TrustKeeper Scan Engine Update for December 16, 2015

Summary

The latest update to the TrustKeeper scan engine that powers our Trustwave Vulnerability Management product (including both internal and external vulnerability scanning) is now available. Enjoy!

New Vulnerability Test Highlights

Some of the more interesting vulnerability tests we added recently are as follows:

Magento

  • Magento Remote Code Execution via Unauthenticated Admin Functions (CVE-2015-1399)
  • Magento Remote Code Execution Vulnerability (CVE-2015-1397)
  • Directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 (CVE-2015-1398)
  • Authentication Bypass in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 (CVE-2015-3457)
  • File Traversal and Upload in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 (CVE-2015-3458)

OpenSSL

  • OpenSSL Denial of Service Vulnerability via Server Name Extension (CVE-2008-0891)
  • OpenSSL Off by One Vulnerability in DTLS (CVE-2007-4995)

Samba

  • Samba 'client/client.c' multiple format string vulnerabilities in smbclient (CVE-2009-1886)

How to Update?

All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.

Trustwave reserves the right to review all comments in the discussion below. Please note that for security and other reasons, we may not approve comments containing links.