Spyware, viruses, & security forum: VULNERABILITIES / FIXES - May 01, 2012

Remote-Anything Player Movie Processing Code Execution Vulnerability

Release Date : 2012-05-01

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: Remote-Anything 5.x

Description:
A vulnerability has been discovered in Remote-Anything, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error within the Player utility when viewing a movie file and can be exploited to cause a buffer overflow via a specially crafted ".flm" file.

Successful exploitation allows execution of arbitrary code, but requires tricking a user into opening a malicious movie file.

The vulnerability is confirmed in version 5.60.15. Other versions may also be affected.

Solution:
Do not open files from untrusted sources.

Provided and/or discovered by:
Saint Patrick

http://secunia.com/advisories/49008/

Release Date : 2012-05-01

Criticality level : Moderately critical
Impact : Security Bypass
Cross Site Scripting
Manipulation of data
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: ManageEngine SupportCenter Plus 7.x

Description:
Multiple vulnerabilities have been reported in ManageEngine SupportCenter Plus, which can be exploited by malicious users to disclose potentially sensitive information, bypass certain security restrictions, and conduct script insertion and SQL injection attacks and by malicious people to conduct script insertion attacks.

1) Input passed via the "countSql" POST parameter to servlet/AJaxServlet (when "action" is set to "getWorkOrderCount") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "userName", "description", and "emailID" POST parameters to sd/Request.sd when submitting a ticket is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

3) Input passed via the "fullName", "twitterId", and "jobTitle" parameters to RequesterDef.do when editing a contact is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

4) Input passed via the "description" POST parameter to WorkOrder.do when creating a request is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

5) Input passed to the "backup_ids" parameter in BackupSchedule.do (when "module" is set to "delete_backup") is not properly verified before being used. This can be exploited to delete backup files.

6) The application allows database backup requests via BackupSchedule.do without checking credentials. This can be exploited to create a backup in a publicly accessible folder and disclose sensitive information.

The vulnerabilities are reported in version 7.9 build 7903. Other versions may also be affected.

Solution:
Update to version 7.9 build 7905.

Provided and/or discovered by:
Robert van Hamburg

Original Advisory:
ManageEngine:
https://supportcenter.wiki.zoho.com/ReadMe-V2.html#7905

Robert van Hamburg:
http://www.exploit-db.com/exploits/18745/

http://secunia.com/advisories/48839/

Release Date : 2012-05-01

Criticality level : Highly critical
Impact : Security Bypass
Cross Site Scripting
Spoofing
Exposure of system information
Exposure of sensitive information
DoS
System access
Where : From remote
Solution Status : Unpatched

Software: Pale Moon 11.x

Description:
Multiple vulnerabilities have been reported in Pale Moon, which can be exploited by malicious people to conduct cross-site scripting and spoofing attacks, disclose certain system and sensitive information, bypass certain security restrictions, and compromise a user's system.

Solution:
Upgrade to version 12.0.

Original Advisory:
http://www.palemoon.org/releasenotes-ng.shtml

http://secunia.com/advisories/48995/

Release Date : 2012-05-01

Criticality level : Highly critical
Impact : Security Bypass
Cross Site Scripting
Manipulation of data
Exposure of system information
Exposure of sensitive information
Privilege escalation
DoS
System access
Where : From remote
Solution Status : Unpatched

Software: HP Systems Insight Manager 6.x

Description:
A weakness, a security issue, and multiple vulnerabilities have been reported in HP Systems Insight Manager, which can be exploited by malicious, local users to potentially gain escalated privileges and by malicious people to disclose sensitive information, conduct cross-site scripting and cross-site request forgery attacks, bypass certain security restrictions, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system.

1) The application bundles vulnerable versions of OpenSSL, Apache Tomcat, Java, Adobe Flash Player, Adobe LiveCycle, Adobe BlazeDS, and Adobe Flex.

2) An unspecified error can be exploited to gain unauthorized access. No further information is currently available.

3) Unspecified errors can potentially be exploited to gain escalated privileges. No further information is currently available.

4) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain unspecified actions by tricking a logged in administrator into visiting a malicious web site.

5) Certain unspecified input is not properly verified before being used to redirect users. No further information is currently available.

The vulnerabilities are reported in versions prior to 7.0.

Solution:
Upgrade to version 7.0.

Provided and/or discovered by:
2-5) Reported by the vendor.

Original Advisory:
HPSBMU02769 SSRT100846:
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c0329815

http://secunia.com/advisories/49035/

Release Date : 2012-05-01

Criticality level : Less critical
Ipact : Security Bypass
Where : From local network
Solution Status : Vendor Patch

Operating System: Ubuntu Linux 10.04
Ubuntu Linux 11.04
Ubuntu Linux 11.10
Ubuntu Linux 12.04

Description:
Ubuntu has issued an update for samba. This fixes a security issue, which can be exploited by malicious users to bypass certain security restrictions.

Solution:
Apply updated packages.

Original Advisory:
USN-1434-1:
https://lists.ubuntu.com/archives/ubuntu-security-announce/2012-May/001673.html

http://secunia.com/advisories/48984/

Release Date : 2012-05-01

Criticality level : Less critical
Ipact : Security Bypass
Where : From local network
Solution Status : Vendor Patch

Operating System: SUSE Linux Enterprise Server (SLES) 11

Description:
SUSE has issued an update for samba. This fixes a security issue, which can be exploited by malicious users to bypass certain security restrictions.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
SUSE-SU-2012:0573-1:
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00023.html

SUSE-SU-2012:0575-1:
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00024.html

http://secunia.com/advisories/49030/

Release Date : 2012-05-01

Criticality level : Moderately critical
Ipact : Security Bypass
Where : From local network
Solution Status : Vendor Patch

Software: Red Hat Enterprise MRG v2 for Red Hat Enterprise Linux (version 5)
Red Hat Enterprise MRG v2 for Red Hat Enterprise Linux (version 6)

Description:
Red Hat has issued an update for Red Hat Enterprise MRG. This fixes a security issue, which can be exploited by malicious people to bypass certain security restrictions.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2012:0528-1:
https://rhn.redhat.com/errata/RHSA-2012-0528.html

RHSA-2012:0529-1:
https://rhn.redhat.com/errata/RHSA-2012-0529.html

http://secunia.com/advisories/49001/

Release Date: 2012-04-12
Last Update : 2012-05-01

Criticality level : Moderately critical
Impact : Unknown
Where : From remote
Solution Status : Vendor Patch

Software: CGIProxy 2.x

Description:
Some vulnerabilities with unknown impacts have been reported in CGIProxy.

The vulnerabilities are caused due to unspecified errors. No further information is currently available.

NOTE: The vendor disputes these vulnerabilities and states that the fixes are not security-related.

The vulnerabilities are reported in versions prior to 2.1.2.

Solution:
Update to version 2.1.2.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://www.jmarshall.com/tools/cgiproxy/CHANGES.txt

http://secunia.com/advisories/48768