Vulnerability Team

1. Linux Kernel SCTP INIT/INIT-ACK Chunk Length Remote Denial of Service Vulnerability

The Linux kernel is prone to a remote denial-of-service vulnerability related to SCTP protocol implementation.

Attackers can exploit this issue to cause a kernel panic, denying service to legitimate users.

REFERNECE: http://www.securityfocus.com/bid/47308/info


2. Linux Kernel 'inotify_init1()' Double Free Local Denial of Service Vulnerability

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause an out-of-memory condition, denying service to legitimate users.

REFERNECE: http://www.securityfocus.com/bid/47296/info


The Vulnerability Team adviced to users and administrators to review and apply the updates notifications
necessary to help mitigate the risks.

source: securityfocus.com 

Nuevas variantes de vulnerabilidades que afectan a Linux.

Linux Kernel Local Address Limit Override Security Weakness

Linux Kernel 'install_special_mapping()' Local Security Bypass Vulnerability

Linux Kernel 'hci_uart_tty_open()' Local Denial of Service Vulnerability

Linux Kernel TIOCGICOUNT CVE-2010-4077 Information Disclosure Vulnerability

Linux Kernel 'net/core/filter.c' Local Information Disclosure Vulnerability

Linux Kernel Block Layer Local Denial of Service Vulnerabilities

Linux Kernel 'x25_parse_facilities()' CVE-2010-4164 Remote Denial of Service Vulnerability

Linux Kernel TIOCGICOUNT 'serial_core.c' Information Disclosure Vulnerability



fuente: securityfocus.com

1. Linux Kernel 'do_io_submit()' Integer Overflow Vulnerability
   
2. Linux Kernel 'net/sched/act_police.c' File Memory Leak Local Information Disclosure Vulnerability
   
3. Linux Kernel 'XFS_IOC_FSGETXATTR' Information Disclosure Vulnerability
   
4. Linux Kernel Futex Macros Local Denial of Service Vulnerability
   
5. Linux Kernel 'io_submit_one()' NULL Pointer Dereference Denial of Service Vulnerability
   
6. Linux Kernel CIFS 'CIFSSMBWrite()' Remote Denial of Service Vulnerability
   
7. Linux Kernel XSF 'SWAPEXT' IOCTL Local Information Disclosure Vulnerability
   
8. Linux Kernel CVE-2010-2066 Donor File Security Bypass Vulnerability
   
9. Linux Kernel CIFS DNS Lookup Cache Poisoning Vulnerability
   
10. Linux Kernel Bluetooth Sysfs File Local Privilege Escalation Vulnerability

Desde Vulnerability Team exortamos a los usuarios y administradores revisar las notificaciones y aplicar las actualizaciones necesarias, para ayudar a mitigar los riesgos.

fuente: securityfocus.com

Oracle MySQL Prior to 5.1.49 'JOIN' Statement Denial Of Service Vulnerability

Oracle MySQL 'HANDLER' interface Denial Of Service Vulnerability

Oracle MySQL 'TEMPORARY InnoDB' Tables Denial Of Service Vulnerability

Oracle MySQL Prior to 5.1.51 Multiple Denial Of Service Vulnerabilities

Oracle MySQL Prior to 5.1.49 Malformed 'BINLOG' Arguments Denial Of Service Vulnerability

Oracle MySQL Prior to 5.1.49 'WITH ROLLUP' Denial Of Service Vulnerability

Oracle MySQL 'EXPLAIN' Denial Of Service Vulnerability

Oracle MySQL 'ALTER DATABASE' Remote Denial Of Service Vulnerability

Oracle MySQL 'LOAD DATA INFILE' Denial Of Service Vulnerability

Cisco ha publicado dos nuevos security advisories con referencia a multiples vulnerabilidades que afectan a los servicios Unified Communications Manager y Unified Presence.

Dichas vulnerabilidades afectan el procesamiento del Session Initiation Protocol (SIP). Explotanndo  estos agujeros podria permitir a un atacante causar un DoS (denial-of-service) el cual podria causar una interrupcion de los servicios de voz.

Cisco Unified Communications Manager Denial of Service Vulnerabilities

Cisco Unified Presence Denial of Service Vulnerabilities

Desde Vulnerability Team exortamos a los usuarios y administradores revisar las notificaciones y aplicar las actualizaciones necesarias, para ayudar a mitigar los riesgos.

fuente: cisco.com | us-cert.gov

Cisco Firewall Services Module (FWSM) for the Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers is prone to a denial-of-service vulnerability that affects TCP packet processing in multi-mode.

An attacker can exploit this issue to cause affected devices to reload, triggering a denial-of-service condition.

This issue is tracked by Cisco Bug ID CSCtg68694.

CISCO FIREWALL SERVICE MODULE

REFERENCIA DE LA VULNERABILIDAD 


Desde Vulnerability Team exortamos a los usuarios y administradores revisar las notificaciones y aplicar las actualizaciones necesarias, para ayudar a mitigar los riesgos.

fuente: securityfocus.com  | cisco.com

Se han encontrado nuevas varientes en vulnerabilidades que afectan a  Adobe Acrobat y Reader.

Adobe Acrobat and Reader Flash Content Parsing Remote Buffer Overflow Vulnerability


Adobe Acrobat and Reader 'AcroForm.api' GIF Image Remote Code Execution Vulnerability

Adobe Acrobat and Reader CVE-2010-2203 Remote Memory Corruption Vulnerability

Adobe Acrobat and Reader 'newfunction' Remote Code Execution Vulnerability

Adobe Acrobat and Reader 'pushstring' and 'debugfile' Remote Code Execution Vulnerability

Adobe Acrobat and Reader 'AcroForm.api' Remote Code Execution Vulnerability

Adobe Acrobat and Reader 'newclass' Flash Content Remote Code Execution Vulnerability

Adobe Acrobat and Reader CLOD Remote Memory Corruption Vulnerability

Adobe Acrobat and Reader CoolType Typography Engine Remote Denial of Service Vulnerability

Adobe Acrobat and Reader CVE-2010-1295 Remote Memory Corruption Vulnerability

Adobe Flash Player, Reader, and Acrobat 'authplay.dll' Remote Code Execution Vulnerability

ULTIMO BOLETIN DE SEGURIDAD DE ADOBE




Desde Vulnerability Team exortamos a los usuarios y administradores revisar las notificaciones y aplicar las actualizaciones necesarias, para ayudar a mitigar los riesgos.

fuente: securityfocus.com 

Linux Kernel 'sctp_process_unk_param()' Remote Denial of Service Vulnerability

Linux Kernel 'find_keyring_by_name()' Local Memory Corruption Vulnerability

Linux Kernel 'nfs4_proc_lock()' Local Denial of Service Vulnerability


Desde Vulnerability Team exortamos a los usuarios y administradores revisar las notificaciones y aplicar las actualizaciones necesarias para mitigar los riesgos.

fuente: securityfocus.com

• Microsoft SharePoint Server 2007 '_layouts/help.aspx' Cross Site Scripting Vulnerability

• Microsoft Internet Explorer 'CStyleSheet' Uninitialized Memory Remote Code Execution Vulnerability

• Microsoft Office COM Object Validation Remote Code Execution Vulnerability

• Microsoft SharePoint Help Page Remote Denial of Service Vulnerability

• Microsoft Excel CVE-2010-0821 'SxView' Record Parsing Remote Code Execution Vulnerability

• Microsoft Excel 'DBQueryExt' ActiveX Data Object (ADO) Parsing Remote Code Execution Vulnerability

• Microsoft Internet Explorer URLMON Sniffing Cross Domain Information Disclosure Vulnerability

• Microsoft Data Analyzer 'max3activex.dll' ActiveX Control Remote Code Execution Vulnerability

• Microsoft Internet Explorer Dynamic Object Tag Information Disclosure Vulnerability

• Microsoft Excel CVE-2010-1251 Record Parsing Stack Corruption Remote Code Execution Vulnerability

• Microsoft Excel CVE-2010-1252 String Parsing Remote Code Execution Vulnerability

Desde Vulnerability Team exortamos a los usuarios y administradores revisar las notificaciones y aplicar las actualizaciones necesarias, para ayudar a mitigar los riesgos.

fuente: securityfocus.com