[Full-disclosure] [ MDVSA-2012:184 ] libtiff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2012:184 http://www.mandriva.com/security/ ___ Package : libtiff Date: December 27, 2012 Affected: 2011., Enterprise Server 5.0 ___ Problem Description: A vulnerability was found and corrected in libtiff: A stack-based buffer overflow was found in the way libtiff handled DOTRANGE tags. An attacker could use this flaw to create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code (CVE-2012-5581). The updated packages have been patched to correct this issue. ___ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5581 ___ Updated Packages: Mandriva Linux 2011: 701b5dc20a00f76975cfa959e273e374 2011/i586/libtiff3-3.9.5-1.5-mdv2011.0.i586.rpm c5e077aeab3099c78395bbf4b8c9c31c 2011/i586/libtiff-devel-3.9.5-1.5-mdv2011.0.i586.rpm c082e756feaab7d143989db2815b0f21 2011/i586/libtiff-progs-3.9.5-1.5-mdv2011.0.i586.rpm fe88ad826a992501f81b67326b0440e6 2011/i586/libtiff-static-devel-3.9.5-1.5-mdv2011.0.i586.rpm e53ec07e3178ae3b9a60e0425b961321 2011/SRPMS/libtiff-3.9.5-1.5.src.rpm Mandriva Linux 2011/X86_64: 72fd5242f5ac230541be60b84a30e159 2011/x86_64/lib64tiff3-3.9.5-1.5-mdv2011.0.x86_64.rpm cdc5163291a6a9bc0be639e3d9e833be 2011/x86_64/lib64tiff-devel-3.9.5-1.5-mdv2011.0.x86_64.rpm e598160457755a2400bb9f6c330b78a0 2011/x86_64/lib64tiff-static-devel-3.9.5-1.5-mdv2011.0.x86_64.rpm 11ee95685a6736a115eb1920ee8f42c5 2011/x86_64/libtiff-progs-3.9.5-1.5-mdv2011.0.x86_64.rpm e53ec07e3178ae3b9a60e0425b961321 2011/SRPMS/libtiff-3.9.5-1.5.src.rpm Mandriva Enterprise Server 5: 3639023296ad42f14876581bb44601c6 mes5/i586/libtiff3-3.8.2-12.10mdvmes5.2.i586.rpm a8f270389a84ddcffa4384b6f46592be mes5/i586/libtiff3-devel-3.8.2-12.10mdvmes5.2.i586.rpm 0739c37b055af7ab1b1d5ff444350348 mes5/i586/libtiff3-static-devel-3.8.2-12.10mdvmes5.2.i586.rpm b63d30cee2973e70c9f4bae2a9a73f32 mes5/i586/libtiff-progs-3.8.2-12.10mdvmes5.2.i586.rpm 4e36ad15fc628559cb2bf3706c95355e mes5/SRPMS/libtiff-3.8.2-12.10mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 09a5cd20b0dd7a98ce7b8f78dec6dab6 mes5/x86_64/lib64tiff3-3.8.2-12.10mdvmes5.2.x86_64.rpm 99b4050efd1adc3911f1a1f845091d05 mes5/x86_64/lib64tiff3-devel-3.8.2-12.10mdvmes5.2.x86_64.rpm 087bd7d1e2a97a828e0687e77c633a28 mes5/x86_64/lib64tiff3-static-devel-3.8.2-12.10mdvmes5.2.x86_64.rpm 238bddcfbbec8e43366ad8ef9d3a19aa mes5/x86_64/libtiff-progs-3.8.2-12.10mdvmes5.2.x86_64.rpm 4e36ad15fc628559cb2bf3706c95355e mes5/SRPMS/libtiff-3.8.2-12.10mdvmes5.2.src.rpm ___ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com ___ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team security*mandriva.com -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFQ3BcOmqjQ0CJFipgRAsXbAKDozGE87O2c9Lb9KplMmJaj6nYYwQCgtA2M W+Fw5e5i9jpoWxt4C7Mf+sI= =bZG5 -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] BF, CSRF, AoF and IAA vulnerabilities in MODx Revolution
Hello list! I want to warn you about multiple vulnerabilities in MODx Revolution. These are Brute Force, Cross-Site Request Forgery, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in MODx. It's about 2.x (Revolution) versions of MODx. In 0.x and 1.x (Evolution) versions of MODx CMS there are much more holes, about which I've wrote earlier. Developers changed the code of their CMS in 2.x versions, which decreased number of vulnerabilities (like DoS hole, but Login Enumeration hole just changed into different one). As I've found at tested web site - one Ukrainian government site, also there were multiple XSS holes on it (which are still not fixed), which were not related to core of engine, it was custom code. - Affected products: - Vulnerable are all versions of MODX Revolution (2.x versions of engine). -- Details: -- Brute Force (WASC-11): In login form (http://site/manager/) there is no protection from Brute Force attacks. Cross-Site Request Forgery (WASC-09): Lack of captcha in login form (http://site/manager/) can be used for different attacks - for CSRF-attack to login into account (remote login - to conduct attacks on vulnerabilities inside of account), for automated entering into account, for phishing and other automated attacks. Which you can read about in the article Attacks on unprotected login forms (http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-April/007773.html). Abuse of Functionality (Login Enumeration) (WASC-42): In login form (http://site/manager/) Login Enumeration is possible. Different messages are shown for correct and incorrect logins. Insufficient Anti-automation (WASC-21): In login form there is no protection against automated request, which allow to picking up logins in automated way by attacking on login function and by attacking on password recovery function it's possible to reveal users' emails. Both functionals are placed at the same page. Timeline: 2012.06.28 - announced at my site about MODx Evolution. 2012.06.28 - informed developers about the first part of vulnerabilities in MODx Evolution. 2012.06.30 - informed developers about the second part of vulnerabilities in MODx Evolution. 2012.07.26 - announced at my site about MODx Revolution. 2012.07.28 - informed developers about vulnerabilities in MODx Revolution and reminded about previous two letters. 2012.07.28-2012.10.31 - during conversation with developers about MODx Revolution, I was constantly reminding them, that I've sent them info about holes in Evolution and I can resent them, because it was clear that they missed it (they only were answering concerning Revolution). 2012.11.02 - after developers said they want to see this information (missed by them in June), I've resent the first two letters to the developers. 2012.12.27 - disclosed at my site (http://websecurity.com.ua/5981/). Best wishes regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [SECURITY] [DSA 2591-1] mahara security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2591-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff December 27, 2012 http://www.debian.org/security/faq - - Package: mahara Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2012-2239 CVE-2012-2243 CVE-2012-2244 CVE-2012-2246 CVE-2012-2247 CVE-2012-2253 CVE-2012-6037 Multiple security issues have been found in Mahara - an electronic portfolio, weblog, and resume builder -, which can result in cross-site scripting, clickjacking or arbitrary file execution. For the stable distribution (squeeze), these problems have been fixed in version 1.2.6-2+squeeze6. For the unstable distribution (sid), these problems have been fixed in version 1.5.1-3.1. We recommend that you upgrade your mahara packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-annou...@lists.debian.org -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlDc1IMACgkQXm3vHE4uylqMPgCg5dS6sguZrMHSYcBwOKfBL2N+ j2wAn36pxjwQBWzicqcDoQhMnxzZM+PZ =6mgD -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [SECURITY] [DSA 2592-1] elinks security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2592-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff December 28, 2012 http://www.debian.org/security/faq - - Package: elinks Vulnerability : programming error Problem type : remote Debian-specific: no CVE ID : CVE-2012-4545 Marko Myllynen discovered that elinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate. For the stable distribution (squeeze), this problem has been fixed in version 0.12~pre5-2+squeeze1. Since the initial Squeeze release Xulrunner needed to be updated and the version currently in the archive is incompatible with Elinks. As such, Javascript support needed to be disabled (only a small subset of typical functionality was supported anyway). It will likely be re-enabled in a later point update For the testing distribution (wheezy), this problem has been fixed in version 0.12~pre5-9. For the unstable distribution (sid), this problem has been fixed in version 0.12~pre5-9. We recommend that you upgrade your elinks packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-annou...@lists.debian.org -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlDdEEgACgkQXm3vHE4uyloZXACg4mj3PpAsZfOX7YTOiYCfAAU5 9S8AoKQNPnIs2c9vJwnhDqfPbNGqXJVg =zBUI -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
