16日 木曜日、友引

+ RHSA-2017:0527 Moderate: tomcat6 security update
https://rhn.redhat.com/errata/RHSA-2017-0527.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8745

+ UPDATE: Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170310-struts2

+ Cisco Mobility Express 1800 Access Point Series Authentication Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ap1800
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3831

+ Cisco Meshed Wireless LAN Controller Impersonation Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-wlc-mesh
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3854

+ Cisco Workload Automation and Tidal Enterprise Scheduler Client Manager Server Arbitrary File Read Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-tes
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3846

+ Cisco StarOS SSH Privilege Escalation Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3819

+ Cisco Web Security Appliance URL Filtering Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-wsa
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3870

+ Cisco WebEx Meetings Server XML External Entity Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-wms
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3811

+ Cisco WebEx Meetings Server Authentication Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-webex
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3880

+ Cisco UCS Director Cross-Site Scripting Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucs
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3868

+ Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucm2
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3877

+ Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucm2
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3874

+ Cisco Unified Communications Manager Web Interface Cross-Site Scripting Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3872

+ Cisco TelePresence Server API Privilege Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-tps
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3815

+ Cisco Prime Service Catalog Multiple Cross-Site Scripting Vulnerabilities
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-psc
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3866

+ Cisco Nexus 9000 Series Switches Remote Login Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-nss1
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3879

+ Cisco Nexus 9000 Series Switches Telnet Login Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-nss
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3878

+ Cisco Prime Optical for Service Providers RADIUS Secret Disclosure Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-cpo
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3871

+ Cisco Prime Infrastructure API Credentials Management Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-cpi
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3869

+ Cisco Nexus 7000 Series Switches Access-Control Filtering Mechanisms Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-cns
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3875

+ Cisco Adaptive Security Appliance BGP Bidirectional Forwarding Detection ACL Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asa
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3867

+ Linux kernel 4.10.3, 4.9.15, 4.4.54 released
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.3
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.15
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.54

+ UPDATE: JVNVU#95841181 Microsoft Windows の SMB Tree Connect Response パケットの処理にサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/vu/JVNVU95841181/index.html

+ UPDATE: JVNVU#93610402 Apache Struts2 に任意のコードが実行可能な脆弱性
http://jvn.jp/vu/JVNVU93610402/index.html

+ VMware Workstation and Fusion Memory Access Error in Drag and Drop Function Lets Local Users on a Guest System Gain Elevated Privileges on the Host System
http://www.securitytracker.com/id/1038025
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4901

+ Microsoft Edge Fetch API Arbitrary Header Setting
https://cxsecurity.com/issue/WLB-2017030144
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0140

+ Apache Struts Jakarta Multipart Parser OGNL Injection
https://cxsecurity.com/issue/WLB-2017030143
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638

VU#553503 D-Link DIR-130 and DIR-330 are vulnerable to authentication bypass and do not protect credentials
https://www.kb.cert.org/vuls/id/553503

「重要インフラの防御で重要なのは、行動計画の立案だ」とNISC瓜生氏
http://itpro.nikkeibp.co.jp/atcl/news/17/031600839/?ST=security&itp_list_theme

社長に「よし、分かった」と言わせるセキュリティ会話術
「サイバー攻撃を完全に防げ」と言われたら、“折衷案”で説得しよう
http://itpro.nikkeibp.co.jp/atcl/column/17/021400032/030800004/?ST=security&itp_list_theme

Mozilla: Everyone's scared of hackers but clueless about fending them off
http://www.linuxsecurity.com/content/view/171050/169/

Hire a DDoS service to take down your enemies
http://www.linuxsecurity.com/content/view/171049/169/

Debunking 5 Myths About DNS
http://www.linuxsecurity.com/content/view/171048/169/