Spyware, viruses, & security forum: VULNERABILITIES / FIXES - August 08, 2012

Hitachi JP1/Integrated Management Cross-Site Scripting Vulnerability

Release Date : 2012-08-08

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Partial Fix

Software: Hitachi JP1/Integrated Management (IM)

Description:
A vulnerability has been reported in Hitachi JP1/Integrated Management, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input related to Service Support is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions 08-11 through 08-11-04, 08-50 through 08-50-07, 08-51 through 08-51-09, 09-00 through 09-00-06, and 09-50 through 09-50-03.

Solution:
Update to a fixed version.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Hitachi (English):
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-021/index.html

Hitachi (Japanese):
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-021/index.html

http://secunia.com/advisories/50163/

Release Date : 2012-08-08

Criticality level : Less critical
Impact : Manipulation of data
Where : Local system
Solution Status : Vendor Patch

Operating System: Red Hat Enterprise Linux Desktop 5
Red Hat Enterprise Linux Server 5

Description:
Red Hat has issued an update for sudo. This fixes a security issue, which can be exploited by malicious, local users to manipulate certain data.

The security issue is caused due to a race condition error within the %postun (post-uninstall) script when performing an upgrade or the removal of the sudo package. This can be exploited to overwrite an arbitrary file via a symbolic link attack or modify the contents of the /etc/nsswitch.conf file.

Solution:
Updated packages are available via Red Hat Network.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
RHSA-2012:1149-1:
https://rhn.redhat.com/errata/RHSA-2012-1149.html

Red Hat Bug#844442:
https://bugzilla.redhat.com/show_bug.cgi?id=844442

http://secunia.com/advisories/50178/

Oracle Database CTXSYS.CONTEXT Index Privilege Escalation Vulnerability

Release Date : 2012-08-08

Criticality level : Less critical
Impact : Privilege escalation
Where : From local network
Solution Status : Partial Fix

Software: Oracle Database 10.x
Oracle Database 11.x

Description:
David Litchfield has reported a vulnerability in Oracle Database, which can be exploited by malicious users to gain escalated privileges.

The vulnerability is caused due to an unspecified error related to the CTXSYS.CONTEXT index. No further information is currently available.

Successful exploitation allows user to gain SYSDBA privileges, but requires CREATE TABLE and CREATE PROCEDURE privileges and EXECUTE privileges on DBMS_STATS.

Solution:
Reportedly, patches are available for some 11gR2 versions (please contact the vendor for more information).

Provided and/or discovered by:
David Litchfield

Original Advisory:
http://www.teamshatter.com/topics/general/team-shatter-exclusive/ctxsys-context-privilege-escalation/

http://secunia.com/advisories/50143/

Release Date : 2012-08-08

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Baby Gekko 1.x

Description:
Secunia Research has discovered a vulnerability in Baby Gekko, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the URL to e.g. index.php or includes/errors/404.php is not properly sanitised in includes/errors/404.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that the victim uses a browser that does not URL-encode the request (e.g. Internet Explorer 6).

The vulnerability is confirmed in version 1.2.2a. Other versions may also be affected.

Solution:
Update to version 1.2.2d.

Provided and/or discovered by:
Secunia Research.

Original Advisory:
Secunia Research:
http://secunia.com/secunia_research/2012-28/

http://secunia.com/advisories/49142/

Release Date : 2012-08-08

Criticality level : Moderately critical
Impact : DoS
Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Operating System: openSUSE 12.1

Description:
SUSE has issued an update for python-django. This fixes two security issues and a vulnerability, which can be exploited by malicious people to conduct cross-site scripting attacks and cause a DoS (Denial of Service).

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:0970-1:
http://lists.opensuse.org/opensuse-updates/2012-08/msg00014.html

http://secunia.com/advisories/50167/

Release Date : 2012-08-08

Criticality level : Moderately critical
Impact : Security Bypass
Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: PBBoard 2.x

Description:
High-Tech Bridge has discovered multiple vulnerabilities in PBBoard, which can be exploited by malicious people to conduct cross-site request forgery and SQL injection attacks and bypass certain security restrictions.

1) Input passed via the "username" POST parameter (when "page" is set to "send"), "email" POST parameter (when "page" is set to "forget"), "password" POST parameter (when "page" is set to "forum_archive"), "section" POST parameter (when "page" is set to "management"), "section_id" POST parameter (when "page" is set to "managementreply"), "member_id" POST parameter (when "page" is set to "new_password", and "subjectid" POST parameter (when "page" is set to "tags") to index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) An error due to the application not validating the "member_id" parameter can be exploited to change the password of other users.

3) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. inject and execute arbitrary PHP code if a logged-in administrator visits a malicious web site.

The vulnerabilities are confirmed in version 2.1.4. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
High-Tech Bridge

Original Advisory:
HTB23101:
https://www.htbridge.com/advisory/HTB23101

http://secunia.com/advisories/50153/