Monthly Archives: December 2015

Security

Red Hat Security Advisory 2015-2620-01

Red Hat Security Advisory 2015-2620-01 – Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller framework for web application development. Action Pack implements the controller and the view components. A privilege escalation flaw was discovered in CloudForms, where in certain situations, CloudForms could read encrypted data from the database and then write decrypted data back into the database. If the database was then exported or log files generated, a local attacker might be able to gain access to sensitive information.

CentOS

CESA-2015:2655 Important CentOS 6 bind SecurityUpdate

CentOS Errata and Security Advisory 2015:2655 Important

Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-2655.html

The following updated files have been uploaded and are currently 
syncing to the mirrors: ( sha256sum Filename ) 

i386:
a6e9f9d465f359f55db3ab944454fec8fc88f643ef7a4add405ef8673086b151  bind-9.8.2-0.37.rc1.el6_7.5.i686.rpm
3e8f7fbfa67ded03de604f92afa84da397b2986372682459cd9042259130fa33  bind-chroot-9.8.2-0.37.rc1.el6_7.5.i686.rpm
108fcf6e3fa41f14033e9c884e23aa7c5c580b601aa8e2a38a962564e87c3064  bind-devel-9.8.2-0.37.rc1.el6_7.5.i686.rpm
c0f21c24ab02c5e2cc8e62123aada97bc76c078f9e697fb057366caab7a8bd2d  bind-libs-9.8.2-0.37.rc1.el6_7.5.i686.rpm
54306156d311efa69259af6e103c8a6d57b7c5372134626ea3b1d3d40f4f0a20  bind-sdb-9.8.2-0.37.rc1.el6_7.5.i686.rpm
163ec060fd53b47ee42d037b728d2b3dd62ec91ed51510cdce55bc1be94d3392  bind-utils-9.8.2-0.37.rc1.el6_7.5.i686.rpm

x86_64:
82292085be622290568eb551e9448208a6647e90ee39d87fd0eb714ff51a9c75  bind-9.8.2-0.37.rc1.el6_7.5.x86_64.rpm
b7838a2e4d09c105980a4b7d971a0a8bef2d5d999ecfc0cba76dfa47724f1492  bind-chroot-9.8.2-0.37.rc1.el6_7.5.x86_64.rpm
108fcf6e3fa41f14033e9c884e23aa7c5c580b601aa8e2a38a962564e87c3064  bind-devel-9.8.2-0.37.rc1.el6_7.5.i686.rpm
5a80d45b6be6721a104344fe399406817fa5255bd4de938d9b421d280598618f  bind-devel-9.8.2-0.37.rc1.el6_7.5.x86_64.rpm
c0f21c24ab02c5e2cc8e62123aada97bc76c078f9e697fb057366caab7a8bd2d  bind-libs-9.8.2-0.37.rc1.el6_7.5.i686.rpm
295f460e79abaca23a6e648bb00ad169d9410422297f53a8d7ea5c3f5f6b1930  bind-libs-9.8.2-0.37.rc1.el6_7.5.x86_64.rpm
e75b77960bcd3322b08f84aece1d9d948f2bf1fb22fa343f2f2bb041e1fed64a  bind-sdb-9.8.2-0.37.rc1.el6_7.5.x86_64.rpm
e440ee99799a0b96d5aea0020b4369ce7e80d413f3e3a07a03f9c12a0789f257  bind-utils-9.8.2-0.37.rc1.el6_7.5.x86_64.rpm

Source:
091274ede99a2f24fe1adbda4b9ca846e6a16b5b4d22334ccc1274602effaeaf  bind-9.8.2-0.37.rc1.el6_7.5.src.rpm
CentOS

CEBA-2015:2654 CentOS 6 udev BugFix Update

CentOS Errata and Bugfix Advisory 2015:2654 

Upstream details at : https://rhn.redhat.com/errata/RHBA-2015-2654.html

The following updated files have been uploaded and are currently 
syncing to the mirrors: ( sha256sum Filename ) 

i386:
447d34fe297fc91ae7de208ee5810fb6f60adf97593f687bacd3b4d4b3fe407b  libgudev1-147-2.63.el6_7.1.i686.rpm
fa1e8acd300a76a603a42aa192b2a7ded2dec62bde9d82892e0a50b5a6be35d0  libgudev1-devel-147-2.63.el6_7.1.i686.rpm
d78f0bf45614fa0717b4961fc44d96f4777555c05dfcbf5e338b80e21dcdb873  libudev-147-2.63.el6_7.1.i686.rpm
b0a0db26676a2b5d63ca9dc0960b301485a50830fdbc572d9c9ef870e22d4580  libudev-devel-147-2.63.el6_7.1.i686.rpm
e17affd21f069d955ef626af2e21944d12c1b1e0f5072f1174f40d4dc2780833  udev-147-2.63.el6_7.1.i686.rpm

x86_64:
447d34fe297fc91ae7de208ee5810fb6f60adf97593f687bacd3b4d4b3fe407b  libgudev1-147-2.63.el6_7.1.i686.rpm
a0e210d7fea9181a8b9baec6b14e80b43cb1d66a088d3d06ec55cc8d1a175cbc  libgudev1-147-2.63.el6_7.1.x86_64.rpm
fa1e8acd300a76a603a42aa192b2a7ded2dec62bde9d82892e0a50b5a6be35d0  libgudev1-devel-147-2.63.el6_7.1.i686.rpm
ecbf9c1884202cfcca30b53d473060310a8766308f4cc19007b7dc037c0b052c  libgudev1-devel-147-2.63.el6_7.1.x86_64.rpm
d78f0bf45614fa0717b4961fc44d96f4777555c05dfcbf5e338b80e21dcdb873  libudev-147-2.63.el6_7.1.i686.rpm
ec7662a0fc4fd42706dc71784f727661b81e6d16fd91755f8f47c9468bbc1892  libudev-147-2.63.el6_7.1.x86_64.rpm
b0a0db26676a2b5d63ca9dc0960b301485a50830fdbc572d9c9ef870e22d4580  libudev-devel-147-2.63.el6_7.1.i686.rpm
a3a1614ec2f66ca04303dac00943d1b24d67f8dfee942e93a0f0757b06f9b963  libudev-devel-147-2.63.el6_7.1.x86_64.rpm
f1e124eff6e18a3e7d480744643501023606db67477940f35eb1e8fb587f024c  udev-147-2.63.el6_7.1.x86_64.rpm

Source:
f5709a26287ecce830b752f74b3b7af272339099e0c635f6fcd616c01c910575  udev-147-2.63.el6_7.1.src.rpm
CentOS

CESA-2015:2657 Critical CentOS 7 firefox SecurityUpdate

CentOS Errata and Security Advisory 2015:2657 Critical

Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-2657.html

The following updated files have been uploaded and are currently 
syncing to the mirrors: ( sha256sum Filename ) 

x86_64:
1cc9fba74ceb042a050ed4b678c449be6e3d15590d94b74a70a8dc6c26b1f4a8  firefox-38.5.0-3.el7.centos.i686.rpm
a4fc56d9226dd2355fdf1966851214e989629411ec36db45bb07c3155eeab788  firefox-38.5.0-3.el7.centos.x86_64.rpm

Source:
d638045c394ac43ca2496402727b4f67b264d499230789d70786e5a7fc772f21  firefox-38.5.0-3.el7.centos.src.rpm
CentOS

CESA-2015:2655 Important CentOS 7 bind SecurityUpdate

CentOS Errata and Security Advisory 2015:2655 Important

Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-2655.html

The following updated files have been uploaded and are currently 
syncing to the mirrors: ( sha256sum Filename ) 

x86_64:
0811e5950fff3136324237fd5050fc1afc33bf6098e9582ffa24d6338be40109  bind-9.9.4-29.el7_2.1.x86_64.rpm
7bde727a4d71d040d556a1966dc53011d8edb62a3a4346ec96ce56b5b8745fd1  bind-chroot-9.9.4-29.el7_2.1.x86_64.rpm
14c0e86b12a2e01c11ddc0f5a8dc4bd3c1685812fd371013db68b2bd0d535232  bind-devel-9.9.4-29.el7_2.1.i686.rpm
2dd0d8ff832b23f76a1e622675b22fb5b38afb57dc928cb17506f25c91bf9e7a  bind-devel-9.9.4-29.el7_2.1.x86_64.rpm
1e9b1edb4f5c88d6a12d72fb15705be42954bdd8be4d8d90bdc243eede2a460f  bind-libs-9.9.4-29.el7_2.1.i686.rpm
389f32de98aac1cc921d1b363f0cff0c151afbd0c80429a5a868b57eb25072bf  bind-libs-9.9.4-29.el7_2.1.x86_64.rpm
58603812e909cb1e7ce163e194b07a85766ce284536687ee629fd9ee3e18f96f  bind-libs-lite-9.9.4-29.el7_2.1.i686.rpm
fef40afc6907ea696e34117e5f1cc645e5cc1358b44d17e828741e3a1281aca5  bind-libs-lite-9.9.4-29.el7_2.1.x86_64.rpm
ffde45946640f1e61e53761a73f7a2fd9a5ff712561d0e428f95afc0c2a00bef  bind-license-9.9.4-29.el7_2.1.noarch.rpm
bafbe09a17e085b6de6e57ac8599f7df830a45735cfde37de06ea6b4fb4a6f3c  bind-lite-devel-9.9.4-29.el7_2.1.i686.rpm
4a92101b1046af125612bf8a5d11f9e930393001fc9efe9e1a8f976ad975f13e  bind-lite-devel-9.9.4-29.el7_2.1.x86_64.rpm
dc4db225c6ed118d838ac40840d4533412404a3e7f1111f177b240389f507a55  bind-pkcs11-9.9.4-29.el7_2.1.x86_64.rpm
6d24bf0380b0e0f3dc0b9d85c02ad4ae7617b9e2fb16100587f7de2455b12cf4  bind-pkcs11-devel-9.9.4-29.el7_2.1.i686.rpm
1e129b2ee632a120ab25377b456d99e0479489d83bd899d449bd127cc39ca342  bind-pkcs11-devel-9.9.4-29.el7_2.1.x86_64.rpm
cf8f12f3c4cc92f5b65916f710a890a10492974028d77df62266df915d07baab  bind-pkcs11-libs-9.9.4-29.el7_2.1.i686.rpm
ea7489d41b54c7b93d1343751271c4ba9d92135813ac810c60e7f56aa4d68d2a  bind-pkcs11-libs-9.9.4-29.el7_2.1.x86_64.rpm
62a95dd610f6cd3a40e3afcbfb115cf389e723b799b97a324b6712b22e7ca9ee  bind-pkcs11-utils-9.9.4-29.el7_2.1.x86_64.rpm
a942794f95d3430be3136478496c1dd50a5bb990cb37c50760615d65aaa20baa  bind-sdb-9.9.4-29.el7_2.1.x86_64.rpm
695716a3242cd0040f0179a305dc03b0dbcdc9ed6e6c9590ba53b85ae05f2666  bind-sdb-chroot-9.9.4-29.el7_2.1.x86_64.rpm
85435442931d8056bf16075dc3c71f6c7ccaa39a0f093e891e862d7d82a9d4ef  bind-utils-9.9.4-29.el7_2.1.x86_64.rpm

Source:
6fa9ac7f31b1c4aa24e372f978f7830924ec2a9c17a1b2fc781939b8a28b7b7d  bind-9.9.4-29.el7_2.1.src.rpm
Full Disclosure

Executable installers are vulnerable^WEVIL (case 10): McAfee Security Scan Plus, WebAdvisor and CloudAV (Beta)

Posted by Stefan Kanthak on Dec 16

Hi @ll,

several McAfee “security” products, most notably their Security Scan
Plus (see <http://seclists.org/fulldisclosure/2014/Apr/226> for a
previous advisory) which Adobe pushes to unsuspecting users of Adobe
Reader and Flash Player, are offered as executable installers built
with the vulnerable Nullsoft Scriptable Install System (NSIS) (see
<http://seclists.org/fulldisclosure/2015/Dec/32> for details).

These executable…

Full Disclosure

Executable installers are vulnerable^WEVIL (case 11): Nmap <7.01 and Nmap-WinPcap <4.13

Posted by Stefan Kanthak on Dec 16

Hi @ll,

the executable installers of Nmap-7.00 and prior versions (see
<https://nmap.org/download.html>) as well as WinPcap-Nmap-4.12 and
prior versions (included in nmap-7.00-win32.zip and prior versions)
are built with the vulnerable Nullsoft Scriptable Install System
(NSIS) (see <http://seclists.org/fulldisclosure/2015/Dec/32> for
details).

These executable installers are vulnerable and allow arbitrary
(remote) code execution and…

Full Disclosure

User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness

Posted by halfdog on Dec 16

Hello List,

This ([1]) is a short article how to use the setgid directory
/var/cache/man to escalate privileges from man/man to man/root on Ubuntu
Vivid and to root/root via the “catman” cron job [2]. In my opinion this
is not a really big issue, but I had quite fun analyzing it and writing
a tool to use SUID-binaries to create arbitrary SGID-binaries. So
perhaps someone else might have fun reading the article and reproducing
the…

Full Disclosure

Two bytes change and you have a zero day

Posted by Hossein Lotfi on Dec 16

Hello everyone,

The details of MS15-130 is now public.
http://blogs.flexerasoftware.com/vulnerability-management/2015/12/vulnerability-in-microsofts-unicode-scripts-processor-allows-execution-of-arbitrary-code.html

If interested, you can find more analyzing in the following links:

Yet Another Windows GDI Story – MS15-035:
http://blogs.flexerasoftware.com/vulnerability-management/2015/04/yet-another-windows-gdi-story.html

In memory of a…