BugTraq Latest Security Advisories

Syndicate content
The premier general security mailing list. Vulnerabilities are often announced here first, so check frequently!
Updated: 31 min 18 sec ago

Multiple exposures in Sophos UTM

7 hours 3 min ago

Posted by Tim Schughart on Sep 30

Hello @all,

together with my colleague we found two uncritical vulnerabilities you'll find below.

Product: Sophos UTM
Vendor: Sophos ltd.

Internal reference: ? (Bug ID)
Vulnerability type: Information Disclosure
Vulnerable version: 9.405-5, 9.404-5 and possible other versions affected (not tested)
Vulnerable component: Frontend
Report confidence: yes
Solution status: Not fixed by Vendor, no further responses from vendor.
Fixed...
Categories:

[SYSS-2016-060] Logitech M520 - Insufficient Verification of Data Authenticity (CWE-345)

7 hours 13 min ago

Posted by matthias . deeg on Sep 30

Advisory ID: SYSS-2016-060
Product: M520 (Mouse of Wireless Combo MK520)
Manufacturer: Logitech
Affected Version(s): Model Y-R0012
Tested Version(s): Model Y-R0012
Vulnerability Type: Insufficient Verification of Data Authenticity (CWE-345)
Mouse Spoofing Attack
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2016-06-28
Solution Date: -
Public Disclosure: 2016-09-30
CVE Reference: Not yet assigned
Authors...
Categories:

Re: CVE-2016-5019: MyFaces Trinidad view state deserialization security vulnerability

September 29, 2016 - 2:00pm

Posted by Mike Kienenberger on Sep 29

Clarification: The first line in this CVE [1] was a copy&paste error
during message composition and is not part of the CVE. This line can
make it sound as if CVE-2016-5019 is only an information disclosure
vulnerability rather than a deserialization attack vector. I
apologize for the confusion.
Categories:

Persistent XSS in Abus Security Center - CVSS 8.0

September 29, 2016 - 10:39am

Posted by Tim Schughart on Sep 29

Hi@all,

Product: Abus Security Cams
Vendor:Abus Group

Internal reference: -
Vulnerability type: Cross Site Scripting
Vulnerable version: 0101a and possible other versions affected (not tested)
Vulnerable component: FTP
Report confidence: Confirmed
Solution status: Not fixed by Vendor, will not patch the vuln.
Fixed versions: -
Researcher credits: Tim Schughart & Khanh Quoc Pham of ProSec Networks
Vendor notification: 2016-09-21...
Categories:

[security bulletin] HPSBGN03650 rev.1 - HPE Network Automation Software, Local Arbitrary File Modification

September 29, 2016 - 2:50am

Posted by security-alert on Sep 29

Note: the current version of the following document is available here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05281739

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c05281739
Version: 1

HPSBGN03650 rev.1 - HPE Network Automation Software, Local Arbitrary File
Modification

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2016-09-28
Last Updated:...
Categories:

Cisco Security Advisory: Cisco IOS and IOS XE Software Smart Install Memory Leak Vulnerability

September 28, 2016 - 12:33pm

Posted by Cisco Systems Product Security Incident Response Team on Sep 28

Cisco Security Advisory: Cisco IOS and IOS XE Software Smart Install Memory Leak Vulnerability

Advisory ID: cisco-sa-20160928-smi

Revision: 1.0

For Public Release: 2016 September 28 16:00 GMT

+------------------------------------------------------------------------------

Summary
=======

The Smart Install client feature in Cisco IOS and IOS XE Software contains a vulnerability that could allow an
unauthenticated, remote attacker to cause...
Categories:

Cisco Security Advisory: Cisco IOS and IOS XE Software Multicast Routing Denial of Service Vulnerabilities

September 28, 2016 - 12:22pm

Posted by Cisco Systems Product Security Incident Response Team on Sep 28

Cisco Security Advisory: Cisco IOS and IOS XE Software Multicast Routing Denial of Service Vulnerabilities

Advisory ID: cisco-sa-20160928-msdp

Revision: 1.0

For Public Release: 2016 September 28 16:00 GMT

+------------------------------------------------------------------------------

Summary
=======

Multiple vulnerabilities in the multicast subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated,
remote attacker to...
Categories:

Cisco Security Advisory: Cisco IOS and IOS XE Software Internet Key Exchange Version 1 Fragmentation Denial of Service Vulnerability

September 28, 2016 - 12:11pm

Posted by Cisco Systems Product Security Incident Response Team on Sep 28

Cisco Security Advisory: Cisco IOS and IOS XE Software Internet Key Exchange Version 1 Fragmentation Denial of Service
Vulnerability

Advisory ID: cisco-sa-20160928-ios-ikev1

Revision: 1.0

For Public Release: 2016 September 28 16:00 GMT

+------------------------------------------------------------------------------

Summary
=======
A vulnerability in the Internet Key Exchange version 1 (IKEv1) fragmentation code of Cisco IOS and IOS XE...
Categories:

Cisco Security Advisory: Cisco IOS XE Software NAT Denial of Service Vulnerability

September 28, 2016 - 11:59am

Posted by Cisco Systems Product Security Incident Response Team on Sep 28

Cisco Security Advisory: Cisco IOS XE Software NAT Denial of Service Vulnerability

Advisory ID: cisco-sa-20160928-esp-nat

Revision: 1.0

For Public Release: 2016 September 28 16:00 GMT

+------------------------------------------------------------------------------

Summary
=======

A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS XE Software could
allow an unauthenticated, remote attacker...
Categories:

Cisco Security Advisory: Cisco IOS Software Common Industrial Protocol Request Denial of Service Vulnerability

September 28, 2016 - 11:50am

Posted by Cisco Systems Product Security Incident Response Team on Sep 28

Cisco Security Advisory: Cisco IOS Software Common Industrial Protocol Request Denial of Service Vulnerability

Advisory ID: cisco-sa-20160928-cip

Revison: 1.0

For Public Release: 2016 September 28 16:00 GMT

+------------------------------------------------------------------------------

Summary
=======

A vulnerability in the Common Industrial Protocol (CIP) feature of Cisco IOS Software could allow an unauthenticated,
remote attacker to...
Categories:

Cisco Security Advisory: Cisco IOS and IOS XE Software AAA Login Denial of Service Vulnerability

September 28, 2016 - 11:39am

Posted by Cisco Systems Product Security Incident Response Team on Sep 28

Cisco Security Advisory: Cisco IOS and IOS XE Software AAA Login Denial of Service Vulnerability

Advisory ID: cisco-sa-20160928-aaados

Revision: 1.0

For Public Release: 2016 September 28 16:00 GMT

+------------------------------------------------------------------------------

Summary
=======

A vulnerability in the Authentication, Authorization, and Accounting (AAA) service for remote Secure Shell Host (SSH)
connections to the device for...
Categories:

[REVIVE-SA-2016-002] Revive Adserver - Multiple vulnerabilities

September 28, 2016 - 11:00am

Posted by Matteo Beccati on Sep 28

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2016-002
========================================================================
http://www.revive-adserver.com/security/revive-sa-2016-002
========================================================================
CVE-IDs: TBA
Date: 2016-09-28
Risk Level: Medium...
Categories:

Multiple vulnerabilities found in the Dlink DWR-932B (backdoor, backdoor accounts, weak WPS, RCE ...)

September 28, 2016 - 3:40am

Posted by Pierre Kim on Sep 28

## Advisory Information

Title: Multiple vulnerabilities found in the Dlink DWR-932B (backdoor,
backdoor accounts, weak WPS, RCE ...)
Advisory URL: https://pierrekim.github.io/advisories/2016-dlink-0x00.txt
Blog URL: https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html
Date published: 2016-09-28
Vendors contacted: Dlink
Release mode: Released
CVE: no current CVE
DWF: no current DWF

## Product Description...
Categories:

Cisco Security Advisory: Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016

September 28, 2016 - 3:32am

Posted by Cisco Systems Product Security Incident Response Team on Sep 28

Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016

Advisory ID: cisco-sa-20160927-openssl

Revision: 1.0

For Public Release 2016 September 27 22:40 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

On September 22, 2016, the OpenSSL Software Foundation released an advisory that describes 14 vulnerabilities. Of these
14 vulnerabilities, the OpenSSL Software Foundation...
Categories:

[slackware-security] bind (SSA:2016-271-01)

September 28, 2016 - 3:22am

Posted by Slackware Security Team on Sep 28

[slackware-security] bind (SSA:2016-271-01)

New bind packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
14.2, and -current to fix a security issue.

Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/bind-9.10.4_P3-i586-1_slack14.2.txz: Upgraded.
This update fixes a denial-of-service vulnerability. Testing by ISC has
uncovered a critical error condition which can occur...
Categories:

[SECURITY] [DSA 3680-1] bind9 security update

September 27, 2016 - 2:03pm

Posted by Florian Weimer on Sep 27

-------------------------------------------------------------------------
Debian Security Advisory DSA-3680-1 security () debian org
https://www.debian.org/security/ Florian Weimer
September 27, 2016 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : bind9
CVE ID : CVE-2016-2775 CVE-2016-2776
Debian...
Categories:

ESA-2016-127: EMC ViPR SRM Stored Cross-Site Scripting Vulnerability

September 27, 2016 - 12:52pm

Posted by EMC Product Security Response Center on Sep 27

EMC Identifier: ESA-2016-127
CVE Identifier: CVE-2016-6647
Severity Rating: CVSS v3 Base Score: 7.6 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N)

Affected products:
EMC ViPR SRM versions prior to 4.0.1

Summary:
EMC ViPR SRM 4.0.1 contains a fix for a stored cross-site scripting vulnerability that could potentially be exploited
by malicious users to compromise the affected system.

Details:
EMC ViPR SRM is affected by a stored cross-site...
Categories:

[SECURITY] [DSA 3679-1] jackrabbit security update

September 27, 2016 - 6:13am

Posted by Florian Weimer on Sep 27

-------------------------------------------------------------------------
Debian Security Advisory DSA-3679-1 security () debian org
https://www.debian.org/security/ Florian Weimer
September 27, 2016 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : jackrabbit
CVE ID : CVE-2016-6801
Debian Bug :...
Categories:

[security bulletin] HPSBHF03652 rev.1 - HPE iMC PLAT Network Products running Apache Commons FileUpload, Remote Denial of Service (DoS)

September 27, 2016 - 1:03am

Posted by security-alert on Sep 26

Note: the current version of the following document is available here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05289840

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c05289840
Version: 1

HPSBHF03652 rev.1 - HPE iMC PLAT Network Products running Apache Commons
FileUpload, Remote Denial of Service (DoS)

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date:...
Categories:

[security bulletin] HPSBHF03654 rev.1 - HPE iMC PLAT Network Products using SSL/TLS, Multiple Remote Vulnerabilities

September 27, 2016 - 12:54am

Posted by security-alert on Sep 26

Note: the current version of the following document is available here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05289935

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c05289935
Version: 1

HPSBHF03654 rev.1 - HPE iMC PLAT Network Products using SSL/TLS, Multiple
Remote Vulnerabilities

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2016-09-26
Last...
Categories: