2017年10月31日火曜日

31日 火曜日、友引












+ RHSA-2017:3082 Important: chromium-browser security update
https://access.redhat.com/errata/RHSA-2017:3082
CVE-2017-15396

+ CESA-2017:3081 Important CentOS 7 tomcat Security Update
https://lwn.net/Alerts/737719/

+ CESA-2017:3080 Important CentOS 6 tomcat6 Security Update
https://lwn.net/Alerts/737720/

+ UPDATE: Cisco Expressway Series, Cisco TelePresence Video Communication Server, and Cisco TelePresence Conductor REST API Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-expressway-tp-vcs

+ UPDATE: Cisco Smart Install Protocol Misuse
https://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20170214-smi

UPDATE: JVNVU#93703434 「楽々はがき」および「楽々はがき セレクト for 一太郎」にメモリ破壊の脆弱性
http://jvn.jp/vu/JVNVU93703434/

JVNVU#90609033 Wi-Fi Protected Access II (WPA2) ハンドシェイクにおいて Nonce およびセッション鍵が再利用される問題
http://jvn.jp/vu/JVNVU90609033/

GMOインターネットの「サイトM&A」、顧客情報1万4612件が流出
http://itpro.nikkeibp.co.jp/atcl/news/17/103002551/?ST=security&itp_list_theme

金融のデジタル化を促進、NRIと日本マイクロソフトが業界団体
http://itpro.nikkeibp.co.jp/atcl/news/17/103002549/?ST=security&itp_list_theme

Microsoft Windows 10 Creators Update 32-bit Ring-0 Code Execution
https://cxsecurity.com/issue/WLB-2017100212

2017年10月30日月曜日

30日 月曜日、先勝

+ MantisBT 2.8.0 and 2.7.1 released
http://www.mantisbt.org/blog/?p=540

+ RHSA-2017:3080 Important: tomcat6 security update
https://access.redhat.com/errata/RHSA-2017:3080
CVE-2017-12615
CVE-2017-12617
CVE-2017-5647
CVE-2017-5664

+ RHSA-2017:3081 Important: tomcat security update
https://access.redhat.com/errata/RHSA-2017:3081
CVE-2017-12615
CVE-2017-12617
CVE-2017-5647
CVE-2017-7674

+ CESA-2017:3075 Important CentOS 7 wget Security Update
https://lwn.net/Alerts/737593/

+ CESA-2017:3071 Moderate CentOS 6 ntp Security Update
https://lwn.net/Alerts/737592/

+ UPDATE: Cisco FXOS and NX-OS System Software Authentication, Authorization, and Accounting Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-aaavty

+ Linux kernel 4.13.10, 4.9.59, 4.4.95, 3.18.78 released
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.10
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.59
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.95
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.78

+ Hitachi Multiple Products Multiple Vulnerabilities
https://secuniaresearch.flexerasoftware.com/advisories/79763/
CVE-2016-10165
CVE-2016-9841
CVE-2017-10274
CVE-2017-10281
CVE-2017-10285
CVE-2017-10293
CVE-2017-10295
CVE-2017-10345
CVE-2017-10346
CVE-2017-10347
CVE-2017-10348
CVE-2017-10349
CVE-2017-10350
CVE-2017-10355
CVE-2017-10356
CVE-2017-10357
CVE-2017-10388

+ hitachi-sec-2017-131 Multiple Vulnerabilities in Cosminexus
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-131/index.html
CVE-2016-9841
CVE-2016-10165
CVE-2017-10274
CVE-2017-10281
CVE-2017-10285
CVE-2017-10293
CVE-2017-10295
CVE-2017-10345
CVE-2017-10346
CVE-2017-10347
CVE-2017-10348
CVE-2017-10349
CVE-2017-10350
CVE-2017-10355
CVE-2017-10356
CVE-2017-10357
CVE-2017-10388

+ hitachi-sec-2017-131 Cosminexusにおける複数の脆弱性
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-131/index.html
CVE-2016-9841
CVE-2016-10165
CVE-2017-10274
CVE-2017-10281
CVE-2017-10285
CVE-2017-10293
CVE-2017-10295
CVE-2017-10345
CVE-2017-10346
CVE-2017-10347
CVE-2017-10348
CVE-2017-10349
CVE-2017-10350
CVE-2017-10355
CVE-2017-10356
CVE-2017-10357
CVE-2017-10388

+ Postfix 3.2.4, 3.1.7, 3.0.11 released
http://mirror.postfix.jp/postfix-release/official/postfix-3.2.4.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-3.1.7.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-3.0.11.HISTORY

+ PHP 7.1.11 Released
http://www.php.net/ChangeLog-7.php#7.1.11

+ UPDATE: JVNVU#90609033 Wi-Fi Protected Access II (WPA2) ハンドシェイクにおいて Nonce およびセッション鍵が再利用される問題
http://jvn.jp/vu/JVNVU90609033/index.html

+ JVNVU#99266133 GNU Wget における複数のバッファオーバーフローの脆弱性
http://jvn.jp/vu/JVNVU99266133/index.html

Announcing General Availability of Amazon Aurora with PostgreSQL Compatibility
https://www.postgresql.org/about/news/1795/

ランサムウエア対処の鉄則
被害止まらぬランサムウエア、二つの攻撃手法を知り対処すべし
http://itpro.nikkeibp.co.jp/atcl/column/17/102600453/102700002/?ST=security&itp_list_theme

「ランサムウエアBad Rabbitは脆弱性を利用」、トレンドマイクロの追加調査で明らかに
http://itpro.nikkeibp.co.jp/atcl/news/17/102702543/?ST=security&itp_list_theme

アイカ工業がファイル改ざんの痕跡を確認、Bad Rabbit拡散の可能性強まる
http://itpro.nikkeibp.co.jp/atcl/news/17/102702539/?ST=security&itp_list_theme

2017年10月27日金曜日

27日 金曜日、仏滅

+ RHSA-2017:3071 Moderate: ntp security update
https://access.redhat.com/errata/RHSA-2017:3071
CVE-2017-6462
CVE-2017-6463
CVE-2017-6464

+ RHSA-2017:3075 Important: wget security update
https://access.redhat.com/errata/RHSA-2017:3075
CVE-2017-13089
CVE-2017-13090

+ Google Chrome 62.0.3202.75 released
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html
CVE-2017-15396

+ Mozilla Firefox 56.0.2 released
https://www.mozilla.org/en-US/firefox/56.0.2/releasenotes/

+ Apache OpenOffice 4.1.4 released
http://www.openoffice.org/security/bulletin.html
CVE-2017-3157
CVE-2017-9806
CVE-2017-12607
CVE-2017-12608

+ UPDATE: Oracle Critical Patch Update Advisory - October 2017
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

+ PHP 7.0.25, 5.6.32 Released
http://www.php.net/ChangeLog-7.php#7.0.25
http://www.php.net/ChangeLog-5.php#5.6.32

+ UPDATE: JVNVU#90609033 Wi-Fi Protected Access II (WPA2) ハンドシェイクにおいて Nonce およびセッション鍵が再利用される問題
http://jvn.jp/vu/JVNVU90609033/

+ Apache OpenOffice Multiple Remote Code Execution Vulnerabilities
http://www.securityfocus.com/bid/101585
CVE-2017-9806
CVE-2017-12607
CVE-2017-12608

ニュース解説
ビジネスメール詐欺の被害が国内でも続出、銀行が注意喚起
http://itpro.nikkeibp.co.jp/atcl/column/14/346926/102401175/?ST=security&itp_list_theme

デルがIoT戦略を発表、今後3年間で10億米ドルを投資
http://itpro.nikkeibp.co.jp/atcl/news/17/102602538/?ST=security&itp_list_theme

東急セキュリティとイッツコム、IoT活用のホームセキュリティサービス
http://itpro.nikkeibp.co.jp/atcl/news/17/102602534/?ST=security&itp_list_theme

2017年10月26日木曜日

26日 木曜日、先負

+ UPDATE: Cisco Integrated Management Controller Remote Code Execution Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc3

+ UPDATE: Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa

+ Samba 4.6.9 Available for Download
https://www.samba.org/samba/latest_news.html#4.6.9

+ UPDATE: JVNVU#90609033 Wi-Fi Protected Access II (WPA2) ハンドシェイクにおいて Nonce およびセッション鍵が再利用される問題
http://jvn.jp/vu/JVNVU90609033/

+ Apple Support iOS Application 1.1.1 Unencrypted Third Party Analytics
https://cxsecurity.com/issue/WLB-2017100188
CVE-2017-7147

Google Summer of Code 2017 Mentor Summit
https://www.samba.org/samba/latest_news.html#gsoc_summit_2017

ニュース解説
AWSとAzureを同時活用、先端技術を駆使したボットで番宣
http://itpro.nikkeibp.co.jp/atcl/column/14/346926/101901172/?ST=security&itp_list_theme

国内外の精鋭125人が集結、NTTグループがセキュリティ人材の会合
http://itpro.nikkeibp.co.jp/atcl/news/17/102502526/?ST=security&itp_list_theme

アイカ工業がWebサイトを一時閉鎖、Bad Rabbitが原因か
http://itpro.nikkeibp.co.jp/atcl/news/17/102502525/?ST=security&itp_list_theme

新手のランサムウエア「Bad Rabbit」、JPCERT/CCやセキュリティベンダーが警告
http://itpro.nikkeibp.co.jp/atcl/news/17/102502517/?ST=security&itp_list_theme

日本ヒューレット・パッカードがシングルサインオン製品の新版、分散配置対応を強化
http://itpro.nikkeibp.co.jp/atcl/news/17/102502514/?ST=security&itp_list_theme

ネットワン、マルウエア感染端末を検知・隔離するサービスを投入
http://itpro.nikkeibp.co.jp/atcl/news/17/102502513/?ST=security&itp_list_theme

新生サイバートラストの阿多社長、「IoT機器のセキュリティ対策は不足する」
http://itpro.nikkeibp.co.jp/atcl/news/17/102502510/?ST=security&itp_list_theme

NHKが3267名分の顧客情報を紛失、クレカ番号や氏名・住所など流出の可能性
http://itpro.nikkeibp.co.jp/atcl/news/17/102502509/?ST=security&itp_list_theme

2017年10月25日水曜日

25日 水曜日、友引

+ CESA-2017:2930 Important CentOS 7 kernel Security Update
https://lwn.net/Alerts/737297/

JVNVU#93703434 「楽々はがき」および「楽々はがき セレクト for ?太郎」にメモリ破壊の脆弱性
http://jvn.jp/vu/JVNVU93703434/index.html

ニュース解説
Windows Updateの失敗、誤ったプログラムによる被害は防げたか
http://itpro.nikkeibp.co.jp/atcl/column/14/346926/102401174/?ST=security&itp_list_theme

日本生命が最新型メインフレーム「IBM z14」採用、ハードウエア暗号を評価
http://itpro.nikkeibp.co.jp/atcl/news/17/102402508/?ST=security&itp_list_theme

KDDIがSD-WANサービスを発売、専用機器で簡単に環境構築
http://itpro.nikkeibp.co.jp/atcl/news/17/102402507/?ST=security&itp_list_theme

日立が新発想のUSBセキュリティ、利用制限をハードで後付け
http://itpro.nikkeibp.co.jp/atcl/news/17/102402504/?ST=security&itp_list_theme

2017年10月24日火曜日

24日 火曜日、先勝

+ CESA-2017:2998 Critical CentOS 6 java-1.8.0-openjdk Security Update
https://lwn.net/Alerts/737176/

+ CESA-2017:2972 Moderate CentOS 6 httpd Security Update
https://lwn.net/Alerts/737175/

+ CESA-2017:2998 Critical CentOS 7 java-1.8.0-openjdk Security Update
https://lwn.net/Alerts/737177/

+ phpMyAdmin 4.7.5 is released
https://www.phpmyadmin.net/news/2017/10/23/phpmyadmin-475-released/

+ UPDATE: Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2

+ UPDATE: Apache Struts 2 Remote Code Execution Vulnerability Affecting Multiple Cisco Products: September 2017
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170909-struts2-rce

+ UPDATE: Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa

+ UPDATE: Cisco NX-OS Software TCP Netstack Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-netstack

+ Cisco Spark Hybrid Calendar Service Information Disclosure Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171023-spark
CVE-2017-12310

+ curl 7.56.1 released
https://curl.haxx.se/changes.html#7_56_1

+ Apache HTTP Server 2.4.29 Released
http://www.apache.org/dist/httpd/Announcement2.4.html
http://www.apache.org/dist/httpd/CHANGES_2.4.29

+ UPDATE: JVNVU#90609033 Wi-Fi Protected Access II (WPA2) ハンドシェイクにおいて Nonce およびセッション鍵が再利用される問題
http://jvn.jp/vu/JVNVU90609033/index.html

+ cURL/libcURL CVE-2017-1000257 Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/101519
CVE-2017-1000257

+ GNU glibc CVE-2017-15671 Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/101517
CVE-2017-15671

2017年10月23日月曜日

23日 月曜日、赤口

+ RHSA-2017:2998 Critical: java-1.8.0-openjdk security update
https://access.redhat.com/errata/RHSA-2017:2998
CVE-2017-10274
CVE-2017-10281
CVE-2017-10285
CVE-2017-10295
CVE-2017-10345
CVE-2017-10346
CVE-2017-10347
CVE-2017-10348
CVE-2017-10349
CVE-2017-10350
CVE-2017-10355
CVE-2017-10356
CVE-2017-10357
CVE-2017-10388

+ RHSA-2017:2997 Important: chromium-browser security update
https://access.redhat.com/errata/RHSA-2017:2997
CVE-2017-15386
CVE-2017-15387
CVE-2017-15388
CVE-2017-15389
CVE-2017-15390
CVE-2017-15391
CVE-2017-15392
CVE-2017-15393
CVE-2017-15394
CVE-2017-15395
CVE-2017-5124
CVE-2017-5125
CVE-2017-5126
CVE-2017-5127
CVE-2017-5128
CVE-2017-5129
CVE-2017-5130
CVE-2017-5131
CVE-2017-5132
CVE-2017-5133

+ RHSA-2017:2972 Moderate: httpd security update
https://access.redhat.com/errata/RHSA-2017:2972
CVE-2017-12171
CVE-2017-9798

+ RHSA-2017:2966 Moderate: ansible security, bug fix, and enhancement update
https://access.redhat.com/errata/RHSA-2017:2966
CVE-2017-7550

+ RHSA-2017:2930 Important: kernel security and bug fix update
https://access.redhat.com/errata/RHSA-2017:2930
CVE-2016-8399
CVE-2017-1000111
CVE-2017-1000112
CVE-2017-11176
CVE-2017-14106
CVE-2017-7184
CVE-2017-7541
CVE-2017-7542
CVE-2017-7558

+ UPDATE: Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa

+ UPDATE: Cisco AMP for Endpoints Static Key Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171020-ampfe

+ Linux kernel 4.13.9, 4.9.58, 4.4.94, 3.18.77 released
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.9
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.58
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.94
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.77

2017年10月20日金曜日

20日 金曜日、先負

+ gawk 4.2.0 released
http://ftp.gnu.org/gnu/gawk/?C=M;O=D

+ RHSA-2017:2972 Moderate: httpd security update
https://access.redhat.com/errata/RHSA-2017:2972
CVE-2017-12171
CVE-2017-9798

+ RHSA-2017:2966 Moderate: ansible security, bug fix, and enhancement update
https://access.redhat.com/errata/RHSA-2017:2966
CVE-2017-7550

+ RHSA-2017:2930 Important: kernel security and bug fix update
https://access.redhat.com/errata/RHSA-2017:2930
CVE-2016-8399
CVE-2017-1000111
CVE-2017-1000112
CVE-2017-11176
CVE-2017-14106
CVE-2017-7184
CVE-2017-7541
CVE-2017-7542
CVE-2017-7558

+ CESA-2017:2911 Important CentOS 6 wpa_supplicant Security Update
https://lwn.net/Alerts/736856/

+ Ubuntu 17.10, 16.04.3 released
https://wiki.ubuntu.com/ArtfulAardvark/ReleaseNotes?_ga=2.239840512.228917382.1508457611-1754260706.1408405881
https://wiki.ubuntu.com/XenialXerus/ReleaseNotes?_ga=2.109678214.228917382.1508457611-1754260706.1408405881

+ UPDATE: Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa

+ UPDATE: Cisco Nexus Series Switches CLI Command Injection Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss

+ UPDATE: Oracle Critical Patch Update Advisory - October 2017
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

+ Apple iOS 10.2 (14C92) Remote Code Execution
https://cxsecurity.com/issue/WLB-2017100140

+ Tomcat Remote Code Execution via JSP Upload Bypass
https://cxsecurity.com/issue/WLB-2017100138
CVE-2017-12617

PostgresDAC 3.3.0 meets PostgreSQL 10
https://www.postgresql.org/about/news/1794/

UPDATE: JVNVU#90609033 Wi-Fi Protected Access II (WPA2) ハンドシェイクにおいて Nonce およびセッション鍵が再利用される問題
http://jvn.jp/vu/JVNVU90609033/index.html

やばいパスワード
役立たずの烙印、パスワードにまつわる「秘密の質問」
http://itpro.nikkeibp.co.jp/atcl/column/17/092800400/101700005/?ST=security&itp_list_theme

ニュース解説
データ保護で出遅れた日本企業、GDPR対応済みは2%
http://itpro.nikkeibp.co.jp/atcl/column/14/346926/101801168/?ST=security&itp_list_theme

日立、プライバシー保護の取り組みをまとめたホワイトペーパーを改訂
http://itpro.nikkeibp.co.jp/atcl/news/17/101902477/?ST=security&itp_list_theme

ウイルスバスター クラウドに不具合、Windows 10の大型更新でブルースクリーン
http://itpro.nikkeibp.co.jp/atcl/news/17/101902472/?ST=security&itp_list_theme

2017年10月19日木曜日

19日 木曜日、先勝











+ RHSA-2017:2911 Important: wpa_supplicant security update
https://access.redhat.com/errata/RHSA-2017:2911
CVE-2017-13077
CVE-2017-13078
CVE-2017-13080
CVE-2017-13087

+ Google Chrome 62.0.3202.62 released
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html
CVE-2017-5124
CVE-2017-5125
CVE-2017-5126
CVE-2017-5127
CVE-2017-5128
CVE-2017-5129
CVE-2017-5132
CVE-2017-5130
CVE-2017-5131
CVE-2017-5133
CVE-2017-15386
CVE-2017-15387
CVE-2017-15388
CVE-2017-15389
CVE-2017-15390
CVE-2017-15391
CVE-2017-15392
CVE-2017-15393
CVE-2017-15394
CVE-2017-15395

+ CESA-2017:2907 Important CentOS 7 wpa_supplicant Security Update
https://lwn.net/Alerts/736751/

+ Cisco Cloud Services Platform 2100 Unauthorized Access Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-ccs
CVE-2017-12251

+ Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa
CVE-2017-13077
CVE-2017-13078
CVE-2017-13079

+ Cisco FXOS and NX-OS System Software Authentication, Authorization, and Accounting Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-aaavty
CVE-2017-3883

+ Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones SIP Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1
CVE-2017-12260

+ Cisco Small Business SPA51x Series IP Phones SIP Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip
CVE-2017-12259

+ Cisco WebEx Meetings Server Cross-Site Scripting Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-wms1
CVE-2017-12296

+ Cisco WebEx Meetings Server Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-wms
CVE-2017-12293

+ Cisco WebEx Meeting Center Cross-Site Scripting Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-wmc1
CVE-2017-12298

+ Cisco Unified Contact Center Express Cross-Site Scripting Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-ucce
CVE-2017-12288

+ Cisco SPA300 and SPA500 Series IP Phones Cross-Site Request Forgery Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-spa
CVE-2017-12271

+ Cisco NX-OS Software Python Parser Escape Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-ppe
CVE-2017-12301

+ Cisco Network Analysis Module Parameter Directory Traversal Arbitrary File Deletion Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-nam
CVE-2017-12285

+ Cisco Jabber Information Disclosure Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-jab1
CVE-2017-12286

+ Cisco Jabber for Windows Client Information Disclosure Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-jab
CVE-2017-12284

+ Cisco Expressway Series and Cisco TelePresence Video Communication Server REST API Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-expressway-tp-vcs
CVE-2017-12287

+ Cisco IOS XE Software Verbose Debug Logging Information Disclosure Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-cisco-ios-xe1
CVE-2017-12289

+ Cisco IOS XE Software Web Framework Cross-Site Scripting Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-cisco-ios-xe
CVE-2017-12272

+ FreeBSD-SA-17:07.wpa WPA2 protocol vulnerability
https://www.freebsd.org/security/advisories/FreeBSD-SA-17:07.wpa.asc
CVE-2017-13077
CVE-2017-13078
CVE-2017-13079
CVE-2017-13080
CVE-2017-13081
CVE-2017-13082
CVE-2017-13086
CVE-2017-13087
CVE-2017-13088

+ Linux kernel 4.13.8, 4.9.57, 4.4.93, 3.18.76 released
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.8
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.57
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.93
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.76

+ UPDATE: JVNVU#90609033 Wi-Fi Protected Access II (WPA2) ハンドシェイクにおいて Nonce およびセッション鍵が再利用される問題
http://jvn.jp/vu/JVNVU90609033/index.html

+ UPDATE: JVNVU#99259676 Apache Tomcat の複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU99259676/index.html

+ Windows Kernel Pool Ntfs!LfsRestartLogFile Memory Disclosure
https://cxsecurity.com/issue/WLB-2017100132
CVE-2017-11817

+ Windows Kernel Pool nt!RtlpCopyLegacyContextX86 Memory Disclosure
https://cxsecurity.com/issue/WLB-2017100131
CVE-2017-11784
CVE-2017-8482

VU#307015 Infineon RSA library does not properly generate RSA key pairs
https://www.kb.cert.org/vuls/id/307015

ニュース解説
WannaCry被害に遭った日立、新設CISOにシステム停止の権限
http://itpro.nikkeibp.co.jp/atcl/column/14/346926/101801167/?ST=security&itp_list_theme

IPA、「ランサムウェア特設サイト」を開設
http://itpro.nikkeibp.co.jp/atcl/news/17/101802468/?ST=security&itp_list_theme

インフィニオンのTPM搭載PCでディスク暗号化を破られる可能性、対策はパッチの適用
http://itpro.nikkeibp.co.jp/atcl/news/17/101802467/?ST=security&itp_list_theme

シスコが2018年度の事業戦略、デジタル変革の支援サービスなど新設
http://itpro.nikkeibp.co.jp/atcl/news/17/101802465/?ST=security&itp_list_theme

トレンドマイクロの不正侵入防御、Wikipediaへのアクセスを誤って遮断
http://itpro.nikkeibp.co.jp/atcl/news/17/101802463/?ST=security&itp_list_theme

東芝メモリがマルウエア被害との報道、「グループ内の感染は事実」
http://itpro.nikkeibp.co.jp/atcl/news/17/101802460/?ST=security&itp_list_theme

ニュース解説
WPA2の脆弱性問題が明らかに、危険なこととすべきこと
http://itpro.nikkeibp.co.jp/atcl/column/14/346926/101701165/?ST=security&itp_list_theme

UPDATE: JVNVU#95530052 Infineon 製 RSA ライブラリが RSA 鍵ペアを適切に生成しない問題
http://jvn.jp/vu/JVNVU95530052/index.html

UPDATE: JVNVU#93453933 Dnsmasq に複数の脆弱性
http://jvn.jp/vu/JVNVU93453933/index.html

UPDATE: JVNVU#95513538 様々な Bluetooth 実装に複数の脆弱性
http://jvn.jp/vu/JVNVU95513538/index.html

2017年10月18日水曜日

18日 水曜日、赤口

+ CVE-2017-13080 | Windows Wireless WPA Group Key Reinstallation Vulnerability
https://portal.msrc.microsoft.com/ja-JP/security-guidance/advisory/CVE-2017-13080
CVE-2017-13080

+ RHSA-2017:2899 Critical: flash-plugin security update
https://access.redhat.com/errata/RHSA-2017:2899
CVE-2017-11292

+ RHSA-2017:2907 Important: wpa_supplicant security update
https://access.redhat.com/errata/RHSA-2017:2907
CVE-2017-13077
CVE-2017-13078
CVE-2017-13080
CVE-2017-13082
CVE-2017-13086
CVE-2017-13087
CVE-2017-13088

+ Zabbix 3.4.3, 3.2.9, 3.0.12 released
https://www.zabbix.com/rn3.4.3
https://www.zabbix.com/rn3.2.9
https://www.zabbix.com/rn3.0.12

+ Security updates available for Flash Player | APSB17-32
https://helpx.adobe.com/security/products/flash-player/apsb17-32.html
CVE-2017-11292

+ CESA-2017:2863 Moderate CentOS 6 kernel Security Update
https://lwn.net/Alerts/735841/

+ UPDATE: Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa

+ Linux kernel 4.1.45 released
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.45

+ Java SE 9.0.1 released
http://www.oracle.com/technetwork/java/javase/9-0-1-relnotes-3883752.html

+ Java SE 8u151/ 8u152 released
http://www.oracle.com/technetwork/java/javase/8u152-relnotes-3850503.html
http://www.oracle.com/technetwork/java/javase/8u151-relnotes-3850493.html

+ UPDATE: JVNVU#90609033 Wi-Fi Protected Access II (WPA2) ハンドシェイクにおいて Nonce およびセッション鍵が再利用される問題
http://jvn.jp/vu/JVNVU90609033/index.html

+ JVNVU#92489697 Adobe Flash Player に型の混同 (Type Confusion) の脆弱性
http://jvn.jp/vu/JVNVU92489697/index.html

+ Oracle Critical Patch Update Advisory - October 2017
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

やばいパスワード
パスワードを定期的に変えるのはデメリットが多い!?変更すべき4つの場合
http://itpro.nikkeibp.co.jp/atcl/column/17/092800400/101500004/?ST=security&itp_list_theme

ニュース解説
サイバー犯罪を支援するクラウド、やっかいなことに人気
http://itpro.nikkeibp.co.jp/atcl/column/14/346926/101601162/?ST=security&itp_list_theme

記者の眼
メルカリ、LINE、スマートニュース…失われたネットの信頼を取り戻せるか
http://itpro.nikkeibp.co.jp/atcl/watcher/14/334361/101600936/?ST=security&itp_list_theme

あらゆるWi-Fiに影響する「WPA2」脆弱性、各社が対策を公開
http://itpro.nikkeibp.co.jp/atcl/news/17/101702451/?ST=security&itp_list_theme

Arcserve Japan、メールアーカイブ製品を初投入
http://itpro.nikkeibp.co.jp/atcl/news/17/101702450/?ST=security&itp_list_theme

「アップデートで修正可能」、WPA2の脆弱性に関連団体が続々と声明
http://itpro.nikkeibp.co.jp/atcl/news/17/101702448/?ST=security&itp_list_theme

UPDATE: JVNVU#95530052 Infineon 製 RSA ライブラリが RSA 鍵ペアを適切に生成しない問題
http://jvn.jp/vu/JVNVU95530052/index.html

JVN#54795166 ホームユニット KX-HJB1000 における複数の脆弱性
http://jvn.jp/jp/JVN54795166/index.html

2017年10月17日火曜日

17日 火曜日、大安

+ Mozilla Foundation Security Advisory 2017-23 Security vulnerabilities fixed in Thunderbird 52.4
https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/
CVE-2017-7793
CVE-2017-7818
CVE-2017-7819
CVE-2017-7824
CVE-2017-7805
CVE-2017-7814
CVE-2017-7825
CVE-2017-7823
CVE-2017-7810

+ UPDATE: Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa

+ hitachi-sec-2017-130 Information Disclosure Vulnerability in Hitachi Global Link Manager
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-130/index.html
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-130/index.html

+ hitachi-sec-2017-129 RMI Vulnerability in Hitachi Tuning Manager
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-129/index.html
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-129/index.html

+ hitachi-sec-2017-128 XXE Vulnerability in Hitachi Command Suite
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-128/index.html
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-128/index.html

+ hitachi-sec-2017-127 Remote Code Execution Vulnerability in Hitachi Command Suite
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-127/index.html
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-127/index.html
CVE-2017-5641

+ hitachi-sec-2017-126 Information Disclosure Vulnerability in Hitachi Automation Director
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-126/index.html
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-126/index.html

+ hitachi-sec-2017-125 Multiple Vulnerabilities in Hitachi Infrastructure Analytics Advisor
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-125/index.html
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-125/index.html

+ WiFi WPA2 Key Reinstallation Attacks
https://cxsecurity.com/issue/WLB-2017100118

VU#307015 Infineon RSA library does not properly generate RSA key pairs
https://www.kb.cert.org/vuls/id/307015

VU#228519 Wi-Fi Protected Access II (WPA2) handshake traffic can be manipulated to induce nonce and session key reuse
https://www.kb.cert.org/vuls/id/228519

やばいパスワード
破られにくくて忘れにくいパスワード、賢く使い分ける方法
http://itpro.nikkeibp.co.jp/atcl/column/17/092800400/101500003/?ST=security&itp_list_theme

[続報]東日本銀行のATM障害は夕方時点で継続中、「今日中の復旧目指す」
http://itpro.nikkeibp.co.jp/atcl/news/17/101602445/?ST=security&itp_list_theme

東日本銀行でシステム障害、窓口・ネットは回復もATMは依然使えず
http://itpro.nikkeibp.co.jp/atcl/news/17/101602441/?ST=security&itp_list_theme

JVNVU#91625548 AssetView および AssetView PLATINUM に複数の脆弱性
http://jvn.jp/vu/JVNVU91625548/

2017年10月16日月曜日

16日 月曜日、仏滅

+ PostgreSQL ODBC Driver 10.00.0000 released
https://www.postgresql.org/ftp/odbc/versions/msi/

+ UPDATE: Cisco Adaptive Security Appliance Software Direct Authentication Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-asa

+ Linux kernel 4.13.7 released
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.7

+ Microsoft Edge Chakra StackScriptFunction::BoxState::Box Uninitialized Pointers
https://cxsecurity.com/issue/WLB-2017100112

+ Microsoft Edge Chakra JIT Failed RegexHelper::StringReplace Call
https://cxsecurity.com/issue/WLB-2017100111

+ Microsoft Edge Chakra JIT Incorrect GenerateBailOut Calling Patterns
https://cxsecurity.com/issue/WLB-2017100110

+ Windows Escalate UAC Protection Bypass (In Memory Injection) Abusing WinSXS
https://cxsecurity.com/issue/WLB-2017100102

JVNVU#96796469 NXP Semiconductors 製 MQX RTOS における複数の脆弱性
http://jvn.jp/vu/JVNVU96796469/index.html

やばいパスワード
複雑なパスワードを強制、でも破られやすいという現実
http://itpro.nikkeibp.co.jp/atcl/column/17/092800400/101200002/?ST=security&itp_list_theme

ITpro EXPO 2017速報
最近のエンジニア転職事情は? パソナキャリアと日経HRが講演で疑問に回答
http://itpro.nikkeibp.co.jp/atcl/column/17/101000415/101300112/?ST=security&itp_list_theme

ITpro EXPO 2017速報
ミロク情報サービス、入口・出口対策からWebフィルタリングまでセキュリティ製品
http://itpro.nikkeibp.co.jp/atcl/column/17/101000415/101300110/?ST=security&itp_list_theme

ITpro EXPO 2017速報
アルチザネットワーク、純国産のSSL可視化アプライアンス
http://itpro.nikkeibp.co.jp/atcl/column/17/101000415/101300104/?ST=security&itp_list_theme

ITpro EXPO 2017速報
ブラック・ダック、オープンソースの3リスクを可視化する「Black Duck Hub」
http://itpro.nikkeibp.co.jp/atcl/column/17/101000415/101300102/?ST=security&itp_list_theme

Tpro EXPO 2017速報
ファイル改ざんの検知から復旧まで、DITがIoT機器にも対応する製品
http://itpro.nikkeibp.co.jp/atcl/column/17/101000415/101300100/?ST=security&itp_list_theme

週末に遊べるラズパイ
ラズパイで攻撃者に罠を仕掛ける、ハニーポット「DShield」
http://itpro.nikkeibp.co.jp/atcl/column/17/041900152/101200026/?ST=security&itp_list_theme

ITpro EXPO 2017速報
ランサムウエアの侵入原因を特定、日立ソリューションズ「秘文 Device Control」
http://itpro.nikkeibp.co.jp/atcl/column/17/101000415/101200093/?ST=security&itp_list_theme

2017年10月13日金曜日

13日 金曜日、先勝

+ FTP PWD response parser out of bounds read
https://curl.haxx.se/docs/adv_20171004.html
CVE-2017-1000254

+ MantisBT 2.7.0 released
http://www.mantisbt.org/blog/?p=536

+ CVE-2017-0250 | Microsoft JET データベース エンジンのリモートでコードが実行される脆弱性
https://portal.msrc.microsoft.com/ja-JP/security-guidance/advisory/CVE-2017-0250

+ ADV170012 | TPM の脆弱性により、セキュリティ機能のバイパス
https://portal.msrc.microsoft.com/ja-JP/security-guidance/advisory/ADV170012

+ ADV170014 | Optional Windows NTLM SSO authentication changes
https://portal.msrc.microsoft.com/ja-JP/security-guidance/advisory/ADV170014

+ ADV170016 | Windows Server 2008 の多層防御
https://portal.msrc.microsoft.com/ja-JP/security-guidance/advisory/ADV170016

+ ADV170017 | Office の多層防御機能の更新プログラム
https://portal.msrc.microsoft.com/ja-JP/security-guidance/advisory/ADV170017

+ RHSA-2017:2885 Important: thunderbird security update
https://access.redhat.com/errata/RHSA-2017:2885
CVE-2017-7793
CVE-2017-7810
CVE-2017-7814
CVE-2017-7818
CVE-2017-7819
CVE-2017-7823
CVE-2017-7824

+ RHSA-2017:2863 Moderate: kernel security and bug fix update
https://access.redhat.com/errata/RHSA-2017:2863
CVE-2017-7541

+ RHSA-2017:2860 Moderate: postgresql security update
https://access.redhat.com/errata/RHSA-2017:2860
CVE-2017-7546

+ RHSA-2017:2838 Critical: dnsmasq security update
https://access.redhat.com/errata/RHSA-2017:2838
CVE-2017-14491

+ RHSA-2017:2882 Moderate: httpd security update
https://access.redhat.com/errata/RHSA-2017:2882
CVE-2017-9798

+ RHSA-2017:2836 Critical: dnsmasq security update
https://access.redhat.com/errata/RHSA-2017:2836
CVE-2017-14491
CVE-2017-14492
CVE-2017-14493
CVE-2017-14494
CVE-2017-14495
CVE-2017-14496

+ Selenium Standard Server 3.6.0 released
http://docs.seleniumhq.org/download/

+ Selenium IE Driver Server 3.6.0 released
http://docs.seleniumhq.org/download/

+ Selenium Client & WebDriver 3.6.0 released
http://docs.seleniumhq.org/download/

+ About the security content of iOS 11.0.3
https://support.apple.com/ja-jp/HT208182

+ macOS High Sierra 10.13 追加アップデートのセキュリティコンテンツについて
https://support.apple.com/ja-jp/HT208165

+ watchOS 4.0.1 のセキュリティコンテンツについて
https://support.apple.com/ja-jp/HT208163

+ iOS 11.0.2 のセキュリティコンテンツについて
https://support.apple.com/ja-jp/HT208164

+ Mozilla Firefox 56.0.1 released
https://www.mozilla.org/en-US/firefox/56.0.1/releasenotes/

+ Security update available for RoboHelp | APSB17-25
https://helpx.adobe.com/security/products/robohelp/apsb17-25.html

+ Security updates available for Flash Player | APSB17-28
https://helpx.adobe.com/security/products/flash-player/apsb17-28.html

+ Security updates available for ColdFusion | APSB17-30
https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html

+ CESA-2017:2885 Important CentOS 6 thunderbird Security Update
https://lwn.net/Alerts/736155/

+ CESA-2017:2885 Important CentOS 7 thunderbird Security Update
https://lwn.net/Alerts/736154/

+ CESA-2017:2882 Moderate CentOS 7 httpd Security Update
https://lwn.net/Alerts/736153/

+ CESA-2017:2860 Moderate CentOS 6 postgresql Security Update
https://lwn.net/Alerts/735842/

+ Mozilla Thunderbird 52.4.0 released
https://www.mozilla.org/en-US/thunderbird/52.4.0/releasenotes/

+ Wireshark 2.4.2, 2.2.10, 2.0.16 released
https://www.wireshark.org/docs/relnotes/wireshark-2.4.2.html
https://www.wireshark.org/docs/relnotes/wireshark-2.2.10.html
https://www.wireshark.org/docs/relnotes/wireshark-2.0.16.html

+ 2017 年 10 月のセキュリティ更新プログラム (月例)
https://blogs.technet.microsoft.com/jpsecurity/2017/10/11/201710-security-bulletin/

+ curl 7.56.0 release
https://curl.haxx.se/changes.html#7_56_0

+ Linux kernel 4.13.6, 4.9.56, 4.4.92, 3.18.75, 3.16.49, 3.2.94 released
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.6
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.56
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.92
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.75
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.49
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.94

+ Oracle Critical Patch Update Pre-Release Announcement - October 2017
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

+ Apache HTTP Server 2.4.28 Released
http://www.apache.org/dist/httpd/Announcement2.4.html

+ Apache Tomcat 8.0.47, 7.0.82 Released
http://tomcat.apache.org/tomcat-8.0-doc/changelog.html#Tomcat_8.0.47_(violetagg)
http://tomcat.apache.org/tomcat-7.0-doc/changelog.html#Tomcat_7.0.82_(violetagg)

+ GCC 5.5 released
https://gcc.gnu.org/gcc-5/

VU#590639 NXP Semiconductors MQX RTOS contains multiple vulnerabilities
https://www.kb.cert.org/vuls/id/590639

Announcing the Release of repmgr v4.0 Beta
https://www.postgresql.org/about/news/1793/

2017年10月4日水曜日

4日 水曜日、仏滅










+ CESA-2017:2836 Critical CentOS 7 dnsmasq Security Update
https://lwn.net/Alerts/735342/

+ CESA-2017:2838 Critical CentOS 6 dnsmasq Security Update
https://lwn.net/Alerts/735343/

+ UPDATE: Cisco Integrated Management Controller Remote Code Execution Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc3

+ UPDATE: Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2

+ UPDATE: Apache Struts 2 Remote Code Execution Vulnerability Affecting Multiple Cisco Products: September 2017
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170909-struts2-rce

+ UPDATE: Cisco Integrated Management Controller Privilege Escalation Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc

+ OpenSSH 7.6 released
http://www.openssh.com/

+ JVNVU#93453933 Dnsmasq に複数の脆弱性
http://jvn.jp/vu/JVNVU93453933/

+ Linux Kernel 4-14-rc1 Denial Of Service
https://cxsecurity.com/issue/WLB-2017100037

+ Microsoft IIS UrlScan Module Bypass
https://cxsecurity.com/issue/WLB-2017100034

+ Tcpdump CVE-2017-12997 Denial of Service Vulnerability
http://www.securityfocus.com/bid/100914
CVE-2017-1541

サイバー レジリエンスに関するマイクロソフトの見解
https://blogs.technet.microsoft.com/jpsecurity/2017/10/04/microsoft-perspective-on-cyber-resilience/

米Yahoo!が起こした2013年の情報流出、全30億ユーザー分漏洩との調査結果
http://itpro.nikkeibp.co.jp/atcl/news/17/100402395/?ST=security&itp_list_theme

Java環境なしでマイナンバーカード利用可能に、内閣府がアドオン提供
http://itpro.nikkeibp.co.jp/atcl/news/17/100302391/?ST=security&itp_list_theme

総務省が「IoTセキュリティ総合対策」発表、認証マークや税制優遇に言及
http://itpro.nikkeibp.co.jp/atcl/news/17/100302386/?ST=security&itp_list_theme

2017年10月3日火曜日

3日 火曜日、先負

+ RHSA-2017:2838 Critical: dnsmasq security update
https://access.redhat.com/errata/RHSA-2017:2838
CVE-2017-14491

+ RHSA-2017:2836 Critical: dnsmasq security update
https://access.redhat.com/errata/RHSA-2017:2836
CVE-2017-14491
CVE-2017-14492
CVE-2017-14493
CVE-2017-14494
CVE-2017-14495
CVE-2017-14496

+ CESA-2017:2832 Important CentOS 7 nss Security Update
https://lwn.net/Alerts/735244/

+ CESA-2017:2831 Critical CentOS 6 firefox Security Update
https://lwn.net/Alerts/735241/

+ CESA-2017:2831 Critical CentOS 7 firefox Security Update
https://lwn.net/Alerts/735242/

+ CESA-2017:2832 Important CentOS 6 nss Security Update
https://lwn.net/Alerts/735243/

+ VU#973527 Dnsmasq contains multiple vulnerabilities.
https://www.kb.cert.org/vuls/id/973527
CVE-2017-14491
CVE-2017-14492
CVE-2017-14493
CVE-2017-14494
CVE-2017-14495
CVE-2017-14496

+ UPDATE: JVNVU#91991349 Apache Tomcat の複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU91991349/index.html

+ UPDATE: JVNVU#92256772 Apache HTTP Web Server における複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU92256772/index.html

+ UPDATE: JVNVU#98416507 Apache HTTP Web Server における複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU98416507/index.html

+ UPDATE: JVNVU#95420726 Apache Tomcat にセキュリティ制限回避の脆弱性
http://jvn.jp/vu/JVNVU95420726/index.html

+ UPDATE: JVNVU#97322649 ISC BIND に複数のサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/vu/JVNVU97322649/index.html

+ UPDATE: JVNVU#90211511 Apache Tomcat の複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU90211511/index.html

+ UPDATE: JVNVU#93610402 Apache Struts2 に任意のコードが実行可能な脆弱性
http://jvn.jp/vu/JVNVU93610402/index.html

+ UPDATE: JVNVU#90017300 OpenSSL にサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/vu/JVNVU90017300/index.html

+ UPDATE: JVNVU#92830136 OpenSSL に複数の脆弱性
http://jvn.jp/vu/JVNVU92830136/index.html

+ UPDATE: JVNVU#92930223 OpenSSL に複数の脆弱性
http://jvn.jp/vu/JVNVU92930223/index.html

+ UPDATE: JVNVU#98667810 OpenSSL に複数の脆弱性
http://jvn.jp/vu/JVNVU98667810/index.html

+ UPDATE: JVNVU#93163809 OpenSSL に複数の脆弱性
http://jvn.jp/vu/JVNVU93163809/index.html

+ Dnsmasq Multiple Flaws Let Remote Users Execute Arbitrary Code, Deny Service, and Obtain Potentially Sensitive Information
http://www.securitytracker.com/id/1039474
CVE-2017-13704
CVE-2017-14491
CVE-2017-14492
CVE-2017-14493
CVE-2017-14494
CVE-2017-14495
CVE-2017-14496

+ Microsoft Office 2007 Groove Security Bypass / Code Execution
https://cxsecurity.com/issue/WLB-2017100024

+ Microsoft Office 2007 Word Information Disclosure
https://cxsecurity.com/issue/WLB-2017100023

UPDATE: JVNVU#92793783 Intel Active Management Technology (AMT) にアクセス制限不備の脆弱性
http://jvn.jp/vu/JVNVU92793783/index.html

UPDATE: JVN#89379547 Apache Commons FileUpload におけるサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/jp/JVN89379547/index.html

自動学習するセキュリティ技術、重要インフラ向けに日立が開発
http://itpro.nikkeibp.co.jp/atcl/news/17/100202378/?ST=security&itp_list_theme

ITpro EXPO 2017見どころ解説
爆発的に広がるランサムウエアの恐るべき手口、10月11日にITpro EXPO 2017で講演
http://itpro.nikkeibp.co.jp/atcl/column/17/090800372/100200008/?ST=security&itp_list_theme

ITpro EXPO 2017見どころ解説
「セキュリティ業界の通説は本当か?」、10月13日にNICTが講演
http://itpro.nikkeibp.co.jp/atcl/column/17/090800372/100200007/?ST=security&itp_list_theme

2017年10月2日月曜日

2日 月曜日、友引

+ Operational Notification: KSK-2010 will be retired from the root zone, potentially affecting validating resolvers
https://kb.isc.org/article/AA-01529

+ UPDATE: Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-dhcp

+ hitachi-sec-2017-124 Self-Decrypting Confidential Files created by JP1/HIBUN may insecurely load Dynamic Link Libraries
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-124/index.html

+ hitachi-sec-2017-124 JP1/秘文で作成した自己復号型機密ファイルのDLL読み込みに関する脆弱性
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-124/index.html

+ Apache Tomcat 8.5.23 released
http://tomcat.apache.org/security-8.html

+ PHP 7.1.10 released
http://www.php.net/ChangeLog-7.php#7.1.10

+ OpenVPN Buffer Overflow When Using 'Key Method 1' Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1039470
CVE-2017-12166

脅迫型DDoS攻撃の無料相談窓口、サイバーセキュリティクラウドが開設
http://itpro.nikkeibp.co.jp/atcl/news/17/092902370/?ST=security&itp_list_theme

「企業の75%がサイバーリスク対策に懸念」、AIGジャパンが独自調査
http://itpro.nikkeibp.co.jp/atcl/news/17/092902369/?ST=security&itp_list_theme

EDRやIOC、UEBAって?急増する謎の略語
http://itpro.nikkeibp.co.jp/atcl/watcher/14/334361/092700925/?ST=security&itp_list_theme

セブン-イレブン、2018年の全店展開目指して顔認証の実証実験を開始
http://itpro.nikkeibp.co.jp/atcl/news/17/092902364/?ST=security&itp_list_theme

ビットコインを狙った北朝鮮の攻撃観測、ファイア・アイが解説
http://itpro.nikkeibp.co.jp/atcl/news/17/092902363/?ST=security&itp_list_theme

Blockchain skills: Don't Try to Block the Chain
http://brian.linuxsecurity.com/content/view/175976/169/

Black Hat Europe 2017: New Briefings Announced
http://brian.linuxsecurity.com/content/view/175975/169/