Spyware, viruses, & security forum: VULNERABILITIES / FIXES - April 30, 2012

IBM OS/400 HTTP Server mod_proxy Reverse Proxy Mode Security Bypass Weakness

Release Date : 2012-04-30

Criticality level : Less critical
Impact : Security Bypass
Where : From remote
Solution Status : Vendor Patch

Operating System: IBM OS/400 6.x

Description:
IBM has acknowledged a weakness in OS/400, which can be exploited by malicious people to bypass certain security restrictions.

The weakness is reported in versions V6R1M0.

Solution:
Apply APAR SE51505 or install PTF SI46401.

Original Advisory:
IBM (SE51505, SI46401):
http://www.ibm.com/support/docview.wss?uid=nas2394373277328c954862579cd003c709c
http://www.ibm.com/support/docview.wss?uid=nas39578294f523b4b8c862579dd00751bce

http://secunia.com/advisories/49028/

Release Date : 2012-04-30

Criticality level : Moderately critical
Impact : System access
DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for imagemagick. This fixes multiple vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2462-1:
http://www.debian.org/security/2012/dsa-2462

http://secunia.com/advisories/48974/

Release Date : 2012-04-30

Criticality level : Moderately critical
Impact : Manipulation of data
Where : From remote
Solution Status : Vendor Patch

Software: Axous 1.x

Description:
A vulnerability has been discovered in Axous, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "id" parameter to page.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in version 1.1.0 and confirmed in version 1.01. Prior versions may also be affected.

Solution:
Update to version 1.1.1.

Provided and/or discovered by:
farbodmahini

Original Advisory:
http://www.exploit-db.com/exploits/18793/

http://secunia.com/advisories/48989/

WordPress Zingiri Web Shop Plugin Cross-Site Scripting and Script Insertion Vulnerabilities

Release Date : 2012-04-27
Last Update: 2012-04-30

Criticality level : Moderately critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Zingiri Web Shop Plugin 2.x

Description:
Two vulnerabilities have been discovered in the Zingiri Web Shop plugin for WordPress, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks.

1) Input passed via the "page" parameter to index.php is not properly sanitised before being returned to the user in plugins/zingiri-web-shop/zing.inc.php. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed via the "notes" POST parameter to index.php (when "page" is set to "checkout") is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

The vulnerabilities are confirmed in version 2.4.0. Other versions may also be affected.

Solution:
Update to version 2.4.2.

Provided and/or discovered by:
Mehmet Ince

Original Advisory:
Mehmet Ince:
http://www.exploit-db.com/exploits/18787/

Zingiri:
http://wordpress.org/extend/plugins/zingiri-web-shop/changelog/

http://secunia.com/advisories/48991

Uiga Personal Portal Multiple Cross-Site Scripting and SQL Injection Vulnerabilities

Release Date : 2010-03-01
Last Update: 2012-04-30

Criticality level : Moderately critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Uiga Personal Portal

Description:
Multiple vulnerabilities have been discovered in Uiga Personal Portal, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.

1) Input passed via the "id" parameter to index.php (when "view" is set to "photos") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "exhort" parameter to index.php (when "view" is set to "ar_det") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3) Input passed via the URL to cart.php, includes/photoview.php, and index2.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

4) Input passed via the "p" parameter to index2.php (when "c" is set to "1") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are confirmed in the version downloaded on April 27th 2010. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
1) Easy Laster
2) 41.w4r10r
3) Eyup CELIK
4) farbodmahini, Secure-Land Security Team

Original Advisory:
Easy Laster:
http://www.exploit-db.com/exploits/11599/

Eyup CELIK:
http://www.exploit-db.com/exploits/18002/

farbodmahini:
http://packetstormsecurity.org/files/112288/uigapersonalportalindex2-sql.txt

http://secunia.com/advisories/38757

Release Date : 2012-01-31
Last Update: 2012-04-30

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: SilverStripe 2.x

Description:
Multiple vulnerabilities have been reported in SilverStripe, which can be exploited by malicious users to conduct script insertion attacks.

1) Input passed via the "Title" parameter to admin/EditForm when creating a page is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being unpublished, deleted, or republished.

Successful exploitation requires "Content Authors" privileges.

This vulnerability is confirmed in version 2.4.6. Prior versions may also be affected.

2) Certain input when inserting data into templates is not properly sanitised in the "getHTML()" function in core/control/SilverStripeNavigatorItem.php before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

This vulnerability is reported in versions prior to 2.4.7.

Solution:
Update to version 2.4.7.

Provided and/or discovered by:
1) Karthik R.
2) Reported by the vendor.

Original Advisory:
http://packetstormsecurity.org/files/109210/silverstripecmspage-xss.txt

SilverStripe:
http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.7

http://secunia.com/advisories/47812