TrustKeeper Scan Engine Update – July 22, 2014

Summary

The latest update to the TrustKeeper Scan Engine is now available. Highlights of the release include tests for 14 new vulnerabilities.

New Vulnerability Test Highlights

Some of the more interesting vulnerability tests we added recently are as follows:

Cisco

• Cisco ASA ASDM Privilege Escalation Vulnerability (CSCuj33496) (CVE-2014-2126)

• Cisco ASA SIP Denial of Service Vulnerability (CSCuh44052) (CVE-2014-2129)

• Cisco ASA SSL VPN Authentication Bypass Vulnerability (CSCua85555) (CVE-2014-2128)

Sendmail

• Sendmail sm_close_on_exec File Descriptors Vulnerability (CVE-2014-3956)

Samba

• Samba Internal DNS Server Denial of Service Vulnerability (CVE-2014-0239)

Apache

• Apache Tomcat Information Disclosure via XML Parser (CVE-2014-0119)

PHP

• PHP Insecure Temporary File Vulnerability (CVE-2014-3981)

• PHP cdf_count_chain Denial of Service Vulnerability (CVE-2014-3480)

• PHP cdf_check_stream_offset Denial of Service Vulnerability (CVE-2014-3479)

• PHP cdf_read_short_sector Denial of Service Vulnerability (CVE-2014-0207)

• PHP cdf_read_property_info Denial of Service Vulnerability (CVE-2014-3487)

• PHP mconvert Denial of Service Vulnerability (CVE-2014-3478)

• PHP SPL Arbitrary Code Execution Vulnerability (CVE-2014-3515)

• PHP phpinfo Information Disclosure Vulnerability (CVE-2014-4721)

How to Update?

All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.