The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of SunOS

computer vulnerability CVE-2015-0261 CVE-2015-2153 CVE-2015-2154

tcpdump: four vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of tcpdump.
Impacted products: Debian, Fedora, openSUSE, openSUSE Leap, Solaris, RHEL, tcpdump, Ubuntu, Unix (platform) ~ not comprehensive.
Severity: 2/4.
Consequences: user access/rights, denial of service on service.
Provenance: intranet client.
Number of vulnerabilities in this bulletin: 4.
Creation date: 10/03/2015.
Identifiers: bulletinjul2015, CVE-2015-0261, CVE-2015-2153, CVE-2015-2154, CVE-2015-2155, DSA-3193-1, FEDORA-2015-4939, FEDORA-2015-4953, MDVSA-2015:125, MDVSA-2015:182, openSUSE-SU-2015:0616-1, openSUSE-SU-2017:1199-1, RHSA-2017:1871-01, USN-2580-1, VIGILANCE-VUL-16355.

Description of the vulnerability

Several vulnerabilities were announced in tcpdump.

An attacker can send a malicious IPv6 Mobility packet, in order to trigger a denial of service. [severity:2/4; CVE-2015-0261]

An attacker can send a malicious TCP packet, in order to trigger a denial of service. [severity:2/4; CVE-2015-2153]

An attacker can send a malicious Ethernet packet, in order to trigger a denial of service. [severity:1/4; CVE-2015-2154]

An attacker can send a malicious ForCES (Forwarding and Control Element Separation) packet, in order to trigger a denial of service. [severity:2/4; CVE-2015-2155]
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2015-0288

OpenSSL: NULL pointer dereference via X509_to_X509_REQ

Synthesis of the vulnerability

An attacker can force a NULL pointer to be dereferenced in X509_to_X509_REQ() of OpenSSL, in order to trigger a denial of service.
Impacted products: Arkoon FAST360, ProxySG par Blue Coat, SGOS by Blue Coat, FabricOS, Brocade Network Advisor, Cisco ASR, AnyConnect VPN Client, Cisco ACE, ASA, AsyncOS, Cisco CSS, Cisco ESA, IOS XE Cisco, Cisco IPS, IronPort Email, IronPort Web, Nexus by Cisco, NX-OS, Prime Infrastructure, Cisco PRSM, Cisco Router, Secure ACS, Cisco CUCM, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, WebNS, Cisco WSA, Debian, BIG-IP Hardware, TMOS, Fedora, FreeBSD, hMailServer, HP-UX, AIX, IRAD, Tivoli Workload Scheduler, Juniper J-Series, Junos OS, Junos Space, Junos Space Network Management Platform, NSM Central Manager, NSMXpress, Juniper SBR, McAfee Email Gateway, ePO, McAfee NTBA, McAfee NGFW, VirusScan, McAfee Web Gateway, Data ONTAP, NetBSD, NetScreen Firewall, ScreenOS, OpenBSD, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Solaris, pfSense, RHEL, Base SAS Software, SAS SAS/CONNECT, Slackware, Splunk Enterprise, Stonesoft NGFW/VPN, SUSE Linux Enterprise Desktop, SLES, Nessus, Ubuntu, Unix (platform) ~ not comprehensive, WinSCP.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: document.
Creation date: 09/03/2015.
Identifiers: 1701334, 1964410, 55767, 9010031, c04679334, CERTFR-2015-AVI-089, CERTFR-2015-AVI-117, CERTFR-2015-AVI-146, CERTFR-2015-AVI-177, CERTFR-2015-AVI-259, CERTFR-2016-AVI-303, cisco-sa-20150320-openssl, cisco-sa-20150408-ntpd, cpuoct2017, CTX216642, CVE-2015-0288, DSA-3197-1, DSA-3197-2, FEDORA-2015-4300, FEDORA-2015-4303, FEDORA-2015-6855, FreeBSD-SA-15:06.openssl, HPSBUX03334, JSA10680, MDVSA-2015:062, MDVSA-2015:063, NetBSD-SA2015-007, NTAP-20150323-0002, openSUSE-SU-2015:0554-1, openSUSE-SU-2015:1277-1, openSUSE-SU-2015:2243-1, openSUSE-SU-2016:0640-1, RHSA-2015:0715-01, RHSA-2015:0716-01, RHSA-2015:0752-01, RHSA-2015:0800-01, SA40001, SB10110, SOL16301, SOL16302, SOL16317, SOL16319, SOL16320, SOL16321, SOL16323, SPL-98351, SPL-98531, SSA:2015-111-09, SSRT102000, SUSE-SU-2015:0541-1, SUSE-SU-2015:0553-1, SUSE-SU-2015:0553-2, SUSE-SU-2015:0578-1, TNS-2015-04, USN-2537-1, VIGILANCE-VUL-16342.

Description of the vulnerability

The OpenSSL product processes X.509 certificates.

However, the X509_to_X509_REQ() function does not check if a pointer is NULL, before using it.

An attacker can therefore force a NULL pointer to be dereferenced in X509_to_X509_REQ() of OpenSSL, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2015-0209

OpenSSL: use after free via d2i_ECPrivateKey

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area in d2i_ECPrivateKey of OpenSSL, in order to trigger a denial of service, and possibly to execute code.
Impacted products: ArubaOS, ProxySG par Blue Coat, SGOS by Blue Coat, FabricOS, Brocade Network Advisor, Cisco ASR, AnyConnect VPN Client, Cisco ACE, ASA, AsyncOS, Cisco CSS, Cisco ESA, IOS XE Cisco, Cisco IPS, IronPort Email, IronPort Web, Nexus by Cisco, NX-OS, Prime Infrastructure, Cisco PRSM, Cisco Router, Secure ACS, Cisco CUCM, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, WebNS, Cisco WSA, Debian, BIG-IP Hardware, TMOS, Fedora, FreeBSD, hMailServer, HP-UX, AIX, IRAD, Security Directory Server, Tivoli Directory Server, Tivoli Workload Scheduler, WebSphere MQ, Juniper J-Series, Junos OS, Junos Pulse, Junos Space, Junos Space Network Management Platform, Juniper Network Connect, NSM Central Manager, NSMXpress, Juniper SBR, Data ONTAP, NetBSD, NetScreen Firewall, ScreenOS, OpenBSD, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Solaris, pfSense, RHEL, Base SAS Software, SAS SAS/CONNECT, Slackware, Splunk Enterprise, SUSE Linux Enterprise Desktop, SLES, Nessus, Ubuntu, Unix (platform) ~ not comprehensive, WinSCP.
Severity: 3/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 09/03/2015.
Identifiers: 1698703, 1701334, 1902519, 1960491, 1964410, 55767, 7043086, 9010031, ARUBA-PSA-2015-007, c04679334, CERTFR-2015-AVI-089, CERTFR-2015-AVI-117, CERTFR-2015-AVI-146, CERTFR-2015-AVI-177, CERTFR-2015-AVI-259, CERTFR-2016-AVI-303, cisco-sa-20150320-openssl, cisco-sa-20150408-ntpd, cpuoct2017, CTX216642, CVE-2015-0209, DSA-3197-1, DSA-3197-2, FEDORA-2015-10047, FEDORA-2015-10108, FEDORA-2015-4300, FEDORA-2015-4303, FEDORA-2015-6855, FreeBSD-SA-15:06.openssl, HPSBUX03334, JSA10680, MDVSA-2015:062, MDVSA-2015:063, NetBSD-SA2015-007, NTAP-20150323-0002, openSUSE-SU-2015:0554-1, openSUSE-SU-2015:1277-1, openSUSE-SU-2016:0640-1, RHSA-2015:0715-01, RHSA-2015:0716-01, RHSA-2015:0752-01, RHSA-2016:1087-01, RHSA-2016:1088-01, RHSA-2016:1089-01, SA40001, SOL16301, SOL16302, SOL16317, SOL16319, SOL16320, SOL16321, SOL16323, SPL-98351, SPL-98531, SSA:2015-111-09, SSRT102000, SUSE-SU-2015:0541-1, SUSE-SU-2015:0553-1, SUSE-SU-2015:0553-2, SUSE-SU-2015:0578-1, TNS-2015-04, TSB16661, USN-2537-1, VIGILANCE-VUL-16341.

Description of the vulnerability

The OpenSSL product implements the Elliptic Curves algorithm.

However, the d2i_ECPrivateKey() function frees a memory area before reusing it.

An attacker can therefore force the usage of a freed memory area in d2i_ECPrivateKey() of OpenSSL, in order to trigger a denial of service, and possibly to execute code.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2015-0138 CVE-2015-0204

OpenSSL, LibReSSL, Mono, JSSE: weakening TLS encryption via FREAK

Synthesis of the vulnerability

An attacker, located as a Man-in-the-Middle, can force the Chrome, JSSE, LibReSSL, Mono or OpenSSL client to accept a weak export algorithm, in order to more easily capture or alter exchanged data.
Impacted products: Arkoon FAST360, ArubaOS, Avaya Ethernet Routing Switch, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, FabricOS, Brocade Network Advisor, Cisco ATA, AnyConnect VPN Client, Cisco ACE, ASA, AsyncOS, Cisco ESA, IOS by Cisco, IronPort Email, IronPort Web, Nexus by Cisco, NX-OS, Cisco Prime Access Registrar, Prime Collaboration Assurance, Cisco Prime DCNM, Prime Infrastructure, Cisco Prime LMS, Prime Network Control Systems, Cisco PRSM, Cisco Router, Cisco IP Phone, Cisco MeetingPlace, Cisco WSA, Clearswift Email Gateway, Debian, Black Diamond, ExtremeXOS, Summit, BIG-IP Hardware, TMOS, Fedora, FortiClient, FortiGate, FortiGate Virtual Appliance, FortiOS, FreeBSD, Chrome, HPE NNMi, HP-UX, AIX, DB2 UDB, Domino, Notes, IRAD, Security Directory Server, Tivoli Directory Server, Tivoli Storage Manager, Tivoli Workload Scheduler, WebSphere AS Traditional, WebSphere MQ, Juniper J-Series, Junos OS, Junos Space, Junos Space Network Management Platform, NSM Central Manager, NSMXpress, Juniper SBR, McAfee Email Gateway, ePO, McAfee NTBA, McAfee NGFW, VirusScan, McAfee Web Gateway, Windows (platform) ~ not comprehensive, Data ONTAP, NetBSD, NetScreen Firewall, ScreenOS, Nodejs Core, OpenBSD, Java OpenJDK, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle Internet Directory, Java Oracle, Solaris, Tuxedo, WebLogic, pfSense, Puppet, RHEL, Base SAS Software, SAS SAS/CONNECT, Slackware, Sophos AV, Splunk Enterprise, Stonesoft NGFW/VPN, stunnel, SUSE Linux Enterprise Desktop, SLES, Ubuntu, Unix (platform) ~ not comprehensive.
Severity: 2/4.
Consequences: data reading, data creation/edition.
Provenance: internet server.
Number of vulnerabilities in this bulletin: 2.
Creation date: 04/03/2015.
Revision date: 09/03/2015.
Identifiers: 122007, 1450666, 1610582, 1647054, 1698613, 1699051, 1699810, 1700225, 1700997, 1701485, 1902260, 1903541, 1963275, 1968485, 1973383, 55767, 7014463, 7022958, 9010028, ARUBA-PSA-2015-003, bulletinjan2015, c04556853, c04679334, c04773241, CERTFR-2015-AVI-108, CERTFR-2015-AVI-117, CERTFR-2015-AVI-146, CERTFR-2016-AVI-303, cisco-sa-20150310-ssl, cpuapr2017, cpujul2018, cpuoct2017, CTX216642, CVE-2015-0138, CVE-2015-0204, DSA-3125-1, FEDORA-2015-0512, FEDORA-2015-0601, FG-IR-15-007, FREAK, FreeBSD-SA-15:01.openssl, HPSBMU03345, HPSBUX03244, HPSBUX03334, JSA10679, MDVSA-2015:019, MDVSA-2015:062, MDVSA-2015:063, NetBSD-SA2015-006, NetBSD-SA2015-007, NTAP-20150205-0001, openSUSE-SU-2015:0130-1, openSUSE-SU-2016:0640-1, RHSA-2015:0066-01, RHSA-2015:0800-01, RHSA-2015:1020-01, RHSA-2015:1021-01, RHSA-2015:1091-01, SA40015, SA88, SA91, SB10108, SB10110, SOL16120, SOL16123, SOL16124, SOL16126, SOL16135, SOL16136, SOL16139, SP-CAAANXD, SPL-95203, SPL-95206, SSA:2015-009-01, SSRT101885, SSRT102000, SUSE-SU-2015:1073-1, SUSE-SU-2015:1085-1, SUSE-SU-2015:1086-1, SUSE-SU-2015:1086-2, SUSE-SU-2015:1086-3, SUSE-SU-2015:1086-4, SUSE-SU-2015:1138-1, SUSE-SU-2015:1161-1, T1022075, USN-2459-1, VIGILANCE-VUL-16301, VN-2015-003_FREAK, VU#243585.

Description of the vulnerability

The TLS protocol uses a series of messages which have to be exchanged between the client and the server, before establishing a secured session.

Several cryptographic algorithms can be negotiated, such as algorithms allowed for USA export (less than 512 bits).

An attacker, located as a Man-in-the-Middle, can inject during the session initialization a message choosing an export algorithm. This message should generate an error, however some TLS clients accept it.

Note: the variant related to Windows is described in VIGILANCE-VUL-16332.

An attacker, located as a Man-in-the-Middle, can therefore force the Chrome, JSSE, LibReSSL, Mono or OpenSSL client to accept a weak export algorithm, in order to more easily capture or alter exchanged data.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2014-6593 CVE-2015-0205

JSSE, CyaSSL, Mono, OpenSSL: clear text session via SKIP-TLS

Synthesis of the vulnerability

An attacker, who has a TLS server, can force the JSSE, CyaSSL, Mono or OpenSSL client/server to use a clear text session, in order to allow a third party to capture or alter exchanged data.
Impacted products: ArubaOS, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, FabricOS, Brocade Network Advisor, Cisco ATA, AnyConnect VPN Client, Cisco ACE, ASA, AsyncOS, Cisco ESA, IOS by Cisco, IronPort Email, IronPort Web, Nexus by Cisco, NX-OS, Cisco Prime Access Registrar, Prime Collaboration Assurance, Cisco Prime DCNM, Prime Infrastructure, Cisco Prime LMS, Prime Network Control Systems, Cisco PRSM, Cisco Router, Cisco IP Phone, Cisco MeetingPlace, Cisco WSA, Clearswift Email Gateway, Debian, BIG-IP Hardware, TMOS, Fedora, FreeBSD, HP-UX, AIX, IRAD, Tivoli Workload Scheduler, WebSphere MQ, Juniper J-Series, Junos OS, Junos Space, Junos Space Network Management Platform, NSM Central Manager, NSMXpress, Juniper SBR, McAfee Email Gateway, ePO, McAfee Web Gateway, Windows (platform) ~ not comprehensive, Data ONTAP, NetBSD, NetScreen Firewall, ScreenOS, Nodejs Core, Java OpenJDK, OpenSSL, openSUSE, Oracle Communications, Java Oracle, JavaFX, Solaris, pfSense, Puppet, RHEL, Slackware, Splunk Enterprise, stunnel, SUSE Linux Enterprise Desktop, SLES, Ubuntu, Unix (platform) ~ not comprehensive, vCenter Server, VMware vSphere.
Severity: 2/4.
Consequences: data reading.
Provenance: internet server.
Number of vulnerabilities in this bulletin: 2.
Creation date: 04/03/2015.
Revision date: 09/03/2015.
Identifiers: 1699051, 1700706, 1701485, 9010028, ARUBA-PSA-2015-003, bulletinjan2015, c04517481, c04556853, c04580241, c04583581, CERTFR-2015-AVI-108, CERTFR-2015-AVI-146, CERTFR-2016-AVI-303, cisco-sa-20150310-ssl, cpujan2015, cpuoct2017, CTX216642, CVE-2014-6593, CVE-2015-0205, DSA-3125-1, DSA-3144-1, DSA-3147-1, FEDORA-2015-0512, FEDORA-2015-0601, FEDORA-2015-0983, FEDORA-2015-1075, FEDORA-2015-1150, FEDORA-2015-8251, FEDORA-2015-8264, FreeBSD-SA-15:01.openssl, HPSBUX03219, HPSBUX03244, HPSBUX03273, HPSBUX03281, JSA10679, MDVSA-2015:019, MDVSA-2015:033, MDVSA-2015:062, NetBSD-SA2015-006, NTAP-20150205-0001, openSUSE-SU-2015:0130-1, openSUSE-SU-2015:0190-1, openSUSE-SU-2015:1277-1, RHSA-2015:0066-01, RHSA-2015:0067-01, RHSA-2015:0068-01, RHSA-2015:0069-01, RHSA-2015:0079-01, RHSA-2015:0080-01, RHSA-2015:0085-01, RHSA-2015:0086-01, RHSA-2015:0133-01, RHSA-2015:0134-01, RHSA-2015:0135-01, RHSA-2015:0136-01, RHSA-2015:0263-01, RHSA-2015:0264-01, SA40015, SA88, SB10104, SB10108, SKIP-TLS, SOL16120, SOL16123, SOL16124, SOL16126, SOL16135, SOL16136, SOL16139, SPL-95203, SSA:2015-009-01, SSRT101859, SSRT101885, SSRT101951, SSRT101968, SUSE-SU-2015:0336-1, SUSE-SU-2015:0503-1, USN-2459-1, USN-2486-1, USN-2487-1, VIGILANCE-VUL-16300, VMSA-2015-0003, VMSA-2015-0003.1, VMSA-2015-0003.10, VMSA-2015-0003.11, VMSA-2015-0003.12, VMSA-2015-0003.13, VMSA-2015-0003.14, VMSA-2015-0003.15, VMSA-2015-0003.2, VMSA-2015-0003.3, VMSA-2015-0003.4, VMSA-2015-0003.5, VMSA-2015-0003.6, VMSA-2015-0003.8, VMSA-2015-0003.9.

Description of the vulnerability

The TLS protocol uses a series of messages which have to be exchanged between the client and the server, before establishing a secured session.

However, clients such as JSSE or CyaSSL accept if the server directly skips to the final state (CVE-2014-6593, first analyzed in VIGILANCE-VUL-16014). Moreover, servers such as Mono or OpenSSL accept if the client directly skips to the final state (CVE-2015-0205, first analyzed in VIGILANCE-VUL-15934).The established session thus uses no encryption.

An attacker, who has a TLS server, can therefore force the JSSE, CyaSSL, Mono or OpenSSL client/server to use a clear text session, in order to allow a third party to capture or alter exchanged data.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2015-2188 CVE-2015-2189 CVE-2015-2191

Wireshark 1.10: three vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Wireshark 1.10.
Impacted products: Debian, openSUSE, Solaris, RHEL, Wireshark.
Severity: 2/4.
Consequences: client access/rights, denial of service on service, denial of service on client.
Provenance: intranet client.
Number of vulnerabilities in this bulletin: 3.
Creation date: 05/03/2015.
Identifiers: bulletinapr2015, CERTFR-2015-AVI-087, CERTFR-2015-AVI-169, CVE-2015-2188, CVE-2015-2189, CVE-2015-2191, DSA-3210-1, MDVSA-2015:183, openSUSE-SU-2015:0489-1, RHSA-2015:1460-01, RHSA-2015:2393-01, VIGILANCE-VUL-16319, wnpa-sec-2015-07, wnpa-sec-2015-08, wnpa-sec-2015-10.

Description of the vulnerability

Several vulnerabilities were announced in Wireshark 1.10.

An attacker can send a malicious WCP packet, in order to trigger a denial of service. [severity:2/4; CVE-2015-2188, wnpa-sec-2015-07]

An attacker can generate an error in pcapng, in order to trigger a denial of service. [severity:2/4; CVE-2015-2189, wnpa-sec-2015-08]

An attacker can generate an infinite loop in TNEF, in order to trigger a denial of service. [severity:2/4; CVE-2015-2191, wnpa-sec-2015-10]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability bulletin CVE-2015-2187 CVE-2015-2188 CVE-2015-2189

Wireshark 1.12: six vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Wireshark 1.12.
Impacted products: openSUSE, Solaris, RHEL, Wireshark.
Severity: 2/4.
Consequences: client access/rights, denial of service on service, denial of service on client.
Provenance: intranet client.
Number of vulnerabilities in this bulletin: 6.
Creation date: 05/03/2015.
Identifiers: bulletinapr2015, CERTFR-2015-AVI-087, CERTFR-2015-AVI-169, CVE-2015-2187, CVE-2015-2188, CVE-2015-2189, CVE-2015-2190, CVE-2015-2191, CVE-2015-2192, openSUSE-SU-2015:0489-1, RHSA-2015:2393-01, VIGILANCE-VUL-16318, wnpa-sec-2015-06, wnpa-sec-2015-07, wnpa-sec-2015-08, wnpa-sec-2015-09, wnpa-sec-2015-10, wnpa-sec-2015-11.

Description of the vulnerability

Several vulnerabilities were announced in Wireshark 1.12.

An attacker can send a malicious ATN-CPDLC packet, in order to trigger a denial of service. [severity:2/4; CVE-2015-2187, wnpa-sec-2015-06]

An attacker can send a malicious WCP packet, in order to trigger a denial of service. [severity:2/4; CVE-2015-2188, wnpa-sec-2015-07]

An attacker can generate an error in pcapng, in order to trigger a denial of service. [severity:2/4; CVE-2015-2189, wnpa-sec-2015-08]

An attacker can send a malicious LLDP packet, in order to trigger a denial of service. [severity:2/4; CVE-2015-2190, wnpa-sec-2015-09]

An attacker can generate an infinite loop in TNEF, in order to trigger a denial of service. [severity:2/4; CVE-2015-2191, wnpa-sec-2015-10]

An attacker can generate an infinite loop in SCSI OSD, in order to trigger a denial of service. [severity:2/4; CVE-2015-2192, wnpa-sec-2015-11]
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2015-0228

Apache httpd mod_lua: denial of service via WebSocket PING

Synthesis of the vulnerability

An attacker can send a malicious PING message to Apache httpd using mod_lua with a WebSocket, in order to trigger a denial of service.
Impacted products: Apache httpd, Apache httpd Modules ~ not comprehensive, Fedora, openSUSE, Solaris, RHEL, Slackware, Ubuntu.
Severity: 1/4.
Consequences: denial of service on server, denial of service on service.
Provenance: user account.
Creation date: 05/03/2015.
Identifiers: 918352, bulletinoct2015, CVE-2015-0228, FEDORA-2015-11689, FEDORA-2015-11792, MDVSA-2015:093, openSUSE-SU-2015:0418-1, RHSA-2015:1666-01, SSA:2015-198-01, USN-2523-1, VIGILANCE-VUL-16302.

Description of the vulnerability

The mod_lua experimental module can be installed on Apache httpd, in order to create extensions based on the Lua language.

The r:wsupgrade() function converts a connection to a WebSocket. However, when a malicious PING message is received, a fatal error occurs in the lua_websocket_read() function.

An attacker can therefore send a malicious PING message to Apache httpd using mod_lua with a WebSocket, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2014-5355

MIT krb5: two vulnerabilities via krb5_read_message

Synthesis of the vulnerability

An attacker can force two errors due to the krb5_read_message() function of MIT krb5, in order to trigger a denial of service.
Impacted products: Debian, AIX, MIT krb5, openSUSE, Solaris, RHEL, Ubuntu.
Severity: 2/4.
Consequences: denial of service on server, denial of service on service.
Provenance: intranet client.
Number of vulnerabilities in this bulletin: 2.
Creation date: 23/02/2015.
Identifiers: bulletinjan2015, CVE-2014-5355, DLA-1265-1, MDVSA-2015:069, openSUSE-SU-2015:0542-1, RHSA-2015:0794-01, RHSA-2015:2154-07, USN-2810-1, VIGILANCE-VUL-16247.

Description of the vulnerability

The krb5_read_message() function reads network messages, and store them in a string.

The krb5_read_message() function does not guaranties that the string containing the version ends with a '\0'. The recvauth_common() function then tries to read a memory area which is not reachable, which triggers a fatal error. [severity:2/4]

An attacker can use a version with a zero length, to force a NULL pointer to be dereferenced in recvauth_common(), in order to trigger a denial of service. [severity:2/4]

An attacker can therefore force two errors due to the krb5_read_message() function of MIT krb5, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2015-0273

PHP: two vulnerabilities of unserialize DateTimeZone

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via an unserialize of DateTimeZone on PHP, in order to trigger a denial of service, and possibly to execute code. It is also possible to read a memory area.
Impacted products: Debian, Fedora, HP-UX, openSUSE, Solaris, PHP, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Consequences: administrator access/rights, privileged access/rights, user access/rights, data reading, denial of service on server, denial of service on service, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 2.
Creation date: 17/02/2015.
Revision date: 23/02/2015.
Identifiers: 68942, bulletinjul2015, c04686230, CERTFR-2015-AVI-074, CVE-2015-0273, DSA-3195-1, FEDORA-2015-2315, FEDORA-2015-2328, HPSBUX03337, MDVSA-2015:079, MDVSA-2015:080, openSUSE-SU-2015:0440-1, RHSA-2015:1053-01, RHSA-2015:1066-01, RHSA-2015:1135-01, RHSA-2015:1218-01, SSRT102066, SUSE-SU-2016:1638-1, USN-2535-1, VIGILANCE-VUL-16209.

Description of the vulnerability

The PHP unserialize() function converts a string to a PHP data structure.

A DateTimeZone object is used to represent a localized time. The php_date_initialize_from_hash() function unserializes a DateTimeZone object. However, two vulnerabilities were announced in this function.

An attacker can force the usage of a freed memory area in php_date_initialize_from_hash(), in order to trigger a denial of service, and possibly to execute code. [severity:3/4; CERTFR-2015-AVI-074, CVE-2015-0273]

An attacker can read a memory fragment via php_date_initialize_from_hash(), in order to obtain sensitive information. [severity:1/4]

An attacker can therefore force the usage of a freed memory area via an unserialize of DateTimeZone on PHP, in order to trigger a denial of service, and possibly to execute code. It is also possible to read a memory area.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about SunOS: