@RISK: The Consensus Security Vulnerability Alert

Part I -- Critical Vulnerabilities from TippingPoint (www.tippingpoint.com)

Part II -- Comprehensive List of Newly Discovered Vulnerabilities from Qualys

• (1) MEDIUM: ASP.NET Authentication Bypass

Part II -- Comprehensive List of Newly Discovered Vulnerabilities from Qualys (www.qualys.com)

Other Microsoft Products

• 12.2.1 - Microsoft ASP.NET Multiple vulnerabilities

Third Party Windows Apps

• 12.2.2 - IBM Web Experience Factory Smart Refresh HTML Injection

Linux

• 12.2.3 - lio-utils Debug Mode Insecure Temporary File Creation

Cross Platform

• 12.2.4 - VLC Media Player TiVo Demuxer Remote Heap-Based Buffer Overflow
• 12.2.5 - Java Hash Collision Denial of Service
• 12.2.6 - Python Hash Collision Denial of Service
• 12.2.7 - Apache Tomcat Hash Collision Denial of Service

Web Application - Cross Site Scripting

• 12.2.8 - Siena CMS "err" Parameter Cross-Site Scripting
• 12.2.9 - PhpMyAdmin Multiple Cross-Site Scripting Vulnerabilities
• 12.2.10 - BigACE Multiple Cross-Site Scripting Vulnerabilities

Web Application - SQL Injection

• 12.2.11 - WSN Links "report.php" SQL Injection
• 12.2.12 - Plogger "id" Parameter SQL Injection
• 12.2.13 - OpenEMR "validateUser.php" SQL Injection
• 12.2.14 - DedeCMS Multiple SQL Injection Vulnerabilities
• 12.2.15 - Akiva WebBoard "name" Parameter SQL Injection

Web Application

• 12.2.16 - RapidLeech "notes" Parameter HTML Injection
• 12.2.17 - Winn Guestbook "name" Parameter HTML Injection
• 12.2.18 - Joomla! Simple File Upload Arbitrary File Upload
• 12.2.19 - Mavili Guestbook Multiple Security Vulnerabilities
• 12.2.20 - E107 Multiple Vulnerabilities
• 12.2.21 - Bugzilla Cross Site Scripting and Security Bypass Vulnerabilities
• 12.2.22 - Register Plus Redux Multiple Security vulnerabilities
• 12.2.23 - Vtiger CRM "graph.php" Script Authentication Bypass

Network Device

• 12.2.24 - WiFi Protected Setup PIN Brute Force Authentication Bypass

Hardware

• 12.2.25 - Multiple Digital Satellite TV Platforms Multiple Unspecified Vulnerabilities
• 12.2.26 - Op5 Appliance Multiple Unspecified Remote Command Execution Vulnerabilities

PART I Critical Vulnerabilities

PART I Critical Vulnerabilities Part I for this issue has been compiled by Josh Bronson at TippingPoint, a division of HP, as a by-product of that company's continuous effort to ensure that its intrusion prevention products effectively block exploits using known vulnerabilities. TippingPoint's analysis is complemented by input from a council of security managers from twelve large organizations who confidentially share with SANS the specific actions they have taken to protect their systems. A detailed description of the process may be found at http://www.sans.org/newsletters/risk/#process

*************************************************************

Part II: Weekly Comprehensive List of Newly Discovered Vulnerabilities
Week 1, 2012

Part II -- Comprehensive List of Newly Discovered Vulnerabilities from Qualys (www.qualys.com) This list is compiled by Qualys ( www.qualys.com ) as part of that company's ongoing effort to ensure its vulnerability management web service tests for all known vulnerabilities that can be scanned. As of this week Qualys scans for 12975 unique vulnerabilities. For this special SANS community listing, Qualys also includes vulnerabilities that cannot be scanned remotely. ______________________________________________________________________

• 12.2.1 - CVE: CVE-2011-3414,CVE-2011-3415,CVE-2011-3416,CVE-2011-3417
• Platform: Other Microsoft Products
• Title: Microsoft ASP.NET Multiple vulnerabilities
• Description: ASP.NET is a Web application framework developed and marketed by Microsoft. The application is exposed to multiple security issues. See reference for further details. Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5 Service Pack 1, Microsoft .NET Framework 3.5.1 and Microsoft .NET Framework 4 on all supported editions of Microsoft Windows are affected.
• Ref: http://technet.microsoft.com/en-us/security/bulletin/ms11-100

• 12.2.2 - CVE: Not Available
• Platform: Third Party Windows Apps
• Title: IBM Web Experience Factory Smart Refresh HTML Injection
• Description: IBM Web Experience Factory is a software lifecycle management application. The application is exposed to an HTML injection issue because it fails to properly sanitize user-supplied input. This issue affects the "Smart Refresh" component. IBM Web Experience Factory 7.0 and 7.0.1 are affected.
• Ref: http://www-01.ibm.com/support/docview.wss?uid=swg21575083

• 12.2.3 - CVE: Not Available
• Platform: Linux
• Title: lio-utils Debug Mode Insecure Temporary File Creation
• Description: lio-utils is a low-level configuration tool set. The application is exposed to an insecure temporary file creation issue. This issue is caused by a logic error in the "etc/init.d/target" script, which allows the application to fall unexpectedly into debug mode. The application later creates the "/tmp/tgetctl-dbug" file in an insecure manner while running in debug mode. lio-utils 4.1 is vulnerable; other versions may also be affected.
• Ref: http://www.securityfocus.com/bid/51242/references

• 12.2.4 - CVE: Not Available
• Platform: Cross Platform
• Title: VLC Media Player TiVo Demuxer Remote Heap-Based Buffer Overflow
• Description: VLC is a cross-platform media player. VLC media player is exposed to a heap-based buffer overflow issue that affects the TiVo demuxer. This issue occurs when handling a specially crafted header of the TiVo (".TY") files. VLC media player versions 0.9.0 through 1.1.12 are vulnerable; other versions may also be affected.
• Ref: http://www.videolan.org/security/sa1108.html

• 12.2.5 - CVE: Not Available
• Platform: Cross Platform
• Title: Java Hash Collision Denial of Service
• Description: Java is a programming language. The application is exposed to a denial of service issue due to an error during hashing form posts and updating a hash table. Specially crafted forms in HTTP POST requests can trigger hash collisions resulting in high CPU consumption. Java 7 and prior are affected.
• Ref: http://www.ocert.org/advisories/ocert-2011-003.html http://www.securityfocus.com/bid/51236/references

• 12.2.6 - CVE: Not Available
• Platform: Cross Platform
• Title: Python Hash Collision Denial of Service
• Description: Python is a programming language available for multiple platforms. The application is exposed to a denial of service issue due to an error during hashing form posts and updating a hash table. Specially crafted forms in HTTP POST requests can trigger hash collisions resulting in high CPU consumption. All versions of Python are affected.
• Ref: http://www.securityfocus.com/bid/51239/references

• 12.2.7 - CVE: CVE-2011-4084
• Platform: Cross Platform
• Title: Apache Tomcat Hash Collision Denial of Service
• Description: Apache Tomcat is a Java-based web server application for multiple operating systems. The application is exposed to a denial of service issue due to an error during hashing form posts and updating a hash table. Specially crafted forms in HTTP POST requests can trigger hash collisions resulting in high CPU consumption. All versions of Apache Tomcat are affected.
• Ref: http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3C4EFB9800
  .5010106@apache.org%3E http://www.securityfocus.com/bid/51200/references

• 12.2.8 - CVE: Not Available
• Platform: Web Application - Cross Site Scripting
• Title: Siena CMS "err" Parameter Cross-Site Scripting
• Description: Siena CMS is a PHP-based content management system. PHP-SCMS is exposed to a cross-site-scripting issue because it fails to properly sanitize user-supplied input submitted to the "err" parameter of the "index.php" script. Siena CMS 1.242 is vulnerable; other versions may also be affected.
• Ref: http://www.securityfocus.com/bid/51218/discuss

• 12.2.9 - CVE: CVE-2011-4780
• Platform: Web Application - Cross Site Scripting
• Title: PhpMyAdmin Multiple Cross-Site Scripting Vulnerabilities
• Description: PhpMyAdmin is a web-based administration interface for MySQL databases. The application is exposed to multiple cross-site scripting issues because it fails to properly sanitize user-supplied input submitted to the "libraries/display_export.lib.php" script. Specifically, these issues affect the export panels in the server, database and table sections. phpMyAdmin versions prior to 3.4.x are affected.
• Ref: http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php

• 12.2.10 - CVE: Not Available
• Platform: Web Application - Cross Site Scripting
• Title: BigACE Multiple Cross-Site Scripting Vulnerabilities
• Description: BigACE is a PHP-based content manager. The application is exposed to multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied input submitted to multiple scripts and parameters. BigACE 2.7.5 is vulnerable; other versions may also be affected.
• Ref: http://www.securityfocus.com/archive/1/521088

• 12.2.11 - CVE: Not Available
• Platform: Web Application - SQL Injection
• Title: WSN Links "report.php" SQL Injection
• Description: WSN Links is a web-based directory application implemented in PHP. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied input submitted to the "id" parameter of the "report.php" script. All versions of WSN Links are affected.
• Ref: http://www.securityfocus.com/bid/51222/discuss

• 12.2.12 - CVE: Not Available
• Platform: Web Application - SQL Injection
• Title: Plogger "id" Parameter SQL Injection
• Description: Plogger is a web-based photo gallery application implemented in PHP. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data submitted to the "id" parameter. Plogger 1.0 Rc1 is affected.
• Ref: http://www.securityfocus.com/bid/51228/discuss

• 12.2.13 - CVE: Not Available
• Platform: Web Application - SQL Injection
• Title: OpenEMR "validateUser.php" SQL Injection
• Description: OpenEMR is an electronic medical record application implemented in PHP. The application is exposed to an SQL injection issue because it fails to properly sanitize user-supplied input submitted to the "u" parameter of the "interface/login/validateUser.php" script. OpenEMR 4.1.0 is vulnerable; other versions may also be affected.
• Ref: http://www.mavitunasecurity.com/sql-injection-vulnerability-in-openemr/ http://www.securityfocus.com/bid/51247/references

• 12.2.14 - CVE: Not Available
• Platform: Web Application - SQL Injection
• Title: DedeCMS Multiple SQL Injection Vulnerabilities
• Description: DedeCMS is a PHP-based content manager. The application is exposed to multiple SQL injection issues because it fails to sufficiently sanitize user-supplied data submitted to the following scripts and parameters: "list.php": "id", "members.php": "id" and "book.php": "id". DeDeCMS 5.1, 5.3, 5.5 and 5.6 are affected.
• Ref: http://www.securityfocus.com/bid/51211/discuss

• 12.2.15 - CVE: Not Available
• Platform: Web Application - SQL Injection
• Title: Akiva WebBoard "name" Parameter SQL Injection
• Description: Akiva WebBoard is a PHP-based bulletin board application. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data submitted to the "name" parameter of the "WB/Default.asp" script. Versions prior to Akiva WebBoard 8 SR 1 are affected.
• Ref: http://www.securityfocus.com/bid/51210/references

• 12.2.16 - CVE: Not Available
• Platform: Web Application
• Title: RapidLeech "notes" Parameter HTML Injection
• Description: RapidLeech is a PHP-based server transfer script. The application is exposed to an HTML injection issue because it fails to sufficiently sanitize user-supplied data to the "notes" parameter of the "notes.php" script. RapidLeech 2.3 is vulnerable and other versions may also be affected.
• Ref: http://www.securityfocus.com/bid/51230/discuss

• 12.2.17 - CVE: CVE-2011-5026
• Platform: Web Application
• Title: Winn Guestbook "name" Parameter HTML Injection
• Description: Winn Guestbook is a Web application implemented in PHP. The application is exposed to an HTML injection issue because it fails to sufficiently sanitize user-supplied data to the "name" parameter of the "index.php" script. Winn Guestbook 2.4.8c is vulnerable and other versions may also be affected.
• Ref: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-5026 http://www.securityfocus.com/bid/51232/references

• 12.2.18 - CVE: Not Available
• Platform: Web Application
• Title: Joomla! Simple File Upload Arbitrary File Upload
• Description: Joomla is a PHP-based content management system. Simple File Upload is an extension for Joomla. The application is exposed to an arbitrary file upload issue because it fails to properly sanitize user-supplied input. Specifically, it fails to adequately validate files with ".php5" extension before uploading them onto the web server. Simple File Upload 1.3 is vulnerable and other versions may also be affected.
• Ref: http://wasen.net/index.php?option=com_content&view=article&id=64&Ite
  mid=59

• 12.2.19 - CVE: Not Available
• Platform: Web Application
• Title: Mavili Guestbook Multiple Security Vulnerabilities
• Description: Mavili Guestbook is a web-based application implemented in ASP. Mavili Guestbook is exposed to multiple security vulnerabilities. An SQL injection issue affects the "id" parameter of the "/edit.asp" script. Multiple cross-site scripting issues occur and a security bypass issue exists. Mavili Guestbook 200711 is affected.
• Ref: http://www.securityfocus.com/archive/1/521090

• 12.2.20 - CVE: Not Available
• Platform: Web Application
• Title: E107 Multiple Vulnerabilities
• Description: E107 is a PHP-based Web application. The application is exposed to multiple issues. A cross-site scripting issue affects the "resend_name" parameter of the "e107_admin/users.php" script. Multiple cross-site scripting issues affect the "e107_images/thumb.php" and "rate.php" scripts. An HTML injection issue affects the "link" BBCode in user signatures. An SQL injection issue affects the "username" parameter of the "usersettings.php" script. E107 0.7.26 is vulnerable and other versions may be affected.
• Ref: http://secunia.com/advisories/46706/ http://permalink.gmane.org/gmane.comp.security.oss.general/6571

• 12.2.21 - CVE: CVE-2011-3657,CVE-2011-3667
• Platform: Web Application
• Title: Bugzilla Cross Site Scripting and Security Bypass Vulnerabilities
• Description: Bugzilla is a web-based bug tracking application. The application is exposed to multiple issues. A cross-site scripting issue occurs in the "chart.cgi" and "report.cgi" scripts. A security-bypass issue occurs because the "User.offer_account_by_email()" method fails to check the "user_can_create_account" setting of the authentication method in accounts creation. Bugzilla 2.17.1 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3 are affected.
• Ref: http://www.bugzilla.org/security/3.4.12/ http://www.securityfocus.com/bid/51213/references

• 12.2.22 - CVE: Not Available
• Platform: Web Application
• Title: Register Plus Redux Multiple Security vulnerabilities
• Description: Register Plus Redux is a plugin for WordPress. WordPress is a web-based publishing application implemented in PHP. Register Plus Redux is exposed to multiple input-validation issues. See reference for further details. Register Plus Redux 3.7.3.1 is vulnerable; other versions may also be affected.
• Ref: http://www.securityfocus.com/archive/1/520561 https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_weberp.html

• 12.2.23 - CVE: Not Available
• Platform: Web Application
• Title: Vtiger CRM "graph.php" Script Authentication Bypass
• Description: Vtiger CRM is a PHP-based customer relationship management application. The application is exposed to an authentication bypass issue because it fails to check credentials in database backup requests through the "graph.php" script. Vtiger CRM 5.2.x and 5.1.x are affected.
• Ref: http://francoisharvey.ca/2011/12/advisory-meds-2011-01-vtigercrm-anonymous-acces
  s-to-setting-module/

• 12.2.24 - CVE: Not Available
• Platform: Network Device
• Title: WiFi Protected Setup PIN Brute Force Authentication Bypass
• Description: WiFi Protected Setup is a computing standard created by the WiFi Alliance to ease the setup and securing of a wireless home network. WiFi Protected Setup is exposed to an authentication bypass issue because it fails to provide a lock out policy for brute force attempts. Specifically, the "external registrar" method requires just the router's PIN in authentication. Attackers can determine whether the PIN is correct through the "EAP-NACK" message, which is sent when the PIN authentication fails. wireless routers that support WPS are affected.
• Ref: http://www.kb.cert.org/vuls/id/723755 http://www.securityfocus.com/bid/51187/references

• 12.2.25 - CVE: Not Available
• Platform: Hardware
• Title: Multiple Digital Satellite TV Platforms Multiple Unspecified Vulnerabilities
• Description: Multiple Digital Satellite TV Platforms are exposed to multiple unspecified issues. In total, 24 unspecified security issues have been reported in various Satellite TV products. The most serious issue will allow attackers to completely compromise the affected application. Limited information is currently available regarding these issues. Devices from Onet.pl S.A, Advanced Digital Broadcast, STMicroelectronics, ITI Neovision, Conax AS and DreamLab Onet.pl S are affected.
• Ref: http://www.securityfocus.com/bid/51251/discuss http://www.security-explorations.com/en/SE-2011-01.html

• 12.2.26 - CVE: CVE-2012-0261,CVE-2012-0262,CVE-2012-0263,CVE-2012-0264
• Platform: Hardware
• Title: Op5 Appliance Multiple Unspecified Remote Command Execution Vulnerabilities
• Description: Op5 Monitor and op5 Appliance are network monitoring servers. The servers are exposed to multiple remote command execution issues and a credentials leaking issue because it fails to properly validate user-supplied input. op5 Monitor 5.5.x and op5 Appliance are affected.
• Ref: http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appli
  ance/

(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only. In some cases, copyright for material in this newsletter may be held by a party other than Qualys (as indicated herein) and permission to use such material must be requested from the copyright owner.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account