USN-2520-1: CUPS vulnerability

Ubuntu Security Notice USN-2520-1

26th February, 2015

cups vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 14.10
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS
  • Ubuntu 10.04 LTS

Summary

CUPS could be made to crash or run programs if it processed a specially
crafted file.

Software description

  • cups
    – Common UNIX Printing System(tm)

Details

Peter De Wachter discovered that CUPS incorrectly handled certain malformed
compressed raster files. A remote attacker could use this issue to cause
CUPS to crash, resulting in a denial of service, or possibly execute
arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.10:
cups

1.7.5-3ubuntu3.1
Ubuntu 14.04 LTS:
cups

1.7.2-0ubuntu1.5
Ubuntu 12.04 LTS:
cups

1.5.3-0ubuntu8.6
Ubuntu 10.04 LTS:
cups

1.4.3-1ubuntu1.14

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2014-9679

SEC Consult SA-20150227-0 :: Multiple vulnerabilities in Loxone Smart Home

Posted by SEC Consult Vulnerability Lab on Feb 27

SEC Consult Vulnerability Lab Security Advisory < 20150227-0 >
=======================================================================
title: Multiple vulnerabilities
product: Loxone Smart Home
vulnerable version: Firmware: 5.49; Android-App: 3.4.1
fixed version: 6.3
impact: High
homepage: http://www.loxone.com
found: 2014-07-02
by: Daniel Schwarz…

Is there such a thing as too much privacy ?

In a rather bold move, Apple has published a Privacy page that talks more about the security measures in iOS 8 that prevent Apple from bypassing your security and accessing your data. Of course, if Apple can’t access your data, then there’s no way for them to provide it in response to a government warrant. Not one to be left out, Google has also talked about their security and encryption methods in Android that will keep data safe.

During certain criminal investigations, government agencies will try to access data from smartphones to help them learn more about the case, and if they’re not going to be able to do that effectively thanks to these safety measures, then the argument is that it’s going to make it harder to solve crimes and criminals will be even more bold with their use of technology.

Only last week the news spread about the largest SIM card maker in the world being impacted by a major security breach. Nothing unusual, except Gemalto’s system seems to have been compromised by both NSA and GCHQ in the aim of storing the encryption keys that protect SIM cards. “Once successful, the program would have allowed intelligence agencies to decrypt cell phone signals in mid-air or implant malware remotely into any phone with a Gemalto SIM card” according to The Verge.

For many people, this topic presents an interesting conundrum. As much as the public may want privacy, a lot of the people that you ask would likely say that the government should be able to access certain data from a smartphone when necessary in order to solve a case. In other words, they don’t want the government to have access to everything so that they can pick and choose what they want to see, but they do think that technology can hold the key to solving certain crimes and should be used when appropriate.

What do you think? 

Should everyone have equal #smartphone privacy or should concessions be made when it comes to criminals?

The post Is there such a thing as too much privacy ? appeared first on Avira Blog.

Fedora 21 Security Update: qpid-cpp-0.30-12.fc21

Resolved Bugs
1186308 – CVE-2015-0223 qpid-cpp: anonymous access to qpidd cannot be prevented
1181721 – CVE-2015-0203 qpid-cpp: qpidd can be crashed by unauthenticated user
1184488 – build failure in qpid-cpp-0.30/src/tests/txshift.cpp<br
Added qpidtoollibs to the qpid-tools package.
Fixed path to qpid-ha in the systemd service descriptor.
Resolves: BZ#1186308
Apply patch 10.
Resolves: BZ#1184488
Resolves: BZ#1181721

CVE-2014-2188

The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connection attempt with a blank password, aka Bug IDs CSCuo09400 and CSCun16016.