Spyware, viruses, & security forum: VULNERABILITIES / FIXES - December 14, 2012

MyBB Facebook profile link on Postbit Plugin Script Insertion Vulnerability

Release Date : 2012-12-14

Criticality level : Moderately critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Facebook profile link on Postbit 2.x (plugin for MyBB)

Description:
A vulnerability has been discovered in the Facebook profile link on Postbit plugin for MyBB, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via the Facebook id/nickname field when editing profile details is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

The vulnerability is confirmed in version 2.4. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
limb0

Original Advisory:
limb0:
http://www.exploit-db.com/exploits/23355/

http://secunia.com/advisories/51554/

MyBB DyMy User Agent Plugin "User-Agent" SQL Injection Vulnerability

Release Date : 2012-12-14

Criticality level : Moderately critical
Impact : Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: DyMy User Agent 0.x (plugin for MyBB)

Description:
A vulnerability has been discovered in the DyMy User Agent plugin for MyBB, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "User-Agent" HTTP header when e.g. posting a new reply is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is confirmed in version 0.1.3. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
JoinSe7en

Original Advisory:
JoinSe7en:
http://www.exploit-db.com/exploits/23359/

http://secunia.com/advisories/51565/

VMware View Connection/Security Server Directory Traversal Vulnerability

Release Date: 2012-12-14

Criticality level : Moderately critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: VMware View 4.x
VMware View 5.x

Description:
A vulnerability has been reported in VMware View, which can be exploited by malicious people to disclose sensitive information.

The vulnerability is caused due to an error within the View Connection Server and View Security Server and can be exploited to disclose arbitrary files via directory traversal attacks.

The vulnerability is reported in versions prior to 5.1.2 and 4.6.2.

Solution:
Update to version 5.1.2 or 4.6.2.

Provided and/or discovered by:
The vendor credits Digital Defense, Inc. Vulnerability Research Team.

Original Advisory:
http://www.vmware.com/security/advisories/VMSA-2012-0017.html

http://secunia.com/advisories/51597/

WordPress Welcart e-Commerce Plugin Cross-Site Scripting and Request Forgery Vulnerabilities

Release Date: 2012-12-14

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Welcart e-Commerce Plugin 1.x

Description:
Multiple vulnerabilities have been reported in the Welcart e-Commerce plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks.

1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain unspecified actions if a logged-in administrative user visits a malicious web site.

The vulnerabilities are reported in versions 1.2.1 and prior.

Solution:
Update to version 1.2.2.

Provided and/or discovered by:
Yoshinori Matsumoto, Kobe Digital Lab via JVN.

Original Advisory:
Welcart (Japanese):
http://www.welcart.com/community/archives/4524

JVN:
http://jvn.jp/en/jp/JVN18731696/index.html
http://jvn.jp/en/jp/JVN53269985/index.html
http://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000108.html
http://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000109.html

http://secunia.com/advisories/51581/

IBM Rational ClearCase OpenSSL TLS Integer Underflow Denial of Service Vulnerability

Release Date: 2012-12-14

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Software: IBM Rational ClearCase 7.x
IBM Rational ClearCase 8.x

Description:
IBM has acknowledged a vulnerability in IBM Rational ClearCase, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a bundled vulnerable version of OpenSSL.

The vulnerability is reported in versions prior to 8.0.0.5 and 7.1.2.9.

Solution:
Update to version 8.0.0.5 or 7.1.2.9.

Original Advisory:
http://www.ibm.com/support/docview.wss?uid=swg21620340

http://secunia.com/advisories/51595/

IBM Rational ClearQuest Web Client Cross-Site Scripting Vulnerability

Release Date: 2012-12-14

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: IBM Rational ClearQuest 7.x
IBM Rational ClearQuest 8.x

Description:
A vulnerability has been reported in IBM Rational ClearQuest, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input passed to the OSLC interface system in the ClearQuest Web (CQ Web) client is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site.

The vulnerability is reported in versions prior to 7.1.2.9 and 8.0.0.5.

Solution:
Update to version 7.1.2.9 or 8.0.0.5.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
IBM (PM72905):
http://www.ibm.com/support/docview.wss?uid=swg21620342

http://secunia.com/advisories/51598/

SnackAmp Music Player File Processing Buffer Overflow Vulnerabilities

Release Date: 2010-08-30
Last Update : 2012-12-14

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: SnackAmp Music Player 3.x

Description:
Two vulnerabilities have been discovered in SnackAmp Music Player, which can be exploited by malicious people to compromise a user's system.

1) A boundary error when parsing SMP files can be exploited to cause a stack-based buffer overflow via a specially crafted file.

2) A boundary error when parsing WAV and AIFF files can be exploited to cause a heap-based buffer overflow via a specially crafted file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are confirmed in versions 3.1.2 and 3.1.3. Other versions may also be affected.

Solution:
Do not open untrusted files.

Provided and/or discovered by:
James Fitts

Original Advisory:
http://www.exploit-db.com/exploits/14831/
http://www.exploit-db.com/exploits/14832/
http://www.exploit-db.com/exploits/18692/

http://secunia.com/advisories/41144