Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT Security Bulletin
ASB-2019.0060
McAfee Security Bulletin - Threat Intelligence Exchange Server 2.3.1 update
fixes Linux kernel, OpenSSH, and OpenSSL vulnerabilities
18 February 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: McAfee Threat Intelligence Exchange Server
Operating System: Linux variants
Virtualisation
Impact/Access: Access Privileged Data -- Existing Account
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-15919 CVE-2018-15473 CVE-2018-5407
CVE-2018-5391 CVE-2018-0732
Member content until: Wednesday, March 20 2019
Reference: ASB-2019.0041
ASB-2019.0031
ASB-2019.0030
ESB-2018.3474
ESB-2018.3380
ESB-2018.3377
ESB-2018.3374
ESB-2018.1758
OVERVIEW
Multiple vulnerabilities have been identified in McAfee
Threat Intelligence Exchange Server.
IMPACT
Details of the vulnerabilities can be found below:
"CVE-2018-5391:
The Linux kernel, versions 3.9+, is vulnerable to a denial of service
attack with low rates of specially modified packets targeting IP fragment
re-assembly. An attacker may cause a denial of service condition by sending
specially crafted IP fragments.
https://nvd.nist.gov/vuln/detail/CVE-2018-5391
CVE-2018-15473:
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not
delaying bailout for an invalid authenticating user until after the packet
containing the request has been fully parsed, related to auth2-gss.c,
auth2-hostbased.c, and auth2-pubkey.c.
https://nvd.nist.gov/vuln/detail/CVE-2018-15473
CVE-2018-15919:
Remotely observable behavior in auth-gss2.c in OpenSSH through 7.8 could be
used by remote attackers to detect existence of users on a target system
when GSS2 is in use.
https://nvd.nist.gov/vuln/detail/CVE-2018-15919
CVE-2018-0732:
During key agreement in a TLS handshake using a DH(E) based ciphersuite, a
malicious server can send a very large prime value to the client. This will
cause the client to spend an unreasonably long period of time generating a
key for this prime resulting in a hang until the client has finished. This
could be exploited in a Denial Of Service attack.
https://nvd.nist.gov/vuln/detail/CVE-2018-0732
CVE-2018-5407:
OpenSSL ECC scalar multiplication, used in, for example, ECDSA and ECDH,
has been shown to be vulnerable to a microarchitecture timing side channel
attack. An attacker with sufficient access to mount local timing attacks
during ECDSA signature generation could recover the private key.
https://www.openssl.org/news/vulnerabilities.html#2018-0734
https://nvd.nist.gov/vuln/detail/CVE-2018-5407" [1]
MITIGATION
McAfee recommends installing or updating to the following versions:
"TIE Server 2.3.1" [1]
REFERENCES
[1] Threat Intelligence Exchange Server 2.3.1 update fixes Linux
kernel, OpenSSH, and OpenSSL vulnerabilities
https://kc.mcafee.com/corporate/index?page=content&id=SB10269
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXGn5bWaOgq3Tt24GAQhzJQ//bVVWJOEI76nz6OLPVBw+Yx+UvnjhuQes
7X8zrvemKurPhL0cuNPj7UTTlGf9QuIIP/RFdpajCle9Hzxd1s2Xt4261NEzoXS5
yI29V2aAwFpEuRV9z1v9tQHijuBPwYj7RVMpWz794DfjlPcTxUasQj8IaXCMz7rE
fdFybW5tDoyN89J80i+ogiP0sBf8rsp7xbhWV4vIpOYroTPcNGwPdcxixTTRCrk7
gA0cUaRsaPrzKcIL0RfHRmf5lTxZSlEVxmTIV1j+eMPXzabngPr23g+EWPi5K8dH
DUqilMAsXe7seoKaz6TfEgd+XDkzYIPhB1pQ5dkaMUWyueiA+PaA/kekhvpFjWV4
kupufVJX7jIVGJcB8iAklLMjFZongj54WbfOreyD6Cax6QVtbBZq+MYIzfYHPyVy
ijguUqRlC55O/hHvVYlrSrZ+F24ag+2p0pd/KYGPSZaM0X24qHJ31HL+u2E4aD3n
wA9lVFJbQq9UhE13msLp/kQhw1kaLWEejTWVd09vWbZiAewF83LmpudFJ1TaeNWq
8xjE2MIIEGaeIHYNaemP9a5AdQQ6yZU+rOFIZyTx/NwVxS2j0POniyj6l4P2o48l
+tkKlHjX7RO59IGwd/41yPIYIcoJTGR5UFgE2OyQKZQh8UHmPjJo81+JUbXvwEoS
Px6xGZv5G9o=
=2HCg
-----END PGP SIGNATURE-----