Spyware, viruses, & security forum: VULNERABILITIES / FIXES - October 09, 2012

Release Date : 2012-10-09

Criticality level : Highly critical
Impact: System access
Where : From remote
Solution Status : Vendor Patch

Software: Adobe AIR 3.x
Adobe Flash Player 11.x

Description:
Multiple vulnerabilities have been reported in Adobe Flash Player and Adobe AIR, which can be exploited by malicious people to compromise a user's system.

1) Some unspecified errors can be exploited to cause buffer overflows. No further information is currently available.

2) Some unspecified errors can be exploited to corrupt memory. No further information is currently available.

3) Another unspecified error can be exploited to corrupt memory. No further information is currently available.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in the following versions:
* Adobe Flash Player versions 11.4.402.278 and prior for Windows
* Adobe Flash Player versions 11.4.402.265 and prior for Macintosh
* Adobe Flash Player versions 11.2.202.238 and prior for Linux
* Adobe Flash Player versions 11.1.115.17 and prior for Android 4.x
* Adobe Flash Player versions 11.1.111.16 and prior for Android 3.x and 2.x
* Adobe AIR versions 3.4.0.2540 and prior for Windows and Macintosh, SDK (includes AIR for iOS), and for Android

Solution:
Update to a fixed version.

Provided and/or discovered by:
The vendor credits:
1, 2) Mateusz Jurczyk, Gynvael Coldwind, and Fermin Serna, Google Security Team.
3) Dark Son, Code Audit Labs

Original Advisory:
http://www.adobe.com/support/security/bulletins/apsb12-22.html

http://secunia.com/advisories/50876/

Release Date : 2012-10-09

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Icy Phoenix 2.x

Description:
A vulnerability has been discovered in Icy Phoenix, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "subject" parameter to contact_us.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is confirmed in version 2.0. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Kurdish hackers team

Original Advisory:
http://packetstorm.codar.com.br/1210-exploits/icyphoenix2-xss.txt

http://secunia.com/advisories/50890/

Interspire Email Marketer "Action" Cross-Site Scripting Vulnerability

Release Date : 2012-10-09

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Interspire Email Marketer 6.x

Description:
Ibrahim El-Sayed has reported a vulnerability in Interspire Email Marketer, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "Action" parameter in admin/index.php (when "Page" is set to "Addons" and "Addon" is set to "dynamiccontenttags") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in version 6.0.1. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Ibrahim El-Sayed (the_storm), Vulnerability Lab

Original Advisory:
http://www.vulnerability-lab.com/download_content.php?id=710

http://secunia.com/advisories/50815/

Release Date : 2012-10-09

Criticality level : Less critical
Impact : Privilege escalation
DoS
Where : Local system
Solution Status : Vendor Patch

Operating System : Ubuntu Linux 8.04

Description:
Ubuntu has issued an update for the kernel. This fixes a vulnerability, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and potentially gain escalated privileges.

Solution:
Apply updated packages.

Original Advisory:
USN-1598-1:
http://www.ubuntu.com/usn/usn-1598-1/

http://secunia.com/advisories/50807/

Release Date : 2012-10-09

Criticality level : Less critical
Impact : Privilege escalation
Where : Local system
Solution Status : Vendor Patch

Operating System : Ubuntu Linux 12.04

Description:
Ubuntu has issued an update for kernel. This fixes a vulnerability, which can be exploited by malicious, local users to perform certain actions with escalated privileges.

Solution:
Apply updated packages.

Original Advisory:
USN-1599-1:
http://www.ubuntu.com/usn/usn-1599-1/

http://secunia.com/advisories/50848/

Zen Cart "zen_get_all_get_params()" Cross-Site Scripting Vulnerability

Release Date : 2012-10-09

Criticality level : Less critical
Impact: Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Zen Cart 1.x

Description:
Stefan Schurtz has discovered a vulnerability in Zen Cart, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via arbitrary parameter names and values to e.g. login.php in the admin section is not properly sanitised in the "zen_get_all_get_params()" function (admin/includes/functions/general.php) before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires knowledge of the administration section URL.

The vulnerability is confirmed in version 1.5.1. Other versions may also be affected.

Solution:
Apply patch.

Provided and/or discovered by:
Stefan Schurtz via Secunia.

Original Advisory:
http://www.zen-cart.com/showthread.php?200947-XSS-Flaw-Patch

http://secunia.com/advisories/50574/

Fujitsu Interstage HTTP Server "httpOnly" Cookie Information Disclosure Vulnerability

Release Date : 2012-10-09

Criticality level : Less critical
Impact: Exposure of sensitive information
Where : From remote
Solution Status : Vendor Workaround

Software: Interstage Application Server 10.x
Interstage Application Server 5.x
Interstage Application Server 6.x
Interstage Application Server 7.x
Interstage Application Server 8.x
Interstage Application Server 9.x
Interstage Apworks 6.x
Interstage Apworks 7.x
Interstage Business Application Server 8.x
Interstage Job Workload Server 8.x
Interstage Studio 10.x
Interstage Studio 8.x
Interstage Studio 9.x

Description:
Fujitsu has acknowledged a vulnerability in Interstage HTTP Server, which can be exploited by malicious people to disclose potentially sensitive information.

Please see the vendor's advisory for a list of affected products.

Solution:
Apply the recommended workaround (please see the vendor's advisory for details).

Original Advisory:
http://www.fujitsu.com/global/support/software/security/products-f/interstage-201203e.html

http://secunia.com/advisories/50840/

Microsoft Windows Kerberos Session Handling Denial of Service Vulnerability

Release Date : 2012-10-09

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System : Microsoft Windows 7
Microsoft Windows Server 2008

Description:
A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious users to cause a DoS (Denial of Service).

The vulnerability is caused due to a NULL pointer dereference error within the Kerberos implementation when handling session requests and can be exploited to restart the system via a specially crafted session request.

Solution:
Apply updates.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
MS12-069 (KB2743555):
http://technet.microsoft.com/en-us/security/bulletin/ms12-069

http://secunia.com/advisories/50867/

Release Date : 2012-10-09

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Microsoft SQL Server 2000
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition
Microsoft SQL Server 2008
Microsoft SQL Server 2012

Description:
A vulnerability has been reported in Microsoft SQL Server, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input is not properly sanitised within the SQL Server Report Manager before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution:
Apply patches.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
MS12-070 (KB983814, KB2716429, KB2716427, KB2716434, KB2716433, KB2716436, KB2716435, KB2716440, KB2716439, KB2716442, KB2716441):
http://technet.microsoft.com/en-us/security/bulletin/ms12-070

http://secunia.com/advisories/50901/

Microsoft Works DOC File Processing Memory Corruption Vulnerability

Release Date : 2012-10-09

Criticality level : Highly critical
Impact: System access
Where : From remote
Solution Status : Vendor Patch

Software: Microsoft Works 9.x

Description:
A vulnerability has been reported in Microsoft Works, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an unspecified error when processing Word files and can be exploited to corrupt memory via a specially crafted DOC file.

Successful exploitation may allow execution of arbitrary code, but requires tricking a user into opening a malicious file.

Solution:
Apply patches.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
MS12-065 (KB2754670):
http://technet.microsoft.com/en-us/security/bulletin/ms12-065

http://secunia.com/advisories/50844/