Spyware, viruses, & security forum: VULNERABILITIES / FIXES - December 24, 2012

Release Date : 2012-12-24

Criticality level : Highly critical
Impact : Exposure of sensitive information
Privilege escalation
DoS
System access
Where : From remote
Solution Status : Vendor Patch

Operating System: pfSense 2.x

Description:
pfSense has acknowledged multiple vulnerabilities in pfSense, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to disclose potentially sensitive information, cause a DoS (Denial of Service), and potentially compromise an application using the library.

The vulnerabilities are reported in versions prior to 2.0.2.

Solution:
Update to version 2.0.2.

Original Advisory:
http://blog.pfsense.org/?p=676

http://secunia.com/advisories/51674/

WordPress Clockstone Theme upload.php Arbitrary File Upload Vulnerability

Release Date : 2012-12-24

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: WordPress Clockstone Theme 1.x

Description:
DigiP has reported a vulnerability in the Clockstone theme for WordPress, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the wp-content/themes/clockstone/theme/functions/upload.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.

The vulnerability is reported in versions 1.2 and prior.

Solution:
Reportedly fixed by the vendor (please contact the vendor for details).

Provided and/or discovered by:
DigiP

Original Advisory:
http://www.attack-scanner.com/security/clockstone-and-other-various-cmsmasters-themes-flaw-patched/

http://secunia.com/advisories/51619/

Hero Framework Cross-Site Scripting and Request Forgery Vulnerabilities

Release Date : 2012-12-24

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Hero Framework 3.x

Description:
Stefan Schurtz has discovered multiple vulnerabilities in Hero Framework, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks.

1) Input passed to the "q" parameter in search and "username" parameter in users/login (when "errors" is set to "true") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. change the first and last name of users if a logged-in user visits a malicious web site.

Note: This can further be exploited to conduct script insertion attacks.

The vulnerabilities are confirmed in version 3.76. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Stefan Schurtz

Original Advisory:
http://www.darksecurity.de/index.php?/227-SSCHADV2012-023-Hero-Framework-3.76-Cross-site-Scripting-vulnerability.html

http://secunia.com/advisories/51668/

Novell iPrint Client "op-client-interface-version" Code Execution Vulnerability

Release Date : 2012-12-24

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Novell iPrint Client 5.x

Description:
A vulnerability has been reported in Novell iPrint Client, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an unspecified error when handling the "op-client-interface-version" parameter. No further information is currently available.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in versions prior to 5.82.

Solution:
Update to version 5.82

Provided and/or discovered by:
The vendor credits Brian Gorenc, HP DVLabs.

Original Advisory:
Novell:
http://www.novell.com/support/kb/doc.php?id=7008708

http://secunia.com/advisories/51616/

Release Date : 2012-12-24

Criticality level : Highly critical
Impact : Cross Site Scripting
Spoofing
Manipulation of data
Exposure of sensitive information
DoS
System access
Where : From remote
Solution Status : Vendor Patch

Software: IBM Rational Synergy 7.x

Description:
IBM has acknowledged some vulnerabilities in IBM Rational Synergy, which can be exploited by malicious people to conduct spoofing and cross-site scripting attacks, disclose potentially sensitive information, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system.

The vulnerabilities are reported in versions prior to 7.1.0.7.

Solution:
Update to version 7.1.0.7.

Original Advisory:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21618977

http://secunia.com/advisories/51681/

Release Date : 2012-12-24

Criticality level : Moderately critical
Impact : System access
DoS
Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Novell eDirectory 8.x

Description:
Some vulnerabilities have been reported in Novell eDirectory, which can be exploited by malicious users to cause a DoS (Denial of Service) and by malicious people to conduct cross-site scripting attacks and compromise a vulnerable system.

1) An error within the dhost service when handling certain characters can be exploited to crash the service via a specially crafted HTTP request.

NOTE: This vulnerability affects the Windows platform only.

2) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) An error in the NCP implementation can be exploited to cause a stack-based buffer overflow.

Successful exploitation of this vulnerability may allow execution of arbitrary code.

The vulnerabilities are reported in versions prior to 8.8.7.2 and 8.8.6.7.

Solution:
Update to version 8.8.7.2 or 8.8.6.7.

Provided and/or discovered by:
1, 2) The vendor credits Positive Technologies.
3) Reported by the vendor.

Original Advisory:
http://www.novell.com/support/kb/doc.php?id=3426981
http://www.novell.com/support/kb/doc.php?id=7011533
http://www.novell.com/support/kb/doc.php?id=7011538
http://www.novell.com/support/kb/doc.php?id=7011539

http://secunia.com/advisories/51667/