Spyware, viruses, & security forum: VULNERABILITIES / FIXES - April 27, 2012

Quest Toad for Data Analysts Insecure Default Directory Permissions

Release Date : 2012-04-27

Criticality level : Moderately critical
Impact : Privilege escalation
Where : Local system
Solution Status : Unpatched

Software: Quest Toad for Data Analysts 3.x

Description:
Secunia Research has discovered a security issue in Quest Toad for Data Analysts, which can be exploited by malicious, local users to gain escalated privileges.

The problem is that insecure default permissions ("Everyone" group granted "Full Control") are set on the "%CommonProgramFiles%\Quest Shared" directory and some of its child objects. This can be exploited to remove, manipulate, and replace application files.

The security issue is confirmed in version 3.0.1 bundled with Quest Toad Development Suite for Oracle version 11.0R2. Other versions may also be affected.

Solution:
Set proper permissions to prevent unprivileged users from creating or manipulating files in the directory.

Provided and/or discovered by:
Secunia Research

Original Advisory:
Secunia Research:
http://secunia.com/secunia_research/2012-13/

http://secunia.com/advisories/48663/

Release Date : 2012-04-27

Criticality level : Less critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Ubuntu Linux 10.04
Ubuntu Linux 11.04

Description:
Ubuntu has issued an update for jetty. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).

Solution:
Apply updated packages.

Original Advisory:
USN-1429-1:
http://www.ubuntu.com/usn/usn-1429-1

http://secunia.com/advisories/48981/

Release Date : 2012-04-27

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for spip. This fixes some vulnerabilities, which can be exploited by malicious people to conduct cross-site scripting attacks.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2461-1:
http://www.debian.org/security/2012/dsa-2461

http://secunia.com/advisories/48975/

Release Date : 2012-04-27

Criticality level : Highly critical
Impact : Privilege escalation
DoS
System access
Where : From remote
Solution Status : Partial Fix

Operating System: VMware ESX Server 4.x

Description:
VMware has acknowledged some vulnerabilities in VMware ESX Server, which can be exploited by malicious, local users in a guest virtual machine to gain escalated privileges and by malicious people to cause a DoS (Denial of Service) and potentially compromise the vulnerable system.

The vulnerabilities are reported in versions 4.1 and 4.0.

Solution:
Apply patches.

Original Advisory:
VMSA-2012-0008:
http://www.vmware.com/security/advisories/VMSA-2012-0008.html

http://secunia.com/advisories/48959/

Release Date : 2012-04-27

Criticality level : Less critical
Impact : Exposure of sensitive information
Where : From local network
Solution Status : Vendor Patch

Software: TwonkyServer 7.x

Description:
r@b13$ has reported a vulnerability in TwonkyServer, which can be exploited by malicious people to disclose potentially sensitive information.

An input validation error within the web server component can be exploited to disclose arbitrary files via directory traversal attacks.

The vulnerability is reported in versions prior to 7.0.6.

Solution:
Update to version 7.0.6.

Provided and/or discovered by:
r@b13$, Digital Defense, Inc. Vulnerability Research Team

Original Advisory:
http://archives.neohapsis.com/archives/bugtraq/2012-04/0208.html

http://secunia.com/advisories/49015/

HP LaserJet Printers / Digital Senders Unauthorized Firmware Update Security Issue

Release Date: 2011-12-01
Last Update: 2012-04-27

Criticality level: Moderately critical
Impact : Security Bypass
Where: From local network
Solution Status: Partial Fix

Operating System: HP 9200C Digital Sender
HP 9250 Digital Sender
HP CM8000 Color MFP Series
HP Color LaserJet 2800 All-in-One Printer Series
HP Color LaserJet 3000 Series
HP Color LaserJet 3800 Series
HP Color LaserJet 4700 Series
HP Color LaserJet 4730 Series
HP Color LaserJet 5550 Series
HP Color LaserJet 9500 Series
HP Color LaserJet CM1312 Multifunction Printer Series
HP Color LaserJet CM2320 Multifunction Printer series
HP Color LaserJet CM3530 Series
HP Color LaserJet CM4730 Multifunction Printer Series
HP Color LaserJet CM6030/CM6040 MFP Series
HP Color LaserJet CP1210 Printer series
HP Color LaserJet CP1510 Printer Series
HP Color LaserJet CP2025 Printer series
HP Color LaserJet CP3505 Series
HP Color LaserJet CP3525 Series
HP Color LaserJet CP4005 Series
HP Color LaserJet CP4025 / CP 4525 Series
HP Color Laserjet CP5525 Series
HP Color LaserJet CP6015
HP Color LaserJet Enterprise CM4540 Series
HP Color LaserJet Enterprise CP4520 Printer series
HP Color LaserJet Enterprise CP4525
HP Color LaserJet P4014 / P4015 / P4515 Series
HP Color LaserJet Professional CP5225 Printer series
HP LaserJet 2400 Printer Series
HP LaserJet 4240 / 4250 / 4340 Series
HP LaserJet 4345 Series
HP LaserJet 4350 Series
HP LaserJet 5200 Series
HP LaserJet 9040/9050 Series
HP LaserJet Enterprise 500 color M551 Series
HP LaserJet Enterprise 600 Series
HP LaserJet Enterprise M4555 MFP Series
HP LaserJet Enterprise P3015 Series
HP LaserJet M1120 Multifunction Printer Series
HP LaserJet M1319 Multifunction Printer Series
HP LaserJet M2727 Multifunction Printer series
HP LaserJet M3027/3035 MFP
HP LaserJet M3035 MFP Series
HP LaserJet M4345 Multifunction Printer series
HP LaserJet M5025/5035 MFP
HP LaserJet M5035 MFP Series
HP LaserJet M9040/M9050 Multifunction Printer series
HP LaserJet P1500 Printer series
HP LaserJet P2035 Printer series
HP LaserJet P2055 Printer series
HP LaserJet P3005 Series
HP LaserJet P4515
HP Laserjet Printer 5200 Series
HP LaserJet Pro 100 Color M175 Multifunction Printer series
HP LaserJet Pro CM1415 Color Multifunction Printer series
HP LaserJet Pro CP1025 Color Printer Series
HP LaserJet Pro CP1525 Color Printer series
HP LaserJet Pro M1136 Multifunction Printer series
HP LaserJet Pro M1212nf Multifunction Printer series
HP LaserJet Pro M1536 Multifunction Printer series
HP LaserJet Pro P1102 Printer Series
HP LaserJet Pro P1606dn Printer

Description:
A security issue has been reported in various HP LaserJet Printers and HP Digital Senders, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to an error within the Remote Firmware Update (RFU) mechanism, which does not check for authentication when handling firmware updates. This can be exploited to upload a malicious firmware to device via a specially crafted request to TCP port 9100.

Please see the vendor's advisory for the list of affected products.

Solution:
Apply firmware update. Please see the vendor's advisory for details. As a workaround disable the "Printer Firmware Update" setting.

Provided and/or discovered by:
Salvatore Stolfo and Ang Cui, Columbia University.

Original Advisory:
HPSBPI02728 SSRT100692:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03102449

http://secunia.com/advisories/47063

Release Date: 2012-04-18
Last Update: 2012-04-27

Criticality level : Moderately critical
Impact : Security Bypass
Manipulation of data
Brute force
Exposure of sensitive information
System access
Where : From remote
Solution Status : Vendor Patch

Software: Oracle Database 10.x
Oracle Database 11.x

Description:
Multiple vulnerabilities have been reported in Oracle Database, which can be exploited by malicious users to compromise a vulnerable system, by malicious users and malicious people to disclose potentially sensitive information and manipulate certain data, and by malicious people to conduct brute force attacks and bypass certain security restrictions.

1) An error in the Oracle Spatial component can be exploited by authenticated users to execute arbitrary code.

Successful exploitation of this vulnerability requires Create session, create index, alter index, and create table privileges.

2) An error in the Core RDBMS component can be exploited by authenticated users to execute arbitrary code.

Successful exploitation of this vulnerability requires create library and create procedure privileges.

3) An error within the OCIPasswordChange API can be exploited to e.g. change the password of locked accounts via brute force attacks.

4) An error within the OCIPasswordChange API when handling locked accounts can be exploited to e.g. guess account passwords via brute force attacks.

Note: Additionally, incorrect log-in attempts are not always correctly logged.

5) Some errors exist within Enterprise Manager Grid Control.

6) An error in the Application Express component can be exploited to manipulate certain data.

7) An error within the RDBMS Core component can be exploited by authenticated users to manipulate certain data.

Successful exploitation of this vulnerability requires Create Session privileges.

The vulnerabilities are reported in the following products and versions:
* Oracle Database 11g Release 2 versions 11.2.0.2 and 11.2.0.3
* Oracle Database 11g Release 1 version 11.1.0.7
* Oracle Database 10g Release 2 versions 10.2.0.3, 10.2.0.4, and 10.2.0.5

Solution:
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by:
3, 4) Esteban Martinez Fayo, Application Security Inc.

It is currently unclear who reported the remaining vulnerabilities as the Oracle Critical Patch Update for April 2012 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixDB

Team SHATTER:
https://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-incomplete-protection-of-oracle-database-locked-accounts/
https://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-ocipasswordchange-leaks-information-pwdhash/
https://www.teamshatter.com/topics/general/team-shatter-exclusive/advisory-failed-authentication-using-ocipassword-not-recorded/

http://secunia.com/advisories/48855/

Release Date : 2012-04-27

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: DiY-CMS 1.x

Description:
snup has discovered a vulnerability in DiY-CMS, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. delete forum categories if a logged-in administrative user visits a malicious web site.

The vulnerability is confirmed in version 1.0. Other versions may also be affected.

Solution:
Do not browse untrusted sites or follow untrusted links while being logged-in to the application.

Provided and/or discovered by:
snup via Vulnerability Research Laboratory.

Original Advisory:
http://www.vulnerability-lab.com/get_content.php?id=518

http://secunia.com/advisories/49011/