CentOS Errata and Bugfix Advisory 2014:1361 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-1361.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: f7206ad3f099f7f3a889e60181de07f22f5a887c58915addb96286b358879dad ethtool-3.8-4.el7_0.x86_64.rpm Source: 249bf779e0cc6dd9ccbbb33b41d781b3437e23dac7d8f2b2e7018fdc803d652f ethtool-3.8-4.el7_0.src.rpm
Monthly Archives: October 2014
Apache mod_cgi Remote Command Execution
Apache mod_cgi remote command execution exploit that leverages shellshock.
Postfix SMTP Shellshock
Postfix SMTP with procmail shellshock exploit that affects versions 4.2.x up through 4.2.48.
Red Hat Security Advisory 2014-1359-01
Red Hat Security Advisory 2014-1359-01 – Polkit-qt is a library that lets developers use the PolicyKit API through a Qt-styled API. The polkit-qt library is used by the KDE Authentication Agent, which is a part of kdelibs. It was found that polkit-qt handled authorization requests with PolicyKit via a D-Bus API that is vulnerable to a race condition. A local user could use this flaw to bypass intended PolicyKit authorizations. This update modifies polkit-qt to communicate with PolicyKit via a different API that is not vulnerable to the race condition. All polkit-qt users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
CESA-2014:1359 Important CentOS 7 polkit-qtSecurity Update
CentOS Errata and Security Advisory 2014:1359 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1359.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 469ec506f78304c51f385b054029bc165b4027ca1721f73667ee9151cb89b2a6 polkit-qt-0.103.0-10.el7_0.i686.rpm c3403ffee586868bc003f85982553a1bc2860caab13339f53454e63e063dea09 polkit-qt-0.103.0-10.el7_0.x86_64.rpm 266e739f8d9d4811ceb304258dc103d759f8d0d3f5518589d14e0aa32bbd8255 polkit-qt-devel-0.103.0-10.el7_0.i686.rpm 5a6972e28e0df36c6a9088179f9cee3d036ba93987d06ab0643e1d4487304ae4 polkit-qt-devel-0.103.0-10.el7_0.x86_64.rpm 5ed37c9af4c75e28771e5fdb0b4e12ccbaaefc95ecbd87decb70a91a5c13f61e polkit-qt-doc-0.103.0-10.el7_0.noarch.rpm Source: 5ba465a8aeb2c20476d58143742fbfc7510647780340a19d4ecdd77a601ef288 polkit-qt-0.103.0-10.el7_0.src.rpm
CEBA-2014:1356 CentOS 7 dhcp BugFix Update
CentOS Errata and Bugfix Advisory 2014:1356 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-1356.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 3e4301b534eb11741fb80f5887918e06b0821db1f66e37fe3e957a9d5e9bf761 dhclient-4.2.5-27.el7.centos.2.x86_64.rpm 51fb0535e6774e7039ef4df7f7e75eb207d1e43e99f0eed0c8d93b8bec81ae06 dhcp-4.2.5-27.el7.centos.2.x86_64.rpm b6a505aede47fce36b74eac93f6872006a62740fc0b2cdc446479033e7cbad8d dhcp-common-4.2.5-27.el7.centos.2.x86_64.rpm 4c05a088cbf3b4863c3dc19e2cae76ed21cff85a13555d226a9fd0c6d7f9c238 dhcp-devel-4.2.5-27.el7.centos.2.i686.rpm e0237ed75f9677081fdf7c0d34790c2326b9fcd6f2a6833a4e648b28891856b0 dhcp-devel-4.2.5-27.el7.centos.2.x86_64.rpm 9558d6ddf3b9089f47b8a1c3d199c5b8dd9cdef0335004e40e9c4c6ebbce91c7 dhcp-libs-4.2.5-27.el7.centos.2.i686.rpm ef59a01c7a91817de77a0f4aa9087bcafb1061a3df8027c741b2930c41347c6c dhcp-libs-4.2.5-27.el7.centos.2.x86_64.rpm Source: 59564ace4f214466eea874f05efcd80b10db1a9c2497d4135783826d7ece57a0 dhcp-4.2.5-27.el7.centos.2.src.rpm
CVE-2014-6054 (debian_linux, libvncserver, ubuntu_linux)
The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier allows remote attackers to cause a denial of service (divide-by-zero error and server crash) via a zero value in the scaling factor in a (1) PalmVNCSetScaleFactor or (2) SetScale message.
Bugzilla Vulnerability Puts Bug Collections in Harm’s Way
A vulnerability in the account creation process in Bugzilla, bug-tracking software developed and licensed by Mozilla, exposes vulnerabilities collected by the system. Mozilla is expected to patch the vulnerability today.
Experts Laud Changes to iPhone, Android Encryption
The changes that both Google and Apple have made to their mobile operating systems to encrypt the data on users’ devices have generated praise from the security and privacy communities and vitriol and criticism from the law enforcement and political worlds in equal measure.
CA Technologies GNU Bash Shellshock
CA Technologies is investigating multiple GNU Bash vulnerabilities, referred to as the “Shellshock” vulnerabilities, which were publicly disclosed on September 24-27, 2014. CVE identifiers CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, and CVE-2014-6278 have been assigned to these vulnerabilities. These vulnerabilities could allow a local or remote attacker to utilize specially crafted input to execute arbitrary commands or code.