Spyware, viruses, & security forum: VULNERABILITIES / FIXES - April 09, 2012

Release Date : 2012-04-09

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: FFmpeg 0.x

Description:
Multiple vulnerabilities have been reported in FFmpeg, which can be exploited by malicious people to compromise an application using the library.

1) A format string error exists within the "srt_to_ass()" function (libavcodec/srtdec.c) when parsing certain parameters.

2) An integer overflow error exists within the "dirac_unpack_block_motion_data()" function (libavcodec/diracdec.c) when handling certain motion data.

3) An integer overflow error exists within the "sws_init_context()" function (libswscale/utils.c) when decoding certain scale data.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in versions prior to 0.10.1.

Solution:
Update to version 0.10.1 or later.

Provided and/or discovered by:
1) Reported by the vendor.
2, 3) The vendor credits Mateusz "j00ru" Jurczyk and Gynvael Coldwind.

Original Advisory:
http://ffmpeg.org/index.html#pr0101

http://secunia.com/advisories/48770/

Release Date : 2012-04-09

Criticality level : Less critical
Impact : Spoofing
Where : From remote
Solution Status : Unpatched

Software: Apache Hadoop 0.20.x

Description:
A vulnerability has been reported in Apache Hadoop, which can be exploited by malicious users to impersonate other users.

Solution:
Upgrade to version 1.0.2.

http://secunia.com/advisories/48775/

Release Date : 2012-04-09

Criticality level : Moderately critical
Impact : Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: idev-GameSite 1.x

Description:
the_storm has discovered a vulnerability in idev-GameSite, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "id" parameter to index.php (when "page" is set to "pages") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is disabled.

The vulnerability is confirmed in version 1.0. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
the_storm, Vulnerability Research Laboratory

Original Advisory:
http://www.vulnerability-lab.com/get_content.php?id=494

http://secunia.com/advisories/48725/

Release Date : 2012-04-09

Criticality level : Moderately critical
Impact : Exposure of system information
Exposure of sensitive information
System access
Where : From remote
Solution Status : Unpatched

Software: OpenCart 1.x

Description:
Janek Vind has discovered two vulnerabilities in OpenCart, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to disclose sensitive information.

1) Input passed via the "route" parameter to index.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.

2) The admin/controller/catalog/download.php script does not properly validate uploaded files, which can be exploited to execute arbitrary PHP code by uploading a PHP file with e.g. an appended ".jpg" file extension.

Successful exploitation requires catalog/download access permissions.

The vulnerabilities are confirmed in version 1.5.2.1. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly verified. Restrict access to the download folder (e.g. via .htaccess).

Provided and/or discovered by:
Janek Vind "waraxe"

Original Advisory:
http://www.waraxe.us/advisory-84.html

http://secunia.com/advisories/48762/

KVM qemu-kvm "ext4_fill_flex_info()" Denial of Service Vulnerability

Release Date : 2012-04-09

Criticality level : Not critical
Impact : DoS
Where : Local system
Solution Status : Vendor Workaround

Software: KVM (Kernel-based Virtual Machine)

Description:
A vulnerability has been reported in KVM qemu-kvm, which can be exploited by malicious, local users in a guest virtual machine to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the "ext4_fill_flex_info()" function in fs/ext4/super.c when mounting a file system and can be exploited to cause a division by zero.

Solution:
Fixed in the GIT repository.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://git.kernel.org/?p=virt/kvm/kvm.git;a=commit;h=d50f2ab6f050311dbf7b8f5501b25f0bf64a439b

http://secunia.com/advisories/48645/

osCMax "customers_group_name" Script Insertion and SQL Injection Vulnerabilities

Release Date : 2012-04-09

Criticality level : Less critical
Impact : Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: osCMax 2.x

Description:
Two vulnerabilities have been discovered in osCMax, which can be exploited by malicious users to conduct script insertion and SQL injection attacks.

1) Input passed via the "customers_group_name" parameter to admin/customers_groups.php (when "action" is set "update" and "page" and "cID" are set to valid values) is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

2) Input passed via the "customers_group_name" parameter to admin/customers_groups.php (when "action" is set "update" and "page" and "cID" are set to valid values) is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is disabled.

Successful exploitation of the vulnerabilities requires access rights to edit customer groups.

The vulnerabilities are confirmed in version 2.5.1. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
1) Vulnerability Research Laboratory
2) Adora Belle Dearheart

Original Advisory:
http://www.vulnerability-lab.com/get_content.php?id=497

http://secunia.com/advisories/48731/