Spyware, viruses, & security forum: VULNERABILITIES / FIXES - February 21, 2013

Drupal Menu Reference Module Menu Link Title Script Insertion Vulnerability

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Drupal Menu Reference Module 7.x

Description:
A vulnerability has been reported in the Menu Reference module for Drupal, which can be exploited by malicious users to conduct script insertion attacks.

Input passed via the menu link title is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires the "Administer menus and menu items" permission.

The vulnerability is reported in 7.x-1.x versions prior to 7.x-1.0.

Solution:
Update to version 7.x-1.1.

Provided and/or discovered by:
The vendor credits Tamas Demeter-Haludka

Original Advisory:
SA-CONTRIB-2013-022:
http://drupal.org/node/1922446

http://secunia.com/advisories/52296/

Drupal Taxonomy Manager Module Cross-Site Request Forgery Vulnerability

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Drupal Taxonomy Manager Module 6.x

Description:
A vulnerability has been reported in the Taxonomy Manager module for Drupal, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain unspecified requests if a logged-in administrative user visits a malicious web site.

The vulnerability is reported in 6.x-2.x versions prior to 6.x-2.2.

Solution:
Update to version 6.x-2.3.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
SA-CONTRIB-2013-018:
http://drupal.org/node/1922410

http://secunia.com/advisories/52300/

Release Date : 2013-02-21

Criticality level : Highly critical
Impact : Exposure of sensitive information
System access
Where: From remote
Solution Status : Vendor Patch

Software:
Red Hat Enterprise Linux Desktop Supplementary (v. 6)
Red Hat Enterprise Linux HPC Node Supplementary (v. 6)
Red Hat Enterprise Linux Server Supplementary (v. 6)
Red Hat Enterprise Linux Workstation Supplementary (v. 6)
RHEL Desktop Supplementary (v. 5 client)
RHEL Supplementary (v. 5 server)

Description:
Red Hat has issued an update for java-1.6.0-sun. This fixes multiple vulnerabilities, which can be exploited by malicious people to disclose certain sensitive information and compromise a user's system.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0531-01:
https://rhn.redhat.com/errata/RHSA-2013-0531.html

http://secunia.com/advisories/52307/

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Drupal Display Suite Plugin 7.x

Description:
A vulnerability has been reported in the Display Suite module for Drupal, which can be exploited by malicious users to conduct script insertion attacks.

Certain input is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires a contributed module being installed that alter usernames e.g. the realname module and the author field must be displayed as plain text "author".

The vulnerability is reported in 7.x-1.x versions prior to 7.x-1.7 and 7.x-2.x versions prior to 7.x-2.1.

Solution:
Update the a fixed version.

Provided and/or discovered by:
The vendor credits Stephane Corlosquet, Drupal Security Team.

Original Advisory:
SA-CONTRIB-2013-021:
http://drupal.org/node/1922438

http://secunia.com/advisories/52297/

Release Date : 2013-02-21

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System:
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6

Description:
Red Hat has issued an update for sssd. This fixes multiple vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service).

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0508-02:
https://rhn.redhat.com/errata/RHSA-2013-0508.html

http://secunia.com/advisories/52315/

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Piwigo 2.x

Description:
A vulnerability has been reported in Piwigo, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to perform certain actions related to LocalFiles Editor when a logged-in user visits a specially crafted web page.

The vulnerability is reported in versions prior to 2.4.7.

Solution:
Update to version 2.4.7.

Provided and/or discovered by:
The vendor credits High-Tech Bridge SA.

Original Advisory:
http://piwigo.org/forum/viewtopic.php?id=21470
http://freecode.com/projects/piwigo/releases/352431
http://piwigo.org/bugs/view.php?id=0002844

http://secunia.com/advisories/52228/

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Operating System:
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6

Description:
Red Hat has issued an update for httpd. This fixes a vulnerability, which can be exploited by malicious people to conduct cross-site scripting attacks.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0512-2:
https://rhn.redhat.com/errata/RHSA-2013-0512.html

http://secunia.com/advisories/52319/

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Privilege escalation
DoS
Where : Local system
Solution Status : Vendor Patch

Operating System:
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6

Description:
Red Hat has issued an update for pam. This fixes two vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and potentially gain escalated privileges.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0521-2:
https://rhn.redhat.com/errata/RHSA-2013-0521.html

http://secunia.com/advisories/52291/

Release Date : 2013-02-21

Criticality level : Less critical
Impact : System access
DoS
Where : From remote
Solution Status : Vendor Patch

Operating System:
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6

Description:
Red Hat has issued an update for pcsc-lite. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0525-2:
https://rhn.redhat.com/errata/RHSA-2013-0525.html

http://secunia.com/advisories/52281/

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Security Bypass
Where : From local network
Solution Status : Vendor Patch

Operating System:
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6

Description:
Red Hat has issued an update for 389-ds-base. This fixes a vulnerability, which can be exploited by malicious users to bypass certain security restrictions.

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0503-03:
https://rhn.redhat.com/errata/RHSA-2013-0503.html

http://secunia.com/advisories/52323/

Release Date : 2013-02-21

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System :
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6

Description:
Red Hat has issued an update for dhcp. This fixes a security issue, which can be exploited by malicious people to cause a DoS (Denial of Service).

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0504-02:
https://rhn.redhat.com/errata/RHSA-2013-0504.html

http://secunia.com/advisories/52322/

Release Date : 2013-02-21

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System:
openSUSE 12.1
openSUSE 12.2

Description:
SUSE has issued an update for postgresql91. This fixes a vulnerability, which can be exploited by malicious users to cause a DoS (Denial of Service).

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2013:0318-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00059.html

http://secunia.com/advisories/52290/

WordPress Contact Form Plugin "cntctfrm_contact_email" Cross-Site Scripting Vulnerability

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: WordPress Contact Form Plugin 3.x

Description:
A vulnerability has been discovered in the Contact Form plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "cntctfrm_contact_email" POST parameter to index.php is not properly sanitised in wp-content/plugins/contact-form-plugin/trunk/contact_form.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in the context of an affected site.

The vulnerability is confirmed in version 3.36. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Disclosed within a SVN commit.

Original Advisory:
http://wordpress.org/extend/plugins/contact-form-plugin/changelog/
http://plugins.trac.wordpress.org/changeset/670240/contact-form-plugin/trunk

http://secunia.com/advisories/52250/

SAP NetWeaver GRMGApp XML External Entity and Security Bypass Vulnerabilities

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Exposure of sensitive information
Security Bypass
Where : From local network
Solution Status : Vendor Patch

Software: SAP NetWeaver 7.x

Description:
ERPScan has reported two vulnerabilities in SAP NetWeaver, which can be exploited by malicious people to disclose potentially sensitive information and bypass certain security restrictions.

1) An error within GRMGApp due to the application not properly restricting access can be exploited to e.g send administrative commands to the Gateway or Message server.

2) An unspecified error within GRMGApp when parsing external XML entities can be exploited to e.g. disclose local files.

Solution:
Apply SAP Note 1729293 and 1725390.

Provided and/or discovered by:
Dmitriy Chastukhin, ERPScan

Original Advisory:
SAP:
https://service.sap.com/sap/support/notes/1729293
https://service.sap.com/sap/support/notes/1725390

DSECRG-13-002:
http://erpscan.com/advisories/dsecrg-13-002-sap-grmgapp-xxe-and-authentication-bypass/

http://secunia.com/advisories/52272/

Drupal Ubercart Views Module "full name" Script Insertion Vulnerability

Release Date : 2013-02-21

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Vendor Patch

Software: Drupal Ubercart Views Module 6.x

Description:
A vulnerability has been reported in the Ubercart Views module for Drupal, which can be exploited by malicious people to conduct script insertion attacks.

Certain input related to the "full name" field in Views is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires the ability to store a name in an order within the checkout process.

The vulnerability is reported in versions prior to 6.x-3.3.

Solution:
Update to version 6.x-3.3.

Provided and/or discovered by:
The vendor credits 20th.

Original Advisory:
SA-CONTRIB-2013-019:
http://drupal.org/node/1922416

http://secunia.com/advisories/52299/