[security bulletin] HPSBUX02857 SSRT101103 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03714148 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03714148 Version: 1 HPSBUX02857 SSRT101103 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2013-03-25 Last Updated: 2013-03-22 Potential Security Impact: Remote unauthorized access, disclosure of information, and other vulnerabilities? Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in Java Runtime Environment (JRE) and Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other exploits. References: CVE-2012-1541, CVE-2012-3213, CVE-2012-3342, CVE-2013-0169, CVE-2013-0351, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0429, CVE-2013-0431, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, CVE-2013-0438, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0444, CVE-2013-0445, CVE-2013-0446, CVE-2013-0449, CVE-2013-0450, CVE-2013-0809, CVE-2013-1473, CVE-2013-1475, CVE-2013-1476, CVE-2013-1478, CVE-2013-1480, CVE-2013-1484, CVE-2013-1485, CVE-2013-1486, CVE-2013-1487, CVE-2013-1489, CVE-2013-1493 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.23, and B.11.31 running HP JDK and JRE v7.0.04 and earlier BACKGROUND CVSS 2.0 Base Metrics === Reference Base Vector Base Score CVE-2012-1541(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-3213(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2012-3342(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0169(AV:N/AC:H/Au:N/C:P/I:N/A:N)2.6 CVE-2013-0351(AV:N/AC:L/Au:N/C:P/I:P/A:P)7.5 CVE-2013-0409(AV:N/AC:L/Au:N/C:P/I:N/A:N)5.0 CVE-2013-0419(AV:N/AC:H/Au:N/C:C/I:C/A:C)7.6 CVE-2013-0423(AV:N/AC:H/Au:N/C:C/I:C/A:C)7.6 CVE-2013-0424(AV:N/AC:L/Au:N/C:N/I:P/A:N)5.0 CVE-2013-0425(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0426(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0427(AV:N/AC:L/Au:N/C:N/I:P/A:N)5.0 CVE-2013-0428(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0429(AV:N/AC:H/Au:N/C:C/I:C/A:C)7.6 CVE-2013-0431(AV:N/AC:L/Au:N/C:N/I:P/A:N)5.0 CVE-2013-0432(AV:N/AC:L/Au:N/C:P/I:P/A:N)6.4 CVE-2013-0433(AV:N/AC:L/Au:N/C:N/I:P/A:N)5.0 CVE-2013-0434(AV:N/AC:L/Au:N/C:P/I:N/A:N)5.0 CVE-2013-0435(AV:N/AC:L/Au:N/C:P/I:N/A:N)5.0 CVE-2013-0437(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0438(AV:N/AC:M/Au:N/C:P/I:N/A:N)4.3 CVE-2013-0440(AV:N/AC:L/Au:N/C:N/I:N/A:P)5.0 CVE-2013-0441(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0442(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0443(AV:N/AC:H/Au:N/C:P/I:P/A:N)4.0 CVE-2013-0444(AV:N/AC:H/Au:N/C:C/I:C/A:C)7.6 CVE-2013-0445(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0446(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0449(AV:N/AC:L/Au:N/C:P/I:N/A:N)5.0 CVE-2013-0450(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-0809(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1473(AV:N/AC:L/Au:N/C:N/I:P/A:N)5.0 CVE-2013-1475(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1476(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1478(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1480(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1484(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1485(AV:N/AC:L/Au:N/C:N/I:P/A:N)5.0 CVE-2013-1486(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1487(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1489(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2013-1493(AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 === Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following Java version upgrade to resolve these vulnerabilities. The upgrade is available from the following location http://www.hp.com/java HP-UX B.11.23, B.11.31 JDK and JRE v7.0.05 or subsequent MANUAL ACTIONS: Yes - Update For Java v7.0 update to Java v7.0.05 or subsequent PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issue
[SECURITY] [DSA 2653-1] icinga security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2653-1 secur...@debian.org http://www.debian.org/security/Florian Weimer March 26, 2013 http://www.debian.org/security/faq - - Package: icinga Vulnerability : buffer overflow Problem type : remote Debian-specific: no CVE ID : CVE-2012-6096 Debian Bug : 697931 It was discovered that Icinga, a host and network monitoring system, contains several buffer overflows in the history.cgi CGI program. For the stable distribution (squeeze), this problem has been fixed in version 1.0.2-2+squeeze1. For the testing distribution (wheezy), this problem has been fixed in version 1.7.1-5. For the unstable distribution (sid), this problem has been fixed in version 1.7.1-5. We recommend that you upgrade your icinga packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-annou...@lists.debian.org -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJRUgT+AAoJEL97/wQC1SS+h4oIAKTl/sTEJGoNuw68I2mk+GPj zDHZQedpaT6tS6zoq1EJtKegvmRm9aqp0tLOds0p9DR+1Z8lzZyks2me00wFPxj8 pYNiA0/udLXcbrOoxbKNasd6RWqEVoIQwaZeQvnqWyVWIJ2RZ/QfYwyTvEYs0Gvw H/p8Ebqe6Ix486ARGH7iBna50yi/h9WfSIrnrwcU8Kw205/UruIOsb+7fIGA7SWu AYLUXlZ5zgqyMiBgSdbtuU9T/s4O6m6Ip6VUiA22olmubctfKVKTK4OK+E+Ld9eq AB8cDfcO2CjtUvG2c+k1kYS67QkBcKlRM0xMcbBtekGZxgBV1NPSiVZKo+EjXjk= =Zoin -END PGP SIGNATURE-
Re: Report OWASP WAF Naxsi bypass Vulnerability
Tracked through issue 65 (http://code.google.com/p/naxsi/issues/detail?id=65), fixed at check-in R545 (http://code.google.com/p/naxsi/source/detail?spec=svn545&r=545). On Mon, Mar 25, 2013 at 10:00 PM, wrote: > OWASP WAF Naxsi bypass Vulnerability > > Certain unspecified input is not properly handed in > naxsi_src/naxsi_utils.c naxsi_unescape_uri(u_char **dst, u_char **src, > size_t size, ngx_uint_t type) before being used to filtered. This can > be exploited to bypass some WAF rules. > > Naxsi site > https://code.google.com/p/naxsi/ > > Affected > All the version > > My site > http://safe3.com.cn/ > > My nick name is Safe3 > > It happens like that,the naxsi_unescape_uri function process the % url > decode,if the next char after the % is a hex char and not after the > hex char,then it will drop the % and the next char.So if we input a > sql keyword "s%elect",it will come to "slect" instead,this is not the > standard url decode way.Such as the IIS asp,it will process the > "s%elect" as a result of "select",so we can bypass some > WAF rules just like that. > > I afford a standard url decode function patch as the follow to fix this issue: > ...
[slackware-security] dhcp (SSA:2013-086-02)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 [slackware-security] dhcp (SSA:2013-086-02) New dhcp packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: +--+ patches/packages/dhcp-4.2.5_P1-i486-1_slack14.0.txz: Upgraded. This update replaces the included BIND 9 code that the DHCP programs link against. Those contained a defect that could possibly lead to excessive memory consumption and a denial of service. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2266 (* Security fix *) +--+ Where to find the new packages: +-+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 12.1: ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/dhcp-4.2.5_P1-i486-1_slack12.1.tgz Updated package for Slackware 12.2: ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/dhcp-4.2.5_P1-i486-1_slack12.2.tgz Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/dhcp-4.2.5_P1-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/dhcp-4.2.5_P1-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/dhcp-4.2.5_P1-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/dhcp-4.2.5_P1-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/dhcp-4.2.5_P1-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/dhcp-4.2.5_P1-x86_64-1_slack13.37.txz Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/dhcp-4.2.5_P1-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/dhcp-4.2.5_P1-x86_64-1_slack14.0.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/dhcp-4.2.5_P1-i486-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/dhcp-4.2.5_P1-x86_64-1.txz MD5 signatures: +-+ Slackware 12.1 package: c277d6dae778ddf859d3af9584cee23e dhcp-4.2.5_P1-i486-1_slack12.1.tgz Slackware 12.2 package: 15d244081a57135dfa61b8454209d296 dhcp-4.2.5_P1-i486-1_slack12.2.tgz Slackware 13.0 package: df6a3c2e39397f80e03a6b4b112bbf25 dhcp-4.2.5_P1-i486-1_slack13.0.txz Slackware x86_64 13.0 package: dbbdc76cc2bf5054ce15c036f3f4a21f dhcp-4.2.5_P1-x86_64-1_slack13.0.txz Slackware 13.1 package: 77f1881425fbce4922256b9c2d973f80 dhcp-4.2.5_P1-i486-1_slack13.1.txz Slackware x86_64 13.1 package: ce4486703ec878a8cf3cd1e6791e61be dhcp-4.2.5_P1-x86_64-1_slack13.1.txz Slackware 13.37 package: 01a8dde3c944beb5050d0ae6cde11bff dhcp-4.2.5_P1-i486-1_slack13.37.txz Slackware x86_64 13.37 package: 4f74f10dbb95e30b4470cefa66eff96a dhcp-4.2.5_P1-x86_64-1_slack13.37.txz Slackware 14.0 package: aa2d3985c9ea6ebc6882c96383d62e35 dhcp-4.2.5_P1-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 7f75298567f9d6ee252af1389ae9852a dhcp-4.2.5_P1-x86_64-1_slack14.0.txz Slackware -current package: e92641fe8649aa6d122b72e666e7420b n/dhcp-4.2.5_P1-i486-1.txz Slackware x86_64 -current package: 2e46a3038527318b06271e11e763dbb9 n/dhcp-4.2.5_P1-x86_64-1.txz Installation instructions: ++ Upgrade the package as root: # upgradepkg dhcp-4.2.5_P1-i486-1_slack14.0.txz Then, restart the dhcp daemon. +-+ Slackware Linux Security Team http://slackware.com/gpg-key secur...@slackware.com ++ | To leave the slackware-security mailing list: | ++ | Send an email to majord...@slackware.com with this text in the body of | | the email message: | || | unsubscribe slackware-security | || | You will get a confirmation message back containing instructions to| | complete the process. Please do not reply to this email address. | +---
[slackware-security] bind (SSA:2013-086-01)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 [slackware-security] bind (SSA:2013-086-01) New bind packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: +--+ patches/packages/bind-9.9.2_P2-i486-1_slack14.0.txz: Upgraded. This update fixes a critical defect in BIND 9 that allows an attacker to cause excessive memory consumption in named or other programs linked to libdns. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2266 https://kb.isc.org/article/AA-00871 (* Security fix *) +--+ Where to find the new packages: +-+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 12.1: ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/bind-9.8.4_P2-i486-1_slack12.1.tgz Updated package for Slackware 12.2: ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/bind-9.8.4_P2-i486-1_slack12.2.tgz Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/bind-9.8.4_P2-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/bind-9.8.4_P2-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/bind-9.8.4_P2-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/bind-9.8.4_P2-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/bind-9.8.4_P2-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/bind-9.8.4_P2-x86_64-1_slack13.37.txz Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/bind-9.9.2_P2-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/bind-9.9.2_P2-x86_64-1_slack14.0.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/bind-9.9.2_P2-i486-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/bind-9.9.2_P2-x86_64-1.txz MD5 signatures: +-+ Slackware 12.1 package: bcf111a9a9526482ae8dea688755c889 bind-9.8.4_P2-i486-1_slack12.1.tgz Slackware 12.2 package: ac7dd818bacdb8ba270ec7d21190a581 bind-9.8.4_P2-i486-1_slack12.2.tgz Slackware 13.0 package: 5d4bb658b7b8fdc01ae74275e1ff0b20 bind-9.8.4_P2-i486-1_slack13.0.txz Slackware x86_64 13.0 package: d7a20fdcbc112a724ee33279a0e1aacb bind-9.8.4_P2-x86_64-1_slack13.0.txz Slackware 13.1 package: 0ecbcf1b1ff849b906770266ee6b2264 bind-9.8.4_P2-i486-1_slack13.1.txz Slackware x86_64 13.1 package: 0bd611fc2026a964b499a954d9abfb05 bind-9.8.4_P2-x86_64-1_slack13.1.txz Slackware 13.37 package: f1cf2f258f710c63c7f6456dd1487a3e bind-9.8.4_P2-i486-1_slack13.37.txz Slackware x86_64 13.37 package: cbeb80303f92f9d745600be0cac3b820 bind-9.8.4_P2-x86_64-1_slack13.37.txz Slackware 14.0 package: 519d4a66bc1df3b5508f8ed6f2f5abc1 bind-9.9.2_P2-i486-1_slack14.0.txz Slackware x86_64 14.0 package: dd2320d76994dd0bb085e2cf6a86a86f bind-9.9.2_P2-x86_64-1_slack14.0.txz Slackware -current package: 0d7ff93b20cc99cff691e40c8847ab58 n/bind-9.9.2_P2-i486-1.txz Slackware x86_64 -current package: 42b6641fc5c041c51c65551f256fb847 n/bind-9.9.2_P2-x86_64-1.txz Installation instructions: ++ Upgrade the package as root: # upgradepkg bind-9.9.2_P2-i486-1_slack14.0.txz Then, restart the name server: # /etc/rc.d/rc.bind restart +-+ Slackware Linux Security Team http://slackware.com/gpg-key secur...@slackware.com ++ | To leave the slackware-security mailing list: | ++ | Send an email to majord...@slackware.com with this text in the body of | | the email message: | || | unsubscribe slackware-security | || | You will get a confirmation message back containing instructions to| | complete the process. Please do not reply to this email address.
Path Traversal in AWS XMS
Advisory ID: HTB23147 Product: AWS XMS Vendor: http://www.aws-dms.com Vulnerable Version(s): 2.5 and probably prior Tested Version: 2.5 Vendor Notification: March 6, 2013 Vendor Patch: March 16, 2013 Public Disclosure: March 27, 2013 Vulnerability Type: Path Traversal [CWE-22] CVE Reference: CVE-2013-2474 Risk Level: Medium CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N) Solution Status: Fixed by Vendor Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) --- Advisory Details: High-Tech Bridge Security Research Lab discovered path traversal vulnerability in AWS XMS, which can be exploited to read contents of arbitrary files. 1) Path Traversal in AWS XMS: CVE-2013-2474 The vulnerability exists due to insufficient filtration of "what" HTTP GET parameter passed to "/importer.php" script before using it in PHP "file()" function. A remote attacker can read contents of arbitrary files on the target system. The vulnerable script sets "text/javascript" Content-Type for the output data, which makes exploitation of the vulnerability via a web browser inconvenient. Exploitation via telnet or wget utilities is easier. The following PoC (Proof of Concept) code uses wget utility to download source code of "/default.php" file, which contains application configuration data and administrator’s credentials: wget http://[host]/importer.php?what=defaults.php%00.js To bypass protections against NULL-byte injection (implemented in PHP 5.3.4 and later versions) or enabled "magic_quotes_gpc", alternative techniques based on path normalization and length restrictions can be used. The second PoC code uses a large amount of '/' symbols (4096 is sufficient for the majority of platforms) to bypass the restrictions and get source code of the "/default.php" file: wget http://[host]/importer.php?what=defaults.php///...//.js --- Solution: Upgrade to AWS XMS 2.6 More Information: http://www.aws-dms.com/temp.php?use=templates/download.xml#xms-2.6 --- References: [1] High-Tech Bridge Advisory HTB23147 - https://www.htbridge.com/advisory/HTB23147 - Path Traversal in AWS XMS. [2] AWS XMS - http://www.aws-dms.com/ - XMS is an online visual web development enviroment and framework, providing a web application base, with multi language support, based on XML. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. --- Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
McAfee Virtual Technician ActiveX Control Insecure Method
Advisory ID: HTB23128 Product: McAfee Virtual Technician (MVT) 6.5.0.2101 Vendor: McAfee Vulnerable Version(s): 6.5.0.2101 and probably prior Tested Version: 6.5.0.2101 on Windows 7 SP1 and Internet Explorer 9 Vendor Notification: November 19, 2012 Vendor Patch: March 15, 2013 Public Disclosure: March 27, 2013 Vulnerability Type: Exposed Unsafe ActiveX Method [CWE-618] CVE Reference: CVE-2012-5879 Risk Level: Medium CVSSv2 Base Score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P) Solution Status: Fixed by Vendor Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) --- Advisory Details: High-Tech Bridge Security Research Lab discovered vulnerability in McAfee Virtual Technician ActiveX control, which can be exploited by remote malicious person to overwrite arbitrary files with garbage data on a vulnerable system. 1) Insecure method in McAfee Virtual Technician ActiveX control: CVE-2012-5879 The vulnerability exists due to the ActiveX control including the insecure "Save()" method in "McHealthCheck.dll" DLL. This can be exploited to corrupt or create arbitrary files in the context of the current user. The following PoC code is available: McAfee Virtual Technician [McHealthCheck.dll] v.6.5.0.2101 This proof of concepts creates an arbitrary file in a system [Windows 7, SP1 with IE 9.0] by leveraging the McHealthCheck.dll ActiveX module and the method "Save()": sub CreateArbitraryFile() arg1="FilePath\File_name_to_corrupt_or_create" target.Save arg1 End Sub --- Solution: Upgrade to McAfee Virtual Technician (MVT) 7.1 More Information: https://kc.mcafee.com/corporate/index?page=content&id=SB10040 --- References: [1] High-Tech Bridge Advisory HTB23128 - https://www.htbridge.com/advisory/HTB23128 - McAfee Virtual Technician ActiveX control Insecure Method. [2] McAfee Virtual Technician - mvt.mcafee.com - McAfee Virtual Technician collects information on your computer system so that McAfee can diagnose and solve problems related to your McAfee software. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. --- Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
[security bulletin] HPSBST02848 SSRT101112 rev.1 - HP XP P9000 Command View Advanced Edition Suite Products, Remote Disclosure of Information
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03691745 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03691745 Version: 1 HPSBST02848 SSRT101112 rev.1 - HP XP P9000 Command View Advanced Edition Suite Products, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2013-03-27 Last Updated: 2013-03-27 Potential Security Impact: Remote disclosure of information Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP XP P9000 Command View Advanced Edition Suite products including HP P9000 Command View Advanced Edition Software (DevMgr), HP XP Provisioning Manager Software (ProvMgr), HP P9000 Replication Manager Software (RepMgr), and HP P9000 Tiered Storage Manager Software (TSMgr). The vulnerability could be remotely exploited resulting in a disclosure of information. References: CVE-2012-0053 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP XP P9000 Command View Advanced Edition Suite Software: Software Product Affected Versions (Platform) HP P9000 Command View Advanced Edition Software (DevMgr) 7.0.0-00 to earlier than 7.4.1-00 (Windows/Linux) HP XP Provisioning Manager Software (ProvMgr) 5.0.0-00 to earlier than 7.0.0-00 (Windows/Linux) NOTE : From version 7.0.0-00 and subsequent, ProvMgr has been integrated into DevMgr. HP P9000 Tiered Storage Manager Software (TSMgr) 5.0.0-00 to earlier than 7.4.1-00 (Windows/Linux) HP P9000 Replication Monitor Software (RepMon) 5.0.0-00 to earlier than 6.0.0-00 (Windows) HP P9000 Replication Manager Software (RepMgr) 6.0.0-00 to earlier than 7.4.1-00 (Windows) 7.0.0-00 to earlier than 7.4.1-00 (Linux) BACKGROUND CVSS 2.0 Base Metrics === Reference Base Vector Base Score CVE-2012-0053(AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 === Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following updates for HP XP P9000 Command View Advanced Edition Suite products. In addition, instructions for a Mitigation Solution are also provided below. Software Product Software Version Updates (Platform) HP P9000 Command View Advanced Edition Software (DevMgr) 7.4.1-00 or subsequent (Windows/Linux) HP XP Provisioning Manager Software (ProvMgr) Please apply the Mitigation Solution below HP P9000 Tiered Storage Manager Software (TSMgr) 7.4.1-00 or subsequent (Windows/Linux) HP P9000 Replication Monitor Software (RepMon) Please apply the Mitigation Solution below HP P9000 Replication Manager Software (RepMgr) 7.4.1-00 or subsequent (Windows/Linux) Mitigation Solution - The following procedure can be applied to avoid this vulnerability: Open a command window and change to the current directory by executing the following command: Windows... cd Common-Component-installation-directory\bin Linux ... cd Common-Component-installation-directory/bin Stop the services of P9000 Command View AE Suite products by executing the following command: hcmdssrv /stop Backup the file below, then open it with a text editor: Windows... Common-Component-installation-directory\httpsd\conf\httpsd.conf Linux ... Common-Component-installation-directory/httpsd/conf/httpsd.conf In the above file, after the line: (ErrorDocument 417 "Expectation Failed"), Add the line : (ErrorDocument 400 "Bad Request") NOTE : For the products listed below, a slightly different version of the line must be added instead. Product Version (Platform) CVXPAE 5.0.0-00 to earlier than 5.8.0-00 (Windows) 5.1.0-00 to earlier than 5.8.0-00 (Linux) ProvMgr 5.0.0-00 to earlier than 5.8.0-00 (Windows) 5.1.0-00 to earlier than 5.8.0-00 (Linux) TSMgr 5.0.0-00 to earlier than 5.8.0-00 (Windows) 5.1.0-00 to earlier than 5.8.0-00 (Linux) RepMon 5.0.0-00 to earlier than 5.8.0-00 (Windows) Add the following line to the end of the file styled in the following manner: (ErrorDocument 400 "Bad Request) NOTE : Bad Request is entered without the closing double quotation mark. If this line already exists in the file, do not add it. Save the modified file. Start the services of the XP P9000 Command View AE Suite products by executing the following command: hcmdssrv /start HISTORY Version:1 (rev.1) - 27 March 2013 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP
Cisco Security Advisory: Cisco IOS Software Zone-Based Policy Firewall Session Initiation Protocol Inspection Denial of Service Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco IOS Software Zone-Based Policy Firewall Session Initiation Protocol Inspection Denial of Service Vulnerability Advisory ID: cisco-sa-20130327-cce Revision 1.0 For Public Release 2013 March 27 16:00 UTC (GMT) +- Summary === Cisco IOS Software contains a memory leak vulnerability that could be triggered through the processing of malformed Session Initiation Protocol (SIP) messages. Exploitation of this vulnerability could cause an interruption of services. Only devices that are configured for SIP inspection are affected by this vulnerability. Cisco has released free software updates that address this vulnerability. There are no workarounds for devices that must run SIP inspection. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-cce Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd0ACgkQUddfH3/BbTo1NQD+JTLByafJPlfucXQ7tGEHnYy5 vVv944CH2/B0vC3+AHUA/Aw9dc2MzCzkrKELNu9FQDBFkr5lIhdY9i942xPDfHKQ =6IL2 -END PGP SIGNATURE-
Cisco Security Advisory: Cisco IOS Software IP Service Level Agreement Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco IOS Software IP Service Level Agreement Vulnerability Advisory ID: cisco-sa-20130327-ipsla Revision 1.0 For Public Release 2013 March 27 16:00 UTC (GMT) +- Summary === The Cisco IOS Software implementation of the IP Service Level Agreement (IP SLA) feature contains a vulnerability in the validation of IP SLA packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. Mitigations for this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-ipsla Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd0ACgkQUddfH3/BbTp8QwD+IPK7Dzz7B0uga/FtZKjYU9XC ik2D1EIVMDWcFNYovn8A/i2M+COtgQr9j/7CuMRdNfnAoA65JOxRHu4NTW7cdZoo =w51Y -END PGP SIGNATURE-
Cisco Security Advisory: Cisco IOS Software Protocol Translation Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco IOS Software Protocol Translation Vulnerability Advisory ID: cisco-sa-20130327-pt Revision 1.0 For Public Release 2013 March 27 16:00 UTC (GMT) +- Summary === The Cisco IOS Software Protocol Translation (PT) feature contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-pt Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd4ACgkQUddfH3/BbTr/hQEAhB32OjahAaNFUbeYsZloNqCX C9JHEqRP4k4Y27LcWZUA+wTwW0yKpKzQ9+ZDvaWYiXtL1iSvOhlSjS178A3kMIhb =JlLG -END PGP SIGNATURE-
Cisco Security Advisory: Cisco IOS Software Smart Install Denial of Service Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco IOS Software Smart Install Denial of Service Vulnerability Advisory ID: cisco-sa-20130327-smartinstall Revision 1.0 For Public Release 2013 March 27 16:00 UTC (GMT) +- Summary === The Smart Install client feature in Cisco IOS Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. Affected devices that are configured as Smart Install clients are vulnerable. Cisco has released free software updates that address this vulnerability. There are no workarounds for devices that have the Smart Install client feature enabled. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-smartinstall Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd4ACgkQUddfH3/BbToUsAD+NSDtaCAvOzfjmsqhxVZN6Uy+ ceAxXTPCp6M0n8yGk0sA/1uJk8CWE1yjCtTu1IDGX8K/SUvWFEUi0pqFyKfKVFEa =eRMY -END PGP SIGNATURE-
Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco IOS Software Network Address Translation Vulnerability Advisory ID: cisco-sa-20130327-nat Revision 1.0 For Public Release 2013 March 27 10:00 UTC (GMT) +- Summary === The Cisco IOS Software implementation of the virtual routing and forwarding (VRF) aware network address translation (NAT) feature contains a vulnerability when translating IP packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-nat Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd0ACgkQUddfH3/BbTrndAD/Qxm/suF3S/US+6bDND+/OKB3 9KpBW/wUPVC2+87IFRQBAIXFrAjFqnbmmBAKFEVZztVhRN1TlOW9JL7mKd6SXwZw =jAQM -END PGP SIGNATURE-
Cisco Security Advisory: Cisco IOS Software Internet Key Exchange Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco IOS Software Internet Key Exchange Vulnerability Advisory ID: cisco-sa-20130327-ike Revision 1.0 For Public Release 2013 March 27 16:00 UTC (GMT) +- Summary === The Cisco IOS Software Internet Key Exchange (IKE) feature contains a denial of service (DoS) vulnerability. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-ike Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd0ACgkQUddfH3/BbTovwQD8DwYcxZks8h9lxLcC9YX0Stal GfVltUM7jduv3M2tsQgBAIdGU+jBhC8Ct4i/0idzEkoX6o8TAK3EbcUqZt9QjK6F =Viuu -END PGP SIGNATURE-
Cisco Security Advisory: Cisco IOS Software Resource Reservation Protocol Denial of Service Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco IOS Software Resource Reservation Protocol Denial of Service Vulnerability Advisory ID: cisco-sa-20130327-rsvp Revision 1.0 For Public Release 2013 March 27 16:00 UTC (GMT) +- Summary === The Resource Reservation Protocol (RSVP) feature in Cisco IOS Software and Cisco IOS XE Software contains a vulnerability when used on a device that has Multiprotocol Label Switching with Traffic Engineering (MPLS-TE) enabled. Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to cause a reload of the affected device. Repeated exploitation could result in a sustained denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. There are no workarounds available to mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-rsvp Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd4ACgkQUddfH3/BbTqZ+AD/SPWuHu+4uf/xKA+RAbRbCZxd H9SFakcWJIPsy9TYjBABAI6/LmnQ9FrB1PHcVABckjYOnB+9JUd03ynxrsFPzIQS =W+Lt -END PGP SIGNATURE-
ESA-2013-018: EMC Smarts Product - Cross Site Scripting Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ESA-2013-018: EMC Smarts Product - Cross Site Scripting Vulnerability EMC Identifier: ESA-2013-018 CVE Identifier: CVE-2013-0936 Severity Rating: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) Affected products: EMC Smarts Product versions prior to 9.2 EMC Smarts IP Manager EMC Smarts Service Assurance Manager EMC Smarts Server Manager all versions EMC Smarts VoIP Availability Manager EMC Smarts Network Protocol Manager EMC Smarts MPLS Manager Summary: EMC Smarts Product versions prior to the 9.2 version contain a so-called Cross-site scripting vulnerability that could potentially be exploited by malicious users. Details: The Cross-site scripting vulnerability referenced above could be potentially exploited by a malicious attacker for conducting scripting attacks in EMC Smarts Products. The vulnerability could be exploited by getting an authenticated user to click on specially-crafted links that a malicious attacker can embed within an email, web page or other source. This may lead to execution of malicious html requests or scripts in the context of the authenticated user. Resolution: EMC Smarts version 9.2 products contain the resolution to this issue. EMC strongly recommends all customers upgrade at the earliest opportunity. Link to remedies: Registered EMC Online Support customers can download software from support.emc.com by navigating to https://support.emc.com/downloads/ [The following is standard text included in all security advisories. Please do not change or delete.] Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867. For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. EMC Corporation distributes EMC Security Advisories, in order to bring to the attention of users of the affected EMC products, important security information. EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.12 (Cygwin) iEYEARECAAYFAlFTJOQACgkQtjd2rKp+ALx7qwCgpM1dGZJBI6aUYH/agRIchfj8 UQQAoJo9vi4cFWCVs6CnEYd5GTT8OE6K =aYMf -END PGP SIGNATURE-
