Summary
The latest update to the TrustKeeper scan engine that powers our Trustwave Vulnerability Management product (including both internal and external vulnerability scanning) is now available. Enjoy!
New Vulnerability Test Highlights
Some of the more interesting vulnerability tests we added recently are as follows:
Apache Tomcat
- Apache Subversion authentication bypass via realm string in Cyrus SASL (CVE-2016-2167)
- Apache Tomcat directory traversal vulnerability allows bypassing SecurityManager restrictions (CVE-2015-5174)
- Apache Tomcat remote code execution by SecurityManager restrictions bypass via a crafted web application (CVE-2016-0714)
- Apache Tomcat security bypass, arbitrary data read or write and Denial of Service because of a bug in code that handles global context (CVE-2016-0763)
- Apache Tomcat vulnerability allows bypassing SecurityManager restrictions via crafted web application (CVE-2016-0706)
Apache Subversion
- Apache Subversion authentication bypass via realm string in Cyrus SASL (CVE-2016-2167)
Cisco ASA
- Buffer overflow vulnerability in the IKE Daemon for Cisco ASA (CVE-2009-4919)
- Bypass on the firewall restrictions via IPv6 packets in Cisco ASA (CVE-2009-4913)
- Cross-site scripting vulnerability in the WebVPN portal on Cisco ASA (CVE-2009-4910)
- Denial of service by a memory leak in Clientless SSL VPN for Cisco ASA (CVE-2008-2734)
- Denial of service in DTLS with TLS fragment handling for Cisco ASA (CVE-2009-4923)
- Denial of service through an IPSec Client Authentication Processing Vulnerability in Cisco ASA (CVE-2008-2733)
- Denial of service through an URI Processing Error Vulnerability in SSL VPNs for Cisco ASA (CVE-2008-2735)
- Denial of service through malformed NAT-T packets in IKE for Cisco ASA (CVE-2009-4918)
- Denial of service through malformed TCP packets in Cisco ASA (CVE-2009-4921)
- Denial of service through multiple vulnerabilities of SIP inspection in Cisco ASA (CVE-2008-2732)
- Denial of service under heavy SIP traffic in Cisco ASA (CVE-2009-4917)
- Denial of Service Vulnerability on Cisco ASA (CVE-2009-4911)
- Denial of service when many remote peers try to establish ipsec L2L tunnels in Cisco ASA (CVE-2009-4922)
- HTTP Response Splitting Vulnerability in WebVPN on Cisco ASA (CVE-2008-7257)
- Information Disclosure vulnerability in Clientless VPN for Cisco ASA (CVE-2008-2736)
- Memory leaks while parsing subject alternate name from a certificate in Cisco ASA (CVE-2009-4914)
- SSL Handshake is allowed to Non-Authorized HTTPS Clients in Cisco ASA (CVE-2009-4912)
PostgreSQL
- Blank password detection for PostgreSQL
Juniper ScreenOS
- Juniper ScreenOS Denial of Service in the administrative web services interface via crafted SSL packet (CVE-2016-1268)
- Juniper ScreenOS Denial of Service or remote code execution via crafted SSH negotiation (CVE-2015-7754)
Nginx
- Nginx vulnerable to Denial of Service attack via a crafted request which results in attempt to write to temporary file (CVE-2016-4450)
OpenSSL
- OpenSSL Denial of Service in ServerKeyExchange (CVE-2015-1794)
- OpenSSL Denial of Service via lack of PSS parameter (CVE-2015-3194)
- OpenSSL Double free vulnerability in the dsa_priv_decode function (CVE-2016-0705)
- OpenSSL Memory leak in the SRP_VBASE_get_by_user implementation allows remote attackers to obtain sensitive information (CVE-2016-0798)
- OpenSSL memory leak in the X509_ATTRIBUTE (CVE-2015-3195)
- OpenSSL NULL pointer dereference (CVE-2016-0797)
- OpenSSL RSA Private Keys can be easily obtained via attack against DH or DHE ciphersuites (CVE-2015-3193)
- OpenSSL Side channel attack on modular exponentiation which could lead to the recovery of RSA keys (CVE-2016-0702)
- OpenSSL small subgroup attack on DH/DHE due to unsafe primes, introduced by X9.42 style parameter files, as those required for RFC 5114 (CVE-2016-0701)
- OpenSSL The fmtstr function improperly calculates string lengths (CVE-2016-0799)
Oracle MySQL
- Oracle MySQL October 2015 CPU Multiple Vulnerabilities (CVE-2015-3144, CVE-2015-4819, CVE-2015-1793, CVE-2015-0286, CVE-2015-4879, CVE-2015-4815, CVE-2015-4905, CVE-2015-4905, CVE-2015-4858, CVE-2015-4862, CVE-2015-4866, CVE-2015-4816, CVE-2015-4800, CVE-2015-4870, CVE-2015-4802, CVE-2015-4833, CVE-2015-4830, CVE-2015-4730, CVE-2015-4826, CVE-2015-4904, CVE-2015-4913, CVE-2015-4895, CVE-2015-4861, CVE-2015-4807, CVE-2015-4890, CVE-2015-4791, CVE-2015-4864, CVE-2015-4836, CVE-2015-4910, CVE-2015-4766, CVE-2015-4792)
WordPress
- WordPress cross-site scripting vulnerability in plupload.flash.swf via Same-Origin Method Execution (CVE-2016-4566)
- WordPress cross-site scripting vulnerability in wp-db.php by long comments improperly stored in database (CVE-2015-8834)
How to Update?
All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.