Security Updates | 2009-01-15

I track security updates for the following vendors: Apple, Cisco, FreeBSD, Microsoft, Red Hat, and Sun Microsystems. I chose these vendors based on my own needs for the networks and systems I manage. I've also found that updates from these vendors tend to catch the major updates necessary for common software applications. If you have other vendors you would like me to provide updates for, send me a message.

Cisco Systems Inc.

• Cisco ONS Platform Crafted Packet Vulnerability
• IronPort Encryption Appliance / PostX and PXE Encryption Vulnerabilities
• Cisco IOS Cross-Site Scripting Vulnerabilities
• MD5 Hashes May Allow for Certificate Spoofing

The FreeBSD Project

• ntpd cryptographic signature bypass
• BIND DNSSEC incorrect checks for malformed signatures

Microsoft Corporation

• Vulnerabilities in Windows Media Components Could Allow Remote Code Execution (959807)
• Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (957173)

Red Hat, Inc.

• RHSA-2009:0006 Moderate: rhpki security and bug fix update
• RHSA-2009:0014 Important: kernel security and bug fix update
• RHSA-2009:0015 Critical: java-1.6.0-ibm security update
• RHSA-2009:0016 Critical: java-1.5.0-ibm security update

Sun Microsystems, Inc.

• A Security Vulnerability in the vncviewer(1) RFB Protocol Validation May Allow Execution of Arbitrary Code and Lead to a Denial of Service (DoS)
• Security Vulnerability in Sun Java System Access Manager May Allow Unauthorized Access Through Revealed Passwords
• A Security Vulnerability in Sun Java System Access Manager May Allow Privilege Escalation of Sub-Realm Administrators
• Security Vulnerability in samba(7) Specially Crafted Packet May Allow Execution of Arbitrary Code With Root Privileges
• Security Vulnerability Relating to the posix_fallocate(3C) System Call May Lead to a Denial of Service (DoS)
• Security Vulnerabilities in the Solaris lpadmin(1M) and ppdmgr(1M) Utilities May Lead to a Denial of Service (DoS) Condition
• Security vulnerability in Solaris Related to the Apache 1.3 mod_perl(3) Module Component "PerlRun.pm" may Lead to Denial of Service (DoS)