Spyware, viruses, & security forum: VULNERABILITIES / FIXES - June 12, 2012

Release Date : 2012-06-12

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Apple iTunes 10.x

Description:
Apple has reported two vulnerabilities in Apple iTunes, which can be exploited by malicious people to compromise a user's system.

1) An error in the handling of .m3u playlists can be exploited to cause a heap-based buffer overflow via a specially crafted M3U (".m3u") file.

2) A vulnerability is caused due to a bundled vulnerable version of WebKit.

NOTE: This vulnerability does not affect the application on OS X Lion systems.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Solution:
Update to version 10.6.3.

Provided and/or discovered by:
The vendor credits:
1) Gjoko Krstic, Zero Science Lab.
2) Adam Barth and Abhishek Arya, Google Chrome Security Team.

Original Advisory:
Apple:
http://support.apple.com/kb/HT5318

http://secunia.com/advisories/49489/

WordPress Thinkun Remind Plugin "dirPath" Remote File Inclusion Vulnerability

Release Date : 2012-06-12

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: WordPress Thinkun Remind Plugin 1.x

Description:
Sammy Forgit has discovered a vulnerability in the Thinkun Remind plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "dirPath" parameter in wp-content/plugins/thinkun-remind/exportData.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from remote resources.

The vulnerability is confirmed in version 1.1.3. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly verified.

Provided and/or discovered by:
Sammy Forgit, OpenSysCom.

Original Advisory:
http://www.opensyscom.fr/Actualites/wordpress-plugins-thinkun-remind-remote-file-disclosure-vulnerability.html

http://secunia.com/advisories/49461/

Release Date : 2012-06-12

Criticality level : Moderately critical
Impact : Exposure of sensitive information
DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: openSUSE 11.4
openSUSE 12.1

Description:
SUSE has issued an update for bind. This fixes a vulnerability, which can be exploited by malicious people to disclose potentially sensitive information or cause a DoS (Denial of Service).

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:0722-1:
lists.opensuse.org/opensuse-security-announce/2012-06/msg00005.html

http://secunia.com/advisories/49501/

Release Date : 2012-06-12

Criticality level : Not critical
Impact : Exposure of sensitive information
Where : Local system
Solution Status : Vendor Patch

Software: libguestfs 1.x

Description:
A security issue has been reported in libguestfs, which can be exploited by malicious, local users to disclose potentially sensitive information.

The security issue is caused due to the "virt-edit" utility not keeping original file permissions when editing a file inside a virtual machine image, which results in world-readable permissions being set.

The security issue is reported in version 1.16.4. Other versions may also be affected.

Solution:
Update to version 1.16.24.

Provided and/or discovered by:
Reported by Richard W.M. Jones in a Red Hat bug report.

Original Advisory:
https://bugzilla.redhat.com/show_bug.cgi?id=788642

http://secunia.com/advisories/49431/

Xen Privilege Escalation and Denial of Service Vulnerabilities

Release Date : 2012-06-12

Criticality level : Less critical
Impact : Privilege escalation
DoS
Where : Local system
Solution Status : Vendor Patch

Software: Xen 3.x
Xen 4.x

Description:
Two vulnerabilities have been reported in Xen, which can be exploited by malicious, local users in a guest virtual machine to cause a DoS (Denial of Service) and gain escalated privileges.

1) An error when handling certain system calls can be exploited to gain additional privileges.

Successful exploitation of this vulnerability requires a 64-bit PV guest kernel running on a 64-bit hypervisor.

2) An error when handling exceptions does not properly clear a flag, which can be exploited to cause a crash.

Note: This vulnerability does not affect HVM guests.

The vulnerabilities are reported in versions 3.4, 4.0, and 4.1.

Note: Additionally, a weakness exists within 64-bit PV guests, which can lead to CPU lock ups.

Solution:
Apply patches (please see the vendor's advisory for more information).

Provided and/or discovered by:
1) The vendor credits Rafal Wojtczuk.
2) Reported by the vendor.

Original Advisory:
XSA-7:
http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html

XSA-8:
http://lists.xen.org/archives/html/xen-announce/2012-06/msg00003.html

XSA-9:
http://lists.xen.org/archives/html/xen-announce/2012-06/msg00002.html

http://secunia.com/advisories/49381/

Microsoft .NET Framework WinForms Memory Access Vulnerability

Release Date : 2012-06-12

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Microsoft .NET Framework 2.x
Microsoft .NET Framework 3.x
Microsoft .NET Framework 4.x

Description:
A vulnerability has been reported in Microsoft .NET Framework, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error within the framework when handling pointers and can be exploited to corrupt memory via a specially crafted web page.

Successful exploitation allows execution of arbitrary code, but requires a browser that can run XAML Browser Applications (XBAPs).

Solution:
Apply patches.

Provided and/or discovered by:
The vendor credits Vitaliy Toropov via ZDI.

Original Advisory:
MS12-038 (KB2706726, KB2686828, KB2686827, KB2686833, KB2686830, KB2686831):
http://technet.microsoft.com/en-us/security/bulletin/ms12-038

http://secunia.com/advisories/49418/

Microsoft Windows Kernel-Mode Drivers Multiple Vulnerabilities

Release Date : 2012-06-12

Criticality level : Less critical
Impact : Privilege escalation
Where : Local system
Solution Status : Vendor Patch

Operating System: Microsoft Windows 7
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows Server 2008
Microsoft Windows Storage Server 2003
Microsoft Windows Vista
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional

Description:
Multiple vulnerabilities have been reported in Windows, which can be exploited by malicious, local users to gain escalated privileges.

1) An error in win32k.sys within the string atom class name handling can be exploited to execute arbitrary code with kernel-mode privileges.

2) An error in win32k.sys within the string atom class name handling can be exploited to execute arbitrary code with kernel-mode privileges.

3) An error in win32k.sys within the clipboard format atom name handling can be exploited to execute arbitrary code with kernel-mode privileges.

4) An integer overflow error when handling the reference counter for font resources when loading TrueType fonts can be exploited to execute arbitrary code with kernel-mode privileges.

5) A race condition error in win32k.sys when handling particular thread creation attempts can be exploited to execute arbitrary code with kernel-mode privileges.

Solution:
Apply patches.

Provided and/or discovered by:
1-3) The vendor credits Tarjei Mandt, Azimuth Security.
4) The vendor credits Mateusz "j00ru" Jurczyk, Google Inc.
5) Reported by the vendor.

Original Advisory:
MS12-041 (KB2709162):
http://technet.microsoft.com/en-us/security/bulletin/MS12-041

http://secunia.com/advisories/49436/

Release Date : 2012-06-12

Criticality level : Highly critical
Impact : Cross Site Scripting
Exposure of sensitive information
System access
Where : From remote
Solution Status : Vendor Patch

Software: Microsoft Internet Explorer 6.x
Microsoft Internet Explorer 7.x
Microsoft Internet Explorer 8.x
Microsoft Internet Explorer 9.x

Description:
Multiple vulnerabilities have been reported in Internet Explorer, which can be exploited by malicious people to disclose sensitive information, conduct cross-site scripting attacks, and compromise a user's system.

1) An error when handling the "Center" element can be exploited to access an already deleted object and corrupt memory.

Successful exploitation of this vulnerability allows execution of arbitrary code.

2) An unspecified error in the "toStaticHTML" API when sanitising HTML code can be exploited to execute arbitrary HTML and script code in the user's browser session in context of a targeted site.

3) An error when handling EUC-JP character encoding can be exploited to execute arbitrary HTML and script code in the user's browser session in context of a targeted site.

4) An unspecified error when processing NULL bytes can be exploited to disclose content from the process memory.

5) An unspecified error within the developer toolbar can be exploited to access an already deleted object and corrupt memory.

Successful exploitation of this vulnerability allows execution of arbitrary code.

6) An error when handling the "Same ID" property can be exploited to access an already deleted object and corrupt memory.

Successful exploitation of this vulnerability allows execution of arbitrary code.

7) An error when handling the "Col" element can be exploited to access a nonexistent object and corrupt memory.

Successful exploitation of this vulnerability allows execution of arbitrary code.

8) An error when handling the "Title" element can be exploited to access an already deleted object and corrupt memory.

Successful exploitation of this vulnerability allows execution of arbitrary code.

9) An error when handling the "OnBeforeDeactivate" event can be exploited to access an already deleted object and corrupt memory.

Successful exploitation of this vulnerability allows execution of arbitrary code.

10) An error when handling the "insertAdjacentText" method can be exploited to access undefined memory and corrupt memory.

Successful exploitation of this vulnerability allows execution of arbitrary code.

11) An error when handling the "insertRow" method can be exploited to access an already deleted object and corrupt memory.

Successful exploitation of this vulnerability allows execution of arbitrary code.

12) An error when handling the "OnRowsInserted" event can be exploited to access an already deleted object and corrupt memory.

Successful exploitation of this vulnerability allows execution of arbitrary code.

13) An error within the handling of the "Scrolling" event can be exploited to disclose information from another domain or Internet Explorer zone.

Solution:
Apply patches.

Provided and/or discovered by:
The vendor credits:
1) An anonymous person via iDefense
2) Adi Cohen, IBM
3) Masato Kinugawa
4) Roman Shafigullin, LinkedIn
5) Code Audit Labs, VulnHunt
6) Dark Son, VulnHunt
7) Vupen via ZDI
8, 9, 10, 11, 12) An anonymous person via ZDI
13) Reported by the vendor

Original Advisory:
MS12-037 (KB2699988)
http://technet.microsoft.com/en-us/security/bulletin/ms12-037

http://secunia.com/advisories/49412/

Release Date : 2012-06-12

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Microsoft Dynamics AX 2012

Description:
A vulnerability has been reported in Microsoft Dynamics AX, which can be exploited by malicious people to conduct cross-site scripting attacks.

Unspecified input passed to Enterprise Portal is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution:
Apply patches.

Provided and/or discovered by:
The vendor credits Finian Mackin.

Original Advisory:
MS12-040 (KB2706738, KB2709100, KB2710639, KB2711239):
http://technet.microsoft.com/en-us/security/bulletin/MS12-040

http://secunia.com/advisories/49433/