This document summarizes several security vulnerabilities from 2015, including: - The MS15-034 vulnerability allowed remote code execution via specially crafted HTTP requests to affected Windows systems. Microsoft addressed this with an update. - ProFtpd had a vulnerability where its mod_copy module allowed unauthorized copying of files. - OpenSSL had multiple vulnerabilities disclosed in a security advisory, including DoS issues, memory corruptions, and NULL pointer dereferences. - The FREAK attack allowed intercepting HTTPS connections and forcing weak encryption that could be broken to steal data. Checkers were available online. - Samba had a vulnerability in its Netlogon Remote Protocol that did not require authentication to execute vulnerable code

1. Security
Vulnerabilities Of
2015

2. Index
• MS Security Bulletin MS15-034
• ProFtpd mod_copy vulnerability
• OpenSsl Vulnerability
• Freak Vulnerability
• Samba Vulnerability
• Ghost Vulnerability

3. Microsoft Security Bulletin MS15-034 Critical
• This security update resolves a vulnerability in Microsoft
Windows. The vulnerability could allow remote code
execution if an attacker sends a specially crafted HTTP
request to an affected Windows system.
• This security update is rated Critical for all supported
editions of Windows 7, Windows Server 2008 R2,
Windows 8, Windows Server 2012, Windows 8.1, and
Windows Server 2012 R2.
• The security update addresses the vulnerability by
modifying how the Windows HTTP stack handles
requests.

4. Microsoft Security Bulletin MS15-034 Critical
References:
https://github.com/rapid7/metasploit-framework/pull/5150
https://www.snort.org/advisories/vrt-rules-2015-04-14
https://technet.microsoft.com/en-us/library/security/ms15-034.aspx
Checkers for this vulnerability
https://lab.xpaw.me/MS15-034/
https://github.com/pr4jwal/quick-scripts/blob/master/ms15-034.nse
https://github.com/wrycu/ms15-034-detector/blob/master/ms15-034_detect.py

5. Proftpd Vulnerability
Unauthenticated copying of files via SITE CPFR/CPTO
allowed by mod_copy
References: http://bugs.proftpd.org/show_bug.cgi?id=4169

6. Openssl Multiple Vulnerabilities
OpenSSL Security Advisory [19 Mar 2015]
OpenSSL 1.0.2 ClientHello sigalgs DoS (CVE-2015-0291) High
Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204) High
Multiblock corrupted pointer (CVE-2015-0290) Moderate
Segmentation fault in DTLSv1_listen (CVE-2015-0207) Moderate
Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286) Moderate
Segmentation fault for invalid PSS parameters (CVE-2015-0208) Moderate
ASN.1 structure reuse memory corruption (CVE-2015-0287) Moderate
PKCS7 NULL pointer dereferences (CVE-2015-0289) Moderate
Base64 decode (CVE-2015-0292) Moderate
DoS via reachable assert in SSLv2 servers (CVE-2015-0293) Moderate
Empty CKE with client auth and DHE (CVE-2015-1787) Moderate
Handshake with unseeded PRNG (CVE-2015-0285) Low
Use After Free following d2i_ECPrivatekey error (CVE-2015-0209) Low
X509_to_X509_REQ NULL pointer deref (CVE-2015-0288) Low
References:
https://www.openssl.org/news/secadv_20150319.txt

7. Freak Vulnerability
• On Tuesday, March 3, 2015, researchers announced a new
SSL/TLS vulnerability called the FREAK attack. It allows
an attacker to intercept HTTPS connections between
vulnerable clients and servers and force them to use
weakened encryption, which the attacker can break to steal
or manipulate sensitive data.
• The FREAK attack was discovered by Karthikeyan
Bhargavan at INRIA in Paris and the miTLS team.

8. Freak Vulnerability
Checkers &References For Freak Vulnerability:
https://tools.keycdn.com/freak
https://www.ssllabs.com/ssltest/
https://freakattack.com/clienttest.html
https://freakattack.com/

9. Samba vulnerability (CVE-2015-0240)
The Samba team reported CVE-2015-0240 last February 23, 2015. This
vulnerability is very difficult to exploit and we are not aware of successful
exploitation. However, it is quite interesting from the point for view of
detection. There are two important facts:
• The vulnerability resides in the Netlogon Remote
Protocol implementation of Samba which is a very high-level
application protocol that can be used over different transports
configurations.
• To execute the vulnerable code the attacker doesn’t need be
authenticated and can use many ways to launch the attacks because of
the previous point. This is very motivating for attackers as they can find
ways to bypass Intrusion Prevention System (IPS).

10. Samba vulnerability (CVE-2015-0240)
References:
• http://blog.trendmicro.com/trendlabs-security-
intelligence/samba-remote-code-execution-vulnerability-
cve-2015-0240/
• https://www.nccgroup.trust/en/blog/2015/03/samba-
_netr_serverpasswordset-expoitability-analysis/
• https://securityblog.redhat.com/2015/02/23/samba-
vulnerability-cve-2015-0240/

11. Ghost vulnerability
The GHOST vulnerability is a serious weakness in the Linux glibc
library. It allows attackers to remotely take complete control of the
victim system without having any prior knowledge of system
credentials. CVE-2015-0235 has been assigned to this issue.
What is glibc?
• The GNU C Library or glibc is an implementation of the
standard C library and a core part of the Linux operating system.
Without this library a Linux system will not function.

12. Ghost vulnerability
References & Checker for this vulnerability:
https://community.qualys.com/blogs/laws-of-
vulnerabilities/2015/01/27/the-ghost-vulnerability
http://support.citrix.com/article/CTX200391
http://security.stackexchange.com/questions/80210/ghost-bug-
is-there-a-simple-way-to-test-if-my-system-is-secure
http://www.openwall.com/lists/oss-security/2015/01/27/9

13. Ghost vulnerability
References & Checker for this vulnerability:
https://rhn.redhat.com/errata/RHSA-2015-0090.html
https://launchpad.net/ubuntu/+source/eglibc
https://security-tracker.debian.org/tracker/CVE-2015-0235
https://oss.oracle.com/pipermail/el-errata/2015-January/004810.html
http://lists.centos.org/pipermail/centos-announce/2015-
January/020906.html
http://lists.opensuse.org/opensuse-updates/2015-01/msg00085.html
http://www.gnu.org/software/libc/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0235

14. Thanks