HP Security Bulletin HPSBMU03601 1 – HPE Insight Control server deployment has addressed the following security vulnerabilities: The Cross-protocol Attack on TLS using SSLv2 also known as “DROWN” which could be exploited remotely resulting in disclosure of information Multiple OpenSSL vulnerabilities which could be remotely exploited resulting in Denial of Service (DoS) Multiple vulnerabilities that can be exploited locally resulting in Cross-site scripting (XSS), and Information Disclosure. Revision 1 of this advisory.
Monthly Archives: May 2016
Wekby APT Gang Using DNS Tunneling for Command and Control
Wekby attackers are turning to the technique known as DNS tunneling in lieu of more conventional HTTP delivery of command and controls for remote access control of infected computer networks.
VMWare vSphere Web Client 6.0 Cross Site Scripting
VMWare vSphere web client versions 5.1 through 6.0 suffer from a flash cross site scripting vulnerability.
Cisco Security Advisory 20160525-ipv6
Cisco Security Advisory – A vulnerability in the IP Version 6 (IPv6) packet processing functions of Cisco IOS XR Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to stop processing IPv6 traffic, leading to a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted IPv6 packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted IPv6 Neighbor Discovery packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to stop processing IPv6 traffic, leading to a DoS condition on the device. Cisco will release software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Ubuntu Security Notice USN-2950-5
Ubuntu Security Notice 2950-5 – USN-2950-1 fixed vulnerabilities in Samba. USN-2950-3 updated Samba to version 4.3.9, which introduced a regression when using the ntlm_auth tool. This update fixes the problem. Jouni Knuutinen discovered that Samba contained multiple flaws in the DCE/RPC implementation. A remote attacker could use this issue to perform a denial of service, downgrade secure connections by performing a man in the middle attack, or possibly execute arbitrary code. Stefan Metzmacher discovered that Samba contained multiple flaws in the NTLMSSP authentication implementation. A remote attacker could use this issue to downgrade connections to plain text by performing a man in the middle attack. Alberto Solino discovered that a Samba domain controller would establish a secure connection to a server with a spoofed computer name. A remote attacker could use this issue to obtain sensitive information. Various other issues were also addressed.
APT Groups Finding Success with Patched Microsoft Flaw
Researchers at Kaspersky Lab have identified six APT groups using exploits for a Microsoft Office flaw that was patched in September 2015.
Release for CentOS Linux 6.8 i386 and x86_64
We are pleased to announce the immediate availability of CentOS Linux
6.8 and install media for i386 and x86_64 Architectures. Release Notes
for 6.8 are available at:
http://wiki.centos.org/Manuals/ReleaseNotes/CentOS6.8
We recommend everyone review these release notes.
CentOS Linux 6.8 is derived from source code released by Red Hat, Inc.
for Red Hat Enterprise Linux 6.8. All upstream variants have been
placed into one combined repository to make it easier for end users.
Workstation, server, and minimal installs can all be done from our
combined repository. All of our testing is only done against this
combined distribution.
There are many fundamental changes in this release, compared with the
past CentOS Linux 6 releases, and we highly recommend everyone study
the upstream Release Notes as well as the upstream Technical Notes
about the changes and how they might impact your installation. (See
the 'Further Reading' section if the CentOS release notes link above).
All updates since the upstream 6.8 release are also on the CentOS
mirrors as zero day updates. When installing CentOS-6.8 (or any other
version) from any of our media, you should always run 'yum update'
after the install to apply these.
Users consuming our centos-cr repositories will already be running all
the packages that make up CentOS-6.8, and all updates released since.
They will notice only the centos-release and anaconda updates today
when moving to CentOS Linux 6.8. For more information on the CR
repository for future updates, see this link:
http://wiki.centos.org/AdditionalResources/Repositories/CR
Release Announcements for all updated packages are available here:
http://bit.ly/1WOy3dB
+++++++++++++++++++++++
Upgrading From Prior Major CentOS Versions:
We recommend everyone perform a fresh reinstall rather than attempt an
inplace upgrade from other major CentOS versions (CentOS-2.1, CentOS-3.x,
CentOS-4.x, CentOS-5.x).
+++++++++++++++++++++++
Upgrading from CentOS-6.0 / 6.1 / 6.2 / 6.3 / 6.4 / 6.5 / 6.6 or 6.7
CentOS Linux is designed to automatically upgrade between releases
within a major version (in this case, CentOS-6). Unless you have
edited your yum default configuration, a 'yum update' should move your
machines seamlessly from any previous CentOS Linux 6.x release to 6.8.
We also test this in our QA cycles and have noticed no problems, any
issues would be mentioned in the Release Notes.
+++++++++++++++++++++++
Downloading CentOS Linux 6.8 for new installs:
When possible, consider using torrents to obtain our ISOs. Usually it
is also the fastest means to download the distro.
The install media is split into various formats. We have made efforts
to ensure that most install types and roles can be done from DVD-1
itself, and the minimal install ISO is only tested to deliver a
minimal install set, when used as an ISO format ( either on cd or usb
). While other forms of installs ( eg. pxe delivered ) might work from
the minimal ISO, they are neither tested not supported. The only
format where we support the entire set of install options and delivery
mechanisms is via the complete CentOS Linux 6.8 tree, wihch can also
be created by consolidating all content from DVD1 and DVD2.
We no longer produce CD size images for the entire CentOS Linux 6
distribution, however the minimal install and netinstall iso images
are small enough to fit on all CD grade media.
Torrent files for the DVD's are available at :
http://mirror.centos.org/centos/6.8/isos/i386/CentOS-6.8-i386-bin-DVD1to2.torrent
http://mirror.centos.org/centos/6.8/isos/x86_64/CentOS-6.8-x86_64-bin-DVD1to2.torrent
You can also use a mirror close to you to get any of our ISOs:
http://mirror.centos.org/centos/6.8/isos/
If you need to update a local mirror, you can choose from our mirror
network http://www.centos.org/download/mirrors/ Most mirrors will
allow downloads over http, ftp and rsync.
Note: The x86_64 ISOs (minimal, netinstall, DVD1) should install on UEFI
machines.
Secure Boot must be disabled to install CentOS 6. The Live ISOs and i386
ISOs will
not boot with UEFI.
+++++++++++++++++++++++
sha256sum for the CentOS-6.8 ISOS:
i386:
720d185fdf063383a4471657076b72fc162d3c3c3bca2e5e5ae13a25b3046519
CentOS-6.8-i386-bin-DVD1.iso
0c1a498a469214f276b4390a9ac2111fe8eb89084f7921d2eced659ada09e1a9
CentOS-6.8-i386-bin-DVD2.iso
7df6c27c0cd1186845bee4e786d43dbd3ae429258098283f9dbc2b2d20ed6a89
CentOS-6.8-i386-LiveCD.iso
7e2ace104901921ac919a390be827251727dfd04437fbd4e4d3024b6d70d8718
CentOS-6.8-i386-LiveDVD.iso
f4cf0614cc2ac451ffec5bd349ee74a1b31fd394e58561a07c38a21be5a4bdeb
CentOS-6.8-i386-minimal.iso
1668434d76e14a45a189b7810582e7e6ded686854f75b7f8ba053830a5706e57
CentOS-6.8-i386-netinstall.iso
x86_64:
dda55622614a8b43b448a72f87d6cb7f79de1eff49ee8c5881a7d9db28d4e35
CentOS-6.8-x86_64-bin-DVD1.iso
0aba869427b4ce04e100d72744daf7fea1f7be2e4be56b658095bd9e99e04e6d
CentOS-6.8-x86_64-bin-DVD2.iso
efa82d673206cb6af377b1f929a510cc2b1ce95cdb436210121ec271e056c920
CentOS-6.8-x86_64-LiveCD.iso
52a9c8c1d250de39976dda9412293473b8349efefb31b66fecdee0fdf93866d9
CentOS-6.8-x86_64-LiveDVD.iso
ec49c297d484b9da0787e5944edc38f7c70f21c0f6a60178d8e9a8926d1949f4
CentOS-6.8-x86_64-minimal.iso
56d9cc5757ed1443af7b321967622a108978328f72e58050d31bcf1998dfd162
CentOS-6.8-x86_64-netinstall.iso
+++++++++++++++++++++++
Cloud Images:
Images for various on-premise and off-premise Cloud environments are
currently under development for CentOS Linux 6.8 and will be released
in the coming days. Everyone looking to join and help with the CentOS
Cloud efforts is encouraged to join the CentOS-devel list where such
issues are discussed (
http://lists.centos.org/mailman/listinfo/centos-devel ).
+++++++++++++++++++++++
Getting Help:
The best place to start when looking for help with CentOS is at the
wiki ( http://wiki.centos.org/GettingHelp ) which lists various
options and communities who might be able to help. If you think there
is a bug in the system, do report it at http://bugs.centos.org/ - but
keep in mind that the bugs system is *not* a support mechanism. If you
need supported software with Support Level Agreements, people to call
and response times then we recommend Red Hat Enterprise Linux.
If you have questions you would like to field at us in real time, come
join the office hours on Wed or Thu of every week. You can find
details on these at http://wiki.centos.org/OfficeHours
+++++++++++++++++++++++
Meet-ups and Events:
If you would like to get involved in helping organize, run, present or
sponsor a CentOS Dojo or even just want more details then join the
CentOS Promo list:
http://lists.centos.org/mailman/listinfo/centos-promo and drop an
email introducing yourself. We are very keen to find help to run
events around the world, and also to find people who can represent
CentOS at various community events around the world.
+++++++++++++++++++++++
Contributing and joining the project:
We are always looking for people to join and help with various things
in the project. If you are keen to help out a good place to start is
the wiki page at http://wiki.centos.org/Contribute . If you have
questions or a specific area you would like to contribute towards that
is not covered on that page, feel free to drop in on #centos-devel at
irc.freenode.net for a chat or email the centos-devel list
(http://lists.centos.org).
+++++++++++++++++++++++
Thanks to everyone who contributed towards making CentOS Linux 6.8,
especially the effort put in, as always, by the QA
(http://wiki.centos.org/QaGroup) and Build teams.
A special shout out to all the donors who have contributed hardware,
network connectivity, hosting and resources over the years. The CentOS
project now has a fairly well setup resource pool, solely thanks to
the donors.
Enjoy!
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos< at >irc.freenode.net
Twitter: < at >JohnnyCentOS
PHP CRUD 1.4 Backdoor Accounts
PHP CRUD version 1.4 comes installed with weakly protected backdoor accounts.
CVE-2014-3672 (libvirt, xen)
The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.
CVE-2015-8853 (fedora, perl)
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by “ax80.”