Spyware, viruses, & security forum: VULNERABILITIES / FIXES - November 06, 2012

Apache Tomcat Security Bypass and Denial of Service Vulnerabilities

Release Date: 2012-11-06

Criticality level : Moderately critical
Impact: Security Bypass
DoS
Where : From remote
Solution Status : Vendor Patch

Software: Apache Tomcat 5.x
Apache Tomcat 6.x
Apache Tomcat 7.x

Description:
A weakness and a vulnerability have been reported in Apache Tomcat, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service).

1) An error within the "parseHeaders()" function (InternalNioInputBuffer.java) when parsing request headers does not properly verify the permitted size and can be exploited to trigger an OutOfMemoryError exception via specially crafted headers.

This vulnerability is reported in versions 6.0.0-6.0.35 and 7.0.0-7.0.27.

2) An error within DIGEST authentication mechanism does not properly check server nonces.

This weakness is reported in versions 5.5.0-5.5.35, 6.0.0-6.0.35, and 7.0.0-7.0.29.

Solution:
Update to version 5.5.36, 6.0.36, or 7.0.30.

Provided and/or discovered by:
1) The vendor credits Josh Spiewak.
2) The vendor credits Tilmann Kuhn.

Original Advisory:
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.30
http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36
http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.36

http://secunia.com/advisories/51138/

Release Date: 2012-11-06

Criticality level : Moderately critical
Impact: System access
Where : From remote
Solution Status : Vendor Patch

Operating System : Ubuntu Linux 12.04

Description:
Ubuntu has issued an update for mesa. This fixes a vulnerability, which can be exploited by malicious people to compromise an application using the library.

Solution:
Apply updated packages.

Original Advisory:
USN-1623-1:
http://www.ubuntu.com/usn/usn-1623-1/

http://secunia.com/advisories/51215/

Release Date: 2012-11-06

Criticality level : Less critical
Impact: Spoofing
Where : From remote
Solution Status : Unpatched

Software: Apache Axis 1.x
Apache Axis2/Java 1.x

Description:
A security issue has been reported in Apache Axis, which can be exploited by malicious people to conduct spoofing attacks.

The security issue is caused due to the server hostname not being validated against the domain name in the subject's Common Name (CN) or subjectAltName fields of X.509 certificates. This can be exploited to spoof a SSL server via e.g. Man-in-the-Middle (MitM) attacks.

The security issue is reported in the following products:
* Apache Axis version 1.4.
* Apache Axis2/Java version 1.6.2.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Reported at the ACM CCS 2012 conference.

Original Advisory:
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

http://secunia.com/advisories/51219/

Release Date: 2012-11-06

Criticality level : Less critical
Impact: Spoofing
Where : From remote
Solution Status : Unpatched

Software: Python tweepy Module 1.x

Description:
A security issue has been reported in Python tweepy Module, which can be exploited by malicious people to conduct spoofing attacks.

The security issue is reported version 1.11. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Reported at the ACM CCS 2012 conference.

Original Advisory:
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

http://secunia.com/advisories/51223/

VeriCentre Web Console Multiple SQL Injection Vulnerabilities

Release Date: 2012-11-06

Criticality level : Less critical
Impact: Manipulation of data
Where : From remote
Solution Status : Vendor Patch

Software: VeriCentre Web Console 2.x

Description:
Multiple vulnerabilities have been reported in VeriCentre Web Console, which can be exploited by malicious users to conduct SQL injection attacks.

Input passed via the "TerminalId", "ModelName", and "ApplicationName" parameters to WebConsole/terminal/paramedit.aspx is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are reported in versions prior to 2.2 build 36.

Solution:
Update to version 2.2 build 36 or higher.

Provided and/or discovered by:
Cory Eubanks, Clear Skies Security LLC.

Original Advisory:
US-CERT:
http://www.kb.cert.org/vuls/id/180091

Clear Skies Security:
http://www.clearskies.net/documents/css-advisory-css1211-vericentre.pdf

http://secunia.com/advisories/51122/