Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security community.  

Summary:

              1.      Apache Struts “ParameterInterceptor” Security Bypass Vulnerability

             2.      Asterisk SRTP Video Stream Negotiation Denial of Service Vulnerability

             3.      Cisco Digital Media Manager Administrative Resources Access Security Bypass Vulnerability

             4.      Cisco TelePresence System Default Root Account Security Issue

             5.      cURL SSL/TLS IV Selection Weakness and URL Sanitization Vulnerability

             6.      HP-UX Multiple Vulnerabilities

             7.      IBM DB2 Accessories Suite Outside In Technology Multiple Vulnerabilities

             8.      IBM Lotus Symphony Image Processing Integer Overflow Vulnerability

             9.      OpenSSL DTLS Denial of Service Vulnerability

           10.     Opera Filename Disclosure Weakness and Security Bypass Vulnerability

           11.     Oracle Solaris Multiple Vulnerabilities

           12.     Smokeping “displaymode” Cross-Site Scripting Vulnerability

           13.     Symantec pcAnywhere / IT Management Suite Code Execution and Insecure Permission

           14.     Red Hat Multiple Vulnerabilities

           15.     SUSE Multiple Vulnerabilities

           16.     Trend Micro DataArmor / DriveArmor Privilege Escalation Vulnerability

  Read the rest of this entry »

Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security community. 

 Summary:

              1.      Apache Tomcat Request Object Recycle Security Bypass

             2.      HP StorageWorks Modular Smart Array P2000 G3 Web Interface Directory Traversal Vulnerability

             3.      IBM HTTP Server Multiple Vulnerabilities

             4.      IBM SPSS Data Collection ActiveX Controls Multiple Vulnerabilities

             5.      IBM WebSphere Application Server Multiple Vulnerabilities

             6.      Oracle Application Server Cross-Site Scripting and SQL Injection Vulnerabilities

             7.      Oracle Communications Unified Calendar Server Multiple Vulnerabilities

             8.      Oracle Database Multiple Vulnerabilities

             9.      Oracle E-Business Suite Multiple Vulnerabilities

           10.     Oracle Fusion Middleware Multiple Vulnerabilities

           11.     Oracle GlassFish Communications Server / Sun Java System Application Server Denial of Service

           12.     Oracle GlassFish Enterprise Server Multiple Vulnerabilities

           13.     Oracle JD Edwards EnterpriseOne Tools Multiple Vulnerabilities

           14.     Oracle MySQL Server Multiple Vulnerabilities

           15.     Oracle OpenSSO Administration Component Data Manipulation Vulnerability

           16.     Oracle Outside In Technology Outside In Filters Multiple Vulnerabilities

           17.     Oracle PeopleSoft Enterprise CRM Unspecified Vulnerability

           18.     Oracle PeopleSoft Enterprise PeopleTools Unspecified Vulnerability

           19.     Oracle PeopleSoft Human Capital Management Multiple Vulnerabilities

           20.     Oracle Solaris Multiple Vulnerabilities

           21.     Oracle Transportation Manager Apache HTTP Server ByteRange Filter Denial of Service

           22.     Oracle Virtual Desktop Infrastructure Information Disclosure and Data Manipulation

           23.     Oracle VM VirtualBox Multiple Vulnerabilities

           24.     Oracle WebLogic Server Data Manipulation and Denial of Service Vulnerabilities

           25.     SUSE Multiple Vulnerabilities

Read the rest of this entry »

Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security community.

Summary:

1.     Adobe Reader/Acrobat Multiple Vulnerabilities
2.     Google Chrome Multiple Vulnerabilities
3.     HP LaserJet P3015 Unspecified Security Bypass Vulnerability
4.     IBM Java Multiple Vulnerabilties
5.     IBM Rational License Key Server License Manager Log File Upload Vulnerability
6.     IBM WebSphere Application Server Community Edition Tomcat Container Denial of Service
7.     Microsoft January Security Bulletin
         a.   Vulnerability in Windows Kernel Could Allow Security Feature Bypass MS12-001 (2644615) – Important
         b.   Vulnerability in Windows Object Packager Could Allow Remote Code Execution MS12-002 (2603381) –Important
         c.   Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege  MS12-003  (2646524) – Important
         d.   Vulnerabilities in Windows Media Could Allow Remote Code Execution MS12-004 (2636391) – Critical
         e.   Vulnerability in Microsoft Windows Could Allow Remote Code Execution MS12-005 (2584146) – Important
         f.   Vulnerability in SSL/TLS Could Allow Information Disclosure MS12-006 (2643584) – Important
         g.   Vulnerability in AntiXSS Library Could Allow Information Disclosure MS12-007 (2607664) – Important
8.    Red Hat Multiple Vulnerabilities
9.    SUSE Multiple Vulnerabilities
10.  Wireshark Multiple Vulnerabilities

Read the rest of this entry »

Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security community.  

Summary:

1. Apache Geronimo Multiple Vulnerabilities
2. Apache Struts Multiple Vulnerabilities
3. Apache Tomcat Web Form Hash Collision Denial of Service Vulnerability
4. Attachmate Reflection for the Web Java Multiple Vulnerabilities
5. Avaya CMS Solaris TCP/IP Implementation Denial of Service Vulnerability
6. F5 Enterprise Manager Multiple Vulnerabilities
7. HP Managed Printing Administration Multiple Vulnerabilities
8. HP-UX update for Java
9. IBM AIX X Server Two Vulnerabilities
10. IBM Java Two Vulnerabilities
11. IBM Lotus Domino Notes RPC Authentication Processing Denial of Service Vulnerability
12. IBM Rational Rhapsody BB FlashBack SDK ActiveX Control Vulnerabilities
13. Microsoft .NET Framework Multiple Vulnerabilities MS11-100 (2638420) – Critical
14. Mozilla Firefox / Thunderbird JAR File Handling Weakness
15. Mozilla SeaMonkey Multiple Vulnerabilities
16. Mozilla Firefox, SeaMoney and Thunderbird Multiple Vulnerabilities
17. Nagios XI Cross-Site Scripting and Privilege Escalation Vulnerabilities
18. OpenSSL Multiple Vulnerabilities
19. Oracle iPlanet Web Server SSL/TLS Initialization Vector Selection Weakness
20. Oracle Sun System Firmware Network Time Protocol Multiple Vulnerabilities
21. phpMyAdmin “Servers-0-host” Script Insertion Vulnerability
22. Red Hat Multiple Vulnerabilities
23. RSA SecurID Software Token Insecure Library Loading Vulnerability
24. SUSE Multiple Vulnerabilities

  Read the rest of this entry »

Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security Community.  

Summary:

1.      Adobe ColdFusion Two Cross-Site Scripting Vulnerabilities

2.      Apache Struts Conversion Error OGNL Expression Injection Vulnerability

3.      APC PowerChute Business Edition Unspecified Cross-Site Scripting Vulnerability

4.      Blue Coat ProxyAV libpng Buffer Overflow Vulnerability

5.      Cacti Multiple Vulnerabilities

6.      Google Chrome Multiple Vulnerabilities

7.      HP Device Access Manager for HP ProtectTools ActiveX Control Buffer Overflow Vulnerability

8.      HP-UX update for BIND

9.      IBM AIX Inventory Scout Data Manipulation and File Deletion Vulnerabilities

10.     IBM Tivoli Federated Identity Manager SAML Signature Validation Security Bypass

11.     ISC DHCP Regular Expressions Denial of Service Vulnerability

12.     Kerberos KDC “process_tgs_req()” NULL Pointer Dereference Denial of Service Vulnerability

13.     Microsoft December Security Bulletin Address Multiple Vulnerabilties

a. Vulnerability in Microsoft Office IME (Chinese) Could Allow Elevation of Privilege MS11-088 (2652016) – Important

b. Vulnerability in Microsoft Office Could Allow Remote Code Execution MS11-089 (2590602) – Important

c. Cumulative Security Update of ActiveX Kill Bits MS11-090 (2618451) – Critical

d. Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution MS11-091 (2607702) – Important

e. Vulnerability in Windows Media Could Allow Remote Code Execution MS11-092 (2648048) – Critical

f. Vulnerability in OLE Could Allow Remote Code Execution MS11-093 (2624667) – Important

g. Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution  MS11-094 (2639142) – Important

h. Vulnerability in Active Directory Could Allow Remote Code Execution MS11-095 (2640045) – Important

i. Vulnerability in Microsoft Excel Could Allow Remote Code Execution MS11-096 (2640241) – Important

j. Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege MS11-097 (2620712) – Important

k. Vulnerability in Windows Kernel Could Allow Elevation of Privilege MS11-098 (2633171) – Important

l. Cumulative Security Update for Internet Explorer MS11-099 (2618444) – Important

14.     Oracle Solaris Adobe Flash Player Multiple Vulnerabilities

15.     Red Hat Multiple Vulnerabilities

16.     RSA Adaptive Authentication On-Premise Two Security Bypass Vulnerabilities

17.     SUSE Multiple Vulnerabilities

18.     Trend Micro Control Manager “CGenericScheduler::AddTask()” Buffer Overflow Vulnerability

19.     ZENworks Asset Management rtrlet Component Arbitrary File Upload Vulnerability

  Read the rest of this entry »

Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security community.  

Summary:

1. Adobe Flex Cross-Site Scripting Vulnerability
2. HP Operations / Performance Agent Unauthorized Directory Access  Vulnerability
3. HP-UX update for Tomcat Servlet Engine
4. IBM AIX Multiple Vulnerabilities
5. IBM Java Multiple Vulnerabilities
6. BM WebSphere Application Server JSF Applications Request Handling Information Disclosure
7. MAC RealPlayer Multiple Vulnerabilities
8. Novell NetWare XNFS.NLM “xdrDecodeString()” Buffer Overflow Vulnerability
9. Novell Open Enterprise Server iPrint Client “GetDriverSettings()” Buffer Overflow Vulnerability
10. Oracle Solaris Multiple Vulnerabilities
11. Red Hat Multiple Vulnerabilities
12. SUSE Multiple Vulnerabilities
13. VMware vCenter Update Manager Jetty Directory Traversal Vulnerability

  Read the rest of this entry »

Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security community.  

Summary: 

1. Adobe Flash Player Multiple Vulnerabilities
2. Apple iOS Multiple Vulnerabilities
3. Google Chrome Multiple Vulnerabilities
4. HP Directories Support for ProLiant Management Processors Security Bypass Vulnerability
5. HP StorageWorks P4000 Virtual SAN Appliance Software Buffer Overflow
6. HP-UX System Administration Manager Unspecified Privilege Escalation Vulnerability
7. IBM AIX Workload Partition System Calls Denial of Service Vulnerability
8. IBM WebSphere MQ Control Commands Security Bypass Security Issue
9. ISC BIND Recursive Query Processing Denial of Service Vulnerability
10. Oracle Global Desktop Apache HTTP Server Two Denial of Service Vulnerabilities
11. Red Hat Multiple Vulnerabilities
12. SAP NetWeaver Multiple Vulnerabilities
13. SUSE Multiple Vulnerabilities

   Read the rest of this entry »

Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security community.

Summary:

1. Adobe Shockwave Player Multiple Vulnerabilities

2. Apache Tomcat Manager Application Servlets Security Bypass Security Issue

3. Apple Mac OS X update for Java

4. Avaya CMS libpng Multiple Vulnerabilities

5. D-Link DIR-300 Router Management Vulnerability

6. HP Integrated Lights-Out OpenSSL Security Bypass and Data Manipulation Vulnerabilities

7. HP Network Node Manager i Cross-Site Scripting Vulnerabilities

8. HP OpenView Network Node Manager Apache Multiple Denial of Service Vulnerabilities

9. HP TCP/IP Services for OpenVMS Security Bypass and Denial of Service Vulnerabilities

10. IBM AIX OpenSSL Multiple Vulnerabilities

11. IBM DB2 Tools for z/OS CAE Server Directory Information Disclosure Security Issue

12. IBM Rational Asset Manager Cross-Site Scripting and Security Bypass Vulnerabilities

13. Microsoft Security Bulletin for November 2011

a. Vulnerability in TCP/IP Could Allow Remote Code Execution MS11-083 (2588516) – Critical

b. Vulnerability in Windows Kernel-Mode Drivers Could Allow Denial of Service MS11-084 (2617657) – Moderate

c. Vulnerability in Windows Mail and Windows Meeting Space Could Allow Remote Code Execution MS11-085 (2620704) – Important

d. Vulnerability in Active Directory Could Allow Elevation of Privilege MS11-086 (2630837) – Important

14. Mozille Firefox / Thunderbird Multiple Vulnerabilities

15. Oracle Solaris Apache Tomcat Multiple Vulnerabilities

16. Red Hat Multiple Vulnerabilities

17. SUSE Multiple Vulnerabilities

Read the rest of this entry »

Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security community.

Vulnerability Summary:

1. Cisco Products Multiple Vulnerabilities
2. Citrix XenDesktop Client Drive Mapping Policy Bypass Security Issue
3. D-Link Products SSH Server Buffer Overflow Vulnerability
4. HP OpenView Network Node Manager Multiple Unspecified Vulnerabilities
5. HP-UX update for BIND
6. IBM AIX BIND Multiple Vulnerabilities
7. Microsoft Windows Kernel Word File Handling Remote Code Execution Vulnerability
8. Novell Messenger Server Process Memory Information Disclosure Vulnerability
9. Oracle Solaris Multiple Vulnerabilities
10. Red Hat Multiple Vulnerabilities
11. SUSE Multiple Vulnerabilities
12. VMware ESXi Server “sblim-sfcb” Integer Overflow Vulnerability
13. Wireshare Multiple Vulnerabilities

Additional Information:

FEMA Emergency Alert Test Notification

Read the rest of this entry »

Commonwealth Security and Risk Management staff has been tracking multiple vulnerabilities that may have significant impact for the Commonwealth Information Security community.

Summary:

1. Apple Quick Time Multiple Vulnerabilities
2. Check Point Products Multiple Vulnerabilities
3. Cisco Products Multiple Vulnerabilities
4. HP-UX Containers Unspecified Privilege Escalation Vulnerability
5. IBM WebSphere Application Server for z/OS Two Vulnerabilities
6. IBM WebSphere ILOG Rule Team Server Unspecified Cross-Site Scripting Vulnerability
7. McAfee Web Gateway Unspecified Cross-Site Scripting Vulnerability
8. Microsoft Outlook Web Access Session Replay Security Bypass Vulnerability
9. Novell iPrint Client “GetDriverSettings()” Buffer Overflow Vulnerability
10. Novell Netware HTTP Server ByteRange Filter Denial of Service Vulnerability
11. Oracle Solaris Vino Framebuffer Update Handling Denial of Service Vulnerability
12. Red Hat Multiple Vulnerabilities
13. SUSE Multiple Vulnerabilities
14. Winamp Multiple Vulnerabilities Read the rest of this entry »