Spyware, viruses, & security forum: VULNERABILITIES / FIXES - September 10, 2012

Release Date : 2012-09-10

Criticality level : Highly critical
System access
Where : From remote
Solution Status : Vendor Patch

Software: RealPlayer 15.x

Description:
Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.

1) An error when unpacking AAC stream data can be exploited to cause a buffer overflow.

2) An error when decoding AAC SDK can be exploited to corrupt heap memory.

3) An error when handling RealMedia files can be exploited to cause a buffer overflow.

4) Another error when handling RealMedia files can be exploited to cause a buffer overflow.

The vulnerabilities are reported in versions 15.0.2.72 and prior.

NOTE: Additionally, a weakness exists when parsing codec frame size, which can lead to a crash.

Solution:
Update to version 15.0.3.37 or later.

Provided and/or discovered by:
The vendor credits Andrzej Dyjak.

Original Advisory:
http://service.real.com/realplayer/security/09072012_player/en/

http://secunia.com/advisories/50566/

Release Date : 2012-09-10

Criticality level : Less critical
Impact : Privilege escalation
Where : Local system
Solution Status : Vendor Patch

Operating System : Debian GNU/Linux 6.0

Description:
Debian has issued an update for qemu and qemu-kvm. This fixes a security issue and a vulnerability, which can be exploited by malicious, local users in a guest virtual machine to potentially gain escalated privileges and by malicious, local users to perform certain actions with escalated privileges.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2542-1:
http://www.debian.org/security/2012/dsa-2542

DSA-2545-1:
http://www.debian.org/security/2012/dsa-2545

http://secunia.com/advisories/50514/

Release Date : 2012-09-10

Criticality level : Less critical
Impact : Privilege escalation
Where : Local system
Solution Status : Vendor Patch

Operating System : Debian GNU/Linux 6.0

Description:
Debian has issued an update for xen-qemu-dm-4.0. This fixes two vulnerabilities, which can be exploited by malicious, local users to potentially gain escalated privileges.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2543-1:
http://www.debian.org/security/2012/dsa-2543

http://secunia.com/advisories/50517/

Release Date : 2012-09-10

Criticality level : Highly critical
Impact : Manipulation of data
Exposure of sensitive information
DoS
System access
Where : From remote
Solution Status : Vendor Patch

Software: Red Hat Enterprise Linux Desktop Supplementary (v. 6)
Red Hat Enterprise Linux HPC Node Supplementary (v. 6)
Red Hat Enterprise Linux Server Supplementary (v. 6)
Red Hat Enterprise Linux Workstation Supplementary (v. 6)
RHEL Desktop Supplementary (v. 5 client)
RHEL Supplementary (v. 5 server)

Description:
Red Hat has issued an update for java-1.5.0-ibm. This fixes multiple vulnerabilities, which can be exploited by malicious, local users to disclose potentially sensitive data and by malicious people to manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2012:1245-01:
https://rhn.redhat.com/errata/RHSA-2012-1245.html

http://secunia.com/advisories/50548/

vBulletin vBShout Module "from" and "end" Cross-Site Scripting Vulnerabilities

Release Date : 2012-09-10

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: vBShout (module for vBulletin) 6.x

Description:
Two vulnerabilities has been reported in the vBShout module for vBulletin, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "from" and "to" parameters to dbtech/vbshout/actions/archive.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in version 6.0.8. Prior versions may also be affected.

Solution:
Apply hotfix (please see the vendor's advisory for details).

Provided and/or discovered by:
The vendor credits InterNot.

Original Advisory:
http://www.dragonbyte-tech.com/f4/security-hotfix-vbshout-v6-0-8-a-9023/

http://secunia.com/advisories/50565/

Release Date : 2012-09-10

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: XnView 1.x

Description:
FuzzMyApp has reported a vulnerability in XnView, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error when processing a TIFF image with JPEG compression. This can be exploited to cause heap-based buffer overflow via specially crafted "ImageLength" and "ImageWidth" header values.

Successful exploitation may allow execution of arbitrary code, but requires tricking a user into opening a malicious file.

The vulnerability is reported in version 1.98 and 1.99. Other versions may also be affected.

Solution:
Update to version 1.99.1.

Provided and/or discovered by:
FuzzMyApp

Original Advisory:
http://www.fuzzmyapp.com/advisories/FMA-2011-016/FMA-2011-016-EN.xml

http://secunia.com/advisories/50547/

Pinboarding Pro Script Insertion and Cross-Site Request Forgery Vulnerabilities

Release Date : 2012-09-10

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Pinboarding Pro

Description:
Two vulnerabilities have been reported in Pinboarding Pro, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site request forgery attacks.

1) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. change the password of the administrative user when a logged-in administrative user visits a specially crafted web page.

2) Input passed via the "board_desc" parameter to uploadpin.php is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

Solution:
No official solution is currently available.

Provided and/or discovered by:
DaOne

Original Advisory:
http://www.exploit-db.com/exploits/21148

http://secunia.com/advisories/50525/

Release Date : 2012-09-140

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Operating System : Debian GNU/Linux 6.0

Description:
Debian has issued an update for mahara. This fixes a vulnerability, which can be exploited by malicious people to conduct cross-site scripting attacks.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2540-1:
http://www.debian.org/security/2012/dsa-2540

http://secunia.com/advisories/50521/

WordPress Mac Photo Gallery Plugin Two Security Bypass Security Issues

Release Date : 2012-09-10

Criticality level : Moderately critical
Impact : Security Bypass
Where : From remote
Solution Status : Unpatched

Software: WordPress Mac Photo Gallery Plugin 2.x

Description:
Charlie Eriksen has discovered two security issues in the Mac Photo Gallery plugin for WordPress, which can be exploited by malicious people to bypass certain security restrictions.

The security issues are caused due to missing authentication and authorisation checks in the wp-content/plugins/mac-dock-gallery/macalbajax.php and wp-content/plugins/mac-dock-gallery/macphtajax.php scripts and can be exploited to access otherwise restricted functionality (e.g. edit image and album descriptions).

The security issues are confirmed in version 2.10. Other versions may also be affected.

Solution:
Upgrade to a fixed version (please contact the vendor for details).

Provided and/or discovered by:
Charlie Eriksen via Secunia.

http://secunia.com/advisories/49923/