Spyware, viruses, & security forum: VULNERABILITIES / FIXES - March 26, 2012

Release Date : 2012-03-26

Criticality level : Highly critical
Impact : System access
DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for gnutls26. This fixes a vulnera:ility, which can be exploited by malicious people to potentially compromise an application using the library.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2441-1:
http://www.debian.org/security/2012/dsa-2441

http://secunia.com/advisories/48511/

FreePBX Cross-Site Scripting and Command Injection Vulnerabilities

Release Date : 2012-03-26

Criticality level : Moderately critical
Impact : Cross Site Scripting
System access
Where : From remote
Solution Status : Vendor Workaround

Software: FreePBX 2.x

Description:
Two vulnerabilities have been reported in FreePBX, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct cross-site scripting attacks.

1) Input passed to the "login" parameter in recordings/index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed to the "callmenum" parameter in recordings/misc/callme_page.php (when "action" is set to "c") is not properly verified before being used. This can be exploited to inject and execute arbitrary shell commands.

The vulnerabilities are reported in version 2.10.0. Other versions may also be affected.

Solution:
Fixed in the SVN repository.

Provided and/or discovered by:
Martin Tschirsich

Original Advisory:
FreePBX:
http://www.freepbx.org/trac/ticket/5711

Martin Tschirsich:
http://archives.neohapsis.com/archives/fulldisclosure/2012-03/0234.html

http://secunia.com/advisories/48463/

Release Date : 2012-03-26

Criticality level : Highly critical
Impact : System access
DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: SUSE Linux Enterprise Server (SLES) 10

Description:
SUSE has issued an update for php5. This fixes multiple vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory
SUSE-SU-2012:0411-1::
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html

http://secunia.com/advisories/48567/

Release Date : 2012-03-26

Criticality level : Moderately critical
Impact : Unknown
Where : From remote
Solution Status : Vendor Patch

Software: NetFront Life Browser for Android 2.x

Description:
AppSec has reported a vulnerability with an unknown impact in NetFront Life Browser for Android.

The vulnerability is caused due to an unspecified error. Currently there is no further information available.

The vulnerability is reported in version 2.3.0. Prior versions may also be affected.

Solution:
Update to version 2.3.1.

Provided and/or discovered by:
Daoyuan Wu, Xiapu Luo and Rocky K. C. Chang, Department of Computing, The Hong Kong Polytechnic University

Original Advisory:
http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1485-vulnerability-in-NetFrontLifeBrowser.html

http://secunia.com/advisories/48557/

Release Date : 2012-03-26

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: phpFox 2.x
phpFox 3.x

Description:
A vulnerability has been reported in phpFox, which can be exploited by malicious people to compromise a vulnerable system.

Input passed via the "phpfox[call]" or "core[call]" POST parameter to static/ajax.php is not properly verified in the "Phpfox_Module::getComponent()" function within include/library/phpfox/module/module.class.php before being used in an "eval()" call. This can be exploited to inject and execute certain shell commands.

The vulnerability is reported in 2.x versions prior to 2.1.0 (build 3) and 3.x versions prior to 3.0.1 (build 3).

Solution:
Update to version 2.1.0 (build 3) or 3.0.1 (build 3).

Provided and/or discovered by:
Egidio Romano aka EgiX.

Original Advisory:
phpFox:
http://www.phpfox.com/blog/v2-1-0-build-3-v3-0-1-build-3-released/

Egidio Romano:
http://www.exploit-db.com/exploits/18655/

http://secunia.com/advisories/48550/

Hitachi IT Operations Analyzer Unspecified Cross-Site Scripting Vulnerability

Release Date : 2012-03-26

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Hitachi IT Operations Analyzer

Description:
A vulnerability has been reported in Hitachi IT Operations Analyzer, which can be exploited by malicious people to conduct cross-site scripting attacks.

The vulnerability is reported in versions 02-01, 02-51 through 02-51-01, 02-53 through 02-53-02, and 03-01.

Solution:
Filter malicious characters and character sequences using a proxy.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Hitachi (English):
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-010/index.html

Hitachi (Japanese):
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-010/index.html

http://secunia.com/advisories/48556/

WordPress CMS Tree Page View Plugin "cms_tpv_view" Cross-Site Scripting Vulnerability

Release Date : 2012-03-26

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress CMS Tree Page View Plugin 0.x

Description:
High-Tech Bridge SA has discovered a vulnerability in the CMS Tree Page View plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "cms_tpv_view" parameter in e.g. wp-admin/edit.php (when "post_type" is set to "page" and "page" is set to "cms-tpv-page-page") is not properly sanitised within the "cms_tpv_admin_head()" function in wp-content/plugins/cms-tree-page-view/functions.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 0.8.8. Prior versions may also be affected.

Solution:
Update to version 0.8.9.

Provided and/or discovered by:
High-Tech Bridge SA

Original Advisory:
CMS Tree Page View:
http://wordpress.org/extend/plugins/cms-tree-page-view/changelog/
http://plugins.trac.wordpress.org/changeset/523576/cms-tree-page-view#file52

HTB23083:
https://www.htbridge.com/advisory/HTB23083

http://secunia.com/advisories/48510/

vBulletin vbActivity Module "reason" Script Insertion Vulnerabilities

Release Date : 2012-03-26

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: vBActivity (module for vBulletin) 3.x

Description:
Two vulnerabilities have been reported in the vbActivity module for vBulletin, which can be exploited by malicious users to conduct script insertion attacks.

Input passed via the "reason" parameter to dbtech/vbactivity/actions/nominatemedal.php and to dbtech/vbactivity/actions/requestmedal.php is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

The vulnerabilities are reported in vbActivity Pro versions prior to 3.0.1.

Solution:
Update to version 3.0.1.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://www.dragonbyte-tech.com/f4/vbactivity-vbshout-forumon-rpg-vbdownloads-vbquiz-updates-security-releases-6876/

http://secunia.com/advisories/48490/

vBulletin Forumon RPG Module "monster[title]" Script Insertion Vulnerability

Release Date : 2012-03-26

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Forumon RPG (module for vBulletin) 1.x

Description:
A vulnerability has been reported in the Forumon RPG module for vBulletin, which can be exploited by malicious users to conduct script insertion attacks.

Input passed via the "monster[title]" parameter when creating a new monster not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

The vulnerability is reported in versions prior to 1.0.8.

Solution:
Update to version 1.0.8.

Provided and/or discovered by:
Reported by the vendor.

http://secunia.com/advisories/48514/

vBulletin vBDownloads Module "mirrors[]" Script Insertion Vulnerability

Release Date : 2012-03-26

Criticality level : Less critical
Impact : Unknown
Where : From remote
Solution Status : Vendor Patch

Software: vBDownloads (module for vBulletin) 1.x

Description:
A vulnerability has been reported in vBDownloads module for vBulletin, which can be exploited by malicious users to conduct script insertion attacks.

Input passed via the "mirrors[]" parameter to dbtech/downloads/actions/editdownload.php is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

Solution:
Update to the latest version.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://www.dragonbyte-tech.com/f4/vbactivity-vbshout-forumon-rpg-vbdownloads-vbquiz-updates-security-releases-6876/

http://secunia.com/advisories/48522/