Spyware, viruses, & security forum: VULNERABILITIES / FIXES - April 06, 2012

Release Date : 2012-04-06

Criticality level : Highly critical
Impact : Unknown
Security Bypass
System access
Where : From remote
Solution Status : Vendor Patch

Software: Google Chrome 18.x

Description:
Multiple vulnerabilities have been reported in Google Chrome where some have unknown impacts while others can be exploited by malicious people to bypass certain security restrictions and compromise a user's system.

1) Two unspecified errors in Flash Player can be exploited to corrupt memory in the Chrome interface.

2) An out-of-bounds read error exists when handling Skia clipping.

3) An error exists within the cross-origin policy when handling iframe replacement.

4) A use-after-free error exists when handling run-ins.

5) A use-after-free error exists when handling line boxes.

6) A use-after-free error exits when handling v8 bindings.

7) A use-after-free error exits when handling HTMLMediaElement.

8) An error exists within the cross-origin policy when parenting pop-up windows.

9) A use-after-free error exists when handling SVG resources.

10) A use-after-free error exists when handling media content.

11) A use-after-free error exists when applying style commands.

12) A use-after-free error exists when handling focus events.

13) A read-after-free error exists within script bindings.

The vulnerabilities are reported in versions prior to 18.0.1025.151.

Solution:
Update to version 18.0.1025.151.

Provided and/or discovered by:
The vendor credits:
2, 4, 5, 11, 12) miaubiz
3, 8) Sergey Glazunov
6) SkyLined, Google Chrome Security Team
7) pa_kt via ZDI
9) Arthur Gerkis
10) Slawomir Blazek
13) Inferno, Google Chrome Security Team

Original Advisory:
http://googlechromereleases.blogspot.com/2012/04/stable-and-beta-channel-updates.html

http://secunia.com/advisories/48732/

Release Date : 2012-04-06

Criticality level : Highly critical
Impact : System access
DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Ubuntu Linux 10.04
Ubuntu Linux 10.10
Ubuntu Linux 11.04
Ubuntu Linux 11.10
Ubuntu Linux 8.04

Description:
Ubuntu has issued an update for gnutls26. This fixes two vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

Solution:
Apply updated packages.

Original Advisory:
USN-1418-1:
http://www.ubuntu.com/usn/usn-1418-1

http://secunia.com/advisories/48712/

Siemens Scalance X Switches HTTP Request Handling Denial of Service

Release Date : 2012-04-06

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System: Siemens Scalance X-300 Series Switches
Siemens Scalance X-400 Series Switches

Description:
A vulnerability has been reported in Siemens Scalance X Switches, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the embedded web server when handling HTTP requests. This can be exploited to cause the device to reboot via a specially crafted request sent to the administrative web interface.

The following models are affected:
* Scalance X414-3E
* Scalance X308-2M
* Scalance X-300EEC
* Scalance XR-300
* Scalance X-300

Solution:
Update to firmware version 3.7.1 for Scalance X414-3E and version 3.7.2 for all other affected Scalance X switches.

Provided and/or discovered by:
The vendor credits Jurgen Bilberger, Daimler TSS GmbH.

Original Advisory:
Siemens SSA-130874:
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-130874.pdf

http://secunia.com/advisories/48730/

Release Date : 2012-04-06

Criticality level : Moderately critical
Impact : Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: GENU

Description:
A vulnerability has been discovered in GENU, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "article_id" parameter to articles/read.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is confirmed in version 2012.3. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
hordcode security

Original Advisory:
http://www.exploit-db.com/exploits/18708/

http://secunia.com/advisories/48701/

Release Date : 2012-04-06

Criticality level : Not critical
Impact : Security Bypass
Where : Local system
Solution Status : Vendor Workaround

Software: slock 0.x

Description:
A weakness has been reported in slock, which can be exploited by malicious people with physical access to bypass certain security restrictions.

The weakness is caused due to an error when handling a "XRaiseWindow()" event on a locked screen. This can be exploited to view the current active window and potentially gain access to sensitive information.

Solution:
Fixed in the Mercurial repository.

Provided and/or discovered by:
Longpoke in a Gentoo bug.

Original Advisory:
https://bugs.gentoo.org/show_bug.cgi?id=401645

http://secunia.com/advisories/48700/

Release Date : 2012-04-06

Criticality level : Less critical
Impact : Dos
Where : From local network
Solution Status : Unpatched

Operating System: Sony BRAVIA TV CX Series

Description:
A vulnerability has been reported in Sony BRAVIA TV, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error when handling datagrams and can be exploited to cause a device to stop responding and eventually shut down via a flooding attack.

The vulnerability is reported in KDL-32CX525. Other versions may also be affected.

Solution:
No fix is currently available.

Provided and/or discovered by:
Gabriel Menezes Nunes

Original Advisory:
Gabriel Menezes Nunes:
http://archives.neohapsis.com/archives/bugtraq/2012-04/0043.html

http://secunia.com/advisories/48705/

Joomla! VirtueMart Component "virtuemart_userinfo_id" SQL Injection Vulnerability

Release Date : 2012-04-06

Criticality level : Less critical
Impact : Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: VirtueMart 2.x (component for Joomla!)

Description:
A vulnerability has been discovered in the VirtueMart component for Joomla!, which can be exploited by malicious users to conduct SQL injection attacks.

Input passed via the "virtuemart_userinfo_id" POST parameter to index.php/virtue-mart-edit-address (when "option" is set to "com_virtuemart") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability has been confirmed in version 2.0.2. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
renangbarreto

Original Advisory:
http://forum.virtuemart.net/index.php?topic=99999.0

http://secunia.com/advisories/48713/

Release Date : 2012-04-06

Criticality level : Moderately critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: vBulletin 4.x

Description:
Two vulnerabilities have been reported in vBulletin, which can be exploited by malicious people to conduct script insertion attacks.

Certain unspecified input is not properly sanitised in clientscript/ckeplugins/bbcode/plugin.js and clientscript/ckeditor/ckeditor.js before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

The vulnerabilities are reported in versions 4.1.4 through 4.1.11.

Solution:
Install patch. Please see vendor's advisory for more information.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
https://www.vbulletin.com/forum/showthread.php/398716-vBulletin-Security-Patch-for-vBulletin-4-1-4-4-1-11-for-Suite-amp-Forum-03-23-2012

http://secunia.com/advisories/48541/

Quest Connection Broker Client ActiveX Control "SaveMiniLaunchFile()" Insecure Method

Release Date : 2012-04-06

Criticality level : Less critical
Impact : Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: Quest Connection Broker Client ActiveX Control (pnllmcli.dll) 7.x
Quest vWorkspace 7.x

Description:
Andrea Micalizzi has discovered a vulnerability in Quest Connection Broker Client ActiveX Control, which can be exploited by malicious people to manipulate certain data.

The vulnerability is caused due to the insecure "SaveMiniLaunchFile()" method allowing arbitrary paths to be supplied as the "pFileName" argument. This can be exploited to create or overwrite arbitrary files on a user's system.

The vulnerability is confirmed in version 7.5.304.547 bundled with Quest vWorkspace 7.5. Other versions may also be affected.

Solution:
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by:
Andrea Micalizzi (rgod)

Original Advisory:
http://retrogod.altervista.org/9sg_quest_vworkspace_poc.htm

http://secunia.com/advisories/48674/

Arbor Peakflow SP Login Interface Cross-Site Scripting Vulnerability

Release Date : 2012-04-06

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Operating System: Arbor Peakflow SP

Description:
b.saleh has reported a vulnerability in Arbor Peakflow SP, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input appended to the URL after index/ in the login interface is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions prior to SP 5.6, SP 5.5p5, and SP 5.1.1p5.

Solution:
Update to version SP 5.6, SP 5.5p5, or SP 5.1.1p5.

Provided and/or discovered by:
b.saleh

Original Advisory:
http://archives.neohapsis.com/archives/bugtraq/2012-04/0019.html
http://archives.neohapsis.com/archives/bugtraq/2012-04/0036.html
http://archives.neohapsis.com/archives/bugtraq/2012-04/0037.html

http://secunia.com/advisories/48728/