Spyware, viruses, & security forum: VULNERABILITIES / FIXES - March 23, 2012

Release Date : 2012-03-23

Criticality level : Highly critical
Impact : System access
DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Ubuntu Linux 10.04
Ubuntu Linux 10.10
Ubuntu Linux 11.04
Ubuntu Linux 11.10
Ubuntu Linux 8.04

Description:
Ubuntu has issued an update for freetype. This fixes multiple vulnerabilities, which can be exploited by malicious people to potentially compromise an application using the library.

Solution:
Apply updated packages.

Original Advisory:
USN-1403-1:
http://www.ubuntu.com/usn/usn-1403-1

http://secunia.com/advisories/48508/

Release Date : 2012-03-23

Criticality level : Less critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for raptor. This fixes a vulnerability, which can be exploited by malicious people to disclose potentially sensitive information.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2438-1:
http://www.us.debian.org/security/2012/dsa-2438

http://secunia.com/advisories/48493/

Apache Wicket Cross-Site Scripting and File Disclosure Vulnerabilities

Release Date : 2012-03-23

Criticality level : Less critical
Impact : Cross Site Scripting
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: Apache Wicket 1.x

Description:
Two vulnerabilities have been reported in Apache Wicket, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose certain sensitive information.

1) Input passed via the "wicket:pageMapName" parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

NOTE: This vulnerability only affects versions 1.4.x.

2) Certain unspecified input is not properly verified before being used to read files. This can be exploited to e.g. display certain hidden files from the webroot via directory traversal sequences.

NOTE: This vulnerability affects versions 1.4.x and 1.5.x.

Solution:
Update to version 1.4.20 or 1.5.5.

Provided and/or discovered by:
The vendor credits:
1) Jens Schenck and Stefan Schmidt
2) Sebastian van Erk

Original Advisory:
http://wicket.apache.org/2012/03/22/wicket-cve-2012-0047.html
http://wicket.apache.org/2012/03/22/wicket-cve-2012-1089.html

http://secunia.com/advisories/48499/

Cisco Linksys PlayerPT ActiveX Control "SetSource()" Buffer Overflow

Release Date : 2012-03-23

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: Cisco-Linksys PlayerPT ActiveX Control (PlayerPT.ocx) 1.x

Description:
rgod has discovered a vulnerability in Cisco Linksys PlayerPT ActiveX Control, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when handling the "SetSource()" method and can be exploited to cause a stack-based buffer overflow via an overly long "base64string" argument.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 1.0.0.15. Other versions may also be affected.

Solution:
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by:
rgod

Original Advisory:
http://retrogod.altervista.org/9sg_linksys_playerpt.htm

http://secunia.com/advisories/48543/

Release Date : 2012-03-23

Criticality level : Moderately critical
Impact : Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: SWTOR CharDB 1.x

Description:
Some vulnerabilities have been discovered in SWTOR CharDB, which can be exploited by malicious people to conduct script insertion and SQL injection attacks.

1) Input passed via the "userun" POST parameter to user/registration.php is not properly sanitised before being used. This can be exploited to insert HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

2) Input passed via the "swtorun" POST parameter to user/login_check.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3) Input passed via the "userun" POST parameter to user/registration.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of the vulnerabilities #2 and #3 requires that "magic_quotes_gpc" is disabled.

The vulnerabilities are confirmed in version 1.8b. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
1, 2) Stefan Schurtz
3) John "Mossy" Lawn

Original Advisory:
SSCHADV2012-009:
http://www.darksecurity.de/index.php?/207-SSCHADV2012-009-Star-Wars-Old-Republic-SWTOR-Char-DB-1.8b-Multiple-security-vulnerabilities.html

http://secunia.com/advisories/48518/

vBulletin vBShout Module "shout" Script Insertion Vulnerability

Release Date : 2012-03-23

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: vBShout (module for vBulletin)

Description:
A vulnerability has been reported in the vBShout module for vBulletin, which can be exploited by malicious users to conduct script insertion attacks.

Input passed via the "shout" parameter to vbshout.php (when "do" is set to "shout") is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
ToiL.

http://secunia.com/advisories/48525/

Release Date : 2012-03-23

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for libpng. This fixes a vulnerability, which can potentially be exploited by malicious people to compromise an application using the library.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2439-1:
http://www.debian.org/security/2012/dsa-2439

http://secunia.com/advisories/48320/

PHP Grade Book "SaveSQL" Database Backup Authentication Bypass Vulnerability

Release Date : 2012-03-23

Criticality level : Moderately critical
Impact : Security Bypass
Where : From remote
Solution Status : Vendor Patch

Software: PHP Grade Book 1.x

Description:
A vulnerability has been discovered in PHP Grade Book, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to the application allowing database backup requests via the "SaveSQL" action without checking credentials. This can be exploited to download the database backup and disclose sensitive information.

The vulnerability is confirmed in version 1.9.1. Prior versions may also be affected.

Solution:
Update to version 1.9.1a.

Provided and/or discovered by:
Mark Stanislav

Original Advisory:
http://www.exploit-db.com/exploits/18647/

http://secunia.com/advisories/48524/

Janetter Information Disclosure and Cross-Site Request Forgery Vulnerabilities

Release Date : 2012-03-23

Criticality level : Less critical
Impact : Cross Site Scripting
Exposure of sensitive information
Where : From remote
Solution Status :Vendor Patch

Software: Janetter 3.x

Description:
Two vulnerabilities have been reported in Janetter, which can be exploited by malicious people to conduct cross-site request forgery attacks and disclose certain sensitive information.

1) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. post tweets and upload images to twitter by tricking a logged in user into visiting a malicious web site.

2) An unspecified error can be exploited to disclose session information by tricking the user by tricking a logged in user into visiting a malicious web site.

The vulnerabilities are reported in versions prior to 3.3.0.0.

Solution:
Update to version 3.3.0.0.

Provided and/or discovered by:
JVN credits Kazuhiko Kusano, Graduate School of Information Sciences, Tohoku University.

Original Advisory:
JVN:
http://jvn.jp/en/jp/JVN83459967/index.html
http://jvn.jp/en/jp/JVN10745573/index.html

Janetter:
http://blog.janetter.net/post/19158054673/janetter-v3-3-0-0-release

http://secunia.com/advisories/48480/