Spyware, viruses, & security forum: VULNERABILITIES / FIXES - February 01, 2013

HP Network Node Manager Unspecified Cross-Site Scripting Vulnerabilities

Release Date : 2013-02-01

Criticality level : Less critical
Impact: Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: HP Network Node Manager i (NNMi) 9.x

Description:
Some vulnerabilities have been reported in HP Network Node Manager, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions 9.0x, 9.1x, and 9.20.

Solution:
Apply hotfix.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
HPSBMU02842 SSRT100909:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03652323

http://secunia.com/advisories/52048/

Release Date : 2013-02-01

Criticality level: Highly critical
Impact: DoS
System access
Where: From remote
Solution Status : Vendor Patch

Operating System :
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6

Description:
Red Hat has issued an update for mingw32-libxml2. This fixes multiple vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0217-1:
https://rhn.redhat.com/errata/RHSA-2013-0217.html

http://secunia.com/advisories/52051/

WordPress yolink Search Plugin "s" Cross-Site Scripting Vulnerability

Release Date : 2013-02-01

Criticality level : Less critical
Impact: Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: WordPress yolink Search Plugin 2.x

Description:
A vulnerability has been discovered in the yolink Search plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "s" GET parameter to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

The vulnerability is confirmed in version 2.5. Prior versions may also be affected.

Solution:
Update to version 2.6.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
yolink Search:
http://wordpress.org/extend/plugins/yolink-search/changelog/
http://plugins.trac.wordpress.org/changeset/661916/yolink-search/tags

http://secunia.com/advisories/52030/

Release Date : 2013-02-01

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Operating System: Netgear SPH200D 1.x

Description:
Michael Messner has reported a vulnerability in Netgear SPH200D, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input appended to the URL when accessing a non-existent page is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in version 1.0.4.80. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Michael Messner

Original Advisory:
http://www.s3cur1ty.de/m1adv2013-002

http://secunia.com/advisories/52029/

VMware vSphere Products Client-Side Authentication Vulnerability

Release Date : 2013-02-01

Criticality level : Not critical
Impact : System access
Where : From local network
Solution Status : Partial Fix

Software:
VMware Virtual Infrastructure Client
VMware VirtualCenter 2.x
VMware vSphere 4.x
VMware vSphere Client 4.x

Description:
A vulnerability has been reported in some VMware vSphere products, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error within the handling of the management authentication protocol, which can be exploited to corrupt memory.

Successful exploitation may allow execution of arbitrary code, but requires tricking the vCenter Server or vSphere Client into interacting with a malicious server as a client.

The vulnerability is reported in the following products and versions:
* vCenter Server version 4.1
* vCenter Server version 4.0
* VirtualCenter version 2.5
* vSphere Client version 4.1
* vSphere Client version 4.0
* VI-Client version 2.5

Solution:
Apply patches if available.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
VMware:
http://www.vmware.com/security/advisories/VMSA-2013-0001.html

http://secunia.com/advisories/52047/

Release Date : 2013-02-01

Criticality level : Moderately critical
Impact : DoS
System access
Where : From local network
Solution Status : Partial Fix

Operating System:
VMware ESXi 3.x
VMware ESXi 4.x

Description:
Multiple vulnerabilities have been reported in VMware ESXi, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) A vulnerability exists within the handling of the authentication protocol.

2) Some vulnerabilities exist in the bundled vulnerable version of libxml2.

The vulnerabilities are reported in versions 4.1, 4.0, and 3.5.

Solution:
Apply patches if available.

Original Advisory:
VMware:
http://www.vmware.com/security/advisories/VMSA-2013-0001.html

http://secunia.com/advisories/52062/

Release Date: 2013-02-01

Criticality level : Moderately critical
Impact: Security Bypass
Cross Site Scripting
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: JBoss Enterprise BRMS Platform 5.x

Description:
Red Hat has issued an update for JBoss Enterprise BRMS Platform. This fixes multiple vulnerabilities, which can be exploited by malicious, local users to disclose potentially sensitive information, by malicious users to bypass certain security restrictions, and by malicious people to conduct cross-site scripting attacks and bypass certain security restrictions.

Solution:
Apply security patches or update to version 5.3.1.

Original Advisory:
RHSA-2013:0221-1:
https://rhn.redhat.com/errata/RHSA-2013-0221.html

http://secunia.com/advisories/52054/

Vaadin "JsonPaintTarget.addAttribute()" Script Insertion Vulnerability

Release Date : 2013-02-01

Criticality level: Modertaely critical
Impact: Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Vaadin 6.x

Description:
A vulnerability has been reported in Vaadin, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via keys of the "Map" argument to the "JsonPaintTarget.addAttribute()" method is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will execute in a user's browser session in context of an affected site when the malicious data is being viewed.

The vulnerability is reported in versions prior to 6.8.8.

Solution:
Update to version 6.8.8.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
https://vaadin.com/forum/-/message_boards/view_message/2456529
https://vaadin.com/download/release/6.8/6.8.8/release-notes.html#security-fixes
http://dev.vaadin.com/ticket/10873

http://secunia.com/advisories/52063/

Release Date : 2013-01-31

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Workaround

Software: DataLife Engine 9.x

Description:
Egidio Romano has reported a vulnerability in DataLife Engine, which can be exploited by malicious people to compromise a vulnerable system.

Input passed via the "catlist[]" POST parameter to engine/preview.php (when "mod" is set to "preview") is not properly sanitised before calling the "preg_replace()" function with the "e" modifier. This can be exploited to execute arbitrary PHP code.

Successful exploitation requires the application to use a template that incorporates "[catlist]" or "[not-catlist]" tags in its preview.tpl file (default template does not).

The vulnerability is reported in version 9.7. Other versions may also be affected.

Solution:
Apply the vendor patch.

Provided and/or discovered by:
Egidio Romano

Original Advisory:
KIS-2013-01:
http://karmainsecurity.com/KIS-2013-01

http://secunia.com/advisories/51971/

Schneider Electric Accutech Manager Buffer Overflow Vulnerability

Release Date : 2013-01-31

Criticality level : Moderately critical
Impact : System access
Where : From local network
Solution Status : Unpatched

Software: Schneider Electric Accutech Manager 2.x

Description:
A vulnerability has been reported in Schneider Electric Accutech Manager, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an unspecified error and can be exploited to cause a heap-based buffer overflow.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in versions 2.00.1 and prior.

Solution:
No official solution is currently available. A fix is scheduled to be released in February 2013.

Provided and/or discovered by:
The vendor credits Exodus Intelligence.

Original Advisory:
http://www.schneider-electric.com/sites/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2013/01/20130121_advisory_of_vulnerability_affecting_accutech_manager_software.xml

http://secunia.com/advisories/52034/