Copssh 4.7.1 has OpenSSL 1.0.1f containing security fixes against vulnerabilities CVE-2013-4353, CVE-2013-6450 and CVE-2013-6449:

CVE-2013-4353A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL pointer exception. A malicious server could use this flaw to crash a connecting client. This issue only affected OpenSSL 1.0.1 versions. Reported by Anton Johansson.CVE-2013-6450A flaw in DTLS handling can cause an application using OpenSSL and DTLS to crash. This is not a vulnerability for OpenSSL prior to 1.0.0. Reported by Dmitry Sobinov.CVE-2013-6449A flaw in OpenSSL can cause an application using OpenSSL to crash when using TLS version 1.2. This issue only affected OpenSSL 1.0.1 versions. Reported by Ron Barber.

In addition, Cygwin and other tools are updated to their latest versions.

Existing customers can download the latest version from their customer pages at www.itefix.net

Distribution packages created by Adolsign 2.4 are cabaple of setting the default signature. You can simply use command line options --newdefault and/or --replydefault to trigger that functionality. It is also possible to specify the name/location of a distribution package by using the new option --packagename. Example:

adolsign --sig corporate --new --reply --user test --packagename c:\packages\test

will create c:\packages\test.exe, which will generate signature corporate and set it as the default signature for new/reply messages for the user test when it is run by the user.

Adolsign 2.4 introduces the option --targetdirectory, allowing you to explicitly specify the location of the signatures directory. Even if Adolsign is capable of doing that job, it may be necessary with a manual override in certain circumstances. One other feature introduced in the new version is to process signatures in the configuration file in the order they are defined.

Existing customers can download the latest version from their customer pages at www.itefix.net.

Nagwin 2.0.1 is a major maintenance release upgrading PHP binaries from 5.3.21 to 5.5.7.

Existing customers can download the latest version from their customer pages at www.itefix.net

Nagwin 2.0.0 is the first Nagwin package containing Nagios Core 4 binaries (4.0.2). As in earlier releases, we had to patch Nagios Core to handle external commands via a plain file based scheme, rather than pipes. In addition, all Nagwin services are now started by a new developed nagwin_service tool, solving some other challenges with the new process structure in Core 4. Nagwin 2.0.0 delivers Pnp4Nagios in bulk mode rather than the standard synchronous one, bringing performance gains for performance collection.

Existing customers can download the latest version from their customer pages at www.itefix.net, and can upgrade their existing installation by simply running the installer even if it is a major upgrade. All services will be registered again. Configuration files etc/nagios/nagios.cfg and etc/nagios/nagwin/commands.cfg will be overwritten for proper operation. However, your old files will still be available with the extension .pre-200.

OpenSSH 6.4 fixes a security bug:

 * sshd(8): fix a memory corruption problem triggered during rekeying
   when an AES-GCM cipher is selected. Full details of the vulnerability
   are available at: http://www.openssh.com/txt/gcmrekey.adv

Existing customers can download latest versions from their customer pages at www.itefix.net

Winrpe version 4.2.0 contains Nrpe 2.15 with full IPv6 support. See release announcement for more information.

$ ./nrpe --version

nrpe: unknown option -- version

NRPE - Nagios Remote Plugin Executor

Copyright (c) 1999-2008 Ethan Galstad (nagios@nagios.org)

Version: 2.15

Last Modified: 09-06-2013

License: GPL v2 with exemptions (-l for more info)

SSL/TLS Available: Anonymous DH Mode, OpenSSL 0.9.6 or higher required

TCP Wrappers Available

***************************************************************

** POSSIBLE SECURITY RISK - COMMAND ARGUMENTS ARE SUPPORTED! **

** Read the NRPE SECURITY file for more information **

***************************************************************

Usage: nrpe [-n] -c <config_file> [-4|-6] <mode>

Options:

-n = Do not use SSL

<config_file> = Name of config file to use

-4 = use ipv4 only

-6 = use ipv6 only

<mode> = One of the following operating modes:

-i = Run as a service under inetd or xinetd

-d = Run as a standalone daemon

-d -s = Run as a subsystem under AIX

Notes:

This program is designed to process requests from the check_nrpe

plugin on the host(s) running Nagios. It can run as a service

under inetd or xinetd (read the docs for info on this), or as a

standalone daemon. Once a request is received from an authorized

host, NRPE will execute the command/plugin (as defined in the

config file) and return the plugin output and return code to the

check_nrpe plugin.

Both 32-bit and 64-bit cwRsync client and server installers are updated with Rsync 3.1.0 which has become a mature solution after more than two years of existence. In addition, installers have the most recent versions of OpenSSH and Cygwin.

Existing customers can download latest versions from their customer pages at www.itefix.net

Both 32-bit and 64-bit Copssh installers are updated with OpenSSH 6.3 and newer versions of Cygwin DLL and tools. OpenSSH 6.3 Change log

Existing customers can download latest versions from their customer pages at www.itefix.net

Winrpe version 4.1.1 contains nrpe with command arguments enabled, giving the ability for clients to supply arguments to commands which should be run. Please note that this feature should be considered a security risk, and you should only use it if you know what you're doing! To enable support for command arguments, you must in addition to set the option dont_blame_nrpe directive in the NRPE config file to 1. The installer has also OpenSSL and Cygwin binaries updated.

Version 1.6.1 is a maintenance release containing the start web page with a proper version information, and the latest Cygwin binaries (1.7.24).

Existing customers can download the latest version from their customer pages at www.itefix.net