Spyware, viruses, & security forum: VULNERABILITIES / FIXES - April 20, 2012

Release Date : 2012-04-20

Criticality level : Highly critical
Impact : Security Bypass
DoS
System access
Where : From remote
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for openssl. This fixes multiple vulnerabilities, which can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), and potentially compromise an application using the library.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2454-1:
http://www.us.debian.org/security/2012/dsa-2454

http://secunia.com/advisories/48895/

IBM Rational ClearQuest ActiveX Control Buffer Overflow Vulnerability

Release Date : 2012-04-20

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: IBM Rational ClearQuest 7.x
IBM Rational ClearQuest 8.x
IBM Rational ClearQuest ActiveX Control 7.x
IBM Rational ClearQuest ActiveX Control 8.x

Description:
A vulnerability has been reported in IBM Rational ClearQuest, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a function prototype mismatch in the "RegisterSchemaRepoFromFileByDbSet()" function in the IBM Rational ClearQuest ActiveX control (cqole.dll). This can be exploited to cause a heap-based buffer overflow by tricking a user into visiting a malicious website.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in versions 7.1.1 through 7.1.2.5, 8.0, and 8.0.0.1.

Solution:
Update to a fixed version.

Provided and/or discovered by:
The vendor credits Andrea Micalizzi via ZDI.

Original Advisory:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21591705

X-Force:
http://xforce.iss.net/xforce/xfdb/73492

http://secunia.com/advisories/48933/

Hitachi JP1/IT Desktop Management Cross-Site Scripting and Denial of Service Vulnerabilities

Release Date : 2012-04-20

Criticality level : Less critical
Impact : Cross Site Scripting
DoS
Where : From remote
Solution Status : Vendor Patch

Software: Hitachi JP1/IT Desktop Management

Description:
Two vulnerabilities have been reported in Hitachi JP1/IT Desktop Management, which can be exploited by malicious people to conduct cross-site scripting attacks and cause a DoS (Denial of Service).

1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) An unspecified error can be exploited to cause a crash. No further information is currently available.

The vulnerabilities are reported in versions 09-50 and 09-50-01.

Solution:
Update to version 09-50-02.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Hitachi (Japanese):
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-011/index.html

http://secunia.com/advisories/48843/

WordPress Zingiri Web Shop Plugin Multiple Unspecified Vulnerabilities

Release Date : 2012-04-20

Criticality level : Moderately critical
Impact : Unknown
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Zingiri Web Shop Plugin 2.x

Description:
Some vulnerabilities with an unknown impact have been reported in the Zingiri Web Shop plugin for WordPress.

The vulnerabilities are caused due to an unspecified error. No further information is currently available.

The vulnerabilities are reported in versions prior to 2.4.0.

Solution:
Update to version 2.4.0.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://wordpress.org/extend/plugins/zingiri-web-shop/changelog/
http://forums.zingiri.com/announcements.php?aid=2

http://secunia.com/advisories/48909/

Release Date : 2012-04-20

Criticality level : Highly critical
Impact : Manipulation of data
Exposure of sensitive information
DoS
System access
Where : From remote
Solution Status : Vendor Patch

Software: IBM Java 6.x

Description:
IBM has acknowledged multiple vulnerabilities in IBM Java, which can be exploited by malicious people to disclose potentially sensitive information, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system.

Solution:
Update to version 6 SR10-FP1.

Original Advisory:
http://www.ibm.com/developerworks/java/jdk/alerts/

http://secunia.com/advisories/48913/

ChatBlazer Enterprise Server Client "user" Cross-Site Scripting Vulnerability

Release Date : 2012-04-20

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: ChatBlazer Enterprise Server 8.x

Description:
Sony has discovered a vulnerability in ChatBlazer Enterprise Server, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "user" parameter to client/client.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 8.5 (Evaluation). Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
Sony

Original Advisory:
Sony:
http://st2tea.blogspot.com/2012/04/chatblazer-flash-chat-cross-site.html

http://secunia.com/advisories/48905/

Shibboleth Identity Provider LDAPS Hostname Verification Security Issue

Release Date : 2012-04-20

Criticality level : Less critical
Impact :Spoofing
Where : From remote
Solution Status : Vendor Patch

Software: Shibboleth 1.x
Shibboleth 2.x

Description:
A security issue has been reported in the Shibboleth Identity Provider, which can be exploited by malicious people to conduct spoofing attacks.

The security issue is caused due to the Identity Provider not verifying the hostname of a LDAP server when using LDAPS and can be exploited to spoof a LDAP server via Man-in-the-Middle (MitM) attacks.

The security issue is reported in Shibboleth Identity Provider versions prior to 2.3.6.

Solution:
Update to Shibboleth Identity Provider version 2.3.6.

Provided and/or discovered by:
The vendor credits Scott Cantor, The Ohio State University.

Original Advisory:
http://shibboleth.internet2.edu/secadv/secadv_20120227.txt

http://secunia.com/advisories/48910/

Release Date : 2012-04-20

Criticality level : Moderately critical
Impact : Security Bypass
Where : From remote
Solution Status : Vendor Patch

Software: ownCloud 3.x

Description:
luks has discovered a vulnerability in ownCloud, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to the core/lostpassword/index.php script generating predictable tokens for password resets and can be exploited to change the passwords of arbitrary users.

The vulnerability is confirmed in version 3.0.1. Prior versions may also be affected.

Solution:
Update to version 3.0.2.

Provided and/or discovered by:
luks

Original Advisory:
luks:
http://seclists.org/fulldisclosure/2012/Apr/223

ownCloud:
http://gitorious.org/owncloud/owncloud/commit/85f9869f6925ef52c1015916bbc28e13c15abc73

http://secunia.com/advisories/48856/

Oracle Enterprise Manager Grid Control Multiple Vulnerabilities

Release Date: 2012-04-18
Last Update : 2012-04-20

Criticality level : Moderately critical
Impact : Hijacking
Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status : Vendor Patch

Software: Oracle Enterprise Manager 10.x
Oracle Enterprise Manager 11.x

Description:
Multiple vulnerabilities have been reported in Oracle Enterprise Manager Grid Control, which can be exploited by malicious users to conduct SQL injection attacks and by malicious people to manipulate certain data, conduct session fixation attacks and HTTP response splitting attacks.

1) An error when handling sessions within the Security Framework subcomponent of the Enterprise Manager Base Platform component can be exploited to hijack a user's session.

2) Input passed via the "fConfigGuid" parameter to /em/console/ecm/config/compareWizard/compareWizFirstConfig is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3) Input passed via the "SCPLBL_INSTALLED_DATE0DI" parameter to /em/console/ecm/search/searchPage is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

4) Input passed via the "prevPage" parameter to /em/console/database/schema/table is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user. This allows arbitrary HTML and script code to be executed in a user's browser session in context of an affected site.

5) Input passed via the "pageName" parameter to /em/console/database/schema/grantObjPrivs is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user. This allows arbitrary HTML and script code to be executed in a user's browser session in context of an affected site.

6) An unspecified error within the Security Framework subcomponent of the Enterprise Manager Base Platform component can be exploited to manipulate certain Base Platform accessible data.

Please see the vendor's advisory for a list of affected versions.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
1-5) Esteban Martinez Fayo, Application Security Inc.
6) It is currently unclear who reported this vulnerability as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixEM

Team SHATTER:
https://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-oem-vulnerable-to-session-fixation/
https://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-sqli-oem-comparewizfirstconfig/
https://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-sql-injection-in-oracle-enterprise-manager-searchpage-web-page/
https://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-http-response-splitting-in-oem-prevpage/
https://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-sql-injection-in-oracle-enterprise-manager-searchpage-web-page-2/

http://secunia.com/advisories/48870

Release Date: 2012-04-18
Last Update : 2012-04-20

Criticality level : Moderately critical
Impact : Spoofing
Cross Site Scripting
System access
Where : From remote
Solution Status : Partial Fix

Software: ownCloud 3.x

Description:
A weakness and multiple vulnerabilities have been discovered in ownCloud, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct spoofing, cross-site scripting, and cross-site request forgery attacks.

1) Input passed via the "redirect_url" parameter to index.php is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.

2) Input passed via the "redirect_url" parameter to index.php and the "files" parameter to files/ajax/download.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. conduct script insertion attacks via editing contacts when a logged-in user visits a specially crafted web page.

4) An error due to the files/ajax/upload.php script not verifying the extension of an uploaded file can be exploited to e.g. upload an .htaccess file, which will allow uploaded PHP files to be executed.

The weakness and vulnerabilities are confirmed in version 3.0.2. Other versions may also be affected.

Solution:
Vulnerability #4 is fixed in the GIT repository. Edit the source code to ensure that input is properly sanitised and verified. Do not browse untrusted sites or follow untrusted links while being logged-in to the application.

Provided and/or discovered by:
1-3) Tobias Glemser, Tele-Consulting.
4) luks

Original Advisory:
ownCloud:
http://gitorious.org/owncloud/owncloud/commit/acdce2b1e01f7c0a77b7e7949540e1b0ba94efd1

Tele-Consulting:
http://www.tele-consulting.com/advisories/TC-SA-2012-01.txt

luks:
http://seclists.org/fulldisclosure/2012/Apr/223

http://secunia.com/advisories/48850