Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399.
Monthly Archives: September 2015
CVE-2015-3864
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
CVE-2015-6575
SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted atoms in MP4 data, aka internal bug 20139950, a different vulnerability than CVE-2015-1538. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7915, CVE-2014-7916, and/or CVE-2014-7917.
Taxonomy Find – Unsupported – SA-CONTRIB-2015-153
- Advisory ID: DRUPAL-SA-CONTRIB-2015-0XX
- Project: Taxonomy Find (third-party module)
- Version: 6.x, 7.x
- Date: 2015-September-30
- Security risk: 13/25 ( Moderately Critical) AC:None/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon
- Vulnerability: Cross Site Scripting
Description
This module enables you to add a simple search interface to lookup taxonomy terms by name.
The module doesn’t sufficiently sanitize output of taxonomy vocabulary names and term names.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission “Administer vocabularies and terms” or the ability to add or edit nodes or entities with taxonomy fields attached.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
- MODULE 6.x-2.x versions up to 6.x-1.2.
- MODULE 7.x-2.x versions up to 7.x-1.0.
Drupal core is not affected. If you do not use the contributed Taxonomy Find module, there is nothing you need to do.
Solution
If you use the Taxonomy Find module you should uninstall it.
Also see the Taxonomy Find project page.
Reported by
- Matt Vance provisional member of the Drupal Security Team
Fixed by
Not applicable.
Coordinated by
- Rick Manelius of the Drupal Security Team
- Matt Vance provisional member of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
User Dashboard – SQL Injection – Critical – SA-CONTRIB-2015-152
- Advisory ID: DRUPAL-SA-CONTRIB-2015-152
- Project: UserDashboard (third-party module)
- Version: 7.x
- Date: 2015-September-30
- Security risk: 19/25 ( Critical) AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All
- Vulnerability: SQL Injection
Description
Module contains SQL Injection vulnerabilities.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
- user_dashboard 7.x versions prior to 7.x-1.4
Drupal core is not affected. If you do not use the contributed UserDashboard module, there is nothing you need to do.
Solution
Install the latest version.
- If you use the User Dashboard module for Drupal 7.x, upgrade to 7.x-1.4
Also see the UserDashboard project page.
Reported by
Fixed by
Coordinated by
- Michael Hess of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Why independent testing is good for Avast Antivirus
Avast Free Antivirus just received another AV-Test certification for its stellar protection against real-world threats, performance in daily use, and usability.
Yay! It’s like collecting another trophy for the display case or another blue ribbon to hang on the wall, but what does it really mean? How is this type of testing useful for you, our customers?
Ondrej Vlcek, Avast’s Chief Operations Officer explains,
Because of the overwhelming growth of malware targeting consumers and businesses, labs like AV-Test Institute have become an invaluable independent source of data to Avast. Their research has influenced our engineers to expand their knowledge of malware, revolutionize diagnostic and detection methods, and facilitate strategies to get real-time updates to hundreds of millions of people who put their trust in our antivirus products.”
Here’s a little background on the testing lab.
AV-Test Institute is an independent lab designed specifically for testing and researching malware. Located in Magdeburg, Germany, they inhabit 1200m² (12,900 ft²) of space with 3 server rooms and a variety of main and secondary laboratories.
Safety protocols
Just like a specialized facility that deals with infectious agents, AV-Test has set up safety protocols to avoid accidental infections. The hazardous material they store includes 330 million pieces of malicious test data collected over the past 15 years. Every day, they collect another 390,000 new samples of malware.
Thirty specialists work in three labs with more than 100 workstations connected to three physically separate networks: Red for all the test malware with no internet access, Yellow has limited internet access for malware testing, and Green has full internet access so they can download and update programs.
Test Procedures
Every two months, antivirus products are run through a series of tests using a pre-determined configuration that mimics that of the real world. The AV-Test lab looks at three areas: Protection, Performance, and Usability.
In the August 2015 round, 22 products were run through grueling tests. The products can earn a maximum of six points in each of the three test categories for a total of 18 points.
For example, in the Protection category, Avast Free Antivirus had to recognize over 330 zero-day malware attacks, which means they are new, still unknown threats. In the second phase, the objective was to recognize and defend against just under 45,000 known malware threats from the AV-Test reference sets. The average results for the July and August test were 98% detection for zero-day. Avast Free Antivirus scored 99% and 100%, for an average of 99.5%. Avast Free Antivirus identified 100% of widespread and prevalent malware in the second phase. We improved our overall score over the previous test by a half a percentage point, which makes a difference in the real world.
Certification
The award of an AV-TEST CERTIFIED seal of approval is evidence that Avast Free Antivirus has achieved the level of performance and protection defined by the AV-Test labs.
Tests like these, and the ones by Austrian lab AV-Comparatives, are not only for security geeks, but useful for our customers. Even if you never read over the results, you can be guaranteed that we take them seriously and strive to use the information to create the best products we can to protect your home and business PCs, Macs, and Android smartphones and tablets.
Follow Avast on Facebook, Twitter, YouTube, and Google+ where we keep you updated on cybersecurity news every day.
Re: Cisco AnyConnect elevation of privileges via DMG install script
Posted by Securify B.V. on Sep 30
————————————————————————
Fix
————————————————————————
Cisco customers with active contracts can obtain updates through the
Software Center at https://software.cisco.com/download/navigator.html.
Cisco has released bug ID CSCuv11947 for registered users, which
contains additional details and an up-to-date list of affected product
versions.
Re: Cisco AnyConnect elevation of privileges via DLL side loading
Posted by Securify B.V. on Sep 30
————————————————————————
Fix
————————————————————————
Cisco customers with active contracts can obtain updates through the
Software Center at https://software.cisco.com/download/navigator.html.
Cisco has released bug ID CSCuv01279 [5] for registered users, which
contains additional details and an up-to-date list of affected product
versions.
Significant WinRAR vulnerability identified
An expert says that the popular compression tool WinRAR contains a significant vulnerability that exposes it to an attack.
The post Significant WinRAR vulnerability identified appeared first on We Live Security.
Unsupported Honeywell Experion PKS Vulnerable to Public Attacks
Unsupported versions of Honeywell distributed control system software are vulnerable to publicly available remote exploits.