TrustKeeper Scan Engine Update for March 09, 2016

Summary

The latest update to the TrustKeeper scan engine that powers our Trustwave Vulnerability Management product (including both internal and external vulnerability scanning) is now available. Enjoy!

New Vulnerability Test Highlights

Some of the more interesting vulnerability tests we added recently are as follows:

Cisco

• Cisco ASA Internet Key Exchange Remote Command Execution (CVE-2016-1287)

FILL_ME_IN_MANUALLY

• Bind vulnerable to DoS via a malformed Address Prefix List (APL) record (CVE-2015-8704)
• Bind vulnerable to DoS via OPT pseudo-RR data or ECS options (CVE-2015-8705)
• Multiple Cross-site Scripting Vulnerabilities in Open Source Point of Sale (CVE-2015-0299)
• nginx Resolver: invalid pointer dereference (CVE-2016-0742)
• OpenSourcePOS Authentication Brute Force
• phpMyAdmin Cross-site Framing in setup.php (CVE-2008-3456)
• phpMyAdmin Cross-site scripting in normalization page (CVE-2016-2043)
• phpMyAdmin Cross-site scripting in setup.php (CVE-2008-3457)
• phpMyAdmin Cross-site scripting vulnerability in SQL editor (CVE-2016-2045)
• phpMyAdmin Cross-site scripting when register_globals is enabled (CVE-2008-2960)
• phpMyAdmin Full path disclosure in common.inc.php (CVE-2016-2038)
• phpMyAdmin Full path disclosure in SQL parser (CVE-2016-2044)
• phpMyAdmin Information Disclosure in AES.php and Rijndael.php (CVE-2016-2042)
• phpMyAdmin Insecure XSRF/CSRF token comparison (CVE-2016-2041)
• phpMyAdmin Insecure XSRF/CSRF token generation (CVE-2016-2039)
• phpMyAdmin Multiple authenticated Cross-site scripting Vulnerabilities (CVE-2016-2040)
• phpMyAdmin Setup Script Cross-Site Request Forgery Vulnerability. (CVE-2009-4605)
• Windows Remote Management Default/Guessable Credentials
• phpMyAdmin Insecure random number generation for password suggestion (CVE-2016-1927)

Microsoft

• Multiple Vulnerabilities in Microsoft Windows 8.1/Server 2012 R2 (CVE-2013-3869, CVE-2013-3899, CVE-2013-3900, CVE-2013-3902, CVE-2013-3903, CVE-2013-3907, CVE-2013-3918, CVE-2013-3940, CVE-2013-5056, CVE-2013-5058, CVE-2014-0253, CVE-2014-0255, CVE-2014-0256, CVE-2014-0257, CVE-2014-0263, CVE-2014-0266, CVE-2014-0271, CVE-2014-0295, CVE-2014-0296, CVE-2014-0300, CVE-2014-0301, CVE-2014-0315, CVE-2014-0316, CVE-2014-0317, CVE-2014-0318, CVE-2014-0323, CVE-2014-1767, CVE-2014-1806, CVE-2014-1807, CVE-2014-1811, CVE-2014-1812, CVE-2014-1814, CVE-2014-1816, CVE-2014-1817, CVE-2014-1818, CVE-2014-1819, CVE-2014-1824, CVE-2014-2780, CVE-2014-2781, CVE-2014-2814, CVE-2014-4060, CVE-2014-4062, CVE-2014-4064, CVE-2014-4072, CVE-2014-4073, CVE-2014-4074, CVE-2014-4078, CVE-2014-4113, CVE-2014-4114, CVE-2014-4118, CVE-2014-4121, CVE-2014-4122, CVE-2014-4148, CVE-2014-4149, CVE-2014-6317, CVE-2014-6318, CVE-2014-6321, CVE-2014-6322, CVE-2014-6324, CVE-2014-6331, CVE-2014-6332, CVE-2014-6352, CVE-2014-6353, CVE-2014-6355, CVE-2015-0001, CVE-2015-0002, CVE-2015-0003, CVE-2015-0004, CVE-2015-0005, CVE-2015-0006, CVE-2015-0008, CVE-2015-0009, CVE-2015-0010, CVE-2015-0011, CVE-2015-0014, CVE-2015-0015, CVE-2015-0016, CVE-2015-0057, CVE-2015-0058, CVE-2015-0059, CVE-2015-0060, CVE-2015-0061, CVE-2015-0062, CVE-2015-0073, CVE-2015-0074, CVE-2015-0075, CVE-2015-0076, CVE-2015-0077, CVE-2015-0078, CVE-2015-0079, CVE-2015-0080, CVE-2015-0081, CVE-2015-0084, CVE-2015-0087, CVE-2015-0088, CVE-2015-0089, CVE-2015-0090, CVE-2015-0091, CVE-2015-0092, CVE-2015-0093, CVE-2015-0094, CVE-2015-0095, CVE-2015-0096, CVE-2015-1635, CVE-2015-1637, CVE-2015-1638, CVE-2015-1643, CVE-2015-1644, CVE-2015-1647, CVE-2015-1648, CVE-2015-1670, CVE-2015-1671, CVE-2015-1672, CVE-2015-1674, CVE-2015-1675, CVE-2015-1676, CVE-2015-1677, CVE-2015-1678, CVE-2015-1679, CVE-2015-1680, CVE-2015-1681, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, CVE-2015-1699, CVE-2015-1701, CVE-2015-1702, CVE-2015-1716, CVE-2015-1719, CVE-2015-1720, CVE-2015-1721, CVE-2015-1722, CVE-2015-1723, CVE-2015-1756, CVE-2015-1769, CVE-2015-2361, CVE-2015-2362, CVE-2015-2363, CVE-2015-2364, CVE-2015-2365, CVE-2015-2366, CVE-2015-2367, CVE-2015-2368, CVE-2015-2369, CVE-2015-2370, CVE-2015-2371, CVE-2015-2374, CVE-2015-2381, CVE-2015-2382, CVE-2015-2387, CVE-2015-2416, CVE-2015-2417, CVE-2015-2423, CVE-2015-2426, CVE-2015-2428, CVE-2015-2429, CVE-2015-2430, CVE-2015-2431, CVE-2015-2432, CVE-2015-2433, CVE-2015-2434, CVE-2015-2435, CVE-2015-2440, CVE-2015-2453, CVE-2015-2454, CVE-2015-2455, CVE-2015-2456, CVE-2015-2458, CVE-2015-2459, CVE-2015-2460, CVE-2015-2461, CVE-2015-2462, CVE-2015-2463, CVE-2015-2464, CVE-2015-2465, CVE-2015-2471, CVE-2015-2472, CVE-2015-2473, CVE-2015-2476, CVE-2015-2478, CVE-2015-2479, CVE-2015-2480, CVE-2015-2481, CVE-2015-2504, CVE-2015-2506, CVE-2015-2507, CVE-2015-2508, CVE-2015-2509, CVE-2015-2510, CVE-2015-2511, CVE-2015-2512, CVE-2015-2513, CVE-2015-2514, CVE-2015-2515, CVE-2015-2516, CVE-2015-2517, CVE-2015-2518, CVE-2015-2519, CVE-2015-2524, CVE-2015-2525, CVE-2015-2526, CVE-2015-2527, CVE-2015-2528, CVE-2015-2529, CVE-2015-2530, CVE-2015-2534, CVE-2015-2535, CVE-2015-2546, CVE-2015-2548, CVE-2015-2549, CVE-2015-2550, CVE-2015-2552, CVE-2015-2553, CVE-2015-2554, CVE-2015-6095, CVE-2015-6096, CVE-2015-6099, CVE-2015-6100, CVE-2015-6101, CVE-2015-6102, CVE-2015-6103, CVE-2015-6104, CVE-2015-6106, CVE-2015-6107, CVE-2015-6108, CVE-2015-6109, CVE-2015-6111, CVE-2015-6112, CVE-2015-6113, CVE-2015-6115, CVE-2015-6125, CVE-2015-6126, CVE-2015-6127, CVE-2015-6128, CVE-2015-6131, CVE-2015-6132, CVE-2015-6133, CVE-2015-6171, CVE-2015-6173, CVE-2015-6174, CVE-2015-6175, CVE-2016-0006, CVE-2016-0007, CVE-2016-0008, CVE-2016-0009, CVE-2016-0014, CVE-2016-0015, CVE-2016-0016, CVE-2016-0018, CVE-2016-0019, CVE-2016-0020, CVE-2016-0033, CVE-2016-0036, CVE-2016-0037, CVE-2016-0038, CVE-2016-0040, CVE-2016-0041, CVE-2016-0042, CVE-2016-0044, CVE-2016-0046, CVE-2016-0047, CVE-2016-0048, CVE-2016-0049, CVE-2016-0050, CVE-2016-0051, CVE-2016-0058)

PHP

• phpMyAdmin Setup Script PHP Injection Vulnerability (CVE-2010-3055)

How to Update?

All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.