Software Updates

TrustKeeper Scan Engine Update April 27 2015

Written by | Apr 28, 2015 7:51:00 AM

The latest update to the TrustKeeper scan engine that powers our Trustwave Vulnerability Management product (including both internal and external vulnerability scanning) is now available.

With the release of the Avengers: Age of Ultron movie in theaters this week, we've been thinking about what our super-power might be. You could say it's vulnerability checks. For example, with this update we add a whopping 149 new vulnerability checks--the vast majority coming from the recent addition of VMWare ESX/ESXi support. In addition, we've also added checks for common staples such as Apache, Cisco, ISC Bind and PHP.

New Vulnerability Test Highlights

Some of the more interesting vulnerability tests we added recently are as follows:

Apache

  • Apache Tomcat Information Disclosure in Authentication Headers Vulnerability (CVE-2010-1157)

Cisco

  • Cisco ASA HTTP/FTP/SCP Sensitive Information Disclosure via syslog (CSCuq22357 and CSCur41860) (CVE-2014-3410)
  • Cisco ASA SSL VPN Memory Blocks Exhaustion Vulnerability (CSCuq68888) (CVE-2014-3407)

ISC

  • ISC BIND Defect in Delegation Handling Denial of Service (CVE-2014-8500)

PHP

  • PHP enchant_broker_request_dict Heap Buffer Overflow Vulnerability (CVE-2014-9705)
  • PHP Fileinfo Component Denial of Service Vulnerability (CVE-2014-9652)
  • PHP GD Extension Denial of Service Vulnerability (CVE-2014-9709)
  • PHP move_uploaded_file NULL Character in Path Access Restriction Bypass (CVE-2015-2348)
  • PHP Multiple unserialize Use After Free Vulnerabilities (CVE-2015-0273)
  • PHP phar_rename_archive Use After Free Vulnerability (CVE-2015-2301)
  • PHP unserialize Use After Free Vulnerability (CVE-2015-2787)
  • PHP Use-after-free vulnerability in the _zend_shared_memdup function (CVE-2015-1351)
  • PHP WSLD Injection Vulnerabilities via default soap.wsdl_cache_dir setting (CVE-2013-6501)
  • PHP Denial of Service in readelf.c (CVE-2014-9653)

Samba

  • Samba Elevation of privilege to Active Directory Domain Controller (CVE-2014-8143)

VMWare

How to Update?

All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.
View full post