InfoSec News

Cisco issued three security advisories today, 20 JUN 2012; two are new, one is an update.

NEW: Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module Denial of Service Vulnerability

Cisco ASA 5500 Series Adaptive Security Appliances (Cisco ASA) and Cisco Catalyst 6500 Series ASA Services Module (Cisco ASASM) contain a vulnerability that may allow an unauthenticated, remote attacker to cause the reload of the affected device.

NEW: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client

The Cisco AnyConnect Secure Mobility Client is affected by the following vulnerabilities:

Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerability

Cisco AnyConnect Secure Mobility Client VPN Downloader Software Downgrade Vulnerability

Cisco AnyConnect Secure Mobility Client and Cisco Secure Desktop HostScan Downloader Software Downgrade Vulnerability

Cisco AnyConnect Secure Mobility Client 64-bit Java VPN Downloader Arbitrary Code Execution Vulnerability


UPDATED: Cisco Application Control Engine Administrator IP Address Overlap Vulnerability

A vulnerability exists in Cisco Application Control Engine (ACE) software. Administrative users may be logged into an unintended context (virtual instance) on the ACE when running in multicontext mode.


Russ McRee | @holisticinfosec
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
An Australian Federal Court judge ordered Apple to pay a A$2.25 million (US$2.28 million) fine and $300,000 in court costs to settle a lawsuit accusing the company of falsely marketing the 4G capabilities of its latest iPad.
Larry Ellison might have a new place to dock his yacht. The billionaire CEO of Oracle has reached an agreement to buy 98 percent of Lanai, one of Hawaii's eight main islands.
A technology coming later this year from a startup called Bromium will secure computers not by blocking them off from suspect data and applications but by isolating anything untrusted from the core of the OS.
Customers of Amazon Web Services may be unknowingly locking their data and computational logic in with the popular cloud service, making it difficult to move or significantly modify those resources, the president of a competing cloud provider asserted Wednesday.
Samsung is looking into the idea of hosting its own cloud services to extend the appeal of its Android-based consumer smartphones and tablets to enterprises, the company said on Wednesday.
Verizon Wireless will add 46 U.S. cities to its 4G LTE network on Thursday, for a total of 304 markets.
Quagga bgpd 'bgp_capability_orf()' BGP OPEN Message Remote Denial Of Service Vulnerability
This article is the first in a series called The 12 Principles of Agile IT Governance. The series is designed to help board members and senior managers leverage technology excellence as a competitive advantage for their organization. Each article discusses a key principle of agile IT governance and presents tactical measures that allow for deployment of that principle.
Python SimpleHTTPServer 'list_directory()' Function Cross Site Scripting Vulnerability
Oracle Database Server 'TNS Listener' Remote Poisoning Vulnerability
Google's executive chairman, Eric Schmidt, warned that the World Wide Web isn't as worldwide as it needs to be.
Bento 4 for iPad (I know, I know, if this is Bento 4, what happened to Bento 2 and 3?) is a significant update to what was already a useful and powerful personal database app for the iPad. A completely redesigned user interface makes it easier to create and add data to your databases, the app offers 40 Retina-ready themes and, best of all, you are no longer required to have a Mac version of Bento in order to create sophisticated databases. Bento 4 is a standalone iOS app that is just as capable of creating and managing collections of information as is its desktop counterpart.
Oracle on Wednesday agreed to accept "zero" damages for the outstanding copyright infringement claims in its lawsuit against Google over its use of Java in Android.
An unpatched vulnerability in the Microsoft XML Core Services (MSXML) is being exploited in attacks launched from compromised websites to infect computers with malware, according to security researchers from antivirus vendor Sophos.
Enterprise open source software provider Red Hat has jumpedinto the emerging NoSQL market, releasing an in-memory data store as part of an update of its JBoss management platform.
HP could have joined in on Oracle's acquisition of Sun Microsystems until just before the deal was announced, Oracle co-President Safra Catz told a judge on Tuesday.
Analyst firm Gartner on Wednesday said it has lowered its 2012 growth estimate for the global enterprise applications market to $120.4 billion, citing "limited signs" of economic improvement in the short term.
Cisco Security Advisory: Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module Denial of Service Vulnerability
Cisco Security Advisory: Cisco Application Control Engine Administrator IP Address Overlap Vulnerability
Cisco Security Advisory: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
Malicious sites discovered via Google?s Safe Browsing effort include compromised websites and others designed for malware distribution or phishing.

Add to digg Add to StumbleUpon Add to del.icio.us Add to Google
[ MDVSA-2012:097 ] python
Microsoft unveiled Windows Phone 8 on Wednesday, confirming the mobile operating system will share core code with Windows 8, and will add support for mobile wallet and NFC when WP8 arrives in the fall.
Beware: Hubris, sycophantism and déformation professionnelle can spread from the corner office to IT.
Microsoft's introduction Monday of the new Surface tablet may have been dramatic, but the presentation left as many questions unanswered as it resolved. We offer some clues, based on what is known so far.
A U.S. House of Representatives committee has told the United Nations International Telecommunication Union to keep its hands off the Internet.
Apple has little to worry about from Microsoft's tradition-breaking move to sell its own tablets, analysts say. Can the Microsoft Surface successfully take on the iPad?
Apple was found guilty of infringing on a UMTS-related patent owned by Samsung and must compensate Samsung for an undetermined amount, a Dutch court ruled on Wednesday.
At home improvement store Lowe's, executives don't just focus on their current employees. They're casting an eye toward the people they'll be hiring months or even years from now.
HP today released a smaller version of its Windows NAS file server, the X5520. The new model is aimed at SMBs and addressing unstructured data growth due to trends such as bring-your-own technology.
[ MDVSA-2012:096 ] python
The idea that employees who quit their jobs are more likely to be running away from their managers than they are to be bailing out on their companies, was first popularized by two researchers from The Gallup Organization in 1999.
Amazon's Appstore will open this summer in the U.K., Germany, France, Italy and Spain, and developers can now submit apps for distribution in those countries, the company said on Wednesday.
Commentics 2.0 <= Multiple Vulnerabilities
Multiple vulnerabilities in [email protected]
[Announcement] ClubHack Magazine Issue 29, June 2012 Released
Two-step verification, which adds a second layer of security to a log-in process, has been available since 2010 in Google Apps, but now IT administrators will be able to enforce it for all their users as a requirement.
The highly sophisticated Flame malware was jointly developed by the U.S. and Israeli governments in preparation for a cybersabotage campaign to disrupt Iran's nuclear fuel enrichment efforts, according to a media report.
Oracle MySQL Server Multiple Unspecified Security Vulnerabilities
BusyBox 'udhcpc' Shell Characters in Response Remote Code Execution Vulnerability
389 Directory Server Certificate Groups Remote Denial of Service Vulnerability
With all the exhilaration surrounding the debut of Apple's pioneering Retina MacBook Pros, it's easy to overlook that the company also upgraded the rest of its pro laptop lineup. In addition to the Retina MacBook Pro--the justifiable new standard against which Apple's other laptops (indeed all laptops) will now be judged--the company has also updated a pair of 13-inch and a pair of 15-inch non-Retina MacBook Pros. These new "regular" models offer a speed boost over their late-2011 predecessors thanks to brand new processors and video components, and feature updated technology, including USB 3.
Acer on Wednesday announced new Timeline Ultra M5 ultrabooks starting at $679.99 that will be upgradable to Microsoft's upcoming Windows 8 Pro for $14.99.
Google is 'surprised' that the U.K. Information Commissioner's Office (ICO) reopened its investigation into the way the company's Street View cars gathered personal data from unencrypted Wi-Fi networks, the company said in a letter to the ICO on Monday.
Qt SSL Certificate IP Address Wildcard Validation Security Bypass Vulnerability
PECL Alternative PHP Cache 'apc.php' Cross Site Scripting Vulnerability

BFC Financial Corporation and Bluegreen Corporation Announce ...
MarketWatch (press release)
... on BFC's website at www.bfcfinancial.com under the tab "Investor Relations -- Regulatory Info -- SEC Filings" or by directing a request by mail to BFC Financial ...

and more »
A Japanese group devoted to developing software for the iPhone and iPad is set to launch Thursday, with major domestic firms like Hitachi and NEC mulling becoming members.
Apple's repair policies have come under fire in China from a government funded consumer watchdog group, which has criticized the company for using refurbished parts to fix products.
Eastman Kodak has filed a complaint against Apple and FlashPoint Technology, accusing the two companies of attempts to delay and derail its efforts to sell its patents relating to digital imaging.
Samsung's Galaxy S III is one of the most hotly anticipated Android phones ever. So does it actually live up to all the hype?
A week ago we covered MS12-042 (Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2711167))on the monthly Microsoft patch update cycle. This Microsoft advisory includes two vulnerabilities:CVE-2012-0217 and CVE-2012-1515 (VMware related).
Unfortunately, the official CVE-2012-0217 only makes references to Microsoft Windows OS, but other environments are also affected by this local privilege escalation vulnerability associated to 64-bit Intel processors. From the US-CERTnote: Some 64-bit operating systems and virtualization software running on Intel CPU hardware are vulnerable to a local privilege escalation attack. The vulnerability may be exploited for local privilege escalation or a guest-to-host virtual machine escape. In particular, it affects FreeBSD or Xen (RedHat, SUSE, etc).
More details at Vulnerability Note VU#649219:SYSRET 64-bit operating system privilege escalation vulnerability on Intel CPU hardware.

Raul Siles

Founder and Senior Security Analyst with Taddong

www.taddong.com (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Linux Kernel dl2k Network Driver IOCTL Handling Local Denial of Service Vulnerability
WikiLeaks founder Julian Assange has requested political asylum from the government of Ecuador, and is under the protection of the country's embassy in London, the whistle-blowing website said in a Twitter message on Tuesday.
Internet Storm Center Infocon Status