Spyware, viruses, & security forum: VULNERABILITIES / FIXES - February 07, 2013

Release Date : 2013-02-07

Criticality level : Less critical
Impact : System access
Where : From local network
Solution Status : Vendor Patch

Operating System :
openSUSE 12.1
openSUSE 12.2

Description:
SUSE has issued an update for libupnp. This fixes three vulnerabilities, which can be exploited by malicious people to compromise an application using the library.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2013:0255-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00013.html

http://secunia.com/advisories/52124/

Cisco ATA 187 Analog Telephone Adaptor Authentication and Authorisation Bypass Vulnerability

Release Date : 2013-02-07

Criticality level : Moderately critical
Impact : System access
Where : From local network
Solution Status : Vendor Patch

Operating System: Cisco ATA 180 Series Analog Telephone Adaptors

Description:
A vulnerability has been reported in Cisco ATA 187 Analog Telephone Adaptor, which can be exploited by malicious people to compromise a vulnerable device.

The vulnerability is caused due to an error when handling authentication and command authorisation and can be exploited to bypass authentication and shell command authorisation via telnet request to TCP port 7870 and subsequently execute arbitrary shell commands.

The vulnerability is reported in firmware versions 9.2.1.0 and 9.2.3.1.

Solution:
Update to firmware version 9.2.3.1 ES build 4 or later.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Cisco (CSCtz67038):
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130206-ata187
http://tools.cisco.com/security/center/viewAlert.x?alertId=28010
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtz67038

http://secunia.com/advisories/52060/

Buffalo TeraStation Network Attached Storage (NAS) TS-Series File Download Vulnerability

Release Date: 2013-02-07

Criticality level: Not critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Unpatched

Operating System: Buffalo TeraStation Network Attached Storage (NAS) TS-Series 1.x

Description:
Andrea Fabrizi has reported a vulnerability in Buffalo TeraStation Network Attached Storage (NAS) TS-Series, which can be exploited by malicious people to disclose potentially sensitive information.

Input passed via the "gKey" parameter to cgi-bin/sync.cgi (when "gPage" is set to "information", "gMode" is set to "log", and "gTyp" is set to "save") is not properly verified before being used. This can be exploited to download arbitrary files.

The vulnerability is reported in version 1.57. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Andrea Fabrizi

Original Advisory:
http://www.andreafabrizi.it/?exploits:terastation

http://secunia.com/advisories/52012/

Release Date: 2013-02-07

Criticality level: Not critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: CyaSSL 2.x

Description:
A weakness has been reported in CyaSSL, which can be exploited by malicious people to disclose certain sensitive information.

The weakness is caused due to the CBC ciphersuite of the Transport Layer Security (TLS) implementation exposing timing differences when verifying the padding checks. This can be exploited to recover parts of the plaintext via a timing attack.

The weakness is reported in versions prior to 2.5.0.

Solution:
Update to version 2.5.0.

Provided and/or discovered by:
Nadhem Alfardan and Kenny Paterson.

Original Advisory:
CyaSSL:
http://www.yassl.com/yaSSL/Docs-cyassl-changelog.html

Nadhem Alfardan and Kenny Paterson:
http://www.isg.rhul.ac.uk/tls/

http://secunia.com/advisories/52028/

Release Date: 2013-02-07

Criticality level: Not critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: MatrixSSL 3.x

Description:
A weakness has been reported in MatrixSSL, which can be exploited by malicious people to disclose certain sensitive information.

The weakness is caused due to the CBC ciphersuite of the Transport Layer Security (TLS) implementation exposing timing differences when verifying the padding checks. This can be exploited to recover parts of the plaintext via a timing attack.

The weakness is reported in versions prior to 3.4.1.

Solution:
Update to version 3.4.1.

Provided and/or discovered by:
Nadhem Alfardan and Kenny Paterson.

Original Advisory:
MatrixSSL:
http://www.matrixssl.org/news.html

Nadhem Alfardan and Kenny Paterson:
http://www.isg.rhul.ac.uk/tls/

http://secunia.com/advisories/52126/

Release Date : 2013-02-07

Criticality level : Less critical
Impact: Cross Site Scripting
Spoofing
Manipulation of data
Where : From remote
Solution Status : Vendor Patch

Software: IBM Netezza 7.x

Description:
A weakness and multiple vulnerabilities have been reported in IBM Netezza, which can be exploited by malicious users to manipulate certain data and conduct script insertion and SQL injection attacks and by malicious people to conduct spoofing attacks.

1) Certain unspecified input passed is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Certain unspecified input is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

3) An error when verifying the authenticity of requests can be exploited to manipulate certain data.

4) Certain unspecified input is not properly verified before being used. This can be exploited to display an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.

The weakness and the vulnerabilities are reported in version 7.0.

Solution:
Apply patch version 7.0 P2.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://www.ibm.com/support/docview.wss?uid=swg21624568

http://secunia.com/advisories/52107/

Microsoft System Center Operations Manager Cross-Site Scripting Vulnerabilities

Release Date: 2013-01-08
Last Update : 2013-02-07

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Partial Fix

Software: Microsoft System Center Operations Manager 2007

Description:
Two vulnerabilities have been reported in Microsoft System Center Operations Manager, which can be exploited by malicious people to conduct cross-site scripting attacks.

1) Certain unspecified input passed to the Web Console is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed to the "__CALLBACKPARAM" parameter in InternalPages/ExecuteTask.aspx is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Input passed via the URL or the "DisplayMode" and "SearchStr" parameters in ResultViews/ViewTypeManager.aspx is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution:
Apply patches.

Provided and/or discovered by:
1) Reported by the vendor.
2, 3) Andy Yang, Stratsec.

Original Advisory:
MS13-003 (KB2783850):
http://technet.microsoft.com/en-us/security/bulletin/ms13-003

Stratsec:
http://www.stratsec.net/Research/Advisories/Microsoft-System-Center-Operations-Manager-(SCOM)-

http://secunia.com/advisories/51686

GNOME Online Accounts SSL Certificate Verification Security Issue

Release Date : 2013-02-07

Criticality level : Less critical
Impact : Spoofing
Where : From remote
Solution Status : Vendor Patch

Software: GNOME Online Accounts 3.x

Description:
Simon McVittie has reported a security issue in GNOME Online Accounts, which can be exploited by malicious people to conduct spoofing attacks.

The security issue is caused due to the application not properly verifying a server SSL certificate, which can be exploited to e.g. spoof a server via MitM (Man-in-the-Middle) attacks.

The security issue is reported in version 3.4.2 and versions 3.7.x prior to 3.7.5. Other versions may also be affected.

Solution:
Apply updates if available.

Provided and/or discovered by:
Simon McVittie

Original Advisory:
Gnome Online Accounts:
http://git.gnome.org/browse/gnome-online-accounts/tree/NEWS
http://git.gnome.org/browse/gnome-online-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e

Simon McVittie:
http://seclists.org/oss-sec/2013/q1/239
https://bugzilla.gnome.org/show_bug.cgi?id=693214

http://secunia.com/advisories/51976/

HP LeftHand Virtual SAN Appliance Software Multiple Vulnerabilities

Release Date : 2013-02-07

Criticality level : Moderately critical
Impact : System access
Where : From local network
Solution Status : Unpatched

Software:
HP StorageWorks P4000 Virtual SAN Appliance Software 8.x
HP StorageWorks P4000 Virtual SAN Appliance Software 9.x

Description:
Multiple vulnerabilities have been reported in HP LeftHand Virtual SAN Appliance Software, which can be exploited by malicious people to compromise a vulnerable system.

1) An unspecified error in the hydra component can be exploited to potentially execute arbitrary code.

2) An unspecified error in the hydra component can be exploited to potentially execute arbitrary code.

3) An unspecified error in the hydra component can be exploited to potentially execute arbitrary code.

4) An unspecified error in the hydra component can be exploited to potentially execute arbitrary code.

The vulnerabilities are reported in versions prior to 10.0.

Solution:
Upgrade to version 10.0.

Provided and/or discovered by:
The vendor credits e6af8de8b1d4b2b6d5ba2610cbf9cd38 via ZDI.

Original Advisory:
HPSBST02846 SSRT100798:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03661318

http://secunia.com/advisories/52110/