Spyware, viruses, & security forum: VULNERABILITIES / FIXES - February 06, 2013

Release Date : 2013-02-06

Criticality level : Less critical
Impact : Security Bypass
Cross Site Scripting
Privilege escalation
Where : From remote
Solution Status : Vendor Patch

Operating System:
openSUSE 11.4
openSUSE 12.1

Description:
SUSE has issued an update for apache2. This fixes two weaknesses, a security issue, and a vulnerability, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to bypass certain security restrictions and conduct cross-site scripting attacks.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2013:0243-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html

openSUSE-SU-2013:0248-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html

http://secunia.com/advisories/52111/

Release Date: 2013-02-06

Criticality level Not critical
Impact : Security Bypass
Where : Local system
Solution Status : Vendor Workaround

Software:
Qt 4.x
Qt 5.x

Description:
A weakness has been reported in Qt, which can be exploited by malicious, local users to bypass certain security restrictions.

The weakness is caused due to the Qt library creating shared memory blocks with world-readable and world-writable permissions, which can be exploited to overwrite arbitrary data in the shared memory or read arbitrary data from the memory.

The weakness is reported in versions 4.4.0 through 5.0.0.

Solution:
Apply patches if available.

Provided and/or discovered by:
The vendor credits Tim Brown.

Original Advisory:
http://permalink.gmane.org/gmane.comp.lib.qt.devel/9759

http://secunia.com/advisories/52040/

Release Date : 2013-02-06

Criticality level : Less critical
Impact : Security Bypass
Cross Site Scripting
System access
Where : From remote
Solution Status : Vendor Patch

Software: EMC RSA Archer GRC 5.x

Description:
Multiple vulnerabilities have been reported in EMC RSA Archer GRC, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct cross-site scripting attacks, conduct clickjacking attacks, and bypass certain security restrictions.

1) An unspecified error exists within the application and can be exploited to upload arbitrary files via directory traversal sequences.

2) An unspecified error related to Silverlight can be exploited to bypass same-origin policy and perform unauthorized cross-domain requests.

3) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

4) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain unspecified actions by tricking a user into clicking a specially crafted link via clickjacking.

The vulnerabilities are reported in versions prior to 5.3.

Solution:
Update to version 5.2SP1 or 5.3.

Provided and/or discovered by:
1, 2, 4) Reported by the vendor
3) The vendor credits Nello Coppeto, eMaze Network SpA

Original Advisory:
ESA-2013-002:
http://seclists.org/bugtraq/2013/Feb/att-0/ESA-2013-002.txt

http://secunia.com/advisories/52102/

Cisco Nexus 7000 Series NX-OS High Availability Policy CDP Denial of Service Vulnerability

Release Date : 2013-02-06

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System :
Cisco Nexus 7000 Series Switches
Cisco NX-OS 4.x
Cisco NX-OS 5.x

Description:
A vulnerability has been reported in Cisco Nexus 7000 Series NX-OS, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error when handling Cisco Discovery Protocol (CDP) packets and can be exploited to reset a device by sending specially crafted CDP packets.

Successful exploitation requires that the High Availability policy is configured for Reset.

The vulnerability is reported in versions 4.2, 5.0, 5.1, and 5.2 running on Cisco Nexus 7000 series switches.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Cisco (CSCtk34535, CSCtk19132):
http://tools.cisco.com/security/center/viewAlert.x?alertId=26619
http://www.cisco.com/en/US/docs/switches/datacenter/sw/5_x/nx-os/release/notes/52_nx-os_release_note.html

http://secunia.com/advisories/52094/

Release Date : 2013-02-06

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: IntegraXor 4.x
PE3DO32A ActiveX Control 4.x

Description:
A vulnerability has been reported in IntegraXor, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error in the PE3DO32A.ocx ActiveX control and can be exploited to cause a buffer overflow.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in version 4.00 build 4250.0 and prior.

Solution:
Update to version 4.00 build 4280.0.

Provided and/or discovered by:
Andrew Brooks

Original Advisory:
ICS-CERT:
http://ics-cert.us-cert.gov/pdf/ICSA-13-036-02.pdf

http://secunia.com/advisories/52073/

OpenSSL Information Disclosure and Denial of Service Vulnerabilities

Release Date : 2013-02-06

Criticality level : Less critical
Impact : Exposure of sensitive information
DoS
Where : From remote
Solution Status : Vendor Patch

Software: OpenSSL 0.x
OpenSSL 1.x

Description:
Multiple vulnerabilities have been reported in OpenSSL, which can be exploited by malicious people to disclose potentially sensitive information and cause a DoS (Denial of Service) of the application using the library.

1) An error when handling message authentication codes (MACs) with a block cipher algorithm in the CBC (Cipher-Block Chaining) mode can be exploited to potentially disclose certain plaintext bits from a block of ciphertext.

2) An error when handling TLS packets using CBC mode can be exploited to cause a crash.

This vulnerability is reported in version 1.0.1c running on the AES-NI platform.

3) An error when handling OCSP response verification can be exploited to render the application unusable.

Vulnerabilities #1 and #3 are reported in versions 1.0.1c, 1.0.0j, and 0.9.8x and prior.

Solution:
Update to versions 1.0.1d, 1.0.0k, or 0.9.8y.

Provided and/or discovered by:
1) Nadhem AlFardan and Kenny Paterson, Information Security Group at Royal Holloway, University of London
2) The vendor independently credits Adam Langley and Wolfgang Ettlingers
3) Reported by the vendor.

Original Advisory:
OpenSSL:
http://www.openssl.org/news/secadv_20130205.txt

Nadhem AlFardan and Kenny Pater

http://secunia.com/advisories/52036/

Xen "pciback_enable_msi()" Log Message Flooding Denial of Service Vulnerability

Release Date : 2013-02-06

Criticality level : Not critical
Impact : DoS
Where : Local system
Solution Status : Vendor Workaround

Software: Xen 3.x

Description:
A vulnerability has been reported in Xen, which can be exploited by malicious, local users in a guest virtual machine to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the "pciback_enable_msi()" function (drivers/xen/pciback/conf_space_capability_msi.c), which does not limit the rate of kernel log messages. This can be exploited to flood the kernel with log messages and render the system unusable.

Successful exploitation requires running a guest with access to passed through PCI devices.

The vulnerability is reported in versions 3.x including Linux 2.6.18.

Solution:
Fixed in the Mercurial repository.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
XSA-43:
http://www.openwall.com/lists/oss-security/2013/02/05/9

http://secunia.com/advisories/52059/

Cisco IOS Catalyst Switches HTTP Server Feature Denial of Service Vulnerability

Release Date : 2013-02-06

Criticality level : Moderately critical
Impact : DoS
Where : From remote
Solution Status : Partial Fix

Operating System :
Cisco IOS 12.x
Cisco IOS 15.0
Cisco IOS 15.1
Cisco IOS 15.2

Description:
A vulnerability has been reported in Cisco IOS, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error when handling TCP socket events within the HTTP server feature and can be exploited to crash a device by sending a specially crafted series of packets to TCP port 80 or 443.

Successful exploitation requires the HTTP server feature to be enabled.

Please see the vendor's advisory for a list of affected versions running on Cisco Catalyst switches.

Solution:
Apply updates if available (please see the vendor's advisory for details).

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Cisco (CSCuc53853):
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1100
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCuc53853

http://secunia.com/advisories/52026/