Spyware, viruses, & security forum: VULNERABILITIES / FIXES - May 11, 2012

Release Date : 2012-05-11

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Opera 11.x

Description:
A vulnerability has been reported in Opera, which can be exploited by malicious people to compromise a user's system.

An out-of-bounds write error when parsing the URL can be exploited to corrupt memory via a specially crafted URL.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in versions prior to 11.64.

Solution:
Update to version 11.64.

Provided and/or discovered by:
The vendor credits Andrey Stroganov.

Original Advisory:
http://www.opera.com/support/kb/view/1016/

http://secunia.com/advisories/49081/

Release Date : 2012-05-11

Criticality level : Less critical
Impact : Exposure of sensitive information
Privilege escalation
DoS
Where : From local network
Solution Status : Vendor Patch

Operating System: openSUSE 12.1

Description:
SUSE has issued an update for puppet. This fixes two security issues and two vulnerabilities, which can be exploited by malicious, local users to disclose potentially sensitive information and perform certain actions with escalated privileges and by malicious users to cause a DoS (Denial of Service).

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:0608-1:
http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html

http://secunia.com/advisories/49136/

Release Date : 2012-05-11

Criticality level : Highly critical
Impact : Spoofing
Manipulation of data
Security Bypass
Exposure of sensitive information
System access
Where : From remote
Solution Status : Vendor Patch

Operating System: openSUSE 11.4
openSUSE 12.1

Description:
SUSE has issued an update for opera. This fixes two security issues and multiple vulnerabilities, which can be exploited by malicious, local users to disclose potentially sensitive information and manipulate certain data and by malicious people to conduct spoofing attacks, bypass certain security restrictions, and potentially compromise a user's system.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:0610-1:
http://lists.opensuse.org/opensuse-updates/2012-05/msg00014.html

http://secunia.com/advisories/49123/

Release Date : 2012-05-11

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Software: Movicon 11.x

Description:
A vulnerability has been reported in Movicon, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the OPC server, which can be exploited to cause an out-of-bounds read by sending a specially crafted HTTP Post request to TCP port 9090.

The vulnerability is reported in versions prior to 11.3.

Solution:
Update to version 11.3.

Provided and/or discovered by:
ICS-CERT credits Dillon Beresford of IXIA.

Original Advisory:
ICS-CERT:
http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-01.pdf

http://secunia.com/advisories/49092/

Release Date : 2012-05-11

Criticality level : Moderately critical
Impact : Manipulation of data
Where : From remote
Solution Status : Vendor Patch

Software: Galette 0.x

Description:
A vulnerability has been discovered in Galette, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "id_adh" parameter to picture.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is confirmed in version 0.63.3. Other versions may also be affected.

Solution:
Update to version 0.7.0.

Provided and/or discovered by:
Sofian Brabez via a bug report.

Original Advisory:
http://redmine.ulysses.fr/issues/250

http://secunia.com/advisories/49106/

Release Date : 2012-05-11

Criticality level : Less critical
Impact : System access
Where : From local network
Solution Status : Unpatched

Software: QNX Momentics 6.x
QNX Phindows 3.x
QNX Software Development Platform 6.x

Description:
Luigi Auriemma has discovered a vulnerability in QNX Phindows, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in phindows.exe when processing server replies. This can be exploited to cause a stack-based buffer overflow via a specially crafted TCP response packet.

Successful exploitation allows execution of arbitrary code, but requires tricking a user into connecting to a malicious Photon session server.

The vulnerability is confirmed in Phindows version 3.0.44. Other versions may also be affected.

Solution:
Do not connect to untrusted servers.

Provided and/or discovered by:
Luigi Auriemma

Original Advisory:
http://aluigi.altervista.org/adv/qnxph_1-adv.txt

http://secunia.com/advisories/49090/

PHP QUERY_STRING Parameters and Buffer Overflow Vulnerabilities

Release Date: 2012-05-04
Last Update: 2012-05-11

Criticality level : Highly critical
Impact : Exposure of sensitive information
System access
Where : From remote
Solution Status : Vendor Patch

Software: PHP 5.3.x
PHP 5.4.x

Description:
Two vulnerabilities have been reported in PHP, which can be exploited by malicious people to disclose certain sensitive information or compromise a vulnerable system.

1) An error when parsing certain QUERY_STRING parameters can be exploited to e.g. disclose the PHP source code or execute arbitrary code.

This vulnerability is reported in versions 5.3.12 and prior and versions 5.4.2 and prior.

2) An error in the "apache_request_headers()" function can be exploited to cause a buffer overflow.

NOTE: This vulnerability affects version 5.4 only.

Solution:
Update to versions 5.4.3 and 5.3.13.

Provided and/or discovered by:
1) De Eindbazen
2) Reported in PHP bug report.

Original Advisory:
PHP:
https://bugs.php.net/bug.php?id=61910
https://bugs.php.net/bug.php?id=61807
http://www.php.net/archive/2012.php#id2012-05-08-1

De Eindbazen:
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/

US-CERT VU#520827:
http://www.kb.cert.org/vuls/id/520827

http://secunia.com/advisories/49014

If I read http://stackoverflow.com/questions/2474802/is-there-a-recommended-dtls-library?rq=1 correctly, it's a rather bad idea, especially since it's not available.

There are implementations in other languages. So you might be able to run a service written in another language and call that from your Java program. Or use some other wrapper to make it Java-callable.

Kees