Spyware, viruses, & security forum: VULNERABILITIES / FIXES - January 03, 2013

Release Date : 2013-01-03

Criticality level Moderately critical
Impact : Manipulation of data
Where : From remote
Solution Status Vendor Patch

Software: Ruby on Rails 2.3.x
Ruby on Rails 3.0.x
Ruby on Rails 3.1.x
Ruby on Rails 3.2.x

Description:
joernchen has reported a vulnerability in Ruby on Rails, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the Active Record interface via method parameters is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in versions prior to 3.0.18, prior to 3.1.9, and prior to 3.2.10.

Solution:
Update to version 3.2.10, 3.1.9, or 3.0.18 or apply patch.

Provided and/or discovered by:
joernchen, Phenoelit

Original Advisory:
http://groups.google.com/group/rubyonrails-security/t/c2353369fea8c53

http://secunia.com/advisories/51697/

Release Date : 2013-01-03

Criticality level : Moderately critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: CubeCart 5.x

Description:
Aung Khant has discovered multiple vulnerabilities in CubeCart, which can be exploited by malicious people to conduct cross-site request forgery and script insertion attacks.

1) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. delete a document, a download, a product, and a customer when a logged-in administrative user visits a specially crafted web page.

2) Input passed via the "review[name]" and "review[title]" POST parameter to index.php (when posting a review) is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in an administrative user's browser session in context of an affected site if malicious data is viewed when editing the review.

The vulnerabilities are confirmed in version 5.1.5. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Aung Khant, YGN Ethical Hacker Group

Original Advisory:
http://yehg.net/lab/pr0js/advisories/%5Bcubecart_5x%5D_csrf
http://yehg.net/lab/pr0js/advisories/%5Bcubecart_5x%5D_xss

http://secunia.com/advisories/51703/

NVIDIA Graphics Drivers for Windows "nvsr" Named Pipe Buffer Overflow Vulnerability

Release Date : 2013-01-03

Criticality level Less critical
Impact: System access
Where : From local network
Solution Status: Unpatched

Software: NVIDIA Graphics Drivers for Windows 310.x

Description:
A vulnerability has been reported in NVIDIA Graphics Drivers for Windows, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to a boundary error when processing data received in the "nvsr" named pipe and can be exploited to cause a stack-based buffer overflow via specially crafted requests.

The vulnerability is reported in NVIDIA Graphics Drivers for Windows version 310.70. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Peter Winter-Smith

Original Advisory:
Peter Winter-Smith:
http://packetstormsecurity.com/files/119107/NVidia-Display-Driver-Buffer-Overflow.html

http://secunia.com/advisories/51629/

WordPress Google Doc Embedder Plugin Arbitrary File Disclosure Vulnerability

Release Date : 2013-01-03

Criticality level Moderately critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status Vendor Patch

Software: WordPress Google Doc Embedder Plugin 2.x

Description:
Charlie Eriksen has discovered a vulnerability in the Google Doc Embedder plugin for WordPress, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "file" parameter in wp-content/plugins/google-document-embedder/libs/pdf.php (when "fn" is set to a valid value) is not properly verified before being used to display files. This can be exploited to disclose the contents of arbitrary files via directory traversal sequences.

The vulnerability is confirmed in version 2.4.6. Other versions may also be affected.

Solution:
Update to version 2.5.4.

Provided and/or discovered by:
Charlie Eriksen via Secunia

http://secunia.com/advisories/50832/