Alerts – Page 980 – Tanzania Computer Emergency Response Team

VMware Security Updates

15th August 2018

VMware has released security updates to address vulnerabilities to its multiple products. Exploitation of these vulnerabilities may lead into disclosure of sensitive information and execution of code on the host machine. Users and administrators are encouraged to review VMSA-2018-0019.1, VMSA-2018-0020, VMSA-2018-0021 and VMSA-2018-0022 VMware security advisories and apply necessary updates.

Microsoft Security Updates

15th August 2018

Microsoft has released security updates to address vulnerabilities to its multiple products. Exploitation of these vulnerabilities may allow attacker to take control of an affected system.

Users and Administrators are encouraged to review released Microsoft Security bulletins and apply necessary updates. For more information view Release Notes and Security Update Summary.

Adobe Security Updates

15th August 2018

Adobe has released security update to address vulnerabilities to its multiple products. Exploitation of these vulnerabilities may allow an attacker to take control of an affected system.

Users and Administrators are encouraged to review released Adobe security bulletins and apply necessary updates. For more information view links below:

Oracle Security Update

15th August 2018

Oracle has released security update to address vulnerability in Oracle database versions 11.2.0.4, 12.2.0.1 and 12.1.0.2 on Windows and versions 12.1.0.2 on Unix or Linux. Exploitation of this vulnerability may allow remote unauthenticated attacker to take complete control of an affected product and gain shell access to the underlying server.

Users and Administrators are encouraged to review Oracle Security Advisory and apply necessary updates.

Vulnerability in Linux Kernel

15th August 2018

Advisory No: TZCERT/SA/2018/08/13

Date of First Release: 14^th August 2018

Source:

Multi-State Information Sharing and Analysis Center (MS-ISAC) and Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC).

Product Affected:

The vulnerable Linux Kernel version is 4.9+. However, several Linux distributions have backported some of the networking code from version 4.9 into their kernels resulting in additional affected systems. The additional affected operating systems are listed below:-

Ubuntu 16.04 – linux-azure, linux-gcp, linux-hwe;
Ubuntu 18.04 – linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2;
Junos OS – MX Series, QFX Series, NFX Series, PTX Series, vMX, vSRX, vQFX, vPTX, etc.
FreeBSD – All supported Versions;
Debian – 4.9.110-3+deb9u1;
SUSE Linux Enterprise 15;
Arista EOS – version 4.20 and lower;
Arista vEOS – 4.20, 4.18;
Akamai Technologies; and
Red Hat Enterprise Linux 6, 7, 7 for Real Time, 7 for ARM64, 7 for Power, Atomic Host.

Overview:

A vulnerability has been identified in the Linux Kernel that could allow Denial of Service (DoS) conditions over any open TCP port.

Description:

The Linux Kernel version 4.9 has been identified to be vulnerable to Denial of Service (DoS) conditions over any open TCP port. The fact that several linux distributions have backported some of the networking code from version 4.9, the scope of the vulnerability is much larger. Exploitation of this vulnerability is asymmetric, requiring a limited number of requests from the attack source.

The vulnerability is exploited through the use of specially crafted packets in a TCP session. When triggered, these packets make expensive calls to the Central Processing Unit (CPU) that can quickly exhaust available resources. The vulnerable functions, tcp_collapse_ofo_queue () and tcp_prune_ofo_queue (), are used to deal with reassembling TCP segments. This attack requires a continuous two-way TCP connection to an open port and it cannot be performed using spoofed Internet Protocol (IP) addresses.

Impact:

Successful exploitation of this vulnerability could lead to prolonged periods of down time and loss of functionality.

Solution:

Users and administrators are urged to apply appropriate testing and immediately apply appropriate updates provided by your Linux Distribution Vendor to vulnerable systems.

Furthermore, systems administrators are recommended to limit external network access to affected products, if not required; and also use intrusion detection systems to monitor their critical systems running on Linux Operating Systems (OS) for any signs of anomalous activity and take appropriate measures.

References: