Spyware, viruses, & security forum: VULNERABILITIES / FIXES - February 08, 2013

Release Date : 2013-02-08

Criticality level : Extremely critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Adobe Flash Player 11.x

Description:
Two vulnerabilities have been reported in Adobe Flash Player, which can be exploited by malicious people to compromise a user's system.

1) An unspecified error can be exploited to cause a buffer overflow.

NOTE: This vulnerability is currently being actively exploited in targeted attacks against the Windows version.

2) An unspecified error can be exploited to corrupt memory.

NOTE: This vulnerability is currently being actively exploited in targeted attacks against the Macintosh and Windows versions.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

The vulnerabilities are reported in the following versions:
* Adobe Flash Player versions 11.5.502.146 and earlier for Windows and Macintosh
* Adobe Flash Player versions 11.2.202.261 and earlier for Linux
* Adobe Flash Player versions 11.1.115.36 and earlier for Android 4.x
* Adobe Flash Player versions 11.1.111.31 and earlier for Android 3.x
* Adobe Flash Player versions 11.5.31.137 and earlier for Chrome users
* Adobe Flash Player versions 11.3.378.5 and earlier for Internet Explorer 10 users on Windows 8

Solution:
Update to a fixed version.

Provided and/or discovered by:
1, 2) Reported as 0-day.

Original Advisory:
http://www.adobe.com/support/security/bulletins/apsb13-04.html
http://blogs.adobe.com/psirt/2013/02/security-updates-available-for-adobe-flash-player-apsb13-04.html

http://secunia.com/advisories/52116/

Release Date : 2013-02-08

Criticality level : Less critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Software: Debian GNU/Linux 6.0

Description:
Debian has issued an update for ircd-hybrid. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).

Solution:
Apply updated packages via the apt-get package manager.

Original Advisory:
DSA-2618-1:
http://www.debian.org/security/2013/dsa-2618

http://secunia.com/advisories/52106/

Release Date : 2013-02-08

Criticality level : Not critical
Impact : DoS
Where : Local system
Solution Status : Vendor Patch

Operating System :
Red Hat Enterprise Linux Desktop 5
Red Hat Enterprise Linux Server 5

Description:
Red Hat has issued an update for xen. This fixes a vulnerability, which can be exploited by malicious, local users in a guest virtual machine to cause a DoS (Denial of Service).

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0241-1:
https://rhn.redhat.com/errata/RHSA-2013-0241.html

http://secunia.com/advisories/52118/

CubeCart "unserialize()" Configuration Manipulation Vulnerability

Release Date : 2013-02-08

Criticality level : Moderately critical
Impact : Security Bypass
Where : From remote
Solution Status : Vendor Patch

Software: CubeCart 5.x

Description:
Egidio Romano has discovered a vulnerability in CubeCart, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to the classes/cubecart.class.php script using the "unserialize()" function with user controlled input, which can be exploited save a serialised object in the database and e.g. manipulate the configuration using the "__destruct()" method of the "Config" class.

The vulnerability is confirmed in version 5.2.0. Prior versions may also be affected.

Solution:
Update to version 5.2.1.

Provided and/or discovered by:
Egidio Romano (Egix)

Original Advisory:
CubeCart:
http://forums.cubecart.com/?showtopic=47026

Egidio Romano (Egix):
http://karmainsecurity.com/KIS-2013-02

http://secunia.com/advisories/52072/

Cybozu Garoon Cross-Site Scripting and SQL Injection Vulnerabilities

Release Date : 2013-02-08

Criticality level : Less critical
Impact : Cross Site Scripting
Manipulation of data
Where : From remote
Solution Status : Vendor Patch

Software: Cybozu Garoon 3.x

Description:
Two vulnerabilities have been reported in Cybozu Garoon, which can be exploited by malicious users to conduct SQL injection attacks and by malicious people to conduct cross-site scripting attacks.

1) Certain unspecified input is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability requires logging permission.

2) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions 3.5.3 and prior.

Solution:
Update to version 3.5.4.

Provided and/or discovered by:
JVN credits Ken Asai.

Original Advisory:
Cybozu (Japanese):
http://cs.cybozu.co.jp/information/20130125up01.php
http://cs.cybozu.co.jp/information/20130125up02.php
https://support.cybozu.com/ja/article/6116
https://support.cybozu.com/ja/article/6117

JVN (English):
http://jvn.jp/en/jp/JVN95863326/index.html
http://jvn.jp/en/jp/JVN07629635/index.html
http://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000008.html
http://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000007.html

JVN (Japanese):
http://jvn.jp/jp/JVN07629635/index.html
http://jvn.jp/jp/JVN95863326/index.html

http://secunia.com/advisories/52042/

Release Date : 2013-02-08

Criticality level : Moderately critical
Impact : DoS
System access
Where : From remote
Solution Status : Vendor Patch

Software: FFmpeg 1.x

Description:
Multiple vulnerabilities have been reported in FFmpeg, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

1) Some integer overflows exist within the "process_frame_obj()" function (libavcodec/sanm.c) when parsing certain data.

2) An error within the "old_codec47()" function (libavcodec/sanm.c) can be exploited to cause a buffer overflow.

3) An error within the "gif_copy_img_rect()" function (libavcodec/gifdec.c) can be exploited to cause a crash.

4) A boundary error within the "vqa_decode_chunk()" function (libavcodec/vqavideo.c) can be exploited to cause a buffer overflow.

5) A boundary error within the "aac_decode_init()" function (libavcodec/aacdec.c) can be exploited to cause cause a crash.

6) An error within the "decode_slice_header()" function (libavcodec/h264.c) can be exploited to cause a crash.

7) An error within the "generate_joint_tables()" function (libavcodec/huffyuvdec.c) can be exploited to cause a buffer overflow.

8) An error within the "field_end()" function (libavcodec/h264.c) can be exploited to cause a crash.

The vulnerabilities are reported in versions prior to 1.1.2.

Solution:
Update to version 1.1.2.

Provided and/or discovered by:
The vendor credits Mateusz "j00ru" Jurczyk and Gynvael Coldwind.

Original Advisory:
http://ffmpeg.org/security.html

http://secunia.com/advisories/52093/

Release Date : 2013-02-08

Criticality level : Less critical
Impact : Cross Site Scripting
Exposure of system information
Where : From remote
Solution Status : Unpatched

Software: SiteGo 1.x

Description:
Multiple vulnerabilities have been discovered in SiteGo, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose certain system information.

1) The application does not properly restrict access to the admin/include/phpinfo.php script, which can be exploited to e.g. disclose PHP and web server configuration.

2) Input passed via the "Browse" GET parameter (when "action" is set to "vote" and "page" is set to a valid page number) and the "delete" GET parameter (when "action" is set to "MailList" and "reason" is set to "1") to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

The vulnerabilities are confirmed in version 1.0.

Solution:
No official solution is currently available.

Provided and/or discovered by:
L0n3ly-H34rT

Original Advisory:
http://packetstormsecurity.com/files/120122/SiteGo-Local-File-Inclusion-Cross-Site-Scripting.html

http://secunia.com/advisories/52123/

Release Date : 2013-02-08

Criticality level : Not critical
Impact : Exposure of system information
Where : Local system
Solution Status : Vendor Patch

Software: Rack 1.x

Description:
A security issue has been reported in Rack, which can be exploited by malicious, local users to disclose potentially sensitive information.

The security issue is caused due to the application using files in an insecure manner, which can be exploited to disclose potentially sensitive information via symlink attacks.

The security issue is reported in versions prior to 1.4.5 and 1.5.2.

Solution:
Update to version 1.4.5 or 1.5.2.

Provided and/or discovered by:
Ben Murphy

Original Advisory:
https://groups.google.com/forum/#!msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ
https://groups.google.com/forum/#!msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ

http://secunia.com/advisories/52033/

ActiveFax (ActFax) LPD/LPR and RAW Server Buffer Overflow Vulnerabilities

Release Date : 2013-02-08

Criticality level : Moderately critical
Impact : System access
Where : From local network
Solution Status : Unpatched

Software: ActiveFax (ActFax) 5.x

Description:
Some vulnerabilities have been discovered in ActiveFax (ActFax), which can be exploited by malicious people to compromise a vulnerable system.

1) Some boundary errors within the RAW server when processing the "@F000", "@F506", and "@F605" data fields can be exploited to cause stack-based buffer overflows by sending a specially crafted command to the server.

2) A boundary error exists within the LPD/LPR server.

The vulnerabilities are confirmed in version 5.01 build 0232. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
1) Craig Freyman

Original Advisory:
http://packetstormsecurity.com/files/120109/ActFax-5.01-RAW-Server-Buffer-Overflow.html

http://secunia.com/advisories/52096/

Release Date : 2013-02-08

Criticality level : Less critical
Impact : Exposure of system information
Where : From remote
Solution Status : Unpatched

Software:
ezStats2 for Medal of Honor Warfighter 1.x
ezStats2 for Playstation Network 1.x
ezStats2 Serverviewer 0.x

Description:
A weakness has been discovered in multiple ezStats products, which can be exploited by malicious people to disclose certain system information.

The application provides unrestricted access to admin/apitest.php.

List of affected products:
* ezStats2 for Playstation Network version 1.10.
* ezStats2 Serverviewer version 0.62.
* ezStats2 for Medal of Honor Warfighter version 1.0.

Solution:
No official solution is currently available.

Provided and/or discovered by:
L0n3ly-H34rT.

Original Advisory:
http://se3c.blogspot.dk/2013/02/ezstats2-for-playstation-network-v110.html
http://se3c.blogspot.dk/2013/02/ezstats2-serverviewer-v062-local-file.html
http://se3c.blogspot.dk/2013/02/ezstats2-for-medal-of-honor-warfighter.html

http://secunia.com/advisories/52097/

Microsoft System Center Operations Manager Cross-Site Scripting Vulnerabilities

Release Date : 2013-01-08
Last Update : 2013-02-08

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status: Partial Fix

Software: Microsoft System Center Operations Manager 2007

Description:
Multiple vulnerabilities have been reported in Microsoft System Center Operations Manager, which can be exploited by malicious people to conduct cross-site scripting attacks.

1) Certain unspecified input passed to the Web Console is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed to the "__CALLBACKPARAM" parameter in InternalPages/ExecuteTask.aspx is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Input passed via the URL or the "DisplayMode" and "SearchStr" parameters in ResultViews/ViewTypeManager.aspx is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution:
Apply patches.

Provided and/or discovered by:
1) Reported by the vendor.
2, 3) Andy Yang, Stratsec.

Original Advisory:
MS13-003 (KB2783850):
http://technet.microsoft.com/en-us/security/bulletin/ms13-003

Stratsec:
http://www.stratsec.net/Research/Advisories/Microsoft-System-Center-Operations-Manager-(SCOM)-

http://secunia.com/advisories/51686