Spyware, viruses, & security forum: VULNERABILITIES / FIXES - March 30, 2012

Release Date : 2012-03-30

Criticality level : Less critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Operating System: openSUSE 12.1

Description:
SUSE has issued an update for libreoffice. This fixes a vulnerability, which can be exploited by malicious people to disclose potentially sensitive information.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:0428-1:
https://hermes.opensuse.org/messages/14108305

http://secunia.com/advisories/48649/

Release Date : 2012-03-30

Criticality level : Moderately critical
Impact : Unknown
Where : From remote
Solution Status : Vendor Patch

Software: iRODS 3.x

Description:
Multiple vulnerabilities with unknown impacts have been reported in iRODS.

The vulnerabilities are caused due to unspecified errors. No further information is currently available.

The vulnerabilities are reported in versions prior to 3.1.

Solution:
Update to version 3.1.

Provided and/or discovered by:
The vendor credits Barton Miller, James Kupsch, and Henry Abbey from the University of Wisconsin-Madison.

Original Advisory:
https://www.irods.org/index.php/Release_Notes_3.1

http://secunia.com/advisories/48600/

Release Date : 2012-03-30

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: libpng 1.x

Description:
A vulnerability has been reported in libpng, which can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to an error within the "png_set_text_2()" function (pngset.c) when parsing certain text chunks and can be exploited to corrupt heap memory via a specially crafted PNG file.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in versions prior to 1.5.10, 1.4.11, 1.2.49, and 1.0.59.

Solution:
Update to version 1.5.10, 1.4.11, 1.2.49, or 1.0.59.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://www.libpng.org/pub/png/src/libpng-1.5.10-README.txt

http://secunia.com/advisories/48587/

Release Date : 2012-03-30

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: JAMWiki 1.x

Description:
Sooraj K.S has discovered a vulnerability in JAMWiki, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "num" parameter to Special:AllPages is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 1.1.5. Prior versions may also be affected.

Solution:
Update to version 1.2.

Provided and/or discovered by:
Sooraj K.S, SecPod Research Team

Original Advisory:
JAMWiki:
http://jamwiki.org/wiki/en/JAMWiki_1.1.6
http://jira.jamwiki.org/browse/JAMWIKI-76

SecPod:
http://secpod.org/blog/?p=493

http://secunia.com/advisories/48638/

Coppermine Photo Gallery "keywords" Script Insertion Vulnerability

Release Date : 2012-03-30

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Coppermine Photo Gallery 1.x

Description:
Janek Vind has discovered a vulnerability in Coppermine Photo Gallery, which can be exploited by malicious users to conduct script insertion attacks.

Input passed via the "keywords" POST parameter to edit_one_pic.php is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

Successful exploitation requires access rights to edit image information.

The vulnerability is confirmed in version 1.5.18. Prior versions may also be affected.

Solution:
Update to version 1.5.20.

Provided and/or discovered by:
Janek Vind

Original Advisory:
Coppermine Photo Gallery:
http://forum.coppermine-gallery.net/index.php/topic,74682.0.html

waraxe-2012-SA#081:
http://www.waraxe.us/advisory-81.html

http://secunia.com/advisories/48643/

VMware ESX Server / ESXi I/O Handling ROM Overwrite Privilege Escalation Vulnerability

Release Date : 2012-03-30

Criticality level : Less critical
Impact : Privilege escalation
Where : Local system
Solution Status : Vendor Patch

Operating System: VMware ESX Server 3.x
VMware ESX Server 4.x
VMware ESXi 3.x
VMware ESXi 4.x

Description:
A vulnerability has been reported in VMware ESX Server and VMware ESXi, which can be exploited by malicious, local users in a guest virtual machine to gain escalated privileges.

The vulnerability is caused due to an error when handling port-based I/O and can be exploited to modify virtual DOS machine Read-Only Memory.

The vulnerability is reported in ESX Server and ESXi versions 4.1, 4.0, and 3.5 running Windows XP 32-bit, Windows Server 2003 32-bit, and Windows Server 2003 R2 32-bit.

Solution:
Apply patches.

Provided and/or discovered by:
The vendor credits Derek Soeder, Ridgeway Internet Security.

Original Advisory:
http://www.vmware.com/security/advisories/VMSA-2012-0006.html

http://secunia.com/advisories/48669/

Red Hat Network Satellite NULL Organization Package Upload Security Bypass Vulnerability

Release Date : 2012-03-30

Criticality level : Moderately critical
Impact : Security Bypass
Where : From remote
Solution Status : Vendor Patch

Software: Red Hat Network Satellite Server 5.x

Description:
A vulnerability has been reported in Red Hat Network Satellite, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to improper authentication and authorisation checks within the spacewalk-backend when handling a NULL organization. This can be exploited to consume disk space of the /var partition and stop the application from downloading updates by uploading arbitrary packages.

Note: The vulnerability affects version 5.4 running on Red Hat Enterprise Linux 6 under mod_wsgi only.

Solution:
Updated packages are available via Red Hat Network.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
RHSA-2012:0436-1:
https://rhn.redhat.com/errata/RHSA-2012-0436.html

http://secunia.com/advisories/48664/

Release Date : 2012-03-30

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: Havalite 1.x

Description:
A vulnerability has been discovered in Havalite, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to the havalite/upload.php script improperly verifying uploaded files. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.

The vulnerability is confirmed in version 1.1.0. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly verified.

Provided and/or discovered by:
KedAns-Dz

Original Advisory:
http://packetstormsecurity.org/files/111358/Havalite-CMS-Shell-Upload-SQL-Injection-Disclosure.html

http://secunia.com/advisories/48646/

Release Date : 2012-03-30

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: phpPgAdmin 5.x

Description:
A vulnerability has been reported in phpPgAdmin, which can be exploited by malicious users to conduct script insertion attacks.

Certain unspecified input related to functions is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

The vulnerability is reported in version 5.0.3. Prior versions may also be affected.

Solution:
Update to version 5.0.4.

Provided and/or discovered by:
The vendor credits Mateusz Goik.

Original Advisory:
phpPgAdmin:
http://sourceforge.net/news/?group_id=37132
https://github.com/phppgadmin/phppgadmin/commit/74174ad639664b52cc1609ede0af8bc403e98a00

Mateusz Goik:
http://sourceforge.net/mailarchive/message.php?msg_id=28783470

http://secunia.com/advisories/48574/

Release Date : 2012-03-30

Criticality level : Not critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Unpatched

Software: PTK 1.x

Description:
Multiple weaknesses have been discovered in PTK, which can be exploited by malicious people to disclose potentially sensitive information.

The weaknesses are caused due to the application not properly restricting access to files within the /log, /images, and /report folders and can be exploited to e.g. disclose valid user names, case evidence files, and generated reports via brute force attacks.

The weaknesses are confirmed in version 1.0.5. Other versions may also be affected.

Solution:
Restrict access to the log, images, and report folders (e.g. via .htaccess).

Provided and/or discovered by:
An anonymous person

Original Advisory:
http://packetstormsecurity.org/files/111360/PTK-1.0.5-Cross-Site-Scripting-Unrestricted-Access.html

http://secunia.com/advisories/48585/

Release Date : 2012-03-30

Criticality level : Highly critical
Impact : System access
Manipulation of data
Where : From remote
Solution Status : Unpatched

Software:
Quest ARDoc ActiveX Control 7.x
Quest InTrust 10.x
Software FX Annotation Objects Extension ActiveX Control (AnnotateX.dll) 1.x

Description:
Andrea Micalizzi has discovered multiple vulnerabilities in Quest InTrust, which can be exploited by malicious people to manipulate certain data and compromise a user's system.

1) An insecure method in the ARDoc ActiveX Control (ARDoc.dll) can be exploited to overwrite arbitrary files with the contents of exported documents via a call to the "SaveToFile()" method with a specially crafted "bstrFileName" argument.

2) An input validation error in the Annotation Objects Extension ActiveX Control (AnnotateX.dll) can be exploited to call an arbitrary memory location via a call to the "Add()" method with a specially crafted "obj" argument.

Successful exploitation of this vulnerability allows execution of arbitrary code.

The vulnerabilities are confirmed in version 10.4.0.853. Other versions may also be affected.

Solution:
Set the kill-bit for the ActiveX controls.

Provided and/or discovered by:
Andrea Micalizzi (rgod)

Original Advisory:
http://retrogod.altervista.org/9sg_quest_ii.htm
http://retrogod.altervista.org/9sg_quest_adv.htm

http://secunia.com/advisories/48566/