MCAFEE FOUNDSTONE FSL UPDATE 2013-FEB-25 To better protect your environment McAfee has created this FSL check update for the Foundstone Product Suite. The following is a detailed summary of the new and updated checks included with this release. NEW CHECKS 14663 - VMware vsphere Products Client-Side Authentication Vulnerability CVE: CVE-2013-1405 DISA IAVA: 2013-B-0012 A vulnerability is present in some versions of VMware vsphere. VMware vsphere products provides unified management of VM. A vulnerability is present in some versions of VMware vsphere. The flaw exist in the handling of the management authentication protocol. Successful exploitation by a remote attacker could result in remote code execution. 14750 - (HT5644) Apple OS X Server Multiple Ruby on Rails Vulnerabilities Category: SSH Module -> NonIntrusive -> Mac OS X Patches and Hotfixes CVE: CVE-2013-0156, CVE-2013-0333 Multiple vulnerabilities are present in some versions of Apple Mac OS X Server. Apple Mac OS X Server provides easy to use interface to configure enterprise services for Apple devices. Multiple vulnerabilities are present in some versions of Apple Mac OS X Server. The flaws lie in Ruby on Rails in OS X Server. Successful exploitation could allow an attacker to cause arbitrary code execution. 14751 - Schneider Electric Accutech Manager Heap Overflow Remote Code Execution Category: Windows Host Assessment -> SCADA CVE: CVE-2013-0658 A remote code execution vulnerability is present in some versions of Schneider Electric Accutech Manager.
A remote code execution vulnerability is present in some versions of Schneider Electric Accutech Manager. The flaw is due to a heap-based buffer overflow in the application. Successful exploitation by a remote attacker could result in the execution of arbitrary code or a denial of service. 14752 - (VMSA-2013-0002) VMware View VMCI Privilege Escalation Vulnerability CVE: CVE-2013-1406 A privilege escalation vulnerability is present in some versions of VMware View. VMware View is a remote virtual desktops management solution. A privilege escalation vulnerability is present in some versions of VMware View. The flaw occurs due to the handing of control code of vmci.sys. Successful exploitation could allow an attacker to escalate privilege. 14755 - Ruby on Rails Serialized Attributes YAML Remote Code Execution CVE: CVE-2013-0277 A remote code execution vulnerability is present in some versions of Ruby on Rails. A remote code execution vulnerability is present in some versions of Ruby on Rails. The flaw lies in the serialized attribute handling code. Successful exploitation by a remote attacker could result in the execution of arbitrary code or a denial of service. 14756 - BlackBerry Enterprise Server LibTIFF Remote Code Execution I CVE: CVE-2012-2088
The flaw is due to how TIFF images are processed. Successful exploitation by a remote attacker could result in the execution of arbitrary code. 14757 - BlackBerry Enterprise Server LibTIFF Remote Code Execution II CVE: CVE-2012-4447 The flaw is due to how TIFF images are processed. Successful exploitation by a remote attacker could result in the execution of arbitrary code. 14754 - Ruby on Rails attr_protected Method ActiveRecord Security Bypass Risk Level: Medium CVE: CVE-2013-0276 A security bypass vulnerability is present in some versions of Ruby on Rails. A security bypass vulnerability is present in some versions of Ruby on Rails. The flaw lies in the attr_protected method in ActiveRecord. Successful exploitation could allow a remote attacker to bypass security restrictions. 14768 - Bugzilla Show Bug Invalid Format Cross Site Scripting Vulnerability Category: General Vulnerability Assessment -> NonIntrusive -> Web Server Risk Level: Medium CVE: CVE-2013-0785 A cross site scripting vulnerability is present in some versions of Bugzilla. Bugzilla is a Web-based bug-tracking system. A cross site scripting vulnerability is present in some versions of Bugzilla. The flaw occurs due to bug id was not sanitized when format is invalid. Successful exploitation could allow an attacker to execute arbitrary script code. 14767 - Bugzilla Debug Mode Query Information Disclosure Vulnerability
Category: General Vulnerability Assessment -> NonIntrusive -> Web Server Risk Level: Low CVE: CVE-2013-0786 An information disclosure vulnerability is present in some versions of Bugzilla. Bugzilla is a Web-based bug-tracking system. An information disclosure vulnerability is present in some versions of Bugzilla. The flaw lies in debug mode. Successful exploitation could allow an attacker to obtain confidential field value. 14586 - Microsoft Windows Machine Account Lockout Threshold Policy The Microsoft Windows machine account lockout threshold parameter does not match policy. The Microsoft Windows machine account lockout threshold parameter does not match policy. This policy setting allows administrators to specify the number of failed logon attempts that will cause a user account to be locked out. ENHANCED CHECKS The following checks have been updated. Enhancements may include optimizations, changes that reflect new information on a vulnerability and anything else that improves upon an existing FSL check. 4098 - Microsoft HTML Help Workshop Buffer Overflow vulnerability Check Version: 1.95 CVE: CVE-2006-0564 8801 - Apple Safari 'Window.Parent.Close()' Code Execution Vulnerability CVE: CVE-2010-1939
13735 - Microsoft Wordpad Doc File Null Pointer Denial of Service 13802 - Microsoft Windows OpenType Font Denial Of Service 13850 - Microsoft IIS FTP Command Denial of Service 4648 - Microsoft SQL MS Jet Engine Unicode Buffer Overflow Vulnerability Risk Level: Medium Check Version: 1.1514 CVE: CVE-2002-0695, CVE-2002-0859 DISA IAVA: 2003-T-0013,2003-T-0008,2003-T-0004,2003-A-0012,2003-A-0011,200 CVE is updated. 14528 - Microsoft Windows Enable S4U2Self For Claim Policy
14535 - Microsoft Windows Machine Inactivity limit Policy 14583 - Microsoft Windows Block Microsoft Accounts Policy 70001 - windowspolicy.fasl3.inc Category: General Vulnerability Assessment -> NonIntrusive -> Invalid Category Check Version: 1.5015 70050 - vmware.fasl3.inc Category: General Vulnerability Assessment -> NonIntrusive -> Invalid Category Check Version: 1.3199 70129 - ruby.fasl3.inc Category: General Vulnerability Assessment -> NonIntrusive -> Invalid Category
ADDITIONAL NOTES 70001 - This content package includes new Windows2012 Policies. HOW TO UPDATE FS1000 APPLIANCE customers should follow the instructions for Enterprise/Professional customers, below. In addition, we strongly urge all appliance customers to authorize and install any Windows Update critical patches. The appliance will auto-download any critical updates but will wait for your explicit authorization before installing. FOUNDSTONE ENTERPRISE and PROFESSIONAL customers may obtain these new scripts using the FSUpdate Utility by selecting "FoundScan Update" on the help menu. Make sure that you have a valid FSUpdate username and password. The new vulnerability scripts will be automatically included in your scans if you have selected that option by right-clicking the selected vulnerability category and checking the "Run New Checks" checkbox. MANAGED SERVICE CUSTOMERS already have the newest update applied to their environment. The new vulnerability scripts will be automatically included when your scans are next scheduled, provided the Run New Scripts option has been turned on. MCAFEE TECHNICAL SUPPORT ServicePortal: https://mysupport.mcafee.com/ Multi-National Phone Support available here: http://www.mcafee.com/us/about/contact/index.html Non-US customers - Select your country from the list of Worldwide Offices. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you are not the intended recipient please contact the sender and delete all copies. Copyright 2010 McAfee, Inc. McAfee is a registered trademark of McAfee, Inc. and/or its affiliates