Spyware, viruses, & security forum: VULNERABILITIES / FIXES - February 13, 2013

Release Date : 2013-02-13

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software:
BlackBerry Enterprise Server 5.x
BlackBerry Enterprise Server Express for Domino 5.x
Blackberry Enterprise Server Express for Exchange 5.x
BlackBerry Enterprise Server for Domino 5.x
Blackberry Enterprise Server for Exchange 5.x
BlackBerry Enterprise Server for Novell GroupWise 5.x

Description:
Research In Motion has acknowledged two vulnerabilities in BlackBerry Enterprise Server, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerabilities exist in the bundled version of LibTIFF, which is used by the BlackBerry Mobile Data System Connection Service and the BlackBerry Messaging Agent.

The vulnerabilities are reported in the following products:
* BlackBerry Enterprise Server Express versions 5.0.4 and prior for Microsoft Exchange and IBM Lotus Domino
* BlackBerry Enterprise Server versions 5.0.4 and prior for Microsoft Exchange, IBM Lotus Domino, and Novell Groupwise

Solution:
Update to a fixed version or apply interim security update.

Original Advisory:
BSRT-2013-003:
http://www.blackberry.com/btsc/KB33425

http://secunia.com/advisories/52168/

Release Date : 2013-02-13

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System:
Ubuntu Linux 10.04
Ubuntu Linux 11.10
Ubuntu Linux 12.04
Ubuntu Linux 8.04

Description:
Ubuntu has issued an update for postgresql. This fixes a vulnerability, which can be exploited by malicious users to cause a DoS (Denial of Service).

Solution:
Apply updated packages.

Original Advisory:
USN-1717-1:
http://www.ubuntu.com/usn/usn-1717-1/

http://secunia.com/advisories/52174/

Release Date : 2013-02-13

Criticality level : Highly critical
Impact : Exposure of sensitive information
System access
Where : From remote
Solution Status : Vendor Patch

Software:
Red Hat Enterprise Linux Desktop Supplementary (v. 6)
Red Hat Enterprise Linux Server Supplementary (v. 6)
Red Hat Enterprise Linux Workstation Supplementary (v. 6)
RHEL Desktop Supplementary (v. 5 client)
RHEL Supplementary (v. 5 server)

Description:
Red Hat has issued an update for flash-plugin. This fixes multiple vulnerabilities, which can be exploited by malicious people to disclose certain sensitive information and compromise a user's system.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0254-01:
https://rhn.redhat.com/errata/RHSA-2013-0254.html

http://secunia.com/advisories/52203/

IBM WebSphere Cast Iron Cloud Integration Unspecified Vulnerability

Release Date : 2013-02-13

Criticality level : Moderately critical
Impact : Unknown
Where : From local network
Solution Status : Vendor Patch

Software: IBM WebSphere Cast Iron Cloud Integration 6.x

Description:
A vulnerability with an unknown impact has been reported in WebSphere Cast Iron Cloud Integration.

The vulnerability is caused due to an unspecified error when using LDAP authentication. No further information is currently available.

Please see the vendor's advisory for a list of affected versions.

Solution:
Apply updates (please see the vendor's advisory for details).

Original Advisory:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21623324

http://secunia.com/advisories/52191/

Accela / eAccela BizSearch Unspecified Spoofing Vulnerability

Release Date : 2013-02-13

Criticality level : Less critical
Impact : Spoofing
Where : From remote
Solution Status : Vendor Patch

Software:
Accela BizSearch 3.x
eAccela BizSearch 2.x

Description:
A vulnerability has been reported in Accela / eAccela BizSearch, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to an unspecified error and can be exploited to impersonate another user and subsequently disclose certain information.

Successful exploitation requires single sign on to be enabled in the Accela BizSearch gateway options.

Please see the vendor's advisory for a list of affected version.

Solution:
Apply patch (please see the vendor's advisory for details).

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Fujitsu (Japanese):
http://software.fujitsu.com/jp/security/products-fujitsu/solution/bizsearch201301.html

http://secunia.com/advisories/52200/

Release Date : 2013-02-13

Criticality level : Moderately critical
Impact : Unknown
Where : From remote
Solution Status : Vendor Patch

Operating System: openSUSE 12.1

Description:
SUSE has issued an update for opera. This fixes a vulnerability with an unknown impact.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2013:0289-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00038.html

http://secunia.com/advisories/52204/

Release Date : 2012-11-12
Last Update : 2013-02-13

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Roundup 1.x

Description:
Multiple vulnerabilities have been reported in Roundup, which can be exploited by malicious people to conduct cross-site scripting attacks.

1) Input passed via the username is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed via the "@action" parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Input passed via the "otk" parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

4) Input passed via the ok and error messages is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions prior to 1.4.20.

Solution:
Update to version 1.4.20.

Provided and/or discovered by
1) The vendor credits Thomas Arendsen Hein.
2) Reported by the vendor.
3) The vendor credits Jesse Ruderman.
4) The vendor credits David Benjamin.

Original Advisory:
http://roundup.hg.sourceforge.net/hgweb/roundup/roundup/raw-file/default/CHANGES.txt

http://secunia.com/advisories/51230