not applicable * vCenter Update Manager 5.1 any 5.1 Update 3 vCenter Update Manager 5.0 any patch pending * this product uses the Oracle JRE 1.7.0 family 4. Solution Please review the patch/release notes for your product and version and verify the checksum of your downloaded file. vCSA 5.1 Update 3, vCenter Server 5.1 Update 3 and Update Manager 5.1 Update 3 ---------------------------- Downloads and Documentation: https://www.vmware.com/go/download-vsphere ESXi 5.1 ---------------------------- File: update-from-esxi5.1-5.1_update03.zip.zip md5sum: b3fd3549b59c6c59c04bfd09b08c6edf sha1sum: 02139101fe205894774caac02820f6ea8416fb8b http://kb.vmware.com/kb/2086288 update-from-esxi5.1-5.1_update03 contains ESXi510-201412101-SG 5. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3797 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8371 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0015 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1752 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4238 JRE Oracle Java SE Critical Patch Update Advisory of July 2014 http://www.oracle.com/technetwork/topics/security/cpujul2014- 1972956.html - ------------------------------------------------------------------------ 6. Change log 2014-12-04 VMSA-2014-0012 Initial security advisory in conjunction with the release of VMware vCSA 5.1 Update 3, vCenter Server 5.1 Update 3 and ESXi 5.1 Patches released on 2014-12-04. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce at lists.vmware.com bugtraq at securityfocus.com fulldisclosure at seclists.org E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories Consolidated list of VMware Security Advisories http://kb.vmware.com/kb/2078735 VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html Twitter https://twitter.com/VMwareSRC Copyright 2014 VMware Inc. All rights reserved. Relevant releases/architectures: RHEV Hypervisor for RHEL-6 - noarch 3. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. Upgrade Note: If you upgrade the Red Hat Enterprise Virtualization Hypervisor through the 3.2 Manager administration portal, the Host may appear with the status of "Install Failed". If this happens, place the host into maintenance mode, then activate it again to get the host back to an "Up" state. A buffer overflow flaw was found in the way QEMU processed the SCSI "REPORT LUNS" command when more than 256 LUNs were specified for a single SCSI target. A privileged guest user could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2013-4344) Multiple flaws were found in the way Linux kernel handled HID (Human Interface Device) reports. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2013-4238) The default OpenSSH configuration made it easy for remote attackers to exhaust unauthorized connection slots and prevent other users from being able to log in to a system. This flaw has been addressed by enabling random early connection drops by setting MaxStartups to 10:30:100 by default. For more information, refer to the sshd_config(5) man page. The security fixes included in this update address the following CVE numbers: CVE-2012-0786 and CVE-2012-0787 (augeas issues) CVE-2013-1813 (busybox issue) CVE-2013-0221, CVE-2013-0222, and CVE-2013-0223 (coreutils issues) CVE-2012-4453 (dracut issue) CVE-2013-4332, CVE-2013-0242, and CVE-2013-1914 (glibc issues) CVE-2013-4387, CVE-2013-0343, CVE-2013-4345, CVE-2013-4591, CVE-2013-4592, CVE-2012-6542, CVE-2013-3231, CVE-2013-1929, CVE-2012-6545, CVE-2013-1928, CVE-2013-2164, CVE-2013-2234, and CVE-2013-2851 (kernel issues) CVE-2013-4242 (libgcrypt issue) CVE-2013-4419 (libguestfs issue) CVE-2013-1775, CVE-2013-2776, and CVE-2013-2777 (sudo issues) This update also fixes the following bug: * A previous version of the rhev-hypervisor6 package did not contain the latest vhostmd package, which provides a "metrics communication channel" between a host and its hosted virtual machines, allowing limited introspection of host resource usage from within virtual machines. This has been fixed, and rhev-hypervisor6 now includes the latest vhostmd package. Bugs fixed (https://bugzilla.redhat.com/): 908060 - rhev-hypervisor 6.5 release 908707 - CVE-2010-5107 openssh: Prevent connection slot exhaustion attacks 996381 - CVE-2013-4238 python: hostname check bypassing vulnerability in SSL module 999890 - CVE-2013-2889 Kernel: HID: zeroplus: heap overflow flaw 1000429 - CVE-2013-2892 Kernel: HID: pantherlord: heap overflow flaw 1000451 - CVE-2013-2888 Kernel: HID: memory corruption flaw 1007330 - CVE-2013-4344 qemu: buffer overflow in scsi_target_emulate_report_luns 1026703 - Latest vhostmd package is not built in 6. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: python security, bug fix, and enhancement update Advisory ID: RHSA-2013:1582-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1582.html Issue date: 2013-11-21 CVE Names: CVE-2013-4238 ===================================================================== 1. Summary: Updated python packages that fix one security issue, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: Python is an interpreted, interactive, object-oriented programming language. Note that to exploit this issue, an attacker would need to obtain a carefully crafted certificate signed by an authority that the client trusts. (CVE-2013-4238) These updated python packages include numerous bug fixes and one enhancement. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes. All users of python are advised to upgrade to these updated packages, which fix these issues and add this enhancement. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 521898 - Fix instances of #!/usr/bin/env python in python-tools 841937 - RHEL 6 installation fails when Turkish language is selected 845802 - python prepends UTF-8 BOM syslog messages - causes messages to be treated a EMERG level 893034 - yum traceback with python-2.6.6-29.el6_2.2 and higher + missing /dev/urandom 919163 - python logging problem - when rotating to new log file, logger checks file's stat when the file does not exist 928390 - Python SSLSocket.getpeercert() incorrectly returns an empty Subject Alternative Name from peer certificate. 948025 - SocketServer doesn't handle syscall interruption 958868 - Downstream added "timeout=None" keyword argument causes regression in eventlet 960168 - failed incoming SSL connection stays open 978129 - Please consider to backport patch: issue9374 urlparse should parse query and fragment for arbitrary schemes 996381 - CVE-2013-4238 python: hostname check bypassing vulnerability in SSL module 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/python-2.6.6-51.el6.src.rpm i386: python-2.6.6-51.el6.i686.rpm python-debuginfo-2.6.6-51.el6.i686.rpm python-libs-2.6.6-51.el6.i686.rpm tkinter-2.6.6-51.el6.i686.rpm x86_64: python-2.6.6-51.el6.x86_64.rpm python-debuginfo-2.6.6-51.el6.x86_64.rpm python-libs-2.6.6-51.el6.x86_64.rpm tkinter-2.6.6-51.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/python-2.6.6-51.el6.src.rpm i386: python-debuginfo-2.6.6-51.el6.i686.rpm python-devel-2.6.6-51.el6.i686.rpm python-test-2.6.6-51.el6.i686.rpm python-tools-2.6.6-51.el6.i686.rpm x86_64: python-debuginfo-2.6.6-51.el6.x86_64.rpm python-devel-2.6.6-51.el6.x86_64.rpm python-test-2.6.6-51.el6.x86_64.rpm python-tools-2.6.6-51.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/python-2.6.6-51.el6.src.rpm x86_64: python-2.6.6-51.el6.x86_64.rpm python-debuginfo-2.6.6-51.el6.x86_64.rpm python-devel-2.6.6-51.el6.x86_64.rpm python-libs-2.6.6-51.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/python-2.6.6-51.el6.src.rpm x86_64: python-debuginfo-2.6.6-51.el6.x86_64.rpm python-test-2.6.6-51.el6.x86_64.rpm python-tools-2.6.6-51.el6.x86_64.rpm tkinter-2.6.6-51.el6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/python-2.6.6-51.el6.src.rpm i386: python-2.6.6-51.el6.i686.rpm python-debuginfo-2.6.6-51.el6.i686.rpm python-devel-2.6.6-51.el6.i686.rpm python-libs-2.6.6-51.el6.i686.rpm tkinter-2.6.6-51.el6.i686.rpm ppc64: python-2.6.6-51.el6.ppc64.rpm python-debuginfo-2.6.6-51.el6.ppc64.rpm python-devel-2.6.6-51.el6.ppc64.rpm python-libs-2.6.6-51.el6.ppc64.rpm tkinter-2.6.6-51.el6.ppc64.rpm s390x: python-2.6.6-51.el6.s390x.rpm python-debuginfo-2.6.6-51.el6.s390x.rpm python-devel-2.6.6-51.el6.s390x.rpm python-libs-2.6.6-51.el6.s390x.rpm x86_64: python-2.6.6-51.el6.x86_64.rpm python-debuginfo-2.6.6-51.el6.x86_64.rpm python-devel-2.6.6-51.el6.x86_64.rpm python-libs-2.6.6-51.el6.x86_64.rpm tkinter-2.6.6-51.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/python-2.6.6-51.el6.src.rpm i386: python-debuginfo-2.6.6-51.el6.i686.rpm python-test-2.6.6-51.el6.i686.rpm python-tools-2.6.6-51.el6.i686.rpm ppc64: python-debuginfo-2.6.6-51.el6.ppc64.rpm python-test-2.6.6-51.el6.ppc64.rpm python-tools-2.6.6-51.el6.ppc64.rpm s390x: python-debuginfo-2.6.6-51.el6.s390x.rpm python-test-2.6.6-51.el6.s390x.rpm python-tools-2.6.6-51.el6.s390x.rpm tkinter-2.6.6-51.el6.s390x.rpm x86_64: python-debuginfo-2.6.6-51.el6.x86_64.rpm python-test-2.6.6-51.el6.x86_64.rpm python-tools-2.6.6-51.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/python-2.6.6-51.el6.src.rpm i386: python-2.6.6-51.el6.i686.rpm python-debuginfo-2.6.6-51.el6.i686.rpm python-devel-2.6.6-51.el6.i686.rpm python-libs-2.6.6-51.el6.i686.rpm tkinter-2.6.6-51.el6.i686.rpm x86_64: python-2.6.6-51.el6.x86_64.rpm python-debuginfo-2.6.6-51.el6.x86_64.rpm python-devel-2.6.6-51.el6.x86_64.rpm python-libs-2.6.6-51.el6.x86_64.rpm tkinter-2.6.6-51.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/python-2.6.6-51.el6.src.rpm i386: python-debuginfo-2.6.6-51.el6.i686.rpm python-test-2.6.6-51.el6.i686.rpm python-tools-2.6.6-51.el6.i686.rpm x86_64: python-debuginfo-2.6.6-51.el6.x86_64.rpm python-test-2.6.6-51.el6.x86_64.rpm python-tools-2.6.6-51.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2013-4238.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Technical_Notes/python.html#RHSA-2013-1582 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSjYqsXlSAg2UNWIIRAuMMAJwM8jw9rPAfeyuTRa3MRzo4uld8KACfQjmk XBl65OiG/woL4p1WaTgJdK0= =MrR1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ============================================================================ Ubuntu Security Notice USN-1983-1 October 01, 2013 python2.7 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS Summary: Several security issues were fixed in Python. An attacker could exploit this to cause Python to consume resources, resulting in a denial of service. This issue only affected Ubuntu 13.04. (CVE-2013-4238) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.04: python2.7 2.7.4-2ubuntu3.2 python2.7-minimal 2.7.4-2ubuntu3.2 Ubuntu 12.10: python2.7 2.7.3-5ubuntu4.3 python2.7-minimal 2.7.3-5ubuntu4.3 Ubuntu 12.04 LTS: python2.7 2.7.3-0ubuntu3.4 python2.7-minimal 2.7.3-0ubuntu3.4 In general, a standard system update will make all the necessary changes

The RAKP protocol support in the Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers sends a password hash to the client, which makes it easier for remote attackers to obtain access via a brute-force attack. Intelligent Platform Management Interface is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions on the affected computer. This may aid in further attacks

The client application in Siemens COMOS before 9.1 Update 458, 9.2 before 9.2.0.6.37, and 10.0 before 10.0.3.0.19 allows local users to gain privileges and bypass intended database-operation restrictions by leveraging COMOS project access. Siemens COMOS is a factory management software developed by Siemens. The following products are affected by this vulnerability: COMOS 9.1 prior to COMOS 9.1 LyraUpdate458 (Update 458) prior to COMOS 9.2 V092_Upd06_Patch037 (9.2.0.6.37) Prior to COMOS 10.0 V100_SP03_Patch019 (10.0.3.0.19). Siemens COMOS is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges, which may aid in further attacks. The software enables the holistic design and management of plant and machinery assets throughout their lifecycle

Cisco Finesse allows remote attackers to obtain sensitive information by sniffing the network for HTTP query data, aka Bug ID CSCug16732. Cisco Finesse Contains a vulnerability in which important information is obtained. Attackers can exploit this issue to gain access to sensitive information that may lead to further attacks. This issue is being tracked by Cisco Bug ID CSCug16732. The software improves call center service quality, improves customer experience, and increases agent satisfaction

Absolute path traversal vulnerability in the web interface in Cisco Finesse allows remote attackers to read directory contents via a direct request to a directory URL, aka Bug ID CSCug16772. Cisco Finesse is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. This issue is being tracked by Cisco BugId CSCug16772. The software improves call center service quality, improves customer experience, and increases agent satisfaction

Vodafone EasyBox is a router device. The Vodafone EasyBox device generates a WPS-PIN based on the MAC address and device serial number, allowing remote attackers to exploit the vulnerability to generate a WPS-PIN that is not authorized to access the device.

The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers has a default password for the IPMI user account, which makes it easier for remote attackers to perform power-on, power-off, or reboot actions, or add or modify accounts, via unspecified vectors. System X3250 M4 is prone to a denial-of-service vulnerability

SQL injection vulnerability in SAP BI Universal Data Integration allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to the J2EE schema. SAP BI Universal Data Integration is a universal data analysis interface for SAP BI solutions from SAP SAP. User-provided input that was not properly filtered by the program before the SQL query was used. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database

Multiple integer overflows in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices allow remote attackers to cause a denial of service (component crash) or possibly execute arbitrary code via an L5 connection with a crafted PDU value that triggers a heap-based buffer overflow within (1) L5SocketsDispatcher.c or (2) L5Connector.c. wimax-ns is prone to multiple security vulnerabilities including; 1. An insecure file-permission issue 2. Multiple information-disclosure issues 3. Multiple buffer-overflow issues Attackers can exploit these issues to disclose sensitive information and execute arbitrary code on the affected device. Failed exploit attempts will result in a denial-of-service condition. Intel WiMAX Network Service is a network service of Intel Corporation that integrates 802.16 wireless metropolitan area network technology. These vulnerabilities are caused by the fact that the socket dispatcher and connector modules of the L5 connection do not filter when processing payload data units (PDUs) Input submitted by the user

The InitMethodAndPassword function in InfraStack/OSAgnostic/WiMax/Agents/Supplicant/Source/SupplicantAgent.c in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses the same RSA private key in supplicant_key.pem on all systems, which allows local users to obtain sensitive information via unspecified decryption operations. wimax-ns is prone to multiple security vulnerabilities including; 1. An insecure file-permission issue 2. Multiple information-disclosure issues 3. Multiple buffer-overflow issues Attackers can exploit these issues to disclose sensitive information and execute arbitrary code on the affected device. Failed exploit attempts will result in a denial-of-service condition. A local attacker could exploit this vulnerability to obtain sensitive information through a decrypt operation

The OSAL_Crypt_SetEncryptedPassword function in InfraStack/OSDependent/Linux/OSAL/Services/wimax_osal_crypt_services.c in the OSAL crypt module in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices logs a cleartext password during certain attempts to set a password, which allows local users to obtain sensitive information by reading a log file. wimax-ns is prone to multiple security vulnerabilities including; 1. An insecure file-permission issue 2. Multiple information-disclosure issues 3. Multiple buffer-overflow issues Attackers can exploit these issues to disclose sensitive information and execute arbitrary code on the affected device. Failed exploit attempts will result in a denial-of-service condition. Intel WiMAX Network Service is a network service of Intel Corporation that integrates 802.16 wireless metropolitan area network technology. A local attacker could exploit this vulnerability to obtain sensitive information by reading log files

The Trace_OpenLogFile function in InfraStack/OSDependent/Linux/InfraStackModules/TraceModule/TraceModule.c in the Trace module in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses world-writable permissions for wimaxd.log, which allows local users to cause a denial of service (data corruption) by modifying this file. wimax-ns is prone to multiple security vulnerabilities including; 1. An insecure file-permission issue 2. Multiple information-disclosure issues 3. Multiple buffer-overflow issues Attackers can exploit these issues to disclose sensitive information and execute arbitrary code on the affected device. Failed exploit attempts will result in a denial-of-service condition

Schweitzer Engineering Laboratories (SEL) SEL-2241, SEL-3505, and SEL-3530 RTAC master devices allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet. Schweitzer Engineering Laboratories is a leading manufacturer in Washington State, USA, and is a leader in power system relay protection, control, monitoring, metering and SCADA. Under certain conditions, the DNP3 driver will automatically restart and resume communication, but in severe cases, the device ALARM contact will trigger an assertion and need to reload the device driver settings. The affected products are as follows: SEL-3530-R100 -V0-Z001001-D20090915 - SEL-3530- SEL-3530-R123-V0-Z002001SEL-3530-4-R107-V0-Z001001-D20100818 - SEL-3530-4-R123 -V0-Z002001-D20130117SEL-3505-R119-V0-Z001001-D20120720 - SEL-3505-R123-V0-Z002001-D20130117SEL-2241-R113-V0-Z001001-D20110721 - SEL-2241-R123-V0-Z002001-D20130117. Multiple Schweitzer Engineering Laboratories devices are prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to crash the affected device, denying service to legitimate users. Note: This issue affects the IP connected devices

Schweitzer Engineering Laboratories (SEL) SEL-2241, SEL-3505, and SEL-3530 RTAC master devices allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line. Schweitzer Engineering Laboratories is a leading manufacturer in Washington State, USA, and is a leader in power system relay protection, control, monitoring, metering and SCADA. Under certain conditions, the DNP3 driver will automatically restart and resume communication, but in severe cases, the device ALARM contact will trigger an assertion and need to reload the device driver settings. The affected products are as follows: SEL-3530-R100 -V0-Z001001-D20090915 - SEL-3530- SEL-3530-R123-V0-Z002001SEL-3530-4-R107-V0-Z001001-D20100818 - SEL-3530-4-R123 -V0-Z002001-D20130117SEL-3505-R119-V0-Z001001-D20120720 - SEL-3505-R123-V0-Z002001-D20130117SEL-2241-R113-V0-Z001001-D20110721 - SEL-2241-R123-V0-Z002001-D20130117. Schweitzer Engineering Laboratories multiple devices are prone to a local denial-of-service vulnerability. An attacker can exploit this issue to crash the affected device, denying service to legitimate users. NOTE: To exploit this issue, local access to the serial-based outstation is required

Cisco TelePresence System Software 1.10.1 and earlier on 500, 13X0, 1X00, 30X0, and 3X00 devices, and 6.0.3 and earlier on TX 9X00 devices, has a default password for the pwrecovery account, which makes it easier for remote attackers to modify the configuration or perform arbitrary actions via HTTPS requests, aka Bug ID CSCui43128. Vendors report this vulnerability Bug ID CSCui43128 Published as.By a third party, HTTPS Via request, settings may be changed or arbitrary actions may be taken. Cisco TelePresence System Software is prone to an unauthorized-access vulnerability Attackers can exploit this issue to gain unauthorized administrative access to affected system. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCui43128. Cisco TelePresence is a set of video conferencing solutions called "TelePresence" system of Cisco (Cisco). The solution provides components such as audio and video spaces, which can provide remote participants with a "face-to-face" virtual meeting room effect. A remote attacker can exploit this vulnerability to modify the configuration or perform arbitrary operations through HTTPS requests

Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. AlgoSec Firewall Analyzer 6.1-b86 is affected; other versions may also be vulnerable. AlgoSec Firewall Analyzer (AFA) is a set of firewall analysis solutions from AlgoSec Company in the United States. The solution supports automatic detection of security loopholes in firewall policies. A cross-site scripting vulnerability exists in the afa/php/Login.php script in version 6.1-b86 of AFA

The NTT DOCOMO overseas usage application 2.0.0 through 2.0.4 for Android does not properly connect to Wi-Fi access points, which allows remote attackers to obtain sensitive information by leveraging presence in an 802.11 network's coverage area. docomo overseas usage is prone to an information-disclosure vulnerability. Attackers can exploit this issue to disclose potentially sensitive information through man-in-the-middle attacks. This may aid in further attacks. docomo overseas usage 2.0.0 through versions 2.0.4 are vulnerable

An ActiveX control in NationalInstruments.Help2.dll in National Instruments NI .NET Class Library Help, as used in Measurement Studio 2013 and earlier and other products, allows remote attackers to obtain sensitive information about the existence of registry keys via crafted (1) key-open or (2) key-close method calls. Attackers may exploit this issue by enticing an unsuspecting victim to view a malicious webpage. The impact of this issue is currently unknown. We will update this BID as more information becomes available

The ActiveX controls in the HelpAsst component in NI Help Links in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products allow remote attackers to cause a denial of service by triggering the display of local .chm files. Attackers may exploit this issue by enticing an unsuspecting victim to view a malicious webpage. The impact of this issue is currently unknown. We will update this BID as more information becomes available. The following products are affected: Diadem 2012 and prior LabVIEW 2012 and prior LabWindows/CVI 2012 and prior Measurement Studio 2013 and prior TestStand 2012 and prior

Absolute path traversal vulnerability in the 3D Graph ActiveX control in cw3dgrph.ocx in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products allows remote attackers to create and execute arbitrary files via a full pathname in an argument to the ExportStyle method, in conjunction with file content in the (1) Caption or (2) FormatString property value. Attackers can exploit this issue to create and execute arbitrary files in the context of the application (typically Internet Explorer) that is using the ActiveX control, which may aid in a remote code execution. The following products are affected: LabVIEW 2012 and prior LabWindows/CVI 2012 and prior Measurement Studio 2013 and prior TestStand 2012 and prior