Spyware, viruses, & security forum: VULNERABILITIES / FIXES - September 17, 2012

Release Date : 2012-09-17

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: OptiPNG 0.x

Description:
A vulnerability has been reported in OptiPNG, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to a use-after-free error related to the palette reduction functionality. No further information is currently available.

Success exploitation may allow execution of arbitrary code.

The vulnerability is reported in version 0.7, 0.7.1, and 0.7.2.

Solution:
Update to version 0.7.3.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://sourceforge.net/news/?group_id=151404

http://secunia.com/advisories/50654/

Release Date : 2012-09-17

Criticality level : Highly critical
Impact : Manipulation of data
Exposure of sensitive information
DoS
System access
Where : From remote
Solution Status : Vendor Patch

Operating System : SUSE Linux Enterprise Server (SLES) 10
SUSE Linux Enterprise Server (SLES) 11

Description:
SUSE has issued an update for java-1_4_2-ibm. This fixes multiple vulnerabilities, which can be exploited by malicious, local users to disclose potentially sensitive information and by malicious people to manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
SUSE-SU-2012:1177-1:
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00020.html

http://secunia.com/advisories/50659/

Release Date : 2012-09-17

Criticality level : Less critical
Impact : Privilege escalation
DoS
Where : Local system
Solution Status : Vendor Patch

Operating System : openSUSE 11.4

Description:
SUSE has issued an update for xen. This fixes multiple vulnerabilities, which can be exploited by malicious, local users in a guest virtual machine to cause a DoS (Denial of Service) and potentially gain escalated privileges.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:1174-1:
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html

http://secunia.com/advisories/50653/

Release Date : 2012-09-17

Criticality level : Less critical
Impact : Privilege escalation
Where : Local system
Solution Status : Vendor Patch

Operating System : openSUSE 11.4
openSUSE 12.1

Description:
SUSE has issued an update for qemu. This fixes a vulnerability, which can be exploited by malicious, local users in a guest virtual machine to potentially gain escalated privileges.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:1170-1:
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00016.html

http://secunia.com/advisories/50632/

Release Date : 2012-09-17

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System : Ubuntu Linux 11.04

Description:
Ubuntu has issued an update for the kernel. This fixes some vulnerabilities, which can be exploited by malicious, local users and malicious people to cause a DoS (Denial of Service).

Solution:
Apply updated packages.

Original Advisory:
USN-1567-1:
http://www.ubuntu.com/usn/usn-1567-1/

http://secunia.com/advisories/50650/

Release Date : 2012-09-17

Criticality level : Moderately critical
Impact : Security Bypass
Exposure of system information
Where : From remote
Solution Status : Vendor Patch

Software: Moodle 2.1.x
Moodle 2.2.x
Moodle 2.3.x

Description:
A weaknesses and some security issues have been reported in Moodle, which can be exploited by malicious users to bypass certain security restrictions and by malicious people to disclose certain system information and bypass certain security restrictions.

1) The application does not properly restrict access to certain actions and can be exploited to show and hide topics and setting the current topic.

Successful exploitation of this security issue requires course editing capabilities.

This security issue is reported in versions 2.3 through 2.3.1+ and 2.2 through 2.2.4+.

2) The application does not verify the publication state of a blog when handling embedded files and can be exploited to access embedded files of an unpublished blog.

3) An error due to the application not properly verifying a certain permission can be exploited to reset a course by directly accessing the reset page.

4) The application does not properly restrict access to certain functions when using a web service token linked to certain external services and can be exploited to access otherwise restricted functionality.

The security issues #2 through #4 are reported in versions 2.3 through 2.3.1+, 2.2 through 2.2.4+, and 2.1 through 2.1.7+.

5) The application displays the full installation path within an error message when handling malformed requests in theme/yui_combo.php.

This weakness is reported in versions 2.3 through 2.3.1+.

Solution:
Update to version 2.1.8, 2.2.5, or 2.3.2.

Provided and/or discovered by:
The vendor credits:
1) Alexander Bias
2) Kyle Decot
3) Rex Lorenzo
4) Nathan Mares
5) Mark Baseggio

Original Advisory:
Moodle (MSA-12-0052, MSA-12-0053, MSA-12-0054, MSA-12-0055, MSA-12-0056):
http://moodle.org/mod/forum/discuss.php?d=211556
http://moodle.org/mod/forum/discuss.php?d=211557
http://moodle.org/mod/forum/discuss.php?d=211558
http://moodle.org/mod/forum/discuss.php?d=211559
http://moodle.org/mod/forum/discuss.php?d=211560

http://secunia.com/advisories/50588/

Release Date : 2012-09-17

Criticality level : Less critical
Impact : DoS
System access
Where : From remote
Solution Status : Vendor Patch

Operating System : Debian GNU/Linux 6.0

Description:
Debian has issued an update for devscripts. This fixes some weaknesses, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.

1) Certain input passed to the dverify script is not properly verified before being used as arguments for external commands and can be exploited to execute arbitrary code via a specially crafted source package.

2) Certain input passed to the dget script is not properly verified when processing .dsc and .changes files and can be exploited to delete arbitrary files via a specially crafted source package.

3) Certain input passed to the dget script is not properly sanitised when processing .dsc and .changes files and can be exploited to execute arbitrary code via a specially crafted source package.

4) A race condition error in the annotate-output script when handling temporary files can be exploited to manipulate arbitrary files via symbolic link attacks.

Solution:
Apply updated packages via the apt-get package manager.

Provided and/or discovered by:
The vendor credits:
1 - 3) Raphael Geissert
4) Jim Meyering, Red Hat

Original Advisory:
DSA-2549-1:
http://www.debian.org/security/2012/dsa-2549

http://secunia.com/advisories/50600/

Release Date : 2012-09-17

Criticality level : Less critical
Impact : Cross Site Scripting
Manipulation of data
System access
Where : From remote
Solution Status : Unpatched

Software: Auxilium PetRatePro

Description:
Multiple vulnerabilities have been discovered in Auxilium PetRatePro, which can be exploited by malicious people to conduct cross-site request and SQL injection attacks and compromise a vulnerable system.

1) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. create an arbitrary user with administrative privileges if a logged-in administrative user visits a malicious web site.

2) Input passed via the "phid" parameter to viewcomments.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3) An error due to the admin/sitebanners/upload_banners.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a PHP file

Solution:
No official solution is currently available.

Provided and/or discovered by:
DaOne

Original Advisory:
http://www.exploit-db.com/exploits/21329/

http://secunia.com/advisories/50617/