TrustKeeper Scan Engine Update for November 02, 2016

Summary

The latest update to the TrustKeeper scan engine that powers our Trustwave Vulnerability Management product (including both internal and external vulnerability scanning) is now available. Enjoy!

New Vulnerability Test Highlights

Some of the more interesting vulnerability tests we added recently are as follows:

ISC BIND

  • Bind vulnerable to Denial of Service via a packet with malformed options section (CVE-2016-2848)

OpenSSH

  • OpenSSH 6.8 and 6.9 vulnerable to Denial of Service because TTY devices are world-writable (CVE-2015-6565)
  • OpenSSH before 7.3 vulnerable to Denial of Service by not setting a limit for password length (CVE-2016-6515)

Oracle

PHP

  • PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code (CVE-2015-8617)
  • PHP before 5.6.25 and 7.x before 7.0.10 allows arbitrary session data (CVE-2016-7125)
  • PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service or other impacts(CVE-2016-7129)
  • PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service or other impacts(CVE-2016-7131)
  • PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service or other impacts(CVE-2016-7130)
  • PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service or other impacts (CVE-2016-7132)
  • PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or other impacts(CVE-2016-7418)
  • PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or other impacts(CVE-2016-7413)
  • PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough (CVE-2016-7414)
  • PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class (CVE-2016-7416)
  • PHP before 5.6.26 mishandles object-deserialization failures (CVE-2016-7411)
  • PHP mishandles thumbnail file sizes allowing remote attackers to obtain sensitive information (CVE-2016-7128)
  • SplArray unserialization in PHP before 5.6.26 and 7.x before 7.0.11 allows a denial of service (CVE-2016-7417)

How to Update?

All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.

Trustwave reserves the right to review all comments in the discussion below. Please note that for security and other reasons, we may not approve comments containing links.