SecurityTracker Monday Morning Vulnerability Summary Oct 28, 2013

Transcription

1 In This Week's SecurityTracker Vulnerability Summary SecurityTracker Alerts: 27 Vendors: Alstom - Apple Computer - CA - Cisco - EMC - F5 Networks - GNU [multiple authors] - Gnupg.org - Google - Joyent, Inc. - kernel.org - libvirt.org - Mozilla.org - Siemens - WatchGuard - Xerox Products: Apple ios - Apple Keynote - Apple Remote Desktop - Apple Safari - BIG-IP - CA SiteMinder - Cisco Catalyst Switch - Cisco Identity Services Engine - Cisco IOS - e-terraplatform - Glibc - GnuPG (Gnu Privacy Guard) - Google Chrome - libvirt - Linux Kernel - Mac OS X - Network Security Services (NSS) - Node.js - RSA Authentication Agent - Siemens COMOS - WatchGuard XTM - Xerox WorkCentre Headlines: 1. Linux Kernel ip output Memory Corruption Flaw Lets Local Users Deny Service or Gain Elevated Privileges 2. Node.js HTTP Server Lets Remote Users Deny Service 3. Linux Kernel Device Mapper Snapshot Error Lets Local Users Read From Free Disk Space 4. libvirt API Access Control Flaw Lets Remote Authenticated Users Deny Service 5. Cisco Identity Services Engine Lets Remote Users Download Data and Remote Authenticated Users Execute Arbitrary Commands 6. Cisco IOS XR Fragmented Packet Processing Flaw Lets Remote Users Deny Service 7. Apple ios Bugs Let Physically Local Users Bypass Access Protections 8. Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code and Spoof URLs 9. Mozilla Network Security Services Uninitialized Memory Read Has Unspecified Impact Copyright 2013, SecurityGlobal.net LLC Page 1 of 10

2 10. Xerox WorkCentre and ColorQube Let Remote Users Gain Unauthorized Access 11. CA SiteMinder Input Validation Flaw Permits Cross-Site Scripting Attacks 12. Mac OS X Server JSON Memory Allocation Error Lets Remote Users Deny Service 13. RSA Authentication Agent for Web for IIS Flaw Lets Remote Users Bypass the Agent 14. Apple Remote Desktop Format String Flaw Lets Remote Users Execute Arbitrary Code 15. Cisco Identity Services Engine Guest Account Creation Bug Lets Remote Users Deny Service 16. Cisco Catalyst 3750X Switch Lets Local Users Gain Elevated Privileges 17. Alstom e-terracontrol DNP3 Protocol Processing Flaw Lets Remote Users Deny Service 18. GnuPG Incorrect Processing of Key Flags Subpacket May Let Users Bypass Security Controls 19. F5 BIG-IP Traffic Management Microkernel Component Lets Remote Users Deny Service 20. GnuPG Side-Channel Attack Lets Local Users Recover RSA Secret Keys 21. WatchGuard XTM Buffer Overflow Lets Remote Users Execute Arbitrary Code and Input Validation Flaw Permits Cross-Site Scripting Attacks 22. Glibc getaddrinfo() Overflow Lets Remote or Local Users Deny Service 23. Apple Keynote Lets Local Users Bypass the Screen Lock 24. libvirt virt-login-shell Input Validation Flaw Copyright 2013, SecurityGlobal.net LLC Page 2 of 10

3 Lets Local Users Gain Elevated Privileges 25. Apple Mac OS X Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Information and Local Users Bypass Access Controls and Deny Service 26. Siemens COMOS Unspecified Flaw Lets Local Users Gain Elevated Database Privileges 27. Apple Safari Web Inspector Disables Private Browsing Without Warning Your SecurityTracker Vulnerability Alerts 1. Linux Kernel Vendor: kernel.org A vulnerability was reported in the Linux Kernel. A local user can cause denial of service conditions. A local user may be able to obtain elevated privileges on the target system. Impact: Denial of service via local system Alert: 2. Node.js Vendor: Joyent, Inc. A vulnerability was reported in Node.js. A remote user can cause denial of service conditions. Alert: 3. Linux Kernel Vendor: kernel.org Copyright 2013, SecurityGlobal.net LLC Page 3 of 10

4 A vulnerability was reported in the Linux Kernel. A local user can read portions of disk space on the target system. Impact: Disclosure of system information Alert: 4. libvirt Vendor: libvirt.org A vulnerability was reported in libvirt. A remote authenticated user can cause denial of service conditions. Alert: 5. Cisco Identity Services Engine Vendor: Cisco Two vulnerabilities were reported in Cisco Identity Services Engine. A remote authenticated user can execute arbitrary commands on the target system. A remote user can obtain potentially sensitive information. Impact: Disclosure of system information Alert: 6. Cisco IOS Vendor: Cisco A vulnerability was reported in Cisco IOS XR. A remote user can cause denial of service conditions. Copyright 2013, SecurityGlobal.net LLC Page 4 of 10

5 Alert: 7. Apple ios Several vulnerabilities were reported in Apple ios. A physically local user can bypass access controls. Impact: User access via local system Alert: 8. Google Chrome Vendor: Google A vulnerability was reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can spoof URLs. Impact: Execution of arbitrary code via network Alert: 9. Network Security Services (NSS) Vendor: Mozilla.org A vulnerability was reported in Mozilla Network Security Services (NSS). The impact was not specified. Impact: Not specified Alert: Xerox WorkCentre Vendor: Xerox Copyright 2013, SecurityGlobal.net LLC Page 5 of 10

6 A vulnerability was reported in Xerox WorkCentre and ColorQube. A remote user can gain unauthorized access. Impact: User access via network Alert: CA SiteMinder Vendor: CA A vulnerability was reported in CA SiteMinder. A remote user can conduct cross-site scripting attacks. Impact: Disclosure of authentication information Alert: Mac OS X A vulnerability was reported in Mac OS X Server. A remote user can cause denial of service conditions. Alert: RSA Authentication Agent Vendor: EMC A vulnerability was reported in RSA Authentication Agent for Web for IIS. A remote user can bypass security controls. Impact: Host/resource access via network Alert: Copyright 2013, SecurityGlobal.net LLC Page 6 of 10

7 14. Apple Remote Desktop A vulnerability was reported in Apple Remote Desktop. A remote user can execute arbitrary code on the target system. Impact: Execution of arbitrary code via network Alert: Cisco Identity Services Engine Vendor: Cisco A vulnerability was reported in Cisco Identity Services Engine. A remote user can cause denial of service conditions. Alert: Cisco Catalyst Switch Vendor: Cisco A vulnerability was reported in Cisco Catalyst 3750X Switches. A local user can obtain elevated privileges on the target system. Impact: Root access via local system Alert: e-terraplatform Vendor: Alstom A vulnerability was reported in Alstom e-terracontrol. A remote user can cause denial of service conditions. Copyright 2013, SecurityGlobal.net LLC Page 7 of 10

8 Alert: GnuPG (Gnu Privacy Guard) Vendor: Gnupg.org A vulnerability was reported in GnuPG. A remote user may be able to bypass security controls. Impact: Modification of system information Alert: BIG-IP Vendor: F5 Networks A vulnerability was reported in F5 BIG-IP. A remote user can cause denial of service conditions. Alert: GnuPG (Gnu Privacy Guard) Vendor: Gnupg.org A vulnerability was reported in GnuPG. A local user can obtain portions of the RSA secret key. Impact: Disclosure of authentication information Alert: WatchGuard XTM Vendor: WatchGuard Copyright 2013, SecurityGlobal.net LLC Page 8 of 10

9 Two vulnerabilities were reported in WatchGuard XTM. A remote user can execute arbitrary code on the target system. A remote user can conduct cross-site scripting attacks. Impact: Disclosure of authentication information Alert: Glibc Vendor: GNU [multiple authors] A vulnerability was reported in Glibc. A remote or local user can cause denial of service conditions. Impact: Denial of service via local system Alert: Apple Keynote A vulnerability was reported in Apple Keynote. A local user can bypass the screen lock in certain cases. Impact: User access via local system Alert: libvirt Vendor: libvirt.org A vulnerability was reported in libvirt. A local user can obtain elevated privileges on the target system. Impact: Modification of system information Alert: Copyright 2013, SecurityGlobal.net LLC Page 9 of 10

10 25. Mac OS X Multiple vulnerabilities were reported in Apple Mac OS X. A remote user can cause arbitrary code to be executed on the target user's system. A local user can bypass access controls. A local user can cause denial of service conditions. A remote user can obtain potentially sensitive information. Impact: Denial of service via local system Alert: Siemens COMOS Vendor: Siemens A vulnerability was reported in Siemens COMOS. A local user can obtain elevated privileges on the target system. Impact: User access via local system Alert: Apple Safari A vulnerability was reported in Apple Safari. A remote or local user can obtain potentially sensitive information in certain cases. Impact: Disclosure of system information Alert: Copyright 2013, SecurityGlobal.net LLC Page 10 of 10