Hash: SHA256

                         AUSCERT Security Bulletin

    [R1] Nessus 6.10 Fixes Multiple Third-party Library Vulnerabilities
                              3 February 2017


        AusCERT Security Bulletin Summary

Product:              Tenable Nessus
Operating System:     Windows
                      OS X
                      Linux variants
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Access Privileged Data          -- Remote/Unauthenticated      
                      Denial of Service               -- Remote/Unauthenticated      
Resolution:           Patch/Upgrade
CVE Names:            CVE-2017-3732 CVE-2016-7055 CVE-2016-4483
                      CVE-2016-4449 CVE-2016-4448 CVE-2016-4447
                      CVE-2016-3705 CVE-2016-3627 CVE-2016-1840
                      CVE-2016-1839 CVE-2016-1838 CVE-2016-1837
                      CVE-2016-1836 CVE-2016-1835 CVE-2016-1834
                      CVE-2016-1833 CVE-2016-1695 CVE-2015-8317
                      CVE-2015-8242 CVE-2015-8241 CVE-2015-8035
                      CVE-2015-7942 CVE-2015-7941 CVE-2015-7500
                      CVE-2015-7499 CVE-2015-7498 CVE-2015-7497
                      CVE-2015-5312 CVE-2015-1819 
Member content until: Sunday, March  5 2017
Reference:            http://www.tenable.com/security/tns-2017-03


        Multiple vulnerability have been identified in Tenable Nessus prior to 
        version 6.10.[1]


        The vendor has provided the following details regarding the 
        "Nessus 6.9.0 - 6.9.3 is possibly impacted by multiple 
        vulnerabilities reported in OpenSSL. Tenable has not investigated 
        each one to determine if it is exploitable or the vulnerable code 
        path can be reached. Instead, Dev has upgraded the impacted 
        libraries as a faster and safer alternative. Due to the possibility
        of impacting Nessus users, we strongly encourage you to upgrade.
        The following vulnerabilities have been resolved with the updated 
        OpenSSL crypto/bn/asm/x86_64-mont5.pl Montgomery Squaring Procedure
        BN_mod_exp Incorrect Results Private Key Derivation Weakness (VulnDB
        151020 / CVE-2017-3732)
        OpenSSL crypto/evp/e_chacha20_poly1305.c CHACHA20-POLY1305 Cipher 
        Packet Handling Out-of-bounds Read Remote DoS (VulnDB 151018 / 
        OpenSSL crypto/bn/asm/x86_64-mont.pl Montgomery Multiplication 
        Incorrect Results Weakness (VulnDB 147021 / CVE-2016-7055)
        Nessus 6.5.0 - 6.9.3 is possibly impacted by multiple 
        vulnerabilities reported in Libxml2. Tenable has not investigated 
        each one to determine if it is exploitable or the vulnerable code 
        path can be reached. Instead, Dev has upgraded the impacted 
        libraries as a faster and safer alternative. Due to the number of 
        library issues and the potential for any of these issues to impact 
        Nessus users, we strongly encourage you to upgrade. Note that two of
        these issues do not have CVE assignments.
        Libxml2 parser.c XML Handling Unspecified Issue (VulnDB 130538 / 
        Libxml2 parser.c Entity Boundary Handling Unspecified Memory Access
        Issue (VulnDB 130539 / CVE-2015-7500)
        Libxml2 dict.c xmlDictComputeFastQKey() Function Heap Buffer 
        Overflow (VulnDB 130535 / CVE-2015-7497)
        Libxml2 parser.c Unspecified XML External Entity (XXE) Injection 
        Issue (VulnDB 130536 / CVE-2015-5312)
        Libxml2 Encoding Conversion Failure Entity Processing Unspecified 
        Issue (VulnDB 130543 / CVE-2015-7498)
        Libxml2 xzlib.c xz_decomp() Function Infinite Loop DoS Weakness 
        (VulnDB 129696 / CVE-2015-8035)
        Libxml2 SAX2.c xmlSAX2TextNode() Function Out-of-bounds Read Issue 
        (VulnDB 130292 / CVE-2015-8242)
        Libxml2 parser.c xmlParseMarkupDecl() Function Out-of-bounds Read 
        Issue (VulnDB 130435 / CVE-2015-8241)
        Libxml2 parser.c xmlParseEncodingDecl() Function Encoding Value 
        Handling Out-of-bounds Read Issue (VulnDB 130641 / CVE-2015-8317)
        Libxml2 parser.c xmlParseEncodingDecl() Function Input Stream 
        Conversion Handling Out-of-bounds Read Issue (VulnDB 130642 / 
        Libxml2 XML External Entity (XXE) Expansion Resource Exhaustion 
        Remote DoS (VulnDB 120600 / CVE-2015-1819)
        Libxml2 parser.c xmlParseConditionalSections() Function 
        Out-of-bounds Read Issue (VulnDB 121175 / CVE-2015-7941 / 
        Libxml2 Multiple Functionality Format Strings (VulnDB 138966 / 
        Libxml2 parser.c xmlParseElementDecl() / 
        xmlParseConditionalSections() Functions Out-of-bounds Read Issue 
        (VulnDB 138928 / CVE-2016-4447)
        Libxml2 parser.c xmlStringLenDecodeEntities() Function Unspecified 
        XML External Entity (XXE) Injection Issue (VulnDB 138926 / 
        Libxml2 xmlregexp.c xmlFAParseCharRange() Function Heap Buffer 
        Overflow (VulnDB 138572 / CVE-2016-1840)
        Libxml2 parser.c xmlParseStartTag2() Function Heap Use-after-free 
        (VulnDB 138567 / CVE-2016-1835)
        Libxml2 xmlstring.c xmlStrncatNew() Function Heap Buffer Overflow 
        (VulnDB 138566 / CVE-2016-1834)
        Libxml2 parser.c xmlParseNCNameComplex() Function Heap 
        Use-after-free (VulnDB 138568 / CVE-2016-1836)
        Libxml2 HTMLparser.c htmlParseSystemLiteral() / 
        htmlParsePubidLiteral() Functions Heap Buffer Overflow (VulnDB 
        138569 / CVE-2016-1837)
        Libxml2 xmlsave.c xmlBufAttrSerializeTxtContent() Function Recover 
        Mode XML Content Handling Out-of-bounds Read Issue (VulnDB 137965 /
        Libxml2 parser.c Multiple Function Recursive 
        xmlStringDecodeEntities() Call Handling Stack Overflow DoS (VulnDB 
        137962 / CVE-2016-3705)
        Libxml2 HTMLparser.c htmlParseName() / htmlParseNameComplex() 
        Functions Out-of-bounds Read Issue (VulnDB 134833 / CVE-2016-1839)
        Libxml2 parser.c xmlParserEntityCheck() Function Recovery Mode XML 
        Content Parsing Recursion DoS (VulnDB 136194 / CVE-2016-3627)
        Libxml2 parser.c xmlParseEndTag2() Function Out-of-bounds Read Issue
        (VulnDB 130651 / CVE-2016-1838 / CVE-2016-1695)
        Libxml2 parserInternals.c xmlNextChar() Function Out-of-bounds Read
        Issue (VulnDB 130653 / CVE-2016-1833)
        Libxml2 uri.c xmlParse3986Port() Function Port Argument Handling 
        Integer Overflow Unspecified Issue (VulnDB 138921)
        Libxml2 HTMLparser.c htmlParseNameComplex() Function HTML File 
        Encoding Detection Failure (VulnDB 138927) "[1]


        Tenable advises users should upgrade to the latest version of 
        Tenable Nessus to address these issues:
        "Tenable has released Nessus version 6.10 that corresponds to the 
        supported operating systems and architectures. To update your Nessus
        installation, follow these steps:
        Download the appropriate installation file to the system hosting 
        Nessus Professional or Nessus Manager, available at the Tenable 
        Support Portal 
        Stop the Nessus service.
        Install according to your operating system procedures.
        Restart the Nessus service."[1]


        [1] [R1] Nessus 6.10 Fixes Multiple Third-party Library Vulnerabilities

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967