Spyware, viruses, & security forum: VULNERABILITIES / FIXES - December 21, 2012

Release Date : 2012-12-21

Criticality level : Moderately critical
Impact Security Bypass
Manipulation of data
System access
Where : From local network
Solution Status Vendor Patch

Software: CA Identity Manager 12.x

Description:
Two vulnerabilities have been reported in CA IdentityMinder, which can be exploited by malicious people to bypass certain security restrictions, manipulate certain data or compromise a vulnerable system.

1) An unspecified error can be exploited to manipulate certain data or execute arbitrary commands. No further information is currently available.

2) An unspecified error can be exploited to gain elevated access. No further information is currently available.

The vulnerabilities are reported in versions r12.0, r12.5 prior to SP15, and r12.6 GA.

Solution:
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
CA20121220-01:
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={FBA53B61-3A68-4506-9876-F845F6DD8A93}

http://secunia.com/advisories/51320/

Release Date : 2012-12-21

Criticality level : Less critical
Impact: Dos
Where : From remote
Solution Status :Vendor Patch

Software: Fuse ESB Enterprise 7.x

Description:
Red Hat has issued an update for Fuse ESB Enterprise. This fixes two vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service).

Solution:
Update to version 7.1.0.

Original Advisory:
RHSA-2012:1604-01:
https://rhn.redhat.com/errata/RHSA-2012-1604.html

http://secunia.com/advisories/51659/

VMware vCenter Server Appliance Two Information Disclosure Vulnerabilities

Release Date : 2012-12-21

Criticality level : Less critical
Impact: Exposure of sensitive information
Where : From local network
Solution Status : Vendor Patch

Software: VMware vCenter Server Appliance 5.x

Description:
Two vulnerabilities have been reported in VMware vCenter Server Appliance, which can be exploited by malicious users to disclose certain sensitive information.

1) Certain unspecified input is not properly verified before being used to access files. This can be exploited to disclose the contents of arbitrary files via directory traversal sequences.

This vulnerability is reported in versions 5.1 and 5.0.

2) Certain unspecified input passed via XML files is not properly verified before being used to download files. This can be exploited to download arbitrary files.

This vulnerability is reported in version 5.0.

Solution:
Apply patches.

Provided and/or discovered by:
The vendor credits Alexander Minozhenko, ERPScan.

Original Advisory:
http://www.vmware.com/security/advisories/VMSA-2012-0018.html

http://secunia.com/advisories/46859/

Release Date : 2012-12-20

Criticality level : Highly critical
Impact : DoS
System access
Where: From remote
Solution Status : Vendor Patch

Software: IBM InfoSphere Streams 1.x
IBM InfoSphere Streams 2.x
IBM InfoSphere Streams 3.x

Description:
IBM has acknowledged multiple vulnerabilities in IBM InfoSphere Streams, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

The vulnerabilities are reported in versions 1.2, 2.0, and 3.0.

Solution:
Apply patch.

Original Advisory:
https://www.ibm.com/support/docview.wss?uid=swg21620575
https://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_potential_security_exposure_when_using_ibm_infosphere_streams_due_to_vulnerabilities_in_ibm_java_se_version_6_sdk6

http://secunia.com/advisories/51657/

Release Date : 2012-12-20

Criticality level : Highly critical
Impact Unknown
DoS
System access
Where From remote
Solution Status : Vendor Patch

Operating System : Ubuntu Linux 11.10

Description:
Ubuntu has issued an update for libav. This fixes multiple vulnerabilities, where some have an unknown impact and others can be exploited by malicious people to compromise an application using the library.

Solution:
Apply updated packages.

Original Advisory:
USN-1674-1:
http://www.ubuntu.com/usn/usn-1674-1/

http://secunia.com/advisories/51643/

IBM Tivoli Remote Control / IBM Tivoli Endpoint Manager for Remote Control Java Multiple Vulnerabilities

Release Date : 2012-12-20

Criticality level : Highly critical
Impact : Security Bypass
System access
Where: From remote
Solution Status : Vendor Patch

Software: IBM Tivoli Endpoint Manager 8.x
IBM Tivoli Remote Control 5.x

Description:
IBM has acknowledged multiple vulnerabilities in IBM Tivoli Remote Control and IBM Tivoli Endpoint Manager for Remote Control, which can be exploited by malicious people to bypass certain security restrictions and compromise a user's system.

The vulnerabilities are reported in IBM Tivoli Remote Control version 5.1.2 and IBM Tivoli Endpoint Manager for Remote Control version 8.2.

Solution:
Apply fixes.

Original Advisory:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21616594
http://www.ibm.com/support/docview.wss?uid=swg24034117
http://www.ibm.com/support/docview.wss?uid=swg21616584
http://www.ibm.com/support/docview.wss?uid=swg24034115
https://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_tivoli_remote_control_5_1_2_clients_affected_by_vulnerabilities_in_ibm_jre_cve_2012_4820_cve_2012_4821_cve_2012_4822_cve_2012_48237

http://secunia.com/advisories/51584/