TrustKeeper Scan Engine Update for February 03, 2016

Summary

The latest update to the TrustKeeper scan engine that powers our Trustwave Vulnerability Management product (including both internal and external vulnerability scanning) is now available. Enjoy!

New Vulnerability Test Highlights

Some of the more interesting vulnerability tests we added recently are as follows:

Apache

• Apache Subversion Integer overflow allows remote attackers to execute arbitrary code via an svn:// protocol string (CVE-2015-5259)

Cisco

• Cisco ASA DHCP Denial of Service Vulnerability (CSCsh50277) (CVE-2007-2461)
• Cisco ASA Local Privilege Escalation Vulnerability (CSCsh33287) (CVE-2007-0960)

Magneto

• Directory traversal in the MAGMI (aka Magento Mass Importer) for Magento Server allows remote attackers to read arbitrary files. (CVE-2015-2067)
• GNU tar unsafe symlink (CVE-2006-6097)

OpenSSL

• OpenSSL Denial of Service vulnerability in ssl/s3_clnt.c (CVE-2015-3196)

Samba

• Samba client encryption vulnerable to downgrade attack (CVE-2015-5296)

How to Update?

All Trustwave customers using the TrustKeeper Scan Engine receive the updates automatically as soon as an update is available. No action is required.