Last day to save $500 for SANS San Diego 2013

@RISK: The Consensus Security Vulnerability Alert

Volume: X, Issue: 13
April 1, 2011

SANS Newsletters Home

@RISK is the SANS community's consensus bulletin summarizing the most important vulnerabilities and exploits identified during the past week and providing guidance on appropriate actions to protect your systems (PART I). It also includes a comprehensive list of all new vulnerabilities discovered in the past week (PART II).

Summary of the vulnerabilities reported this week:

    • Category
    • # of Updates & Vulnerabilities
    • Summary of Updates and Vulnerabilities in this Consensus
    • Platform Number of Updates and Vulnerabilities
    • - ------------------------ -------------------------------------
    • Third Party Windows Apps
    • 1 (#1)
    • Mac Os
    • 1
    • Linux
    • 2
    • Cross Platform
    • 23 (#2,#3,#4)
    • Web Application - Cross Site Scripting
    • 2
    • Web Application
    • 3
    • Network Device
    • 1

***************** Sponsored By Industrial Defender ***************

Industrial Defender is the global leader in Automation System Security Management, assuring the availability, reliability and security of critical infrastructure.

http://www.sans.org/info/74383 ***************************************************************** TRAINING UPDATE

-- The National Cybersecurity Innovation Conference, April 18-19, 2011 User-to-user conference featuring outstanding examples of continuous monitoring and security in the cloud. http://www.sans.org/cyber-security-innovations-2011/ -- 2011 Asia Pacific SCADA and Process Control Summit, Sydney, Australia, March 31-April 7, 2011 http://www.sans.org/sydney-scada-2011/ -- SANS Northern Virginia 2011, Reston, VA, April 15-23, 2011 11 courses. Bonus evening presentations include Cyberwar or Business as Usual? The State of US Federal CyberSecurity Efforts http://www.sans.org/northern-virginia-2011/ -- SANS Security West 2011, San Diego, CA, May 3-12, 2011 23 courses. Bonus evening presentations include The Emerging Security Threat Panel Discussion; and Emerging Trends in Data Law and Investigation http://www.sans.org/security-west-2011/ -- SANS Cyber Guardian 2011, Baltimore, MD, May 15-22, 2011 8 courses. http://www.sans.org/cyber-guardian-2011/ -- SANS Rocky Mountain 2011, Denver, CO, June 25-30, 2011 7 courses. Bonus evening presentations include SANS Hacklab and Why End Users are Your Weakest Link http://www.sans.org/rocky-mountain-2011/ -- Looking for training in your own community? http://sans.org/community/ Save on On-Demand training (30 full courses) - See samples at http://www.sans.org/ondemand/discounts.php#current Plus Barcelona, Amsterdam, Brisbane and London all in the next 90 days. For a list of all upcoming events, on-line and live: http://www.sans.org/index.php http://www.sans.org/info/74383 *****************************************************************

Table Of Contents
Part II -- Comprehensive List of Newly Discovered Vulnerabilities from Qualys (www.qualys.com)
Third Party Windows Apps
Mac Os
Linux
Cross Platform
Web Application - Cross Site Scripting
Web Application
Network Device

************************* Sponsored Link: ***********************

1) New SANS Analyst Whitepaper: The following paper has just been posted in the reading room: "Managing Insiders in Utility Control Environments" by Matt Luallen http://www.sans.org/info/74388 *****************************************************************

PART I Critical Vulnerabilities

Part I for this issue has been compiled by Josh Bronson at TippingPoint, a division of HP, as a by-product of that company's continuous effort to ensure that its intrusion prevention products effectively block exploits using known vulnerabilities. TippingPoint's analysis is complemented by input from a council of security managers from twelve large organizations who confidentially share with SANS the specific actions they have taken to protect their systems. A detailed description of the process may be found at http://www.sans.org/newsletters/risk/#process

Widely Deployed Software
  • (1) HIGH: Microsoft Windows Media Player Monkey Audio Parsing Vulnerability
  • Affected:
    • Microsoft Windows Media Player v11.0

  • Description: Microsoft Windows Media Player is susceptible to a buffer overflow vulnerability due to a parsing error in the code responsible for handling Monkey's Audio files. Monkey's Audio files, which have .ape extensions, are losslessly compressed, similar to FLAC and Apple Lossless. In order to exploit this vulnerability, an attacker must entice a target to open a malicious file.

  • Status: vendor not confirmed, updates not available

  • References:
  • (2) HIGH: RealNetworks RealPlayer Buffer Overflow
  • Affected:
    • RealPlayer 11.0, possibly other versions

  • Description: RealNetworks RealPlayer, a widely-installed cross-platform media player, is susceptible to a buffer overflow vulnerability due to an error handling Real Metadata Package (RMP) files. Detailed analysis of the vulnerability is not available, but a public exploit has been released. By enticing a target to open a malicious file, an attacker can exploit this vulnerability in order to execute arbitrary on the target's machine.

  • Status: vendor not confirmed, updates not available

  • References:
  • (3) HIGH: VLC Media Player '.AMV' and '.NSV' Invalid Pointer
  • Affected:
    • VLC media player prior to 1.1.8

  • Description: VideoLAN has released a patch for VLC, its cross-platform media player, that addresses multiple invalid pointer vulnerabilities. This vulnerability was discovered by fuzzing the application. By changing the a particular byte in a .AMV file, for example, it is possible to cause VLC to crash due to an invalid pointer. In combination with a heap spray, an attacker can overwrite the instruction pointer on the stack, resulting in code execution. In order to exploit this vulnerability, an attacker must entice a target to view a malicious site.

  • Status: vendor confirmed, updates available

  • References:
  • (4) MEDIUM: Google Chrome Multiple Vulnerabilities
  • Affected:
    • Google Chrome prior to 10.0.648.204

  • Description: Google has released a patch addressing multiple vulnerabilities in its Chrome web browser. Google has rated the all of these vulnerabilities high, and they involve two use-after-free vulnerabilities, two stale pointers, one memory corruption, and one unspecified "buffer error." The errors are related to parsing HTML, CSS, and SVG; DOM manipulation; and string handling. Although the details of these vulnerabilities are unavailable, it is likely that at least some of them can be used to execute arbitrary code on a target's machine. In order to exploit this vulnerabilities, an attacker must entice a target to view a malicious site.

  • Status: vendor confirmed, updates available

  • References:
Part II: Weekly Comprehensive List of Newly Discovered Vulnerabilities
Week 13, 2011

Part II -- Comprehensive List of Newly Discovered Vulnerabilities from Qualys (www.qualys.com) This list is compiled by Qualys ( www.qualys.com ) as part of that company's ongoing effort to ensure its vulnerability management web service tests for all known vulnerabilities that can be scanned. As of this week Qualys scans for 11053 unique vulnerabilities. For this special SANS community listing, Qualys also includes vulnerabilities that cannot be scanned remotely. ______________________________________________________________________

  • 11.14.1 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: Microsoft Windows Media Player ".ape" File Remote Buffer Overflow
  • Description: Microsoft Windows Media Player is a multimedia application available for the Windows operating system. Microsoft Windows Media Player is exposed to a remote buffer overflow issue because it fails to perform adequate bounds checks on user-supplied input. Microsoft Windows Media Player version 11.0 is affected.
  • Ref: http://www.securityfocus.com/bid/47041
  • 11.14.2 - CVE:CVE-2011-0172,CVE-2010-1452,CVE-2010-2068,CVE-2011-0173,CVE-2011-0174,CVE-2011-0175,CVE-2011-0176,CVE-2011-0177,CVE-2010-0405,CVE-2011-0178,CVE-2010-3434,CVE-2010-4260,CVE-2010-4261,CVE-2010-4479,CVE-2011-0179,CVE-2011-0180,CVE-2011-0170,CVE-2011-0181
  • Platform: Mac Os
  • Title: Apple Mac OS X Multiple Vulnerabilities
  • Description: Apple Mac OS X is exposed to multiple issues because it fails to properly sanitize user-supplied input. Apple Mac OS X versions prior to OS X 10.6.7 are affected.
  • Ref: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
  • 11.14.3 - CVE: CVE-2011-1180
  • Platform: Linux
  • Title: Linux Kernel "iriap.c" Multiple Remote Buffer Overflow Vulnerabilities
  • Description: The Linux kernel is exposed to multiple remote buffer overflow issues because it fails to perform adequate boundary checks on user supplied data in the Infrared Data Association (IrDA) subsystem. Specifically, the "iriap_getvaluesbyclass_indication()" function in the "net/irda/iriap.c" source file fails to properly validate the length of peer names and attributes before they are copied into a fixed-length stack buffer.
  • Ref: http://marc.info/?l=linux-netdev&m=130067113628164&w=2
  • 11.14.4 - CVE: CVE-2011-1478
  • Platform: Linux
  • Title: Linux Kernel Generic Receive Offload (GRO) Local Denial of Service
  • Description: The Linux kernel is exposed to a local denial of service issue when handling specially crafted sockets in the core Generic Receive Offload (GRO) code. This issue can occur because of insufficient freeing of a socket buffer belonging to an unknown VLAN.
  • Ref: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1478
  • 11.14.5 - CVE: Not Available
  • Platform: Cross Platform
  • Title: HP Data Protector Remote Code Execution
  • Description: HP Data Protector is a commercial data management product for backup and recovery operations. HP Data Protector is exposed to a remote code execution issue in the "DBServer.exe" process. The problem occurs when processing a packet sent through TCP port 19813.
  • Ref: http://www.zerodayinitiative.com/advisories/ZDI-11-112/
  • 11.14.6 - CVE: CVE-2011-1471
  • Platform: Cross Platform
  • Title: PHP "Zip" Extension "zip_fread()" Function Denial of Service
  • Description: PHP is a general purpose scripting language that is suited for web development. "Zip" is an extension to read or write ZIP compressed archives. PHP is exposed to a remote denial of service issue that affects the "Zip" extension. PHP versions prior to 5.3.6 are affected.
  • Ref: http://bugs.php.net/bug.php?id=49072
  • 11.14.7 - CVE: CVE-2011-0468
  • Platform: Cross Platform
  • Title: openSUSE "aaa_base" Package Tab Expansion Local Privilege Escalation
  • Description: The openSUSE "aaa_base" package is exposed to a local privilege escalation issue. The problem occurs when handling filenames containing meta characters when performing tab expansions.
  • Ref: https://hermes.opensuse.org/messages/7712778
  • 11.14.8 - CVE: Not Available
  • Platform: Cross Platform
  • Title: IBM Lotus Domino Remote Console Authentication Bypass
  • Description: IBM Lotus Domino is a client/server product designed for collaborative working environments. The application is exposed to a remote authentication bypass issue. Specifically, the remote console listens for requests by default on TCP port 2050.
  • Ref: http://www.zerodayinitiative.com/advisories/ZDI-11-110/
  • 11.14.9 - CVE: CVE-2011-0186
  • Platform: Cross Platform
  • Title: Apple QuickTime JPEG2000 Image Multiple Memory Corruption Vulnerabilities
  • Description: Apple QuickTime is a media player that supports multiple file formats. Apple QuickTime is exposed to multiple memory corruption issues that occur while handling specially crafted JPEG2000 images. Mac OS X versions 10.6 through 10.6.6 and Mac OS X Server versions 10.6 through 10.6.6 are affected.
  • Ref: http://www.securityfocus.com/bid/46995/references
  • 11.14.10 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Perl "Perl_reg_numbered_buff_fetch()" Function Remote Denial of Service
  • Description: Perl is a programming language available for multiple platforms. Perl is exposed to a remote denial of service issue that occurs in the "Perl_reg_numbered_buff_fetch()" function of the "regcomp.c" source file because of an assertion failure when processing certain specially crafted regular expressions.
  • Ref: http://rt.perl.org/rt3/Public/Bug/Display.html?id=76538#txn-713602
  • 11.14.11 - CVE: CVE-2010-3276,CVE-2010-3275
  • Platform: Cross Platform
  • Title: VLC Media Player ".AMV" and ".NSV" Files Multiple Remote Buffer Overflow Vulnerabilities
  • Description: VLC is a cross-platform media player. VLC media player is exposed to stack-based buffer overflow issues because it fails to perform adequate boundary checks on user-supplied data. These issues may be triggered when the vulnerable application opens malformed ".AMV" or ".NSV" files. VLC media player versions prior to 1.1.8 are affected.
  • Ref: http://www.securityfocus.com/archive/1/517150
  • 11.14.12 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Avaya IP Office Manager TFTP Server Remote Denial of Service
  • Description: Avaya IP Office Manager is an application for IP Office system. The TFTP server is a component of the application. The application is exposed to a remote denial of service issue. Avaya IP Office Manager version 8.1 is affected.
  • Ref: http://www.securityfocus.com/bid/47021
  • 11.14.13 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Citrix Presentation Server and XenApp ActiveSync Service Remote Code Execution
  • Description: Citrix Presentation Server and XenApp are virtualization applications. Citrix Presentation Server and XenApp are exposed to a remote code execution issue that occurs in the ActiveSync service when processing a specially crafted packet.
  • Ref: http://support.citrix.com/article/CTX128366
  • 11.14.14 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Python "urllib" and "urllib2" Modules Information Disclosure and Denial of Service Vulnerabilities
  • Description: Python is an open source object-oriented programming language. The application is exposed to an information disclosure issue and a denial of service issue that affect the "urllib" and "urllib2" modules when handling "ftp://" and "file://" URL schemes. Python versions 2.4.6 and 2.6.5 are affected.
  • Ref: https://bugzilla.redhat.com/show_bug.cgi?id=690560
  • 11.14.15 - CVE:CVE-2009-5060,CVE-2009-5062,CVE-2009-5061,CVE-2009-5059,CVE-2009-5058,CVE-2008-7286,CVE-2008-7285,CVE-2008-7284
  • Platform: Cross Platform
  • Title: IBM Lotus Quickr Multiple Remote Denial of Service Vulnerabilities
  • Description: IBM Lotus Quickr is web-based collaboration software designed for sharing documents and media. The application is exposed to multiple issues that result in a crash of the service, denying service to legitimate users.
  • Ref: https://www-304.ibm.com/support/docview.wss?uid=swg27013341
  • 11.14.16 - CVE:CVE-2011-1296,CVE-2011-1295,CVE-2011-1294,CVE-2011-1293,CVE-2011-1292,CVE-2011-1291
  • Platform: Cross Platform
  • Title: Google Chrome Multiple Security Vulnerabilities
  • Description: Google Chrome is a web browser for multiple platforms. Google Chrome is exposed to multiple security issues. Chrome versions prior to 10.0.648.204 are affected.
  • Ref: http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html
  • 11.14.17 - CVE: CVE-2011-0458
  • Platform: Cross Platform
  • Title: Google Picasa Insecure Library Loading Arbitrary Code Execution
  • Description: Google Picasa is a graphics application available for Microsoft Windows. The application is exposed to an issue that lets attackers execute arbitrary code. The issue arises because the application uses the file search path in a non-secure manner. Google Picasa versions prior to 3.8 are affected.
  • Ref: http://jvn.jp/en/jp/JVN99977321/index.html
  • 11.14.18 - CVE: CVE-2011-1420
  • Platform: Cross Platform
  • Title: EMC Data Protection Advisor Collector for Solaris SPARC Insecure File Permissions
  • Description: EMC Data Protection Advisor Collector provides management solutions for data protection. The application is exposed to an insecure file permissions issue that affects certain unspecified files.
  • Ref: http://www.securityfocus.com/archive/1/517179
  • 11.14.19 - CVE: Not Available
  • Platform: Cross Platform
  • Title: RealPlayer ".rmp' File Remote Buffer Overflow
  • Description: RealPlayer is an application that allows users to play back various media formats. RealPlayer is exposed to a remote stack-based buffer overflow issue because it fails to perform adequate boundary checks on user-supplied input. RealPlayer version 11.0 is affected.
  • Ref: http://www.securityfocus.com/bid/47039
  • 11.14.20 - CVE: Not Available
  • Platform: Cross Platform
  • Title: eXPert PDF Batch Creator Denial of Service
  • Description: eXPert PDF is a PDF creator and editor application for Microsoft Windows. The application is exposed to a denial of service issue that affects the batch creator "vsbatch2pdf.exe" file. eXPert PDF version 7.0.880.0 is affected.
  • Ref: http://www.securityfocus.com/bid/47040
  • 11.14.21 - CVE: CVE-2010-3743
  • Platform: Cross Platform
  • Title: wodWebServer.NET Directory Traversal
  • Description: wodWebServer.NET is a .NET component that implements server-side HTTP and HTTPS protocols. The application is exposed to a directory traversal issue because it fails to sufficiently sanitize user-supplied input. wodWebServer.NET version 1.3.3 is affected.
  • Ref: http://www.weonlydo.com/WebServer.NET/web-http-net-server.asp
  • 11.14.22 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Zend Server Java Bridge "javamw.jar" Service Remote Code Execution
  • Description: Zend Server is a web application server. Zend Server is exposed to a remote code execution issue in the Zend Java Bridge component. The problem occurs when processing a packet sent through TCP port 10001.
  • Ref: http://www.securityfocus.com/archive/1/517210
  • 11.14.23 - CVE: CVE-2011-0727
  • Platform: Cross Platform
  • Title: GNOME Display Manager Race Condition Local Privilege Escalation
  • Description: GNOME Display Manager (GDM) is a display manager for the X Window System. GNOME Display Manager is exposed to a local privilege escalation issue that occurs because it fails to properly handle the cache directories used to store users "dmrc" and "face" icon files.
  • Ref: http://www.securityfocus.com/bid/47063
  • 11.14.24 - CVE: CVE-2011-1097
  • Platform: Cross Platform
  • Title: rsync Client Incremental File List Remote Memory Corruption
  • Description: The "rsync" client is used to synchronize files and directory structures across a network. It is commonly used to maintain mirrors of FTP sites, often through anonymous access to the rsync server. The application is exposed to a remote memory corruption issue that is exposed when the application handles a malformed file list data.
  • Ref: https://bugzilla.redhat.com/show_bug.cgi?id=675036
  • 11.14.25 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Rumble Mail Server "MAIL FROM" Command Remote Denial of Service
  • Description: Rumble is a mail server available for Unix and Windows. Rumble is exposed to a remote denial of service issue because the application fails to perform adequate boundary checks on user-supplied data. Rumble version 0.25.2232 is affected.
  • Ref: https://bugzilla.redhat.com/show_bug.cgi?id=675036
  • 11.14.26 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Distributed Ruby Multiple Remote Code Execution Vulnerabilities
  • Description: Distributed Ruby (dRuby) is a distributed object-oriented scripting language that allows programs to communicate with each other on the same machine or over a network. Distributed Ruby (dRuby) is exposed to multiple remote code execution issues that affects the "instance_eval" and "syscall" methods.
  • Ref: http://www.securityfocus.com/bid/47071
  • 11.14.27 - CVE: CVE-2010-3743
  • Platform: Cross Platform
  • Title: jHTTPd Directory Traversal
  • Description: jHTTPd is a threaded web server implemented in Java. The application is exposed to a directory traversal issue because it fails to sufficiently sanitize user-supplied input. This issue can be exploited by sending a specially crafted URI request containing directory-traversal strings. jHTTPd version 0.1a is affected.
  • Ref: http://www.securityfocus.com/bid/47075
  • 11.14.28 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: Alkacon OpenCms Multiple Cross-Site Scripting Vulnerabilities
  • Description: Alkacon OpenCms is a web-based content manager. The application is exposed to multiple cross-site scripting issues because it fails to properly sanitize user-supplied input to various scripts and parameters. OpenCms versions prior to 7.5.4 are affected.
  • Ref: http://www.securityfocus.com/archive/1/517209
  • 11.14.29 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: SPIP "404.html" Cross-Site Scripting
  • Description: SPIP is a website-publishing application implemented in PHP. The application is exposed to a cross-site scripting issue because it fails to properly sanitize user-supplied input submitted to the "404.html" script. SPIP versions prior to 2.1.9, 1.9.2j, and 2.0.14 are affected.
  • Ref: http://www.securityfocus.com/bid/47061
  • 11.14.30 - CVE: Not Available
  • Platform: Web Application
  • Title: Cetera eCommerce Multiple Cross-Site Scripting and SQL Injection Vulnerabilities
  • Description: Cetera eCommerce is a website creation, management, and development software kit. Cetera eCommerce is exposed to multiple cross-site scripting and SQL injection issues because it fails to sufficiently sanitize user-supplied data. Cetera eCommerce versions 15.0 and earlier are affected.
  • Ref: http://www.securityfocus.com/bid/47044
  • 11.14.31 - CVE: Not Available
  • Platform: Web Application
  • Title: webEdition CMS HTML Injection and Local File Include Vulnerabilities
  • Description: webEdition CMS is a PHP-based content manager. The application is exposed to multiple input validation issues. webEdition CMS version 6.1.0.2 is affected.
  • Ref: http://www.securityfocus.com/bid/47047
  • 11.14.32 - CVE: Not Available
  • Platform: Web Application
  • Title: Alkacon OpenCms HTTPOnly Cookie Flag Information Disclosure Weakness
  • Description: OpenCms is a web-based application implemented using Java and XML. The application is exposed to an information disclosure weakness because it fails to properly protect sensitive cookie data with the "HTTPOnly" protection mechanism. OpenCms versions prior to 7.5.4 are affected.
  • Ref: http://www.securityfocus.com/archive/1/517209
  • 11.14.33 - CVE: CVE-2011-1472
  • Platform: Network Device
  • Title: Nokia E75 Firmware Lock Code Authentication Bypass
  • Description: Nokia E75 is a smart phone. Nokia E75 is exposed to an authentication bypass issue that occurs because of an unspecified error in the device which allows the user to bypass the "lock code" during the boot process.
  • Ref: http://www.cert.fi/en/reports/2011/vulnerability410355.html

(c) 2011. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only. In some cases, copyright for material in this newsletter may be held by a party other than Qualys (as indicated herein) and permission to use such material must be requested from the copyright owner.

Subscriptions: @RISK is distributed free of charge by the SANS Institute to people responsible for managing and securing information systems and networks. You may forward this newsletter to others with such responsibility inside or outside your organization. For a free subscription or to update a current subscription, visit http://portal.sans.org/

SANS training gives me the tools I need to do my job.
-Michael Hiramoto, NCI

SANS San Diego 2013

Latest Whitepapers

Building and Maintaining a "Certifiable" Workforce
By Robert J. Mavretich

How Can You Build and Leverage SNORT IDS Metrics to Reduce Risk?
By Tim Proffitt

Daisy Chain Authentication
By Courtney Imbert

Latest Tweets

NEW #SANS Survey: Security Analytics & Intelligence 2nd [...]
October 1, 2013 - 6:30 PM

Tips on how to convince your boss to let you train online wi [...]
October 1, 2013 - 6:23 PM

#2 Tip on how 2 convince your boss 2 let u train online: Fle [...]
October 1, 2013 - 3:00 PM

Contact Us

(301) 654-SANS (7267)
Mon-Fri 9am - 8pm EST/EDT
info@sans.org

"As a security professional, this info is foundational to do a competent job, let alone be successful."
- Michael Foster, Providence Health & Security

"It was a great learning experience that helped open my eyes wider. The instructor's knowledge was fantastic."
- Manuja Wikesekera, Melbourne Cricket Club

"The perfect balance of theory and hands-on experience."
- James D. Perry II, University of Tennessee