Last day to save $500 for SANS San Diego 2013

@RISK: The Consensus Security Vulnerability Alert

Volume: VIII, Issue: 43
October 22, 2009

SANS Newsletters Home

More critical vulnerabilities than anytime in years, all in Microsoft products. Alan

@RISK is the SANS community's consensus bulletin summarizing the most important vulnerabilities and exploits identified during the past week and providing guidance on appropriate actions to protect your systems (PART I). It also includes a comprehensive list of all new vulnerabilities discovered in the past week (PART II).

Summary of the vulnerabilities reported this week:

    • Category
    • # of Updates & Vulnerabilities
    • Platform Number of Updates and Vulnerabilities
    • -------------------------- ----------------------------------------
    • Windows
    • 8 (#1, #3, #4, #6, #7, #8, #9, #10, #11)
    • Third Party Windows Apps
    • 3 (#2)
    • Mac OS
    • 1
    • Linux
    • 3
    • Solaris
    • 1
    • Unix
    • 8
    • Cross Platform
    • 8 (#5)
    • Web Application - Cross Site
    • Scripting
    • 3
    • Web Application
    • 11

*************************** Sponsored By SANS ***************************

Join Computer Incident Response professionals at the Incident Detection Summit December 9-10. Hear about the latest tools, tactics and techniques to detect incidents. Learn how to advise clients and upper management on successful incident detection programs.

https://www.sans.org /info/49869"> https://www.sans.org /info/49869

************************************************************************* TRAINING UPDATE

- -- SANS Chicago North Shore, Oct. 26-Nov. 2, https://www.sans.org /chicago09/"> https://www.sans.org /chicago09/

- -- SCADA Security Summit, Stockholm, Oct. 27-30, https://www.sans.org /euscada09_summit/"> https://www.sans.org /euscada09_summit/

- -- SANS Middle East, October 31-November 11, https://www.sans.org /middleeast09/"> https://www.sans.org /middleeast09/

- -- SANS San Francisco, November 9-14, https://www.sans.org /sanfrancisco09"> https://www.sans.org /sanfrancisco09

- -- SANS Sydney, Nov.9-14 https://sans.org/sydney09/

- -- SANS London, UK, Nov.28-Dec. 9, https://sans.org/london09/

- -- SANS CDI, Washington DC, Dec. 11-18, https://www.sans.org /cyber-defense-initiative-2009"> https://www.sans.org /cyber-defense-initiative-2009

- -- SANS Security East 2010, New Orleans, January 10-18, 2010 19 courses, bonus evening presentations https://www.sans.org /security-east-2010/"> https://www.sans.org /security-east-2010/

Looking for training in your own community?

https://sans.org/community/

Save on On-Demand training (30 full courses) - See samples at https://www.sans.org /ondemand"> https://www.sans.org /ondemand

Plus Hong Kong, Oslo and Vancouver, all in the next 90 days. For a list of all upcoming events, on-line and live: https://www.sans.org

*************************************************************************

Table Of Contents
Part II -- Comprehensive List of Newly Discovered Vulnerabilities from Qualys (www.qualys.com)
Windows
Third Party Windows Apps
UiTV UiPlayer UiCheck.dll "GetUiDllVersion()" Buffer Overflow Vulnerability
MAC OS
Linux
Solaris
UNIX
Cross Platform
Web Applications Cross Site Scripting
Web Application - Cross Site Scripting
Web Application
PART I Critical Vulnerabilities

Part I for this issue has been compiled by Rohan Kotian at TippingPoint, a division of 3Com, as a by-product of that company's continuous effort to ensure that its intrusion prevention products effectively block exploits using known vulnerabilities. TippingPoint's analysis is complemented by input from a council of security managers from twelve large organizations who confidentially share with SANS the specific actions they have taken to protect their systems. A detailed description of the process may be found at http://www.sans.org/newsletters/cva/#process

Widely Deployed Software
  • (2) CRITICAL: Microsoft Products GDI+ Multiple Vulnerabilities (MS09-062)
  • Affected:
    • Windows XP Service Pack 2 and Windows XP Service Pack 3
    • Windows XP Professional x64 Edition Service Pack 2
    • Windows Server 2003 Service Pack 2
    • Windows Server 2003 x64 Edition Service Pack 2
    • Windows Server 2003 with SP2 for Itanium-based Systems
    • Windows Vista and Windows Vista Service Pack 1
    • Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1
    • Windows Server 2008 for 32-bit Systems*
    • Windows Server 2008 for x64-based Systems*
    • Windows Server 2008 for Itanium-based Systems
    • Microsoft Internet Explorer 6 Service Pack 1
    • Microsoft .NET Framework 1.1 Service Pack 1
    • Microsoft .NET Framework 2.0 Service Pack 1
    • Microsoft .NET Framework 2.0 Service Pack 2
    • Microsoft Office XP Service Pack 3
    • Microsoft Office 2003 Service Pack 3
    • 2007 Microsoft Office System Service Pack 1
    • 2007 Microsoft Office System Service Pack 2
    • Microsoft Office Project 2002 Service Pack 1
    • Microsoft Office Visio 2002 Service Pack 2
    • PowerPoint Viewer 2007 Service Pack 2
    • Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack x
    • Microsoft Expression Web and Microsoft Expression Web 2
    • Microsoft Office Groove 2007 and Microsoft Office Groove 2007 Service Pack 1
    • Microsoft Works 8.5
    • Microsoft Office Excel Viewer, PowerPoint Viewer 2007, PowerPoint Viewer
    • 2007 Service Pack 1
    • SQL Server 2000 Reporting Services

  • Description: The GDI is the Graphics Device Interface, the portion of the Microsoft Windows operating system that handles graphical operations on behalf of applications. Multiple vulnerabilities have been identified in GDI+ in the way it handles certain files. There are integer overflow vulnerabilities in the way it handles WMF, PNG and BMP image files. There are buffer overflow vulnerabilities in the way it handles PNG and TIFF files. There is an error in the way it processes malformed graphic control extensions in TIFF files which can be used by attackers to corrupt memory. An integer overflow vulnerability has been reported in certain GDI+ API's that are accessible from .NET Framework applications. A memory corruption vulnerability has been reported caused by improper parsing of Office Art Property Tables by Microsoft Office. Successfully exploiting one of these vulnerabilities would allow an attacker to execute arbitrary code with the privileges of the current user. Depending upon configuration, WMF and EMF files may be opened upon receipt without first prompting the user. Some technical details are publicly available for these vulnerabilities.

  • Status: Vendor confirmed, updates available.

  • References:
  • (3) CRITICAL: Microsoft Active Template Library (ATL) ActiveX Controls Multiple Vulnerabilities (MS09-060)
  • Affected:
    • Microsoft Office XP Service Pack 3
    • Microsoft Office 2003 Service Pack 3
    • 2007 Microsoft Office System Service Pack 1 and 2007 Microsoft Office System Service Pack 2
    • Microsoft Visio 2002 Viewer*
    • Microsoft Office Visio 2003 Viewer*
    • Microsoft Office Visio Viewer 2007, Microsoft Office Visio Viewer 2007
    • Service Pack 1, and Microsoft Office Visio Viewer 2007 Service Pack 2

  • Description: Active Template Library (ATL) is a set of C++ classes developed by Microsoft to make programming of Component Object Model (COM) objects easier. Multiple vulnerabilities have been reported in the Microsoft Visual Studio ATL which might lead to arbitrary remote code execution or information disclosure. The first issue is an error in ATL headers which might allow an attacker to call VariantClear() on a variant that has not been correctly initialized. The second issue is a remote code execution vulnerability caused by errors in the ATL headers in the way they handle instantiation of objects from data streams. This could allow an attacker to bypass certain security policies such as kill bits within Internet Explorer and thereby facilitate code execution. The third issue is an information disclosure vulnerability caused as a result of some ATL headers reading string data with no ending NULL bytes. A specially crafted web page can be used to trigger these vulnerabilities. Some technical details on these vulnerabilities are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
  • (4) CRITICAL: Microsoft Windows ATL COM Initialization Remote Code Execution Vulnerability (MS09-055)
  • Affected:
    • Microsoft Windows 2000 Service Pack 4
    • Microsoft Windows XP
    • Microsoft Windows XP Professional x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 Service Pack 2
    • Microsoft Windows Server 2003 x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 SP2 (Itanium)
    • Microsoft Windows Vista
    • Microsoft Windows Vista x64 Edition
    • Microsoft Windows Server 2008 (32-bit)
    • Microsoft Windows Server 2008 (x64)
    • Microsoft Windows Server 2008 (Itanium)
    • Microsoft Windows Server 2008 R2 (x64)
    • Microsoft Windows Server 2008 R2 (Itanium)
    • Microsoft Windows 7 for (32-bit)
    • Microsoft Windows 7 for (x64)

  • Description: Active Template Library (ATL) is a set of C++ classes developed by Microsoft to make programming of Component Object Model (COM) objects easier. A code execution vulnerability exists in the Microsoft ActiveX controls which were compiled using the vulnerable Microsoft Active Template Library. The specific flaws are errors in the way ATL headers handles instantiation of an object from data streams. A specially crafted web page that instantiates the vulnerable ActiveX control can be used to trigger this vulnerability. Successful exploitation might allow an attacker to execute arbitrary code in the context of the current user. MS09-055 Microsoft bulletin provides a Cumulative Security update of ActiveX Kill Bits.

  • Status: Vendor confirmed, updates available.

  • References:
  • (5) CRITICAL: Microsoft Windows SMBv2 Multiple Vulnerabilities (MS09-050)
  • Affected:
    • Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2
    • Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
    • Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2*
    • Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2*
    • Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  • Description: Server Message Block (SMB), a file sharing protocol from Microsoft with SMBv2 as an update, has been reported with multiple vulnerabilities. The first issue is a denial of service vulnerability caused by insufficient sanity checks of fields while parsing SMv2 packets by Server Message Block (SMB) Protocol software. The second flaw is an error in the SMB implementation in the way it improperly handles SMB Multi-Protocol Negotiate Request packets. The third issue is an error in SMB in the way it improperly handles specially crafted SMB packets. Authentication is not required to exploit these vulnerabilities. Full technical details of these vulnerabilities are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
  • (6) CRITICAL: Microsoft .NET Framework Multiple Vulnerabilities (MS09-061)
  • Affected:
    • Microsoft .NET Framework 1.x
    • Microsoft .NET Framework 2.x
    • Microsoft .NET Framework 3.x

  • Description: The Microsoft .NET framework contains multiple vulnerabilities caused by improper verification of verifiable code. There is an error in Microsoft .NET framework which could be exploited by a .NET application to obtain a pointer to stack memory that is no longer used. The second error in .NET framework could allow a malicious .NET application to bypass equality check. The third issue is an error in .NET framework which could be leveraged by a malicious .NET application or Silverlight application to change memory eventually leading to code execution. Successful exploitation in each of the three cases might allow an attacker to execute arbitrary code. A specially crafted XAML browser application (XBAP), or a specially crafted ASP.NET application or a malicious Microsoft .NET application can be used to trigger one of these errors. Some technical details on these vulnerabilities are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
  • (7) CRITICAL: Microsoft Indexing Service ActiveX Control Memory Corruption Vulnerability (MS09-057)
  • Affected:
    • Microsoft Windows 2000 Service Pack 4
    • Microsoft Windows XP Service Pack 2
    • Microsoft Windows XP Service Pack 3
    • Microsoft Windows XP Professional x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 Service Pack 2
    • Microsoft Windows Server 2003 x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 SP2 (Itanium)

  • Description: Microsoft Indexing Service is used to extract content, both text and property information, from files and to construct an indexed catalog to facilitate efficient and rapid searching. A remote code execution vulnerability has been reported in Microsoft Indexing Service. The specific issue is with an ActiveX control included with the Indexing Service, since it does not handle specially crafted Web content properly. Successful exploitation of this vulnerability might allow an attacker to execute arbitrary code in the context of the logged on user. Some technical details of the vulnerability are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
  • (8) CRITICAL: Microsoft Windows Media Runtime Multiple Vulnerabilities (MS09-051)
  • Affected:
    • Microsoft DirectShow WMA Voice Codec
    • Microsoft Windows Media Audio Voice Decoder
    • Microsoft Audio Compression Manager
    • Microsoft Windows 2000 Service Pack 4
    • Microsoft Windows XP Service Pack 2
    • Microsoft Windows XP Service Pack 3
    • Microsoft Windows XP Professional x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 Service Pack 2
    • Microsoft Windows Server 2003 x64 Edition Service Pack 2
    • Microsoft Windows Vista
    • Microsoft Windows Vista x64 Edition
    • Microsoft Windows Server 2008 (32-bit)
    • Microsoft Windows Server 2008 (x64)

  • Description: Microsoft Windows Media Runtime is used to provide information and tools to applications that use Windows media content. Multiple vulnerabilities have been reported in Microsoft Windows Media Runtime. The first issue is a memory corruption error in Windows Media Runtime caused by incorrect processing of Advanced Systems Format (ASF) files. A specially crafted ASF file can be used to trigger this vulnerability. The second issue is a heap corruption vulnerability in Windows Media Runtime caused by improper handling of certain functions in compressed audio files. A malicious media file can be used to trigger this vulnerability. Successful exploitation in both cases might allow an attacker to execute arbitrary code in the context of the affected application. Some technical details about these vulnerabilities are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
  • (9) CRITICAL: Microsoft Windows Media Player Heap Overflow Vulnerability (MS09-052)
  • Affected:
    • Microsoft Windows 2000 Service Pack 4
    • Microsoft Windows XP Service Pack 2
    • Microsoft Windows XP Service Pack 3
    • Microsoft Windows XP Professional x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 Service Pack 2
    • Microsoft Windows Server 2003 x64 Edition Service Pack 2
    • Microsoft Windows Media Player 6.4

  • Description: Microsoft Windows Media Runtime is used to provide information and tools to applications that use Windows media content. Multiple vulnerabilities have been reported in Microsoft Windows Media Runtime. The first issue is a memory corruption error in Windows Media Runtime caused by incorrect processing of Advanced Systems Format (ASF) files. A specially crafted ASF file can be used to trigger this vulnerability. The second issue is a heap corruption vulnerability in Windows Media Runtime caused by improper handling of certain functions in compressed audio files. A malicious media file can be used to trigger this vulnerability. Successful exploitation in both cases might allow an attacker to execute arbitrary code in the context of the affected application. Some technical details about these vulnerabilities are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
  • (10) MODERATE: Microsoft Local Security Authority Subsystem Denial of Service (MS09-059)
  • Affected:
    • Microsoft Windows XP
    • Microsoft Windows XP Professional x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 Service Pack 2
    • Microsoft Windows Server 2003 x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 SP2 (Itanium)
    • Microsoft Windows Vista
    • Microsoft Windows Vista x64 Edition
    • Microsoft Windows Server 2008 for (32-bit)
    • Microsoft Windows Server 2008 for (x64)
    • Microsoft Windows Server 2008 for (Itanium)
    • Microsoft Windows Server 2008 R2 (x64)
    • Microsoft Windows Server 2008 R2 (Itanium)
    • Microsoft Windows 7 for (32-bit)
    • Microsoft Windows 7 for (x64-based Systems)

  • Description: Microsoft Windows Local Security Authority Subsystem Service (LSASS) is a security mechanism that handles local security, login policies and domain authentication. A denial of service vulnerability has been reported in LSASS. The specific flaw is an error in the Windows NTML implementation in LSASS, in the way it handles specific packets during authentication process. A specially crafted authentication packet can be used to trigger this vulnerability. Successful exploitation may cause the server-side LSASS process to stop responding and restart the computer. Some technical details about the vulnerability are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
  • (11) MODERATE: Microsoft Windows CryptoAPI Multiple Vulnerabilities (MS09-056)
  • Affected:
    • Microsoft Windows 2000 Service Pack 4
    • Microsoft Windows XP Service Pack 2
    • Microsoft Windows XP Service Pack 3
    • Microsoft Windows XP Professional x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 Service Pack 2
    • Microsoft Windows Server 2003 x64 Edition Service Pack 2
    • Microsoft Windows Server 2003 SP2 (Itanium)
    • Microsoft Windows Vista
    • Microsoft Windows Vista x64 Edition
    • Microsoft Windows Server 2008 (32-bit)
    • Microsoft Windows Server 2008 (x64)
    • Microsoft Windows Server 2008 (Itanium)
    • Microsoft Windows Server 2008 R2 (x64)
    • Microsoft Windows Server 2008 R2 (Itanium)
    • Microsoft Windows 7 (32-bit)
    • Microsoft Windows 7 (x64)

  • Description: Windows CryptoAPI enables developers to add authentication features like digital certificates, encryption and decryption mechanisms and encoding to and decoding from Abstract Syntax Notation One (ASN.1). Two vulnerabilities have been reported in Windows CryptoAPI. The first issue is a spoofing vulnerability caused due to Windows CryptoAPI incorrectly parsing a null terminator as the end of any values identified by an Object Identifier (OID). A specially crafted certificate e.g. with a NULL byte in the Common Name field can be used to trigger this vulnerability. The second flaw is an integer overflow error in Windows CryptoAPI in the way it parses ASN.1 object identifiers from X.509 certificates. A specially crafted certificate can be used to trigger this vulnerability. Successful exploitation might allow attackers to conduct spoofing attacks. Some technical details of these vulnerabilities are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
Part II: Weekly Comprehensive List of Newly Discovered Vulnerabilities
Week 43, 2009

Week 43, 2009 This list is compiled by Qualys ( www.qualys.com ) as part of that company's ongoing effort to ensure its vulnerability management web service tests for all known vulnerabilities that can be scanned. As of this week Qualys scans for 7553 unique vulnerabilities. For this special SANS community listing, Qualys also includes vulnerabilities that cannot be scanned remotely. ______________________________________________________________________

  • 09.43.1 - CVE: CVE-2009-2527
  • Platform: Windows
  • Title: Microsoft Windows Media Player ASF Processing Vulnerability
  • Description: Microsoft Windows Media Player is a multimedia application available for the Windows operating system. The Application is prone to a remote code execution issue when handling specially crafted Advanced Systems Format (ASF) files. Microsoft Windows Media Player 6.4 is affected by this issue.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-052.mspx
  • 09.43.2 - CVE: CVE-2009-0555, CVE-2009-2525
  • Platform: Windows
  • Title: Microsoft Windows Media Runtime Remote Code Execution
  • Description: Microsoft Windows Media Player is a multimedia application available for the Windows operating system. The Application is prone to a remote code execution issue because it fails to properly bounds check user-supplied input.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-051.mspx
  • 09.43.3 - CVE: CVE-2009-1547,CVE-2009-2529,CVE-2009-2530,CVE-2009-2531
  • Platform: Windows
  • Title: Microsoft Internet Explorer Multiple Vulnerabilities
  • Description: Microsoft Internet Explorer (IE) is a Web browser for Microsoft Windows. The Application is exposed to multiple vulnerablities like memory corruption and remote code execution. Sucessfully exploting this issue can allow an attacker to execute arbitrary code. Internet Explorer versions 5.01,6,7 and 8 are affected by this issue.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-054.mspx
  • 09.43.4 - CVE: CVE-2009-0090, CVE-2009-0091, CVE-2009-2497
  • Platform: Windows
  • Title: Microsoft .NET Common Language Runtime Multiple Vulnerabilities
  • Description: Microsoft .NET Framework is expoed to a remote code execution issue because they fail to properly handle interfaces when running .NET applications and also because it fails to properly verify .NET applications before running them. Microsoft .Net Framework Versions 1.1 and 2 are affected by this issue.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-061.mspx
  • 09.43.5 - CVE: CVE-2009-0901,CVE-2009-2493,CVE-2009-2495
  • Platform: Windows
  • Title: Microsoft Active Template Library (ATL) for Microsoft Office Remote Code Execution Description:Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office are exposed to multiple vulnerabitilities like remote code execution
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-060.mspx
  • 09.43.6 - CVE: CVE-2009-2510,CVE-2009-2511
  • Platform: Windows
  • Title: Microsoft Windows CryptoAPI Spoofing Description:The Windows CryptoAPI is an application programming interface that allows developers to secure applications using cryptography. The Windows CryptioAPI is exposed a spoofing issue because it inc
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-056.mspx
  • 09.43.7 - CVE: CVE-2009-2507
  • Platform: Windows
  • Title: Microsoft Windows Indexing Service Remote Code Execution
  • Description: The Indexing Service catalogs data to facilitate efficient and rapid searching. The application is vulnerable to remote code execution issue beacuse of the use of ActiveX component that is included with it which fails to properly handle Web content. Successfully exploting this issue will allow an attacker to take complete control of an affected system.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-057.mspx
  • 09.43.8 - CVE: CVE-2009-2524
  • Platform: Windows
  • Title: Microsoft Local Security Authority Subsystem Denial of Service
  • Description: The Local Security Authority Subsystem Service (LSASS) manages local security, domain authentication and Active Directory service processes. The application is exposed to denial of service issue when processing malformed packets during the authentication process. Successfully exploiting this issue will result in denial of service which causes the affected system to reboot.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-059.mspx
  • 09.43.9 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: Foxit Reader Firefox Plugin Memory Corruption Vulnerability
  • Description: Foxit Reader is a PDF document viewer. Foxit Reader plugin for Firefox "npFoxitReaderPlugin.dll" is vulnerable to a memory corruption issue. Foxit Reader versions 3.1.2.1013 and Mozilla Firefox 3.5.3 are vulnerable. Other versions may also be affected.
  • Ref: http://seclists.org/fulldisclosure/2009/Oct/198
  • 09.43.11 - CVE: CVE-2009-2970
  • Platform: UiTV UiPlayer UiCheck.dll "GetUiDllVersion()" Buffer Overflow Vulnerability
  • Title: Third Party Windows Apps
  • Description: UiPlayer is a video player provided by UITV. The vulnerability is caused due to a boundary error within UiCheck.dll. This can be exploited to cause a stack-based buffer overflow by passing an overly long argument to the "GetUiDllVersion()" ActiveX method. Successful exploitation allows execution of arbitrary code. The vulnerability is reported in UiCheck.dll version 1.0.0.6. Prior versions may also be affected. Multiple vendors are affected by this issue.
  • Ref: http://www.nsfocus.com/en/advisories/0901.html
  • 09.43.12 - CVE: CVE-2009-3615
  • Platform: MAC OS
  • Title: Adium ICQ Message Denial of Service Weakness
  • Description: Adium is an open source multi-protocol instant messaging (IM) client for Mac OS X that supports many IM networks. A denial of service vulnerability exists in Adium due to an error within the handling of certain oscar protocol messages.
  • Ref: http://trac.adium.im/wiki/AdiumVersionHistory#Version1.3.710162009
  • 09.43.13 - CVE: CVE-2009-2908,CVE-2009-2909,CVE-2009-2910
  • Platform: Linux
  • Title: Fedora update for kernel
  • Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc. Multiple vulnerabilities have been reported in the kernel which can be exploited by malicious, local users to disclose certain system information and potentially gain escalated privileges. Fedora has issued an updated for the kernel to resolve these issues. Ref: https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00483.html
  • 09.43.14 - CVE: Not Available
  • Platform: Linux
  • Title: Linux Kernel "unix_stream_connect()" Denial of Service Security Issue
  • Description: The Linux kernel forms the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc. The kernel is prone to a security issue that is caused due to a deadlock within the "unix_stream_connect()" function in net/unix/af_unix.c, which can be exploited to cause a denial of service by performing certain socket operations. The security issue is confirmed in version 2.6.31.4. Other versions may also be affected.
  • Ref: http://patchwork.kernel.org/patch/54678/
  • - CVE: CVE-2009-0791, CVE-2009-1188, CVE-2009-3604,CVE-2009-3606, CVE-2009-3608, CVE-2009-3609
  • Platform: Linux
  • Title: KDE KPDF Multiple Vulnerabilities
  • Description: KDE is a graphical desktop environment for Unix workstations. KPDF is a pdf viewer. Multiple integer overflow flaws were discovered in KDE KPDF.
  • Ref: https://rhn.redhat.com/errata/RHSA-2009-1502.html
  • 09.43.16 - CVE: CVE-2009-2404,CVE-2009-2408
  • Platform: Solaris
  • Title: Sun Solaris Thunderbird Network Security Services Vulnerabilities
  • Description: Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security enabled client and server applications. The application is exposed to a security bypass issue it fails to properly validate the domain name in a signed CA certificate. Sun OpenSolaris build earlier than snv_125; Mozilla Thunderbird earlier than 2.0.0.23 and Mozilla Network Security Services (NSS) earlier than 3.12.3 are affected by this issue.
  • Ref: http://sunsolve.sun.com/search/document.do?assetkey=1-66-269468-1
  • 09.43.18 - CVE: CVE-2009-1788,CVE-2009-1791
  • Platform: UNIX
  • Title: Ubuntu update for libsndfile
  • Description: The "libsndfile" library is a C library for reading and writing audio files. Multiple boundary errors exists in the "libsndfile" library functions which can be exploited to cause heap-based buffer overflows via a specially crafted AIFF and VOC files. Successful exploitation of the vulnerabilities may allow execution of arbitrary code. The vulnerabilities are reported in versions prior to 1.0.20.
  • Ref: http://www.ubuntu.com/usn/USN-849-1
  • 09.43.19 - CVE: CVE-2009-0791,CVE-2009-1188,CVE-2009-3604,CVE-2009-3606,CVE-2009-3608,CVE-2009-3609
  • Platform: UNIX
  • Title: Red Hat update for kdegraphics
  • Description: The kdegraphics packages contain applications for the K Desktop Environment, including KPDF, a viewer for Portable Document Format (PDF) files. Multiple vulnerabilities have been reported in K Desktop Environment KPDF due to the use of vulnerable Xpdf code. These can be exploited by malicious people to potentially compromise a user's system. Red Hat has issued an update for kdegraphics to resolve these issues.
  • Ref: https://rhn.redhat.com/errata/RHSA-2009-1502.html https://rhn.redhat.com/errata/RHSA-2009-1512.html
  • 09.43.20 - CVE: CVE-2009-3696,CVE-2009-3697
  • Platform: UNIX
  • Title: Fedora update for phpMyAdmin
  • Description: phpMyAdmin is a software tool written in PHP intended to handle the administration of MySQL over the Internet. phpMyAdmin is prone to script insertion vulnerabilities because input passed to various parameters is not properly sanitized before being used. This can be exploited to insert arbitrary HTML and script code, and conduct SQL injection attacks. The vulnerabilities are reported in versions prior to 2.11.9.6 and 3.2.2.1. Fedora has released an update to resolve these issues. Ref: https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html
  • 09.43.21 - CVE: CVE-2009-2042
  • Platform: UNIX
  • Title: Sun Solaris libpng Interlaced Images Information Disclosure
  • Description: The libpng packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files. libpng is prone to a vulnerability that is caused due to an error when processing 1-bit interlaced images. This can be exploited to disclose uninitialised memory via specially crafted images having widths that are not divisible by 8. The vulnerability is reported in versions prior to 1.2.37. Updates to resolve this issue are available for Solaris.
  • Ref: http://sunsolve.sun.com/search/document.do?assetkey=1-66-269788-1
  • 09.43.22 - CVE: Not Available
  • Platform: UNIX
  • Title: Fedora update for perl-Net-OAuth
  • Description: perl-Net-OAuth is an OAuth protocol support library for Perl. An error in the handling of the authorization process of OAuth Core 1.0 can be exploited to access protected resources by tricking the user to click on a specially crafted link. Fedora has released an update to resolve this issue. Ref: https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00476.html https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00497.html
  • 09.43.23 - CVE: CVE-2009-2660, CVE-2009-3296
  • Platform: UNIX
  • Title: Debian update for camlimages
  • Description: CamlImages is an image processing library. CamlImages is prone to multiple vulnerabilities that are caused due to integer overflow errors when processing TIFF and JPEG images and can be exploited to potentially cause heap-based buffer overflows. Successful exploitation of these vulnerabilities allows execution of arbitrary code.
  • Ref: http://lists.debian.org/debian-security-announce/2009/msg00234.html
  • 09.43.24 - CVE: CVE-2009-3165
  • Platform: UNIX
  • Title: Debian update for bugzilla
  • Description: Bugzilla is a Web based general purpose bug tracking tool. Multiple SQL injection vulnerabilities exist in Bugzilla because certain input passed to web service functions is not properly sanitized. This can be exploited to manipulate SQL queries by injecting SQL code. An information disclosure vulnerability exists if a user logs in immediately after resetting the password, causing the password to appear in the URL. Debian has released an update to resolve these issues.
  • Ref: http://www.us.debian.org/security/2009/dsa-1913
  • 09.43.25 - CVE: CVE-2009-1188, CVE-2009-3603, CVE-2009-3604,CVE-2009-3606, CVE-2009-3608, CVE-2009-3609
  • Platform: Cross Platform
  • Title: Xpdf Multiple Vulnerabilities
  • Description: Xpdf is an open source PDF viewer. Multiple integer overflow vulnerabilities exist in Xpdf which can be exploited to cause heap-based buffer overflows and allow execution of arbitrary code by tricking a user into opening a specially crafted PDF file. The vulnerabilities are reported in versions prior to 3.02pl4.
  • Ref: http://site.pi3.com.pl/adv/xpdf.txt
  • 09.43.26 - CVE: CVE-2009-1999, CVE-2009-3407, CVE-2009-1990, CVE-2009-1998,CVE-2009-3399, CVE-2009-3396, CVE-2009-2002, CVE-2009-2625, CVE-2009-0217,CVE-2009-3403, CVE-2009-3406, CVE-2009-3409, CVE-2009-3404, CVE-2009-3405,CVE-2009-3401, CVE-2009-3402, CVE-2009-3397
  • Platform: Cross Platform
  • Title: Oracle Critical Patch Update Advisory - October 2009
  • Description: Oracle released Oracle Critical Patch Update Advisory - October 2009. See the reference for details. Ref: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html
  • 09.43.27 - CVE: CVE-2008-3684, CVE-2008-3685
  • Platform: Cross Platform
  • Title: EMC Documentum ApplicationXtender Admin Agent Multiple Vulnerabilities
  • Description: EMC Documentum is an enterprise content management system. EMC Documentum ApplicationXtender is vulnerable heap-based buffer overflow with the Admin Agent service when receiving crafted packets over TCP port 2606. The application is also vulnerable to an arbitrary file upload due to an input sanitation error in the upload functionality. EMC Documentum ApplicationXtender versions 5.40 SP1 and earlier are vulnerable.
  • Ref: http://www.zerodayinitiative.com/advisories/ZDI-08-095 http://www.zerodayinitiative.com/advisories/ZDI-08-096
  • 09.43.28 - CVE: CVE-2009-3617
  • Platform: Cross Platform
  • Title: aria2 "AbstractCommand::onAbort()" Format String Vulnerability
  • Description: aria2 is a download utility. It is vulnerable to a format string error in the "AbstractCommand::onAbort()" function. aria2 versions 1.6.1 and earlier are vulnerable. Ref: http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1586
  • 09.43.29 - CVE: CVE-2009-2052, CVE-2009-2874
  • Platform: Cross Platform
  • Title: Cisco Unified Presence Denial of Service Vulnerabilities
  • Description: Cisco Unified Presence collects information about a user availability and their communications capabilities. Cisco Unified Presence is vulnerable to a denial of service due to an error in the TimesTenD process when establishing large number of connections to TCP port 16200 or 22794. Also an error exists in the embedded firewall when tracking network connections. Cisco Unified Presence versions prior to 6.0(6) and 7.0(5) are vulnerable.
  • Ref: http://www.cisco.com/warp/public/707/cisco-sa-20091014-cup.shtml
  • 09.43.30 - CVE: Not Available
  • Platform: Cross Platform
  • Title: ZoIPer SIP INVITE Denial of Service Vulnerability
  • Description: ZoIPer is an Internet communication suite. It is vulnerable to a denial of service issue when processing crafted SIP INVITE messages containing an empty "Call-Info" header. ZoIPer Free version 2.22 library versions 4829 and earlier are vulnerable.
  • Ref: http://packetstormsecurity.org/0910-exploits/zoiper_dos.py.txt
  • 09.43.31 - CVE: CVE-2009-3602
  • Platform: Cross Platform
  • Title: Unbound NSEC3 Signature Validation Bypass Security Issue
  • Description: Unbound is a validating, recursive, and caching DNS resolver. Unbound is exposed to a security bypass issue beacause of an error while validating NSEC3 records. Unbound versions earlier to 1.3.4 are affected by this issue.
  • Ref: http://unbound.net/pipermail/unbound-users/2009-October/000852.html
  • 09.43.32 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Skype Extras Manager component Unspecified Vulnerability
  • Description: Skype is a software application that allows users to make voice calls over the Internet. The Application is exposed to an unspecified error in the Extras Manager component. Skype Extras Manager versions earlier than 2.0.0.67 included in Skype for Windows versions earlier than 4.1.0.179.
  • Ref: https://developer.skype.com/WindowsSkype/ReleaseNotes
  • 09.43.33 - CVE: Not Available
  • Platform: Web Applications Cross Site Scripting
  • Title: Quick.Cart Cross-Site Request Forgery Vulnerability
  • Description: Quick.Cart is a easy to use shopping cart script. The application is exposed to cross-site request forgery attacks because it allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. Quick.Cart version 3.4 is affected by this issue.
  • Ref: http://packetstormsecurity.org/0910-exploits/quickcart-xsslfixsrf.txt
  • 09.43.34 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: Drupal RealName Module Script Insertion Vulnerability
  • Description: The RealName module allows the administrator to choose fields from the user profile that will be used to add a "real name" element (method) to a user object. Drupal's RealName module is prone to a script insertion vulnerability because the real name from a user profile is not properly sanitized before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. The vulnerability is reported in versions prior to 6.x-1.3. Other versions may also be affected.
  • Ref: http://drupal.org/node/604760
  • 09.43.35 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: IBM Rational RequisitePro ReqWebHelp Cross-Site Scripting
  • Description: Rational RequisitePro helps project teams to manage requirements, write use cases, improve traceability and strengthen collaboration. Multiple cross-site scripting vulnerabilities exist in RequisitePro because input passed to the "searchWord", "maxHits", "scopedSearch", and "scope" parameters in /ReqWebHelp/basic/searchView.jsp, and to the "operation" parameter in /ReqWebHelp/advanced/workingSet.jsp is not properly sanitized before being returned to the user. IBM Rational RequisitePro 7.x versions are affected with this issue.
  • Ref: http://www-01.ibm.com/support/docview.wss?uid=swg1PK83895
  • 09.43.36 - CVE: CVE-2008-2364
  • Platform: Web Application
  • Title: IBM OS/400 HTTP Server mod_proxy Denial of Service
  • Description: IBM HTTP Server (IHS) is a Web server based on the Apache Software Foundation's Apache HTTP Server that runs on AIX, HP-UX, Linux, Solaris, Windows NT, and z/OS. A vulnerability in IBM OS/400 HTTP Server is caused due to an error in the "ap_proxy_http_process_response()" function when forwarding interim responses. This can be exploited to consume large amounts of memory by tricking mod_proxy into sending an overly large number of interim responses to the client. Ref: http://www-01.ibm.com/support/docview.wss?uid=nas2f960f9e1d5d7811786257655003c8e7a
  • 09.43.37 - CVE: CVE-2009-2412
  • Platform: Web Application
  • Title: IBM HTTP Server Apache Portable Runtime Integer Overflows
  • Description: IBM HTTP Server (IHS) is a Web server based on the Apache Software Foundation's Apache HTTP Server that runs on AIX, HP-UX, Linux, Solaris, Windows NT, and z/OS. IBM HTTP Server is prone to multiple vulnerabilities that are caused due to the application including a vulnerable Apache Portable Runtime version. These can be exploited to cause a denial of service condition.
  • Ref: http://www-01.ibm.com/support/docview.wss?uid=swg1PK93225
  • 09.43.38 - CVE: Not Available
  • Platform: Web Application
  • Title: AgoraCart Cross-Site Request Forgery Vulnerability
  • Description: AgoraCart is an ecommerce shopping cart software solution. A vulnerability exists in AgoraCart, because the application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform administrative actions, e.g. manipulate a .htaccess file via the protected/manager.cgi script or change the user's password if a logged-in administrative user visits a malicious web site. Version 5.2.005 is vulnerable. Other versions may also be affected.
  • Ref: http://holisticinfosec.org/content/view/129/45/
  • 09.43.39 - CVE: Not Available
  • Platform: Web Application
  • Title: Drupal Shibboleth Authentication Module Privilege Escalation Security Issue
  • Description: Drupal Shibboleth Authentication Module provides user authentication with Shibboleth (both v1.3 and v2.0) as well as some authorisation features. A privilege escalation vulnerability exists due to an error in the handling of statically granted permissions for Shibboleth sessions. This can be exploited to perform certain actions with escalated privileges by logging-in using a browser that has not been closed by another user after logging-out. The security issue is reported in versions prior to 6.x-3.2 and 5.x-3.4.
  • Ref: http://drupal.org/node/604488
  • 09.43.41 - CVE: Not Available
  • Platform: Web Application
  • Title: Joomla AjaxChat Component File Inclusion Vulnerability
  • Description: Joomla AjaxChat Component is a browser based chat system for Joomla. It is vulnerable to a file inclusion vulnerability due to insufficient sanitization of input to the "mosConfig_absolute_path" parameter. Joomla AjaxChat Component versions 1.0 and earlier are vulnerable.
  • Ref: http://packetstormsecurity.org/0910-exploits/joomlaajaxchat-rfi.txt
  • 09.43.42 - CVE: Not Available
  • Platform: Web Application
  • Title: TYPO3 Random Images Extension Command Execution Vulnerability
  • Description: TYPO3 is a web content management framework. It is vulnerable to a remote shell command execution vulnerablity due to insufficient sanitization of input. TYPO3 versions 1.6.4 and earlier are vulnerable.
  • Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-014/
  • 09.43.43 - CVE: Not Available
  • Platform: Web Application
  • Title: Piwik Arbitrary File Creation Vulnerability
  • Description: Piwik is an open source web analytics application. It is vulnerable to a file creation vulnerablity due to input passed to the "name" and "HTTP_RAW_POST_DATA" parameters in ofc_upload_image.php is not properly verified to check for file extensions and file contents before being used to create files. Piwik versions 0.4.3 and earlier are vulnerable.
  • Ref: http://packetstormsecurity.org/0910-exploits/piwik-upload.txt
  • 09.43.45 - CVE: Not Available
  • Platform: Web Application
  • Title: Mongoose Source Code Disclosure Vulnerability
  • Description: Mongoose is a Windows based HTTP server. It is vulnerable to source code disclosure when handling crafted HTTP requests. Mongoose Web Server versions 2.8 and earlier are vulnerable.
  • Ref: http://packetstormsecurity.org/0910-exploits/mongoose-disclose.txt
  • 09.43.46 - CVE: Not Available
  • Platform: Web Application
  • Title: NaviCOPA Script Source Disclosure Vulnerability
  • Description: NaviCOPA is a Windows based HTTP server. It is vulnerable to source code disclosure when handling crafted HTTP requests. NAViCOPA versions 3.01.2 and earlier are vulnerable.
  • Ref: http://pocoftheday.blogspot.com/2009/10/navicopa-web-server-3012- remote-source.html

(c) 2009. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only. In some cases, copyright for material in this newsletter may be held by a party other than Qualys (as indicated herein) and permission to use such material must be requested from the copyright owner.

Subscriptions: @RISK is distributed free of charge by the SANS Institute to people responsible for managing and securing information systems and networks. You may forward this newsletter to others with such responsibility inside or outside your organization.

The level of expertise is unprecedented. People like Ed are hard to find!
-Steve O'Brien, City of Bend

Get an iPad or Nexus 10 with Online Training

Latest Whitepapers

Building and Maintaining a "Certifiable" Workforce
By Robert J. Mavretich

How Can You Build and Leverage SNORT IDS Metrics to Reduce Risk?
By Tim Proffitt

Daisy Chain Authentication
By Courtney Imbert

Latest Tweets

NEW #SANS Survey: Security Analytics & Intelligence 2nd [...]
October 1, 2013 - 6:30 PM

Tips on how to convince your boss to let you train online wi [...]
October 1, 2013 - 6:23 PM

#2 Tip on how 2 convince your boss 2 let u train online: Fle [...]
October 1, 2013 - 3:00 PM

Contact Us

(301) 654-SANS (7267)
Mon-Fri 9am - 8pm EST/EDT
info@sans.org

"As a security professional, this info is foundational to do a competent job, let alone be successful."
- Michael Foster, Providence Health & Security

"It was a great learning experience that helped open my eyes wider. The instructor's knowledge was fantastic."
- Manuja Wikesekera, Melbourne Cricket Club

"SANS is far more in-depth than other training I have attended."
- Frank Rajnai, Sears Canada Inc