Spyware, viruses, & security forum: VULNERABILITIES / FIXES - September 12, 2012

Python trytond Module Button Model Security Bypass Vulnerability

Release Date : 2012-09-12

Criticality level : Moderately critical
Impact : Security Bypass
Where From local network
Solution Status : Vendor Patch

Software: Python trytond Module 2.x

Description:
A vulnerability has been reported in Python trytond Module, which can be exploited by malicious users to bypass certain security restrictions.

The vulnerability is caused due to the module not properly verifying access permissions on the button model and can be exploited to execute button code.

The vulnerability is reported in versions prior to 2.4.2.

Solution:
Update to version 2.4.2.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://news.tryton.org/2012/09/security-releases-for-trytond-24-series.html

http://secunia.com/advisories/50529/

Release Date : 2012-09-12

Criticality level : Less critical
Impact : Security Bypass
Where From local network
Solution Status : Vendor Patch

Software: Bacula 5.x

Description:
A security issue has been reported in Bacula, which can be exploited by malicious users to bypass certain security restrictions.

The security issue is caused due to an error within the implementation of console ACLs, which can be exploited to gain access to certain restricted functionality and e.g. dump resources.

The security issue is reported in versions prior to 5.2.11.

Solution:
Update to version 5.2.11.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://sourceforge.net/projects/bacula/files/bacula/5.2.11/ReleaseNotes/view

http://secunia.com/advisories/50535/

Release Date : 2012-09-12

Criticality level : Moderately critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Operating System : McAfee Firewall Enterprise (formely Sidewinder Firewall) 7.x
McAfee Firewall Enterprise 8.x

Description:
McAfee has acknowledged multiple vulnerabilities in McAfee Firewall Enterprise, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerabilities are reported in versions prior to 7.0.1.05.H05 and 8.2.1P04.

Solution:
Apply patches.

Original Advisory:
https://kc.mcafee.com/corporate/index?page=content&id=KB76173

http://secunia.com/advisories/50593/

Release Date : 2012-09-12

Criticality level : Moderately critical
Impact : Exposure of sensitive information
DoS
System access
Where : From remote
Solution Status : Vendor Patch

Operating System : Red Hat Enterprise Linux Desktop 5
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 5
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6
RHEL Desktop Workstation 5

Description:
Red Hat has issued an update for libexif. This fixes multiple vulnerabilities, which can be exploited by malicious people to disclose certain sensitive information, cause a DoS (Denial of Service), and compromise an application using the library.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2012:1255-1:
https://rhn.redhat.com/errata/RHSA-2012-1255.html

http://secunia.com/advisories/50587/

Atlassian Confluence Unspecified Cross-Site Scripting Vulnerability

Release Date : 2012-09-12

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Atlassian Confluence 4.x

Description:
A vulnerability has been reported in Atlassian Confluence, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions prior to 4.1.9.

Solution:
Update to version 4.1.9 or later.

Provided and/or discovered by:
The vendor credits D. Niedermaier, Intrest SEC.

Original Advisory:
https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2012-09-11
https://jira.atlassian.com/browse/CONF-26366

http://secunia.com/advisories/50606/

Release Date : 2012-09-12

Criticality level : Highly critical
Impact : Manipulation of data
Exposure of sensitive information
DoS
System access
Where : From remote
Solution Status : Vendor Patch

Software: IBM Java 7.x

Description:
IBM has acknowledged multiple vulnerabilities in IBM Java, which can be exploited by malicious, local users to disclose potentially sensitive data and by malicious people to disclose potentially sensitive information, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system.

Solution:
Update to version 7 SR2.

Original Advisory:
http://www.ibm.com/developerworks/java/jdk/alerts/

http://secunia.com/advisories/50607/

Citrix XenApp Online Plug-in / Receiver Code Execution Vulnerability

Release Date : 2012-09-12

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Citrix Receiver
Citrix XenApp Online Plug-in 12.x

Description:
A vulnerability has been reported in Citrix XenApp Online Plug-in and Citrix Receiver, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an unspecified error. No further information is currently available.

Successful exploitation may allow execution of arbitrary code, but requires tricking a user into opening a malicious file from an SMB or WebDAV share.

The vulnerability is reported in Citrix Receiver for Windows versions 3.2 and prior and Citrix XenApp Online Plug-in for Windows versions 12.1 and prior.

Solution:
Update to a fixed version.

Provided and/or discovered by:
The vendor credits Alexey Tyurin, Digital Security Research.

Original Advisory:
http://support.citrix.com/article/CTX134681

http://secunia.com/advisories/50536/