VARIoT IoT vulnerabilities database

Sony Playstation 3 is prone to multiple denial-of-service vulnerabilities because its browser fails to adequately handle user-supplied data. An attacker can exploit this issue by exhausting memory resources to cause the browser to become unresponsive or to crash the device.

Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer.". Apache is prone to multiple denial-of-service vulnerabilities. An attacker with the ability to execute arbitrary server-side script-code can exploit these issues to stop arbitrary services on the affected computer in the context of the master webserver process; other attacks may also be possible. A vulnerability was found in the Apache mod_cache module that could cause the httpd server child process to crash if it was sent a carefully crafted request. This could lead to a denial of service if using a threaded MPM (CVE-2007-1863). A local attacker with the ability to run scripts on the server could manipulate the scoreboard and cause arbitrary processes to be terminated (CVE-2007-3304). Updated packages have been patched to prevent the above issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304 _______________________________________________________________________ Updated Packages: Mandriva Linux 2007.0: 5f906bba3e1195f5ffbc3fcb2a6bde38 2007.0/i586/apache-base-2.2.3-1.1mdv2007.0.i586.rpm 83a4844cd98ef203958796ce280a71b2 2007.0/i586/apache-devel-2.2.3-1.1mdv2007.0.i586.rpm 2a6853cad61ca0548715486c5d4c8a23 2007.0/i586/apache-htcacheclean-2.2.3-1.1mdv2007.0.i586.rpm bebbc850c030be2ef87ce12d420fb825 2007.0/i586/apache-mod_authn_dbd-2.2.3-1.1mdv2007.0.i586.rpm 9e08e4738b304aab4f90f4f18aa5da45 2007.0/i586/apache-mod_cache-2.2.3-1.1mdv2007.0.i586.rpm 989d0538f7882277053f6d4c89ca581c 2007.0/i586/apache-mod_dav-2.2.3-1.1mdv2007.0.i586.rpm c1c0fc53dd811dd6176800226574efbf 2007.0/i586/apache-mod_dbd-2.2.3-1.1mdv2007.0.i586.rpm e68509c01d66b9d42e676e7974360154 2007.0/i586/apache-mod_deflate-2.2.3-1.1mdv2007.0.i586.rpm 5596cb5359b7919125fc10be83598445 2007.0/i586/apache-mod_disk_cache-2.2.3-1.1mdv2007.0.i586.rpm d71b54240667224fd7da7fec4693c30b 2007.0/i586/apache-mod_file_cache-2.2.3-1.1mdv2007.0.i586.rpm 3571cab041e622f9399c57f377ac3fe3 2007.0/i586/apache-mod_ldap-2.2.3-1.1mdv2007.0.i586.rpm 598fdd7aad80fdc557142c5e9fc00677 2007.0/i586/apache-mod_mem_cache-2.2.3-1.1mdv2007.0.i586.rpm f4ec774478f5d198ad2e3d3384a5ad83 2007.0/i586/apache-mod_proxy-2.2.3-1.1mdv2007.0.i586.rpm ab7726290be59f03a5ade2029a2b02f8 2007.0/i586/apache-mod_proxy_ajp-2.2.3-1.1mdv2007.0.i586.rpm d72ab4173d51da4a0c1df63dbb52ccf5 2007.0/i586/apache-mod_ssl-2.2.3-1.1mdv2007.0.i586.rpm fcde0ec8b64d83402b53f926ec7fa835 2007.0/i586/apache-mod_userdir-2.2.3-1.1mdv2007.0.i586.rpm 58a0628d42d23c9aa5df6567789fad40 2007.0/i586/apache-modules-2.2.3-1.1mdv2007.0.i586.rpm 011487e1afdfb400419303182e5320c7 2007.0/i586/apache-mpm-prefork-2.2.3-1.1mdv2007.0.i586.rpm 7a755b22020153b44f8d00ba153d3d97 2007.0/i586/apache-mpm-worker-2.2.3-1.1mdv2007.0.i586.rpm ef6e11f0d26db492bc9fe83a2dbf53d7 2007.0/i586/apache-source-2.2.3-1.1mdv2007.0.i586.rpm 411b90e42ed304f329e9989d64a9dfc5 2007.0/SRPMS/apache-2.2.3-1.1mdv2007.0.src.rpm Mandriva Linux 2007.0/X86_64: 7c5408879073413fb27f2d40854813d0 2007.0/x86_64/apache-base-2.2.3-1.1mdv2007.0.x86_64.rpm c720f2a661616b0bf35bc353d14b9b3b 2007.0/x86_64/apache-devel-2.2.3-1.1mdv2007.0.x86_64.rpm 12164d6d70972cb9ed2fb6581e212bf1 2007.0/x86_64/apache-htcacheclean-2.2.3-1.1mdv2007.0.x86_64.rpm 5278f8d03ce9d59ec4929d4362b04bbe 2007.0/x86_64/apache-mod_authn_dbd-2.2.3-1.1mdv2007.0.x86_64.rpm 40c83185db12d04f4953a374b329ebb3 2007.0/x86_64/apache-mod_cache-2.2.3-1.1mdv2007.0.x86_64.rpm fe37fb1d4378c4bbcfd8d63bd57c3d4d 2007.0/x86_64/apache-mod_dav-2.2.3-1.1mdv2007.0.x86_64.rpm 0830bc5d1718a533e3358a45975596ce 2007.0/x86_64/apache-mod_dbd-2.2.3-1.1mdv2007.0.x86_64.rpm e18c3a6a322258e73b87170766aa7882 2007.0/x86_64/apache-mod_deflate-2.2.3-1.1mdv2007.0.x86_64.rpm fc8c27067e6b04bd549fe0b95579ebaa 2007.0/x86_64/apache-mod_disk_cache-2.2.3-1.1mdv2007.0.x86_64.rpm b31385db2199fd33eeb624c80e9d882a 2007.0/x86_64/apache-mod_file_cache-2.2.3-1.1mdv2007.0.x86_64.rpm 08123786649152eab65e123c75db8e66 2007.0/x86_64/apache-mod_ldap-2.2.3-1.1mdv2007.0.x86_64.rpm 7de4b739d93683648209dcdc69dd5473 2007.0/x86_64/apache-mod_mem_cache-2.2.3-1.1mdv2007.0.x86_64.rpm 85fde2923d945f3849d77f806b8bc55d 2007.0/x86_64/apache-mod_proxy-2.2.3-1.1mdv2007.0.x86_64.rpm b68991944f2989b6d3f89f7272239d76 2007.0/x86_64/apache-mod_proxy_ajp-2.2.3-1.1mdv2007.0.x86_64.rpm 19871683773211daa721957dc5dd565d 2007.0/x86_64/apache-mod_ssl-2.2.3-1.1mdv2007.0.x86_64.rpm 5cf2a97219d6789e4572da1ecddedf16 2007.0/x86_64/apache-mod_userdir-2.2.3-1.1mdv2007.0.x86_64.rpm feede872aaf0ca4bbd86ffe24455e9cd 2007.0/x86_64/apache-modules-2.2.3-1.1mdv2007.0.x86_64.rpm a00a35d4eba8f538cea741b2fc4079f4 2007.0/x86_64/apache-mpm-prefork-2.2.3-1.1mdv2007.0.x86_64.rpm da86251e4417f068d2cafed30e380779 2007.0/x86_64/apache-mpm-worker-2.2.3-1.1mdv2007.0.x86_64.rpm ceb7fd32d3ad933ab6a914085f858911 2007.0/x86_64/apache-source-2.2.3-1.1mdv2007.0.x86_64.rpm 411b90e42ed304f329e9989d64a9dfc5 2007.0/SRPMS/apache-2.2.3-1.1mdv2007.0.src.rpm Mandriva Linux 2007.1: 9daef91724ded29a3c76e74c261f7766 2007.1/i586/apache-base-2.2.4-6.2mdv2007.1.i586.rpm 9288ee938a0853d6e0072f839c68c1c2 2007.1/i586/apache-devel-2.2.4-6.2mdv2007.1.i586.rpm 613a986f9f654f1ce3432ee6f6db2391 2007.1/i586/apache-htcacheclean-2.2.4-6.2mdv2007.1.i586.rpm 8e0eb376d851d1ddba8850d4233fc3d3 2007.1/i586/apache-mod_authn_dbd-2.2.4-6.2mdv2007.1.i586.rpm 24de68668efa15e4abaaffd690837256 2007.1/i586/apache-mod_cache-2.2.4-6.2mdv2007.1.i586.rpm 288866908d43959c4b31c368346ba65d 2007.1/i586/apache-mod_dav-2.2.4-6.2mdv2007.1.i586.rpm d25838ec739d7a0037148f573262f81c 2007.1/i586/apache-mod_dbd-2.2.4-6.2mdv2007.1.i586.rpm ebad14bcccb73c8f8a27e98a6982a6f1 2007.1/i586/apache-mod_deflate-2.2.4-6.2mdv2007.1.i586.rpm 810d445f2146848b582e798e368b32ab 2007.1/i586/apache-mod_disk_cache-2.2.4-6.2mdv2007.1.i586.rpm 307de93279683b5b3e76ee6d971781cc 2007.1/i586/apache-mod_file_cache-2.2.4-6.2mdv2007.1.i586.rpm f59890e1bc38cfa598a4100705cf4cc6 2007.1/i586/apache-mod_ldap-2.2.4-6.2mdv2007.1.i586.rpm 098a05d1cbaa6bfa2d2707896dd6366c 2007.1/i586/apache-mod_mem_cache-2.2.4-6.2mdv2007.1.i586.rpm 6504f5e57440ff07da16de3d928898f6 2007.1/i586/apache-mod_proxy-2.2.4-6.2mdv2007.1.i586.rpm adc3a611a780e23178e93a6cedf135d4 2007.1/i586/apache-mod_proxy_ajp-2.2.4-6.2mdv2007.1.i586.rpm 659508a67fbe28b5dd9f861384ca1cf1 2007.1/i586/apache-mod_ssl-2.2.4-6.2mdv2007.1.i586.rpm 604eb70716d7e7b6bc6e8399cc4d9f5c 2007.1/i586/apache-mod_userdir-2.2.4-6.2mdv2007.1.i586.rpm 750d7cb431356abc88fe7a031f872b04 2007.1/i586/apache-modules-2.2.4-6.2mdv2007.1.i586.rpm 210be718db221db891452f05a001ee4e 2007.1/i586/apache-mpm-event-2.2.4-6.2mdv2007.1.i586.rpm 482e3d3af6756108c3e9a26ec2a8ac56 2007.1/i586/apache-mpm-itk-2.2.4-6.2mdv2007.1.i586.rpm b76ff4578c127ebd248b21a85a31140a 2007.1/i586/apache-mpm-prefork-2.2.4-6.2mdv2007.1.i586.rpm 2484dee8a4d4e7604a69abcd1b443954 2007.1/i586/apache-mpm-worker-2.2.4-6.2mdv2007.1.i586.rpm 9823f9b97e1829df97999494c3a3d453 2007.1/i586/apache-source-2.2.4-6.2mdv2007.1.i586.rpm ccbd9fad2b29ff86d8601f7201f48d72 2007.1/SRPMS/apache-2.2.4-6.2mdv2007.1.src.rpm Mandriva Linux 2007.1/X86_64: 4d043339268bff11fa07897ee3dc2988 2007.1/x86_64/apache-base-2.2.4-6.2mdv2007.1.x86_64.rpm afbae73f408fa95c9e4d25e3aa39583d 2007.1/x86_64/apache-devel-2.2.4-6.2mdv2007.1.x86_64.rpm d92c22ff28fcd919b3a8525f753066c3 2007.1/x86_64/apache-htcacheclean-2.2.4-6.2mdv2007.1.x86_64.rpm abe81d2effd6f4975accbdc8d25d089e 2007.1/x86_64/apache-mod_authn_dbd-2.2.4-6.2mdv2007.1.x86_64.rpm 480d5c31af3289f26953a691f92e2a51 2007.1/x86_64/apache-mod_cache-2.2.4-6.2mdv2007.1.x86_64.rpm 3feae93ade4038e67fcbaa691f2a74aa 2007.1/x86_64/apache-mod_dav-2.2.4-6.2mdv2007.1.x86_64.rpm b60eead7fe808fbc5eff6cb34f1de80b 2007.1/x86_64/apache-mod_dbd-2.2.4-6.2mdv2007.1.x86_64.rpm 023afee3221da629fd8e1d34006b7463 2007.1/x86_64/apache-mod_deflate-2.2.4-6.2mdv2007.1.x86_64.rpm 1180446c8cf65c196352006d6da00e17 2007.1/x86_64/apache-mod_disk_cache-2.2.4-6.2mdv2007.1.x86_64.rpm 0e8c2dfc0e42c23b0afbada9f8868bb6 2007.1/x86_64/apache-mod_file_cache-2.2.4-6.2mdv2007.1.x86_64.rpm 32aa45f45b8893d6c23c6892b7ad7e62 2007.1/x86_64/apache-mod_ldap-2.2.4-6.2mdv2007.1.x86_64.rpm 15c20ffb5fdc8ab2a6fa92157c9f0536 2007.1/x86_64/apache-mod_mem_cache-2.2.4-6.2mdv2007.1.x86_64.rpm f91fd6552f480eb36d030bb2e91d30b4 2007.1/x86_64/apache-mod_proxy-2.2.4-6.2mdv2007.1.x86_64.rpm 2c9d1e35af7adebaeb6284bf5da4dd5f 2007.1/x86_64/apache-mod_proxy_ajp-2.2.4-6.2mdv2007.1.x86_64.rpm caa59aaba47c89d20e799a3f02271afd 2007.1/x86_64/apache-mod_ssl-2.2.4-6.2mdv2007.1.x86_64.rpm 8ac44f8c409ea29492a3acdc1eb44c7f 2007.1/x86_64/apache-mod_userdir-2.2.4-6.2mdv2007.1.x86_64.rpm 0f2198ec988390ff3b7843a1e7090517 2007.1/x86_64/apache-modules-2.2.4-6.2mdv2007.1.x86_64.rpm 2548664fde736f25acf59f46c847d1ff 2007.1/x86_64/apache-mpm-event-2.2.4-6.2mdv2007.1.x86_64.rpm 2434c402bae11969ddf5281f2f042d24 2007.1/x86_64/apache-mpm-itk-2.2.4-6.2mdv2007.1.x86_64.rpm 8a06ecd19726db033496a042c6a6be2f 2007.1/x86_64/apache-mpm-prefork-2.2.4-6.2mdv2007.1.x86_64.rpm e8d339c397409391f3fb36f704c38c6c 2007.1/x86_64/apache-mpm-worker-2.2.4-6.2mdv2007.1.x86_64.rpm 8a6f923428242f7aa1b4d489739e241b 2007.1/x86_64/apache-source-2.2.4-6.2mdv2007.1.x86_64.rpm ccbd9fad2b29ff86d8601f7201f48d72 2007.1/SRPMS/apache-2.2.4-6.2mdv2007.1.src.rpm Corporate 4.0: 74beb8d1579ce5d5f12c8b15981b6e63 corporate/4.0/i586/apache-base-2.2.3-1.1.20060mlcs4.i586.rpm 326a8259b0d99bc2938bfa6cd85743e7 corporate/4.0/i586/apache-devel-2.2.3-1.1.20060mlcs4.i586.rpm ca305d0928255a65814af781b345a056 corporate/4.0/i586/apache-htcacheclean-2.2.3-1.1.20060mlcs4.i586.rpm 48c2b6a5ee11c3f011b1f6dc60a86479 corporate/4.0/i586/apache-mod_authn_dbd-2.2.3-1.1.20060mlcs4.i586.rpm b81a3077cb88a34af43a61ad6f2559ea corporate/4.0/i586/apache-mod_cache-2.2.3-1.1.20060mlcs4.i586.rpm ba5aee0b2a86182560e54f0cf4d360bd corporate/4.0/i586/apache-mod_dav-2.2.3-1.1.20060mlcs4.i586.rpm b696352106c5a0d1697385523455c767 corporate/4.0/i586/apache-mod_dbd-2.2.3-1.1.20060mlcs4.i586.rpm e79f271f000dd7f3a009cca70fd7e4a2 corporate/4.0/i586/apache-mod_deflate-2.2.3-1.1.20060mlcs4.i586.rpm c7bdb987f61099b64e751639ca02dd8a corporate/4.0/i586/apache-mod_disk_cache-2.2.3-1.1.20060mlcs4.i586.rpm b0303fcc2f43bdcf25419dde56df2297 corporate/4.0/i586/apache-mod_file_cache-2.2.3-1.1.20060mlcs4.i586.rpm f818ff0f890abe230c92069f9d256e5c corporate/4.0/i586/apache-mod_ldap-2.2.3-1.1.20060mlcs4.i586.rpm 4247be23e42c368b3880c7ab5ac13c89 corporate/4.0/i586/apache-mod_mem_cache-2.2.3-1.1.20060mlcs4.i586.rpm e50f1749935c96d3364bdce9af5d22bf corporate/4.0/i586/apache-mod_proxy-2.2.3-1.1.20060mlcs4.i586.rpm a619b4e0130d1db7f77a790fee0917a6 corporate/4.0/i586/apache-mod_proxy_ajp-2.2.3-1.1.20060mlcs4.i586.rpm 8170e0e77256f08d07b02119400a19f9 corporate/4.0/i586/apache-mod_ssl-2.2.3-1.1.20060mlcs4.i586.rpm 4a5d94d4f94295efe48266a1d529486e corporate/4.0/i586/apache-mod_userdir-2.2.3-1.1.20060mlcs4.i586.rpm 7c0c27197d6b44115366eac339c424f2 corporate/4.0/i586/apache-modules-2.2.3-1.1.20060mlcs4.i586.rpm 56351aafc723fdea2f2fac22d5046944 corporate/4.0/i586/apache-mpm-prefork-2.2.3-1.1.20060mlcs4.i586.rpm ccbb2f27b762b5dd564dc7a00aac6db0 corporate/4.0/i586/apache-mpm-worker-2.2.3-1.1.20060mlcs4.i586.rpm a65137ff29ed6a1da1f894d19997faec corporate/4.0/i586/apache-source-2.2.3-1.1.20060mlcs4.i586.rpm 8cdf592a822485abba00dfb6591615ea corporate/4.0/SRPMS/apache-2.2.3-1.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: 7a9b4f5b3fcf2cac67e4c38022ee2441 corporate/4.0/x86_64/apache-base-2.2.3-1.1.20060mlcs4.x86_64.rpm 5604ba341d957fbe6182bd2eb29a8e9d corporate/4.0/x86_64/apache-devel-2.2.3-1.1.20060mlcs4.x86_64.rpm 8983bda4bbe3b58f9c6c317531eb52b7 corporate/4.0/x86_64/apache-htcacheclean-2.2.3-1.1.20060mlcs4.x86_64.rpm 9baf252cbc8ef8a093ed25e7a0daf25d corporate/4.0/x86_64/apache-mod_authn_dbd-2.2.3-1.1.20060mlcs4.x86_64.rpm 26cc58bcbfd25a83c15051c8f590a36d corporate/4.0/x86_64/apache-mod_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm 941a32aea1b1b3bca1ae343d5d925892 corporate/4.0/x86_64/apache-mod_dav-2.2.3-1.1.20060mlcs4.x86_64.rpm 1d79a7b921ce150de88e22ffbaba4b31 corporate/4.0/x86_64/apache-mod_dbd-2.2.3-1.1.20060mlcs4.x86_64.rpm d80b9ffca3dd024e73d069e55ba7fa3e corporate/4.0/x86_64/apache-mod_deflate-2.2.3-1.1.20060mlcs4.x86_64.rpm 7a7a11645680a7bee9cf88b166b0d32f corporate/4.0/x86_64/apache-mod_disk_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm fcc85c0f9faf1fa08a01f3d4ecb68033 corporate/4.0/x86_64/apache-mod_file_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm 55789d16ff565bcd31dfa522435d4d4b corporate/4.0/x86_64/apache-mod_ldap-2.2.3-1.1.20060mlcs4.x86_64.rpm 7ee708824d65878b71ede35e139ac94d corporate/4.0/x86_64/apache-mod_mem_cache-2.2.3-1.1.20060mlcs4.x86_64.rpm e8579835f848cade641da14354196497 corporate/4.0/x86_64/apache-mod_proxy-2.2.3-1.1.20060mlcs4.x86_64.rpm 6a1e70a638aecf603f3bc2485d14bd78 corporate/4.0/x86_64/apache-mod_proxy_ajp-2.2.3-1.1.20060mlcs4.x86_64.rpm 212f40574d0821b909972ebc36fb697a corporate/4.0/x86_64/apache-mod_ssl-2.2.3-1.1.20060mlcs4.x86_64.rpm 32a8dd886e42c8093be05c9ee4d31855 corporate/4.0/x86_64/apache-mod_userdir-2.2.3-1.1.20060mlcs4.x86_64.rpm 265bccd86baa7fca942f1c6d4d694523 corporate/4.0/x86_64/apache-modules-2.2.3-1.1.20060mlcs4.x86_64.rpm babdb585a6c754f23d91c41fc844a5e2 corporate/4.0/x86_64/apache-mpm-prefork-2.2.3-1.1.20060mlcs4.x86_64.rpm 63274f5c5dc3897d0062f621b1c63e0e corporate/4.0/x86_64/apache-mpm-worker-2.2.3-1.1.20060mlcs4.x86_64.rpm 18782a1fcbcb760d36162ce830ac4cdd corporate/4.0/x86_64/apache-source-2.2.3-1.1.20060mlcs4.x86_64.rpm 8cdf592a822485abba00dfb6591615ea corporate/4.0/SRPMS/apache-2.2.3-1.1.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFGjD3WmqjQ0CJFipgRAtGoAKCXMGCKCMbkso0ugvF0TpsWNwkPjgCfVakS Re00IyLecNs4MIGgsrv2qJE= =5EEm -----END PGP SIGNATURE----- . Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-servers/apache < 2.2.6 *>= 2.0.59-r5 >= 2.2.6 Description =========== Multiple cross-site scripting vulnerabilities have been discovered in mod_status and mod_autoindex (CVE-2006-5752, CVE-2007-4465). An error has been discovered in the recall_headers() function in mod_mem_cache (CVE-2007-1862). The mod_cache module does not properly sanitize requests before processing them (CVE-2007-1863). The Prefork module does not properly check PID values before sending signals (CVE-2007-3304). The mod_proxy module does not correctly check headers before processing them (CVE-2007-3847). Impact ====== A remote attacker could exploit one of these vulnerabilities to inject arbitrary script or HTML content, obtain sensitive information or cause a Denial of Service. Workaround ========== There is no known workaround at this time. Resolution ========== All Apache users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/apache-2.0.59-r5" References ========== [ 1 ] CVE-2006-5752 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752 [ 2 ] CVE-2007-1862 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1862 [ 3 ] CVE-2007-1863 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863 [ 4 ] CVE-2007-3304 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304 [ 5 ] CVE-2007-3847 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847 [ 6 ] CVE-2007-4465 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200711-06.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01182588 Version: 1 HPSBUX02273 SSRT071476 rev. 1 - HP-UX running Apache, Remote Unauthorized Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2007-10-10 Last Updated: 2007-10-10 Potential Security Impact: Remote Unauthorized Denial of Service (DoS) Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP-UX Apache version 2.0.59. The vulnerability could be exploited remotely to create a Denial of Service (DoS). References: CVE-2007-3847, CVE-2007-3304 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.11, B.11.23, B.11.31 running Apache 2.0.59.00 BACKGROUND To determine if a system has an affected version, search the output of "swlist -a revision -l fileset" for an affected fileset. Then determine if the recommended action has been taken. AFFECTED VERSIONS For IPv4: HP-UX B.11.11 ============= hpuxwsAPACHE action: install revision B.2.0.59.00.0 or subsequent restart Apache URL: ftp://ssrt1476:ssrt1476@hprc.external.hp.com For IPv6: HP-UX B.11.11 HP-UX B.11.23 HP-UX B.11.31 ============= hpuxwsAPACHE,revision=B.1.0.00.01 hpuxwsAPACHE,revision=B.1.0.07.01 hpuxwsAPACHE,revision=B.1.0.08.01 hpuxwsAPACHE,revision=B.1.0.09.01 hpuxwsAPACHE,revision=B.1.0.10.01 hpuxwsAPACHE,revision=B.2.0.48.00 hpuxwsAPACHE,revision=B.2.0.49.00 hpuxwsAPACHE,revision=B.2.0.50.00 hpuxwsAPACHE,revision=B.2.0.51.00 hpuxwsAPACHE,revision=B.2.0.52.00 hpuxwsAPACHE,revision=B.2.0.53.00 hpuxwsAPACHE,revision=B.2.0.54.00 hpuxwsAPACHE,revision=B.2.0.55.00 hpuxwsAPACHE,revision=B.2.0.56.00 hpuxwsAPACHE,revision=B.2.0.58.00 hpuxwsAPACHE,revision=B.2.0.58.01 hpuxwsAPACHE,revision=B.2.0.59.00 action: install revision B.2.0.59.00.0 or subsequent restart Apache URL: ftp://ssrt1476:ssrt1476@hprc.external.hp.com END AFFECTED VERSIONS RESOLUTION HP has made the following available to resolve the vulnerability. OS Release Depot name MD5 Sum B.11.11 (IPv4) HPUXWSA-B218-01-1111ipv4.depot eb3bb933baac0f05e1e0809ef1e84eb2 B.11.11 (IPv6) HPUXWSA-B218-01-1111ipv6.depot 540a56b155699336bcbfac0eaf87e3ce B.11.23 PA-32 HPUXWSA-B218-01-1123-32.depot 2900a0cbea01b6905dc768680fbd5381 B.11.23 IA-64 HPUXWSA-B218-01-1123-64.depot 3be084d96e8a509692e37c71c0184014 B.11.31 PA-32 HPUXWSA-B218-01-1131-32.depot 861122eef70f1b53d68c5adafc64cdb5 B.11.31 IA-64 HPUXWSA-B218-01-1131-64.depot 8dc57222257fe27fb5994da16e91f9a4 The updates are available from: ftp://ssrt1476:ssrt1476@hprc.external.hp.com/ ftp://ssrt1476:ssrt1476@192.170.19.100/ MANUAL ACTIONS: Yes - Update Install Apache 2.0.59.00.0 or subsequent. PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all HP-issued Security Bulletins and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa HISTORY Revision: 1 (rev.1) - 10 October 2007 Initial release Third Party Security Patches: Third party security patches which are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For further information, contact normal HP Services support channel. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches -check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems -verify your operating system selections are checked and save. To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections. To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do * The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." \xa9Copyright 2007 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBRw4UMuAfOvwtKn1ZEQLDowCgnVZZuBkuV66atvv6mh6sxARqYYkAmQEy 7CP41v96ckMOtfU4yeG76pv2 =VMzd -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2009-0010 Synopsis: VMware Hosted products update libpng and Apache HTTP Server Issue date: 2009-08-20 Updated on: 2009-08-20 (initial release of advisory) CVE numbers: CVE-2009-0040 CVE-2007-3847 CVE-2007-1863 CVE-2006-5752 CVE-2007-3304 CVE-2007-6388 CVE-2007-5000 CVE-2008-0005 - ------------------------------------------------------------------------ 1. Summary Updated VMware Hosted products address security issues in libpng and the Apace HTTP Server. 2. Relevant releases VMware Workstation 6.5.2 and earlier, VMware Player 2.5.2 and earlier, VMware ACE 2.5.2 and earlier 3. Problem Description a. Third Party Library libpng Updated to 1.2.35 Several flaws were discovered in the way third party library libpng handled uninitialized pointers. An attacker could create a PNG image file in such a way, that when loaded by an application linked to libpng, it could cause the application to crash or execute arbitrary code at the privilege level of the user that runs the application. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-0040 to this issue. The following table lists what action remediates the vulnerability (column 4) if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= VirtualCenter any Windows not affected Workstation 6.5.x any 6.5.3 build 185404 or later Player 2.5.x any 2.5.3 build 185404 or later ACE 2.5.x any 2.5.3 build 185404 or later Server 2.x any patch pending Server 1.x any patch pending Fusion 2.x Mac OS/X not affected Fusion 1.x Mac OS/X not affected ESXi 4.0 ESXi not affected ESXi 3.5 ESXi not affected ESX 4.0 ESX not affected ESX 3.5 ESX not affected ESX 3.0.3 ESX not affected ESX 3.0.2 ESX not affected ESX 2.5.5 ESX not affected * * The libpng update for the Service Console of ESX 2.5.5 is documented in VMSA-2009-0007. b. Apache HTTP Server updated to 2.0.63 The new version of ACE updates the Apache HTTP Server on Windows hosts to version 2.0.63 which addresses multiple security issues that existed in the previous versions of this server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2007-3847, CVE-2007-1863, CVE-2006-5752, CVE-2007-3304, CVE-2007-6388, CVE-2007-5000, CVE-2008-0005 to the issues that have been addressed by this update. The following table lists what action remediates the vulnerability (column 4) if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= VirtualCenter any Windows not affected Workstation 6.5.x any not affected Player 2.5.x any not affected ACE 2.5.x Windows 2.5.3 build 185404 or later ACE 2.5.x Linux update Apache on host system * Server 2.x any not affected Server 1.x any not affected Fusion 2.x Mac OS/X not affected Fusion 1.x Mac OS/X not affected ESXi 4.0 ESXi not affected ESXi 3.5 ESXi not affected ESX 4.0 ESX not affected ESX 3.5 ESX not affected ESX 3.0.3 ESX not affected ESX 3.0.2 ESX not affected ESX 2.5.5 ESX not affected * The Apache HTTP Server is not part of an ACE install on a Linux host. Update the Apache HTTP Server on the host system to version 2.0.63 in order to remediate the vulnerabilities listed above. 4. Solution Please review the patch/release notes for your product and version and verify the md5sum and/or the sha1sum of your downloaded file. VMware Workstation 6.5.3 ------------------------ http://www.vmware.com/download/ws/ Release notes: http://www.vmware.com/support/ws65/doc/releasenotes_ws653.html For Windows Workstation for Windows 32-bit and 64-bit Windows 32-bit and 64-bit .exe md5sum: 7565d16b7d7e0173b90c3b76ca4656bc sha1sum: 9f687afd8b0f39cde40aeceb3213a91be487aad1 For Linux Workstation for Linux 32-bit Linux 32-bit .rpm md5sum: 4d55c491bd008ded0ea19f373d1d1fd4 sha1sum: 1f43131c960e76a530390d3b6984c78dfc2da23e Workstation for Linux 32-bit Linux 32-bit .bundle md5sum: d4a721c1918c0e8a87c6fa4bad49ad35 sha1sum: c0c6f9b56e70bd3ffdb5467ee176110e283a69e5 Workstation for Linux 64-bit Linux 64-bit .rpm md5sum: 72adfdb03de4959f044fcb983412ae7c sha1sum: ba16163c8d9b5aa572526b34a7b63dc6e68f9bbb Workstation for Linux 64-bit Linux 64-bit .bundle md5sum: 83e1f0c94d6974286256c4d3b559e854 sha1sum: 8763f250a3ac5fc4698bd26319b93fecb498d542 VMware Player 2.5.3 ------------------- http://www.vmware.com/download/player/ Release notes: http://www.vmware.com/support/player25/doc/releasenotes_player253.html Player for Windows binary http://download3.vmware.com/software/vmplayer/VMware-player-2.5.3-185404.exe md5sum: fe28f193374c9457752ee16cd6cad4e7 sha1sum: 13bd3ff93c04fa272544d3ef6de5ae746708af04 Player for Linux (.rpm) http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.i386.rpm md5sum: c99cd65f19fdfc7651bcb7f328b73bc2 sha1sum: a33231b26e2358a72d16e1b4e2656a5873fe637e Player for Linux (.bundle) http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.i386.bundle md5sum: 210f4cb5615bd3b2171bc054b9b2bac5 sha1sum: 2f6497890b17b37480165bab9f430e8645edae9b Player for Linux - 64-bit (.rpm) http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.x86_64.rpm md5sum: f91576ef90b322d83225117ae9335968 sha1sum: f492fa9cf26ee2818f164aac04cde1680c25d974 Player for Linux - 64-bit (.bundle) http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-185404.x86_64.bundle md5sum: 595d44d7945c129b1aeb679d2f001b05 sha1sum: acd69fcb0c6bc49fd4af748c65c7fb730ab1e8c4 VMware ACE 2.5.3 ---------------- http://www.vmware.com/download/ace/ Release notes: http://www.vmware.com/support/ace25/doc/releasenotes_ace253.html ACE Management Server Virtual Appliance AMS Virtual Appliance .zip md5sum: 44cc7b86353047f02cf6ea0653e38418 sha1sum: 9f44b15e6681a6e58dd20784f829c68091a62cd1 VMware ACE for Windows 32-bit and 64-bit Windows 32-bit and 64-bit .exe md5sum: 0779da73408c5e649e0fd1c62d23820f sha1sum: 2b2e4963adc89f3b642874685f490222523b63ef ACE Management Server for Windows Windows .exe md5sum: 0779da73408c5e649e0fd1c62d23820f sha1sum: 2b2e4963adc89f3b642874685f490222523b63ef ACE Management Server for SUSE Enterprise Linux 9 SLES 9 .rpm md5sum: a4fc92d7197f0d569361cdf4b8cca642 sha1sum: af8a135cca398cacaa82c8c3c325011c6cd3ed75 ACE Management Server for Red Hat Enterprise Linux 4 RHEL 4 .rpm md5sum: 841005151338c8b954f08d035815fd58 sha1sum: 67e48624dba20e6be9e41ec9a5aba407dd8cc01e 5. References CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0040 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6388 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5000 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005 - ------------------------------------------------------------------------ 6. Change log 2009-08-20 VMSA-2009-0010 Initial security advisory after release of Workstation 6.5.3, Player 2.5.3, and ACE 2.5.3 on 2009-08-20. - ------------------------------------------------------------------------ 7. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: * security-announce at lists.vmware.com * bugtraq at securityfocus.com * full-disclosure at lists.grok.org.uk E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Center http://www.vmware.com/security VMware security response policy http://www.vmware.com/support/policies/security_response.html General support life cycle policy http://www.vmware.com/support/policies/eos.html VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html Copyright 2009 VMware Inc. All rights reserved. =========================================================== Ubuntu Security Notice USN-499-1 August 16, 2007 apache2 vulnerabilities CVE-2006-5752, CVE-2007-1863, CVE-2007-3304 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6.10 Ubuntu 7.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: apache2-common 2.0.55-4ubuntu2.2 apache2-mpm-prefork 2.0.55-4ubuntu2.2 apache2-mpm-worker 2.0.55-4ubuntu2.2 Ubuntu 6.10: apache2-common 2.0.55-4ubuntu4.1 apache2-mpm-prefork 2.0.55-4ubuntu4.1 apache2-mpm-worker 2.0.55-4ubuntu4.1 Ubuntu 7.04: apache2-mpm-prefork 2.2.3-3.2ubuntu0.1 apache2-mpm-worker 2.2.3-3.2ubuntu0.1 apache2.2-common 2.2.3-3.2ubuntu0.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Stefan Esser discovered that mod_status did not force a character set, which could result in browsers becoming vulnerable to XSS attacks when processing the output. If a user were tricked into viewing server status output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. By default, mod_status is disabled in Ubuntu. (CVE-2006-5752) Niklas Edmundsson discovered that the mod_cache module could be made to crash using a specially crafted request. A remote user could use this to cause a denial of service if Apache was configured to use a threaded worker. By default, mod_cache is disabled in Ubuntu. (CVE-2007-1863) A flaw was discovered in the signal handling of Apache. A local attacker could trick Apache into sending SIGUSR1 to other processes. The vulnerable code was only present in Ubuntu Feisty. (CVE-2007-3304) Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2.diff.gz Size/MD5: 115882 e94e45574e3b131d3a9a0e07e193f1e5 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2.dsc Size/MD5: 1148 c2bc143625fbf8ca59fea300845c5a42 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55.orig.tar.gz Size/MD5: 6092031 45e32c9432a8e3cf4227f5af91b03622 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu2.2_all.deb Size/MD5: 2124364 9b8ca5d5757c63f5ee6bbd507f0a8357 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 833000 be4c7770c725f5f4401ca06d1347211f http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 227832 41c12dfe84f109e6544a33e4e1d791a8 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 222934 7e4d072bad27239e366a6eda94c09190 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 227576 8fc59f78a3fa0e5d6dac81e875039bda http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 171082 4318f93373b705563251f377ed398614 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 171860 257f4183d70be5a00546c39c5a18f108 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 93916 695cee55f91ceb9424abe31d8b6ee1dd http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 35902 00c1082a77ff1d863f72874c4472a26d http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 285336 0a8510634b21f56f0d9619aa6fc9cec9 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_amd64.deb Size/MD5: 143952 d75f83ac219bce95a15a8f44b82b8ea7 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 786186 4e78fa0d438867194f66b11b4eb6fc2e http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 202448 74cf60884e18c1fc93f157010a15b12c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 198456 209a0b92995fec453ed4c2c181e3e555 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 202038 6cbd437caf993fa2b2b38369cd3d5863 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 171074 0a5a26aa58af7aa2d51d1cf5d7c543d6 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 171848 af9ca78febc5bc0c7936296dab958349 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 91884 2857d60b507b28c736f83815c9f3d1b8 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 35906 202b5b233af0d26e29ca7302cf7fd04c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 261418 c90342706ac26682d15032a5ba5cb51a http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_i386.deb Size/MD5: 131850 951a4573901bc2f10d5febf940d57516 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 859126 afdd8642ca447fc9dc70dfed92be0fa6 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 219898 6d9c9f924d2356bf9d3438a280870a7d http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 215602 dd554132cdea0f860e01cf5d4e0dbc7c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 219378 7a1f4b325dacef287c901fa66680c04e http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 171096 a0e2547d38ef1b84dc419d69e42ffa0b http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 171864 200ab662b2c13786658486df37fda881 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 103628 ae36642fbd4698bb362fa4bf9417b0e3 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 35910 358027282f2f19451d3aa784dc0474dc http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 280950 0d9b56ec076da25e2a03f6d3c6445057 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_powerpc.deb Size/MD5: 141074 f5d3d5e0e5911e0c0156ae55af50f87b sparc architecture (Sun SPARC/UltraSPARC) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 803440 d66da6a91c08956c3c5062668349ef41 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 209970 57f0a8f823a4502ee9a2608e3181cc81 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 205582 1dcfb0df796e85c409f614544ea589fe http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 209330 6bf7ae824eea35d3487febef384fce91 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 171080 1088337f4abcb6c8f65751b6120c2307 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 171868 5cda04cd73a9c6d8dfc18abd55c09ebd http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 92972 850ab3bb0904e8fe9b6255c42ba7f84c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 35904 7af260b95c4faa17ef34810fed888caf http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 267550 08182a8a2cab00fc0e6bca2cccf5165f http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.2_sparc.deb Size/MD5: 129760 a60606c6d2f12209b0bdae997be4a13f Updated packages for Ubuntu 6.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1.diff.gz Size/MD5: 116265 2732761b18dfb3c2cd1aa0b54c2cf623 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1.dsc Size/MD5: 1148 4b9c4612469c521db0c5fdbe2f6b9b25 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55.orig.tar.gz Size/MD5: 6092031 45e32c9432a8e3cf4227f5af91b03622 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu4.1_all.deb Size/MD5: 2124550 8d5c30342b35f9fd595fb09d7659b6fc amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 836342 2c4ba483b0b20fdc2d43819109177941 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 227390 e61cc1998f5b8f2c44dce587e59d288a http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 222376 6bdbff7f7f80fd464d1e3ec52d6e7171 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 226848 4356b4caf2b40f364c8893c41b9f9355 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 171304 c4395af051e876228541ef5b8037d979 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 172074 99dadc4ad0f0947f9368d89f4589d95a http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 94204 30f3bb8c72575fe93940ecc730b8e4b6 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 36152 ea3cbefcbee7e2f6e5555edb44733ad9 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 286544 d555931490d44d93bec31c4bfc19ed12 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_amd64.deb Size/MD5: 145014 3e06ceb0a55598d82f9f781c44e210b3 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 806938 050bb7665332d3761e1a8e47939fa507 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 209556 ee530b24aba8838001ebb6c901bc90cd http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 205718 b52a17c63909eae3c49bad0ab1958f4b http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 209158 1844fa5e09224a90944f8b886ddb5a2a http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 171296 9de8aba41f7e3d60f41536ca712adebb http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 172078 01ccd554177364747b08e2933f121d2c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 93240 4573597317416869646eb2ea42cd0945 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 36150 77666d65bade6a91bd58826c79f11dc9 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 266390 a3963d8e76f6865404f7fadb47880c87 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_i386.deb Size/MD5: 137604 387f6bcdaa58dbbe53082241b3231844 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 865372 27d7f1de1fcb2114d3f3b0a774302488 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 221542 1ae8fa5cf4b77f3b2aa054e2886e587e http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 217044 9134983c40107f79fcac8d1eacbc7117 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 221324 b435dc09c63ecbcd564a0923a8f07350 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 171296 6d2a0abfb7a1daaeae56559eeb322dcb http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 172064 ecc2037409554ea43c5a6848aa510c76 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 104654 d0957d8df044c4a34437241792ed97d1 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 36148 34e102e1d2e1c6a6f31801dfb98cb82a http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 284548 c8f325ccc42cbe77191d4ddd9abc2a4e http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_powerpc.deb Size/MD5: 144238 82cfbfcec5fc4931078145af8947c035 sparc architecture (Sun SPARC/UltraSPARC) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 811594 d8548e537fd81994bbb638e105dfbf8b http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 212160 81cd0197ff89b79c967c1074ede9f8d7 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 207870 5d80ed8dc39b0d4d59fccb747624a684 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 211578 9407383d85db831dab728b39cce9acc8 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 171294 5e4d695a99bdc1fdfb0bfcef8b91d03d http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 172064 06e3e765d799e281dba7329ff9d9e138 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 93796 1048b47b289fb2047fa9ac7ebbe94a57 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 36150 0d106a177aa4271b1cfc0e96eec1a748 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 268444 3912123e7c71cc638132305ca89fe23b http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu4.1_sparc.deb Size/MD5: 130626 f4444e0239c2da7d3c31e3486606f95a Updated packages for Ubuntu 7.04: Source archives: http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1.diff.gz Size/MD5: 112120 f7b1a17718aed7ca73da3a6d7aad06b0 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1.dsc Size/MD5: 1128 e82b1bee591fff50d6673ed1a443e543 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3.orig.tar.gz Size/MD5: 6342475 f72ffb176e2dc7b322be16508c09f63c Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2.3-3.2ubuntu0.1_all.deb Size/MD5: 2199184 c03756f87cb164213428532f70e0c198 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.2.3-3.2ubuntu0.1_all.deb Size/MD5: 272064 5be351f491f8d1aae9a270d1214e93e3 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2.3-3.2ubuntu0.1_all.deb Size/MD5: 6674104 bdbabf8f478562f0e003737e977ffc7b http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.3-3.2ubuntu0.1_all.deb Size/MD5: 38668 9f0c7c01e8441285c084002eb4619065 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_amd64.deb Size/MD5: 449624 1b54a8000c40eaaa0f9e31527b9bb180 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_amd64.deb Size/MD5: 445346 d15625641a3247fbf5d9d9b9aed34968 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_amd64.deb Size/MD5: 449208 55f39c28a4de98d53f80231aeb7d6c59 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_amd64.deb Size/MD5: 403570 0042c75be8a2d128d62b79398deaefa8 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_amd64.deb Size/MD5: 404138 929772b95ea67f338ad423a65b2b7011 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_amd64.deb Size/MD5: 341312 906819b0de863209575aa65d39a594a5 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_amd64.deb Size/MD5: 971462 f85e32c5f6437ce149553aee97ffd934 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_i386.deb Size/MD5: 432922 c1b81ac7dc7b7a0b2261fd10d9bcf5c6 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_i386.deb Size/MD5: 428856 f506f2a9dd2dbd5c2d3f72a476cc3537 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_i386.deb Size/MD5: 432314 a5a11947ad8cf14604efa7ddcfd20bfe http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_i386.deb Size/MD5: 403574 da84a3a99276f14a11ac892ce7eee170 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_i386.deb Size/MD5: 404138 0fdd43a53e6957aa3a348a7bd9c876f5 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_i386.deb Size/MD5: 340396 88a0ddbc58335416d91c9f10adc9d5f5 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_i386.deb Size/MD5: 929716 138d58487b882e6002e3c5e4a9489add powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_powerpc.deb Size/MD5: 451530 ddc437092ef642fcd396713cd1972f4c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_powerpc.deb Size/MD5: 446960 af1b667708e062f81bca4e995355394d http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_powerpc.deb Size/MD5: 450940 ed9f31ec5045a88446115987c6e97655 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_powerpc.deb Size/MD5: 403574 65801ab51335a15dc370b9341a0e50dd http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_powerpc.deb Size/MD5: 404146 fd35e65fadd836feb0190b209947b466 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_powerpc.deb Size/MD5: 360518 b74bc9eead429cd8f0ebecd6a94e5edb http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_powerpc.deb Size/MD5: 1073812 376fe5b1ee383a6d870eea5dd3c6a704 sparc architecture (Sun SPARC/UltraSPARC) http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.3-3.2ubuntu0.1_sparc.deb Size/MD5: 434408 c70ef2e9aed191fe53886ceb3725596e http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.3-3.2ubuntu0.1_sparc.deb Size/MD5: 430574 7b690896da23a151ee5e106d596c1143 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.3-3.2ubuntu0.1_sparc.deb Size/MD5: 433918 cc01edfcfc673ba9a86c83fcc66e6870 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.3-3.2ubuntu0.1_sparc.deb Size/MD5: 403568 a7660cff70394403c764cf8f30c7298a http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.3-3.2ubuntu0.1_sparc.deb Size/MD5: 404136 b8587d5eba0be59a6576d6cf645b2122 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.3-3.2ubuntu0.1_sparc.deb Size/MD5: 343370 1572a001a612add57d23350210ac1736 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.3-3.2ubuntu0.1_sparc.deb Size/MD5: 938586 b74a91fcfbb0503355e94981310bd1ce

Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not clear potentially sensitive memory before use, which allows remote attackers to read memory from a web browser via unknown vectors related to Java applets. Apple QuickTime for Java fails to properly clear memory. As a result, sensitive information may be exposed to unintended parties. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Attackers may exploit this issue by convincing victims into visiting a malicious website. Exploiting this issue may allow remote attackers to view memory that may contain sensitive information. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. There is a loophole in QuickTime's Java Applet implementation, and a remote attacker may use this loophole to obtain sensitive information on the client. If a user is tricked into visiting a page containing a malicious Java Applet, this vulnerability may be triggered, resulting in the disclosure of sensitive information

Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations. Apple QuickTime for Java fails to properly clear memory. As a result, sensitive information may be exposed to unintended parties. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Apple QuickTime for Java is prone to a remote heap-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input prior to copying it to an insufficiently sized buffer. Failed exploit attempts will result in a denial of service. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. There is a loophole in the implementation of QuickTime, and a remote attacker may take advantage of this loophole to control the user's machine. If a user is tricked into visiting a Web page containing a specially crafted Java Applet, a heap overflow may be triggered, resulting in the execution of arbitrary instructions

Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) 5.4.0.6, when Internet Explorer 6 is used, allows remote attackers to execute arbitrary code via a long argument to the (1) Send485CMD method, and possibly the (2) SetLoginID, (3) AddSite, (4) SetScreen, and (5) SetVideoServer methods. Honeywell is a well-known American security products company, and Ademco is one of its anti-theft alarm products.  The ATNBaseLoader100 module (ATNBaseLoader100.dll) used by Ademco products has a buffer overflow vulnerability when processing malformed parameters. Remote attackers may use this vulnerability to control user machines.  The ATNBaseLoader100 module (ATNBaseLoader100.dll) ActiveX control has a stack overflow vulnerability when processing the Send485CMD (), SetLoginID (), and AddSite () methods. If a user is tricked into visiting a malicious site and passing long parameters to these methods, this overflow can be triggered, causing arbitrary instructions to be executed. Ademco ATNBaseLoader100 ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts likely result in denial-of-service conditions. Ademco ATNBaseLoader100 ActiveX control 5.4.0.6 is vulnerable to this issue; other versions may also be affected

Buffer overflow in iChat in Apple Mac OS X 10.3.9 and 10.4.9 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted UPnP Internet Gateway Device (IGD) packet. Apple Mac OS X is prone to multiple security vulnerabilities. These issues affect Mac OS X and various applications, including Alias Manager, CoreGraphics, crontabs, iChat, and PPP. Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. Both local and remote vulnerabilities are present. Apple Mac OS X 10.4.9 and prior versions are vulnerable to these issues. There is a buffer overflow in iChat's UPnP IGD code used to create port mappings to the main NAT gateway. An attacker on the local network can trigger this overflow by sending a specially crafted message, causing the application to terminate unexpectedly or execute arbitrary commands

Buffer overflow in mDNSResponder in Apple Mac OS X 10.4 up to 10.4.9 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted UPnP Internet Gateway Device (IGD) packet. Successfully exploiting this issue allows remote attackers to execute arbitrary machine code with superuser privileges, facilitating the complete compromise of affected computers. Failed exploit attempts likely result in a denial-of-service condition. Apple Mac OS X 10.4.0 through 10.4.9 are vulnerable to this issue. The vendor reports this issue also affects Apple TV versions prior to 1.1. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201201-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: mDNSResponder: Multiple vulnerabilities Date: January 20, 2012 Bugs: #290822 ID: 201201-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in mDNSResponder, which could lead to execution of arbitrary code with root privileges. Background ========== mDNSResponder is a component of Apple's Bonjour, an initiative for zero-configuration networking. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/mDNSResponder < 212.1 >= 212.1 Description =========== Multiple vulnerabilities have been discovered in mDNSResponder. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All mDNSResponder users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/mDNSResponder-212.1" NOTE: This is a legacy GLSA. Updates for all affected architectures are available since November 21, 2009. It is likely that your system is already no longer affected by this issue. References ========== [ 1 ] CVE-2007-2386 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2386 [ 2 ] CVE-2007-3744 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3744 [ 3 ] CVE-2007-3828 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3828 [ 4 ] CVE-2008-0989 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0989 [ 5 ] CVE-2008-2326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2326 [ 6 ] CVE-2008-3630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3630 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201201-05.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Alias Manager in Apple Mac OS X 10.3.9 and 10.4.9 does not display files with the same name in mounted disk images that have the same name, which might allow user-assisted attackers to trick a user into executing malicious files. A vulnerabilty in the way Apple Mac OS X iChat handles specially crafted UPnP packets may allow execution of arbitrary code or denial of service. Apple Mac OS X is prone to multiple security vulnerabilities. These issues affect Mac OS X and various applications, including Alias Manager, CoreGraphics, crontabs, iChat, and PPP. Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. Both local and remote vulnerabilities are present. Apple Mac OS X 10.4.9 and prior versions are vulnerable to these issues. Attackers can trick users into loading two disk images with the same name and cause users to open malicious programs

Format string vulnerability in the VPN daemon (vpnd) in Apple Mac OS X 10.3.9 and 10.4.9 allows local users to execute arbitrary code via the -i parameter. Attackers may exploit this issue to crash the application or execute arbitrary code with superuser privileges. Successful exploits can result in a complete compromise of vulnerable computers. Apple Mac OS X Server 10.4.9 and prior versions are vulnerable to this issue. This issue was originally included in BID 24144 (Apple Mac OS X 2007-005 Multiple Security Vulnerabilities), but has been given its own record. A local attacker can trigger this vulnerability by running the vpnd command with specially crafted parameters, resulting in arbitrary command execution with system privileges

The PPP daemon (pppd) in Apple Mac OS X 10.4.8 checks ownership of the stdin file descriptor to determine if the invoker has sufficient privileges, which allows local users to load arbitrary plugins and gain root privileges by bypassing this check. A vulnerabilty in the way Apple Mac OS X iChat handles specially crafted UPnP packets may allow execution of arbitrary code or denial of service. Apple Mac OS X is prone to multiple security vulnerabilities. These issues affect Mac OS X and various applications, including Alias Manager, CoreGraphics, crontabs, iChat, and PPP. Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. Both local and remote vulnerabilities are present. Apple Mac OS X 10.4.9 and prior versions are vulnerable to these issues. BACKGROUND Apple Mac OS X pppd is a setuid root application that is used to establish and configure connections for point to point links. It is commonly used for configuring traditional dial-up modem and DSL connections. More information can be found at the following URL. http://developer.apple.com/documentation/Darwin/Reference/Manpages/man8/pppd.8.html II. The vulnerability exists due to insufficient access validation when processing the "plugin" command line option. The application does not properly verify that the requesting user has root privileges and allows any user to load plug-ins. When checking to see if the executing user has root privileges, a check is made to see if the stdin file descriptor is owned by root. Passing this check is trivial and allows the attacker to load arbitrary plug-ins resulting in arbitrary code execution with root privileges. III. ANALYSIS Exploitation is trivial and grants root access. This vulnerability cannot be triggered remotely; an attacker needs local access to the victim's system in order to exploit this vulnerability. pppd is installed by default. IV. Other versions may also be affected. V. WORKAROUND Remove the setuid bit from the pppd binary. This will prevent users without root privileges from being able to properly use the program. VI. VENDOR RESPONSE Apple Inc has addressed this vulnerability in Apple Security Update 2007-005. More information can be found from Apple's Security Update page or the Security Update 2007-005 advisory page at the respective URLs below. http://docs.info.apple.com/article.html?artnum=61798 http://docs.info.apple.com/article.html?artnum=305530 VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2007-0752 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 01/08/2007 Initial vendor notification 01/09/2007 Initial vendor response 05/24/2007 Coordinated public disclosure IX. CREDIT The discoverer of this vulnerability wishes to remain anonymous. Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php Free tools, research and upcoming events http://labs.idefense.com/ X. LEGAL NOTICES Copyright \xa9 2007 iDefense, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information

A cleanup script in crontabs in Apple Mac OS X 10.3.9 and 10.4.9 might delete filesystems that have been mounted in /tmp, which might allow local users to cause a denial of service, related to the find command. Apple Mac OS X is prone to multiple security vulnerabilities. These issues affect Mac OS X and various applications, including Alias Manager, CoreGraphics, crontabs, iChat, and PPP. Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. Both local and remote vulnerabilities are present. Apple Mac OS X 10.4.9 and prior versions are vulnerable to these issues

Integer overflow in CoreGraphics in Apple Mac OS X 10.4 up to 10.4.9 allows remote user-assisted attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted PDF file. Apple Mac OS X is prone to multiple security vulnerabilities. These issues affect Mac OS X and various applications, including Alias Manager, CoreGraphics, crontabs, iChat, and PPP. Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. Both local and remote vulnerabilities are present. Apple Mac OS X 10.4.9 and prior versions are vulnerable to these issues

Cross-site scripting (XSS) vulnerability in the web application firewall in Cisco CallManager before 3.3(5)sr3, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to CCMAdmin/serverlist.asp (aka the search-form) and possibly other unspecified vectors. Cisco CallManager is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this vulnerability could allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. Cisco CallManager 4.1.1 is reported vulnerable; other versions may also be affected

Cross-domain vulnerability in Apple Safari 2.0.4 allows remote attackers to access restricted information from other domains via Javascript, as demonstrated by a js script that accesses the location information of cross-domain web pages, probably involving setTimeout and timed events. Apple Safari is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain JavaScript restrictions. Exploiting this issue may allow attackers to access locations that a user visits, even if it's in a different domain than the attacker's site. The most common manifestation of this condition would typically be in blogs or forums. Attackers may be able to access potentially sensitive information that would aid in phishing attacks. This issue affects Safari 2.0.4; other versions may also be affected

The RSA Crypto-C before 6.3.1 and Cert-C before 2.8 libraries, as used by RSA BSAFE, multiple Cisco products, and other products, allows remote attackers to cause a denial of service via malformed ASN.1 objects. The RSA BSAFE Crypto-C and Cert-C libraries contain a denial-of-service vulnerability. RSA Security provides RSA BSAFE Cert-C and Crypto-C For implementing digital certificate processing and cryptographic algorithms respectively C/C++ A library for languages. RSA BSAFE Cert-C and Crypto-C Crafted by ASN.1 There is a problem with object processing, and there is a problem that the library falls into an infinite loop.Service operation disrupted by a remote third party (DoS) There is a possibility of being attacked. Exploiting this vulnerability allows attackers to crash applications that use the affected library. The specific impact of this vulnerability depends on the nature of the applications. Local and remote attacks may be possible. Depending on the nature of vulnerable applications, attackers may be able to exploit this issue without authentication. These versions are vulnerable: RSA BSAFE Crypto-C prior to 6.3.1 Cert-C prior to 2.8 The vendor tracks this issue by RSA Bug ID 46337. Cisco tracks this issue as Bug IDs: Cisco IOS: CSCsd85587 Cisco IOS XR: CSCsg41084 Cisco PIX and ASA Security Appliances: CSCse91999 Cisco Firewall Services Module (FWSM): CSCsi97695 Cisco Unified CallManager: CSCsg44348. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Vulnerability In Crypto Library Advisory ID: cisco-sa-20070522-crypto.shtml http://www.cisco.com/warp/public/707/cisco-sa-20070522-crypto.shtml Revision 1.0 For Public Release 2007 May 22 1300 UTC (GMT) - ------------------------------------------------------------------------------ Summary ======= A vulnerability has been discovered in a third party cryptographic library which is used by a number of Cisco products. This vulnerability may be triggered when a malformed Abstract Syntax Notation One (ASN.1) object is parsed. Due to the nature of the vulnerability it may be possible, in some cases, to trigger this vulnerability without a valid certificate or valid application-layer credentials (such as a valid username or password). Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previusly encrypted information. It is externally coordinated and is tracked by the following external coordinators: * JPCERT/CC - tracked as JVNVU#754281 * CPNI - tracked as NISCC-362917 * CERT/CC - tracked as VU#754281 Cisco has made free software available to address this vulnerability for affected customers. There are no workarounds available to mitigate the effects of the vulnerability. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-crypto.shtml. Note: Another related advisory is posted together with this Advisory. It also describes vulnerabilities related to cryptography that affect Cisco IOS. A combined software table for Cisco IOS only is available at http://www.cisco.com /warp/public/707/cisco-sa-20070522-cry-bundle.shtml and can be used to choose a software release which fixes all security vulnerabilities published as of May 22, 2007. It is sufficient that only one protocol or feature is enabled in order for a devices to be vulnerable. In order to be not vulnerable, all of the listed application protocols or features must be disabled. Affected protocols in Cisco IOS +------------------------------ To determine the software running on a Cisco IOS product, log in to the device and issue the "show version" command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the Cisco IOS release name. Other Cisco devices will not have the "show version" command, or will give different output. Only Cisco IOS images that contain the Crypto Feature Set are vulnerable. Customers who are not running an IOS image with crypto support are not exposed to this vulnerability. Cisco IOS feature set naming indicates that IOS images with crypto support have 'K8' or 'K9' in the feature designator field. The following example shows output from a device running an IOS image with crypto support: Router>show version Cisco IOS Software, 7200 Software (C7200-IK9S-M), Version 12.3(14)T1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2005 by Cisco Systems, Inc. Compiled Thu 31-Mar-05 08:04 by yiyan Since the feature set designator (IK9S) contains 'K9', it can be determine that this feature set contains crypto support. Additional information about Cisco IOS release naming is available at the following link: http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_white_paper09186a008018305e.shtml. You are affected by this vulnerability if you are running one of the vulnerable IOS software releases and have, at least one, of the following protocols or features enabled: * Internet Security Association and Key Management Protocol (ISAKMP) * In some IOS releases the Secure Socket Layer (SSL) may also be affected * Threat Information Distribution Protocol (TIDP) * Cisco IOS SIP Gateway Signaling Support Over TLS (SIP-TLS) * Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) As some other protocols may use affected crypto library the most accurate way to determine if your IOS release is vulnerable is to consult fixed IOS releases table. Internet Security Association and Key Management Protocol (ISAKMP) +----------------------------------------------------------------- To determine if your device has ISAKMP enabled, enter the command "show crypto isakmp policy". Below is an example of a device that has ISAKMP enabled. Router#show crypto isakmp policy Global IKE policy Protection suite of priority 1 <more output> If your output is like in the following example then you do not have IKE enabled on your device. Router#show crypto isakmp policy ISAKMP is turned off In Cisco IOS two features rely on ISAKMP - IPSec and Group Domain of Interpretation (GDOI). Presence of either of these features is detected by the previous example. Prior to IOS version 12.3(8)T, IKE was enabled by default, with no crypto configuration needed for the IOS device to process IKE messages. 12.2SXD versions of Cisco IOS have IKE enabled by default. To ensure that IKE processing is disabled, enter the global configuration command "no crypto isakmp enable". As of IOS version 12.3(2)T (which includes all 12.4-based versions), crypto configuration is required to enable IKE message processing. In order for an IOS device to be vulnerable crypto map must be explicilty configured and applied to an interface. Secure Socket Layer (SSL) +------------------------ In some Cisco IOS software releases the vulnerable library is used to process elements of SSL functionalities. SSL is used to protect several application layer protocols like Hyper Text Transfer Protocol over SSL (HTTPS). HTTPS is not the only protocol that may use SSL but it is the most commonly known. In order to determine if your device has HTTPS configured enter the command "show running | include secure". Below is an example of a device that has HTTPS enabled. router#show running | include secure-server ip http secure-server Threat Information Distribution Protocol (TIDP) +---------------------------------------------- To determine if your device has TDIP enabled, enter the command "show running-config | include parameter-map". Below is an example of a device that has TDIP enabled. router#show running | include parameter-map parameter-map type tms TMS_PAR Cisco IOS SIP Gateway Signaling Support Over TLS (SIP-TLS) +--------------------------------------------------------- To determine if your device has SIP-TLS enabled, enter the command "show running-config | include crypto signaling". Below is an example of a device that has SIP-TLS enabled. router#show running | include crypto signaling crypto signaling default trustpoint user1 Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) +-------------------------------------------------------------------- To determine if your device has EAP-TLS enabled, enter the command "show running-config | include method". Below is an example of a device that has EAP-TLS enabled. Router#show running | include method method tls Affected protocols in Cisco IOS XR +--------------------------------- You are affected by this vulnerability if you are running one of the vulnerable Cisco IOS XR software releases and have, at least one, of the following protocols or features enabled: * Internet Security Association and Key Management Protocol (ISAKMP) * In some IOS XR releases the Secure Socket Layer (SSL) may also be affected * Secure Shell (SSH) Internet Security Association and Key Management Protocol (ISAKMP) +----------------------------------------------------------------- To determine if your device has ISAKMP enabled, enter the command "show running-config | include isakmp". Below is an example of a device that has IKE enabled. Router#show running-config | include isakmp crypto isakmp crypto isakmp policy 1 crypto isakmp profile profile-a Secure Socket Layer (SSL) +------------------------ SSL is used to provide secure communications to the application layer protocols like Hyper Text Transfer Protocol over SSL (HTTPS) and Object Request Brokers (ORB). To determine if your device has any service enabled that uses SSL, enter one of the following commands "show running-config | include http server ssl" or "show running-config | include xml agent corba ssl". Below is an example of a device that has both of the services enabled. Router#show running-config | include http server ssl http server ssl Router#show running-config | include xml agent corba ssl xml agent corba ssl Secure Shell (SSH) +----------------- SSH is an application and a protocol that provides secure replacement for the suite of Berkeley r-tools such as rsh, rlogin and rcp. It is highly prefered over Telnet for interactive sessions. To determine if your device has SSH enabled enter the command "show running-config | include ssh server". Below is an example of a device that has SSH enabled. Router#show running-config | include ssh server ssh server ssh server rate-limit 100 Affected protocols in Cisco PIX and ASA Security Appliances +---------------------------------------------------------- You are affected by this vulnerability if you are running one of the vulnerable Cisco PIX and ASA software releases and have, at least one, of the following protocols or features enabled: * Secure Shell (SSH) * Internet Security Association and Key Management Protocol (ISAKMP) * Secure Socket Layer (SSL) Secure Shell (SSH) +----------------- To determine if a device has SSH enabled, enter the command "show running" and observe the output. If it contains the line as in the following example then SSH is enabled. PIX#show running .... ssh <host_IP_address> <host_netmask> <interface> .... Internet Security Association and Key Management Protocol (ISAKMP) +----------------------------------------------------------------- To determine if a device has ISAKMP enabled, enter the command "show running" and observe the output. If it contains the lines as in the following example then ISAKMP is enabled. PIX#show running .... crypto isakmp policy 2 authentication rsa-sig .... Secure Socket Layer (SSL) +------------------------ SSL is used to protect several application layer protocols like Hyper Text Transfer Protocol over SSL (HTTPS) and Cisco Adaptive Security Device Manager (ASDM) session. To determine if a device has SSL enabled, enter the command "show running" and observe the output. If it contains the line as in the following example then SSL is enabled. PIX#show running .... http server enable .... Affected protocols in Cisco Unified CallManager +---------------------------------------------- You are affected by this vulnerability if you are running one of the vulnerable Cisco Unified CallManager software releases and have, at least one, of the following protocols or features enabled: * Certificate Authority Proxy Function (CAPF) * Cisco TAPI Service Provider (Cisco Unified CallManager TSP) Certificate Authority Proxy Function (CAPF) +------------------------------------------ CAPF is automatically installed with Cisco CallManager but is disabled by default. In order to verify if CAPF is enabled on your Unified CallManager do the following steps. * Step 1 - In Cisco CallManager Administration, choose Service > Service Parameter. * Step 2 - If you are running 4.x software then do the following: from the Server drop-down list box, choose the publisher database server. If you are running 5.x software then do the following: From the Server drop-down list box, choose the first node. * Step 3 - From the Service drop-down list box, choose the Cisco Certificate Authority Proxy Function service. If you are given CAPF parameters then CAPF is running on your system. Cisco TAPI Service Provider (Cisco Unified CallManager TSP) +---------------------------------------------------------- In order to determine if Cisco Unified CallManager TSP is installed open Windows Control Panel (Start > Control Panel) and click on Add/Remove Programs. If 'Cisco Unity-CM TSP' is listed then you have it installed on your system. Products Confirmed Not Vulnerable +-------------------------------- No other Cisco products are currently known to be affected by this vulnerability. Specifically, the following product's features or products are known not to be affected: * Cisco IOS + Secure Shell (SSH) + Secure Copy (SCP) * Cisco Unified Call Manager + Hyper Text Transfer Protocol over SSL (HTTPS) + Cisco Unified CallManager is configured for Secure Survivable Remote Site Telephony (SRST) * MeetingPlace Express and MeetingPlace for Telepresence * Cisco IP Communicator * All Cisco Unified IP Phones 7900 Series * CIP TN3270 Server * Cisco GSS 4400 Series Global Site Selector Appliances * Cisco CatOS The list is not exhaustive. Details ======= ASN.1 is defined by ITU-T (International Telecommunication Union - Telecommunication Standardization Sector) standards and it describes, among other things, data structures for encoding values. The vulnerability addressed by this advisory is related to the implementation of parsing certain data structures and is not a vulnerability in the standard itself. Protocols that use ASN.1 (e.g., voice over IP, Simple Network Management Protocol and others), but do not rely on the vulnerable crypto library, are not affected. This advisory only addresses an implementation issue in a particular crypto library from a single vendor. Cisco will provide a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco PSIRT will set the bias in all cases to normal. Customers are encouraged to apply the bias parameter when determining the environmental impact of a particular vulnerability. CVSS is a standards based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html. Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss. Cisco Bug IDs: CSCsd85587 - Router crashes when processing ISAKMP message CVSS Base Score: 3.3 Access Vector: Remote Access Complexity: Low Authentication: Not Required Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete Impact Bias: Normal CVSS Temporal Score: 2.7 Exploitability: Functional Remediation Level: Official Fix Report Confidence: Confirmed CSCsg41084 - IOS XR crashes when processing ISAKMP message CVSS Base Score: 3.3 Access Vector: Remote Access Complexity: Low Authentication: Not Required Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete Impact Bias: Normal CVSS Temporal Score: 2.7 Exploitability: Functional Remediation Level: Official Fix Report Confidence: Confirmed CSCse91999 - PIX/ASA crashes when processing ISAKMP message CVSS Base Score: 3.3 Access Vector: Remote Access Complexity: Low Authentication: Not Required Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete Impact Bias: Normal CVSS Temporal Score: 2.7 Exploitability: Functional Remediation Level: Official Fix Report Confidence: Confirmed CSCsg44348 - Unified CallManager crashes when processing crypto message CVSS Base Score: 3.3 Access Vector: Remote Access Complexity: Low Authentication: Not Required Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete Impact Bias: Normal CVSS Temporal Score: 2.7 Exploitability: Functional Remediation Level: Official Fix Report Confidence: Confirmed Impact ====== Successful exploitation of the vulnerability listed in this advisory may result in the crash of a vulnerable device. Repeated exploitation can result in a sustained DoS attack. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) describes a release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (the "First Fixed Release") and the anticipated date of availability for each are listed in the "Rebuild" and "Maintenance" columns. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. The release should be upgraded at least to the indicated release or a later version (greater than or equal to the First Fixed Release label). For more information on the terms "Rebuild" and "Maintenance," consult the following URL: http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_white_paper09186a008018305e.shtml Cisco IOS +-------- Fixed Cisco IOS software releases are listed in the table below. +-----------------------------------------------------------------------------+ | Major Release | Availability of Repaired Releases | |------------------------------+----------------------------------------------| | Affected 12.2-Based Release | Rebuild | Maintenance | |------------------------------+----------------------------------------------| | 12.2B | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.2BC | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2BZ | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2CX | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2CZ | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2EW | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2EWA | 12.2(25)EWA9 | | |------------------------------+----------------------------------------------| | 12.2EX | Vulnerable; migrate to 12.2(25)SEE3 or later | |------------------------------+----------------------------------------------| | 12.2EY | Vulnerable; migrate to 12.2(25)SEE3 or later | |------------------------------+----------------------------------------------| | 12.2EZ | Vulnerable; migrate to 12.2(25)SEE3 or later | |------------------------------+----------------------------------------------| | 12.2FX | Vulnerable; migrate to 12.2(25)SEE3 or later | |------------------------------+----------------------------------------------| | 12.2FY | Vulnerable; migrate to 12.2(35)SE2 or later | |------------------------------+----------------------------------------------| | 12.2FZ | Vulnerable; migrate to 12.2(35)SE2 or later | |------------------------------+----------------------------------------------| | 12.2IXA | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2IXB | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2IXC | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2JA | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2JK | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.2SB | 12.2(31)SB3 | | |------------------------------+---------------------+------------------------| | 12.2SE | 12.2(35)SE2 | | |------------------------------+----------------------------------------------| | 12.2SEA | Vulnerable; migrate to 12.2(25)SEE3 or later | |------------------------------+----------------------------------------------| | 12.2SEB | Vulnerable; migrate to 12.2(25)SEE3 or later | |------------------------------+----------------------------------------------| | 12.2SEC | Vulnerable; migrate to 12.2(25)SEE3 or later | |------------------------------+----------------------------------------------| | 12.2SED | Vulnerable; migrate to 12.2(25)SEE3 or later | |------------------------------+----------------------------------------------| | 12.2SEE | 12.2(25)SEE3 | | |------------------------------+----------------------------------------------| | 12.2SEF | Vulnerable; migrate to 12.2(35)SE2 or later | |------------------------------+----------------------------------------------| | 12.2SEG | Vulnerable; migrate to 12.2(35)SE2 or later | |------------------------------+----------------------------------------------| | 12.2SG | | 12.2(37)SG | |------------------------------+---------------------+------------------------| | 12.2SGA | 12.2(31)SGA1 | | |------------------------------+---------------------+------------------------| | 12.2SRA | 12.2(33)SRA3 | | |------------------------------+---------------------+------------------------| | 12.2SRB | | 12.2(33)SRB | |------------------------------+----------------------------------------------| | 12.2SXD | Vulnerable; migrate to 12.2(18)SXF8 or later | |------------------------------+----------------------------------------------| | 12.2SXE | Vulnerable; migrate to 12.2(18)SXF8 or later | |------------------------------+----------------------------------------------| | 12.2SXF | 12.2(18)SXF8 | | |------------------------------+----------------------------------------------| | 12.2T | Vulnerable; migrate to 12.3(22) or later | |------------------------------+----------------------------------------------| | 12.2XR | Vulnerable; migrate to 12.3(22) or later | |------------------------------+----------------------------------------------| | 12.2YU | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.2YV | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.2ZD | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2ZE | Vulnerable; migrate to 12.3(22) or later | |------------------------------+----------------------------------------------| | 12.2ZF | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.2ZG | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2ZH | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2ZJ | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.2ZL | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2ZU | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.2ZW | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | Affected 12.3-Based Release | Rebuild | Maintenance | |------------------------------+---------------------+------------------------| | 12.3 | | 12.3(22) | |------------------------------+----------------------------------------------| | 12.3B | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3BC | 12.3(17b)BC6 | | |------------------------------+----------------------------------------------| | 12.3JA | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3JEA | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3JK | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3JL | 12.3(2)JL1 | | |------------------------------+----------------------------------------------| | 12.3JX | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3T | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3TPC | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3XA | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3XB | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3XC | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3XD | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3XE | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3XF | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3XG | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3XH | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3XI | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3XJ | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3XK | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3XQ | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3XR | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3XS | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3XU | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.3XW | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3XX | Vulnerable; migrate to 12.4(10) or later | |------------------------------+----------------------------------------------| | 12.3YA | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3YD | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.3YF | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3YG | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.3YH | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.3YI | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.3YK | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.3YQ | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.3YS | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.3YT | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.3YU | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.3YX | 12.3(14)YX7 | | |------------------------------+----------------------------------------------| | 12.3YZ | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | Affected 12.4-Based Release | Rebuild | Maintenance | |------------------------------+---------------------+------------------------| | 12.4 | 12.4(7d) | 12.4(10) | |------------------------------+---------------------+------------------------| | 12.4SW | 12.4(11)SW1 | | |------------------------------+---------------------+------------------------| | | 12.4(6)T7 | | | |---------------------+------------------------| | 12.4T | 12.4(9)T3 | | | |---------------------+------------------------| | | 12.4(11)T1 | | |------------------------------+----------------------------------------------| | 12.4XA | Vulnerable; migrate to 12.4(6)T7 or later | |------------------------------+----------------------------------------------| | 12.4XB | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.4XC | 12.4(4)XC6 | | |------------------------------+---------------------+------------------------| | 12.4XD | 12.4(4)XD6 | | |------------------------------+----------------------------------------------| | 12.4XE | Vulnerable; contact TAC | |------------------------------+----------------------------------------------| | 12.4XJ | 12.4(11)XJ2 | | |------------------------------+----------------------------------------------| | 12.4XP | Vulnerable; contact TAC | +-----------------------------------------------------------------------------+ Cisco IOS XR +----------- The following table lists fixed Cisco IOS XR software. +---------------------------------------------------------------------+ | Cisco IOS XR | SMU ID | SMU Name | | Version | | | |---------------------+-----------------+-----------------------------| | 3.2.3 | AA01802 | hfr-k9sec-3.2.3.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.2.4 | AA01801 | hfr-k9sec-3.2.4.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.2.6 | AA01800 | hfr-k9sec-3.2.6.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.3.0 | AA01799, | hfr-k9sec-3.3.0.CSCsg41084 | | | AA01780 | | |---------------------+-----------------+-----------------------------| | 3.3.0 | AA01780 | c12k-k9sec-3.3.0.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.3.1 | AA01781 | c12k-k9sec-3.3.1.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.3.1 | AA01798 | hfr-k9sec-3.3.1.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.3.2 | AA01797 | hfr-k9sec-3.3.2.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.3.3 | AA01796 | hfr-k9sec-3.3.3.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.3.3 | AA01785 | c12k-k9sec-3.3.3.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.4.0 | AA01782 | c12k-k9sec-3.4.0.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.4.0 | AA01795 | hfr-k9sec-3.4.0.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.4.1 | AA01783 | c12k-k9sec-3.4.1.CSCsg41084 | |---------------------+-----------------+-----------------------------| | 3.4.1 | AA01794 | hfr-k9sec-3.4.1.CSCsg41084 | +---------------------------------------------------------------------+ IOS XR Package Installation Envelopes (PIE) can be downloaded from File Exchange at: https://upload.cisco.com/cgi-bin/swc/fileexg/main.cgi?CONTYPES=IOS-XR Installation instructions are included in the accompanying .txt files. Cisco PIX and ASA Security Appliance +----------------------------------- This vulnerability is fixed in the following 7.x software releases: 7.0(6.7), 7.1(2.27), 7.2(1.22), 7.2(2). All 8.x software releases do contain the fixed library and are not affected. No 6.x software releases are affected by this vulnerability. Cisco Firewall Service Module (FWSM) +----------------------------------- This vulnerability is fixed in the following software releases: * 2.3(5) maintenance release, expected in 2007-June * 3.1(6) maintenance release, expected in 2007-June Cisco Unified CallManager +------------------------ This vulnerability is fixed in the following software releases. * 4.0(x) releases are vulnerable but no fix will be provided. Customers are advised to upgrade to the fixed 4.1 or 4.2 software. * 4.1(3)sr.5 expected in 2007-May-24 * 4.2(3)sr.2 expected in 2007-May * 4.3(1)sr.1 expected 2007-Jun * 5.0(4) - no fixed software planned, users should upgrade to 5.1(2) * 5.1(1) - no fixed software planned, users should upgrade to 5.1(2) * 5.1(2) Workarounds =========== The only way to prevent a device being susceptible to the listed vulnerabilities is to disable the affected service(s). However, if regular maintenance and operation of the device relies on these services then there is no workaround. It is possible to mitigate these vulnerabilities by preventing unauthorized hosts to access the affected devices. Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Intelligence companion document for this advisory: http://www.cisco.com/warp/ public/707/cisco-air-20070522-crypto.shtml Control Plane Policing (CoPP) +---------------------------- Control Plane Policing: IOS software versions that support Control Plane Policing (CoPP) can be configured to help protect the device from attacks that target the management and control planes. CoPP is available in Cisco IOS release trains 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T. In the CoPP example below, the ACL entries that match the exploit packets with the permit action will be discarded by the policy-map drop function, while packets that match a deny action (not shown) are not affected by the policy-map drop function. !-- Include deny statements up front for any protocols/ports/IP addresses that !-- should not be impacted by CoPP !-- Include permit statements for the protocols/ports that will be governed by CoPP !-- port 443 - HTTPS access-list 100 permit tcp any any eq 443 !-- port 500 - IKE access-list 100 permit udp any any eq 500 !-- port 848 - GDOI access-list 100 permit tcp any any eq 848 !-- port 5060 - SIP-TLS access-list 100 permit tcp any any eq 5060 !-- port 5354 - TIDP access-list 100 permit tcp any any eq 5354 !-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4 !-- traffic in accordance with existing security policies and !-- configurations for traffic that is authorized to be sent !-- to infrastructure devices. ! !-- Create a Class-Map for traffic to be policed by !-- the CoPP feature. ! class-map match-all Drop-Known-Undesirable match access-group 100 ! !-- Create a Policy-Map that will be applied to the !-- Control-Plane of the device. ! policy-map CoPP-Input-Policy class Drop-Known-Undesirable drop !-- Apply the Policy-Map to the Control-Plane of the !-- device. ! control-plane service-policy input CoPP-Input-Policy Please note that in the 12.0S, 12.2S, and 12.2SX Cisco IOS trains, the policy-map syntax is different: policy-map CoPP-Input-Policy class Drop-Known-Undesirable police 32000 1500 1500 conform-action drop exceed-action drop NOTE: In the above CoPP example, the ACL entries with the "permit" action that match the exploit packets result in the discarding of those packets by the policy-map drop function, while packets that match the "deny" action are not affected by the policy-map drop function. Additional information on the configuration and use of the CoPP feature can be found at http://www.cisco.com/en/US/products/ps6642/products_white_paper0900aecd804fa16a.shtml and http://www.cisco.com/en/US/products/sw/iosswrel/ps1838/products_feature_guide09186a008052446b.html Access Control List (ACL) +------------------------ Access control lists can be used to help mitigate attacks that may try to exploit these vulnerabilities. This is done in a way that only packets from the legitimate sources are allowed to reach the device and all others are dropped. access-list 101 permit tcp host <legitimate_host_IP_address> host <router_IP_address> eq 443 access-list 101 permit udp host <legitimate_host_IP_address> host <router_IP_address> eq 500 access-list 101 permit tcp host <legitimate_host_IP_address> host <router_IP_address> eq 506 access-list 101 permit tcp host <legitimate_host_IP_address> host <router_IP_address> eq 4848 access-list 101 permit tcp host <legitimate_host_IP_address> host <router_IP_address> eq 5060 access-list 101 permit tcp host <legitimate_host_IP_address> host <router_IP_address> eq 5354 access-list 101 deny tcp any any eq 443 access-list 101 deny udp any any eq 500 access-list 101 deny tcp any any eq 506 access-list 101 deny udp any any eq 4848 access-list 101 deny tcp any any eq 5060 access-list 101 deny tcp any any eq 5354 Obtaining Fixed Software ======================== Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third-party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this Advisory. This vulnerability was discovered by Cisco during internal testing. Status of This Notice: Interim ============================== THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20070522-crypto.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-teams@first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------------------------------------+ | Revision 1.0 | 2007-May-22 | Initial public release. | +---------------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. - ------------------------------------------------------------------------------- All contents are Copyright 2006-2007 Cisco Systems, Inc. All rights reserved. - ------------------------------------------------------------------------------- Updated: May 22, 2007 Document ID: 91890 - ------------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFGUv7c8NUAbBmDaxQRAse8AJ9YwxPEprfhiJNzLVTLMXsTnTuWSwCghmmF qlrKeNA331DvYso6f2C5mRk= =dfTU -----END PGP SIGNATURE-----

Cisco IOS 12.4 and earlier, when using the crypto packages and SSL support is enabled, allows remote attackers to cause a denial of service via a malformed (1) ClientHello, (2) ChangeCipherSpec, or (3) Finished message during an SSL session. According to information from Cisco Systems, the vulnerability is HTTPS Server WebVPN Such as service SSL The function to use is enabled Cisco IOS The device may be affected. Cisco IOS is prone to multiple denial-of-service vulnerabilities because it fails to handle malformed SSL packets. Attackers can exploit these issues to cause denial-of-service conditions on an affected device. NOTE: Attackers can exploit these issues only via an established TCP connection, but only prior to security authentication. An attacker can, however, interrupt a secure session and inject malicious packets when a new session is started. Due to these factors, the likelihood of successful attacks is reduced. Cisco IOS is the operating system used by Cisco networking equipment. Attackers can trigger these vulnerabilities after a TCP connection is created but before authentication credentials (such as username/password or certificates) are exchanged, requiring completion of the TCP triple handshake reduces the probability of exploiting these vulnerabilities by using spoofed IP addresses. An attacker intercepting communication between two affected devices would not be able to exploit this vulnerability if an SSL session has already been established, as SSL protects against this type of injection

Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests. Microsoft Internet Information Services is prone to a security-bypass vulnerability. Remote attackers can exploit this issue to hang the application, denying service to legitimate users, or disclose sensitive information. Attackers with physical access to the system may be able to execute arbitrary code with the privileges of the application. Microsoft Internet Information Services 6.0 is vulnerable; other versions may also be affected

The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the CiWebhitsfile parameter to null.htw. Microsoft IIS is prone to an authentication-bypass vulnerability due to its implementation of 'Hit-highlighting' functionality. Attackers can exploit this issue to access private files hosted on an IIS website. Successful exploits may allow attackers to gain access to potentially sensitive information. Other attacks are possible. NOTE: Presumably, accessing a Trusted Zone may allow attackers to execute commands; this has not been confirmed

Comodo Firewall Pro 2.4.18.184 and Comodo Personal Firewall 2.3.6.81, and probably older Comodo Firewall versions, do not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the NT kernel 5.0 and greater, which allows local users to call these functions, and bypass firewall rules or gain privileges, via a modified identifier that is one, two, or three greater than the canonical identifier. Comodo Firewall Pro is prone to a local security vulnerability. These malformed identifiers are one, two, or three larger than the standard identifiers

Check Point ZoneAlarm Pro before 6.5.737.000 does not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the NT kernel 5.0 and greater, which allows local users to call these functions, and bypass firewall rules or gain privileges, via a modified identifier that is one, two, or three greater than the canonical identifier. Comodo Firewall Pro is prone to a local security vulnerability