Spyware, viruses, & security forum: VULNERABILITIES / FIXES - January 07, 2013

NVIDIA Graphics Drivers for Windows "nvsr" Named Pipe Buffer Overflow Vulnerability

Release Date : 2013-01-03
Last Update : 2013-01-07

Criticality level: Less critical
Impact : System access
Where : From local network
Solution Status : Vendor Patch

Software: NVIDIA Graphics Drivers for Windows 310.x

Description:
A vulnerability has been reported in NVIDIA Graphics Drivers for Windows, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to a boundary error when processing data received in the "nvsr" named pipe and can be exploited to cause a stack-based buffer overflow via specially crafted requests.

Successful exploitation requires that file sharing is enabled.

The vulnerability is reported in NVIDIA Graphics Drivers for Windows version 310.70. Other versions may also be affected.

Solution:
Update to version 310.90.

Provided and/or discovered by:
Peter Winter-Smith

Original Advisory:
Peter Winter-Smith:
http://packetstormsecurity.com/files/119107/NVidia-Display-Driver-Buffer-Overflow.html

NVIDIA:
http://www.geforce.com/drivers/results/55121

http://secunia.com/advisories/51629

Release Date : 2013-01-07

Criticality level : Highly critical
Impact: Spoofing
System access
Where : From remote
Solution Status: Vendor Patch

Operating System: Debian GNU/Linux 6.0

Description:
Debian has issued an update for weechat. This fixes a security issue and a vulnerability, which can be exploited by malicious people to conduct spoofing attacks and potentially compromise a user's system.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2598-1:
http://www.debian.org/security/2013/dsa-2598

http://secunia.com/advisories/51700/

Nexpose Security Console Cross-Site Request Forgery Vulnerability

Release Date : 2013-01-07

Criticality level : Less critical
Impact: Cross Site Scripting
Where : From remote
Solution Status: Vendor Patch

Software: Nexpose 5.x

Description:
Robert Gilbert has reported a vulnerability in Nexpose, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests to the Security Console without performing proper validity checks to verify the requests. This can be exploited to e.g. delete a site when a logged-in user visits a specially crafted web page.

The vulnerability is reported in versions prior to 5.5.4.

Solution:
Update to version 5.5.4.

Provided and/or discovered by:
Robert Gilbert, HALOCK Security Labs.

Original Advisory:
Nexpose:
https://community.rapid7.com/docs/DOC-2065#release5

Robert Gilbert:
http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html

http://secunia.com/advisories/51732/

Symantec PGP Whole Disk Encryption 0x80022058 IOCTL Handling Privilege Escalation Vulnerability

Release Date : 2013-01-07

Criticality level : Less critical
Impact: Privilege escalation
Where : Local system
Solution Status: Unpatched

Software: Symantec PGP Whole Disk Encryption 10.x

Description:
Nikita Tarakanov has reported a vulnerability in Symantec PGP Whole Disk Encryption, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to an error in the pgpwded.sys driver when processing the 0x80022058 IOCTL and can be exploited to overwrite arbitrary kernel memory.

Successful exploitation may allow execution of arbitrary code with escalated privileges.

The vulnerability is reported in version 10.2.0 Build 2599 running on Windows XP and Windows Server 2003. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Nikita Tarakanov

Original Advisory:
Symantec:
http://www.symantec.com/connect/blogs/pgp-whole-disk-encryption-zero-day-vulnerability

Nikita Tarakanov:
http://pastebin.com/pEBSjsmC
http://pastebin.com/s3gzFicw

http://secunia.com/advisories/51762/

TomatoCart Cross-Site Scripting and Arbitrary PHP Code Execution Vulnerabilities

Release Date : 2013-01-07

Criticality level : Moderately critical
Impact Cross Site Scripting
System access
Where : From remote
Solution Status : Unpatched

Software: TomatoCart 1.x

Description:
Two vulnerabilities have been discovered in TomatoCart, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct cross-site scripting attacks.

1) The vulnerability is caused due to a bundled version of Piwik.

2) An error exists due to the admin/json.php script (when "action" is set to "save_file") allowing to create files in a folder inside the webroot. This can be exploited to execute e.g. arbitrary PHP code by creating a malicious PHP script.

Successful exploitation of this vulnerability requires access to the admin section.

The vulnerabilities are confirmed in version 1.1.8.1. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
2) Aung Khant, YGN Ethical Hacker Group.

Original Advisory:
Aung Khant:
http://bl0g.yehg.net/2013/01/tomatocart-1x-vulnerable-piwik-extension.html
http://yehg.net/lab/pr0js/advisories/%5Btomatocart1.x%5D_arbitrary_file_creation

http://secunia.com/advisories/51621/

Release Date : 2013-01-07

Criticality level : Moderately critical
Impact Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: Havalite 1.x

Description:
Henri Salo has discovered a vulnerability in Havalite, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via the "comment" parameter to index.php is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

The vulnerability is confirmed in version 1.1.7. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Henri Salo

Original Advisory:
http://www.openwall.com/lists/oss-security/2013/01/06/2

http://secunia.com/advisories/51722/