Spyware, viruses, & security forum: VULNERABILITIES / FIXES - May 03, 2012

Release Date : 2012-05-03

Criticality level : Less critical
Impact : Security Bypass
Where : From local network
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for samba. This fixes a security issue, which can be exploited by malicious users to bypass certain security restrictions.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2463-1:
http://www.debian.org/security/2012/dsa-2463

http://secunia.com/advisories/49017/

Release Date : 2012-05-03

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Baby Gekko 1.x

Description:
Gjoko Krstic has discovered multiple vulnerabilities in Baby Gekko, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "username", "email_address", "password", "password_verify", "firstname", "lastname", and "verification_code" parameters to users/action/register is not properly sanitised in apps/users/registration.template.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are confirmed in version 1.2.0. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
Gjoko Krstic.

Original Advisory:
ZSL-2012-5086:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5086.php

http://secunia.com/advisories/49052/

PluXml File Inclusion and Cross-Site Scripting Vulnerabilities

Release Date : 2012-05-03

Criticality level : Moderately critical
Impact : Cross Site Scripting
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: PluXml 5.x

Description:
Two vulnerabilities have been reported in PluXml, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose potentially sensitive information.

1) Input passed via the "default_lang" POST parameter to update/index.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources via directory traversal attacks.

2) Certain input related to file update is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions prior to 5.1.6.

Solution:
Update to version 5.1.6.

Provided and/or discovered by:
1) High-Tech Bridge SA
2) The vendor credits gwae

Original Advisory:
PluXml:
http://telechargements.pluxml.org/changelog

High-Tech Bridge SA:
https://www.htbridge.com/advisory/HTB23086

http://secunia.com/advisories/49026/

Release Date : 2012-05-03

Criticality level : Not critical
Impact : DoS
Where : Local system
Solution Status : Unpatched

Operating System: Microsoft Windows XP Professional

Description:
A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the "xxxCreateWindowEx()" function and can be exploited to access an invalid memory location resulting in a system crash.

The vulnerability is confirmed on a fully patched Windows XP SP3 (win32k.sys version 5.1.2600.6189). Other versions may also be affected.

Solution:
Restrict access to trusted users only.

Provided and/or discovered by:
Lufeng Li, Neusoft Corporation

Original Advisory:
http://www.exploit-db.com/exploits/18819/

http://secunia.com/advisories/49021/

Release Date : 2012-05-03

Criticality level : Less critical
Impact : Security Bypass
Exposure of sensitive information
DoS
Where : From remote
Solution Status : Vendor Patch

Software: Drupal 7.x

Description:
A weakness, a security issue, and multiple vulnerabilities have been reported in Drupal, which can be exploited by malicious users to disclose sensitive information, bypass certain security restrictions, and cause a DoS (Denial of Service).

1) A weakness is caused due to inefficient text matching pattern and can be exploited to exhaust memory or cause a high CPU load via specially crafted strings passed to the filter system e.g. when posting comments or forum topics.

2) An error due to the application not properly validating the destination for submitted forms can be exploited to redirect submission of sensitive data (e.g. login credentials) to a malicious website.

3) An error due to the application not properly validating user permissions when displaying the forum overview page can be exploited to expose certain metadata of unpublished forum posts.

4) An error due to the application not properly validating user access to cached derivatives of users' private images can be exploited to gain access to derivatives of otherwise restricted images.

5) An error due to the application not properly validating user access to each node in the list of nodes can be exploited to gain access to otherwise restricted nodes.

Successful exploitation of this vulnerability requires the "view content overview" permission and a contributed node access module.

The vulnerabilities are reported in 7.x versions prior to 7.13.

Solution:
Update to version 7.13.

Provided and/or discovered by:
2) Reported by the vendor.

The vendor credits:
1) Jay Wineinger and Lin Clark
3) Glen W
4) frega, Andreas Gonell, Jeremy Meier, and Xenza
5) Jennifer Hodgdon

Original Advisory:
DRUPAL-SA-CORE-2012-002:
http://drupal.org/node/1557938

http://secunia.com/advisories/49012/

Release Date : 2012-05-03

Criticality level : Moderately critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Decoda 3.x

Description:
RedTeam Pentesting has discovered a vulnerability in Decoda, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via "[video]" tags to the markup parser is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

The vulnerability is confirmed in version 3.3.1. Prior versions may also be affected.

Solution:
Update to version 3.3.2.

Provided and/or discovered by:
RedTeam Pentesting

Original Advisory:
RedTeam Pentesting:
http://www.redteam-pentesting.de/en/advisories/rt-sa-2012-002/-php-decoda-cross-site-scripting-in-video-tags

Decoda:
https://github.com/milesj/php-decoda/commits/master

http://secunia.com/advisories/48931/