AusCERT Week in Review
24 September 2010
AusCERT in the Media:
---------------------
Papers, Articles and other documents:
-------------------------------------
Title: New version of Shibboleth 2.2.0
Date: 24 September 2010
URL: http://www.auscert.org.au/13395
Title: New public vulnerability in Microsoft ASP.NET with workarounds.
Date: 18 September 2010
URL: http://www.auscert.org.au/13367
Web Log Entries:
----------------
Title: OpenX - website revenue, or website regret?
Date: 23 September 2010
URL: http://www.auscert.org.au/13386
Alerts, Advisories and Updates:
-------------------------------
Title: ASB-2010.0215 - [Win] Alcatel-Lucent OmniTouch CCAgent: Denial of
service - Remote/unauthenticated
Date: 22 September 2010
URL: http://www.auscert.org.au/13384
Title: ASB-2010.0216.2 - UPDATE [Win][Linux][HP-UX][Solaris][AIX] IBM
WebSphere Application Server 6.1: Denial of service - Remote with user
interaction
Date: 22 September 2010
URL: http://www.auscert.org.au/13385
Title: ASB-2010.0214 - ALERT [Win] Microsoft ASP.NET
Date: 21 September 2010
URL: http://www.auscert.org.au/13374
External Security Bulletins:
----------------------------
Title: ESB-2010.0869 - [Win][Linux] HP System Management Homepage (SMH):
Access confidential data - Remote/unauthenticated
Date: 24 September 2010
OS: Windows 2003, Red Hat Linux, Windows 7, Ubuntu, Debian GNU/Linux,
HP-UX, Windows XP, SUSE, Windows 2000, Windows Vista, Windows Server
2008, Other Linux Variants
URL: http://www.auscert.org.au/13399
Title: ESB-2010.0868 - [Win][Linux] HP System Management Homepage (SMH):
Provide misleading information - Remote with user interaction
Date: 24 September 2010
OS: Windows 2003, Red Hat Linux, Windows 7, Ubuntu, Debian GNU/Linux,
HP-UX, Windows XP, SUSE, Windows 2000, Windows Vista, Windows Server
2008, Other Linux Variants
URL: http://www.auscert.org.au/13398
Title: ESB-2010.0867 - [Win][Linux] HP System Management Homepage (SMH) :
Provide misleading information - Remote/unauthenticated
Date: 24 September 2010
OS: Windows 2003, Red Hat Linux, Windows 7, Ubuntu, Debian GNU/Linux,
HP-UX, Windows XP, SUSE, Windows 2000, Windows Vista, Windows Server
2008, Other Linux Variants
URL: http://www.auscert.org.au/13397
Title: ESB-2010.0866 - [Win][RedHat][HP-UX][Solaris] HP OpenView Network Node
Manager (OV NNM): Denial of service - Remote/unauthenticated
Date: 24 September 2010
OS: Solaris, Red Hat Linux, Windows 2003, HP-UX, Windows XP, Windows 2000,
Windows 7, Windows Vista, Windows Server 2008
URL: http://www.auscert.org.au/13396
Title: ESB-2010.0865 - [Win][UNIX/Linux] RSA Authentication Agent 7.0 for Web:
Access confidential data - Remote/unauthenticated
Date: 23 September 2010
OS: IRIX, HP Tru64 UNIX, Solaris, Red Hat Linux, Windows 2003, Windows 7,
Mac OS X, Ubuntu, Debian GNU/Linux, HP-UX, Windows XP, Other BSD
Variants, SUSE, OpenBSD, Windows 2000, AIX, FreeBSD, Windows Vista,
Other Linux Variants, Windows Server 2008
URL: http://www.auscert.org.au/13394
Title: ESB-2010.0864 - [RedHat] kernel-2.6.18: Increased privileges - Existing
account
Date: 23 September 2010
OS: Red Hat Linux
URL: http://www.auscert.org.au/13393
Title: ESB-2010.0863 - [Cisco] Cisco IOS Software NAT: Denial of service -
Remote/unauthenticated
Date: 23 September 2010
OS: Cisco Products
URL: http://www.auscert.org.au/13392
Title: ESB-2010.0862 - [Cisco] Cisco IOS Software Internet Group Management
Protocol: Denial of service - Remote/unauthenticated
Date: 23 September 2010
OS: Cisco Products
URL: http://www.auscert.org.au/13391
Title: ESB-2010.0861 - [Cisco] Cisco IOS Software H.323: Denial of service -
Remote/unauthenticated
Date: 23 September 2010
OS: Cisco Products
URL: http://www.auscert.org.au/13390
Title: ESB-2010.0860 - [Cisco] Cisco IOS Software Session Initiation Protocol:
Denial of service - Remote/unauthenticated
Date: 23 September 2010
OS: Cisco Products
URL: http://www.auscert.org.au/13389
Title: ESB-2010.0859 - [Cisco] Cisco IOS SSL VPN: Denial of service -
Remote/unauthenticated
Date: 23 September 2010
OS: Cisco Products
URL: http://www.auscert.org.au/13388
Title: ESB-2010.0858 - [Cisco] Cisco Unified Communications Manager: Denial of
service - Remote/unauthenticated
Date: 23 September 2010
OS: Cisco Products
URL: http://www.auscert.org.au/13387
Title: ESB-2010.0857 - [SUSE] SUSE: Unauthorised access - Unknown/unspecified
Date: 22 September 2010
OS: SUSE
URL: http://www.auscert.org.au/13383
Title: ESB-2010.0856 - [RedHat] flash-plugin: Execute arbitrary code/commands
- Remote with user interaction
Date: 22 September 2010
OS: Red Hat Linux
URL: http://www.auscert.org.au/13382
Title: ESB-2010.0855 - [RedHat] kernel: Increased privileges - Existing
account
Date: 22 September 2010
OS: Red Hat Linux
URL: http://www.auscert.org.au/13381
Title: ESB-2010.0854 - [RedHat] bzip2: Execute arbitrary code/commands -
Remote with user interaction
Date: 21 September 2010
OS: Red Hat Linux
URL: http://www.auscert.org.au/13380
Title: ESB-2010.0853 - [Win][UNIX/Linux] OTRS 2.4.x, OTRS 2.3.x: Denial of
service - Remote/unauthenticated
Date: 21 September 2010
OS: IRIX, HP Tru64 UNIX, Solaris, Windows 2003, Red Hat Linux, Windows 7,
Mac OS X, Ubuntu, Debian GNU/Linux, Windows XP, HP-UX, Other BSD
Variants, SUSE, Windows 2000, OpenBSD, AIX, Windows Vista, FreeBSD,
Windows Server 2008, Other Linux Variants
URL: http://www.auscert.org.au/13379
Title: ESB-2010.0852 - ALERT [Win][UNIX/Linux] US-CERT: Adobe Flash
Vulnerabilities
Date: 21 September 2010
OS: HP Tru64 UNIX, Solaris, IRIX, OpenBSD, Other BSD Variants, FreeBSD,
HP-UX, SUSE, Ubuntu, Debian GNU/Linux, Other Linux Variants, Red Hat
Linux, AIX, Windows 7, Windows Server 2008, Windows Vista, Windows
2003, Windows 2000, Windows XP, Mac OS X
URL: http://www.auscert.org.au/13378
Title: ESB-2010.0851 - [FreeBSD] bzip2: Execute arbitrary code/commands -
Remote/unauthenticated
Date: 21 September 2010
OS: FreeBSD
URL: http://www.auscert.org.au/13377
Title: ESB-2010.0850 - [Linux][Debian] bzip2: Execute arbitrary code/commands
- Existing account
Date: 21 September 2010
OS: Red Hat Linux, Debian GNU/Linux, Ubuntu, SUSE, Other Linux Variants
URL: http://www.auscert.org.au/13375
Title: ESB-2010.0849 - [Win][UNIX/Linux][Debian] drupal6: Multiple
vulnerabilities
Date: 21 September 2010
OS: Red Hat Linux, Solaris, HP Tru64 UNIX, IRIX, Windows 2003, Windows 7,
Mac OS X, Debian GNU/Linux, Ubuntu, HP-UX, Windows XP, Other BSD
Variants, SUSE, OpenBSD, Windows 2000, AIX, FreeBSD, Windows Vista,
Other Linux Variants, Windows Server 2008
URL: http://www.auscert.org.au/13373
Title: ESB-2010.0848 - [Mac][OSX] AFP Server: Access confidential data -
Remote/unauthenticated
Date: 21 September 2010
OS: Mac OS X
URL: http://www.auscert.org.au/13372
Title: ESB-2010.0847 - [Linux] linux-2.6: Multiple vulnerabilities
Date: 20 September 2010
OS: Red Hat Linux, SUSE, Other Linux Variants, Debian GNU/Linux, Ubuntu
URL: http://www.auscert.org.au/13370
Title: ESB-2010.0846 - [UNIX/Linux][Debian] squid3: Denial of service -
Remote/unauthenticated
Date: 20 September 2010
OS: IRIX, HP Tru64 UNIX, Solaris, Red Hat Linux, Mac OS X, Debian
GNU/Linux, Ubuntu, HP-UX, Other BSD Variants, SUSE, OpenBSD, AIX,
FreeBSD, Other Linux Variants
URL: http://www.auscert.org.au/13369
Title: ESB-2010.0845 - [Debian] xulrunner: Multiple vulnerabilities
Date: 20 September 2010
OS: Debian GNU/Linux
URL: http://www.auscert.org.au/13368
Title: ESB-2010.0842.2 - UPDATE [Win][Linux] HP System Management Homepage:
Multiple vulnerabilities
Date: 20 September 2010
OS: Windows Server 2008, Other Linux Variants, Windows Vista, Windows 2000,
SUSE, Windows XP, Ubuntu, Debian GNU/Linux, Windows 7, Red Hat Linux,
Windows 2003
URL: http://www.auscert.org.au/13359
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
