SecurityTracker Monday Morning Vulnerability Summary - Nov 24 2014
http://www.securitytracker.com If you run a web site and would like to publish SecurityTracker
vulnerability headlines on your web site for free, then join our
Affiliate Program:
http://securitytracker.com/affiliate/affiliate_signup.htmlSubscriptions to this newsletter are available for free. Just visit
our web site to sign up:
http://www.securitytracker.com/signup/signup_now.html ------------------------------------------------------------------------
In This Week's SecurityTracker Vulnerability Summary
SecurityTracker Alerts: 22
Vendors: Apple Computer - Cisco - Digium (Linux Support
Services) - drupal.org - F5 Networks - Google - Microsoft -
moodle.org - rubyforge.org - Tcpdump.org - wordpress.org
Products: Aironet - Apple iOS - Apple TV - Asterisk - Cisco
IOS - Cisco Unified Communications Manager - Drupal - F5
BIG-IP - Google Chrome - Kerberos - Mac OS X - Moodle - Rails
- Tcpdump - WordPress
Headlines:
1. WordPress Bugs Let Remote Users Conduct Cross-Site
Scripting, Cross-Site Request Forgery, and Denial of Service
Attacks
2. Moodle Bugs Permit Cross-Site Scripting, Cross-Site
Request Forgery, and Information Disclosure Attacks
3. Cisco Aironet DHCP Lease Renewal Flaw Lets Remote
Users Deny Service
4. Rails Action Pack Bug Lets Remote Users Determine
if Specified Files Exist on the Target System
5. Tcpdump Multiple Flaws Let Remote Users Deny Service
6. Asterisk CONFBRIDGE Lets Remote Authenticated Users
Execute Arbitrary System Commands
7. Asterisk DB Dialplan Function Lets Remote
Authenticated Users Gain Elevated Privileges
8. Asterisk PJSIP Channel Driver Flaw in
res_pjsip_refer Module Lets Remote Users Deny Service
9. Microsoft Windows Kerberos KDC Signature Validation
Flaw Lets Remote Authenticated Users
10. Cisco IOS DLSw Processing Flaw Lets Remote Users
Obtain Potentially Sensitive Information
11. Apple TV Bugs Let Remote Users Execute Arbitrary
Code and Local Users Gain Elevated Privileges
12. Asterisk PJSIP Channel Driver Race Condition Lets
Remote Users Deny Service
13. Asterisk ConfBridge State Transition Error Lets
Remote Users Deny Service
14. Cisco Unified Communications Manager IM and
Presence Service Discloses Valid Usernames to Remote Users
15. Apple iOS Lets Local Users Bypass Access Controls
and Remote Applications Launch Arbitrary Binaries
16. Drupal Bugs Let Remote Users Highjack User
Sessions and Deny Service
17. Cisco Aironet EAP Processing Error Lets Remote
Users Deny Service
18. Google Chrome Multiple Bugs Let Remote Users
Execute Arbitrary Code and Obtain Information
19. Apple OS X Bugs Let Remote Users Execute
Arbitrary Code and Obtain Potentially Sensitive Information
20. F5 BIG-IP Lets Remote Authenticated Users Delete
Files on the Target System
21. Asterisk PJSIP ACL Bug Lets Remote Users Bypass
Access Controls
22. Asterisk IP Address Checking Flaw Lets Remote
Users Bypass Access Controls in Certain Cases
------------------------------------------------------------------------
Your SecurityTracker Vulnerability Alerts
1. WordPress
Vendor: wordpress.org
Several vulnerabilities were reported in WordPress. A remote
user can cause denial of service conditions. A remote user can
conduct cross-site scripting attacks. A remote user can conduct
cross-site request forgery attacks. A remote user can compromise a
target user's account.
Impact: Denial of service via network
Alert:
http://securitytracker.com/id/1031243 2. Moodle
Vendor: moodle.org
Multiple vulnerabilities were reported in Moodle. A remote user
can conduct cross-site scripting attacks. A remote user can conduct
cross-site request forgery attacks. A remote authenticated user can
obtain potentially sensitive information.
Impact: Disclosure of authentication information
Alert:
http://securitytracker.com/id/1031215 3. Aironet
Vendor: Cisco
A vulnerability was reported in Cisco Aironet. A remote user
can cause denial of service conditions.
Impact: Denial of service via network
Alert:
http://securitytracker.com/id/1031218 4. Rails
Vendor: rubyforge.org
A vulnerability was reported in Rails. A remote user can
determine whether specified files exist on the target system.
Impact: Disclosure of system information
Alert:
http://securitytracker.com/id/1031217 5. Tcpdump
Vendor: Tcpdump.org
Several vulnerabilities were reported in Tcpdump. A remote user
can cause denial of service conditions.
Impact: Denial of service via network
Alert:
http://securitytracker.com/id/1031235 6. Asterisk
Vendor: Digium (Linux Support Services)
A vulnerability was reported in Asterisk. A remote
authenticated user can gain elevated privileges on the target system.
Impact: Execution of arbitrary code via network
Alert:
http://securitytracker.com/id/1031250 7. Asterisk
Vendor: Digium (Linux Support Services)
A vulnerability was reported in Asterisk. A remote
authenticated user can execute arbitrary code on the target system.
Impact: User access via network
Alert:
http://securitytracker.com/id/1031251 8. Asterisk
Vendor: Digium (Linux Support Services)
A vulnerability was reported in Asterisk. A remote user can
cause denial of service conditions.
Impact: Denial of service via network
Alert:
http://securitytracker.com/id/1031249 9. Kerberos
Vendor: Microsoft
A vulnerability was reported in Microsoft Windows Kerberos. A
remote authenticated user can gain elevated privileges.
Impact: User access via network
Alert:
http://securitytracker.com/id/1031237 10. Cisco IOS
Vendor: Cisco
A vulnerability was reported in Cisco IOS. A remote user can
obtain potentially sensitive information.
Impact: Disclosure of authentication information
Alert:
http://securitytracker.com/id/1031220 11. Apple TV
Vendor: Apple Computer
Several vulnerabilities were reported in Apple TV. A remote
user can execute arbitrary code on the target system. A local user
can obtain elevated privileges on the target system.
Impact: Execution of arbitrary code via local system
Alert:
http://securitytracker.com/id/1031231 12. Asterisk
Vendor: Digium (Linux Support Services)
A vulnerability was reported in Asterisk. A remote user can
cause denial of service conditions.
Impact: Denial of service via network
Alert:
http://securitytracker.com/id/1031248 13. Asterisk
Vendor: Digium (Linux Support Services)
A vulnerability was reported in Asterisk. A remote user can
cause denial of service conditions.
Impact: Denial of service via network
Alert:
http://securitytracker.com/id/1031247 14. Cisco Unified Communications Manager
Vendor: Cisco
A vulnerability was reported in Cisco Unified Communications
Manager IM and Presence Service. A remote user can determine valid
usernames on the target system.
Impact: Disclosure of system information
Alert:
http://securitytracker.com/id/1031240 15. Apple iOS
Vendor: Apple Computer
Several vulnerabilities were reported in Apple iOS. A
physically local user can bypass access controls. An application
can launch arbitrary binaries on the target system.
Impact: Execution of arbitrary code via local system
Alert:
http://securitytracker.com/id/1031232 16. Drupal
Vendor: drupal.org
Two vulnerabilities were reported in Drupal. A remote user can
hijack another user's session. A remote user can cause denial of
service conditions.
Impact: Denial of service via network
Alert:
http://securitytracker.com/id/1031244 17. Aironet
Vendor: Cisco
A vulnerability was reported in Cisco Aironet. A remote user
can cause denial of service conditions.
Impact: Denial of service via network
Alert:
http://securitytracker.com/id/1031219 18. Google Chrome
Vendor: Google
Multiple vulnerabilities were reported in Google Chrome. A
remote user can cause arbitrary code to be executed on the target
user's system. A remote user can obtain potentially sensitive
information.
Impact: Disclosure of system information
Alert:
http://securitytracker.com/id/1031241 19. Mac OS X
Vendor: Apple Computer
Several vulnerabilities were reported in Apple OS X. A remote
user can cause arbitrary code to be executed on the target user's
system. A remote user can obtain potentially sensitive information.
Impact: Disclosure of system information
Alert:
http://securitytracker.com/id/1031230 20. F5 BIG-IP
Vendor: F5 Networks
A vulnerability was reported in F5 BIG-IP. A remote
authenticated user can delete files on the target system.
Impact: Denial of service via network
Alert:
http://securitytracker.com/id/1031216 21. Asterisk
Vendor: Digium (Linux Support Services)
A vulnerability was reported in Asterisk. A remote user can
bypass access controls.
Impact: Host/resource access via network
Alert:
http://securitytracker.com/id/1031246 22. Asterisk
Vendor: Digium (Linux Support Services)
A vulnerability was reported in Asterisk. A remote user can
bypass access controls.
Impact: Host/resource access via network
Alert:
http://securitytracker.com/id/1031245 ------------------------------------------------------------------------
To join, delete, or otherwise change your subscription, visit:
http://www.securitytracker.com/help/accounts.html To contact us, send e-mail to
help@securitytracker.com (mailto:
help@securitytracker.com)
If you need to refer to this weekly vulnerability summary when you
mail us, please provide us with following SecurityTracker message ID:
<WS.ALL.2014Nov24.2244.235812.XND>
Keep Track of the Latest Vulnerabilities with SecurityTracker!
http://www.securitytracker.com copyright 2014, SecurityGlobal.net LLC
See disclaimer notice at:
http://www.securitytracker.com/learn/disclaimer.html ------------------------------------------------------------------------
############################
To unsubscribe from the SECURITYTRACKER-WEEKLY-ALL list:
write to: mailto:
SECURITYTRACKER-WEEKLY-ALL-SIGNOFF-REQUEST@PEACH.EASE.LSOFT.COMor click the following link:
http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=SECURITYTRACKER-WEEKLY-ALL&A=1