Vulnerabilities Weekly Summary Ending August 5

This week  security updates were released by Mozilla, Cisco, VMWare and Apple to address vulnerabilities affecting their respective products.

Mozilla releases security updates for Firefox

Mozilla released update 48 for Firefox and update 45.3.  The updates addresses over 20 vulnerabilities, three of which are deemed critical (“Security Advisories for Firefox“, 2 Aug. 2016).

CVE-2016-2835 – Vulnerabilities in the browser engine in Mozilla Firefox before 48.0 allow remote attackers to cause a memory corruption and application crash or possibly execute arbitrary code.

CVE-2016-2836 – Vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a memory corruption and application crash or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown.

CVE-2016-5258 – Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code.  Exploiting incorrect free operations on DTLS objects during the shutdown of a WebRTC session can caused.

CVE-2016-5259 – Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by way of a script that closes its own Service Worker within a nested sync event loop.

Cisco releases security updates

Cisco released nine security updates for their products. Five of them are deemed high or critical.

CVE-2015-6397 – vulnerability in the default account of Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and the Cisco RV215W Wireless-N VPN Router could allow an authenticated, remote attacker to gain root access to the device due to improper role-based access control (RBAC) of the default account (“Cisco RV110W, RV130W, and RV215W Routers Static Credential Vulnerability“, 3 Aug. 2016). 

CVE-2016-1430 – vulnerability in the web interface of the Cisco RV180 VPN Router and Cisco RV180W Wireless-N Multifunction VPN Router could allow an authenticated, remote attacker to execute arbitrary commands with root-level privileges by sending a crafted HTTP request to the affected device.  This vulnerability is due to improper input validation of HTTP requests (“Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Remote Code Execution Vulnerability, 3 Aug. 2016).

CVE-2016-1466 –  vulnerability in Session Initiation Protocol (SIP) processing functions of the Cisco Unified Communications Manager Instant Messaging (IM) and Presence Service could allow an unauthenticated, remote attackerto exploit this vulnerability by sending a crafted SIP packet to a targeted system and cause the Cisco SIP Proxy Daemon (sipd) process to restart unexpectedly which may result in a denial of service (DoS) condition on a targeted system (“Cisco Unified Communications Manager IM and Presence Service SIP Packet Processing Denial of Service Vulnerability“, 3 Aug. 2016).

CVE-2016-1478 – vulnerability in the processing of Network Time Protocol (NTP) packets by Cisco IOS could allow an unauthenticated, remote attacker to exploit this vulnerability by sending a number of crafted NTP packets to be processed by an affected device and cause an interface wedge and an eventual denial of service (DoS) condition on the affected device.
The vulnerability is due to insufficient checks on clearing the invalid NTP packets from the interface queue (“Cisco IOS Software Crafted Network Time Protocol Packets Denial of Service“, 3 Aug. 2016).

CVE-2016-1429 – vulnerability in the web interface of the Cisco RV180 VPN Router and Cisco RV180W Wireless-N Multifunction VPN Router could allow an unauthenticated, remote attacker to access arbitrary files on the system by sending a crafted HTTP request to the affected device. This vulnerability allows the attacker to perform directory traversal. The vulnerability is due to lack of proper input verification and sanitization of the user input directory path (“Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Unauthorized Access Vulnerability“, 3 Aug. 2016).

VMWare releases security update

VMWare released a security update to address two vulnerabilities affecting their virtualization products (“VMware Security Advisories: VMSA-2016-0010”, 5 Aug. 2016):

CVE-2016-5330 – A DLL hijacking vulnerability affecting the VMware Tools “Shared Folders” (HGFS) feature running on Microsoft Windows. An attacker would need write access to a network share and they would need to social engineer the victim into opening their document which may lead to arbitrary code execution with the privileges of the victim

CVE-2016-5331 -vCenter Server and ESXi contain an HTTP header injection vulnerability due to lack of input validation. This vulnerability can be exploited by settubg arbitrary HTTP response headers and cookies, which may allow for cross-site scripting and malicious redirect attacks.

Apple releases security update for iOS

Apple released a security update for iOS v9.3.4 to address a single vulnerability (“About the security content of iOS 9.3.4“, (5 Aug. 2016):

CVE-2016-4654 – A memory corruption issue may allow an application to be able to execute arbitrary code with kernel privileges

As always please refer to our Patches and Updates page for links to the downloads of the updates.

References:

(2 Aug. 2016). “Security Advisories for Firefox“. Mozilla Corp. Retrieved from https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox

(3 Aug. 2016). “Cisco RV110W, RV130W, and RV215W Routers Static Credential Vulnerability“. Cisco Systems, Inc. Retrieved from http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-rv110_130w2

(3 Aug. 2016). “Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Remote Code Execution Vulnerability”. Cisco Systems, Inc. Retrieved from http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-rv180_2

(3 Aug. 2016). “Cisco Unified Communications Manager IM and Presence Service SIP Packet Processing Denial of Service Vulnerability“. Cisco Systems, Inc. Retrieved from http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-ucm

(3 Aug. 2016). “Cisco IOS Software Crafted Network Time Protocol Packets Denial of Service“. Cisco Systems, Inc. Retrieved from http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160804-wedge

(3 Aug. 2016). “Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Unauthorized Access Vulnerability“. Cisco Systems, Inc. Retrieved from http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-rv180_1

(5 Aug. 2016). “VMware Security Advisories: VMSA-2016-0010”. VMWare, Inc. Retrieved from http://www.vmware.com/security/advisories/VMSA-2016-0010.html

(5 Aug. 2016). “About the security content of iOS 9.3.4“. Apple, Inc. Retrieved from https://support.apple.com/en-us/HT207026