Spyware, viruses, & security forum: VULNERABILITIES / FIXES - August 20, 2012

Release Date : 2012-08-20

Criticality level : Moderately critical
Impact : System access
Where : From local network
Solution Status : Vendor Patch

Software: McAfee SmartFilter Administration 4.x

Description:
A vulnerability has been reported in McAfee SmartFilter Administration, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to missing authentication to the JBoss RMI (Remote Method Invocation) component exposed by SFAdminSrv.exe. This can be exploited to instantiate arbitrary classes or upload and execute arbitrary WAR files with SYSTEM privileges via a specially crafted request to TCP port 1098, 1099, or 4444.

Successful exploitation allows execution of arbitrary code.

The vulnerability is reported in versions 4.2.1 and prior.

Solution:
Update to version 4.2.1.01.

Provided and/or discovered by:
Andrea Micalizzi via ZDI.

Original Advisory:
McAfee:
https://kc.mcafee.com/corporate/index?page=content&id=SB10029

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-12-140/

http://secunia.com/advisories/50304/

Release Date : 2012-08-20

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: LISTSERV 16.x

Description:
Foreground Security has discovered a vulnerability in LISTSERV, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "SHOWTPL" parameter to WA.exe is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 16.0 (Build date: 8 Nov 2011). Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Jose Carlos de Arriba, Foreground Security

Original Advisory:
http://foregroundsecurity.com/component/content/article/1/127-lsoft-listserv-v16-wa-revision-r4241-showtpl-parameter-xss-cross-site-scripting

http://secunia.com/advisories/50098/

IBM Lotus Domino HTTP Response Splitting and Cross-Site Scripting Vulnerabilities

Release Date : 2012-08-20

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: IBM Lotus Domino 8.x

Description:
Multiple vulnerabilities have been reported in IBM Lotus Domino, which can be exploited by malicious people to conduct HTTP response splitting and cross-site scripting attacks.

1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user. This allows arbitrary HTML and script code to be executed in a user's browser session in context of an affected site.

2) Certain unspecified input related to help and webmail is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions prior to 8.5.4.

Solution:
Update to version 8.5.4 when available (scheduled for release in February, 2013).

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21608160

http://secunia.com/advisories/50330/

Release Date: 2012-08-14
Last Update: 2012-08-20

Criticality level : Extremely critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Adobe Flash Player 11.x

Description:
A vulnerability has been reported in Flash Player, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error when parsing font files.

The vulnerability is reported in the following versions:
* Flash Player 11.3.300.270 and earlier for Windows and Macintosh
* Flash Player 11.2.202.236 and earlier for Linux
* Flash Player 11.3.300.270 and earlier for Chrome users

Successful exploitation allows execution of arbitrary code.

NOTE: The vulnerability is currently being actively exploited in targeted attacks via Word documents against the Windows version.

Solution:
Update to version 11.3.300.271 for Windows, Mac, and Chrome or version 11.2.202.238 for Linux.

Provided and/or discovered by:
Reported as a 0-day.

The vendor also credits Alexander Gavrun via iDefense VCP.

Original Advisory:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb12-18.html

Metasploit:
http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/adobe_flash_otf_font.rb

http://secunia.com/advisories/50285

ManageEngine OpStor SQL Injection and Cross-Site Scripting Vulnerabilities

Release Date : 2012-08-20

Criticality level : Less critical
Impact : Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: ManageEngine OpStor 7.x

Description:
Ibrahim El-Sayed has reported some vulnerabilities in ManageEngine OpStor, which can be exploited by malicious users to conduct SQL injection attacks and by malicious people to conduct cross-site scripting attacks.

1) Input passed via the "days" and "name" parameters to availability730.do is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed via the "name" parameter to raidMaps.do is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are reported in version 7.0 build 7002. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Ibrahim El-Sayed (the_storm), Vulnerability Lab

Original Advisory:
Vulnerability Lab:
http://www.vulnerability-lab.com/get_content.php?id=667

http://secunia.com/advisories/50301/

Tinyproxy Multiple Header Hashmap Processing Denial of Service Vulnerability

Release Date : 2012-08-20

Criticality level : Moderately critical
Impact : DoS
Where : From remote
Solution Status : Vendor Workaround

Software: tinyproxy 1.x

Description:
A vulnerability has been reported in Tinyproxy, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to the hashmaps of header responses not being randomized, which can be exploited to consume memory resources.

The vulnerability is reported in version 1.8.3. Other versions may also be affected.

Solution:
Apply patch.

Provided and/or discovered by:
gpernot in a bug report.

Original Advisory:
https://banu.com/bugzilla/show_bug.cgi?id=110

http://secunia.com/advisories/50278/

Release Date : 2012-08-20

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Software: HP Serviceguard 11.x

Description:
A vulnerability has been reported in HP ServiceGuard, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an unspecified error. No further information is currently available.

The vulnerability is reported in versions A.11.19 and A.11.20 running on HP-UX.

Solution:
Apply fix.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
HPSBUX02806 SSRT100789:
https://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03457976

http://secunia.com/advisories/50342/