Lots of Asterisk vulnerabilities in this summary :-( ____________ Steven Donegan KK6IVC SSCC/NORC Life Member, Car #86 www.sscc.us ----- Forwarded Message ----- From: SecurityTracker <newsletters@SECURITYTRACKER.COM> To: SECURITYTRACKER-WEEKLY-ALL@PEACH.EASE.LSOFT.COM Sent: Monday, November 24, 2014 1:10 AM Subject: Weekly Vulnerability Summary - Nov 24 2014 SecurityTracker Monday Morning Vulnerability Summary - Nov 24 2014 http://www.securitytracker.com If you run a web site and would like to publish SecurityTracker vulnerability headlines on your web site for free, then join our Affiliate Program: http://securitytracker.com/affiliate/affiliate_signup.html Subscriptions to this newsletter are available for free. Just visit our web site to sign up: http://www.securitytracker.com/signup/signup_now.html ------------------------------------------------------------------------ In This Week's SecurityTracker Vulnerability Summary SecurityTracker Alerts: 22 Vendors: Apple Computer - Cisco - Digium (Linux Support Services) - drupal.org - F5 Networks - Google - Microsoft - moodle.org - rubyforge.org - Tcpdump.org - wordpress.org Products: Aironet - Apple iOS - Apple TV - Asterisk - Cisco IOS - Cisco Unified Communications Manager - Drupal - F5 BIG-IP - Google Chrome - Kerberos - Mac OS X - Moodle - Rails - Tcpdump - WordPress Headlines: 1. WordPress Bugs Let Remote Users Conduct Cross-Site Scripting, Cross-Site Request Forgery, and Denial of Service Attacks 2. Moodle Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks 3. Cisco Aironet DHCP Lease Renewal Flaw Lets Remote Users Deny Service 4. Rails Action Pack Bug Lets Remote Users Determine if Specified Files Exist on the Target System 5. Tcpdump Multiple Flaws Let Remote Users Deny Service 6. Asterisk CONFBRIDGE Lets Remote Authenticated Users Execute Arbitrary System Commands 7. Asterisk DB Dialplan Function Lets Remote Authenticated Users Gain Elevated Privileges 8. Asterisk PJSIP Channel Driver Flaw in res_pjsip_refer Module Lets Remote Users Deny Service 9. Microsoft Windows Kerberos KDC Signature Validation Flaw Lets Remote Authenticated Users 10. Cisco IOS DLSw Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information 11. Apple TV Bugs Let Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges 12. Asterisk PJSIP Channel Driver Race Condition Lets Remote Users Deny Service 13. Asterisk ConfBridge State Transition Error Lets Remote Users Deny Service 14. Cisco Unified Communications Manager IM and Presence Service Discloses Valid Usernames to Remote Users 15. Apple iOS Lets Local Users Bypass Access Controls and Remote Applications Launch Arbitrary Binaries 16. Drupal Bugs Let Remote Users Highjack User Sessions and Deny Service 17. Cisco Aironet EAP Processing Error Lets Remote Users Deny Service 18. Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Information 19. Apple OS X Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information 20. F5 BIG-IP Lets Remote Authenticated Users Delete Files on the Target System 21. Asterisk PJSIP ACL Bug Lets Remote Users Bypass Access Controls 22. Asterisk IP Address Checking Flaw Lets Remote Users Bypass Access Controls in Certain Cases ------------------------------------------------------------------------ Your SecurityTracker Vulnerability Alerts 1. WordPress Vendor: wordpress.org Several vulnerabilities were reported in WordPress. A remote user can cause denial of service conditions. A remote user can conduct cross-site scripting attacks. A remote user can conduct cross-site request forgery attacks. A remote user can compromise a target user's account. Impact: Denial of service via network Alert: http://securitytracker.com/id/1031243 2. Moodle Vendor: moodle.org Multiple vulnerabilities were reported in Moodle. A remote user can conduct cross-site scripting attacks. A remote user can conduct cross-site request forgery attacks. A remote authenticated user can obtain potentially sensitive information. Impact: Disclosure of authentication information Alert: http://securitytracker.com/id/1031215 3. Aironet Vendor: Cisco A vulnerability was reported in Cisco Aironet. A remote user can cause denial of service conditions. Impact: Denial of service via network Alert: http://securitytracker.com/id/1031218 4. Rails Vendor: rubyforge.org A vulnerability was reported in Rails. A remote user can determine whether specified files exist on the target system. Impact: Disclosure of system information Alert: http://securitytracker.com/id/1031217 5. Tcpdump Vendor: Tcpdump.org Several vulnerabilities were reported in Tcpdump. A remote user can cause denial of service conditions. Impact: Denial of service via network Alert: http://securitytracker.com/id/1031235 6. Asterisk Vendor: Digium (Linux Support Services) A vulnerability was reported in Asterisk. A remote authenticated user can gain elevated privileges on the target system. Impact: Execution of arbitrary code via network Alert: http://securitytracker.com/id/1031250 7. Asterisk Vendor: Digium (Linux Support Services) A vulnerability was reported in Asterisk. A remote authenticated user can execute arbitrary code on the target system. Impact: User access via network Alert: http://securitytracker.com/id/1031251 8. Asterisk Vendor: Digium (Linux Support Services) A vulnerability was reported in Asterisk. A remote user can cause denial of service conditions. Impact: Denial of service via network Alert: http://securitytracker.com/id/1031249 9. Kerberos Vendor: Microsoft A vulnerability was reported in Microsoft Windows Kerberos. A remote authenticated user can gain elevated privileges. Impact: User access via network Alert: http://securitytracker.com/id/1031237 10. Cisco IOS Vendor: Cisco A vulnerability was reported in Cisco IOS. A remote user can obtain potentially sensitive information. Impact: Disclosure of authentication information Alert: http://securitytracker.com/id/1031220 11. Apple TV Vendor: Apple Computer Several vulnerabilities were reported in Apple TV. A remote user can execute arbitrary code on the target system. A local user can obtain elevated privileges on the target system. Impact: Execution of arbitrary code via local system Alert: http://securitytracker.com/id/1031231 12. Asterisk Vendor: Digium (Linux Support Services) A vulnerability was reported in Asterisk. A remote user can cause denial of service conditions. Impact: Denial of service via network Alert: http://securitytracker.com/id/1031248 13. Asterisk Vendor: Digium (Linux Support Services) A vulnerability was reported in Asterisk. A remote user can cause denial of service conditions. Impact: Denial of service via network Alert: http://securitytracker.com/id/1031247 14. Cisco Unified Communications Manager Vendor: Cisco A vulnerability was reported in Cisco Unified Communications Manager IM and Presence Service. A remote user can determine valid usernames on the target system. Impact: Disclosure of system information Alert: http://securitytracker.com/id/1031240 15. Apple iOS Vendor: Apple Computer Several vulnerabilities were reported in Apple iOS. A physically local user can bypass access controls. An application can launch arbitrary binaries on the target system. Impact: Execution of arbitrary code via local system Alert: http://securitytracker.com/id/1031232 16. Drupal Vendor: drupal.org Two vulnerabilities were reported in Drupal. A remote user can hijack another user's session. A remote user can cause denial of service conditions. Impact: Denial of service via network Alert: http://securitytracker.com/id/1031244 17. Aironet Vendor: Cisco A vulnerability was reported in Cisco Aironet. A remote user can cause denial of service conditions. Impact: Denial of service via network Alert: http://securitytracker.com/id/1031219 18. Google Chrome Vendor: Google Multiple vulnerabilities were reported in Google Chrome. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can obtain potentially sensitive information. Impact: Disclosure of system information Alert: http://securitytracker.com/id/1031241 19. Mac OS X Vendor: Apple Computer Several vulnerabilities were reported in Apple OS X. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can obtain potentially sensitive information. Impact: Disclosure of system information Alert: http://securitytracker.com/id/1031230 20. F5 BIG-IP Vendor: F5 Networks A vulnerability was reported in F5 BIG-IP. A remote authenticated user can delete files on the target system. Impact: Denial of service via network Alert: http://securitytracker.com/id/1031216 21. Asterisk Vendor: Digium (Linux Support Services) A vulnerability was reported in Asterisk. A remote user can bypass access controls. Impact: Host/resource access via network Alert: http://securitytracker.com/id/1031246 22. Asterisk Vendor: Digium (Linux Support Services) A vulnerability was reported in Asterisk. A remote user can bypass access controls. Impact: Host/resource access via network Alert: http://securitytracker.com/id/1031245 ------------------------------------------------------------------------ To join, delete, or otherwise change your subscription, visit: http://www.securitytracker.com/help/accounts.html To contact us, send e-mail to help@securitytracker.com (mailto:help@securitytracker.com) If you need to refer to this weekly vulnerability summary when you mail us, please provide us with following SecurityTracker message ID: <WS.ALL.2014Nov24.2244.235812.XND> Keep Track of the Latest Vulnerabilities with SecurityTracker! http://www.securitytracker.com copyright 2014, SecurityGlobal.net LLC See disclaimer notice at: http://www.securitytracker.com/learn/disclaimer.html ------------------------------------------------------------------------ ############################ To unsubscribe from the SECURITYTRACKER-WEEKLY-ALL list: write to: mailto:SECURITYTRACKER-WEEKLY-ALL-SIGNOFF-REQUEST@PEACH.EASE.LSOFT.COM or click the following link: http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=SECURITYTRACKER-WEEK...