The NTP implementation in Cisco IOS 15.1 and 15.5 and IOS XE 3.2 through 3.17 allows remote attackers to modify the system time via crafted packets, aka Bug ID CSCux46898.
Monthly Archives: April 2016
CVE-2016-2003
HPE P9000 Command View Advanced Edition Software (CVAE) 7.x and 8.x before 8.4.0-00 and XP7 CVAE 7.x and 8.x before 8.4.0-00 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVE-2016-2202
The Inventory Solution component in the Management Agent in the client in Symantec Altiris IT Management Suite (ITMS) through 7.6 HF7 allows local users to bypass intended application-blacklist restrictions via unspecified vectors.
Latest TeslaCrypt Targets New File Extensions, Invests Heavily in Evasion
Researchers at Endgame have found new versions of TeslaCrypt in the past few weeks that target a host of new and unusual file extensions, and deploy new obfuscation and evasion techniques.
Cisco Releases Security Updates
Original release date: April 20, 2016
Cisco has released security updates to address vulnerabilities in multiple products. Exploitation of these vulnerabilities could allow a remote attacker to cause a denial-of-service condition on an affected system.
US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates:
- Cisco Wireless LAN Controller Management Interface Denial of Service Vulnerability
- Cisco Adaptive Security Appliance Software DHCPv6 Relay Denial of Service Vulnerability
- Cisco Wireless LAN Controller Denial of Service Vulnerability
- Cisco Wireless LAN Controller HTTP Parsing Denial of Service Vulnerability
- Multiple Cisco Products libSRTP Denial of Service Vulnerability
This product is provided subject to this Notification and this Privacy & Use policy.
CVE-2014-9770
tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files.
CVE-2015-7801
Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file.
CVE-2015-7802
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
CVE-2015-8842
tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file.
CEO Vince Steckler talks cybersecurity with expert roundtable
Avast CEO, Vince Steckler, joined a panel of top security experts for a roundtable discussion about cybersecurity in our everyday lives.
Read ‘Talking Cybersecurity at Home, the Office and In-Between’
