Spyware, viruses, & security forum: VULNERABILITIES / FIXES - August 07, 2012

NVIDIA Graphics Drivers for Linux GPU Device Node Access Privilege Escalation Vulnerability

Release Date : 2012-08-07

Criticality level : Less critical
Impact : Privilege escalation
Where : Local system
Solution Status : Vendor Patch

Software: NVIDIA Graphics Drivers for Linux

Description:
A vulnerability has been reported in NVIDIA Graphics Drivers for Linux, which can be exploited by malicious, local users to potentially gain escalated privileges.

The vulnerability is caused due to an error when handling read and write access to GPU (Graphics Processing Unit) device nodes, which can be exploited to reconfigure a GPU to read from or write to arbitrary system memory.

Successful exploitation requires read and write access to GPU device nodes (default configuration).

The vulnerability is reported in version 295.40. Other versions may also be affected.

Solution:
Update to version 295.71 or 304.32.

Provided and/or discovered by:
An anonymous person.

Original Advisory:
NVIDIA:
http://nvidia.custhelp.com/app/answers/detail/a_id/3140

http://www.exploit-db.com/exploits/20201/

http://secunia.com/advisories/50085/

KOffice KWord ODF Style Parsing Buffer Overflow Vulnerability

Release Date : 2012-08-07

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: KOffice 2.x

Description:
Accuvant Labs has reported a vulnerability in KOffice, which can be exploited by malicious people to compromise a user's system.

The vulnerability is reported in version 2.3.3. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Charlie Miller, Accuvant Labs

Original Advisory:
http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf

http://secunia.com/advisories/50199/

Release Date : 2012-08-07

Criticality level : Less critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for openttd. This fixes two vulnerabilities, which can be exploited by malicious users to cause a DoS (Denial of Service).

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2524-1:
http://www.debian.org/security/2012/dsa-2524

http://secunia.com/advisories/50137/

Intuit GoPayment Card Reader Information Disclosure Vulnerability

Release Date : 2012-08-07

Criticality level : Not critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: Intuit GoPayment Card Reader for Android 2.x
Intuit GoPayment for iOS 4.x

Description:
A vulnerability has been reported in Intuit GoPayment, which can be exploited by malicious people to disclose certain sensitive information.

The vulnerability is caused due to certain credit card information not being properly restricted while processing transactions. This can be exploited to intercept credit card information when a card is swiped via the card reader.

Successful exploitation requires that a malicious application is installed.

The vulnerability is reported in the following products:
* Intuit GoPayment Card Reader for Android versions 2.7.1 and prior
* Intuit GoPayment for iOS versions 4.7.2 and prior

Solution:
Update to a fixed version.

Provided and/or discovered by:
The vendor credits University of Wisconsin, Madison

Original Advisory:
http://security.intuit.com/alert.php?a=51

http://secunia.com/advisories/50184/

TCExam "subject_module_id" and "question_subject_id" SQL Injection Vulnerabilities

Release Date : 2012-08-07

Criticality level : Less critical
Impact : Manipulation of data
Where : From remote
Solution Status : Vendor Patch

Software: TCExam 11.x

Description:
Some vulnerabilities have been reported in TCExam, which can be exploited by malicious users to conduct SQL injection attacks.

Input passed via multiple parameters to multiple scripts is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

List of accected scripts and parameters:
http://[host]/admin/code/tce_edit_answer.php?subject_module_id
http://[host]/admin/code/tce_edit_answer.php?question_subject_id
http://[host]/admin/code/tce_edit_question.php?subject_module_id

The vulnerabilities are reported in versions prior to 11.3.008.

Solution:
Update to version 11.3.008.

Provided and/or discovered by:
The vendor credits Chris Cooper, Reaction Information Security.

Original Advisory:
TCExam:
http://freecode.com/projects/tcexam/releases/347125
http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam;h=edf6e08622642f1b2421f4355d98250d9e1b0742

http://secunia.com/advisories/50141/

AOL downloadUpdater2 Firefox Plugin Buffer Overflow Vulnerability

Release Date : 2012-08-07

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: AOL Deskbar
AOL downloadUpdater2 1.x (Plugin for Firefox)

Description:
A vulnerability has been discovered in the AOL downloadUpdater2 plugin for Firefox, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when handling "src" attribute in an "embed" element (when "type" is set to "applicatiotn/x-vend.aol.dnupdater2.1") and can be exploited to cause a buffer overflow by e.g. tricking a user into visiting a specially crafted website.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 1.3.0.0. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
rgod

Original Advisory:
http://www.exploit-db.com/exploits/20295/

http://secunia.com/advisories/48945/

Release Date : 2012-08-07

Criticality level : Moderately critical
Impact : Manipulation of data
System access
Where : From local network
Solution Status : Vendor Patch

Software: IBM Tivoli Endpoint Manager 8.x

Description:
IBM has acknowledged two vulnerabilities in Tiv:li Endpoint Manager, which can be exploited by malicious people to manipulate certain data and to potentially compromise a vulnerable system.

The vulnerabilities are caused due to bundling a vulnerable OpenSSL library.

The vulnerabilities are reported in versions prior to 8.2.1310.

Solution:
Updated to version 8.2.1310.

Original Advisory:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21607116

http://secunia.com/advisories/50151/

WordPress Featured Post with thumbnail Plugin Unspecified timthumb Vulnerability

Release Date : 2012-08-06

Criticality level : Moderately critical
Impact : Unknown
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Featured Post with thumbnail Plugin 1.x

Description:
A vulnerability with an unknown impact has been reported in the Featured Post with thumbnail plugin for WordPress.

The vulnerability is caused due to an unspecified error related to timthumb. No further information is currently available.

The vulnerability is reported in versions prior to 1.5.

Solution:
Update to version 1.5.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://wordpress.org/extend/plugins/featured-post-with-thumbnail/changelog/
http://plugins.trac.wordpress.org/changeset/582086/featured-post-with-thumbnail

http://secunia.com/advisories/50161/

Palo Alto Networks PAN-OS "inputStr" Cross-Site Scripting Vulnerability

Release Date : 2012-08-06

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Operating System: PAN-OS 3.x
PAN-OS 4.x

Description:
Abhisek has reported a vulnerability in Palo Alto Networks PAN-OS, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "inputStr" parameter to /global-protect/login.esp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected device.

The vulnerability is reported in versions prior to 4.1.0, 4.0.6, and 3.1.12.

Solution:
Update to version 4.1.0, 4.0.6, or 3.1.12.

Provided and/or discovered by:
Abhisek

Original Advisory:
http://blog.abhisek.me/2012/06/xss-on-palo-alto-networks-global.html

http://secunia.com/advisories/50174/