Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT Security Bulletin ASB-2017.0012 [R1] Nessus 6.10 Fixes Multiple Third-party Library Vulnerabilities 3 February 2017 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Tenable Nessus Operating System: Windows OS X Linux variants FreeBSD Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Access Privileged Data -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2017-3732 CVE-2016-7055 CVE-2016-4483 CVE-2016-4449 CVE-2016-4448 CVE-2016-4447 CVE-2016-3705 CVE-2016-3627 CVE-2016-1840 CVE-2016-1839 CVE-2016-1838 CVE-2016-1837 CVE-2016-1836 CVE-2016-1835 CVE-2016-1834 CVE-2016-1833 CVE-2016-1695 CVE-2015-8317 CVE-2015-8242 CVE-2015-8241 CVE-2015-8035 CVE-2015-7942 CVE-2015-7941 CVE-2015-7500 CVE-2015-7499 CVE-2015-7498 CVE-2015-7497 CVE-2015-5312 CVE-2015-1819 Member content until: Sunday, March 5 2017 Reference: http://www.tenable.com/security/tns-2017-03 OVERVIEW Multiple vulnerability have been identified in Tenable Nessus prior to version 6.10.[1] IMPACT The vendor has provided the following details regarding the vulnerabilities: "Nessus 6.9.0 - 6.9.3 is possibly impacted by multiple vulnerabilities reported in OpenSSL. Tenable has not investigated each one to determine if it is exploitable or the vulnerable code path can be reached. Instead, Dev has upgraded the impacted libraries as a faster and safer alternative. Due to the possibility of impacting Nessus users, we strongly encourage you to upgrade. The following vulnerabilities have been resolved with the updated libraries. OpenSSL crypto/bn/asm/x86_64-mont5.pl Montgomery Squaring Procedure BN_mod_exp Incorrect Results Private Key Derivation Weakness (VulnDB 151020 / CVE-2017-3732) OpenSSL crypto/evp/e_chacha20_poly1305.c CHACHA20-POLY1305 Cipher Packet Handling Out-of-bounds Read Remote DoS (VulnDB 151018 / 2017-3731) OpenSSL crypto/bn/asm/x86_64-mont.pl Montgomery Multiplication Incorrect Results Weakness (VulnDB 147021 / CVE-2016-7055) Nessus 6.5.0 - 6.9.3 is possibly impacted by multiple vulnerabilities reported in Libxml2. Tenable has not investigated each one to determine if it is exploitable or the vulnerable code path can be reached. Instead, Dev has upgraded the impacted libraries as a faster and safer alternative. Due to the number of library issues and the potential for any of these issues to impact Nessus users, we strongly encourage you to upgrade. Note that two of these issues do not have CVE assignments. Libxml2 parser.c XML Handling Unspecified Issue (VulnDB 130538 / CVE-2015-7499) Libxml2 parser.c Entity Boundary Handling Unspecified Memory Access Issue (VulnDB 130539 / CVE-2015-7500) Libxml2 dict.c xmlDictComputeFastQKey() Function Heap Buffer Overflow (VulnDB 130535 / CVE-2015-7497) Libxml2 parser.c Unspecified XML External Entity (XXE) Injection Issue (VulnDB 130536 / CVE-2015-5312) Libxml2 Encoding Conversion Failure Entity Processing Unspecified Issue (VulnDB 130543 / CVE-2015-7498) Libxml2 xzlib.c xz_decomp() Function Infinite Loop DoS Weakness (VulnDB 129696 / CVE-2015-8035) Libxml2 SAX2.c xmlSAX2TextNode() Function Out-of-bounds Read Issue (VulnDB 130292 / CVE-2015-8242) Libxml2 parser.c xmlParseMarkupDecl() Function Out-of-bounds Read Issue (VulnDB 130435 / CVE-2015-8241) Libxml2 parser.c xmlParseEncodingDecl() Function Encoding Value Handling Out-of-bounds Read Issue (VulnDB 130641 / CVE-2015-8317) Libxml2 parser.c xmlParseEncodingDecl() Function Input Stream Conversion Handling Out-of-bounds Read Issue (VulnDB 130642 / CVE-2015-8317) Libxml2 XML External Entity (XXE) Expansion Resource Exhaustion Remote DoS (VulnDB 120600 / CVE-2015-1819) Libxml2 parser.c xmlParseConditionalSections() Function Out-of-bounds Read Issue (VulnDB 121175 / CVE-2015-7941 / CVE-2015-7942) Libxml2 Multiple Functionality Format Strings (VulnDB 138966 / CVE-2016-4448) Libxml2 parser.c xmlParseElementDecl() / xmlParseConditionalSections() Functions Out-of-bounds Read Issue (VulnDB 138928 / CVE-2016-4447) Libxml2 parser.c xmlStringLenDecodeEntities() Function Unspecified XML External Entity (XXE) Injection Issue (VulnDB 138926 / CVE-2016-4449) Libxml2 xmlregexp.c xmlFAParseCharRange() Function Heap Buffer Overflow (VulnDB 138572 / CVE-2016-1840) Libxml2 parser.c xmlParseStartTag2() Function Heap Use-after-free (VulnDB 138567 / CVE-2016-1835) Libxml2 xmlstring.c xmlStrncatNew() Function Heap Buffer Overflow (VulnDB 138566 / CVE-2016-1834) Libxml2 parser.c xmlParseNCNameComplex() Function Heap Use-after-free (VulnDB 138568 / CVE-2016-1836) Libxml2 HTMLparser.c htmlParseSystemLiteral() / htmlParsePubidLiteral() Functions Heap Buffer Overflow (VulnDB 138569 / CVE-2016-1837) Libxml2 xmlsave.c xmlBufAttrSerializeTxtContent() Function Recover Mode XML Content Handling Out-of-bounds Read Issue (VulnDB 137965 / CVE-2016-4483) Libxml2 parser.c Multiple Function Recursive xmlStringDecodeEntities() Call Handling Stack Overflow DoS (VulnDB 137962 / CVE-2016-3705) Libxml2 HTMLparser.c htmlParseName() / htmlParseNameComplex() Functions Out-of-bounds Read Issue (VulnDB 134833 / CVE-2016-1839) Libxml2 parser.c xmlParserEntityCheck() Function Recovery Mode XML Content Parsing Recursion DoS (VulnDB 136194 / CVE-2016-3627) Libxml2 parser.c xmlParseEndTag2() Function Out-of-bounds Read Issue (VulnDB 130651 / CVE-2016-1838 / CVE-2016-1695) Libxml2 parserInternals.c xmlNextChar() Function Out-of-bounds Read Issue (VulnDB 130653 / CVE-2016-1833) Libxml2 uri.c xmlParse3986Port() Function Port Argument Handling Integer Overflow Unspecified Issue (VulnDB 138921) Libxml2 HTMLparser.c htmlParseNameComplex() Function HTML File Encoding Detection Failure (VulnDB 138927) "[1] MITIGATION Tenable advises users should upgrade to the latest version of Tenable Nessus to address these issues: "Tenable has released Nessus version 6.10 that corresponds to the supported operating systems and architectures. To update your Nessus installation, follow these steps: Download the appropriate installation file to the system hosting Nessus Professional or Nessus Manager, available at the Tenable Support Portal (https://support.tenable.com/support-center/index.php?x=&mod_id=200) Stop the Nessus service. Install according to your operating system procedures. Restart the Nessus service."[1] REFERENCES [1] [R1] Nessus 6.10 Fixes Multiple Third-party Library Vulnerabilities http://www.tenable.com/security/tns-2017-03 AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWJP+Uox+lLeg9Ub1AQjX1A//c3IFsWJGAqKhLgDfR8OvUoWucCr1UKTZ 7xe2fcL8Yuh/znELO7IxH5eXRu17c4AW/6w1YaOZXyxfqUqbj3Gq+4+iEF+ZM3h1 WelQRuGElkW4qZRt3iNGbVWsTRKUPuhcIWF6oPon+nuGCZ3i015NIfApFypa1EB6 tX9+S5hzTkW5peemeQck8A38SZXQIjnAs76zsA44rbTY1gjTdYT6F54VdxSr26Vq 5Fdm5lzQGLrJ4GoqreWqTrDtgRf4VEtuBzburbmyZusQ4ibwHwazgE6uh92OavQV 2/SxfxctYLgq9Gusydh9K3YGLmZsA9dl1QZqrHBRstsONJuYJ5cw9I/E6H79tHy7 pCvcAGLLmyHJA/lzroQEERkzhubq4i1ouyj+LikXuU9MzNfo5twrITTjpogln875 r35cO9KPx+SMrNxsAL+89bIFdwojI6Bz7dBc5Ul5UbywngP0nuRnFmqm0eaDO2lc +4XtkGmLOU5hLPO80Sa/XTRL2Z03aNXMMP/e6ifVT4HdIb2TaznEunVkR07bFOm5 MSm2ElNuthC9JAFKQjm4w3CL/qV7fh9iNaIdCwipponCRR/nGFEN2vI0lxfNEVju K+BD3v8ueJawY3LN35pPIJznmp+ZA/QXUotOf5IJSwRJjQ8rTuZTbA+xYel1NhaY Ii4FwgCN/5w= =UM4N -----END PGP SIGNATURE-----