The December 2014 edition of the SteelCentral NetAuditor Advisory Service update is now available for versions 18.0.0 and 18.0.1. This update includes 26 new security advisory rules and 3 updated security advisory rules.

 

  • New Security Advisory Rules
    1. ASA VPN Failover Command Injection Vulnerability (cisco-sa-20141008-asa)
    2. Riverbed SteelHead Shellshock Vulnerability (S24997)
    3. NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability (cisco-sa-20140521-nxos)
    4. NX-OS Virtual Device Context SSH Key Privilege Escalation Vulnerability (cisco-sa-20140521-nxos)
    5. NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability (cisco-sa-20140521-nxos)
    6. IOS RSVP Vulnerability (cisco-sa-20140924-rsvp)
    7. IOS SIP DoS Vulnerability (cisco-sa-20140924-sip)
    8. IOS NAT DoS Vulnerability (cisco-sa-20140924-nat)
    9. IOS DHCPv6 DoS Vulnerability (cisco-sa-20140924-dhcpv6)
    10. IOS Metadata Vulnerabilities (cisco-sa-20140924-metadata)
    11. IOS Multicast Domain Name System Vulnerabilities (cisco-sa-20140924-mdns)
    12. GNU Bash Environment Variable Command Injection Vulnerability (cisco-sa-20140926-bash)
    13. ASA SQL*NET Inspection Engine DoS Vulnerability (cisco-sa-20141008-asa)
    14. ASA VPN DoS Vulnerability (cisco-sa-20141008-asa)
    15. ASA IKEv2 DoS Vulnerability (cisco-sa-20141008-asa)
    16. ASA Health and Performance Monitor DoS Vulnerability (cisco-sa-20141008-asa)
    17. ASA GPRS Tunneling Protocol Inspection Engine DoS Vulnerability (cisco-sa-20141008-asa)
    18. ASA SunRPC Inspection Engine DoS Vulnerability (cisco-sa-20141008-asa)
    19. ASA DNS Inspection Engine DoS Vulnerability (cisco-sa-20141008-asa)
    20. ASA VNMC Command Input Validation Vulnerability (cisco-sa-20141008-asa)
    21. ASA Local Path Inclusion Vulnerability (cisco-sa-20141008-asa)
    22. ASA Clientless SSL VPN Information Disclosure and DoS Vulnerability (cisco-sa-20141008-asa)
    23. ASA Clientless SSL VPN Portal Customization Integrity Vulnerability (cisco-sa-20141008-asa)
    24. ASA Smart Call Home Digital Certificate Validation Vulnerability (cisco-sa-20141008-asa)
    25. Riverbed SteelHead OpenSSL Vulnerability (S24204)
    26. Apache HTTPd Range Header DoS Vulnerability (cisco-sa-20110830-apache)

 

  • Updated Security Advisory Rules
    1. IOS DHCP DoS Vulnerability (cisco-sa-20130925-dhcp)
    2. Riverbed SteelHead Heartbleed Vulnerability (S23635)
    3. IOS Object-group ACL Bypass Vulnerability (cisco-sa-20090923-acl)

 

You can download this update directly from NetAuditor by:

  • Manually selecting NetDoctor / Advisories / Download Now, or
  • Adding an automation step to download new update.

See user guide section: "Modules / NetDoctor / SteelCentral NetAuditor Advisory Service"

 

You can also download the patch installer from the SAS Website (requires login).

 

Please contact Riverbed Technical Support with your questions/comments.

 

Sincerely,

SteelCentral NPCM Product Management