Spyware, viruses, & security forum: VULNERABILITIES / FIXES - December 26, 2012

Release Date: 2012-12-26

Criticality level : Highly critical
Impact : DoS
System access
Manipulation of data
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: IBM Rational Functional Tester 8.x

Description:
IBM has acknowledged multiple vulnerabilities in IBM Rational Functional Tester, which can be exploited by malicious people to disclose potentially sensitive information, manipulate certain data, cause a DoS (Denial of Service), and potentially compromise a vulnerable system.

The vulnerabilities are reported in versions prior to 8.3.0.1.

Solution:
Update to version 8.3.0.1.

Original Advisory:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21619418
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_vulnerabilities_in_rational_functional_tester_versions_8_x_due_to_security_vulnerabilities_in_ibm_jre_7_0_service_release_2_or_earlier_and_non_ibm_java_7_03?lang=en_us

http://secunia.com/advisories/51688/

Release Date: 2012-12-26

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: grep 2.x

Description:
A vulnerability has been reported in grep, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to an integer overflow error when parsing very long lines and can be exploited to cause a heap-based buffer overflow.

Successful exploitation may allow execution of arbitrary code, but requires tricking a user into processing a malicious file.

The vulnerability is reported in versions prior to 2.11.

Solution:
Update to version 2.11 or later.

Provided and/or discovered by:
Joshua Rogers via Ubuntu bug report.

Original Advisory:
GNU:
http://savannah.gnu.org/forum/forum.php?forum_id=7132

Joshua Rogers:
https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473

http://secunia.com/advisories/51666/

Release Date: 2012-12-26

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Open-Realty 3.x

Description:
Aung Khant has reported a vulnerability in Open-Realty, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. change account data when a logged-in administrative user visits a specially crafted web page.

The vulnerability is reported in version 3.2.5. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Aung Khant, YGN Ethical Hacker Group

Original Advisory:
http://yehg.net/lab/pr0js/advisories/%5Bopen-realty_3.x%5D_csrf

http://secunia.com/advisories/51585/

Hitachi Multiple Products Apache HTTP Server "httpOnly" Cookie Disclosure Vulnerability

Release Date: 2012-12-26

Criticality level : Moderately critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: Cosminexus 5.x
Cosminexus 6.x
Cosminexus 7.x
Cosminexus 8.x
Cosminexus 9.x
Hitachi Web Server - Security Enhancement 2.x
Hitachi Web Server 1.x
Hitachi Web Server 2.x
Hitachi Web Server 3.x
Hitachi Web Server 4.x
uCosminexus Application Server
uCosminexus Developer

Description:
Hitachi has acknowledged a vulnerability in multiple products, which can be exploited by malicious people to disclose potentially sensitive information.

Please see the vendor's advisory for a list of affected products.

Solution:
Apply updates

Original Advisory:
Hitachi (HS12-033):
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-033/index.html

http://secunia.com/advisories/51626/

Hitachi Multiple Products Apache "apr_brigade_split_line()" Denial of Service Vulnerability

Release Date: 2012-12-26

Criticality level : Moderately critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Software: Cosminexus 7.x
Cosminexus 8.x
Cosminexus 9.x
Hitachi Web Server 3.x
Hitachi Web Server 4.x
uCosminexus Application Server
uCosminexus Developer
uCosminexus Service Architect
uCosminexus Service Platform

Description:
Hitachi has acknowledged a vulnerability in multiple products, which can be exploited by malicious people to cause a DoS (Denial of Service).

Please see the vendor's advisory for a list of affected products.

Solution:
Apply updates

Original Advisory:
Hitachi (HS12-031):
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-031/index.html

http://secunia.com/advisories/51664/