SB15-341: Vulnerability Summary for the Week of November 30, 2015

["US-CERT" <US-CERT@xxxxxxxxxxxxxxxx>]

Title: SB15-341: Vulnerability Summary for the Week of November 30, 2015

National Cyber Awareness System:

SB15-341: Vulnerability Summary for the Week of November 30, 2015

12/07/2015 06:28 AM EST

Original release date: December 07, 2015

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

• High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0

• Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9

• Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

High Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
cisco -- ios_xe	Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, which allows local users to bypass license restrictions and obtain certain root privileges by using the CLI to enter crafted filenames, aka Bug ID CSCuv93130.	2015-12-02	7.2	CVE-2015-6383 CISCO
cisco -- ios	The publish-event event-manager feature in Cisco IOS 15.5(2)S and 15.5(3)S on Cloud Services Router 1000V devices allows local users to execute arbitrary commands with root privileges by leveraging administrative access to enter crafted environment variables, aka Bug ID CSCux14943.	2015-12-01	7.2	CVE-2015-6385 CISCO
cyrus -- imap	The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.	2015-12-03	7.5	CVE-2015-8076 CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM MLIST MLIST MLIST SUSE SUSE
cyrus -- imap	Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.	2015-12-03	7.5	CVE-2015-8077 MLIST CONFIRM CONFIRM MLIST MLIST SUSE
cyrus -- imap	Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.	2015-12-03	7.5	CVE-2015-8078 CONFIRM CONFIRM MLIST SUSE
debian -- debian_linux	The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokeping_cgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments.	2015-12-03	7.5	CVE-2015-0859 DEBIAN
debian -- dpkg	Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.	2015-12-03	7.5	CVE-2015-0860 CONFIRM MISC CONFIRM UBUNTU DEBIAN
mcafee -- mcafee_enterprise_security_manager	McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) 9.3.x before 9.3.2MR19, 9.4.x before 9.4.2MR9, and 9.5.x before 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass authentication by logging in with the username "NGCP|NGCP|NGCP;" and any password.	2015-12-02	9.3	CVE-2015-8024 CONFIRM MISC
pcre -- perl_compatible_regular_expression_library	PCRE before 8.36 mishandles the /(((a)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-2327 CONFIRM CONFIRM MLIST MISC CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-2328 CONFIRM CONFIRM MLIST MISC CONFIRM
pcre -- perl_compatible_regular_expression_library	The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a  1 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8380 CONFIRM MISC MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/ patterns, and related patterns with certain group references, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8381 CONFIRM CONFIRM MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8383 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.	2015-12-01	7.5	CVE-2015-8384 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8385 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8386 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8387 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8388 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8389 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the [: and \ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8390 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	9.0	CVE-2015-8391 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.	2015-12-01	7.5	CVE-2015-8392 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8394 MLIST CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392.	2015-12-01	7.5	CVE-2015-8395 MLIST CONFIRM
siemens -- simatic_cp_343-1_firmware	Siemens SIMATIC CP 343-1 Advanced devices before 3.0.44, CP 343-1 Lean devices, CP 343-1 devices, TIM 3V-IE devices, TIM 3V-IE Advanced devices, TIM 3V-IE DNP3 devices, TIM 4R-IE devices, TIM 4R-IE DNP3 devices, CP 443-1 devices, and CP 443-1 Advanced devices might allow remote attackers to obtain administrative access via a session on TCP port 102.	2015-11-27	9.7	CVE-2015-8214 CONFIRM

Back to top

Medium Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
cisco -- web_security_appliance	The passthrough FTP feature on Cisco Web Security Appliance (WSA) devices with software 8.0.7-142 and 8.5.1-021 allows remote attackers to cause a denial of service (CPU consumption) via FTP sessions in which the control connection is ended after data transfer, aka Bug ID CSCut94150.	2015-12-01	5.0	CVE-2015-6386 CISCO
cisco -- unity_connection	Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unity Connection 9.1(1.10) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCup92741.	2015-12-02	4.3	CVE-2015-6390 CISCO
pcre -- perl_compatible_regular_expression_library	The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular _expression_, as demonstrated by a _javascript_ RegExp object encountered by Konqueror, aka ZDI-CAN-2547.	2015-12-01	6.4	CVE-2015-8382 CONFIRM CONFIRM MLIST MLIST CONFIRM CONFIRM CONFIRM
pcre -- perl_compatible_regular_expression_library	pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.	2015-12-01	5.0	CVE-2015-8393 MLIST CONFIRM
redhat -- ceph	CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.	2015-12-03	4.3	CVE-2015-5245 REDHAT CONFIRM MLIST

Back to top

---

This product is provided subject to this Notification and this Privacy & Use policy.

---

A copy of this publication is available at www.us-cert.gov. If you need help or have questions, please send an email to info@xxxxxxxxxxx. Do not reply to this message since this email was sent from a notification-only address that is not monitored. To ensure you receive future US-CERT products, please add US-CERT@xxxxxxxxxxxxxxxx to your address book.

OTHER RESOURCES:

Contact Us | Security Publications | Alerts and Tips | Related Resources

STAY CONNECTED:

SUBSCRIBER SERVICES:
Manage Preferences  |  Unsubscribe  |  Help

---

This email was sent to linux-security@xxxxxxxxxxx using GovDelivery, on behalf of: United States Computer Emergency Readiness Team (US-CERT) · 245 Murray Lane SW Bldg 410 · Washington, DC 20598 · (888) 282-0870