Monthly Archives: January 2016

Security

Packet Fence 5.6.0

PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.

Drupal

RedHen CRM – Moderately Critical – Cross Site Scripting (XSS) – SA-CONTRIB-2016-002

Description

The Redhen set of modules allows you to build a CRM features in a Drupal site.

When rendering individual Contacts, this module does not properly filter the certain data prior to display. When rendering listing of notes or engagement scores, these modules do not properly filter certain data before display.

This vulnerability is mitigated by the fact that an attacker must have an authenticated user account with access to edit a contact, administer engagement scores, or administer taxonomies.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Redhen 7.x-1.x versions prior to 7.x-1.11.

Drupal core is not affected. If you do not use the contributed RedHen CRM module, there is nothing you need to do.

Solution

Install the latest version:

Workaround (if you are unable to update the module immediately):

  • In the display settings for your Redhen Contact Types (admin/structure/redhen/contact_types), hide “name” on all display modes.
  • Restrict access to “Administer Engagement Scores” and “Administer Taxonomies” to trusted users.

Also see the RedHen CRM project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 
Drupal 7.x
NVD

CVE-2015-8607

The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

NVD

CVE-2016-1494

The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

NVD

CVE-2016-1569

FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to invoke the gbak utility with an invalid parameter.

Security

Ubuntu Security Notice USN-2868-1

Ubuntu Security Notice 2868-1 – Sebastian Poehn discovered that the DHCP server, client, and relay incorrectly handled certain malformed UDP packets. A remote attacker could use this issue to cause the DHCP server, client, or relay to stop responding, resulting in a denial of service.

CentOS

CEEA-2016:0027 CentOS 7 igb Enhancement Update

CentOS Errata and Enhancement Advisory 2016:0027 

Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-0027.html

The following updated files have been uploaded and are currently 
syncing to the mirrors: ( sha256sum Filename ) 

x86_64:
4b8716fa548679c3867d020b1de48397a8018d72197d0afb6ef67762b87a40ff  kmod-igb-5.2.15_k-1.el7_2.x86_64.rpm

Source:
391efa4e877e7ba2da0f6a8e54088df77ad925e8ef2c62fe5ea38d42bd3beeda  igb-5.2.15_k-1.el7_2.src.rpm