CVE-2017-10053 Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Monitoring

漏洞类别:Local

漏洞等级:

漏洞信息

IBM Tivoli Monitoring automates monitoring of essential system resources to detect bottlenecks and potential problems.

There are several vulnerabilities in IBM SDK Java Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring (ITM) component :
-An unspecified vulnerability in Oracle Java SE related to the Java SE Deployment component could allow an unauthenticated attacker to take control of the system.:
-A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges.

AFFECTED PRODUCTS AND VERSIONS:
The following components of IBM Tivoli Monitoring (ITM) are affected by this bulletin:
-Java (CANDLEHOME) ITM 6.2.3 Fix Pack 1 (JRE 1.6) through 6.3.0 Fix Pack 7 (JRE 7)
-Java (Tivoli Enterprise Portal client browser or webstart) ITM 6.2.3 Fix pack 1 through 6.3.0 Fix Pack 7

QID Detection Logic(Authenticated)
It checks for vulnerable versions of IBM Tivoli Monitoring (ITM)

漏洞危害

Successful exploitation allows remote attackers to take control of the system.:

解决方案

Vendor has released a patch to fix this vulnerability. More information can be obtained from IBM Security Bulletin.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

IBM Security Bulletin: Windows

0daybank

CVE-2014-8361 Realtek SDK Command Injection Remote Code Execution Vulnerability.

漏洞类别:Hardware

漏洞等级:

漏洞信息

Realtek provides Full Range of Connectivity, Multimedia, and Consumer Electronics Solutions.

Realtek SDK Miniigd UPnP SOAP Command Execution. Different devices using the Realtek SDK with the miniigd daemon are vulnerable to OS command injection in the UPnP SOAP interface. Failed exploit attempts will result in a denial-of-service condition.

Affected Product:
rtl81xx SDK

QID Detection Logic (UN-Authenticated)
This checks for HTTP header in response received from devices.

漏洞危害

On successful exploitation it allows remote attackers to execute arbitrary code on vulnerable installations of the Realtek SDK.

解决方案

No solution is available at the time of entry.

Workaround:
Restrict interaction with the service to trusted machines.

0daybank

CVE-2017-15429 Red Hat Update for chromium-browser (RHSA-2017:3479)

漏洞类别:RedHat

漏洞等级:

漏洞信息

Chromium is an open-source web browser, powered by WebKit (Blink).

A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-15429)

Affected Products:
Red Hat Enterprise Linux Server 6 x86_64
Red Hat Enterprise Linux Server 6 i386
Red Hat Enterprise Linux Workstation 6 x86_64
Red Hat Enterprise Linux Workstation 6 i386
Red Hat Enterprise Linux Desktop 6 x86_64
Red Hat Enterprise Linux Desktop 6 i386

漏洞危害

A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim.

解决方案

Upgrade to the latest packages which contain a patch. Refer to Applying Package Updates to RHEL system for details.

Refer to Red Hat security advisory RHSA-2017:3479 to address this issue and obtain more information.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

RHSA-2017:3479: Red Hat Enterprise Linux

0daybank

CVE-2017-14746 Fedora Security Update for samba (FEDORA-2017-366046c758)

漏洞类别:Fedora

漏洞等级:

漏洞信息

Fedora has released security update for samba to fix the vulnerability.

Affected OS:
Fedora 26

漏洞危害

Successful exploitation allows attacker to compromise the system.

解决方案

Fedora has issued updated packages to fix this vulnerability.

For more information about the vulnerability and obtaining patches, refer to the following Fedora security advisories :
Fedora 26 Update

Patch:
Following are links for downloading patches to fix the vulnerabilities:

FEDORA-2017-366046c758: Fedora 26

0daybank

CVE-2017-15429 Google Chrome Prior to 63.0.3239.108 UXSS Vulnerability

漏洞类别:Local

漏洞等级:

漏洞信息

Google Chrome is a web browser for multiple platforms developed by Google.

This Google Chrome update fixes the following vulnerability:
CVE-2017-15429: UXSS in V8

Affected Versions:
Google Chrome prior to 63.0.3239.108

QID Detection Logic(Authenticated)
It checks for vulnerable version of Google Chrome.

漏洞危害

Successful exploitation of these vulnerabilities could allow a remote attacker to exploit in the browser itself or in the browser plugins.

解决方案

Customers are advised to upgrade to Google Chrome 63.0.3239.108 or a later version.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Google Chrome: MAC OS X

Google Chrome: Windows

0daybank

CVE-2017-12356 Cisco Jabber Multiple Cross-Site Scripting Vulnerabilities

漏洞类别:Local

漏洞等级:

漏洞信息

Cisco Jabber for Windows is a unified communications client within the Cisco Jabber suite of collaboration software.

The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface.

Affected Software:
Cisco Jabber for Windows versions prior to 11.9(2)

QID Detection Logic (authenticated):
This QID looks for the vulnerable version of "CiscoJabber.exe".

漏洞危害

A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.

解决方案

Customers are advised to consult Cisco bug ID CSCvf79088, CSCvf79080, CSCvf50378 andCSCvg56018 for remediation purposes.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Cisco Jabber 11.9(2) or later: Windows

0daybank

CVE-2017-1000364 McAfee Web Gateway Multiple Vulnerabilities (SB10205)

漏洞类别:CGI

漏洞等级:

漏洞信息

McAfee Web Gateway Anti-Malware Engine, part of McAfee Web Protection, is a powerful in-line technology designed to protect against contemporary threats delivered via HTTP and HTTPS channels, taking web exploit detection, zero-day, and targeted threat prevention to the next level.

McAfee Web Gateway uses a version of 'glibc' which was found vulnerable to stack guard page bypass and arbitrary code execution via LD_LIBRARY_PATH values.

Affected Versions:
McAfee Web Gateway prior to version 7.6.2.16
McAfee Web Gateway prior to version 7.7.2.4

QID Detection Logic:
This QID retrieves McAfee Web Gateway version over port 9090 and checks to see if it's vulnerable.

漏洞危害

An unauthenticated attacker could exploit this vulnerability to execute arbitrary code on the system.

解决方案

Please refer to McAfee Security Bulletin SB10205 for more details.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

SNS936

SNS937

0daybank

CVE-2017-11188 SUSE Enterprise Linux Security Update for ImageMagick (SUSE-SU-2017:3388-1)

漏洞类别:SUSE

漏洞等级:

漏洞信息

SUSE has released security update for imagemagick to fix the vulnerabilities.

Affected Products:
SUSE Linux Enterprise Software Development Kit 12-SP3
SUSE Linux Enterprise Software Development Kit 12-SP2
SUSE Linux Enterprise Server 12-SP3
SUSE Linux Enterprise Server 12-SP2
SUSE Linux Enterprise Desktop 12-SP3
SUSE Linux Enterprise Desktop 12-SP2

漏洞危害

This vulnerability could be exploited to gain partial access to sensitive information. Malicious users could also use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability.

解决方案

Upgrade to the latest packages which contain a patch. To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product.

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2017:3388-1 to address this issue and obtain further details.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

SUSE-SU-2017:3388-1: SUSE Enterprise Linux

0daybank

CVE-2017-11188 SUSE Enterprise Linux Security Update for ImageMagick (SUSE-SU-2017:3378-1)

漏洞类别:SUSE

漏洞等级:

漏洞信息

SUSE has released security update for imagemagick to fix the vulnerabilities.

Affected Products:
SUSE Linux Enterprise Software Development Kit 11-SP4
SUSE Linux Enterprise Server 11-SP4

漏洞危害

This vulnerability could be exploited to gain partial access to sensitive information. Malicious users could also use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability.

解决方案

Upgrade to the latest packages which contain a patch. To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product.

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2017:3378-1 to address this issue and obtain further details.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

SUSE-SU-2017:3378-1: SUSE Enterprise Linux

0daybank

CVE-2017-3737 SUSE Enterprise Linux Security Update for openssl (SUSE-SU-2017:3343-1)

漏洞类别:SUSE

漏洞等级:

漏洞信息

SUSE has released security update for openssl to fix the vulnerabilities.

Affected Products:
SUSE Linux Enterprise Software Development Kit 12-SP3
SUSE Linux Enterprise Software Development Kit 12-SP2
SUSE Linux Enterprise Server 12-SP3
SUSE Linux Enterprise Server 12-SP2
SUSE Linux Enterprise Desktop 12-SP3
SUSE Linux Enterprise Desktop 12-SP2

漏洞危害

This vulnerability could be exploited to gain partial access to sensitive information.

解决方案

Upgrade to the latest packages which contain a patch. To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product.

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2017:3343-1 to address this issue and obtain further details.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

SUSE-SU-2017:3343-1: SUSE Enterprise Linux

0daybank