Spyware, viruses, & security forum: VULNERABILITIES / FIXES - May 18, 2012

Release Date : 2012-05-18

Criticality level : Less critical
Impact : Privilege escalation
Where : Local system
Solution Status : Vendor Patch

Operating System: OpenVMS 8.x

Description:
A vulnerability has been reported in OpenVMS, which can be exploited by malicious, local users to gain escalated privileges.

An error in OpenVMS ACMELOGIN when SYS$ACM system service for authentication is enabled can be exploited to gain escalated privileges.

The vulnerability is reported in versions Alpha 8.3 and 8.4 and Itanium 8.3, 8.3-1H1, and 8.4.

Solution:
Apply updates.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
HPSBOV02780 SSRT100766:
http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03333494

http://secunia.com/advisories/49228/

Release Date : 2012-05-18

Criticality level : Moderately critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for openssl. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service) of the application using the library.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2475-1:
http://www.debian.org/security/2012/dsa-2475

http://secunia.com/advisories/49208/

IBM Rational Change Unspecified Cross-Site Scripting Vulnerability

Release Date : 2012-05-18

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: IBM Rational Change 5.x

Description:
A vulnerability has been reported in IBM Rational Change, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in version 5.3.0.3 and prior.

Solution:
Update to version 5.3.0.3 Interim Fix 1.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
IBM (PM62061):
http://www.ibm.com/support/docview.wss?uid=swg27021238

http://secunia.com/advisories/49202/

NetGear WNDRMAC Password Recovery Information Disclosure Weakness

Release Date : 2012-05-18

Criticality level : Not critical
Impact : Exposure of sensitive information
Where : From local network
Solution Status : Unpatched

Operating System: NetGear WNDRMAC

Description:
Jason Edelstein has reported a vulnerability in NetGear WNDRMAC, which can be exploited by malicious people to disclose sensitive information.

The weakness is caused due to the device disclosing the questions and answers for the password reset functionality via unauth.cgi within the returned HTML source code and this can be exploited to gain access to administrative credentials.

Successful exploitation requires a previous, successfully completed password recovery.

The weakness is reported in versions 1.0.0.22 and prior.

Solution:
Restrict network access to the device to trusted hosts only.

Provided and/or discovered by:
Jason Edelstein, Sense of Security Labs

Original Advisory:
Sense of Security:
http://www.senseofsecurity.com.au/advisories/SOS-12-005.pdf

http://secunia.com/advisories/49099/

Release Date : 2012-05-18

Criticality level : Moderately critical
Impact : Cross Site Scripting
Manipulation of data
Exposure of sensitive information
System access
Where : From local network
Solution Status : Vendor Patch

Operating System: Symantec Web Gateway 5.x

Description:
Multiple vulnerabilities have been reported in Symantec Web Gateway, which can be exploited by malicious people to disclose potentially sensitive information, conduct cross-site scripting attacks, manipulate certain data, and compromise a vulnerable system.

1) An unspecified error can be exploited to inject arbitrary commands. No further information is currently available.

2) Certain unspecified input is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

3) Certain unspecified input is not properly verified before being used to download or delete arbitrary files. This can be exploited to remove or disclose the contents of arbitrary files.

4) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions prior to 5.0.3.

Solution:
Update to version 5.0.3.

Provided and/or discovered by:
1-3) The vendor credits Tenable Network Security via ZDI and an anonymous person via SecuriTeam Secure Disclosure.
4) The vendor credits Ajay Pal Singh Atwal and an anonymous person.

Original Advisory:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00

http://secunia.com/advisories/49216/

Release Date : 2012-05-18

Criticality level : Highly critical
Impact : Security Bypass
System access
Where : From remote
Solution Status : Vendor Patch

Software: Liferay Portal 6.x

Description:
Two vulnerabilities have been reported in Liferay Portal, which can be exploited by malicious users to bypass certain security restrictions and by malicious people to compromise a vulnerable system.

1) An error within the "updateOrganizations" method in the UserServiceUtil class can be exploited to add a user to an arbitrary organisation.

2) An error in the IP filter when handling forward targets can be exploited to bypass the filter and gain unauthorised access to certain webservices.

This can further be exploited to compromise a vulnerable system via e.g. specially crafted requests to the "tunnel" webservice.

The vulnerabilities are reported in versions 6.1 CE and prior and 6.1 EE and prior.

Solution:
Reportedly fixed in versions 6.1 GA1 CE and 6.1 GA1 EE.

Provided and/or discovered by:
Jelmer Kuperus

Original Advisory:
http://packetstormsecurity.org/files/112677/Liferay-Portal-Privilege-Escalation.html
http://packetstormsecurity.org/files/112735/Liferay-6.1-No-Account-Access-Bypass.html

http://secunia.com/advisories/49154/

Release Date : 2012-05-18

Criticality level : Not critical
Impact : Security Bypass
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: PolarSSL 0.x
PolarSSL 1.x

Description:
A weakness has been reported in PolarSSL, which can be exploited by malicious people to disclose sensitive information and bypass certain security restrictions.

The weakness is caused due to weak encryption when generating Diffie-Hellman values and RSA keys, which can be exploited to brute force the private value and master secret and disclose the communication channel via Man-in-the-Middle (MitM) attacks.

The weakness is reported in versions 0.99-pre4 through 1.1.1.

Solution:
Update or upgrade to version 1.1.2.

Provided and/or discovered by:
The vendor credits Ruslan Yushchenko.

Original Advisory:
PolarSSL Security Advisory 2012-01:
http://polarssl.org/trac/wiki/SecurityAdvisory201201

http://secunia.com/advisories/49220/

Release Date: 2012-05-17
Last Update: 2012-05-18

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: OpenOffice.org 3.x

Description:
Two vulnerabilities have been reported in OpenOffice.org, which can be exploited by malicious people to compromise a user's system.

1) An integer overflow error in the vclmi.dll module when allocating memory for an embedded image object can be exploited to cause a heap-based buffer overflow e.g. via a specially crafted JPEG object within a DOC file.

2) An input validation error in the WPXContentListener::_closeTableRow() function within WPXContentListener.cpp when parsing Wordperfect documents can be exploited to decrement an object pointer arbitrarily.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires tricking a user into opening a malicious file.

The vulnerabilities are reported in version 3.3. Other versions may also be affected.

Solution:
Update to version 3.4.

Provided and/or discovered by:
1) Tielei Wang, Georgia Tech Information Security Center via Secunia
2) Kestutis Gudinavicius, SEC Consult

Original Advisory:
OpenOffice.org:
http://www.openoffice.org/security/cves/CVE-2012-1149.html
http://www.openoffice.org/security/cves/CVE-2012-2149.html

Kestutis Gudinavicius:
https://www.sec-consult.com/files/20120518-0_openoffice_memory_overwrite.txt

http://secunia.com/advisories/46992