Spyware, viruses, & security forum: VULNERABILITIES / FIXES - January 14, 2012

Siemens SIMATIC RF Manager ActiveX Control Buffer Overflow Vulnerability

Release Date : 2013-01-14

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status: Vendor Patch

Software: Siemens SIMATIC RF Manager 2008
Siemens SIMATIC RF Manager Basic 3.x

Description:
A vulnerability has been reported in Siemens SIMATIC RF Manager, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error in an unspecified ActiveX control and can be exploited to cause a buffer overflow.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in RF-MANAGER 2008 and RF-MANAGER Basic versions 3.0 and prior.

Solution:
Patch is available by contacting vendor support (see the vendor's advisory for more details).

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-099741.pdf

http://secunia.com/advisories/51845/

Release Date : 2013-01-14

Criticality level : Highly critical
Impact : DoS
System access
Where : From remote
Solution Status: Vendor Patch

Operating System : Debian GNU/Linux 6.0

Description:
Debian has issued an update for asterisk. This fixes multiple vulnerabilities, which can be exploited by malicious users to cause a DoS (Denial of Service) and by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2605-1:
http://www.debian.org/security/2013/dsa-2605

http://secunia.com/advisories/51822/

CoDeSys Authentication Bypass and Directory Traversal Vulnerabilities

Release Date : 2013-01-14

Criticality level : Moderately critical
Impact : Security Bypass
System access
Where : From local network
Solution Status: Vendor Patch

Software: CoDeSys 2.x

Description:
Digital Bond has reported two vulnerabilities in CoDeSys, which can be exploited by malicious people to bypass certain security restrictions and compromise a vulnerable system.

1) An error within the authentication mechanism does not properly restrict access to the device and can be exploited to perform certain administrative tasks.

2) Certain input passed to the file transfer functionality is not properly verified before being used to access files. This can be exploited to read, delete, or upload arbitrary files via directory traversal sequences.

The vulnerabilities are reported in versions 2.3.x and 2.4.x.

Solution:
Apply patches (please contact the vendor for more information).

Provided and/or discovered by:
Reid Wightman, Digital Bond.

Original Advisory:
ICS-CERT (ICSA-13-011-01):
http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf

CoDeSys:
http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html

http://secunia.com/advisories/51847/

IBM Intelligent Operations Center Event Data Script Insertion Vulnerability

Release Date : 2012-12-18
Last Update : 2013-01-14

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From local network
Solution Status : Vendor Patch

Software: IBM Intelligent Operations Center 1.x

Description:
A vulnerability has been reported in IBM Intelligent Operations Center, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via event data is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

The vulnerability is reported in version 1.5.0.

Solution:
Apply interim fix PO00211.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
IBM (PO00211):
http://www.ibm.com/support/docview.wss?uid=swg24034020
http://www.ibm.com/support/docview.wss?uid=swg21622222
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_intelligent_operations_center_vulnerability_in_incoming_event_data_fields_cve_2012_63604

http://secunia.com/advisories/51591

Icinga history.cgi "show_history()" Buffer Overflow Vulnerability

Release Date : 2013-01-14

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Icinga 1.x

Description:
A vulnerability has been reported in Icinga, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the "show_history()" function (history.c) within history.cgi when handling certain parameters, which can be exploited to cause a stack-based buffer overflow via an overly long "host" parameter.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in versions 1.6.1, 1.7.3, and 1.8.3. Prior versions may also be affected.

Solution:
Update to version 1.6.2, 1.7.4, or 1.8.4.

Original Advisory:
Icinga:
https://www.icinga.org/2013/01/14/icinga-1-6-2-1-7-4-1-8-4-released/

http://secunia.com/advisories/51863/

WordPress WP Photo Album Plus Plugin "wppa-tag" Cross-Site Scripting Vulnerability

Release Date : 2013-01-14

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status: Vendor Patch

Software: WordPress WP Photo Album Plus Plugin 4.x

Description:
A vulnerability has been reported in the WP Photo Album Plus plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "wppa-tag" parameter to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in versions prior to 4.9.3.

Solution:
Update to version 4.9.3.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
WP Photo Album Plus:
http://wordpress.org/extend/plugins/wp-photo-album-plus/changelog/
http://plugins.trac.wordpress.org/changeset/651655/wp-photo-album-plus/trunk/wppa-functions.php?old=651254&old_path=wp-photo-album-plus%2Ftrunk%2Fwppa-functions.php

http://secunia.com/advisories/51829/