Spyware, viruses, & security forum: VULNERABILITIES / FIXES - December 19, 2012

Oracle Solaris Apache HTTP Server LD_LIBRARY_PATH and Cross-Site Scripting Vulnerabilities

Release Date : 2012-12-19

Criticality level : Less critical
Impact : Cross Site Scripting
Privilege escalation
Where : From remote
Solution Status : Vendor Patch

Operating System : Oracle Solaris 11.x
Sun Solaris 10.x

Description:
Oracle has acknowledged a security issue and a vulnerability in Apache HTTP Server included in Solaris, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to conduct cross-site scripting attacks.

Solution:
Apply patch.

Original Advisory:
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_apache_http2

http://secunia.com/advisories/51575/

Release Date: 2012-12-19

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status: Vendor Patch

Operating System : Red Hat Enterprise Linux Desktop 5
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 5
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6
RHEL Desktop Workstation 5

Description:
Red Hat has issued an update for libtiff. This fixes multiple vulnerabilities, which can be exploited by malicious people to compromise a user's system.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2012:1590-1:
https://rhn.redhat.com/errata/RHSA-2012-1590.html

http://secunia.com/advisories/51582/

MyBB MyTube Plugin "profile_fields[]" Script Insertion Vulnerability

Release Date: 2012-12-19

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status: Unpatched

Software: MyTube 1.x (plugin for MyBB)

Description:
A vulnerability has been discovered in MyTube plugin for MyBB, which can be exploited by malicious users to conduct script insertion attacks.

Input passed via the "profile_fields[]" parameter to usercp.php (when parameter index is set to a valid value) is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

The vulnerability is confirmed in version 1.0. Other versions may be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Kim Kun Bum

Original Advisory:
http://www.exploit-db.com/exploits/23470/

http://secunia.com/advisories/51600/

IronJacamar Security Domains "allow-multiple-users" Security Bypass

Release Date: 2012-12-19

Criticality level: Less critical
Impact : Security Bypass
Where : From remote
Solution Status : Vendor Patch

Software: IronJacamar 1.x

Description:
A security issue has been reported in IronJacamar, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to the application improperly validating credentials when using the "allow-multiple-users" option with security domains and can be exploited to gain access to a valid connection by using invalid credentials.

The security issue is reported in versions prior to 1.0.12.

Solution:
Update to version 1.0.12.

Provided and/or discovered by:
Red Hat credits Arun Neelicattu of the Red Hat Security Response Team.

Original Advisory:
IronJacamar:
https://issues.jboss.org/browse/JBJCA-864
https://issues.jboss.org/browse/JBJCA/fixforversion/12319522

Red Hat Bug#843358:
https://bugzilla.redhat.com/show_bug.cgi?id=843358

http://secunia.com/advisories/51550/

MyBB Profile Xbox Live ID Plugin "xli" SQL Injection and Script Insertion Vulnerabilities

Release Date: 2012-12-19

Criticality level : Moderately critical
Impact : Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status: Unpatched

Software: Profile Xbox Live ID 1.x (plugin for MyBB)

Description:
Two vulnerabilities have been discovered in the Profile Xbox Live ID plugin for MyBB, which can be exploited by malicious users to conduct script insertion and SQL injection attacks.

1) Input passed via the "xli" POST parameter to usercp.php is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

2) Input passed via the "xli" POST parameter to usercp.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are confirmed in version 1.0. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
1) limb0
2) n3urot0xin

Original Advisory:
limb0:
http://packetstormsecurity.org/files/118927/MyBB-Xbox-Live-ID-Cross-Site-Scripting.html

n3urot0xin:
http://1337day.com/exploit/20001

http://secunia.com/advisories/51620/

IBM Tivoli Storage Manager for Space Management Two Vulnerabilities

Release Date: 2012-12-19

Criticality level: Less critical
Impact : Manipulation of data
Privilege escalation
Where : From local network
Solution Status : Vendor Patch

Software: IBM Tivoli Storage Manager for Space Management 6.x

Description:
Two vulnerabilities have been reported in IBM Tivoli Storage Manager for Space Management, which can be exploited by malicious, local users to perform certain actions with escalated privileges and by malicious users to manipulate certain data.

1) An unspecified error can be exploited by a local user to access and manipulate arbitrary files.

2) An unspecified error can be exploited to access and manipulate files managed by the application.

The vulnerabilities are reported in versions prior to 6.2.5.0 and 6.3.1.0.

Solution:
Update to version 6.2.5.0 (when available) or 6.3.1.0.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
IBM (IC86724, IC87006):
http://www.ibm.com/support/docview.wss?uid=swg21615292

http://secunia.com/advisories/51623/

phpwcms "preg_replace()" Arbitrary Code Execution Vulnerabilities

Release Date: 2012-12-19

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status: Unpatched

Software: phpwcms 1.x

Description:
aeon has discovered multiple vulnerabilities in phpwcms, which can be exploited by malicious users to compromise a vulnerable system.

Input passed via the "article_summary" POST parameter to phpwcms.php (when "do" is set to "articles", "p" is set to "2", and "s" is set to "1") is not properly sanitised in the include/inc_front/content.func.inc.php and include/inc_front/front.func.inc.php scripts before calling the "preg_replace()" function with the "e" modifier. This can be exploited to execute arbitrary PHP code.

Successful exploitation requires a "backend" or "frontend / backend" user account.

The vulnerabilities are confirmed in version 1.5.4.6. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
aeon

Original Advisory:
aeon:
https://infosecabsurdity.wordpress.com/2012/12/17/phpwcms-remote-code-execution-and-php-pcre-filter-evasion-bypasses-zeroday/

http://secunia.com/advisories/51588/