In This Weeks SecurityTracker Vulnerability Summary SecurityTracker Alerts: 26 Vendors: Adobe Systems Incorporated - Belkin Components - CA - Cisco - Citrix - gnutls.org - kernel.org - Microsoft - Rockwell Automation Products: .NET - Adobe Flash - Belkin Modem/Router - CA Cloud Service Management - Cisco Unified Communications Manager - Citrix NetScaler - GnuTLS - Linux Kernel - Microsoft Active Directory - Microsoft Internet Explorer (IE) - Microsoft Internet Information Server (IIS) Web Server - Microsoft Office - Microsoft SharePoint - Microsoft Word - Microsoft XML Core Services (MSXML) - Rockwell Automation Connected Components Workbench - Windows DLL (Any) - Windows Drivers - Windows Remote Desktop Protocol (RDP) - ... Headlines: 1. Microsoft SharePoint Input Validation Flaw Permits Cross-Site Scripting Attacks 2. Windows Schannel Unspecified Flaw Lets Remote Users Execute Arbitrary Code 3. CA Cloud Service Management Bugs Let Remote Users Access Data, Deny Service, and Conduct Cross-Site Request Forgery Attacks 4. Linux Kernel KVM PIT Timer Race Condition Lets Local Guest Users Deny Service on the Host System 5. Adobe Flash Player Multiple Bugs Let Remote Users Obtian Session Tokens and Execute Arbitrary Code 6. Microsoft XML Core Services (MSXML) XML Parsing Flaw Lets Remote Users Execute Arbitrary Code 7. Microsoft Windows Audio Service Lets Users Gain Elevated Privileges 8. Microsoft Active Directory Federation Services Logout Failure Lets Local Users Access the Target Users Account 9. Microsoft .NET Remoting Object Handling Flaw Lets Remote Users Execute Arbitrary Code 10. Windows TCP/IP Stack Object Handling Flaw Lets Local Users Gain Elevated Privileges 11. Cisco Unified Communications Manager Remote Mobile Access Subsystem Certificate Validation Flaw Lets Remote Users Spoof the System 12. Rockwell Automation Connected Components Workbench ActiveX Control Bugs Let Remote Users Execute Arbitrary Code 13. Linux Kernel KVM INVVPID Processing Flaw Lets Local Guest Users Deny Service on the Host System 14. Windows Kernel-Mode Drivers TrueType Array Index Bug Lets Remote Users Deny Service 15. Microsoft Internet Explorer Multiple Memory Corruption Flaws Let Remote Users Execute Arbitrary Code, Obtain Potentially Sensitive Information, and Bypass ASLR Security Protection 16. Belkin Play N750 DB Wireless Dual-Band N+ Router Buffer Overflow Lets Remote Users Execute Arbitrary Code 17. Microsoft Word Memory Corruption Flaws Let Remote Users Execute Arbitrary Code 18. Linux Kernel KVM INVEPT Processing Flaw Lets Local Guest Users Deny Service on the Host System 19. Citrix NetScaler Application Delivery Controller and NetScaler Gateway Authentication Flaw Lets Remote Users Access Network Resources 20. Microsoft Office IME Sandbox Bypass Flaw Lets Remote Users Gain Elevated Privileges 21. Microsoft Input Method Editor (Japanese) Sandbox Bypass Flaw Lets Remote Users Gain Elevated Privileges 22. GnuTLS ECC Certificate Processing Flaw Lets Remote Users Deny Service 23. Linux Kernel Memory Corruption Flaw in USB command_port_read_callback() Lets Physically Local Users Gain Privileges or Deny Service 24. Microsoft Windows OLE Automation Array Bug Lets Remote Users Execute Arbitrary Code 25. Microsoft Internet Information Server Lets Remote Users Bypass Security Features 26. Windows Remote Desktop Protocol (RDP) Does Not Properly Record Logon Failures ------------------------------------------------------------------------ Your SecurityTracker Vulnerability Alerts 1. Microsoft SharePoint Vendor: Microsoft A vulnerability was reported in Microsoft SharePoint. A remote authenticated user can conduct cross-site scripting attacks. Impact: Disclosure of authentication information Alert: securitytracker/id/1031192 2. Windows Schannel Vendor: Microsoft A vulnerability was reported in Windows Schannel. A remote user can execute arbitrary code on the target system. Impact: Execution of arbitrary code via network Alert: securitytracker/id/1031186 3. CA Cloud Service Management Vendor: CA Several vulnerabilities were reported in CA Cloud Service Management. A remote user can gain access to data on the target system. A remote user can cause denial of service conditions. A remote user can conduct cross-site request forgery attacks. Impact: Denial of service via network Alert: securitytracker/id/1031214 4. Linux Kernel Vendor: kernel.org A vulnerability was reported in the Linux Kernel. A local user on a KVM guest system can cause denial of service conditions on the host system. Impact: Denial of service via local system Alert: securitytracker/id/1031200 5. Adobe Flash Vendor: Adobe Systems Incorporated Multiple vulnerabilities were reported in Adobe Flash Player. A remote user can cause arbitrary code to be executed on the target users system. A remote user can obtain elevated privileges. A remote user can obtain session tokens. Impact: Disclosure of authentication information Alert: securitytracker/id/1031182 6. Microsoft XML Core Services (MSXML) Vendor: Microsoft A vulnerability was reported in Microsoft XML Core Services (MSXML). A remote user can cause arbitrary code to be executed on the target users system. Impact: Execution of arbitrary code via network Alert: securitytracker/id/1031187 7. Windows DLL (Any) Vendor: Microsoft A vulnerability was reported in Microsoft Windows Audio Service. A user can obtain elevated privileges on the target system in certain cases. Impact: User access via local system Alert: securitytracker/id/1031191 8. Microsoft Active Directory Vendor: Microsoft A vulnerability was reported in Microsoft Active Directory Federation Service. A local user can access the target users account in certain cases. Impact: Disclosure of system information Alert: securitytracker/id/1031195 9. .NET Vendor: Microsoft A vulnerability was reported in Microsoft .NET. A remote user can execute arbitrary code on the target system. Impact: Execution of arbitrary code via network Alert: securitytracker/id/1031188 10. Windows TCP/IP Stack Vendor: Microsoft A vulnerability was reported in Windows TCP/IP Stack. A local user can obtain elevated privileges on the target system. Impact: User access via local system Alert: securitytracker/id/1031190 11. Cisco Unified Communications Manager Vendor: Cisco A vulnerability was reported in Cisco Unified Communications Manager. A remote user can spoof the system. Impact: Modification of system information Alert: securitytracker/id/1031181 12. Rockwell Automation Connected Components Workbench Vendor: Rockwell Automation A vulnerability was reported in Rockwell Automation Connected Components Workbench (CCW). A remote user can cause arbitrary code to be executed on the target users system. Impact: Execution of arbitrary code via network Alert: securitytracker/id/1031213 13. Linux Kernel Vendor: kernel.org A vulnerability was reported in the Linux Kernel. A local user on a KVM guest system can cause denial of service conditions on the host system. Impact: Denial of service via local system Alert: securitytracker/id/1031202 14. Windows Drivers Vendor: Microsoft A vulnerability was reported in Windows Kernel-Mode Drivers. A remote user can cause denial of service conditions. Impact: Denial of service via network Alert: securitytracker/id/1031198 15. Microsoft Internet Explorer (IE) Vendor: Microsoft Multiple vulnerabilities were reported in Microsoft Internet Explorer. A remote user can cause arbitrary code to be executed on the target users system. A remote user can determine the installation path. Impact: Disclosure of system information Alert: securitytracker/id/1031185 16. Belkin Modem/Router Vendor: Belkin Components A vulnerability was reported in the Belkin Play N750 DB Wireless Dual-Band N+ Router. A remote user can execute arbitrary code on the target system. Impact: Execution of arbitrary code via network Alert: securitytracker/id/1031210 17. Microsoft Word Vendor: Microsoft Several vulnerabilities were reported in Microsoft Word. A remote user can cause arbitrary code to be executed on the target users system. Impact: Execution of arbitrary code via network Alert: securitytracker/id/1031189 18. Linux Kernel Vendor: kernel.org A vulnerability was reported in the Linux Kernel. A local user on a KVM guest system can cause denial of service conditions on the host system. Impact: Denial of service via local system Alert: securitytracker/id/1031201 19. Citrix NetScaler Vendor: Citrix A vulnerability was reported in Citrix NetScaler Application Delivery Controller and NetScaler Gateway. A remote user can gain access to the network resources of a different user. Impact: Host/resource access via network Alert: securitytracker/id/1031212 20. Microsoft Office Vendor: Microsoft A vulnerability was reported in Microsoft Office IME (Japanese). A remote user can bypass sandbox restrictions to gain elevated privileges. Impact: Execution of arbitrary code via network Alert: securitytracker/id/1031197 21. Windows DLL (Any) Vendor: Microsoft A vulnerability was reported in Microsoft Input Method Editor (IME) (Japanese). A remote user can bypass sandbox restrictions to gain elevated privileges. Impact: Execution of arbitrary code via network Alert: securitytracker/id/1031196 22. GnuTLS Vendor: gnutls.org A vulnerability was reported in GnuTLS. A remote user can cause denial of service conditions. Impact: Denial of service via network Alert: securitytracker/id/1031207 23. Linux Kernel Vendor: kernel.org A vulnerability was reported in the Linux Kernel. A local user can obtain elevated privileges on the target system or cause denial of service conditions. Impact: Denial of service via local system Alert: securitytracker/id/1031199 24. Windows DLL (Any) Vendor: Microsoft A vulnerability was reported in Microsoft Windows. A remote user can cause arbitrary code to be executed on the target users system. Impact: Execution of arbitrary code via network Alert: securitytracker/id/1031184 25. Microsoft Internet Information Server (IIS) Web Server Vendor: Microsoft A vulnerability was reported in Microsoft Internet Information Server (IIS). A remote user can bypass address-based access control security feature. Impact: Host/resource access via network Alert: securitytracker/id/1031194 26. Windows Remote Desktop Protocol (RDP) Vendor: Microsoft A vulnerability was reported in Windows Remote Desktop Protocol (RDP). A remote user can bypass the audit logon security feature. Impact: Modification of system information Alert: securitytracker/id/1031193
Posted on: Tue, 18 Nov 2014 03:42:20 +0000
Trending Topics
Recently Viewed Topics
© 2015