Spyware, viruses, & security forum: VULNERABILITIES / FIXES - March 01, 2013

Kingsoft Office Writer 2010 RTF Buffer Overflow Vulnerability

Release Date : 2013-03-01

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status: Vendor Patch

Software: Kingsoft Office 2010

Description:
A vulnerability has been reported in Kingsoft Office, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an unspecified error in Kingsoft Writer, which can be exploited to cause a buffer overflow by tricking a user into opening a specially crafted rich text file (RTF).

Successful exploitation may allow the execution of arbitrary code, but requires tricking a user into opening a malicious file.

The vulnerability is reported in versions prior to 2724.

Solution:
Update to version 2724.

Provided and/or discovered by:
JVN credits Yuji Ukai, Fourteenforty Research Institute, Inc.

Original Advisory:
Kingsoft (Japanese):
http://www.kingsoft.jp/support/office/support_news/writer2010_2723

JVN (English):
http://jvn.jp/en/jp/JVN55924624/index.html
http://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000016.html

JVN (Japanese):
http://jvn.jp/jp/JVN55924624/index.html

http://secunia.com/advisories/52409/

Release Date : 2013-03-01

Criticality level : Less critical
Impact : DoS
Where : From remote
Solution Status : Vendor Patch

Operating System :
Red Hat Enterprise Linux Desktop 5
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Server 5
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Workstation 6
RHEL Desktop Workstation 5

Description:
Red Hat has issued an update for libxml2. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).

Solution:
Updated packages are available via Red Hat Network.

Original Advisory:
RHSA-2013:0581-1:
http://rhn.redhat.com/errata/RHSA-2013-0581.html

http://secunia.com/advisories/52438/

Release Date : 2013-03-01

Criticality level: Highly critical
Impact: Security Bypass
Exposure of sensitive information
System access
Where : From remote
Solution Status : Vendor Patch

Operating System: openSUSE 12.2

Description:
SUSE has issued an update for flash-player. This fixes multiple vulnerabilities, which can be exploited by malicious people to bypass certain security restrictions, disclose certain sensitive information, and compromise a user's system.

Solution:
Apply updated packages via the zypper package manager.

Original Advisory:
openSUSE-SU-2013:0362-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00082.html

openSUSE-SU-2013:0364-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00084.html

openSUSE-SU-2013:0359-2:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00086.html

openSUSE-SU-2013:0367-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00090.html

openSUSE-SU-2013:0295-2:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00091.html

openSUSE-SU-2013:0279-2:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00092.html

openSUSE-SU-2013:0368-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00094.html

openSUSE-SU-2013:0370-1:
http://lists.opensuse.org/opensuse-updates/2013-02/msg00096.html

http://secunia.com/advisories/52444/

Release Date : 2013-03-01

Criticality level : Highly critical
Impact: Privilege escalation
DoS
System access
Manipulation of data
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software:
IBM Java 1.4.x
IBM Java 5.x
IBM Java 6.x
IBM Java 7.x

Description:
IBM has acknowledged a weakness and multiple vulnerabilities in IBM Java, which can be exploited by malicious local users to gain escalated privileges and by malicious people to disclose certain sensitive information, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system.

Solution:
Update to a patched version. Please see the vendor's advisory for more details.

Original Advisory:
http://www.ibm.com/developerworks/java/jdk/alerts/

http://secunia.com/advisories/52308/

Cisco NAC Mac Agent ISE SSL Certificate Verification Security Issue

Release Date: 2013-03-01

Criticality level : Less critical
Impact : Spoofing
Where : From local network
Solution Status : Unpatched

Software: Cisco NAC Appliance (formerly Cisco Clean Access (CCA)) 4.x

Description:
A security issue has been reported in Cisco Network Admission Control (NAC), which can be exploited by malicious people to conduct spoofing attacks.

The security issue is caused due to the Cisco Network Admission Control Mac Agent not properly verifying the SSL certificate while connecting to Identity Services Engine (ISE) server. This can be exploited to e.g. spoof the ISE server via a MitM (Man-in-the-Middle) attack and e.g. disclose potentially sensitive information.

The security issue is reported in version 4.9(0.651). Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Cisco:
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1124

http://secunia.com/advisories/52395/

Cisco Aironet Access Points and Bridges HTTP Profiler Denial of Service Vulnerability

Release Date: 2013-03-01

Criticality level : Less critical
Impact : DoS
Where : From local network
Solution Status : Vendor Patch

Operating System: Cisco Aironet Access Points and Bridges 7.x

Description:
A vulnerability has been reported in Cisco Aironet Access Points and Bridges, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an incorrect buffer handling by HTTP profiler. This can be exploited to cause a crash by sending specially crafted HTTP requests.

The vulnerability is reported in version 7.3(101.0). Prior versions may also be affected.

Solution:
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
Cisco:
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6026

http://secunia.com/advisories/52435/

Release Date : 2013-03-01

Criticality level : Not critical
Impact : Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch

Software: WebCalendar 1.x

Description:
A weakness has been discovered in WebCalendar, which can be exploited by malicious people to disclose certain sensitive information.

The weakness is caused due to the application returning different responses depending on validity of provided user name. This can be exploited to enumerate valid user names.

The weakness is confirmed in version 1.2.6. Prior versions may also be affected.

Solution:
Update to version 1.2.7.

Provided and/or discovered by:
Kenneth F. Belva

Original Advisory:
http://securitymaverick.com/vulnerability-cve-2013-1422-webcalendar-1-2-5-1-2-6-valid-user-determination/

http://secunia.com/advisories/52414/

Release Date : 2010-04-05
Last Update : 2013-03-01

Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched

Software: WebCalendar 1.x

Description:
Multiple vulnerabilities have been discovered in WebCalendar, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting and request forgery attacks.

1) Input passed via the "name", "description", and "location" parameters to edit_entry_handler.php is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

2) Input passed via the "color" parameter to colors.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Input appended to the URL after e.g. about.php or year.php is not properly sanitised in includes/init.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

4) Input passed via the "form", "fday", "fmonth", and "fyear" parameters to datesel.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

5) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. delete an event, ban an IP address from posting, or change the administrative password if a logged-in administrative user visits a malicious web site.

6) Input passed via the "catname" POST parameter to category_handler.php is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site if malicious data is viewed.

The vulnerabilities are confirmed in version 1.2.7. Other versions may also be affected.

Solution:
No official solution is currently available.

Provided and/or discovered by:
1) Matt Jezorek
2) High-Tech Bridge SA
3, 4) Stefan Schurtz
5) Russ McRee
6) Kenneth F. Belva

Original Advisory:
Matt Jezorek:
https://www.upsploit.com/index.php/advisories/view/UPS-2010-0004

High-Tech Bridge SA (HTB22930):
http://www.htbridge.ch/advisory/xss_in_webcalendar.html

SSCHADV2011-008:
http://www.rul3z.de/advisories/SSCHADV2011-008.txt

Russ McRee:
http://holisticinfosec.org/content/view/133/45/

Kenneth F. Belva:
http://securitymaverick.com/vulnerability-cve-2013-1421-webcalendar-1-2-5-1-2-6-category-name-persistent-xss/

http://secunia.com/advisories/44024

Release Date : 2013-03-01

Criticality level : Moderately critical
Impact : Cross Site Scripting
Exposure of sensitive information
Where : From remote
Solution Status: Vendor Patch

Software: mnoGoSearch 3.x

Description:
Two vulnerabilities have been reported in mnoGoSearch, which can be exploited by malicious people to disclose certain sensitive information and conduct cross-site scripting attacks.

1) An error when parsing certain QUERY_STRING parameters can be exploited to disclose the contents of arbitrary files.

2) Input passed via e.g. the "STORED" parameter to search/index.html (when "q" is set to "x") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

The vulnerabilities are reported in version 3.3.12. Prior versions may also be affected.

Solution:
Update to version 3.3.13.

Provided and/or discovered by:
Sergey Bobrov, Positive Research Center

Original Advisory:
http://www.mnogosearch.org/doc33/msearch-changelog.html

http://secunia.com/advisories/52401/