TrustKeeper Scan Engine Update May 20 2015

The latest update to the TrustKeeper scan engine that powers our Trustwave Vulnerability Management product (including both internal and external vulnerability scanning) is now available.

This week we're bringing you 25 new vulnerability checks in Adobe, Apache, Cisco, FreeBSD, ISC BIND, OpenSSH, PHP, and Wordpress.

New Vulnerability Test Highlights

Here are some of the more interesting vulnerability tests we added recently:

Adobe

• Adobe ColdFusion Cross-Site Scripting (XSS) Vulnerability (CVE-2015-0345)
• Adobe ColdFusion Denial-of-Service via Resource Exhaustion (CVE-2014-9166)

Apache

• Apache HTTP Server mod_dav_svn assertion DoS Vulnerability (CVE-2015-0248)
• Apache HTTP Server mod_dav_svn assertion DoS Vulnerability (CVE-2015-0251)
• Apache HTTP Server mod_dav_svn REPORT Request DoS Vulnerability (CVE-2015-0202)
• Apache Tomcat Request Smuggling and Denial of Service Vulnerability (CVE-2014-0227)
• Apache HTTP Server mod_lua module access restriction bypass (CVE-2014-8109)
• Apache HTTP Server mod_proxy_fcgi out-of-bounds memory read (CVE-2014-3583)

Cisco

• Cisco ASA DHCPv6 Relay Denial of Service Vulnerability (CSCur45455) (CVE-2015-0578)
• Cisco ASA Proxy Bypass Content Rewriter Denial of Service Vulnerability (CSCug91577) (CVE-2013-5557)
• Cisco IOS Router Network-Based Application Denial of Service Vulnerability (CSCuo73682) (CVE-2015-0586)

FreeBSD

• FreeBSD Buffer overflow in stdio Vulnerability (FreeBSD-SA-14:27.stdio) (CVE-2014-8611)
• FreeBSD Improper ioctl Parameters Vulnerability (FreeBSD-EN-15:01.vt) (CVE-2014-0998)
• FreeBSD SCTP SCTP_SS_VALUE Kernel Memory Vulnerability (FreeBSD-SA-15:02.kmem) (CVE-2014-8612)
• FreeBSD SCTP Stream Reset Denial of Service Vulnerability (FreeBSD-SA-15:03.sctp) (CVE-2014-8613)

ISC

• ISC BIND cache update policy security bypass (CVE-2012-1033)
• ISC BIND Trust Anchor Management Denial of Service (CVE-2015-1349)

OpenSSH

• OpenSSH socket exhaustion denial of service (CVE-2010-5107)
• OpenSSH SSHFP DNS resource record look up bypass in the client (CVE-2014-2653)
• Portable OpenSSH ssh-keysign unauthorised local access to host keys (CVE-2011-4327)

PHP

• PHP Denial of Service build_tablename function in pgsql.c (CVE-2015-1352)
• PHP ZIP Integer Overflow (CVE-2015-2331)

WordPress

• WordPress Prior to Version 4.1.2 Multiple Vulnerabilities (CVE-2015-3438, CVE-2015-3439)
• WordPress Prior to Version 4.2.1 Cross Site Scripting Vulnerability

How to Update?

All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.