The team in the US is going through the early stages of post-Thanksgiving turkey and gravy withdrawal, but we're trying not to let that slow us down. We've released a new update to the TrustKeeper scanner that includes tests for a cornucopia of more than 40 new vulnerabilities, as well numerous improvements to reduce false-positives.
New Vulnerability Test Highlights
Some of the more interesting vulnerability tests we added recently are as follows:
Cisco
- Cisco ASA DHCP Memory Allocation Denial of Service Vulnerability (CVE-2012-4643)
- Cisco ASA DCERPC Inspection Denial of Service Vulnerabilities (CVE-2012-4662, CVE-2012-4663)
- Cisco ASA SIP Inspection Media Update Denial of Service Vulnerability (CVE-2012-4660)
- Cisco ASA DCERPC Inspection Buffer Overflow Vulnerability (CVE-2012-4661)
- Cisco ASA SSL VPN Authentication Denial of Service Vulnerability (CVE-2012-4659)
- Cisco IOS Software and Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability (CVE-2012-3949)
- Cisco IOS Reverse SSH Denial of Service Vulnerability (CVE-2012-0386)
- Cisco MACE/WAAS Denial of Service Vulnerability (CVE-2012-1312, CVE-2012-1314)
- Cisco IOS Software FlexVPN Denial of Service Vulnerability (CVE-2012-3893)
- Cisco SIP Packet NAT Denial of Service Vulnerability (CVE-2011-3276)
- Cisco IOS Software Chunk Leaks at ipnat node and ipnat entry with Codenomicon SIP Suite (CVE-2011-2578)
Microsoft
- Vulnerability in SMB Server Could Allow Denial of Service (MS11-048) (CVE-2011-1267)
- Vulnerability in Active Directory Certificate Services Web Enrollment Could Allow Elevation of Privilege (MS11-051) (CVE-2011-1264)
- Microsoft .NET Common Language Runtime Remote Code Execution Vulnerabilities (MS10-060) (CVE-2010-1898)
Other
- DotNetNuke Open Redirect Vulnerability in LinkClick.aspx
- mod_cluster Access Restriction Bypass Vulnerability (CVE-2012-1154)
- Joomla! 'language search' Component Cross Site Scripting Vulnerability (CVE-2012-5455)
- Atlassian JIRA XML Parsing Denial of Service Vulnerability (CVE-2012-2926)
How to Update?
All Trustwave customers using the TrustKeeper Scan Engine receive the updates "auto-magically" as soon as an update is available. No action is required.