Tageszusammenfassung - 15.11.2019

End-of-Day report

Timeframe: Donnerstag 14-11-2019 18:00 - Freitag 15-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a

News

How the Linux kernel balances the risks of public bug disclosure

A serious Wi-Fi flaw shows how Linux handles security in plain sight.

https://nakedsecurity.sophos.com/2019/11/15/how-the-linux-kernel-balances-the-risks-of-public-bug-disclosure/

A Tale of Rootkits and Other Backdoors

In this post, we will focus on software backdoors commonly seen in Linux environments, we will attempt to outline some representative examples, and we will discuss common techniques backdoor authors use to hide their malicious payloads.

https://capsule8.com/blog/dont-get-kicked-out-a-tale-of-rootkits-and-other-backdoors/

Vulnerabilities

Security Advisory 2019-15: Security Update for OTRS Framework

OTRS can be put into an endless loop by providing filenames with overly long extensions. This applies to the PostMaster (sending in email) and also upload (attaching files to mails, for example).

https://community.otrs.com/security-advisory-2019-15-security-update-for-otrs-framework/

Security Advisory 2019-14: Security Update for OTRS Framework

An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, which are in the queue where attacker doesn-t have permissions.

https://community.otrs.com/security-advisory-2019-14-security-update-for-otrs-framework/

A heap overflow vulnerability has been found in wolfssl

Wolfssl is an TLS library mostly used in embedded Linux devices. It is also used in the popular tool curl. ... The vulnerability has been given the CVE of CVE-2019-18840.

https://medium.com/@social_62682/heap-overflow-in-wolfssl-cve-2019-18840-185d233c27de

Lücke in älteren WhatsApp-Versionen erlaubte Codeausführung aus der Ferne

Facebook weist auf eine Lücke in dem Messenger WhatsApp hin. Viele Geräte sollten dank automatischer Updates bereits seit einiger Zeit geschützt sein.

https://heise.de/-4587119

Security updates for Friday

Security updates have been issued by CentOS (kernel), Debian (ghostscript, mesa, and postgresql-common), Fedora (chromium, php-robrichards-xmlseclibs, php-robrichards-xmlseclibs3, samba, scap-security-guide, and wpa_supplicant), Mageia (cpio, fribidi, libapreq2, python-numpy, webkit2, and zeromq), openSUSE (ImageMagick, kernel, libtomcrypt, qemu, ucode-intel, and xen), Oracle (kernel), Red Hat (ghostscript, kernel, and kernel-rt), Scientific Linux (ghostscript and kernel), SUSE (bash, enigmail, ghostscript, kernel, libjpeg-turbo, openconnect, squid), Ubuntu (ghostscript, imagemagick, postgresql-common).

https://lwn.net/Articles/804904/

Security Bulletin: Multiple vulnerabilities in jackson-databind affect IBM Platform Symphony and IBM Spectrum Symphony

https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-jackson-databind-affect-ibm-platform-symphony-and-ibm-spectrum-symphony/

Security Bulletin: Security vulnerabilities affect IBM Cloud Object Storage SDK Java (November 2019 Bulletin)

https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-affect-ibm-cloud-object-storage-sdk-java-november-2019-bulletin/

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products

https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-sdk-affect-ibm-performance-management-products/

Security Bulletin: IBM OS Images for RedHat Enterprise System is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091)

https://www.ibm.com/blogs/psirt/security-bulletin-ibm-os-images-for-redhat-enterprise-system-is-vulnerable-to-intel-microarchitectural-data-sampling-mds-vulnerabilites-cve-2018-12126-cve-2018-12127-cve-2018-12130-cve-2019-110/

Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Connect 3.7.4 and earlier (CVE-2017-3732, CVE-2016-7055)

https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerabilites-impacting-ibm-aspera-connect-3-7-4-and-earlier-cve-2017-3732-cve-2016-7055/

Security Bulletin: Apache Commons Collections library in WebSphere Application Server Knowledge Center is vulnerable (CVE-2015-7450)

https://www.ibm.com/blogs/psirt/security-bulletin-apache-commons-collections-library-in-websphere-application-server-knowledge-center-is-vulnerable-cve-2015-7450/

iControl REST logs a plaintext password when the syntax of a cURL request is incorrect

https://support.f5.com/csp/article/K61105950

BIG-IP / BIG-IQ / Enterprise Manager / F5 iWorkflow Configuration utility vulnerability CVE-2019-6663

https://support.f5.com/csp/article/K76052144

TMM vulnerability CVE-2019-6660

https://support.f5.com/csp/article/K23860356

TLS 1.3 vulnerability CVE-2019-6659

https://support.f5.com/csp/article/K34450231

BIG-IP restjavad vulnerability CVE-2019-6662

https://support.f5.com/csp/article/K01049383

TMOS vulnerability CVE-2019-6664

https://support.f5.com/csp/article/K03126093

BIG-IP APM apd vulnerability CVE-2019-6661

https://support.f5.com/csp/article/K61705126