Spyware, viruses, & security forum: VULNERABILITIES / FIXES - January 02, 2013

Charybdis Server Capability Negotiation Denial of Service Vulnerability

Release Date: 2013-01-02

Criticality level : Moderately critical
Impact: DoS
Where : From remote
Solution Status : Vendor Patch

Software: Charybdis 3.x

Description:
A vulnerability has been reported in Charybdis, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is reported in versions prior to 3.4.2.

Solution:
Update to version 3.4.2.

Original Advisory:
http://rabbit.dereferenced.org/~nenolod/ASA-2012-12-31.txt
https://github.com/atheme/charybdis/blob/charybdis-3.4.2/NEWS

http://secunia.com/advisories/51677/

VLC Media Player SWF Video Decoding Use-After-Free Vulnerability

Release Date: 2012-12-12
Last Update : 2013-01-02

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: VLC Media Player 2.x

Description:
Kaveh Ghaemmaghami has discovered a vulnerability in VLC Media Player, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to a use-after-free error when releasing a picture object during video decoding of Flash (SWF) files. This can be exploited to reference an object's callback function pointer from already freed memory.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is confirmed in version 2.0.4. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Kaveh Ghaemmaghami

Additional information provided by Secunia Research.

Original Advisory:
Kaveh Ghaemmaghami:
http://seclists.org/fulldisclosure/2012/Dec/96

http://secunia.com/advisories/51464

Release Date: 2012-09-22
Last Update : 2013-01-02

Criticality level : Highly critical
Impact : Security Bypass
Manipulation of data
System access
Where : From remote
Solution Status : Unpatched

Software: OneCMS 2.x

Description:
Some vulnerabilities have been discovered in OneCMS, which can be exploited by malicious people to bypass certain security restrictions, conduct SQL injection attacks, and compromise a vulnerable system.

1) Input passed via the "rank" parameter to boards.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "username" POST parameter to admin.php (when "load" is set to "login" and "login" is set to "yes") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3) Some vulnerabilities are caused due to a bundled version of TimThumb.

The vulnerabilities are confirmed in version 2.6.4. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
1) kurdish hackers team
2) Sammy Forgit, OpenSysCom

Original Advisory:
Sammy Forgit:
http://www.opensyscom.fr/Actualites/onecms-sql-injection-vulnerability.html
http://www.opensyscom.fr/Actualites/onecms-timthumb-vulnerability.html

http://secunia.com/advisories/46138

WordPress Shopping Cart Plugin Multiple SQL Injection Vulnerabilities

Release Date : 2013-01-02

Criticality level : Highly critical
Impact : Manipulation of data
Where : From remote
Solution Status : Unpatched

Software: WordPress Shopping Cart 8.x (plugin for WordPress)

Description:
Sammy Forgit has discovered multiple vulnerabilities in the WordPress Shopping Cart plugin for WordPress, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "reqID" parameter to wp-content/plugins/levelfourstorefront/scripts/administration/backup.php, wp-content/plugins/levelfourstorefront/scripts/administration/dbuploaderscript.php, wp-content/plugins/levelfourstorefront/scripts/administration/exportaccounts.php, and wp-content/plugins/levelfourstorefront/scripts/administration/exportsubscribers.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are confirmed in version 8.1.14. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Sammy Forgit, Opensyscom

Original Advisory:
http://www.opensyscom.fr/Actualites/wordpress-plugins-wordpress-shopping-cart-multiple-vulnerability.html

http://secunia.com/advisories/51690/

WordPress ReFlex Gallery Plugin Arbitrary File Upload Vulnerability

Release Date : 2013-01-02

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Unpatched

Software: ReFlex Gallery 1.x (plugin for WordPress)

Description:
Sammy Forgit has discovered a vulnerability in the ReFlex Gallery plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.

The vulnerability has been confirmed in version 1.4. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Sammy Forgit, Opensyscom

Original Advisory:
http://www.opensyscom.fr/Actualites/wordpress-plugins-uploader-arbitrary-file-upload-vulnerability.html

http://secunia.com/advisories/51698/

Release Date : 2012-12-31

Criticality level : Moderately critical
Impact : System access
Where : From remote
Solution Status: Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for ghostscript. This fixes a vulnerability, which can be exploited by malicious people to potentially compromise a user's system.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2595-1:
http://www.debian.org/security/2012/dsa-2595

http://secunia.com/advisories/51670/

Release Date : 2012-12-31

Criticality level : Less critical
Impact : Exposure of sensitive information
DoS
Where : From remote
Solution Status: Vendor Patch

Software: IBM SPSS Modeler 14.x
IBM SPSS Modeler 15.x

Description:
A vulnerability has been reported in IBM SPSS Modeler, which can be exploited by malicious people to disclose potentially sensitive information and cause a DoS (Denial of Service).

The vulnerability is caused due to an error when handling certain XML documents and can be exploited via a specially crafted document.

The vulnerability is reported in versions 14 through 15.0 running on all supported platforms.

Solution:
Apply Interim Fix (please see the vendor's advisory for details).

Provided and/or discovered by:
The vendor credits Timur Yunusov, Alexey Osipov, and Ilya Karpov, Positive Research Center (Positive Technologies Company).

Original Advisory:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21620758
http://www.ibm.com/support/docview.wss?uid=swg24034122

http://secunia.com/advisories/51715/

Release Date : 2012-12-31

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status: Vendor Patch

Operating System : Debian GNU/Linux 6.0

Description:
Debian has issued an update for mediawiki-extensions. This fixes a vulnerability, which can be exploited by malicious users to conduct script insertion attacks.

The vulnerability is caused due to improper input validation in the processing of RSS feed. This can be exploited to inject and execute arbitrary HTML and script code in context of the feed by tricking a user into adding and viewing a malicious RSS feed.

Solution:
Apply updated packages via the apt-get package manager.

Provided and/or discovered by:
The vendor credits Thorsten Glaser within a bug report.

Original Advisory:
DSA-2596-1:
http://www.debian.org/security/2012/dsa-2596

http://secunia.com/advisories/51713/

Symfony _internal Route Arbitrary Controller/Service Execution Vulnerability

Release Date : 2012-12-31

Criticality level : Moderately critical
Impact : Security Bypass
System access
Where : From remote
Solution Status: Vendor Workaround

Software: Symfony 2.x

Description:
A vulnerability has been reported in Symfony, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error when handling _internal routes via the "render" tag and can be exploited to execute arbitrary Controller or Services by using a specially crafted path.

Successful exploitation requires _internal routes to be enabled.

The vulnerability is reported in all 2.0.x and 2.1.x versions.

Solution:
Please see the vendor's advisory for recommended workarounds.

Provided and/or discovered by:
The vendor credits Victor Berchet.

Original Advisory:
http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released

http://secunia.com/advisories/51662/

Release Date : 2012-12-31

Criticality level : Moderately critical
Impact : Manipulation of data
System access
Where : From remote
Solution Status: Vendor Patch

Operating System : Debian GNU/Linux 6.0

Description:
Debian has issued an update for moin. This fixes two vulnerabilities, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to manipulate certain data.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2593-1:
http://www.debian.org/security/2012/dsa-2593

http://secunia.com/advisories/51676/