-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                             ESB-2018.3513.16
      Apache Struts Commons FileUpload Library Remote Code Execution
           Vulnerability Affecting Cisco Products: November 2018
                             11 February 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Cisco products
Publisher:         Cisco Systems
Operating System:  Cisco
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Modify Arbitrary Files          -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-1000031  

Reference:         ESB-2018.1307
                   ESB-2018.0372
                   ESB-2017.3099

Original Bulletin: 
   https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-struts-commons-fileupload

Revision History:  February 11 2019: Updated vulnerable products
                   December  6 2018: Updated information about fixed release availability. Removed references to ongoing investigation.
                   December  3 2018: Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability.
                   November 29 2018: Updated information about fixed release availability.
                   November 27 2018: Updated information about fixed release availability.
                   November 23 2018: Updated information about Cisco Webex Centers exposure. Updated information about fixed release availability.
                   November 22 2018: Updated the list of vulnerable products. Updated information about fixed release availability.
                   November 21 2018: Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability.
                   November 20 2018: Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability.
                   November 19 2018: Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability.
                   November 16 2018: Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability.
                   November 15 2018: Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability.
                   November 14 2018: Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability. Indicated that the Cisco TAC is a resource for the Webex environment.
                   November 13 2018: Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability.
                   November 12 2018: Updated the lists of products under investigation, vulnerable products, and products confirmed not vulnerable. Updated information about fixed release availability.
                   November  8 2018: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Apache Struts Commons FileUpload Library Remote Code Execution Vulnerability
Affecting Cisco Products: November 2018

Priority:        Critical
Advisory ID:     cisco-sa-20181107-struts-commons-fileupload
First Published: 2018 November 7 00:00 GMT
Last Updated:    2019 February 7 14:49 GMT
Version 1.17:    Final
Workarounds:     No workarounds available
CVE-2016-1000031 
CWE-502

Summary

  o On November 5, 2018, the Apache Struts Team released a security
    announcement urging an upgrade of the Commons FileUpload library to version
    1.3.3 on systems using Struts 2.3.36 or earlier releases. Systems using
    earlier versions of this library may be exposed to attacks that could allow
    execution of arbitrary code or modifications of files on the system. The
    issue is caused by a previously reported vulnerability of the Apache
    Commons FileUpload library, assigned to CVE-2016-1000031.

    The vulnerability is due to insufficient validation of user-supplied input
    by the affected software. An attacker could exploit this vulnerability by
    submitting crafted data to an affected system. A successful exploit could
    allow the attacker to execute arbitrary code or manipulate files on the
    targeted system.

    This advisory is available at the following link:
    https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
    cisco-sa-20181107-struts-commons-fileupload

Affected Products

  o Cisco investigated its product line to determine which products and
    services may be affected by this vulnerability.

    The Vulnerable Products section of this advisory includes Cisco bug IDs for
    each affected product or service. The bugs are accessible through the Cisco
    Bug Search Tool and contain additional platform-specific information,
    including workarounds (if available) and fixed software releases.

    Any product or service not listed in the "Vulnerable Products" section of
    this advisory is to be considered not vulnerable.

    Vulnerable Products

    The following table lists Cisco products and services that are affected by
    the vulnerability that is described in this advisory. The software
    availability dates in the Fixed Release Availability column are estimates,
    and actual software availability may differ from the dates provided in the
    following table.

                   Product                 Cisco Bug        Fixed Release
                                               ID           Availability
                          Collaboration and Social Media
                                                      Patch file available for
    Cisco SocialMiner                      CSCvn22343 11.5/11.6 by Dec 2018
                                                      12.0.1 (Jan 2019)
                                                      2.8MR3 Security Patch 1
    Cisco Webex Meetings Server            CSCvn18895 (Dec 2018)
                                                      3.0MR2 Security Patch 2
                                                      (Dec 2018)
                       Endpoint Clients and Client Software
    Cisco Webex Management - SuperAdmin    CSCvn18901 T33.7.2 (Dec 2018)
    Control Panel
                       Network and Content Security Devices
                                                      Hot patch available for
                                                      2.1 Patch 7/2.3 Patch 5
    Cisco Identity Services Engine (ISE)   CSCvn17524 2.2 Patch 12 (Nov 2018)
                                                      2.3 Patch 6 (Feb 2019)
                                                      2.4 Patch 5 (Nov 2018)
                                                      2.5 (Dec 2018)
    Cisco Secure Access Control System     CSCvn18934 No fix planned ^1
    (ACS)
                        Network Management and Provisioning
    Cisco Evolved Programmable Network     CSCvn44132 2.2.1.2 (Dec 2018)
    Manager
    Cisco Prime Collaboration Provisioning CSCvn18919 12.6 (Nov 2018)
                                                      3.3.1 Update 04 (Feb
                                                      2019)
    Cisco Prime Infrastructure             CSCvn18917 3.4.1 Update 03 (Mar
                                                      2019)
                                                      3.5 (Dec 2018)
    Cisco Prime License Manager            CSCvn18924 Patch file available for
                                                      10.5.2/11.5.1 by Dec 2018
    Cisco Prime Network Registrar IP       CSCvn18913 No fix planned
    Address Manager (IPAM)
                                                      Patch file available for
    Cisco Prime Network                    CSCvn18910 5.1 by Dec 2018
                                                      5.2 (May 2019)
    Cisco Prime Service Catalog            CSCvn22307 12.1 v7 Patch (Dec 2018)
              Routing and Switching - Enterprise and Service Provider
    Cisco IOx Fog Director                 CSCvn19758 1.7.1 (Jan 2019)
                                                      1.8 (Feb 2019)
    Cisco IoT Field Network Director
    (formerly Cisco Connected Grid Network CSCvn20600 4.3.2 (Dec 2018)
    Management System)
                     Voice and Unified Communications Devices
                                                      Patch file available for
    Cisco Emergency Responder              CSCvn18956 11.5.1/12.0.1 by Dec 2018
                                                      12.5.1 (Jan 2019)
    Cisco Enterprise Chat and Email        CSCvn18957 11.6 ES6 (Jan 2019)
                                                      12.0.1 (Jan 2019)
                                                      Patch file available for
    Cisco Finesse                          CSCvn22344 11.6 by Dec 2018
                                                      12.0.1 (Jan 2019)
    Cisco Hosted Collaboration Mediation   CSCvn18961 11.5(4) (Available)
    Fulfillment
    Cisco Hosted Collaboration Solution    CSCvn18962 12.0.1 (Jan 2019)
    for Contact Center
    Cisco MediaSense                       CSCvn22346 No fix planned
                                                      Patch file available for
    Cisco Unified Communications Manager   CSCvn18959 10.5.2/11.5.1/12.0.1 by
    IM & Presence Service (formerly CUPS)             Dec 2018
                                                      12.5.1 (Jan 2019)
                                                      Patch file available for
    Cisco Unified Communications Manager   CSCvn18952 10.5.2/11.5.1/12.0.1 by
                                                      Dec 2018
                                                      12.5.1 (Jan 2019)
    Cisco Unified Contact Center           CSCvn18888 12.0.1 (Jan 2019)
    Enterprise
                                                      Patch file available for
    Cisco Unified Contact Center Express   CSCvn18955 11.5/11.6 by Dec 2018
                                                      12.0.1 (Jan 2019)
    Cisco Unified E-Mail Interaction       CSCvn18958 No fix planned
    Manager
                                                      Patch file available for
    Cisco Unified Intelligence Center      CSCvn18887 11.5/11.6 by Dec 2018
                                                      12.0.1 (Jan 2019)
    Cisco Unified Intelligent Contact      CSCvn18888 12.0.1 (Jan 2019)
    Management Enterprise
    Cisco Unified Web Interaction Manager  CSCvn18958 No fix planned
                                                      Patch file available for
    Cisco Unity Connection                 CSCvn18954 10.5.2/11.5.1/12.0.1 by
                                                      Dec 2018
                                                      12.5.1 (Jan 2019)
                                                      Patch file available for
    Cisco Virtualized Voice Browser        CSCvn18963 11.5/11.6 by Dec 2018
                                                      12.0.1 (Jan 2019)
              Video, Streaming, TelePresence, and Transcoding Devices
    Cisco Video Distribution Suite for     CSCvn18928 Patch file available by
    Internet Streaming (VDS-IS)                       Dec 2018
                                     Wireless
    Cisco Mobility Services Engine         CSCvn22305 Patch file available by
                                                      Dec 2018
    Cisco Universal Small Cell RAN         CSCvn18939 No fix planned
    Management System (USC RMS)
                            Cisco Cloud Hosted Services
    Cisco Prime Network Change and         CSCvn19865 3.6.1 (Dec 2018)
    Configuration Management                          3.7 (Mar 2019)
    Cisco Smart Connected Spaces           CSCvn22310 Patch file available by
                                                      Dec 2018
    Cisco Smart Net Total Care - Contracts CSCvn18884 4.3.6 (Dec 2018)
    Information System Process Controller
    Cisco Webex Centers - Meeting Center,             T33.7.2 (Dec 2018)
    Training Center, Event Center, Support CSCvn24113 T32.20.2 (Dec 2018)
    Center
                                                      Cisco will update
    Cisco Webex Meetings                   CSCvn18908 affected systems in Dec
                                                      2018


    ^ 1 Cisco Secure Access Control System (ACS) has reached the End of
    Software Maintenance (EoSWM) milestone . Only authenticated attackers with
    access to the Cisco ACS admin console could exploit this vulnerability. An
    administrator could also limit access to the Cisco ACS admin panel from
    trusted hosts in their environment.


    Products Confirmed Not Vulnerable

    Only products listed in the Vulnerable Products section of this advisory
    are known to be affected by this vulnerability.

    Cisco has confirmed that this vulnerability does not affect the following
    products and services:

    Network Application, Service, and Acceleration
       Cisco Data Center Network Manager

    Network and Content Security Devices
       Cisco Firepower Management Center
       Cisco Stealthwatch Endpoint Concentrator
       Cisco Stealthwatch FlowCollector NetFlow
       Cisco Stealthwatch FlowCollector sFlow
       Cisco Stealthwatch FlowSensor
       Cisco Stealthwatch Management Console (SMC)
       Cisco Stealthwatch UDP Director

    Network Management and Provisioning
       Cisco Prime Access Registrar
       Cisco Prime Central for Service Providers
       Cisco Prime Collaboration Assurance
       Cisco Prime Collaboration Deployment
       Cisco Prime LAN Management Solution
       Cisco Prime Provisioning
       Cisco Security Manager

    Routing and Switching - Enterprise and Service Provider
       Cisco Broadband Access Center for Telco and Wireless

    Unified Computing
       Cisco HyperFlex System

    Voice and Unified Communications Devices
       Cisco Unified Customer Voice Portal
       Cisco Unified SIP Proxy Software
       Cisco Unified Survivable Remote Site Telephony Manager
       Cisco Unity Express

    Video, Streaming, TelePresence, and Transcoding Devices
       Cisco StadiumVision Director
       Cisco TelePresence Management Suite

    Cisco Cloud Hosted Services
       Cisco Business Video Services Automation Software
       Cisco Cloud Web Security
       Cisco Common Services Platform Collector
       Cisco Network Device Security Assessment Service
       Cisco Network Performance Analysis
       Cisco Smart Net Total Care - On-Premises
       Cisco Smart Net Total Care
       Cisco Unified Service Delivery Platform
       Cisco Webex Network-Based Recording (NBR) Management

Workarounds

  o Any workarounds for a specific Cisco product or service will be documented
    in product-specific or service-specific Cisco bugs, which are identified in
    the Vulnerable Products section of this advisory.

Fixed Software

  o For information about fixed software releases, consult the Cisco bugs
    identified in the Vulnerable Products section of this advisory. Questions
    concerning the Webex environment may be directed to the Cisco Technical
    Assistance Center (TAC).

    When considering software upgrades, customers are advised to regularly
    consult the advisories for Cisco products, which are available from the
    Cisco Security Advisories and Alerts page , to determine exposure and a
    complete upgrade solution.

    In all cases, customers should ensure that the devices to be upgraded
    contain sufficient memory and confirm that current hardware and software
    configurations will continue to be supported properly by the new release.
    If the information is not clear, customers are advised to contact the Cisco
    TAC or their contracted maintenance providers.

Exploitation and Public Announcements

  o The Cisco Product Security Incident Response Team (PSIRT) is not aware of
    any malicious use of the vulnerability that is described in this advisory.

Source

  o On November 5th, 2018, the Apache Software Foundation released a security
    announcement at the following link: Immediately upgrade commons-fileupload
    to version 1.3.3 when running Struts 2.3.36 or prior

Cisco Security Vulnerability Policy

  o To learn about Cisco security vulnerability disclosure policies and
    publications, see the Security Vulnerability Policy . This document also
    contains instructions for obtaining fixed software and receiving security
    vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

  o Subscribe

Related to This Advisory

  o Apache Struts commons-fileupload Library DiskFileItem File Manipulation
    Arbitrary Code Execution Vulnerability

URL

  o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
    cisco-sa-20181107-struts-commons-fileupload

Revision History

  o +---------+--------------------+-------------+---------+------------------+
    | Version |    Description     |   Section   | Status  |       Date       |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated            |             |         |                  |
    |         | information about  |             |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability for   |             |         |                  |
    |         | Cisco Prime        |             |         |                  |
    |         | Infrastructure.    |             |         |                  |
    |         | The fix was not    |             |         |                  |
    |         | integrated in      |             |         |                  |
    |         | release 3.4.1      |             |         |                  |
    | 1.17    | Update 02 but will | Vulnerable  | Final   | 2019-February-07 |
    |         | be integrated in   | Products    |         |                  |
    |         | 3.4.1 Update 03.   |             |         |                  |
    |         | Corrected a typo   |             |         |                  |
    |         | referencing        |             |         |                  |
    |         | January 2018       |             |         |                  |
    |         | instead of January |             |         |                  |
    |         | 2019 as            |             |         |                  |
    |         | availability time  |             |         |                  |
    |         | for some fixed     |             |         |                  |
    |         | releases.          |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated            |             |         |                  |
    |         | information about  |             |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability for   |             |         |                  |
    |         | Cisco Prime        |             |         |                  |
    | 1.16    | Infrastructure.    | Vulnerable  | Final   | 2019-January-11  |
    |         | The fix was not    | Products    |         |                  |
    |         | integrated in      |             |         |                  |
    |         | release 3.3.1      |             |         |                  |
    |         | Update 03 but will |             |         |                  |
    |         | be integrated in   |             |         |                  |
    |         | 3.3.1 Update 04.   |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated            |             |         |                  |
    |         | information about  | Summary,    |         |                  |
    |         | fixed release      | Affected    |         |                  |
    | 1.15    | availability.      | Products,   | Final   | 2018-December-05 |
    |         | Removed references | Vulnerable  |         |                  |
    |         | to ongoing         | Products    |         |                  |
    |         | investigation.     |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  |             |         |                  |
    |         | of products under  | Affected    |         |                  |
    |         | investigation,     | Products,   |         |                  |
    |         | vulnerable         | Vulnerable  |         |                  |
    |         | products, and      | Products,   |         |                  |
    | 1.14    | products confirmed | Products    | Interim | 2018-November-30 |
    |         | not vulnerable.    | Confirmed   |         |                  |
    |         | Updated            | Not         |         |                  |
    |         | information about  | Vulnerable  |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated            |             |         |                  |
    | 1.13    | information about  | Vulnerable  | Interim | 2018-November-28 |
    |         | fixed release      | Products    |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated            |             |         |                  |
    | 1.12    | information about  | Vulnerable  | Interim | 2018-November-26 |
    |         | fixed release      | Products    |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated            |             |         |                  |
    |         | information about  | Vulnerable  |         |                  |
    |         | Cisco Webex        | Products,   |         |                  |
    | 1.11    | Centers exposure.  | Products    | Interim | 2018-November-22 |
    |         | Updated            | Confirmed   |         |                  |
    |         | information about  | Not         |         |                  |
    |         | fixed release      | Vulnerable  |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the list   |             |         |                  |
    |         | of vulnerable      |             |         |                  |
    | 1.10    | products. Updated  | Vulnerable  | Interim | 2018-November-21 |
    |         | information about  | Products    |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  |             |         |                  |
    |         | of products under  | Affected    |         |                  |
    |         | investigation,     | Products,   |         |                  |
    |         | vulnerable         | Vulnerable  |         |                  |
    |         | products, and      | Products,   |         |                  |
    | 1.9     | products confirmed | Products    | Interim | 2018-November-20 |
    |         | not vulnerable.    | Confirmed   |         |                  |
    |         | Updated            | Not         |         |                  |
    |         | information about  | Vulnerable  |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  |             |         |                  |
    |         | of products under  | Affected    |         |                  |
    |         | investigation,     | Products,   |         |                  |
    |         | vulnerable         | Vulnerable  |         |                  |
    |         | products, and      | Products,   |         |                  |
    | 1.8     | products confirmed | Products    | Interim | 2018-November-19 |
    |         | not vulnerable.    | Confirmed   |         |                  |
    |         | Updated            | Not         |         |                  |
    |         | information about  | Vulnerable  |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  | Affected    |         |                  |
    |         | of products under  | Products,   |         |                  |
    |         | investigation,     | Vulnerable  |         |                  |
    | 1.7     | vulnerable         | Products,   | Interim | 2018-November-16 |
    |         | products, and      | Products    |         |                  |
    |         | products confirmed | Confirmed   |         |                  |
    |         | not vulnerable.    | Not         |         |                  |
    |         |                    | Vulnerable  |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  |             |         |                  |
    |         | of products under  | Affected    |         |                  |
    |         | investigation,     | Products,   |         |                  |
    |         | vulnerable         | Vulnerable  |         |                  |
    |         | products, and      | Products,   |         |                  |
    | 1.6     | products confirmed | Products    | Interim | 2018-November-15 |
    |         | not vulnerable.    | Confirmed   |         |                  |
    |         | Updated            | Not         |         |                  |
    |         | information about  | Vulnerable  |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  |             |         |                  |
    |         | of products under  | Affected    |         |                  |
    |         | investigation,     | Products,   |         |                  |
    |         | vulnerable         | Vulnerable  |         |                  |
    |         | products, and      | Products,   |         |                  |
    | 1.5     | products confirmed | Products    | Interim | 2018-November-14 |
    |         | not vulnerable.    | Confirmed   |         |                  |
    |         | Updated            | Not         |         |                  |
    |         | information about  | Vulnerable  |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  |             |         |                  |
    |         | of products under  |             |         |                  |
    |         | investigation,     | Affected    |         |                  |
    |         | vulnerable         | Products,   |         |                  |
    |         | products, and      | Vulnerable  |         |                  |
    |         | products confirmed | Products,   |         |                  |
    |         | not vulnerable.    | Products    |         |                  |
    | 1.4     | Updated            | Confirmed   | Interim | 2018-November-13 |
    |         | information about  | Not         |         |                  |
    |         | fixed release      | Vulnerable, |         |                  |
    |         | availability.      | Fixed       |         |                  |
    |         | Indicated that the | Software    |         |                  |
    |         | Cisco TAC is a     |             |         |                  |
    |         | resource for the   |             |         |                  |
    |         | Webex environment. |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  |             |         |                  |
    |         | of products under  | Affected    |         |                  |
    |         | investigation,     | Products,   |         |                  |
    |         | vulnerable         | Vulnerable  |         |                  |
    |         | products, and      | Products,   |         |                  |
    | 1.3     | products confirmed | Products    | Interim | 2018-November-12 |
    |         | not vulnerable.    | Confirmed   |         |                  |
    |         | Updated            | Not         |         |                  |
    |         | information about  | Vulnerable  |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  |             |         |                  |
    |         | of products under  | Affected    |         |                  |
    |         | investigation,     | Products,   |         |                  |
    |         | vulnerable         | Vulnerable  |         |                  |
    |         | products, and      | Products,   |         |                  |
    | 1.2     | products confirmed | Products    | Interim | 2018-November-09 |
    |         | not vulnerable.    | Confirmed   |         |                  |
    |         | Updated            | Not         |         |                  |
    |         | information about  | Vulnerable  |         |                  |
    |         | fixed release      |             |         |                  |
    |         | availability.      |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    |         | Updated the lists  | Affected    |         |                  |
    |         | of products under  | Products,   |         |                  |
    |         | investigation,     | Vulnerable  |         |                  |
    | 1.1     | vulnerable         | Products,   | Interim | 2018-November-08 |
    |         | products, and      | Products    |         |                  |
    |         | products confirmed | Confirmed   |         |                  |
    |         | not vulnerable.    | Not         |         |                  |
    |         |                    | Vulnerable  |         |                  |
    +---------+--------------------+-------------+---------+------------------+
    | 1.0     | Initial public     | -           | Interim | 2018-November-07 |
    |         | release.           |             |         |                  |
    +---------+--------------------+-------------+---------+------------------+

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXGC7xWaOgq3Tt24GAQjjew//XU9aeAIkJO53NzYIXOIJZCl6cG1kqJmm
FaWmmC9xtGr8jSc+1MG4ssgDAl+gK5aX0KJPooVhb6f1Nga34j0VmA0tiwpM4VIq
p3bFT1KJ3KaRnXtvDxwYARd+Yi5kCo0pORn4zTzLzDoJ6G2mAuLgDdi6uctkSlbK
5Xmp7jXQHUVNJXtJyDoX7GdQ9YFYTbf5tth8J16cM8tVN0fgddqnKoqq9zFff4jq
L8Cns/DDabY78C8QN6m70c50FqhvaHfm9HJtpnYm+sYHD0YYTh0gjDD0QHIX9rkD
cF/3KqJo2+cygLeCxO5oHEemlaWA+ln1W+0VDuWywdMta0TIohFRQBGQiM6YMN0I
HhygaInfySZpyScPGKjMUyxEQibSKFuamjOOZ5JuKpK71M6UiQSlBZfGSTyh8/rJ
nZqBbDQ60toGYeXmxLEAhIYWo1ypmA1hXdTNASMlTcz9hl3/wIIJewTdgm+fu+JX
D4Ohl6L76kE5YinL4IQuYfM4JIaVvf8lD1HGAMqTpo6CKLXm9AUz/zgvUpfEnUVP
ws/lVlBg8ornGHnAZ4IoMVA2O/sVraejqSaRA40Pjmc0EqMMhl4NV/mnoFcuC/AU
/o3mHXQ82qH85zr5N+FielGhLPxNxtgzLOolreSjWO+f0jzzeRVwQuf63n3C7Bsy
RUEljUBhPTA=
=ISBO
-----END PGP SIGNATURE-----