The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of HP-UX

vulnerability note CVE-2016-2775

ISC BIND: infinite loop via lwresd

Synthesis of the vulnerability

An attacker can generate an infinite loop via lwresd of ISC BIND, in order to trigger a denial of service.
Impacted products: Debian, Fedora, HP-UX, AIX, BIND, openSUSE Leap, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, VxWorks.
Severity: 2/4.
Consequences: denial of service on service.
Provenance: internet client.
Creation date: 19/07/2016.
Identifiers: AA-01393, bulletinjul2016, c05321107, CVE-2016-2775, DLA-645-1, FEDORA-2016-007efacd1c, FEDORA-2016-2941b3264e, FEDORA-2016-3fba74e7f5, FEDORA-2016-53f0c65f40, openSUSE-SU-2017:1063-1, RHSA-2017:2533-01, SSA:2016-204-01, SUSE-SU-2017:0998-1, SUSE-SU-2017:0999-1, SUSE-SU-2017:1027-1, VIGILANCE-VUL-20144.

Description of the vulnerability

The ISC BIND product implements the "lightweight resolver protocol" in the lwresd daemon, or in named when named.conf contains the "lwres" section.

However, if getrrsetbyname() is called to resolve a long relative name (combined with a search list entry), an infinite recursion occurs in lwresd/lwres.

An attacker can therefore generate an infinite loop via lwresd of ISC BIND, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2016-1000104 CVE-2016-1000105 CVE-2016-1000107

Web servers: creating client queries via the Proxy header

Synthesis of the vulnerability

An attacker can send a query with a malicious Proxy header to a web service hosting a CGI script creating web client queries, so they go through attacker's proxy.
Impacted products: Apache httpd, Tomcat, Mac OS X, Debian, Drupal Core, eZ Publish, Fedora, HP-UX, QRadar SIEM, Junos Space, NSM Central Manager, NSMXpress, lighttpd, IIS, nginx, openSUSE, openSUSE Leap, Oracle Communications, Solaris, Perl Module ~ not comprehensive, PHP, Python, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, TrendMicro ServerProtect, TYPO3 Core, Ubuntu, Varnish.
Severity: 3/4.
Consequences: data reading, denial of service on service.
Provenance: internet client.
Number of vulnerabilities in this bulletin: 12.
Creation date: 18/07/2016.
Identifiers: 1117414, 1994719, 1994725, 1999671, APPLE-SA-2017-09-25-1, bulletinjul2017, bulletinoct2016, c05324759, CERTFR-2016-AVI-240, CERTFR-2017-AVI-012, CERTFR-2017-AVI-022, cpujan2018, CVE-2016-1000104, CVE-2016-1000105, CVE-2016-1000107, CVE-2016-1000108, CVE-2016-1000109, CVE-2016-1000110, CVE-2016-1000111, CVE-2016-1000212, CVE-2016-5385, CVE-2016-5386, CVE-2016-5387, CVE-2016-5388, DLA-553-1, DLA-568-1, DLA-583-1, DLA-749-1, DRUPAL-SA-CORE-2016-003, DSA-3623-1, DSA-3631-1, DSA-3642-1, EZSA-2016-001, FEDORA-2016-07e9059072, FEDORA-2016-2c324d0670, FEDORA-2016-340e361b90, FEDORA-2016-4094bd4ad6, FEDORA-2016-4e7db3d437, FEDORA-2016-604616dc33, FEDORA-2016-683d0b257b, FEDORA-2016-970edb82d4, FEDORA-2016-9c8cf5912c, FEDORA-2016-9de7253cc7, FEDORA-2016-9fd814a7f2, FEDORA-2016-9fd9bfab9e, FEDORA-2016-a29c65b00f, FEDORA-2016-aef8a45afe, FEDORA-2016-c1b01b9278, FEDORA-2016-df0726ae26, FEDORA-2016-e2c8f5f95a, FEDORA-2016-ea5e284d34, HPSBUX03665, HT207615, HT208144, HT208221, httpoxy, JSA10770, JSA10774, openSUSE-SU-2016:1824-1, openSUSE-SU-2016:2054-1, openSUSE-SU-2016:2055-1, openSUSE-SU-2016:2115-1, openSUSE-SU-2016:2120-1, openSUSE-SU-2016:2252-1, openSUSE-SU-2016:2536-1, openSUSE-SU-2016:3092-1, openSUSE-SU-2016:3157-1, openSUSE-SU-2017:0223-1, RHSA-2016:1420-01, RHSA-2016:1421-01, RHSA-2016:1422-01, RHSA-2016:1538-01, RHSA-2016:1609-01, RHSA-2016:1610-01, RHSA-2016:1611-01, RHSA-2016:1612-01, RHSA-2016:1613-01, RHSA-2016:1624-01, RHSA-2016:1626-01, RHSA-2016:1627-01, RHSA-2016:1628-01, RHSA-2016:1629-01, RHSA-2016:1630-01, RHSA-2016:1635-01, RHSA-2016:1636-01, RHSA-2016:1648-01, RHSA-2016:1649-01, RHSA-2016:1650-01, RHSA-2016:1978-01, RHSA-2016:2045-01, RHSA-2016:2046-01, SSA:2016-203-02, SSA:2016-358-01, SSA:2016-363-01, SUSE-SU-2017:1632-1, SUSE-SU-2017:1660-1, SUSE-SU-2019:0223-1, USN-3038-1, USN-3045-1, USN-3134-1, USN-3177-1, USN-3177-2, USN-3585-1, VIGILANCE-VUL-20143, VU#797896.

Description of the vulnerability

Most web servers support CGI scripts (PHP, Python, etc.).

According to the RFC 3875, when a web server receives a Proxy header, it has to create the HTTP_PROXY environment variable for CGI scripts.

However, this variable is also used to store the name of the proxy that web clients has to use. The PHP (via Guzzle, Artax, etc.) and Python scripts will thus use the proxy indicated in the web query for all client queries they will send during the CGI session.

An attacker can therefore send a query with a malicious Proxy header to a web service hosting a CGI script creating web client queries, so they go through attacker's proxy.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2016-3092

Apache Tomcat: denial of service via FileUpload

Synthesis of the vulnerability

An attacker can send files of a specially chosen size to Apache Tomcat, in order to overload the server.
Impacted products: Tomcat, Debian, Fedora, HP-UX, Domino, QRadar SIEM, Tivoli Storage Manager, Tivoli System Automation, Tivoli Workload Scheduler, WebSphere AS Traditional, IBM WebSphere ESB, WebSphere MQ, MariaDB ~ precise, MySQL Community, MySQL Enterprise, openSUSE Leap, Oracle Communications, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Server, Oracle OIT, Solaris, Tuxedo, Oracle Virtual Directory, WebLogic, Oracle Web Tier, Percona Server, Puppet, RHEL, JBoss EAP by Red Hat, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: denial of service on server, denial of service on service.
Provenance: internet client.
Creation date: 22/06/2016.
Identifiers: 1987864, 1989628, 1990172, 1991866, 1991867, 1991870, 1991871, 1991875, 1991876, 1991878, 1991880, 1991882, 1991884, 1991885, 1991886, 1991887, 1991889, 1991892, 1991894, 1991896, 1991902, 1991903, 1991951, 1991955, 1991959, 1991960, 1991961, 1992835, 1995388, 1995793, 2000095, 2000544, 2001563, 2012109, 2015814, 7014463, bulletinjul2016, c05324759, cpuapr2017, cpuapr2018, cpujul2017, cpujul2018, cpuoct2017, CVE-2016-3092, DLA-528-1, DLA-529-1, DSA-3609-1, DSA-3611-1, DSA-3614-1, FEDORA-2016-0a4dccdd23, FEDORA-2016-2b0c16fd82, HPSBUX03665, openSUSE-SU-2016:2252-1, RHSA-2016:2068-01, RHSA-2016:2069-01, RHSA-2016:2070-01, RHSA-2016:2071-01, RHSA-2016:2072-01, RHSA-2016:2599-02, RHSA-2016:2807-01, RHSA-2016:2808-01, RHSA-2017:0455-01, RHSA-2017:0456-01, RHSA-2017:0457-01, SUSE-SU-2017:1660-1, USN-3024-1, USN-3027-1, VIGILANCE-VUL-19953.

Description of the vulnerability

The Apache Tomcat product uses a slightly fork of the Apache Commons FileUpload library.

This library is used to receive files from an HTTP client to the server. However, when the file size is such that the size of the MIME envelope (file content + MIME headers) is equal to the size of the file reading buffer, the transfer requires an extremely long duration.

An attacker can therefore send files of a specially chosen size to Apache Tomcat, in order to overload the server.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2016-2016

HP-UX: read-write access via VxFS

Synthesis of the vulnerability

A local attacker can bypass access restrictions of VxFS of HP-UX, in order to read or alter files.
Impacted products: HP-UX.
Severity: 2/4.
Consequences: data reading, data creation/edition, data deletion.
Provenance: user shell.
Creation date: 10/05/2016.
Identifiers: c05121749, CVE-2016-2016, HPSBUX03577, SSRT102172, VIGILANCE-VUL-19567.

Description of the vulnerability

The HP-UX product uses the VxFS (JFS) filesystem.

However, ACLs are not correctly applied when they are inherited.

A local attacker can therefore bypass access restrictions of VxFS of HP-UX, in order to read or alter files.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2015-5370 CVE-2016-0128 CVE-2016-2110

Windows, Samba: code execution via Badlock

Synthesis of the vulnerability

An attacker can use the Badlock vulnerability of Windows or Samba, in order to run code.
Impacted products: ProxySG par Blue Coat, SGOS by Blue Coat, Debian, BIG-IP Hardware, TMOS, Fedora, HP-UX, DB2 UDB, QRadar SIEM, Windows 10, Windows 2008 R0, Windows 2008 R2, Windows 2012, Windows 7, Windows 8, Windows RT, Windows Vista, Data ONTAP, openSUSE, openSUSE Leap, Solaris, Pulse Connect Secure, RHEL, Samba, Slackware, SUSE Linux Enterprise Desktop, SLES, Synology DS***, Synology RS***, Ubuntu.
Severity: 3/4.
Consequences: administrator access/rights, privileged access/rights, user access/rights.
Provenance: intranet client.
Number of vulnerabilities in this bulletin: 9.
Creation date: 23/03/2016.
Revision date: 12/04/2016.
Identifiers: 1986595, 1987766, 3148527, 9010080, bulletinjan2016, bulletinoct2016, c05162399, CVE-2015-5370, CVE-2016-0128, CVE-2016-2110, CVE-2016-2111, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, CVE-2016-2115, CVE-2016-2118, DLA-509-1, DSA-3548-1, DSA-3548-2, DSA-3548-3, FEDORA-2016-48b3761baa, FEDORA-2016-be53260726, HPSBUX03616, MS16-047, NTAP-20160412-0001, openSUSE-SU-2016:1025-1, openSUSE-SU-2016:1064-1, openSUSE-SU-2016:1106-1, openSUSE-SU-2016:1107-1, openSUSE-SU-2016:1108-1, openSUSE-SU-2016:1440-1, RHSA-2016:0611-01, RHSA-2016:0612-01, RHSA-2016:0613-01, RHSA-2016:0618-01, RHSA-2016:0619-01, RHSA-2016:0620-01, RHSA-2016:0621-01, RHSA-2016:0623-01, RHSA-2016:0624-01, RHSA-2016:0625-01, SA122, SA40196, SOL37603172, SOL53313971, SSA:2016-106-02, SSRT110128, SUSE-SU-2016:1022-1, SUSE-SU-2016:1023-1, SUSE-SU-2016:1024-1, SUSE-SU-2016:1028-1, SUSE-SU-2016:1105-1, USN-2950-1, USN-2950-2, USN-2950-3, USN-2950-4, USN-2950-5, VIGILANCE-VUL-19207, VU#813296.

Description of the vulnerability

The Windows and Samba products implement authentication for CIFS.

However, several vulnerabilities in these implementations can be used by a Man-in-the-Middle, or to weaken the protocol.

An attacker can therefore use the Badlock vulnerability of Windows or Samba, in order to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2016-1285 CVE-2016-1286 CVE-2016-2088

ISC BIND: three vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of ISC BIND.
Impacted products: Debian, BIG-IP Hardware, TMOS, Fedora, FreeBSD, HP-UX, AIX, BIND, McAfee Email Gateway, openSUSE, openSUSE Leap, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Consequences: denial of service on service.
Provenance: internet server.
Number of vulnerabilities in this bulletin: 3.
Creation date: 10/03/2016.
Identifiers: bulletinjan2016, c05087821, CVE-2016-1285, CVE-2016-1286, CVE-2016-2088, DSA-3511-1, FEDORA-2016-161b73fc2c, FEDORA-2016-364c0a9df4, FEDORA-2016-5047abe4a9, FEDORA-2016-b593e84223, FreeBSD-SA-16:13.bind, HPSBUX03583, openSUSE-SU-2016:0827-1, openSUSE-SU-2016:0830-1, openSUSE-SU-2016:0834-1, openSUSE-SU-2016:0859-1, RHSA-2016:0458-01, RHSA-2016:0459-01, RHSA-2016:0562-01, RHSA-2016:0601-01, SB10214, SOL62012529, SSA:2016-069-01, SSRT110084, SUSE-SU-2016:0759-1, SUSE-SU-2016:0780-1, SUSE-SU-2016:0825-1, USN-2925-1, VIGILANCE-VUL-19144.

Description of the vulnerability

Several vulnerabilities were announced in ISC BIND.

An attacker can force an assertion error via rndc, in order to trigger a denial of service. [severity:2/4; CVE-2016-1285]

An attacker can force an assertion error via DNAME, in order to trigger a denial of service. [severity:3/4; CVE-2016-1286]

An attacker can force an assertion error via DNS Cookies, in order to trigger a denial of service. [severity:3/4; CVE-2016-2088]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability bulletin CVE-2015-7560 CVE-2016-0771

Samba: two vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Samba.
Impacted products: Debian, Fedora, HP-UX, DB2 UDB, openSUSE, openSUSE Leap, RHEL, Samba, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: data reading, data creation/edition, denial of service on service.
Provenance: user account.
Number of vulnerabilities in this bulletin: 2.
Creation date: 08/03/2016.
Identifiers: 1986595, c05121842, CERTFR-2016-AVI-084, CVE-2015-7560, CVE-2016-0771, DSA-3514-1, FEDORA-2016-cad77a4576, FEDORA-2016-ed1587f6ba, HPSBUX03596, openSUSE-SU-2016:0813-1, openSUSE-SU-2016:0877-1, openSUSE-SU-2016:1064-1, openSUSE-SU-2016:1106-1, openSUSE-SU-2016:1107-1, openSUSE-SU-2016:1108-1, openSUSE-SU-2016:1440-1, RHSA-2016:0448-01, RHSA-2016:0449-01, SSA:2016-068-02, SUSE-SU-2016:0814-1, SUSE-SU-2016:0816-1, SUSE-SU-2016:0837-1, SUSE-SU-2016:0905-1, USN-2922-1, VIGILANCE-VUL-19118.

Description of the vulnerability

Several vulnerabilities were announced in Samba.

An attacker can create a symbolic link, in order to alter ACLs. [severity:2/4; CVE-2015-7560]

An attacker can force a read at an invalid address with a DNS TXT record sent to the internal DNS server in AC DC mode, in order to trigger a denial of service. [severity:2/4; CVE-2016-0771]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2016-0763

Apache Tomcat: read-write access via setGlobalContext

Synthesis of the vulnerability

An attacker, who is allowed to upload a malicious web application on the service, can bypass access restrictions via setGlobalContext of Apache Tomcat, in order to read or alter data.
Impacted products: Tomcat, Debian, Fedora, SiteScope, HP-UX, Snap Creator Framework, openSUSE Leap, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Server, Oracle OIT, Oracle Virtual Directory, WebLogic, Oracle Web Tier, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: data reading, data creation/edition, data deletion.
Provenance: document.
Creation date: 22/02/2016.
Identifiers: 1980693, c05150442, c05324755, cpuapr2017, cpuoct2017, CVE-2016-0763, DSA-3530-1, DSA-3552-1, DSA-3609-1, FEDORA-2016-e6651efbaf, HPSBGN03669, HPSBUX03606, NTAP-20180531-0001, openSUSE-SU-2016:0865-1, RHSA-2016:1087-01, RHSA-2016:1088-01, RHSA-2016:1089-01, RHSA-2016:2599-02, RHSA-2016:2807-01, RHSA-2016:2808-01, SUSE-SU-2016:0769-1, SUSE-SU-2016:0822-1, USN-3024-1, VIGILANCE-VUL-18999.

Description of the vulnerability

The Apache Tomcat product can execute a web application from an untrusted source with a Security Manager.

However, a malicious application can use ResourceLinkFactory.setGlobalContext() to inject a context in another application, and access to its data.

An attacker, who is allowed to upload a malicious web application on the service, can therefore bypass access restrictions via setGlobalContext of Apache Tomcat, in order to read or alter data.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability bulletin CVE-2016-0714

Apache Tomcat: code execution via PersistentManager

Synthesis of the vulnerability

An attacker, who is allowed to upload a malicious web application on the service, can use the PersistentManager of Apache Tomcat, in order to run code.
Impacted products: Tomcat, Debian, BIG-IP Hardware, TMOS, HP-UX, QRadar SIEM, Snap Creator Framework, openSUSE Leap, Oracle Communications, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Server, Oracle OIT, Oracle Virtual Directory, WebLogic, Oracle Web Tier, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: privileged access/rights, user access/rights.
Provenance: document.
Creation date: 22/02/2016.
Identifiers: 1980693, 1983989, c05054964, c05150442, cpuapr2017, cpujul2018, cpuoct2017, CVE-2016-0714, DSA-3530-1, DSA-3552-1, DSA-3609-1, HPSBUX03561, HPSBUX03606, K30971148, NTAP-20180531-0001, openSUSE-SU-2016:0865-1, RHSA-2016:1087-01, RHSA-2016:1088-01, RHSA-2016:1089-01, RHSA-2016:2045-01, RHSA-2016:2599-02, RHSA-2016:2807-01, RHSA-2016:2808-01, SOL30971148, SUSE-SU-2016:0769-1, SUSE-SU-2016:0822-1, SUSE-SU-2016:0839-1, USN-3024-1, VIGILANCE-VUL-18998.

Description of the vulnerability

The Apache Tomcat product can execute a web application from an untrusted source with a Security Manager.

However, a malicious application can use PersistentManager to store an object in a session, and thus execute code.

An attacker, who is allowed to upload a malicious web application on the service, can therefore use the PersistentManager of Apache Tomcat, in order to run code.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2016-0706

Apache Tomcat: information disclosure via StatusManagerServlet

Synthesis of the vulnerability

An attacker, who is allowed to upload a malicious web application on the service, can use a vulnerability in StatusManagerServlet of Apache Tomcat, in order to obtain sensitive information.
Impacted products: Tomcat, Debian, BIG-IP Hardware, TMOS, HP-UX, QRadar SIEM, Snap Creator Framework, openSUSE Leap, Oracle Communications, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Server, Oracle OIT, Oracle Virtual Directory, WebLogic, Oracle Web Tier, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: data reading.
Provenance: document.
Creation date: 22/02/2016.
Identifiers: 1980693, 1983989, c05054964, c05150442, cpuapr2017, cpujul2018, cpuoct2017, CVE-2016-0706, DSA-3530-1, DSA-3552-1, DSA-3609-1, HPSBUX03561, HPSBUX03606, K30971148, NTAP-20180531-0001, openSUSE-SU-2016:0865-1, RHSA-2016:1087-01, RHSA-2016:1088-01, RHSA-2016:1089-01, RHSA-2016:2045-01, RHSA-2016:2599-02, RHSA-2016:2807-01, RHSA-2016:2808-01, SOL30971148, SUSE-SU-2016:0769-1, SUSE-SU-2016:0822-1, SUSE-SU-2016:0839-1, USN-3024-1, VIGILANCE-VUL-18997.

Description of the vulnerability

The Apache Tomcat product can execute a web application from an untrusted source with a Security Manager.

However, a malicious application can use StatusManagerServlet to obtain the content of HTTP queries being processed.

An attacker, who is allowed to upload a malicious web application on the service, can therefore use a vulnerability in StatusManagerServlet of Apache Tomcat, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about HP-UX: