What is Critical Vulnerability
A Critical Vulnerability is a Computer Security declared alert regarding a vulnerability in an application, operating system or configuration that, because of an increased risk or active exploit, must be patched outside of normal patching cycles. Critical Vulnerabilities often have a very short patching window, from hours to days, and that patching window may be reduced as the risk or threats increase. In most cases, Critical Vulnerabilities are declared for remotely accessible vulnerabilities that require no user interaction. Critical Vulnerabilities are continuously scanned for by CST, and network access is denied for systems not in compliance due to the increased risk of its presence on the FNAL network.
What to do about a Critical Vulnerability
The following vulnerabilities have been declared to be
so severe that mitigation measures are MANDATORY for network connection
at Fermilab. Mitigations are in order of preference:
- Remove, reconfigure, or disable the affected software
- Patch the affected software to a current enough level to fix the vulnerability.
- Remove the machine from the Fermilab network
- After you fix your vulnerabilities, remember to update the remediation actions taken in TIssue to lift the network block
In exceptional circumstances, one can request permission to
restrict access to the host machine to a tightly controlled list of inbound connections.
You can also scan yourself using the site Nessus scanner.
List of Critical Vulnerabilities
- Oct 27, 2014: FNAL Critical Vulnerability: TWiki remote code execution vulnerability
- Sept 25, 2014: FNAL Critical Vulnerability: Bourne Again Shell (Bash) Remote Code Execution Vulnerability
- May 2, 2014: FNAL Critical Vulnerability: Vulnerabilities in Internet Explorer Could Allow Remote Code Execution (MS14-021)
- Apr 9, 2014: FNAL Critical Vulnerability: OpenSSL 1.0.1 through 1.0.1f
- Oct 5, 2012: FNAL Critical Vulnerability: Exposing Adobe ColdFusion Servers to the Internet
- June 19, 2012: FNAL Critical Vulnerability: Hypernews
- June 14, 2012: Cumulative Security Update for Internet Explorer (MS012-037)
- June 14, 2012: RE-RELEASE: Vulnerability in RDP (MS12-020)
- March 16, 2012: Vulnerability in RDP (MS12-020)
- December 27, 2011: Telnet server (telnetd) remote code execution
- November 11, 2011: Vulnerability in TCP/IP (MS11-083)
- August 24, 2011: Flexera FlexNet/FlexLM License Manager
- August 2, 2010: Microsoft Shell .LNK Handling (MS10-046)
- January 14, 2009: Microsoft SMB Service (MS09-001)
- October 23, 2008: Microsoft Server Service (MS08-067)
- October 7, 2008: Microsoft Terminal Services Policy Violation
- October 7, 2008: pcAnywhere Policy Violation
- October 7, 2008: TimBukTu Policy Violation
- October 7, 2008: VNC Policy Violation
- May 25, 2007: Vulnerability in SRMWATCH
- April 4, 2007: Vulnerability in MIT Kerberos Telnet server
- April 2, 2007: Vulnerability in Windows Animated Cursor Handling (935423)
- 2007-Jan-12: Critical Vulnerability: MS07-004 (929969)
- 2006-Dec-23: Critical Vulnerability: Symantec Antivirus 10.0.x & 10.1.x
- 2006-Oct-23: Critical Vulnerability: OpenPBS/Torque
- 2006-Aug-09: Critical Vulnerability: MS06-040 (921883) MS Server Service
- 2006-May-16: RealVNC 4.1.1 and earlier Authentication Bypass
- 2006-Jan-05:
Critical Vulnerability: MS06-01 (912840) MS Windows WMF Handling
- 2006-Jan-01: Strong Authentication Violation: Password enabled SSH
- 2005-Oct-14: Critical Vulnerability: MS05-051 MS Windows MSDTC and TIP
- 2005-Oct-13: Critical Vulnerability: MS05-047 MS Windows Plug and Play (MS05-039 Update)
- 2005-Sep-15: TWiki - Enterprise Collaboration Platform
- 2005-Aug-12: MS05-039 Microsoft Windows Plug-n-Play (899588)
- 2005-Aug-11: Backup Exec Remote Agent
- 2005-Jul-1: Backup Exec Remote Agent (and Server)
- 2005-Jun-9: Microsoft SQL Server and MSDE
- 2005-Feb-8: MS 885250 / 890047 / 888113 / 873333 / 873352
- 2004-Oct-12: Open X Servers.
- 2004-Sep-21: MS WordPerfect Converter ( MS04-027 )
- 2004-Sep-21: HP Web JetAdmin ( HPSBPI01078 )
- 2004-Sep-21: Image Libraries - Linux ( RHSA-2004:447, RHSA-2004:465, RHSA-2004:466 )
- 2004-Sep-21: Image Libraries - Windows ( MS04-028 )
- 2004-Sep-09: OS X Combination vulnerability ( 2004-09-07 )
- 2004-Aug-11: mod_ssl for Apache ( VU#303448 )
- 2004-Jul-30: Internet Explorer ( MS04-025 )
- 2004-Jul-20: Various Windows ( MS04-021, -022, -023, -024 )
- 2004-May-24: CVS Server ( CVS remote vulnerability )
- 2004-Apr-28: Microsoft LSASS ( MS04-011 )
- 2004-Apr-22: Microsoft SSL ( MS04-011 )
- 2004-Feb-12: Microsoft ASN.1 ( MS04-007 )
- 2003-Dec-04: rsync heap overflow ( Secunia advisory SA10353 )
- 2003-Aug-21: Microsoft RPC Buffer Overflow ( MS03-039 )
- 2003-Jul-18: Microsoft RPC Buffer Overflow ( MS03-026 ) for servers.
- 2003-Mar-19: Microsoft IIS5 / WebDAV / NTDLL vulnerability ( MS03-007 )
- 2003-Apr-21: Anonymous FTP/Unauthenticated File Manipulation
|