Spyware, viruses, & security forum: VULNERABILITIES / FIXES - January 04, 2013

Facebook Camera for iOS Certificate Verification Security Issue

Release Date : 2013-01-04

Criticality level : Less critical
Impact: Spoofing
Where : From remote
Solution Status : Vendor Patch

Software: Facebook Camera for iOS 1.x

Description:
Mohamed Ramadan has discovered a security issue in Facebook Camera for iOS, which can be exploited by malicious people to conduct spoofing attacks.

The security issue is caused due to the application not properly verifying the server SSL certificate. This can be exploited to e.g. spoof the server via a MitM (Man-in-the-Middle) attack and e.g. disclose potentially sensitive information.

The security issue is confirmed in versions prior to 1.1.2.

Solution:
Update to version 1.1.2.

Provided and/or discovered by:
Mohamed Ramadan

Original Advisory:
http://techcrunch.com/2012/12/24/security-loophole-in-facebooks-camera-app-allowed-hackers-to-hijack-accounts-over-wifi/

http://secunia.com/advisories/51699/

WHMCompleteSolution PayPal and Google Checkout Modules Vulnerabilities

Release Date : 2013-01-04

Criticality level : Less critical
Impact: Manipulation of data
Security Bypass
Where : From remote
Solution Status : Vendor Patch

Software: WHMCompleteSolution 4.x

Description:
Two vulnerabilities have been reported in WHMCompleteSolution, which can be exploited by malicious users to bypass certain security restrictions and conduct SQL injection attacks.

1) An error when handling PayPal transactions within the paypal module can be exploited to credit a different PayPal account than the application configured PayPal account.

Successful exploitation of this vulnerability requires the paypal module to be enabled.

2) Certain input passed to the Google checkout module is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability requires the Google checkout module to be enabled.

The vulnerabilities are reported in versions prior to 4.5.3.

Solution:
Update to version 4.5.3 or apply patch.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://blog.whmcs.com/index.php?t=64778
http://forum.whmcs.com/showthread.php?64778-Security-Advisory-for-V4-5-amp-Google-Checkout-Users

http://secunia.com/advisories/51683/

VLC Media Player HTML Subtitle Parsing Buffer Overflow Vulnerabilities

Release Date : 2012-12-28
Last Update : 2013-01-04

Criticality level : Highly critical
Impact System access
Where : From remote
Solution Status: Vendor Patch

Software: VLC Media Player 2.x

Description:
Some vulnerabilities have been reported in VLC Media Player, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to errors when parsing HTML subtitles in modules/codec/subsdec.c and can be exploited to cause buffer overflows via a specially crafted subtitle file.

Successful exploitation may allow execution of arbitrary code.

The vulnerabilities are reported in versions prior to 2.0.5.

Solution:
Update to version 2.0.5.

Provided and/or discovered by:
The vendor credits Kaveh Ghaemmaghami(coolkaveh).

Original Advisory:
VideoLAN-SA-1301:
http://www.videolan.org/security/sa1301.html

http://secunia.com/advisories/51692

Release Date : 2013-01-04

Criticality level : Less critical
Impact: Spoofing
Where : From remote
Solution Status : Unpatched

Software: nginx 0.x
nginx 1.0.x
nginx 1.1.x
nginx 1.2.x

Description:
A security issue has been reported in nginx, which can be exploited by malicious people to conduct spoofing attacks.

The security issue is caused due to the application not properly verifying the server SSL certificate while using proxy functionality. This can be exploited to e.g. spoof the server via a MitM (Man-in-the-Middle) attack and e.g. disclose potentially sensitive information.

The security issue is reported in version 1.2.6. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
waloeiii.myopenid.com and Daniel Kahn Gillmor

Original Advisory:
http://trac.nginx.org/nginx/ticket/13

http://secunia.com/advisories/51708/