Spyware, viruses, & security forum: VULNERABILITIES / FIXES - January 25, 2013

Release Date: 2013-01-25

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Workaround

Software:
iTop 1.x
iTop 2.x

Description:
Compass Security has discovered two vulnerabilities in iTop, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "text" GET parameter to /pages/UI.php (when "operation" is set to "full_text") and the "expression" GET parameter to /pages/run_query.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session context of an affected site.

The vulnerabilities are confirmed in versions 1.2.1 and 2.0. Other versions may also be affected.

Solution:
Fixed in the SVN repository.

Provided and/or discovered by:
Stephan Rickauer, Compass Security

Original Advisory:
Compass Security:
http://archives.neohapsis.com/archives/fulldisclosure/2013-01/0208.html

http://secunia.com/advisories/51702/

Release Date : 2013-01-25

Criticality level : Less critical
Impact : Exposure of sensitive information
DoS
Where: From local network
Solution Status: Unpatched

Software: IBM InfoSphere BigInsights 1.x

Description:
IBM has acknowledged two vulnerabilities in IBM InfoSphere BigInsights, which can be exploited by malicious, local users to disclose potentially sensitive information and by malicious people to cause a DoS (Denial of Service).

The application bundles a vulnerable version of Java.

The vulnerabilities are reported in versions 1.1 through 1.4.

Solution:
Upgrade to version 2.0.

Original Advisory:
http://www.ibm.com/support/docview.wss?uid=swg21623161
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_multiple_vulnerabilities_in_infosphere_biginsights_due_to_vulnerabilities_in_ibm_java_jdk_version_6_cve_2012_1717_cve_2012_171813?lang=en_us

http://secunia.com/advisories/51914/

Release Date : 2013-01-25

Criticality level : Moderately critical
Impact : Cross Site Scripting
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: WordPress 3.x

Description:
Multiple vulnerabilities have been reported in Wordpress, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks and disclose sensitive data.

1) Certain unspecified input related to shortcodes and post content is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Certain unspecified input related to Plupload is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Input passed via the "sourceUri" parameter to the "pingback.ping" XMLRPC API method is not properly sanitised before being used. This can be exploited to e.g. disclose sensitive data.

The vulnerabilities are reported in versions prior to 3.5.1.

Solution:
Update to version 3.5.1.

Provided and/or discovered by:
The vendor credits:
1) Jon Cave, WordPress security team.
2) Moxiecode.
3) Gennady Kovshenin and Ryan Dewhurst.

Original Advisory:
WordPress:
http://wordpress.org/news/2013/01/wordpress-3-5-1/

http://secunia.com/advisories/51967/

Red Hat update for JBoss Enterprise Application Platform and JBoss Enterprise Web Platform

Release Date : 2013-01-25

Criticality level : Moderately critical
Impact : Security Bypass
Cross Site Scripting
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: JBoss Enterprise Application Platform 5.x
JBoss Enterprise Web Platform 5.x

Description:
Red Hat has issued an update for JBoss Enterprise Application Platform and JBoss Enterprise Web Platform. This fixes a weakness, a security issue, and multiple vulnerabilities, which can be exploited by malicious, local users to disclose potentially sensitive information, by malicious users to bypass certain security restrictions, and by malicious people to conduct cross-site scripting and request forgery attacks and bypass certain security restrictions.

1) Certain input related to operation invocations passed to the JMX console is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) An error within the "SecurityAssociation.getCredential()" function when handling a request without a SecurityContext to a secured back-end resource can be exploited to authenticate as the previously authenticated user.

3) An error in the JMX Invoker due to the AuthorizationInterceptor not properly verifying permissions can be exploited to perform otherwise restricted JMX operations.

Solution:
Updated packages are available via Red Hat Network.

Provided and/or discovered by:
The vendor credits:
1) Tyler Krpata
2) Carlo de Wolf, Red Hat
3) Derek Horton, Red Hat

Original Advisory:
RHSA-2013:0191-1:
https://rhn.redhat.com/errata/RHSA-2013-0191.html

RHSA-2013:0192-1:
https://rhn.redhat.com/errata/RHSA-2013-0192.html

RHSA-2013:0193-1:
https://rhn.redhat.com/errata/RHSA-2013-0193.html

RHSA-2013:0194-1:
https://rhn.redhat.com/errata/RHSA-2013-0194.html

RHSA-2013:0195-1:
https://rhn.redhat.com/errata/RHSA-2013-0195.html

RHSA-2013:0196-1:
https://rhn.redhat.com/errata/RHSA-2013-0196.html

RHSA-2013:0197-1:
https://rhn.redhat.com/errata/RHSA-2013-0197.html

RHSA-2013:0198-1:
https://rhn.redhat.com/errata/RHSA-2013-0198.html

http://secunia.com/advisories/51984/

django CMS page_attribute Template Tag Script Insertion Vulnerability

Release Date: 2013-01-25

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: django CMS 2.x

Description:
A vulnerability has been reported in django CMS, which can be exploited by malicious users to conduct script insertion attacks.

Input passed via the page_attribute template tag is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

Successful exploitation requires the permission to edit at least one django CMS page object.

The vulnerability is reported in versions prior to 2.3.5.

Solution:
Update to version 2.3.5.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/

http://secunia.com/advisories/51953/