Spyware, viruses, & security forum: VULNERABILITIES / FIXES - May 15, 2012

TagLib MP4 File Parsing Division By Zero Denial of Service Vulnerability

Release Date : 2012-05-15

Criticality level : Less critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Software: TagLib 1.x

Description:
A vulnerability has been reported in TagLib, which can be exploited by malicious people to cause a DoS (Denial of Service) of the application using the library.

The vulnerability is caused due to a division by zero error within the parsing of MP4 files can be exploited to cause a crash.

The vulnerability is reported in versions prior to 1.7.2.

Solution:
Update to version 1.7.2.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://mail.kde.org/pipermail/taglib-devel/2012-April/002244.html

http://secunia.com/advisories/49159/

Release Date : 2012-05-15

Criticality level : Highly critical
Impact : Unknown
System access
Where : From remote
Solution Status : Vendor Patch

Operating System: openSUSE 12.1

Description:
SUSE has issued an update for chromium and v8. This fixes multiple vulnerabilities, where some have an unknown impact and others can be exploited by malicious people to compromise a user's system.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:0613-1:
https://hermes.opensuse.org/messages/14565591

http://secunia.com/advisories/49175/

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Privilege escalation
DoS
Where : From local network
Solution Status : Vendor Patch

Operating System: openSUSE 11.4
openSUSE 12.1

Description:
SUSE has issued an update for mysql-cluster. This fixes multiple vulnerabilities, which can be exploited by malicious users to gain escalated privileges and cause a DoS (Denial of Service).

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:0617-1:
https://hermes.opensuse.org/messages/14566470

http://secunia.com/advisories/49179/

WordPress 2 Click Social Media Buttons Two Cross-Site Scripting Vulnerabilities

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress 2 Click Social Media Buttons Plugin 0.x

Description:
Two vulnerabilities have been discovered in the 2 Click Social Media Buttons plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "pinterest-url" parameter in wp-content/plugins/2-click-socialmedia-buttons/libs/pinterest.php (when "pinterest-description" is set) and "xing-url" in wp-content/plugins/2-click-socialmedia-buttons/libs/xing.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are confirmed in version 0.32.2. Other versions may also be affected.

Solution:
Update to version 0.35.

Provided and/or discovered by:
Heine Pedersen and Torben Jensen

Original Advisory:
http://packetstormsecurity.org/files/112711/WordPress-2-Click-Social-Media-Buttons-0.32.2-Cross-Site-Scripting.html

http://secunia.com/advisories/49181/

WordPress CodeStyling Localization Plugin "name" Cross-Site Scripting Vulnerability

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: WordPress CodeStyling Localization 1.x

Description:
A vulnerability has been discovered in the CodeStyling Localization plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "name" parameter to wp-admin/admin-ajax.php is not properly sanitised in wp-content/plugins/codestyling-localization/codestyling-localization.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 1.99.17. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
Heine Pedersen and Torben Jensen.

Original Advisory:
http://packetstormsecurity.org/files/112709/WordPress-CodeStyling-Localization-1.99.16-Cross-Site-Scripting.html

http://secunia.com/advisories/49037/

Release Date : 2012-05-15

Criticality level : Moderately critical
Impact : Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: eLearning Server

Description:
A vulnerability has been reported in eLearning Server, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "nid" parameter to news.php4 is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Solution:
Filter malicious characters and character sequences using a proxy.

Provided and/or discovered by:
Eugene Salov and Andrey Komarov.

Original Advisory:
www.exploit-db.com/exploits/18858/

http://secunia.com/advisories/49126/

Adobe Photoshop CS5 Collada File Processing Buffer Overflow Vulnerability

Release Date : 2012-05-15

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: Adobe Photoshop CS5 12.x

Description:
Andrea Micalizzi has discovered a vulnerability in Adobe Photoshop CS5, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in the U3D.8BI plug-in when processing certain Collada file elements. This can be exploited to cause a stack-based buffer overflow via a specially crafted DAE file.

Successful exploitation allows execution of arbitrary code, but requires tricking a user into opening a malicious file.

The vulnerability is confirmed in version CS5 12.1 (20110328.r.145). Other versions may also be affected.

Solution:
Upgrade to Adobe Photoshop CS6.

Provided and/or discovered by:
Andrea Micalizzi (rgod)

Original Advisory:
http://retrogod.altervista.org/9sg_photoshock_adv.htm

http://secunia.com/advisories/49160/

eZ Publish eZ Style Editor Extension Content Removal Security Bypass Vulnerability

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Security Bypass
Where : From remote
Solution Status : Vendor Patch

Software: eZ Publish eZ Style Editor Extension 1.x

Description:
A vulnerability has been reported in the eZ Style Editor extension for eZ Publish, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error related to removing an image and can be exploited to remove an arbitrary object by using a valid node ID.

The vulnerability is reported in versions 1.0, 1.1, 1.2, 1.3, and 1.4.

Solution:
Apply update.

Provided and/or discovered by:
The vendor credits Yann Michard, Oppida.

Original Advisory:
http://share.ez.no/community-project/security-advisories/ezsa-2012-004-content-removal-access-check-issue-in-ezstyleeditor-extension

http://secunia.com/advisories/47229/

eZ Publish ezoption Datatype Cross-Site Scripting Vulnerability

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: eZ Publish 4.x

Description:
A vulnerability has been reported in eZ Publish, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the ezoption datatype is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions 4.0, 4.1 4.2, 4.3, 4.4, 4.5, and 4.6.

Solution:
Apply update.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://share.ez.no/community-project/security-advisories/ezsa-2011-02-cross-site-scripting-xss-issue-in-the-ezoption-datatype

http://secunia.com/advisories/49044/

eZ Publish eZ Star Rating Extension Attribute ID Cross-Site Scripting Vulnerability

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: eZ Publish 4.x

Description:
A vulnerability has been reported in eZ Publish, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the ID of an attribute to the eZ Star Rating extension is not properly sanitised within the ezsrServerFunctions::rate() function before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in eZ Star Rating versions 1.0, 1.1, 1.2, and 1.3.

Solution:
Apply update.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
eZ Publish:
http://share.ez.no/community-project/security-advisories/ezsa-2011-03-cross-site-scripting-xss-issue-in-the-ezstarrating-extension

http://secunia.com/advisories/49083/

WordPress WP Forum Server "groupid" Cross-Site Scripting Vulnerability

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: WordPress WP Forum Server Plugin 1.x

Description:
A vulnerability has been discovered in the WP Forum Server plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "groupid" parameter in wp-admin/admin.php (when "page" is set to "forum-server/fs-admin/fs-admin.php", "vasthtml_action" is set to "structure", and "do" is set to "addforum") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 1.7.4. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
Heine Pedersen and Torben Jensen

Original Advisory:
http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html

http://secunia.com/advisories/49167/

WordPress Media Library Categories Plugin "q" Cross-Site Scripting Vulnerability

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Media Library Categories 1.x (plugin for WordPress)

Description:
A vulnerability has been discovered in the Media Library Categories plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "q" parameter in wp-admin/upload.php (when "page" is set to "media-library-categories/view.php") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 1.1.1. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
Heine Pedersen and Torben Jensen

Original Advisory:
http://packetstormsecurity.org/files/112697/WordPress-Media-Categories-1.1.1-Cross-Site-Scripting.html

http://secunia.com/advisories/49170/

WordPress Newsletter Manager Plugin Cross-Site Scripting and Request Forgery Vulnerabilities

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: WordPress Newsletter Manager Plugin 1.x

Description:
Two vulnerabilities have been discovered in the Newsletter Manager plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks.

1) Input passed via the "id" parameter to wp-admin/admin.php (when "page" is set to "newsletter-manager-emailcampaigns") is not properly sanitised in wp-content/plugins/newsletter-manager/admin/test_mail.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. change an email address and conduct script insertion attacks by tricking a logged in administrator into visiting a malicious web site.

The vulnerabilities are confirmed in version 1.0.2. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised. Do not browse untrusted websites or follow untrusted links while logged in to the application.

Provided and/or discovered by:
Heine Pedersen and Torben Jensen.

Original Advisory:
http://packetstormsecurity.org/files/112694/WordPress-Newsletter-Manager-1.0-Cross-Site-Scripting.html

http://secunia.com/advisories/49152/

WordPress Newsletter Manager Plugin "xyz_em_campName" Cross-Site Scripting Vulnerability

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Newsletter Manager Plugin 1.x

Description:
A vulnerability has been discovered in the Newsletter Manager plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "xyz_em_campName" parameter to wp-admin/admin.php (when "page" is set to "newsletter-manager-emailcampaigns" or "newsletter-manager-createcampaign") is not properly sanitised in wp-content/plugins/newsletter-manager/admin/edit_campaign.php and wp-content/plugins/newsletter-manager/admin/create_campaign.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are confirmed in version 1.0. Other versions may also be affected.

Solution:
Update to version 1.0.2.

Provided and/or discovered by:
Heine Pedersen and Torben Jensen.

Original Advisory:
http://packetstormsecurity.org/files/112694/WordPress-Newsletter-Manager-1.0-Cross-Site-Scripting.html

http://secunia.com/advisories/49183/

WordPress Mingle Forum Plugin Multiple Cross-Site Scripting Vulnerabilities

Release Date : 2012-05-15

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Mingle Forum Plugin 1.x

Description:
Multiple vulnerabilities have been discovered in the Mingle Forum plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

1) Input passed to the "groupid" parameter in wp-admin/admin.php (when "page" is set to "mfstructure", "mingeforum_action" is set to "structure", and "do" is set to "editgroup") and "usergroup_id" parameter in wp-admin/admin.php (when "page" is set to "mfgroups", "mingeforum_action" is set to "usergroups", and "do" is set to "edit_usergroup") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed to the "forumid" parameter in wp-admin/admin.php (when "page" is set to "mfstructure", "mingeforum_action" is set to "structure", and "do" is set to "editforum") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are confirmed in version 1.0.33. Other versions may also be affected.

Solution:
Update to version 1.0.33.2.

Provided and/or discovered by:
1) Heine Pedersen and Torben Jensen
2) Reported by the vendor

Original Advisory:
Mingle Forum:
http://wordpress.org/extend/plugins/mingle-forum/changelog/

Heine Pedersen and Torben Jensen:
http://packetstormsecurity.org/files/112696/WordPress-Mingle-Forum-1.0.33-Cross-Site-Scripting.html

http://secunia.com/advisories/49171/