Spyware, viruses, & security forum: VULNERABILITIES / FIXES - September 20, 2012

Release Date: 2012-09-20

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System : Ubuntu Linux 10.04

Description:
Ubuntu has issued an update for the kernel. This fixes some vulnerabilities, which can be exploited by malicious, local users and malicious people to cause a DoS (Denial of Service).

Solution:
Apply updated packages.

Original Advisory:
USN-1574-1:
http://www.ubuntu.com/usn/usn-1574-1

http://secunia.com/advisories/50633/

Release Date: 2012-09-20

Criticality level : Highly critical
Impact : Security Bypass
Exposure of sensitive information
Privilege escalation
System access
Where : From remote
Solution Status : Vendor Patch

Operating System : Apple Macintosh OS X

Description:
Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities.

1) Various vulnerabilities exist in the bundled version of Apache.

2) An assertion error in BIND when handling DNS records can be exploited to cause a DoS (Denial of Service).

3) An error in BIND can be exploited to disclose potentially sensitive information or cause a DoS.

4) An error in the CoreText component when handling text glyphs can be exploited to cause a buffer overflow and potentially compromise an application using the component.

5) An error in the DirectoryService Proxy can be exploited to cause a buffer overflow.

6) Errors in the ImageIO component when parsing PNG images can be exploited to corrupt memory.

7) An integer overflow error in the ImageIO component when parsing TIFF images can be exploited to cause a buffer overflow.

8) A previous fix did not properly address an error in the Installer component that allowed users to obtain account information. The original fix ensured that passwords were not recorded to the system log, but did not remove the old system log entries containing passwords.

9) An error in International Components for Unicode (ICU) when handling ICU locale IDs can be exploited to cause a stack-based buffer overflow.

10) A logic error in the kernel when handling debug system calls can be exploited by a malicious program to bypass sandbox restrictions.

11) An error in the LoginWindow component can be exploited by local users to obtain other users' login passwords.

12) An input validation error in Mail can be exploited to execute web plugins when viewing an e-mail message.

13) An error in Mobile Accounts can be exploited by a user with access to the contents of a mobile account to obtain the account password.

14) Multiple errors exist in the bundled version of PHP.

15) An authentication error in Profile Manager Device Management private interface can be exploited to enumerate managed devices.

16) Various errors exist in the bundled versions of QuickLook and QuickTime.

17) An uninitialised memory access error exists in QuickTime when viewing Sorenson-encoded movie files.

18) An error in Ruby may allow decryption of SSL-protected data when a cipher suite uses a block cipher in CBC mode.

19) An error in the USB component can be exploited to corrupt memory by attaching a malicious USB device.

Solution:
Update to version 10.8.2 or 10.7.5 or apply Security Update 2012-004.

Provided and/or discovered by
The vendor credits:
4) Jesse Ruderman, Mozilla Corporation
5) aazubel via ZDI
11) An anonymous person
12, 17) Will Dormann, CERT/CC
13) Harald Wagener, Google
15) Derick Cassidy, XEquals Corporation
19) Andy Davis, NGS Secure

Original Advisory:
Apple:
http://support.apple.com/kb/HT5501

http://secunia.com/advisories/50628/

Release Date: 2012-09-20

Criticality level : Highly critical
Impact : Security Bypass
Exposure of sensitive information
System access
Where : From remote
Solution Status : Vendor Patch

Software: Apple Safari 6.x

Description:
Multiple vulnerabilities have been reported in Safari, which can be exploited by malicious people to bypass certain security restrictions, gain knowledge of sensitive information, or compromise a user's system.

1) A logic error in the handling of the Quarantine attribute when opening HTML documents in safe mode can be exploited to cause the document to not be opened in safe mode and disclose the contents of arbitrary files.

2) An error in the handling of Form Autofill may lead to Address Book "Me" card details being disclosed when using Form Autofill on a specially crafted web page.

3) A logic error when handling HTTPS URLs in the address bar may cause a request to be unexpectedly sent over HTTP if part of the request in the address bar was edited by pasting text.

4) A use-after-free error in the Webkit Cascading Style Sheets (CSS) implementation when handling the :first-letter pseudo-element can be exploited to dereference already freed memory.

5) A use-after-free error in Webkit when handling tables with sections can be exploited to dereference already freed memory.

6) A use-after-free error in Webkit when handling the layout of documents using the Cascading Style Sheets (CSS) counters feature can be exploited to dereference already freed memory.

7) A use-after-free error in the Webkit Cascading Style Sheets (CSS) implementation when handling the :first-letter pseudo-element can be exploited to dereference already freed memory.

8) A use-after-free error in Webkit when handling SVG references can be exploited to dereference already freed memory.

9) A use-after-free error in Webkit when handling counters can be exploited to dereference already freed memory.

10) A use-after-free error in Webkit when handling layout height tracking can be exploited to dereference already freed memory.

11) An unspecified error in Webkit can be exploited to corrupt memory.

12) An unspecified error in Webkit can be exploited to corrupt memory.

13) An unspecified error in Webkit can be exploited to corrupt memory.

14) An unspecified error in Webkit can be exploited to corrupt memory.

15) An unspecified error in Webkit can be exploited to corrupt memory.

16) An unspecified error in Webkit can be exploited to corrupt memory.

17) An unspecified error in Webkit can be exploited to corrupt memory.

18) An unspecified error in Webkit can be exploited to corrupt memory.

19) An unspecified error in Webkit can be exploited to corrupt memory.

20) An unspecified error in Webkit can be exploited to corrupt memory.

21) An unspecified error in Webkit can be exploited to corrupt memory.

22) An unspecified error in Webkit can be exploited to corrupt memory.

23) An unspecified error in Webkit can be exploited to corrupt memory.

24) An unspecified error in Webkit can be exploited to corrupt memory.

25) An unspecified error in Webkit can be exploited to corrupt memory.

26) An unspecified error in Webkit can be exploited to corrupt memory.

27) An unspecified error in Webkit can be exploited to corrupt memory.

28) An unspecified error in Webkit can be exploited to corrupt memory.

29) An unspecified error in Webkit can be exploited to corrupt memory.

30) An unspecified error in Webkit can be exploited to corrupt memory.

31) An unspecified error in Webkit can be exploited to corrupt memory.

32) An unspecified error in Webkit can be exploited to corrupt memory.

33) An unspecified error in Webkit can be exploited to corrupt memory.

34) An unspecified error in Webkit can be exploited to corrupt memory.

35) An unspecified error in Webkit can be exploited to corrupt memory.

36) An unspecified error in Webkit can be exploited to corrupt memory.

37) An unspecified error in Webkit can be exploited to corrupt memory.

38) An unspecified error in Webkit can be exploited to corrupt memory.

39) An unspecified error in Webkit can be exploited to corrupt memory.

40) An unspecified error in Webkit can be exploited to corrupt memory.

41) An unspecified error in Webkit can be exploited to corrupt memory.

42) An unspecified error in Webkit can be exploited to corrupt memory.

43) An unspecified error in Webkit can be exploited to corrupt memory.

44) An unspecified error in Webkit can be exploited to corrupt memory.

45) An unspecified error in Webkit can be exploited to corrupt memory.

46) An unspecified error in Webkit can be exploited to corrupt memory.

47) An unspecified error in Webkit can be exploited to corrupt memory.

48) An unspecified error in Webkit can be exploited to corrupt memory.

49) An unspecified error in Webkit can be exploited to corrupt memory.

50) An unspecified error in Webkit can be exploited to corrupt memory.

51) An unspecified error in Webkit can be exploited to corrupt memory.

52) An unspecified error in Webkit can be exploited to corrupt memory.

53) An unspecified error in Webkit can be exploited to corrupt memory.

54) An unspecified error in Webkit can be exploited to corrupt memory.

55) An unspecified error in Webkit can be exploited to corrupt memory.

56) An unspecified error in Webkit can be exploited to corrupt memory.

57) An unspecified error in Webkit can be exploited to corrupt memory.

58) An unspecified error in Webkit can be exploited to corrupt memory.

59) An unspecified error in Webkit can be exploited to corrupt memory.

60) An unspecified error in Webkit can be exploited to corrupt memory.

61) An unspecified error in Webkit can be exploited to corrupt memory.

Solution:
Update to version 6.0.1.

Provided and/or discovered by:
The vendor credits:
1) Aaron Sigel, vtty.com and Masahiro Yamada
2) Jonathan Hogervorst, Buzzera
3) Aaron Rhoads, East Watch Services LLC and Pepi Zawodsky
4-10, 13) miaubiz
11, 20, 34, 42, 44, 47, 49, 52, 55, 57, 58) Apple Product Security
12) Martin Barbella, Google Chrome Security Team
14, 15, 17, 19, 22, 25, 28, 33, 36, 38-40, 46, 48, 50, 51, 54, 56, 61) Abhishek Arya (Inferno), Google Chrome Security Team
16, 21, 23, 24, 26, 27, 32, 47, 53, 60) Skylined, Google Chrome Security Team
18) Yong Li, Research In Motion
29) Dominic Cooney, Google and Martin Barbella, Google Chrome Security Team
30) Abhishek Arya and Martin Barbella, Google Chrome Security Team
31) Martin Barbella, Google Chrome Security Team
35) Mario Gomes, netfuzzer.blogspot.com and Abhishek Arya (Inferno), Google Chrome Security Team
37) Skylined and Martin Barbella, Google Chrome Security Team
41) Julien Chaffraix, Chromium development community
43, 45) kuzzcc
59) James Robinson of Google

Original Advisory:
Apple:
http://support.apple.com/kb/HT5502

http://secunia.com/advisories/50577/

Release Date : 2012-09-20

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status :Vendor Patch

Operating System : SUSE Linux Enterprise Server (SLES) 10
SUSE Linux Enterprise Server (SLES) 11

Description:
SUSE has issued an update for ghostscript. This fixes a vulnerability, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to an integer underflow error in icclib (icc.c) when handling ICC profiles and can be exploited to cause a heap-based buffer overflow by a specially crafted ICC profile for images embedded in e.g. a postscript or PDF file.

Successful exploitation may allow execution of arbitrary code, but requires tricking a user into opening a malicious file.

Solution:
Apply updated packages via the zypper package manager.

Provided and/or discovered by:
Red Hat credits Marc Schonefeld.

Original Advisory:
SUSE-SU-2012:1222-1:
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00031.html

Red hat Bug#854227:
https://bugzilla.redhat.com/show_bug.cgi?id=854227

http://secunia.com/advisories/50662/

Drupal FileField Sources Module Filename Script Insertion Vulnerability

Release Date : 2012-09-20

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Drupal FileField Sources Module 6.x
Drupal FileField Sources Module 7.x

Description:
Justin C. Klein Keane has reported a vulnerability in the FileField Sources module for Drupal, which can be exploited by malicious users to conduct script insertion attacks.

Certain input related to a filename is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires the ability to upload files on a field that has the "Reference existing" source enabled.

The vulnerability is reported in 6.x-1.x versions prior to 6.x-1.6 and 7.x-1.x versions prior to 7.x-1.6.

Solution:
Update to a fixed version.

Provided and/or discovered by:
Justin C. Klein Keane.

Original Advisory:
SA-CONTRIB-2012-147:
http://drupal.org/node/1789306

Justin:
http://www.madirish.net/539

http://secunia.com/advisories/50688/

Release Date : 2012-09-20

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Operating System : openSUSE 11.4
openSUSE 12.1

Description:
SUSE has issue an update for rubygem-actionpack and rubygem-activesupport. This fixes two vulnerabilities, which can be exploited by malicious people to conduct cross-site scripting attacks.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2012:1218-1:
http://lists.opensuse.org/opensuse-updates/2012-09/msg00083.html

http://secunia.com/advisories/50694/

Release Date : 2012-09-20

Criticality level : Moderately critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Drupal PRH Search Module 7.x

Description:
A vulnerability has been reported in the PRH Search module for Drupal, which can be exploited by malicious people to conduct script insertion attacks.

Certain input passed via the PRH (Patentti- ja Rekisterihallitus) database is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

The vulnerability is reported in versions prior to 7.x-1.1.

Solution:
Update to version 7.x-1.1.

Provided and/or discovered by:
The vendor credits Klaus Purer, Drupal Security Team.

Original Advisory:
SA-CONTRIB-2012-143:
http://drupal.org/node/1789252

http://secunia.com/advisories/50672/

Drupal Imagemenu Module Image Filename Script Insertion Vulnerability

Release Date : 2012-09-20

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Drupal Imagemenu Module 6.x

Description:
A vulnerability has been reported in the Imagemenu module for Drupal, which can be exploited by malicious users to conduct script insertion attacks.

Certain input related to image filenames is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires the "administer imagemenu" permission.

The vulnerability is reported in 6.x-1.x versions prior to 6.x-1.4.

Solution:
Update to version 6.x-1.4.

Provided and/or discovered by:
The vendor credits David Houlder

Original Advisory:
SA-CONTRIB-2012-145:
http://drupal.org/node/1789260

http://secunia.com/advisories/50683/

Release Date : 2012-09-20

Criticality level : Not critical
Impact : DoS
Where : Local system
Solution Status : Vendor Patch

Software: Red Hat Enterprise MRG v2 for Red Hat Enterprise Linux (version 6)

Description:
Red Hat has issued an update for kernel-rt. This fixes a vulnerability, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2012:1282-1:
https://rhn.redhat.com/errata/RHSA-2012-1282.html

http://secunia.com/advisories/50696/

WordPress WP-TopBar Plugin Cross-Site Request Forgery Vulnerability

Release Date : 2012-09-20

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Wordpress WP-TopBar Plugin 4.x

Description:
Blake Entrekin has discovered a vulnerability in the WP-TopBar plugin for WordPress, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. change the message of the TopBar if a logged-in administrative user visits a malicious web site.

Note: This can further be exploited to conduct script insertion attacks.

The vulnerability is reported in version 4.02. Prior versions may also be affected.

Solution:
Update to version 4.03.

Provided and/or discovered by:
Blake Entrekin

Original Advisory:
Blake Entrekin:
http://entresec.blogspot.com/2012/09/wp-topbar-402-csrf-and-stored-xss.html

http://secunia.com/advisories/50693/

WordPress MF Gig Calendar Plugin URL Cross-Site Scripting Vulnerability

Release Date : 2012-09-20

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: WordPress MF Gig Calendar Plugin 0.x

Description:
Reaction Information Security has discovered a vulnerability in the MF Gig Calendar plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via URL (when "page_id" set to the Event Calendar page) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 0.9.4.1. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Chris Cooper and Joseph Sheridan, Reaction Information Security.

Original Advisory:
Reaction Information Security:
http://www.reactionpenetrationtesting.co.uk/mf-gig-calendar-xss.html

http://secunia.com/advisories/50571/