Spyware, viruses, & security forum: VULNERABILITIES / FIXES - October 11, 2012

Symantec Ghost Solution Suite Backup File Parsing Memory Corruption

Release Date : 2012-10-11

Criticality level : Less critical
Impact: System access
Where : From local network
Solution Status : Vendor Patch

Software: Symantec Ghost Solution Suite 2.x

Description:
A vulnerability has been reported in Symantec Ghost Solution Suite, which can be exploited by malicious users to potentially compromise a vulnerable system.

The vulnerability is caused due to an unspecified error when parsing backup files and can be exploited to corrupt memory via a specially crafted backup file placed in the appropriate path on the system.

Successful exploitation may allow execution of arbitrary code.

Solution:
Update to version 2.5.1 and apply patch GSS25x_b2620.

Provided and/or discovered by:
The vendor credits Jeremy Brown, Microsoft.

Original Advisory:
SYM12-016:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121010_00

http://secunia.com/advisories/50953/

Release Date : 2012-10-11

Criticality level : Highly critical
Impact: System access
Where : From remote
Solution Status : Vendor Patch

Software: WebEx Recording Format Player

Description:
Multiple vulnerabilities have been reported in Cisco WebEx Recording Format Player, which can be exploited by malicious people to compromise a user's system.

1) An unspecified error can be exploited to cause a buffer overflow via a specially crafted WRF file.

2) An unspecified error can be exploited to cause a buffer overflow via a specially crafted WRF file.

3) An unspecified error can be exploited to cause a buffer overflow via a specially crafted WRF file.

4) An unspecified error can be exploited to corrupt memory via a specially crafted WRF file.

5) An unspecified error can be exploited to cause a buffer overflow via a specially crafted WRF file.

6) An unspecified error can be exploited to cause a heap-based buffer overflow via a specially crafted WRF file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in the following versions:
* T28 client builds prior to T28.4 (28.4)
* T27 client builds prior to T27LDSP32EP10 (27.32.10)

Solution:
Update to version 28.4 or 27.32.10.

Provided and/or discovered by:
The vendor credits Beyond Security, Core Security, Codenomicon, and TELUS.

Original Advisory:
Cisco:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-webex

http://secunia.com/advisories/50905/

Release Date : 2012-10-11

Criticality level : Moderately critical
Impact: DoS
System access
Where : From local network
Solution Status : Vendor Patch

Software: Cisco Firewall Services Module (FWSM) 4.x

Description:
Some vulnerabilities have been reported in Cisco FWSM (Firewall Services Module) for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

1) Insufficient input validation of transit DCERPC traffic within the DCERPC inspection engine can be exploited to cause a stack-based buffer overflow.

This vulnerability affects versions prior to 4.1(9).

2) Insufficient input validation of transit DCERPC traffic within the DCERPC inspection engine can be exploited to cause a device reload.

This vulnerability affects versions prior to 4.1(7).

3) Insufficient input validation of transit DCERPC traffic within the DCERPC inspection engine can be exploited to cause a device reload.

This vulnerability affects versions prior to 4.1(7).

Solution:
Update to version 4.1(9).

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
CSCtr27522, CSCtr27524, CSCtr27521:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-fwsm

http://secunia.com/advisories/50857/

Release Date : 2012-10-11

Criticality level : Moderately critical
Impact: Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Web Help Desk 11.x

Description:
Two vulnerabilities have been reported in Web Help Desk, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via Subject and Request Details fields in the tickets system is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected product if malicious data is viewed.

The vulnerabilities are reported in version 11.0.7. Prior versions may also be affected.

Solution:
Update to version 11.0.8.

Provided and/or discovered by:
loneferret

Original Advisory:
Web Help Desk:
http://www.webhelpdesk.com/11-0-8-100412/

loneferret:
http://www.exploit-db.com/exploits/21809/

http://secunia.com/advisories/50880/

Drupal ShareThis Module JavaScript Setting Script Insertion Vulnerability

Release Date : 2012-10-11

Criticality level : Less critical
Impact: Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Drupal ShareThis Module 7.x

Description:
A vulnerability has been reported in the ShareThis module for Drupal, which can be exploited by malicious users to conduct script insertion attacks.

Certain input related to JavaScript settings is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires the "administer sharethis" permission.

The vulnerability is reported in 7.x-2.x versions prior to 7.x-2.5.

Solution:
Update to version 7.x-2.5.

Provided and/or discovered by:
The vendor credits Jake Bell.

Original Advisory:
SA-CONTRIB-2012-155:
http://drupal.org/node/1808856

http://secunia.com/advisories/50898/

Release Date : 2012-10-11

Criticality level : Less critical
Impact: Privilege escalation
Where : Local system
Solution Status : Unpatched

Software: ActiveTcl 8.x

Description:
A security issue has been discovered in ActiveTcl, which can be exploited by malicious, local users to perform certain actions with escalated privileges.

The security issue is caused due to the application setting insecure file system permissions on the installation directory and can be exploited to overwrite files (e.g. "C:\Tcl\bin") and execute programs with privileges of another user.

The security issue is confirmed in version 8.5.12.0. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
High-Tech Bridge

http://secunia.com/advisories/50938/

Release Date : 2012-10-11

Criticality level : Less critical
Impact: Privilege escalation
Where : Local system
Solution Status : Unpatched

Software: ActivePython 2.x
ActivePython 3.x

Description:
A security issue has been discovered in ActivePython, which can be exploited by malicious, local users to perform certain actions with escalated privileges.

The security issue is caused due to the application setting insecure file system permissions on the installation directory and can be exploited to overwrite files (e.g. "C:\Python27\" or "C:\Python32\") and execute programs with privileges of another user.

The security issue is confirmed in version 2.7.2.5 and 3.2.2.3. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
High-Tech Bridge

http://secunia.com/advisories/50939/

Release Date : 2012-10-11

Criticality level : Less critical
Impact: Security Bypass
Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Operating System : Ubuntu Linux 10.04
Ubuntu Linux 11.04
Ubuntu Linux 11.10
Ubuntu Linux 12.04

Description:
Ubuntu has issued an update for MoinMoin. This fixes two vulnerabilities, which can be exploited by malicious users to bypass certain security restrictions and by malicious people to conduct cross-site scripting attacks.

Solution:
Apply updated packages.

Original Advisory:
USN-1604-1:
http://www.ubuntu.com/usn/usn-1604-1/

http://secunia.com/advisories/50885/

Release Date : 2012-10-11

Criticality level : Moderately critical
Impact: Cross Site Scripting
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: Drupal Basic webmail Module 6.x

Description:
A weakness and two vulnerabilities have been reported in the Basic webmail module for Drupal, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting and script insertion attacks.

1) An error related to permissions can be exploited to disclose other users email addresses.

Successful exploitation of this weakness requires the "access basic_webmail" permission.

2) Certain input related to the page title is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Certain input passed via emails is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

The weakness and vulnerabilities are reported in 6.x-1.x versions prior to 6.x-1.2.

Solution:
Update to version 6.x-1.2.

Provided and/or discovered by:
Hunter Fox, provisional member of the Drupal Security Team.

Original Advisory:
SA-CONTRIB-2012-154:
http://drupal.org/node/1808852

http://secunia.com/advisories/50902/