TrustKeeper Scan Engine Update – August 21, 2014

Summary

The latest update to the TrustKeeper Scan Engine is now available. This week's update includes new tests for nine vulnerabilities.

New Vulnerability Test Highlights

Some of the more interesting vulnerability tests we added recently are as follows:

Ruby on Rails

• Ruby on Rails strong parameter bypass with create_with (CVE-2014-3514)
• Microsoft Windows 2000
• Vulnerability in Server Service Could Allow Remote Code Execution (MS08-067) (CVE-2008-4250)

Webmin

• Webmin Encrypted Password Disclosure (CVE-2005-0427)
• Webmin Remote Directory Traversal Vulnerability (CVE-2006-3274)
• Webmin Unspecified Command Execution Vulnerability (CVE-2007-5066)

WordPress

• WordPress Cross Site Request Forgery Token Time Brute-Force Weakness (CVE-2014-5204)
• WordPress CSRF Token Delimiter Brute-Force Weakness (CVE-2014-5205)
• WordPress Multisite Avatar Cross Site Scripting Privilege Escalation (CVE-2014-5240)
• WordPress Widget Implementation PHP Serialization Vulnerability (CVE-2014-5203)

How to Update?

All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.