Spyware, viruses, & security forum: VULNERABILITIES / FIXES - June 05, 2012

@WEB ShoppingCart Unspecified Cross-Site Scripting Vulnerability

Release Date : 2012-06-05

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: @WEB ShoppingCart 1.x

Description:
A vulnerability has been reported in @WEB ShoppingCart, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions 1.5.1.0 and prior.

Solution:
Update to version 1.5.2.0.

Provided and/or discovered by:
JVN credits Yoshinori Matsumoto, Kobe Digital Lab., Inc.

Original Advisory:
JVN:
http://jvn.jp/en/jp/JVN78305073/index.html
http://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000055.html

http://secunia.com/advisories/49385/

WordPress Theme My Login Plugin "instance" Cross-Site Scripting Vulnerability

Release Date : 2012-06-05

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Theme My Login Plugin 6.x

Description:
A vulnerability has been discovered in the Theme My Login plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "instance" parameter to index.php (when "action" is set to "lostpassword", "retrievepassword", or "register") is not properly sanitised in wp-content/plugins/theme-my-login/includes/class-theme-my-login.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 6.1.4. Prior versions may also be affected.

Solution:
Update to version 6.2.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Theme My Login:
http://wordpress.org/extend/plugins/theme-my-login/changelog/
http://plugins.trac.wordpress.org/changeset/455063/theme-my-login

http://secunia.com/advisories/49399/

Release Date: 2012-05-09
Last Update: 2012-06-05

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Adobe Illustrator CS5 15.x

Description:
Multiple vulnerabilities have been reported in Adobe Illustrator, which can be exploited by malicious people to compromise a user's system.

1) An unspecified error can be exploited to corrupt memory.

2) Another unspecified error can be exploited to corrupt memory.

3) Another unspecified error can be exploited to corrupt memory.

4) Another unspecified error can be exploited to corrupt memory.

5) An integer overflow error in JPEGFormat.aip when calculating the size of a buffer to allocate based on the image dimensions and colour depth can be exploited to cause a heap-based buffer overflow via a specially crafted JPEG image file.

NOTE: This vulnerability is confirmed in CS5 bundling JPEGFormat.aip version 15.0.128.0.

6) Another unspecified error can be exploited to corrupt memory.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in Adobe Illustrator version CS5.5 (15.1) and prior for Windows and Macintosh. Other versions may also be affected.

Solution:
Update to version CS5 (15.0.3) or CS5.5 (15.1.1) or upgrade to version CS6 (16.0.0).

Provided and/or discovered by:
5) Tielei Wang, Georgia Tech Information Security Center via Secunia

The vendor credits:
1, 4, 6) Felipe Andres Manzano via iSIGHT Partners Global Vulnerability Partnership
2, 3) Justin Kim, Microsoft

http://secunia.com/advisories/47118

Hexamail Server Webmail Email Body Script Insertion Vulnerability

Release Date : 2012-06-05

Criticality level : Moderately critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Hexamail Server 4.x

Description:
Spentera has discovered a vulnerability in Hexamail Server, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via the email body is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed in the webmail interface.

The vulnerability is confirmed in version 4.4.5.002. Other versions may also be affected.

Solution:
No effective workaround is currently available.

Provided and/or discovered by:
modpr0be, Spentera

Original Advisory:
http://www.spentera.com/2012/06/hexamail-server-4-4-5-persistent-xss-vulnerability/

http://secunia.com/advisories/49357/

Linux Kernel 64bit ABI System Call Parameter Sign Extension Security Issue

Release Date: 2009-01-14
Last Update: 2012-06-05

Criticality level : Less critical
Impact: Privilege escalation
DoS
Where: Local system
Solution: Vendor Patch

Operating System: Linux Kernel 2.6.x
Linux Kernel 3.0.x
Linux Kernel 3.2.x
Linux Kernel 3.3.x

Description:
A security issue has been reported in the Linux Kernel, which can be exploited by malicious, local users to potentially cause a DoS (Denial of Service) or gain escalated privileges.

The security issue is caused due to the kernel accepting certain 32bit parameters passed in a 64bit register from userspace without ensuring that the value is correctly sign extended. This may be exploited to crash a system or potentially gain escalated privileges by passing specially crafted parameters to affected system calls.

Reportedly, the following architectures use a vulnerable ABI system when running a 64bit kernel and a 64bit userspace:
* S390
* PowerPC
* SPARC64
* MIPS
* TILE-Gx

Solution:
Update to version 2.6.27.12 or 2.6.28.1 for the s390 and PowerPC (64bit) architectures, version 2.6.28.6 for the SPARC64 architecture, and version 2.6.29 for the MIPS architecture. Update to version 3.0.33, 3.2.19, or 3.3.8 for the TILE-Gx architecture.

Provided and/or discovered by:
Red Hat credits Christian Borntraeger.

Original Advisory
Red Hat::
https://bugzilla.redhat.com/show_bug.cgi?id=479969

Kernel.org:
http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.0.33
http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.2.19
http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.3.8

http://secunia.com/advisories/33477