Spyware, viruses, & security forum: VULNERABILITIES / FIXES - May 04, 2012

Release Date : 2012-05-04

Criticality level : Moderately critical
Impact : Privilege escalation
DoS
System access
Where : From local network
Solution Status : Vendor Patch

Operating System: VMware ESX Server 3.x
VMware ESX Server 4.x
VMware ESXi 3.x
VMware ESXi 4.x
VMware ESXi 5.x

Description:
Multiple vulnerabilities have been reported in VMware ESX Server and VMware ESXi, which can be exploited by malicious, local users in a guest virtual machine to gain escalated privileges and by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) Errors when handling RPC commands can be exploited to cause a crash and potentially execute arbitrary code.

2) An error when parsing NFS traffic can be exploited to corrupt memory.

3) An error in the virtual floppy device can be exploited to cause an out-of-bounds write.

4) An error in the virtual SCSI device can be exploited to cause an out-of-bounds write.

Successful exploitation may allow execution of arbitrary code.

Please see the vendor's advisory for a list of affected versions.

Solution:
Update to a fixed version (please see the vendor's advisory for details).

Provided and/or discovered by:
1) The vendor credits Derek Soeder.
2-4) Reported by the vendor.

Original Advisory:
VMSA-2012-0009:
http://www.vmware.com/security/advisories/VMSA-2012-0009.html

http://secunia.com/advisories/49019/

Release Date : 2012-05-04

Criticality level : Less critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Ubuntu Linux 11.10
Ubuntu Linux 12.04

Description:
Ubuntu has issued an update for nova. This fixes a vulnerability, which can be exploited by malicious users to cause a DoS (Denial of Service).

Solution:
Apply updated packages.

Original Advisory:
USN-1438-1:
http://www.ubuntu.com/usn/usn-1438-1/

http://secunia.com/advisories/49048/

Release Date : 2012-05-04

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Workaround

Software: PHP 5.3.x
PHP 5.4.x

Description:
De Eindbazen has reported a vulnerability in PHP, which can be exploited by malicious people to disclose certain sensitive information or compromise a vulnerable system.

The vulnerability is caused due to an error when parsing certain QUERY_STRING parameters. This can be exploited to e.g. disclose the PHP source code or execute arbitrary code.

The vulnerability is reported in versions 5.3.12 and prior and versions 5.4.2 and prior.

Solution:
Apply patch or workaround.

Provided and/or discovered by:
De Eindbazen

Original Advisory:
PHP:
https://bugs.php.net/bug.php?id=61910

De Eindbazen:
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/

US-CERT VU#520827:
http://www.kb.cert.org/vuls/id/520827

http://secunia.com/advisories/49014/

Release Date : 2012-05-04

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: FFmpeg 0.x

Description:
Multiple vulnerabilities have been reported in FFmpeg, which can be exploited by malicious people to compromise an application using the library.

The vulnerabilities are reported in versions prior to 0.7.12 and 0.8.11.

Solution:
Update to version 0.7.12 or 0.8.11.

Original Advisory:
http://ffmpeg.org/index.html#pr0811

http://secunia.com/advisories/49022/

myCare2x Cross-Site Scripting and SQL Injection Vulnerabilities

Release Date : 2012-05-04

Criticality level : Moderately critical
Impact : Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: myCare2x

Description:
Multiple vulnerabilities have been reported in myCare2x, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.

1) Input passed via the "lang" parameter to modules/patient/mycare2x_pat_info.php, the "dept_nr" and "pid" parameters to modules/importer/mycare2x_importer.php, and the "pid" and "name_last" parameters to modules/patient/mycare_pid.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "name_last", "name_first", "name_middle", and "name_maiden" parameters to modules/patient/mycare_pid.php, the "favorites" and "lang" parameters to modules/nursing/mycare_ward_print.php, the "aktion" and "callurl" parameters to modules/patient/mycare2x_pat_info.php, and the "ln" parameter to modules/drg/mycare2x_proc_search.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution:
Filter malicious characters and character sequences using a proxy.

Provided and/or discovered by:
Vulnerability Lab.

Original Advisory:
http://www.vulnerability-lab.com/get_content.php?id=524

http://secunia.com/advisories/49029/