Ask the Community
Groups
Unitrends Response to certain security vulnerabilities (CVEs) - Reference Article - Connect IT Community | Kaseya
<main> <article class="userContent"> <h2 data-id="summary"><strong>SUMMARY</strong></h2> <p>This article serves as a reference for Unitrends responses to Common Vulnerabilities and Exposures (CVE).</p> <h2 data-id="issue"><strong>ISSUE</strong></h2> <p> </p> <p><span style="color: #3d3d3d;">A security vulnerability CVE report has been issued. Is the Unitrends system vulnerable to it?</span><br><br><span style="color: #3d3d3d;">The CVE and NIST organizations publish security vulnerability reports as they are discovered, and the use cases where the vulnerability occurs is also described. The Unitrends engineering organization must evaluate each of these to determine if there is any vulnerability exposed for Unitrends appliance and determine corrective action, if any.</span><br><br><span style="color: #ff0000;"><strong>Security updates are included in normal monthly appliance updates past release 10.3.0. </strong>No manual action is necessary to have the latest security packages other than updating to the current Unitrends appliance release. </span></p> <h2 data-id="resolution"><strong>RESOLUTION</strong></h2> <p>Unitrends has provided responses to the following CVE's. Note all CVEs solved are not listed, only CVEs that were reported to Unitrends by customers or that are common false positives are included here. This is not an exhaustive listing. </p> <p><br><strong>Before contacting Unitrends Support regarding a possible CVE risks, please do the following:</strong></p> <ol><li>Update your appliance to the latest Unitrends release. Note updating hot copy targets before backup appliances is required. An active support agreement is required to obtain the latest release from Unitrends. </li> <li>Wait at least 30 minutes post update then check in your UI to see if there is an alert indicating a reboot is required. Reboot only if an alert is noted. </li> <li>scan your system with the latest updates of your security vulnerability scanner. Compare the results of your scan with this article. Many CVEs reported against Unitrends systems are false positives or do not apply to our system. Eliminate all that do not apply. </li> <li>Note any CVEs your tool reports the appliance triggered that are not resolved through this process. Provide the output of those specific CVEs to Unitrends support. </li> </ol><p> </p> <p><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013257258" rel="noopener nofollow">CVE-2019-3880 samba: save registry file outside share as unprivileged user</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013161137" rel="noopener nofollow">CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198237" rel="noopener nofollow">CVE-2018-10872 kernel: error in exception handling leads to DoS</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198097" rel="noopener nofollow">CVE-2018-10858 samba: insufficient input validation in libsmbclient</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296418" rel="noopener nofollow">CVE-2018-10675 kernel: Use-after-free vulnerability in mm/mempolicy.c:do_get_mempolicy</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198537" rel="noopener nofollow">CVE-2018-6329 Unitrends: sqli authentication bypass RCE</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295538" rel="noopener nofollow">CVE-2018-6328 Unitrends: RCE with backquotes in /api/hosts/ parameters</a> <br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295318" rel="noopener nofollow">CVE-2018-5733 dhcp: Reference count overflow in dhcpd allows denial of service</a> <br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296638" rel="noopener nofollow">CVE-2018-5732 dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server</a> <br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198197" rel="noopener nofollow">CVE-2018-5390 kernel: TCP segments with random offsets allow a remote denial of service (SegmentSmack)</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198617" rel="noopener nofollow">CVE-2018-3665 Kernel: FPU state information leakage via lazy FPU restore</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198477" rel="noopener nofollow">CVE-2018-3646 kernel: L1 Terminal Fault: VMM</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198637" rel="noopener nofollow">CVE-2018-3639 hw: cpu: speculative store bypass</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296258" rel="noopener nofollow">CVE-2018-3620 kernel: L1 Terminal Fault: OS/SMM</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198157" rel="noopener nofollow">CVE-2018-3615 kernel: L1 Terminal Fault: SGX</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295098" rel="noopener nofollow">CVE-2018-1111 dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script</a> <br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295658" rel="noopener nofollow">CVE-2017-1000405 kernel: Huge Dirty Cow vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199557" rel="noopener nofollow">CVE-2017-1000379: kernel: PIE binary stack mapping</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295638" rel="noopener nofollow">CVE-2017-1000370: kernel: PIE binary stack overrun</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199237" rel="noopener nofollow">CVE-2017-1000368 sudo: Privilege escalation via improper get_process_ttyname parsing</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013197957" rel="noopener nofollow">CVE-2017-1000366: glibc: manipulate heap/stack via LD_LIBRARY_PATH</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296238" rel="noopener nofollow">CVE-2017-1000365: kernel: stack limit bypass</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295618" rel="noopener nofollow">CVE-2017-1000364: kernel: stack guard page flaw</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295718" rel="noopener nofollow">CVE-2017-15275 samba: Server heap-memory disclosure</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013271858" rel="noopener nofollow">CVE-2017-15906 openssh: Improper write operations in readonly mode allow for zero-length file creation</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199277" rel="noopener nofollow">CVE-2017-12479: Unitrends LOGDIR privilege escalation RCE</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295258" rel="noopener nofollow">CVE-2017-12478: Unitrends api/storage authentication bypass RCE</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296618" rel="noopener nofollow">CVE-2017-12477: Unitrends bpserverd authentication bypass RCE</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198497" rel="noopener nofollow">CVE-2017-12163 samba: server memory information leak over SMB1</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013163817" rel="noopener nofollow">CVE-2017-9461 samba: fd_open_atomic infinite loop due to wrong handling of dangling symlinks</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199537" rel="noopener nofollow">CVE-2017-8779 rpcbind: memory leak when failing to parse XDR strings/arrays</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295178" rel="noopener nofollow">CVE-2017-8291 ghostscript corruption of operand stack</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295598" rel="noopener nofollow">CVE-2017-7980 qemu: OOB r/w access issues in bitblt routines</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199197" rel="noopener nofollow">CVE-2017-7895: kernel: NFSv3 server payload bounds checking of WRITE requests</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295518" rel="noopener nofollow">CVE-2017-7805 nss: Potential use-after-free in TLS 1.2 server</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295238" rel="noopener nofollow">CVE-2017-7679 httpd: mod_mime buffer overread</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013197997" rel="noopener nofollow">CVE-2017-7541 kernel: Possible heap buffer overflow in brcmf_cfg80211_mgmt_tx</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198577" rel="noopener nofollow">CVE-2017-7494: samba RCE from a writeable share</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198397" rel="noopener nofollow">CVE-2017-7284: Unitrends forced password change in users.php</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198437" rel="noopener nofollow">CVE-2017-7283: Unitrends RCE in restore.php filenames</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199217" rel="noopener nofollow">CVE-2017-7282: Unitrends LFI in restore.php filename</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198417" rel="noopener nofollow">CVE-2017-7281: Unitrends unrestricted report file upload</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198037" rel="noopener nofollow">CVE-2017-7280: Unitrends RCE in systems.php password</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295458" rel="noopener nofollow">CVE-2017-7279: Unitrends user privilege escalation</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295498" rel="noopener nofollow">CVE-2017-6464 ntp: Denial of Service via malformed config</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295158" rel="noopener nofollow">CVE-2017-5753 kernel: speculative execution bounds-check bypass (meltdown/spectre)</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295038" rel="noopener nofollow">CVE-2017-3169 httpd: mod_ssl NULL pointer dereference</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295298" rel="noopener nofollow">CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199697" rel="noopener nofollow">CVE-2017-0143 Windows SMB RCE Vulnerability (WannaCry)</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199297" rel="noopener nofollow">CVE-2016-10012 openssh: Bounds check evaded in shared memory manager with pre-authentication compression support</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198517" rel="noopener nofollow">CVE-2016-10011 openssh: Leak of host private key material to privilege-separated child process via realloc</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198357" rel="noopener nofollow">CVE-2016-10010 openssh: privilege escalation via Unix domain socket forwarding</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013294998" rel="noopener nofollow">CVE-2016-10009 openssh: loading of untrusted PKCS#11 modules in ssh-agent</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296578" rel="noopener nofollow">CVE-2016-9540 libtiff: cpStripToTile heap-buffer-overflow</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198057" rel="noopener nofollow">CVE-2016-8858 openssh: Memory exhaustion due to unregistered KEXINIT handler</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295578" rel="noopener nofollow">CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013197937" rel="noopener nofollow">CVE-2016-7406: Format string vulnerability in Dropbear SSH</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013153397" rel="noopener nofollow">CVE-2016-6515: openssh: Denial of service via very long passwords</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295418" rel="noopener nofollow">CVE-2016-6329: SWEET32 attacks against 3DES Ciphers (openvpn)</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013247638" rel="noopener nofollow">CVE-2016-6210 openssh: User enumeration via covert timing channel</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295358" rel="noopener nofollow">CVE-2016-5696: kernel: challenge ACK counter disclosure</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199117" rel="noopener nofollow">CVE-2016-5387: Apache HTTPD: Proxy header sets environment</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198317" rel="noopener nofollow">CVE-2016-5195 kernel: mm: privilege escalation via 'dirty' COW</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198597" rel="noopener nofollow">CVE-2016-3115: openssh: bypass SSH restrictions</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198137" rel="noopener nofollow">CVE-2016-2183: SWEET32 TLS/SSL Birthday attacks on 3DES ciphers</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013248798" rel="noopener nofollow">CVE-2016-2125 samba: Unconditional privilege delegation to Kerberos servers in trusted realms</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013266258" rel="noopener nofollow">CVE-2016-2118: Samba Badlock vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198017" rel="noopener nofollow">CVE-2016-2107: OpenSSL oracle padding vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013244998" rel="noopener nofollow">CVE-2016-1908 openssh: possible fallback from untrusted to trusted X11 forwarding</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013170017" rel="noopener nofollow">CVE-2015-8370: grub2 authentication bypass</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295218" rel="noopener nofollow">CVE-2015-8325: openssh privilege escalation via LD_PRELOAD</a> <br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198217" rel="noopener nofollow">CVE-2015-7560 samba: Incorrect ACL get/set allowed on symlink path</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013260638" rel="noopener nofollow">CVE-2015-7547: glibc libresolve vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198377" rel="noopener nofollow">CVE-2015-6564 openssh: Use-after-free bug with PAM support</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198337" rel="noopener nofollow">CVE-2015-6563: openssh: Privilege separation weakness</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295478" rel="noopener nofollow">CVE-2015-5600: openssh: MaxAuthTries limit bypass</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013271838" rel="noopener nofollow">CVE-2015-5352 openssh: XSECURITY restrictions bypass under certain conditions in ssh(1)</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013169957" rel="noopener nofollow">CVE-2015-0240: Samba TALLOC_FREE vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013169977" rel="noopener nofollow">CVE-2015-0235: GHOST glibc vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013180057" rel="noopener nofollow">CVE-2014-9295: ntpd buffer overflow vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013200117" rel="noopener nofollow">CVE-2014-7169: Additional Bash Vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013170637" rel="noopener nofollow">CVE-2014-6271: Bash Vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013176217" rel="noopener nofollow">CVE-2014-3566: SSL Poodle Vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013151237" rel="noopener nofollow">CVE-2014-3493 samba: smbd unicode path names denial of service</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295118" rel="noopener nofollow">CVE-2014-3139: snmpd.php bypass authentication</a> <br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199097" rel="noopener nofollow">CVE-2014-2653 openssh: failure to check DNS SSHFP records in certain scenarios</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013257218" rel="noopener nofollow">CVE-2014-2532 openssh: AcceptEnv environment restriction bypass flaw</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013175497" rel="noopener nofollow">CVE-2014-1692 openssh: uninitialized variable use in J-PAKE implementation</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013169637" rel="noopener nofollow">CVE-2014-0244 samba: nmbd denial of service</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013261718" rel="noopener nofollow">CVE-2014-0224: CCS Injection Vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295698" rel="noopener nofollow">CVE-2014-0160: OpenSSL Heartbleed Vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295558" rel="noopener nofollow">CVE-2014-0098 httpd: mod_log_config does not properly handle logging certain cookies resulting in DoS</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296358" rel="noopener nofollow">CVE-2013-6438 httpd: mod_dav denial of service via crafted DAV WRITE request</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013266638" rel="noopener nofollow">CVE-2013-4434: Dropbear SSH Logon Vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013277498" rel="noopener nofollow">CVE-2013-4421: Dropbear SSH Decompress DoS Vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013248338" rel="noopener nofollow">CVE-2013-2566: TLS/SSL Server Supports RC4 Cipher Algorithms</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295678" rel="noopener nofollow">CVE-2012-5568 tomcat: Slowloris denial of service</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013266278" rel="noopener nofollow">CVE-2012-4929: CRIME SSL/TLS Injection vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013266298" rel="noopener nofollow">CVE-2012-2687: Apache HTTPD: XSS in mod_negotiation</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013161077" rel="noopener nofollow">CVE-2012-0814 openssh: forced command option information disclosure</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296338" rel="noopener nofollow">CVE-2012-0053 httpd: cookie exposure due to error responses</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296658" rel="noopener nofollow">CVE-2012-0031 httpd: possible crash on shutdown due to flaw in scoreboard handling</a> <br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295338" rel="noopener nofollow">CVE-2011-5000 openssh: post-authentication resource exhaustion bug via GSSAPI</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013250778" rel="noopener nofollow">CVE-2011-4327 openssh: Unauthorized local access to host keys on platforms where ssh-rand-helper used</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199337" rel="noopener nofollow">CVE-2011-4317 httpd: uri scheme bypass of the reverse proxy vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295278" rel="noopener nofollow">CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295398" rel="noopener nofollow">CVE-2011-3389: SSL v3/TLS 1.0 BEAST security vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198557" rel="noopener nofollow">CVE-2011-3368: httpd: reverse web proxy vulnerability</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013277518" rel="noopener nofollow">CVE-2009-3095: Apache httpd mod_proxy_ftp FTP command injection</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013266838" rel="noopener nofollow">CVE-2009-2412: Apache httpd: APR apr_palloc heap overflow</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013277478" rel="noopener nofollow">CVE-2009-1955: Apache httpd: APR-util XML DoS</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013170617" rel="noopener nofollow">CVE-2008-0456: Apache HTTPD: CRLF injection in mod_negotiation</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296738" rel="noopener nofollow">CVE-2007-6750 httpd: Apache Slowloris denial of service</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013295138" rel="noopener nofollow">CVE-2007-3999: krb5 RPC library buffer overflow</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296278" rel="noopener nofollow">CVE-2007-2243: OpenSSH S/KEY Authentication Enumeration</a><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013198457" rel="noopener nofollow">CVE-1999-0505: Microsoft Windows SMB Guest Account User Access</a><br><br>Some scanning engines may report additional CVEs the Unitrends appliance is not vulnerable to due to the nature of upstream vs backfilled patches by RedHat/CentOS. Checking the following additional KBs to see if a reported CVE may be a false positive:<br><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199317" rel="noopener nofollow">Security: Common false positive scan results</a><br><br><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013296458" rel="noopener nofollow">Security: False Positives from Qualsys scan engine</a></p> <h2 data-id="cause"><strong>CAUSE</strong></h2> <p>Some security software often uses the upstream project package version number to determine a package’s vulnerabilities, but this does not take into account patches backported by Red Hat to CentOS, which only increments the patch level after the dash.<br><br>Unitrends installs systems with Red Hat EL/CentOS5.7 or EL/CentOS6.5 as the Linux OS distribution. Red Hat will continue to provide long-term support for packages contained in the distribution as defined in the lifecycle link below. Unitrends will continue to supply regular security updates which will include updated packages from Red Hat as they become available throughout the lifecycle of the distribution. <br><br>A variant of this is that some security software references upstream project package versions saying that an older released version will no longer be supported by the project. This should be considered a false positive. This statement means that the upstream project will stop automatically backporting new fixes into that version for Linux distributions. The Linux distributions (including Red Hat) do their own security updates and fixes for package versions that have been distributed. The Red Hat policy on support is described in the links below. <br><br>Red Hat support lifecycle <a href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Faccess.redhat.com%2Fsupport%2Fpolicy%2Fupdates%2Ferrata" rel="noopener nofollow">https://access.redhat.com/support/policy/updates/errata</a> <br>RH Backporting Policy <a href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Faccess.redhat.com%2Fsecurity%2Fupdates%2Fbackporting" rel="noopener nofollow">https://access.redhat.com/security/updates/backporting</a><br>Security Audit Tool OVAL Compatibility <a href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Faccess.redhat.com%2Farticles%2F221883%2F" rel="noopener nofollow">https://access.redhat.com/articles/221883/</a><br><br>Unitrends provides long-term support for all software delivered on our systems for customers covered under an active Unitrends support agreement. When Unitrends determines that functional or security issues require an update, Unitrends will supply an updated software package. This includes providing updated CentOS packages, updated Unitrends software packages, or other custom software packages used by Unitrends. When Unitrends determines that an update is required for a custom software package, Unitrends will compos directly through Unitrends operated code repositories. Unitrends may as necessary also backport a source fix from upstream Linux versions to that software package. Unitrends is the vendor and supplier of packages for your system, not Redhat or other 3rd parties and the Unitrends system should be documented as a vendor managed appliance for purposes of compliance reporting and updating requirements. </p> <h2 data-id="notes"><strong>NOTES</strong></h2> <p>The first line of security is to change your root password from the default, otherwise no amount of security updates will prevent attackers. Appliances using default published passwords will not be offered support until the password is changed. <br>Unitrends appliance support is negated if a Unitrends Appliance is exposed to a publicly accessible IP/port with the exception of the OpenVPN port on hot copy targets. Unitrends backups appliances should have outgoing communication to the internet only and must never be exposed on a pubic IP through NAT or other means. For Hot Copy targets, only the VPN port may be exposed and traffic should be secured to allow only the source appliance location external IP to connect where possible. If this is found to be violated, Unitrends will not provide support until this is closed/secured and if the appliance is compromised because of this issue, the only support provided will be to assist in re-imaging the appliance. It is a violation of the terms of the Unitrends Support agreement to expose our system to external attack. <br><br><strong><a href="https://kaseya.vanillacommunities.com/kb/articles/aliases/unitrends/hc/en-us/articles/360013199397?q=SELECT+ArticleNumber%2CId%2CSummary%2CResolution__c%2CAttachment__Body__s%2CCause__c%2CNotes__c%2CAttachment__ContentType__s%2CAttachment__Length__s%2CAttachment__Name__s%2CTitle%2CKnowledgeArticleId%2CDescription__c+from+Article__kav+where+PublishStatus%3D%27Online%27" rel="noopener nofollow">How to apply Unitrends security updates</a>. </strong>(note this linked article only applies to system running release 10.3.0 or older. to get the latest security updates, simply update your appliance using the UI or enable helix automatic update). <br><br></p> </article> </main>