Spyware, viruses, & security forum: VULNERABILITIES / FIXES - May 10, 2012

Release Date : 2012-05-09

Criticality level : Highly critical
Impact :System access
Where : From remote
Solution Status : Vendor Patch

Software: Adobe Shockwave Player 11.x

Description:
Multiple vulnerabilities have been reported in Adobe Shockwave Player, which can be exploited by malicious people to compromise a user's system.

1) An error within the IMLLib module when parsing a .dir (Adobe Director) file can be exploited to corrupt memory via a specially crafted file.

2) An error within the DPLib module when parsing a .dir file can be exploited to corrupt memory via a specially crafted file.

3) An error within the IMLLib module when parsing a .dir file can be exploited to corrupt memory via a specially crafted file.

4) Another unspecified error can be exploited to corrupt memory.

5) Another unspecified error can be exploited to corrupt memory.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in versions 11.6.4.634 and prior for Windows and Macintosh.

Solution:
Update to version 11.6.5.635.

Provided and/or discovered by:
1 - 3) Rodrigo Rubira Branco, Qualys Vulnerability & Malware Research Labs.
4, 5) The vendor credits Honggang Ren, Fortinet's FortiGuard Labs.

Original Advisory:
Adobe (APSB12-13):
http://www.adobe.com/support/security/bulletins/apsb12-13.html

Rodrigo Rubira Branco:
https://community.qualys.com/docs/DOC-3513
https://community.qualys.com/docs/DOC-3514
https://community.qualys.com/docs/DOC-3515

http://secunia.com/advisories/49086/

Release Date : 2012-05-09

Criticality level : Highly critical
Impact :System access
Where : From remote
Solution Status : Unpatched

Software: Adobe Illustrator CS5 15.x

Description:
Multiple vulnerabilities have been reported in Adobe Illustrator, which can be exploited by malicious people to compromise a user's system.

1) An unspecified error can be exploited to corrupt memory.

2) Another unspecified error can be exploited to corrupt memory.

3) Another unspecified error can be exploited to corrupt memory.

4) Another unspecified error can be exploited to corrupt memory.

5) An integer overflow error in JPEGFormat.aip when calculating the size of a buffer to allocate based on the image dimensions and colour depth can be exploited to cause a heap-based buffer overflow via a specially crafted JPEG image file.

NOTE: This vulnerability is confirmed in CS5 bundling JPEGFormat.aip version 15.0.128.0.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in Adobe Illustrator version CS5.5 and prior for Windows and Macintosh. Other versions may also be affected.

Solution:
Upgrade to Adobe Illustrator CS6.

Provided and/or discovered by:
5) Tielei Wang, Georgia Tech Information Security Center via Secunia

The vendor credits:
1, 4) Felipe Andres Manzano via iSIGHT Partners Global Vulnerability Partnership
2, 3) Justin Kim, Microsoft

Original Advisory:
Adobe (APSB12-10):
http://www.adobe.com/support/security/bulletins/apsb12-10.html

http://secunia.com/advisories/47118/

Release Date : 2012-05-10

Criticality level : Highly critical
Impact : Manipulation of data
DoS
Exposure of sensitive information
System access
Where : From remote
Solution Status : Vendor Patch

Operating System: SUSE Linux Enterprise Server (SLES) 10

Description:
SUSE has issued an update for java-1_5_0-ibm. This fixes multiple vulnerabilities, which can be exploited by malicious people to disclose potentially sensitive information, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
SUSE-SU-2012:0602-1:
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html

http://secunia.com/advisories/49076/

WordPress User Photo Plugin URL Cross-Site Scripting Vulnerability

Release Date : 2012-05-10

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress User Photo Plugin 0.x

Description:
A vulnerability has been discovered in the User Photo plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the URL to wp-admin/options-general.php is not properly sanitised in the "userphoto_options_page()" function in wp-content/plugins/user-photo/user-photo.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 0.9.5.1. Prior versions may also be affected.

Solution:
Update to version 0.9.5.2.

Provided and/or discovered by:
The vendor credits Ryan Hellyer.

Original Advisory:
http://wordpress.org/extend/plugins/user-photo/changelog/

http://secunia.com/advisories/49100/

Drupal Take Control Module Cross-Site Request Forgery Vulnerability

Release Date : 2012-05-10

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Drupal Take Control Module 6.x

Description:
A vulnerability has been reported in the Take Control module for Drupal, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. manipulate certain files within the Drupal file system by tricking an administrative user into visiting a malicious web site.

The vulnerability is reported in 6.x-2.x versions prior to 6.x-2.2.

Solution:
Update to version 6.x-2.2.

Provided and/or discovered by:
The vendor credits Carl Wiedemann.

Original Advisory:
SA-CONTRIB-2012-075:
http://drupal.org/node/1569512

http://secunia.com/advisories/49060/

DecisionTools SharpGrid ActiveX Control Code Execution Vulnerability

Release Date : 2012-05-09

Criticality level : Highly critical
Impact :System access
Where : From remote
Solution Status : Unpatched

Software: Data Dynamics SharpGrid ActiveX Control 2.x
DecisionTools 5.x

Description:
Francis Provencher has discovered a vulnerability in DecisionTools, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the "Images" property in the SharpGrid ActiveX control insecurely using the assigned value as an image list pointer and can be exploited to call a virtual function within an arbitrary memory location.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 5.7 (sg20u.ocx version 2.1.1.1127). Other versions may also be affected.

Solution:
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by:
Francis Provencher, Protek Research Lab's via Secunia.

http://secunia.com/advisories/48571/

Release Date : 2012-05-10

Criticality level : Less critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for libjakarta-poi-java. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a missing validation check of the "length" attribute in an UnhandledDataStructure() constructor (src/org/apache/poi/hwpf/model/UnhandledDataStructure.java) before allocating a buffer. This can be exploited to allocate an arbitrary amount of memory and cause an OutofMemoryError or potentially cause the JVM (Java Virtual Machine) to become unstable via a specially crafted CDF (Channel Definition Format) or CFBF (Compound File Binary Format) document.

Solution:
Apply updated packages via the apt-get package manager.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
DSA-2468-1:
http://www.debian.org/security/2012/dsa-2468

Red Hat Bug #799078:
https://bugzilla.redhat.com/show_bug.cgi?id=799078

http://secunia.com/advisories/49040/

Cisco Unified MeetingPlace Directory Enumeration and Cross-Site Scripting Vulnerabilities

Release Date : 2012-05-09

Criticality level : Less critical
Impact : Cross Site Scripting
Exposure of system information
Where : From remote
Solution Status : Vendor Patch

Software: Cisco Unified MeetingPlace 6.x

Description:
A weakness and two vulnerabilities have been reported in Cisco Unified MeetingPlace, which can be exploited by malicious people to enumerate folders on an affected system and conduct cross-site scripting attacks.

1) The weakness is caused due to an unspecified error and can be exploited to enumerate existing folders via directory traversal sequences.

2) Certain input is not properly sanitised on the Account Page before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Certain input is not properly sanitised in MP Web before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The weakness and vulnerabilities are reported in versions prior to 6.1.1.4 (MR1).

Solution:
Update to version 6.1.1.4 (MR1).

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://www.cisco.com/en/US/docs/voice_ip_comm/meetingplace/6_1/release_notes/mp61_rn.pdf

http://secunia.com/advisories/49102/

Release Date : 2012-05-09

Criticality level : Less critical
Impact : Security Bypass
Where : From local network
Solution Status : Vendor Patch

Operating System: AIX 5.x
AIX 6.x
AIX 7.x

Description:
IBM has acknowledged a vulnerability in AIX, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is reported in versions 5.3, 6.1, and 7.1.

Solution:
Apply interim fix or APAR.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
IBM (IV13751, IV13820, IV13827, IV14209, IV14210, IV14211):
http://aix.software.ibm.com/aix/efixes/security/rpc_advisory.asc

http://secunia.com/advisories/49056/