Spyware, viruses, & security forum: VULNERABILITIES / FIXES - July 09, 2012

MGB Multiple Cross-Site Scripting and SQL Injection Vulnerabilities

Release Date : 2012-07-09

Criticality level : Less critical
Impact : Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: MGB 0.6.x.x

Description:
Stefan Schurtz has discovered multiple vulnerabilities in MGB, which can be exploited by malicious users to conduct SQL injection attacks and by malicious people to conduct cross-site scripting attacks.

1) Input passed via the "p" parameter to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed via the "name", "city", "email", "icq", "aim", "msn", "hp", and "message" parameters to newentry.php is not properly sanitised in the "template()" function in includes/functions.inc.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Input passed via the "id" parameter to admin/admin.php (when "action" is set to "delete") is not properly sanitised in admin/delete.inc.php before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability requires the "Delete post" permission.

The vulnerabilities are confirmed in version 0.6.9.1. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Stefan Schurtz.

Original Advisory:
SSCHADV2012-017:
http://www.darksecurity.de/index.php?/219-SSCHADV2012-017-MGB-OpenSource-Guestbook-0.6.9.1-Multiple-security-vulnerabilities.html

http://secunia.com/advisories/49804/

WordPress Artiss Code Embed Plugin "suffix" Cross-Site Scripting Vulnerability

Release Date : 2012-07-09

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Artiss Code Embed Plugin 2.x

Description:
A vulnerability has been reported in the Artiss Code Embed plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "suffix" parameter to wp-admin/admin.php (when "page" is set to "ace-search") is not properly sanitised in wp-content/plugins/simple-embed-code/includes/ace-search.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions prior to 2.0.2.

Solution:
Update to version 2.0.2.

Provided and/or discovered by:
Matt Fuller via Mozilla bug report

Original Advisory:
Artiss Code Embed:
http://wordpress.org/extend/plugins/simple-embed-code/changelog/
http://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/ace-search.php?rev=524767
http://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/ace-search.php?rev=568287

http://secunia.com/advisories/49848/

IBM WebSphere Portal Dojo Module Directory Traversal Vulnerability

Release Date : 2012-07-09

Criticality level : Moderately critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: IBM WebSphere Portal 7.x
IBM WebSphere Portal 8.x

Description:
A vulnerability has been reported in IBM WebSphere Portal, which can be exploited by malicious people to disclose potentially sensitive information.

Certain input passed via the URL to the Dojo module is not properly verified before being used. This can be exploited to disclose the contents of arbitrary files via directory traversal sequences.

The vulnerability is reported in versions 7.0.0.1 and 7.0.0.2 before CF14, and 8.0.

Solution:
Apply APAR PM64172.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
IBM:
https://www.ibm.com/support/docview.wss?uid=swg21598363

X-Force:
http://xforce.iss.net/xforce/xfdb/75584

http://secunia.com/advisories/49855/

Release Date : 2012-07-09

Criticality level : Not critical
Impact : Brute force
Where : From remote
Solution Status : Unpatched

Software: Avaya Application Enablement Services 5.x
Avaya Application Enablement Services 6.x
Avaya Aura Presence Services 6.x
Avaya Aura Session Manager 1.x
Avaya Aura Session Manager 5.x
Avaya Aura Session Manager 6.x
Avaya Aura System Manager 5.x
Avaya Aura System Manager 6.x
Avaya Experience Portal 6.x
Avaya Meeting Exchange 5.x
Avaya Voice Portal 5.x

Description:
Avaya has acknowledged a weakness in Avaya Products, which can be exploited by malicious people to conduct brute force attacks.

The weakness is reported in the following products:
* Avaya Application Enablement Services versions 5.x and 6.x.
* Avaya Aura Presence Services versions 6.0.x.
* Avaya Aura Session Manager versions 1.1, 5.x, and 6.x.
* Avaya Aura System Manager versions 5.x and 6.x.
* Avaya Experience Portal versions 6.0.x.
* Avaya Meeting Exchange versions 5.x.
* Avaya Voice Portal versions 5.x.

Solution:
The vendor recommends that local and network access to the affected systems be restricted until an update is available.

Original Advisory:
https://downloads.avaya.com/css/P8/documents/100164390

http://secunia.com/advisories/49852/

WordPress Leaflet Maps Marker Plugin Multiple Vulnerabilities

Release Date : 2012-07-09

Criticality level : Less critical
Impact : Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Leaflet Maps Marker Plugin 2.x

Description:
Multiple vulnerabilities have been reported in Leaflet Maps Marker, which can be exploited by malicious users to conduct SQL injection and script insertion attacks and by malicious people to conduct cross-site scripting attacks.

1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Certain unspecified input is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

3) Certain unspecified input passed is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are reported in versions prior to 2.4.

Solution:
Update to version 2.4.

Provided and/or discovered by:
The vendor credits the computing centre of the city of Vienna.

Original Advisory:
Leaflet Maps Marker:
http://www.mapsmarker.com/2012/06/06/leaflet-maps-marker-v2-4-is-available/
http://plugins.trac.wordpress.org/changeset/551499/leaflet-maps-marker

http://secunia.com/advisories/49845/

Release Date : 2012-07-09

Criticality level : Not critical
Impact : Spoofing
Where : From remote
Solution Status : Unpatched

Software: WebsitePanel 1.x

Description:
A weakness has been reported in WebsitePanel, which can be exploited by malicious people to conduct spoofing attacks.

Input passed via the "ReturnUrl" parameter to Default.aspx (when "pid" is set to "Login") is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.

The weakness is reported in version 1.2.0. Other versions may also be affected.

Solution:
Reportedly fixed in version 1.2.2.1 beta.

Provided and/or discovered by:
Anastasios Monachos in a bug ticket.

Original Advisory:
http://websitepanel.codeplex.com/workitem/224

http://secunia.com/advisories/49813/

Netsweeper Cross-Site Scripting and Request Forgery Vulnerabilities

Release Date : 2012-07-09

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Netsweeper 3.x

Description:
Two vulnerabilities have been reported in Netsweeper, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks.

1) Input passed via the "group" parameter to webadmin/tools/local_lookup.php (when "action" is set to "lookup") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. add an administrator by tricking a logged in administrator into visiting a malicious web site.

Solution:
No official solution is currently available.

Provided and/or discovered by:
US-CERT credits Jacob Holcomb, Leland Public Schools.

Original Advisory:
VU#763795:
http://www.kb.cert.org/vuls/id/763795

http://secunia.com/advisories/49801/