From security em unicamp.br Fri Apr 10 15:02:13 2015 From: security em unicamp.br (CSIRT - UNICAMP) Date: Fri, 10 Apr 2015 15:02:13 -0300 Subject: [SECURITY-L] CSIRT Unicamp: atualizacao do site - 10/04/2015 Message-ID: <20150410180213.GB23321@unicamp.br> Prezados, O site do CSIRT Unicamp foi atualizado com as publicações: Boas Práticas em Configuração de switches de camada 2 https://www.security.unicamp.br/89-boas-praticas-em-configuracao-de-switches-de-camada-2.html SELinux: Um importante aliado na Segurança de Servidores Linux (parte 2) https://www.security.unicamp.br/86-selinux-um-importante-aliado-na-seguranca-de-servidores-linux-parte-2.html Atenciosamente, Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC E-mail: security em unicamp.br GnuPG Public Key: http://www.security.unicamp.br/security.asc Contact: +55 19 3521-2289 or +55 19 3521-2290 INOC-DBA-BR: 1251*830 From security em unicamp.br Wed Apr 15 15:34:03 2015 From: security em unicamp.br (CSIRT Unicamp) Date: Wed, 15 Apr 2015 15:34:03 -0300 Subject: [SECURITY-L] [Security-news] Services - Critical - Multiple Vulnerabilites - SA-CONTRIB-2014-096 In-Reply-To: <20150415182443.44CDF1201EC@www7.drupal.org> References: <20150415182443.44CDF1201EC@www7.drupal.org> Message-ID: <552EAF1B.3030602@unicamp.br> -------- Forwarded Message -------- Assunto: [Security-news] Services - Critical - Multiple Vulnerabilites - SA-CONTRIB-2014-096 Data: Wed, 15 Apr 2015 18:24:43 +0000 (UTC) De: security-news em drupal.org Responder a: noreply em drupal.org Para: security-news em drupal.org View online: https://www.drupal.org/node/2471879 * Advisory ID: DRUPAL-SA-CONTRIB-2015-096 * Project: Services [1] (third-party module) * Version: 7.x * Date: 2015-April-15 * Security risk: 16/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] * Vulnerability: Access bypass, Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- Services module enables you to expose an API to third party systems. .... Access bypass (file upload and execution) The resource/endpoint for uploading files does not properly sanitize the filename of uploaded files. This vulnerability is mitigated by the fact that the "File > Create" resource must be enabled and an attacker must have a role with the Services "Save file information" permission. .... Private fields information displayed Services does not check field_access when displaying entities so some private field information may be displayed. This vulnerability is only affecting sites using the field_permissions module configured to hide fields from anonymous users. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- Services 7.x-3.x versions prior to 7.x-3.12. Drupal core is not affected. If you do not use the contributed Services [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version of Services: Services 7.x-3.12 [5]. As a reminder, Services for Drupal 6 is no longer maintained. Also see the Services [6] project page. -------- REPORTED BY --------------------------------------------------------- .... Access Bypass/file upload * Fabian Franz [7] * Bevan Rudge [8] .... Private fields information displayed * giorgio79 [9] -------- FIXED BY ------------------------------------------------------------ .... Access Bypass/file upload * Bevan Rudge [10] .... Private fields information displayed * Kyle Browning [11] module maintainer -------- COORDINATED BY ------------------------------------------------------ * Ben Dougherty [12] of the Drupal Security Team * Stéphane Corlosquet [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] https://www.drupal.org/project/services [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/services [5] https://www.drupal.org/node/2471847 [6] https://www.drupal.org/project/services [7] https://www.drupal.org/u/fabianx [8] https://www.drupal.org/u/bevan [9] https://www.drupal.org/user/235790 [10] https://www.drupal.org/u/bevan [11] https://www.drupal.org/u/kylebrowning [12] https://www.drupal.org/u/benjy [13] https://www.drupal.org/u/scor [14] https://www.drupal.org/contact [15] https://www.drupal.org/security-team [16] https://www.drupal.org/writing-secure-code [17] https://www.drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity _______________________________________________ Security-news mailing list Security-news em drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: From security em unicamp.br Wed Apr 22 17:12:48 2015 From: security em unicamp.br (CSIRT - UNICAMP) Date: Wed, 22 Apr 2015 17:12:48 -0300 Subject: [SECURITY-L] =?iso-8859-1?q?=5Bcais=40cais=2Ernp=2Ebr=3A_Resumo_d?= =?iso-8859-1?q?os_Boletins_de_Seguran=E7a_da_Microsoft_-_Abril/2015=5D?= Message-ID: <20150422201248.GG23417@unicamp.br> ----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca ----- Date: Wed, 22 Apr 2015 14:32:46 -0300 (BRT) From: Centro de Atendimento a Incidentes de Seguranca To: pop-seg em cais.rnp.br, rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br Subject: Resumo dos Boletins de Segurança da Microsoft - Abril/2015 CAIS-Alerta: Resumo dos Boletins de Segurança da Microsoft - Abril/2015 A Microsoft publicou 11 boletins de segurança em 14 de abril de 2015 que abordam ao todo 26 vulnerabilidades em produtos da empresa. As explorações destas vulnerabilidades permitem execução de código remota, desvio de recurso de segurança, divulgação de informações, elevação de privilégio, divulgação não autorizada de informação, desvio de recurso de segurança e negação de serviço. Até o momento da publicação deste alerta não foram divulgados códigos de exploração para as vulnerabilidades listadas. Severidade Crítica · MS15-032 - Atualização de Segurança Cumulativa para o Internet Explorer · MS15-033 - Vulnerabilidades no Microsoft Office podem permitir a Execução de código remota . MS15-034 - Vulnerabilidade no HTTP.sys pode permitir a Execução de código remota · MS15-035 - Vulnerabilidade no componente do Microsoft Graphics pode permitir a Execução de código remota Importante · MS15-036 - Vulnerabilidades no Microsoft SharePoint Server podem permitir a elevação de privilégio · MS15-037 - Vulnerabilidade no Agendador de Tarefas do Windows pode permitir a elevação de privilégio · MS15-038 - Vulnerabilidades no Microsoft Windows podem permitir a elevação de privilégio · MS15-039 - Vulnerabilidade no XML Core Services pode permitir que o recurso de segurança seja ignorado · MS15-040 - Vulnerabilidade nos Serviços de Federação do Active Directory pode permitir a divulgação de informações · MS15-041 - Vulnerabilidade no .Net Framework pode permitir a divulgação não autorizada de informações · MS15-042 - Vulnerabilidade no Windows Hyper-V pode permitir a negação de serviço Moderada Nenhum boletim Baixa Nenhum boletim O sistema de classificação de severidade das vulnerabilidades adotado pelo CAIS é o da própria Microsoft. O CAIS recomenda que se apliquem as correções para vulnerabilidades classificadas como crítica e importante. No caso de correções para vulnerabilidades classificadas como moderadas o CAIS recomenda que ao menos as recomendações de mitigação sejam seguidas. · Crítica - Vulnerabilidades cuja exploração possa permitir a propagação de um worm sem a necessidade de interação com o usuário. · Importante - Vulnerabilidades cuja exploração possa resultar no comprometimento de confidencialidade, integridade ou disponibilidade de dados de usuários ou a integridade ou disponibilidade de recursos de processamento. · Moderada - Exploração é mitigada significativamente por fatores como configuração padrão, auditoria ou dificuldade de exploração. · Baixa - Uma vulnerabilidade cuja exploração seja extremamente difícil ou cujo impacto seja mínimo. Correções disponíveis Recomenda-se atualizar os sistemas para as versões disponíveis em: Microsoft Update https://www.update.microsoft.com/microsoftupdate Microsoft Download Center http://www.microsoft.com/en-us/download/default.aspx Mais informações Resumo do Boletim de Segurança da Microsoft de abril de 2015 https://technet.microsoft.com/pt-BR/library/security/ms15-apr.aspx Microsoft TechCenter de Segurança https://technet.microsoft.com/pt-br/security Microsoft Security Response Center - MSRC https://technet.microsoft.com/pt-br/security/dn440717 Microsoft Security Research & Defense - MSRD http://blogs.technet.com/b/srd/ Central de Proteção e Segurança Microsoft https://www.microsoft.com/pt-br/security/default.aspx Identificador CVE (http://cve.mitre.org): CVE-2015-1652,CVE-2015-1657,CVE-2015-1659 CVE-2015-1660,CVE-2015-1661,CVE-2015-1662 CVE-2015-1665,CVE-2015-1666,CVE-2015-1667 CVE-2015-1668,CVE-2015-1639,CVE-2015-1641 CVE-2015-1649,CVE-2015-1650,CVE-2015-1651 CVE-2015-1635,CVE-2015-1645,CVE-2015-1640 CVE-2015-1653,CVE-2015-0098,CVE-2015-1643 CVE-2015-1644,CVE-2015-1646,CVE-2015-1638 CVE-2015-1648,CVE-2015-1647 O CAIS recomenda que os administradores mantenham seus sistemas e aplicativos sempre atualizados, de acordo com as últimas versões e correções oferecidas pelos fabricantes. Os alertas do CAIS também são oferecidos no Twitter: Siga @caisrnp ################################################################ # CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS) # # Rede Nacional de Ensino e Pesquisa (RNP) # # # # cais em cais.rnp.br http://www.rnp.br/servicos/seguranca # # Tel. 019-37873300 Fax. 019-37873301 # # Chave PGP disponivel http://www.cais.rnp.br/cais-pgp.key # ################################################################ ----- End forwarded message ----- From security em unicamp.br Wed Apr 29 15:00:03 2015 From: security em unicamp.br (CSIRT - UNICAMP) Date: Wed, 29 Apr 2015 15:00:03 -0300 Subject: [SECURITY-L] [security-news@drupal.org: [Security-news] Views - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-103] Message-ID: <20150429180003.GB8942@unicamp.br> ----- Forwarded message from security-news em drupal.org ----- Date: Wed, 29 Apr 2015 17:39:56 +0000 (UTC) From: security-news em drupal.org To: security-news em drupal.org Subject: [Security-news] Views - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-103 X-Mailer: Drupal View online: https://www.drupal.org/node/2480327 * Advisory ID: DRUPAL-SA-CONTRIB-2015-103 * Project: Views [1] (third-party module) * Version: 7.x * Date: 2015-April-29 * Security risk: 15/25 ( Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented. .... Access bypass due cache inconsistency Due to an issue in the caching mechanism of Views it's possible that configured filters loose their effect. This can lead to exposure of content that otherwise would be hidden from visitors. This vulnerability is mitigated by the fact that it can't be exploited directly but occurs when certain prerequisites meet. Systems that use in-memory cache backends like redis / memcache are more likely to be affected by this issue. This is due the common strategy used to free cache space if the configured memory limit of the cache is reached. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Views 7.x-3.x versions from 7.x-3.5 to 7.x-3.11. Drupal core is not affected. If you do not use the contributed Views [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.11 [5] Also see the Views [6] project page. -------- REPORTED BY --------------------------------------------------------- * Peter Philipp [7] * Daniel Wehner [8]the module maintainer -------- FIXED BY ------------------------------------------------------------ * Peter Philipp [9] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/views [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/views [5] https://www.drupal.org/node/2480259 [6] https://www.drupal.org/project/views [7] https://www.drupal.org/user/762870 [8] https://www.drupal.org/user/99340 [9] https://www.drupal.org/user/762870 [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity _______________________________________________ Security-news mailing list Security-news em drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news ----- End forwarded message ----- From security em unicamp.br Thu Apr 30 15:53:26 2015 From: security em unicamp.br (CSIRT - UNICAMP) Date: Thu, 30 Apr 2015 15:53:26 -0300 Subject: [SECURITY-L] [adconrad@ubuntu.com: Ubuntu 10.04 (Lucid Lynx) End of Life reached on April 30, 2015] Message-ID: <20150430185326.GD8942@unicamp.br> ----- Forwarded message from Adam Conrad ----- Date: Thu, 30 Apr 2015 12:43:38 -0600 From: Adam Conrad To: ubuntu-announce em lists.ubuntu.com Cc: ubuntu-security-announce em lists.ubuntu.com Subject: Ubuntu 10.04 (Lucid Lynx) End of Life reached on April 30, 2015 This is a follow-up to the End of Life warning sent last month to confirm that as of today (April 30, 2015), Ubuntu 10.04 is no longer supported. No more package updates will be accepted to 10.04, and it will be archived to old-releases.ubuntu.com in the coming weeks. The original End of Life warning follows, with upgrade instructions: Ubuntu announced its 10.04 (Lucid Lynx) release almost 5 years ago, on April 29, 2010. As with the earlier LTS releases, Ubuntu committed to ongoing security and critical fixes for a period of 5 years. The support period is now nearing its end and Ubuntu 10.04 will reach end of life on Thursday, April 30th. At that time, Ubuntu Security Notices will no longer include information or updated packages for Ubuntu 10.04. The supported upgrade path from Ubuntu 10.04 is via Ubuntu 12.04. Users are encouraged to evaluate and upgrade to our latest 14.04 LTS release via 12.04. Instructions and caveats for the upgrades may be found at https://help.ubuntu.com/community/PreciseUpgrades and https://help.ubuntu.com/community/TrustyUpgrades. Ubuntu 12.04 and 14.04 continue to be actively supported with security updates and select high-impact bug fixes. All announcements of official security updates for Ubuntu releases are sent to the ubuntu-security-announce mailing list, information about which may be found at https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce. Since its launch in October 2004 Ubuntu has become one of the most highly regarded Linux distributions with millions of users in homes, schools, businesses and governments around the world. Ubuntu is Open Source software, costs nothing to download, and users are free to customise or alter their software in order to meet their needs. On behalf of the Ubuntu Release Team, Adam Conrad -- ubuntu-security-announce mailing list ubuntu-security-announce em lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce ----- End forwarded message -----