CIS ADVISORY NUMBER: 2014-089 - Update
A vulnerability exists within the SSL version 3.0 protocol allowing an attacker to hijack and decrypt session cookies that are utilized between a user's web browser and the web site. Secure Sockets Layer (SSL) is a cryptographic protocol that is designed to provide secure network communication using X.509 certificates. This could lead to attackers temporarily impersonating web site visitor account logins and/or online payment systems.
- Any client or Web Server supporting SSLv3 protocol
- Large and medium government
ALERT: Microsoft Security Bulletins - October 2014
Microsoft Security Bulletin Summary for October 2014
US-CERT encourages users and administrators to review the bulletins and apply the necessary updates.
Primary Attack Vector: Specially crafted webpage
Publicly Disclosed: No
Assumptions: Some of these vulnerabilities would have to be used in conjunction with another vulnerability that allow remote code execution
Recommendations: Patch immediately after appropriate testing
Advisory Candidate: Yes
Critical Bourne Again SHell (BASH) Vulnerability Allows for Remote Code Execution
CIS ADVISORY NUMBER: 2014-080
A recent vulnerability has been discovered affecting the Bourne Again SHell (BASH). BASH is the default command-line shell processor that is often run in a text window on Linux and UNIX systems. BASH allows users to type commands that cause actions. In addition, BASH has the ability to read commands from a scripted file. Based on the wide use of Linux and UNIX systems, it can be assumed that most distributions running Linux and UNIX, as well Mac OS X, are likely vulnerable.
Successful exploitation could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Mac OS X
- ... more