VARIoT IoT vulnerabilities database
| VAR-201301-0397 | CVE-2013-0950 | Apple iOS and Apple Safari Used in WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
Note: This issue was previously covered in BID 57572 (Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities), but has been given its own record to better document it. Apple iOS for the iPhone, the iPod touch, and the iPad is prone to multiple security vulnerabilities. Other attacks are also possible.
This BID is being retired. Apple iOS is an operating system developed by Apple (Apple) for mobile devices.
CVE-ID
CVE-2013-0962 : Mario Heiderich of Cure53
For OS X Lion systems Safari 6.0.3 is available via
the Apple Software Update application.
For OS X Mountain Lion systems Safari 6.0.3 is included with
OS X v10.8.3. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-01-28-1 iOS 6.1 Software Update
iOS 6.1 Software Update is now available and addresses the following:
Identity Services
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Authentication relying on certificate-based Apple ID
authentication may be bypassed
Description: An error handling issue existed in Identity Services.
If the user's AppleID certificate failed to validate, the user's
AppleID was assumed to be the empty string. If multiple systems
belonging to different users enter this state, applications relying
on this identity determination may erroneously extend trust. This
issue was addressed by ensuring that NULL is returned instead of an
empty string.
CVE-ID
CVE-2013-0963
International Components for Unicode
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of the
EUC-JP encoding, which could lead to a cross-site scripting attack on
EUC-JP encoded websites. This issue was addressed by updating the
EUC-JP mapping table.
CVE-ID
CVE-2011-3058 : Masato Kinugawa
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user-mode process may be able to access the first page of
kernel memory
Description: The iOS kernel has checks to validate that the user-
mode pointer and length passed to the copyin and copyout functions
would not result in a user-mode process being able to directly access
kernel memory. The checks were not being used if the length was
smaller than one page. This issue was addressed through additional
validation of the arguments to copyin and copyout.
CVE-ID
CVE-2013-0964 : Mark Dowd of Azimuth Security
Security
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description: Several intermediate CA certificates were mistakenly
issued by TURKTRUST. This may allow a man-in-the-middle attacker to
redirect connections and intercept user credentials or other
sensitive information. This issue was addressed by not allowing the
incorrect SSL certificates.
StoreKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: JavaScript may be enabled in Mobile Safari without user
interaction
Description: If a user disabled JavaScript in Safari Preferences,
visiting a site which displayed a Smart App Banner would re-enable
JavaScript without warning the user. This issue was addressed by not
enabling JavaScript when visiting a site with a Smart App Banner.
CVE-ID
CVE-2013-0974 : Andrew Plotkin of Zarfhome Software Consulting, Ben
Madison of BitCloud, Marek Durcek
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2012-2824 : miaubiz
CVE-2012-2857 : Arthur Gerkis
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3687 : kuzzcc
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0951 : Apple
CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2013-0955 : Apple
CVE-2013-0956 : Apple Product Security
CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0968 : Aaron Nelson
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Copying and pasting content on a malicious website may lead
to a cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
content pasted from a different origin. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0962 : Mario Heiderich of Cure53
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
frame elements. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2012-2889 : Sergey Glazunov
WiFi
Available for: iPhone 3GS, iPhone 4, iPod touch (4th generation),
iPad 2
Impact: A remote attacker on the same WiFi network may be able to
temporarily disable WiFi
Description: An out of bounds read issue exists in Broadcom's
BCM4325 and BCM4329 firmware's handling of 802.11i information
elements. This issue was addressed through additional validation of
802.11i information elements.
CVE-ID
CVE-2012-2619 : Andres Blanco and Matias Eissler of Core Security
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device. The version after applying this update
will be "6.1".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRBffvAAoJEPefwLHPlZEwzYgP/0qhsTft9TUGuphoY9tth5WB
D0+8pAKs+1HU+nMOaEKPbK+zdMxblhRNPQyhMuTAQaY5Z/iGn1EXVCTlQBO8esRW
epxNZuhFoaW4wzK9kvw5d/HZ9tfq059ozlFOp1TI2D6J5RwNgxDfigt2PUKCTV4X
u/BONQHIfINYMofgf5897LHYYFSU2+NJj5ouM5dY4Y/kfJkwAnG5AWCAGlEt3QOo
MZdaVv3/itPj4te838FYCVAepel3xBWX0Hhuu87+waHslRrIfQl+EvNk3YZXxWiF
O5Hw9Ng/H8n0sbeA39w0U8tw+q/wPhVexdULgRjBH65+6g7Cu5u+rMuYuRjl8fO/
glLhKZNSrQDa5ZNOraOrF62AFVByHaSxv4cZwo262/6uH93FIBtklMt947GMVQLC
1FT0CIGNJb1/0156bvsABfRScBtK9ZdIUjXhOHMinhQJX3qiBqyKc4/juYPmC9VC
KXk2/K8b0sGWQRc5RuQsSpzkZF9WcrwmgGOBIghp2DLmbAAj0uh2Ttf1GdrOaajR
XpZ2TTJ5qE+IHNU0/etroTYnzjKVjQ0pODrPZj7ALLXULTraXJRJy7fqraUzsHbi
AZiRca+3x/S9nqV0NpTNPZgTwxenox10t0w5vhcBK+SPGga1oVRbtOjGtVIkgoG4
KI3sdgb6PtpZWuIJ6iZA
=J2jv
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Apple iOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA52002
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52002/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
RELEASE DATE:
2013-01-29
DISCUSS ADVISORY:
http://secunia.com/advisories/52002/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/52002/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two security issues and multiple vulnerabilities have been reported
in Apple iOS, which can be exploited by malicious people to conduct
cross-site scripting attacks, bypass certain security restrictions,
and compromise a user's device.
1) An error when handling a validation failure of a AppleID
certificate within the IdentityService can be exploited to
potentially bypass the certificate-based AppleID authentication via
an invalid AppleID certificate.
2) An error exists in International Components for Unicode.
5) Multiple vulnerabilities are caused due to a bundled vulnerable
version of WebKit.
18) Certain input pasted from a different origin is not properly
sanitised in WebKit before being used.
19) Certain unspecified input related to frame handling is not
properly sanitised before being returned to the user.
For more information see vulnerability #1 in:
SA50759
NOTE: Additionally a weakness exists within the handling of 802.11i
information elements within Broadcom's BCM4325 and BCM4329 firmware,
which can be exploited to disable WiFi.
PROVIDED AND/OR DISCOVERED BY:
1, 9, 13, and 14) Reported by the vendor
The vendor credits:
3) Mark Dowd, Azimuth Security
4) Andrew Plotkin, Zarfhome Software Consulting, Ben Madison,
BitCloud, and Marek Durcek
6, 7, 8, 10, 11, 15, and 16) Abhishek Arya (Inferno), Google Chrome
Security Team
12) Dominic Cooney, Google and Martin Barbella, Google Chrome
Security Team
17) Aaron Nelson
18) Mario Heiderich, Cure53
ORIGINAL ADVISORY:
APPLE-SA-2013-01-28-1:
http://support.apple.com/kb/HT5642
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. In
certain contexts, an active network attacker could present untrusted
certificates to iTunes and they would be accepted without warning
| VAR-201301-0396 | CVE-2013-0949 | Apple iOS and Apple Safari Used in WebKit WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
Note: This issue was previously covered in BID 57572 (Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities), but has been given its own record to better document it. Apple iOS for the iPhone, the iPod touch, and the iPad is prone to multiple security vulnerabilities. Other attacks are also possible.
This BID is being retired. Apple iOS is an operating system developed by Apple (Apple) for mobile devices.
CVE-ID
CVE-2013-0962 : Mario Heiderich of Cure53
For OS X Lion systems Safari 6.0.3 is available via
the Apple Software Update application.
For OS X Mountain Lion systems Safari 6.0.3 is included with
OS X v10.8.3. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-01-28-1 iOS 6.1 Software Update
iOS 6.1 Software Update is now available and addresses the following:
Identity Services
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Authentication relying on certificate-based Apple ID
authentication may be bypassed
Description: An error handling issue existed in Identity Services.
If the user's AppleID certificate failed to validate, the user's
AppleID was assumed to be the empty string. If multiple systems
belonging to different users enter this state, applications relying
on this identity determination may erroneously extend trust. This
issue was addressed by ensuring that NULL is returned instead of an
empty string.
CVE-ID
CVE-2013-0963
International Components for Unicode
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of the
EUC-JP encoding, which could lead to a cross-site scripting attack on
EUC-JP encoded websites. This issue was addressed by updating the
EUC-JP mapping table.
CVE-ID
CVE-2011-3058 : Masato Kinugawa
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user-mode process may be able to access the first page of
kernel memory
Description: The iOS kernel has checks to validate that the user-
mode pointer and length passed to the copyin and copyout functions
would not result in a user-mode process being able to directly access
kernel memory. The checks were not being used if the length was
smaller than one page. This issue was addressed through additional
validation of the arguments to copyin and copyout.
CVE-ID
CVE-2013-0964 : Mark Dowd of Azimuth Security
Security
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description: Several intermediate CA certificates were mistakenly
issued by TURKTRUST. This may allow a man-in-the-middle attacker to
redirect connections and intercept user credentials or other
sensitive information. This issue was addressed by not allowing the
incorrect SSL certificates.
StoreKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: JavaScript may be enabled in Mobile Safari without user
interaction
Description: If a user disabled JavaScript in Safari Preferences,
visiting a site which displayed a Smart App Banner would re-enable
JavaScript without warning the user. This issue was addressed by not
enabling JavaScript when visiting a site with a Smart App Banner.
CVE-ID
CVE-2013-0974 : Andrew Plotkin of Zarfhome Software Consulting, Ben
Madison of BitCloud, Marek Durcek
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2012-2824 : miaubiz
CVE-2012-2857 : Arthur Gerkis
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3687 : kuzzcc
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0951 : Apple
CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2013-0955 : Apple
CVE-2013-0956 : Apple Product Security
CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0968 : Aaron Nelson
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Copying and pasting content on a malicious website may lead
to a cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
content pasted from a different origin. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0962 : Mario Heiderich of Cure53
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
frame elements. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2012-2889 : Sergey Glazunov
WiFi
Available for: iPhone 3GS, iPhone 4, iPod touch (4th generation),
iPad 2
Impact: A remote attacker on the same WiFi network may be able to
temporarily disable WiFi
Description: An out of bounds read issue exists in Broadcom's
BCM4325 and BCM4329 firmware's handling of 802.11i information
elements. This issue was addressed through additional validation of
802.11i information elements.
CVE-ID
CVE-2012-2619 : Andres Blanco and Matias Eissler of Core Security
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device. The version after applying this update
will be "6.1".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRBffvAAoJEPefwLHPlZEwzYgP/0qhsTft9TUGuphoY9tth5WB
D0+8pAKs+1HU+nMOaEKPbK+zdMxblhRNPQyhMuTAQaY5Z/iGn1EXVCTlQBO8esRW
epxNZuhFoaW4wzK9kvw5d/HZ9tfq059ozlFOp1TI2D6J5RwNgxDfigt2PUKCTV4X
u/BONQHIfINYMofgf5897LHYYFSU2+NJj5ouM5dY4Y/kfJkwAnG5AWCAGlEt3QOo
MZdaVv3/itPj4te838FYCVAepel3xBWX0Hhuu87+waHslRrIfQl+EvNk3YZXxWiF
O5Hw9Ng/H8n0sbeA39w0U8tw+q/wPhVexdULgRjBH65+6g7Cu5u+rMuYuRjl8fO/
glLhKZNSrQDa5ZNOraOrF62AFVByHaSxv4cZwo262/6uH93FIBtklMt947GMVQLC
1FT0CIGNJb1/0156bvsABfRScBtK9ZdIUjXhOHMinhQJX3qiBqyKc4/juYPmC9VC
KXk2/K8b0sGWQRc5RuQsSpzkZF9WcrwmgGOBIghp2DLmbAAj0uh2Ttf1GdrOaajR
XpZ2TTJ5qE+IHNU0/etroTYnzjKVjQ0pODrPZj7ALLXULTraXJRJy7fqraUzsHbi
AZiRca+3x/S9nqV0NpTNPZgTwxenox10t0w5vhcBK+SPGga1oVRbtOjGtVIkgoG4
KI3sdgb6PtpZWuIJ6iZA
=J2jv
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Apple iOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA52002
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52002/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
RELEASE DATE:
2013-01-29
DISCUSS ADVISORY:
http://secunia.com/advisories/52002/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/52002/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two security issues and multiple vulnerabilities have been reported
in Apple iOS, which can be exploited by malicious people to conduct
cross-site scripting attacks, bypass certain security restrictions,
and compromise a user's device.
1) An error when handling a validation failure of a AppleID
certificate within the IdentityService can be exploited to
potentially bypass the certificate-based AppleID authentication via
an invalid AppleID certificate.
2) An error exists in International Components for Unicode.
5) Multiple vulnerabilities are caused due to a bundled vulnerable
version of WebKit.
18) Certain input pasted from a different origin is not properly
sanitised in WebKit before being used.
19) Certain unspecified input related to frame handling is not
properly sanitised before being returned to the user.
For more information see vulnerability #1 in:
SA50759
NOTE: Additionally a weakness exists within the handling of 802.11i
information elements within Broadcom's BCM4325 and BCM4329 firmware,
which can be exploited to disable WiFi.
PROVIDED AND/OR DISCOVERED BY:
1, 9, 13, and 14) Reported by the vendor
The vendor credits:
3) Mark Dowd, Azimuth Security
4) Andrew Plotkin, Zarfhome Software Consulting, Ben Madison,
BitCloud, and Marek Durcek
6, 7, 8, 10, 11, 15, and 16) Abhishek Arya (Inferno), Google Chrome
Security Team
12) Dominic Cooney, Google and Martin Barbella, Google Chrome
Security Team
17) Aaron Nelson
18) Mario Heiderich, Cure53
ORIGINAL ADVISORY:
APPLE-SA-2013-01-28-1:
http://support.apple.com/kb/HT5642
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. In
certain contexts, an active network attacker could present untrusted
certificates to iTunes and they would be accepted without warning
| VAR-201301-0340 | CVE-2013-0964 | Apple iOS and Apple TV Vulnerability in the kernel that circumvents pointer restrictions |
CVSS V2: 3.6 CVSS V3: - Severity: LOW |
The kernel in Apple iOS before 6.1 and Apple TV before 5.2 does not properly validate copyin and copyout arguments, which allows local users to bypass intended pointer restrictions and access locations in the first kernel-memory page by specifying a length of less than one page. Apple iOS for the iPhone, the iPod touch, and the iPad is prone to an information disclosure vulnerability.
An attacker can exploit this issue to gain access to potentially sensitive information. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. A vulnerability exists in the kernel of Apple iOS versions prior to 6.1 and Apple TV versions prior to 5.2. The vulnerability stems from the fact that the program does not validate the copyin and copyout parameters. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-01-28-1 iOS 6.1 Software Update
iOS 6.1 Software Update is now available and addresses the following:
Identity Services
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Authentication relying on certificate-based Apple ID
authentication may be bypassed
Description: An error handling issue existed in Identity Services.
If the user's AppleID certificate failed to validate, the user's
AppleID was assumed to be the empty string. If multiple systems
belonging to different users enter this state, applications relying
on this identity determination may erroneously extend trust. This
issue was addressed by ensuring that NULL is returned instead of an
empty string.
CVE-ID
CVE-2013-0963
International Components for Unicode
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of the
EUC-JP encoding, which could lead to a cross-site scripting attack on
EUC-JP encoded websites. This issue was addressed by updating the
EUC-JP mapping table. The checks were not being used if the length was
smaller than one page. This issue was addressed through additional
validation of the arguments to copyin and copyout.
CVE-ID
CVE-2013-0964 : Mark Dowd of Azimuth Security
Security
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description: Several intermediate CA certificates were mistakenly
issued by TURKTRUST. This issue was addressed by not allowing the
incorrect SSL certificates.
StoreKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: JavaScript may be enabled in Mobile Safari without user
interaction
Description: If a user disabled JavaScript in Safari Preferences,
visiting a site which displayed a Smart App Banner would re-enable
JavaScript without warning the user. This issue was addressed by not
enabling JavaScript when visiting a site with a Smart App Banner.
CVE-ID
CVE-2013-0974 : Andrew Plotkin of Zarfhome Software Consulting, Ben
Madison of BitCloud, Marek Durcek
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2012-2824 : miaubiz
CVE-2012-2857 : Arthur Gerkis
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3687 : kuzzcc
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0951 : Apple
CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2013-0955 : Apple
CVE-2013-0956 : Apple Product Security
CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0968 : Aaron Nelson
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Copying and pasting content on a malicious website may lead
to a cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
content pasted from a different origin. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0962 : Mario Heiderich of Cure53
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
frame elements. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2012-2889 : Sergey Glazunov
WiFi
Available for: iPhone 3GS, iPhone 4, iPod touch (4th generation),
iPad 2
Impact: A remote attacker on the same WiFi network may be able to
temporarily disable WiFi
Description: An out of bounds read issue exists in Broadcom's
BCM4325 and BCM4329 firmware's handling of 802.11i information
elements. This issue was addressed through additional validation of
802.11i information elements.
CVE-ID
CVE-2012-2619 : Andres Blanco and Matias Eissler of Core Security
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device. The version after applying this update
will be "6.1".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRBffvAAoJEPefwLHPlZEwzYgP/0qhsTft9TUGuphoY9tth5WB
D0+8pAKs+1HU+nMOaEKPbK+zdMxblhRNPQyhMuTAQaY5Z/iGn1EXVCTlQBO8esRW
epxNZuhFoaW4wzK9kvw5d/HZ9tfq059ozlFOp1TI2D6J5RwNgxDfigt2PUKCTV4X
u/BONQHIfINYMofgf5897LHYYFSU2+NJj5ouM5dY4Y/kfJkwAnG5AWCAGlEt3QOo
MZdaVv3/itPj4te838FYCVAepel3xBWX0Hhuu87+waHslRrIfQl+EvNk3YZXxWiF
O5Hw9Ng/H8n0sbeA39w0U8tw+q/wPhVexdULgRjBH65+6g7Cu5u+rMuYuRjl8fO/
glLhKZNSrQDa5ZNOraOrF62AFVByHaSxv4cZwo262/6uH93FIBtklMt947GMVQLC
1FT0CIGNJb1/0156bvsABfRScBtK9ZdIUjXhOHMinhQJX3qiBqyKc4/juYPmC9VC
KXk2/K8b0sGWQRc5RuQsSpzkZF9WcrwmgGOBIghp2DLmbAAj0uh2Ttf1GdrOaajR
XpZ2TTJ5qE+IHNU0/etroTYnzjKVjQ0pODrPZj7ALLXULTraXJRJy7fqraUzsHbi
AZiRca+3x/S9nqV0NpTNPZgTwxenox10t0w5vhcBK+SPGga1oVRbtOjGtVIkgoG4
KI3sdgb6PtpZWuIJ6iZA
=J2jv
-----END PGP SIGNATURE-----
| VAR-201301-0341 | CVE-2013-0968 | Apple iOS 6.1 Used in less than WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
Note: This issue was previously covered in BID 57572 (Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities), but has been given its own record to better document it. Apple iOS for the iPhone, the iPod touch, and the iPad is prone to multiple security vulnerabilities. Other attacks are also possible.
This BID is being retired. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-01-28-1 iOS 6.1 Software Update
iOS 6.1 Software Update is now available and addresses the following:
Identity Services
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Authentication relying on certificate-based Apple ID
authentication may be bypassed
Description: An error handling issue existed in Identity Services.
If the user's AppleID certificate failed to validate, the user's
AppleID was assumed to be the empty string. If multiple systems
belonging to different users enter this state, applications relying
on this identity determination may erroneously extend trust. This
issue was addressed by ensuring that NULL is returned instead of an
empty string.
CVE-ID
CVE-2013-0963
International Components for Unicode
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of the
EUC-JP encoding, which could lead to a cross-site scripting attack on
EUC-JP encoded websites. This issue was addressed by updating the
EUC-JP mapping table.
CVE-ID
CVE-2011-3058 : Masato Kinugawa
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user-mode process may be able to access the first page of
kernel memory
Description: The iOS kernel has checks to validate that the user-
mode pointer and length passed to the copyin and copyout functions
would not result in a user-mode process being able to directly access
kernel memory. The checks were not being used if the length was
smaller than one page. This issue was addressed through additional
validation of the arguments to copyin and copyout.
CVE-ID
CVE-2013-0964 : Mark Dowd of Azimuth Security
Security
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description: Several intermediate CA certificates were mistakenly
issued by TURKTRUST. This may allow a man-in-the-middle attacker to
redirect connections and intercept user credentials or other
sensitive information. This issue was addressed by not allowing the
incorrect SSL certificates.
StoreKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: JavaScript may be enabled in Mobile Safari without user
interaction
Description: If a user disabled JavaScript in Safari Preferences,
visiting a site which displayed a Smart App Banner would re-enable
JavaScript without warning the user. This issue was addressed by not
enabling JavaScript when visiting a site with a Smart App Banner.
CVE-ID
CVE-2013-0974 : Andrew Plotkin of Zarfhome Software Consulting, Ben
Madison of BitCloud, Marek Durcek
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2012-2824 : miaubiz
CVE-2012-2857 : Arthur Gerkis
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3687 : kuzzcc
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0951 : Apple
CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2013-0955 : Apple
CVE-2013-0956 : Apple Product Security
CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0968 : Aaron Nelson
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Copying and pasting content on a malicious website may lead
to a cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
content pasted from a different origin. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0962 : Mario Heiderich of Cure53
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
frame elements. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2012-2889 : Sergey Glazunov
WiFi
Available for: iPhone 3GS, iPhone 4, iPod touch (4th generation),
iPad 2
Impact: A remote attacker on the same WiFi network may be able to
temporarily disable WiFi
Description: An out of bounds read issue exists in Broadcom's
BCM4325 and BCM4329 firmware's handling of 802.11i information
elements. This issue was addressed through additional validation of
802.11i information elements.
CVE-ID
CVE-2012-2619 : Andres Blanco and Matias Eissler of Core Security
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device. The version after applying this update
will be "6.1".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRBffvAAoJEPefwLHPlZEwzYgP/0qhsTft9TUGuphoY9tth5WB
D0+8pAKs+1HU+nMOaEKPbK+zdMxblhRNPQyhMuTAQaY5Z/iGn1EXVCTlQBO8esRW
epxNZuhFoaW4wzK9kvw5d/HZ9tfq059ozlFOp1TI2D6J5RwNgxDfigt2PUKCTV4X
u/BONQHIfINYMofgf5897LHYYFSU2+NJj5ouM5dY4Y/kfJkwAnG5AWCAGlEt3QOo
MZdaVv3/itPj4te838FYCVAepel3xBWX0Hhuu87+waHslRrIfQl+EvNk3YZXxWiF
O5Hw9Ng/H8n0sbeA39w0U8tw+q/wPhVexdULgRjBH65+6g7Cu5u+rMuYuRjl8fO/
glLhKZNSrQDa5ZNOraOrF62AFVByHaSxv4cZwo262/6uH93FIBtklMt947GMVQLC
1FT0CIGNJb1/0156bvsABfRScBtK9ZdIUjXhOHMinhQJX3qiBqyKc4/juYPmC9VC
KXk2/K8b0sGWQRc5RuQsSpzkZF9WcrwmgGOBIghp2DLmbAAj0uh2Ttf1GdrOaajR
XpZ2TTJ5qE+IHNU0/etroTYnzjKVjQ0pODrPZj7ALLXULTraXJRJy7fqraUzsHbi
AZiRca+3x/S9nqV0NpTNPZgTwxenox10t0w5vhcBK+SPGga1oVRbtOjGtVIkgoG4
KI3sdgb6PtpZWuIJ6iZA
=J2jv
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Apple iOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA52002
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52002/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
RELEASE DATE:
2013-01-29
DISCUSS ADVISORY:
http://secunia.com/advisories/52002/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/52002/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two security issues and multiple vulnerabilities have been reported
in Apple iOS, which can be exploited by malicious people to conduct
cross-site scripting attacks, bypass certain security restrictions,
and compromise a user's device.
1) An error when handling a validation failure of a AppleID
certificate within the IdentityService can be exploited to
potentially bypass the certificate-based AppleID authentication via
an invalid AppleID certificate.
2) An error exists in International Components for Unicode.
5) Multiple vulnerabilities are caused due to a bundled vulnerable
version of WebKit.
18) Certain input pasted from a different origin is not properly
sanitised in WebKit before being used.
19) Certain unspecified input related to frame handling is not
properly sanitised before being returned to the user.
For more information see vulnerability #1 in:
SA50759
NOTE: Additionally a weakness exists within the handling of 802.11i
information elements within Broadcom's BCM4325 and BCM4329 firmware,
which can be exploited to disable WiFi.
PROVIDED AND/OR DISCOVERED BY:
1, 9, 13, and 14) Reported by the vendor
The vendor credits:
3) Mark Dowd, Azimuth Security
4) Andrew Plotkin, Zarfhome Software Consulting, Ben Madison,
BitCloud, and Marek Durcek
6, 7, 8, 10, 11, 15, and 16) Abhishek Arya (Inferno), Google Chrome
Security Team
12) Dominic Cooney, Google and Martin Barbella, Google Chrome
Security Team
17) Aaron Nelson
18) Mario Heiderich, Cure53
ORIGINAL ADVISORY:
APPLE-SA-2013-01-28-1:
http://support.apple.com/kb/HT5642
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0342 | CVE-2013-0974 | Apple iOS 6.1 Less than StoreKit Vulnerable to access restrictions |
CVSS V2: 5.1 CVSS V3: - Severity: MEDIUM |
StoreKit in Apple iOS before 6.1 does not properly handle the disabling of JavaScript within the preferences configuration of Mobile Safari, which allows remote attackers to bypass intended access restrictions and execute JavaScript code via a web site with a Smart App Banner.
Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions.
NOTE: This issue was previously discussed in BID 57572 (Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities) but has been given its own record to better document it. Apple iOS for the iPhone, the iPod touch, and the iPad is prone to multiple security vulnerabilities. These issues affect the following components:
Identity Services
Kernel
StoreKit
WebKit
Successfully exploiting these issues may allow attackers to execute arbitrary script code, bypass security restrictions, obtain sensitive information, execute arbitrary code, or crash the affected device. Other attacks are also possible.
This BID is being retired. The following individual records exist to better document the issues:
57576 WebKit CVE-2013-0948 Unspecified Memory Corruption Vulnerability
57580 WebKit CVE-2013-0949 Unspecified Memory Corruption Vulnerability
57581 WebKit CVE-2013-0950 Unspecified Memory Corruption Vulnerability
57582 WebKit CVE-2013-0951 Unspecified Memory Corruption Vulnerability
57583 WebKit CVE-2013-0962 Cross Site Scripting Vulnerability
57584 WebKit CVE-2013-0952 Unspecified Memory Corruption Vulnerability
57585 WebKit CVE-2013-0953 Unspecified Memory Corruption Vulnerability
57586 WebKit CVE-2013-0954 Unspecified Memory Corruption Vulnerability
57587 WebKit CVE-2013-0955 Unspecified Memory Corruption Vulnerability
57588 WebKit CVE-2013-0956 Unspecified Memory Corruption Vulnerability
57589 WebKit CVE-2013-0958 Unspecified Memory Corruption Vulnerability
57590 WebKit CVE-2013-0959 Unspecified Memory Corruption Vulnerability
57591 WebKit CVE-2013-0968 Unspecified Memory Corruption Vulnerability
57595 Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Information Disclosure Vulnerability
57597 Apple iPhone/iPad/iPod touch CVE-2013-0974 Security Bypass Vulnerability
57598 Apple iPhone/iPad/iPod touch Prior to iOS 6.1 CVE-2013-0963 Security Bypass Vulnerability. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-01-28-1 iOS 6.1 Software Update
iOS 6.1 Software Update is now available and addresses the following:
Identity Services
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Authentication relying on certificate-based Apple ID
authentication may be bypassed
Description: An error handling issue existed in Identity Services.
If the user's AppleID certificate failed to validate, the user's
AppleID was assumed to be the empty string. If multiple systems
belonging to different users enter this state, applications relying
on this identity determination may erroneously extend trust. This
issue was addressed by ensuring that NULL is returned instead of an
empty string.
CVE-ID
CVE-2013-0963
International Components for Unicode
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of the
EUC-JP encoding, which could lead to a cross-site scripting attack on
EUC-JP encoded websites. This issue was addressed by updating the
EUC-JP mapping table.
CVE-ID
CVE-2011-3058 : Masato Kinugawa
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user-mode process may be able to access the first page of
kernel memory
Description: The iOS kernel has checks to validate that the user-
mode pointer and length passed to the copyin and copyout functions
would not result in a user-mode process being able to directly access
kernel memory. The checks were not being used if the length was
smaller than one page. This issue was addressed through additional
validation of the arguments to copyin and copyout.
CVE-ID
CVE-2013-0964 : Mark Dowd of Azimuth Security
Security
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description: Several intermediate CA certificates were mistakenly
issued by TURKTRUST. This may allow a man-in-the-middle attacker to
redirect connections and intercept user credentials or other
sensitive information. This issue was addressed by not allowing the
incorrect SSL certificates. This issue was addressed by not
enabling JavaScript when visiting a site with a Smart App Banner.
CVE-ID
CVE-2013-0974 : Andrew Plotkin of Zarfhome Software Consulting, Ben
Madison of BitCloud, Marek Durcek
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2012-2824 : miaubiz
CVE-2012-2857 : Arthur Gerkis
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3687 : kuzzcc
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0951 : Apple
CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2013-0955 : Apple
CVE-2013-0956 : Apple Product Security
CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0968 : Aaron Nelson
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Copying and pasting content on a malicious website may lead
to a cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
content pasted from a different origin. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0962 : Mario Heiderich of Cure53
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
frame elements. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2012-2889 : Sergey Glazunov
WiFi
Available for: iPhone 3GS, iPhone 4, iPod touch (4th generation),
iPad 2
Impact: A remote attacker on the same WiFi network may be able to
temporarily disable WiFi
Description: An out of bounds read issue exists in Broadcom's
BCM4325 and BCM4329 firmware's handling of 802.11i information
elements. This issue was addressed through additional validation of
802.11i information elements.
CVE-ID
CVE-2012-2619 : Andres Blanco and Matias Eissler of Core Security
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device. The version after applying this update
will be "6.1".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRBffvAAoJEPefwLHPlZEwzYgP/0qhsTft9TUGuphoY9tth5WB
D0+8pAKs+1HU+nMOaEKPbK+zdMxblhRNPQyhMuTAQaY5Z/iGn1EXVCTlQBO8esRW
epxNZuhFoaW4wzK9kvw5d/HZ9tfq059ozlFOp1TI2D6J5RwNgxDfigt2PUKCTV4X
u/BONQHIfINYMofgf5897LHYYFSU2+NJj5ouM5dY4Y/kfJkwAnG5AWCAGlEt3QOo
MZdaVv3/itPj4te838FYCVAepel3xBWX0Hhuu87+waHslRrIfQl+EvNk3YZXxWiF
O5Hw9Ng/H8n0sbeA39w0U8tw+q/wPhVexdULgRjBH65+6g7Cu5u+rMuYuRjl8fO/
glLhKZNSrQDa5ZNOraOrF62AFVByHaSxv4cZwo262/6uH93FIBtklMt947GMVQLC
1FT0CIGNJb1/0156bvsABfRScBtK9ZdIUjXhOHMinhQJX3qiBqyKc4/juYPmC9VC
KXk2/K8b0sGWQRc5RuQsSpzkZF9WcrwmgGOBIghp2DLmbAAj0uh2Ttf1GdrOaajR
XpZ2TTJ5qE+IHNU0/etroTYnzjKVjQ0pODrPZj7ALLXULTraXJRJy7fqraUzsHbi
AZiRca+3x/S9nqV0NpTNPZgTwxenox10t0w5vhcBK+SPGga1oVRbtOjGtVIkgoG4
KI3sdgb6PtpZWuIJ6iZA
=J2jv
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Apple iOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA52002
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52002/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
RELEASE DATE:
2013-01-29
DISCUSS ADVISORY:
http://secunia.com/advisories/52002/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/52002/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two security issues and multiple vulnerabilities have been reported
in Apple iOS, which can be exploited by malicious people to conduct
cross-site scripting attacks, bypass certain security restrictions,
and compromise a user's device.
1) An error when handling a validation failure of a AppleID
certificate within the IdentityService can be exploited to
potentially bypass the certificate-based AppleID authentication via
an invalid AppleID certificate.
2) An error exists in International Components for Unicode.
5) Multiple vulnerabilities are caused due to a bundled vulnerable
version of WebKit.
Successful exploitation of vulnerabilities #3 and #5 through #17 may
allow execution of arbitrary code.
18) Certain input pasted from a different origin is not properly
sanitised in WebKit before being used.
19) Certain unspecified input related to frame handling is not
properly sanitised before being returned to the user.
For more information see vulnerability #1 in:
SA50759
NOTE: Additionally a weakness exists within the handling of 802.11i
information elements within Broadcom's BCM4325 and BCM4329 firmware,
which can be exploited to disable WiFi.
PROVIDED AND/OR DISCOVERED BY:
1, 9, 13, and 14) Reported by the vendor
The vendor credits:
3) Mark Dowd, Azimuth Security
4) Andrew Plotkin, Zarfhome Software Consulting, Ben Madison,
BitCloud, and Marek Durcek
6, 7, 8, 10, 11, 15, and 16) Abhishek Arya (Inferno), Google Chrome
Security Team
12) Dominic Cooney, Google and Martin Barbella, Google Chrome
Security Team
17) Aaron Nelson
18) Mario Heiderich, Cure53
ORIGINAL ADVISORY:
APPLE-SA-2013-01-28-1:
http://support.apple.com/kb/HT5642
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0338 | CVE-2013-0962 | Apple iOS and Apple Safari Used in WebKit Vulnerable to cross-site scripting |
CVSS V2: 2.6 CVSS V3: - Severity: LOW |
Cross-site scripting (XSS) vulnerability in WebKit in Apple iOS before 6.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted content that is not properly handled during a copy-and-paste operation. Apple iOS 6.1 Less than and Apple Safari 6.0.3 Used in less than WebKit Contains a cross-site scripting vulnerability. Web Script or HTML May be inserted. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Note: This issue was previously covered in BID 57572 (Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities), but has been given its own record to better document it. Apple iOS for the iPhone, the iPod touch, and the iPad is prone to multiple security vulnerabilities. These issues affect the following components:
Identity Services
Kernel
StoreKit
WebKit
Successfully exploiting these issues may allow attackers to execute arbitrary script code, bypass security restrictions, obtain sensitive information, execute arbitrary code, or crash the affected device. Other attacks are also possible.
This BID is being retired. The following individual records exist to better document the issues:
57576 WebKit CVE-2013-0948 Unspecified Memory Corruption Vulnerability
57580 WebKit CVE-2013-0949 Unspecified Memory Corruption Vulnerability
57581 WebKit CVE-2013-0950 Unspecified Memory Corruption Vulnerability
57582 WebKit CVE-2013-0951 Unspecified Memory Corruption Vulnerability
57583 WebKit CVE-2013-0962 Cross Site Scripting Vulnerability
57584 WebKit CVE-2013-0952 Unspecified Memory Corruption Vulnerability
57585 WebKit CVE-2013-0953 Unspecified Memory Corruption Vulnerability
57586 WebKit CVE-2013-0954 Unspecified Memory Corruption Vulnerability
57587 WebKit CVE-2013-0955 Unspecified Memory Corruption Vulnerability
57588 WebKit CVE-2013-0956 Unspecified Memory Corruption Vulnerability
57589 WebKit CVE-2013-0958 Unspecified Memory Corruption Vulnerability
57590 WebKit CVE-2013-0959 Unspecified Memory Corruption Vulnerability
57591 WebKit CVE-2013-0968 Unspecified Memory Corruption Vulnerability
57595 Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Information Disclosure Vulnerability
57597 Apple iPhone/iPad/iPod touch CVE-2013-0974 Security Bypass Vulnerability
57598 Apple iPhone/iPad/iPod touch Prior to iOS 6.1 CVE-2013-0963 Security Bypass Vulnerability.
CVE-ID
CVE-2013-0962 : Mario Heiderich of Cure53
For OS X Lion systems Safari 6.0.3 is available via
the Apple Software Update application.
For OS X Mountain Lion systems Safari 6.0.3 is included with
OS X v10.8.3. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-01-28-1 iOS 6.1 Software Update
iOS 6.1 Software Update is now available and addresses the following:
Identity Services
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Authentication relying on certificate-based Apple ID
authentication may be bypassed
Description: An error handling issue existed in Identity Services.
If the user's AppleID certificate failed to validate, the user's
AppleID was assumed to be the empty string. If multiple systems
belonging to different users enter this state, applications relying
on this identity determination may erroneously extend trust. This
issue was addressed by ensuring that NULL is returned instead of an
empty string.
CVE-ID
CVE-2013-0963
International Components for Unicode
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of the
EUC-JP encoding, which could lead to a cross-site scripting attack on
EUC-JP encoded websites. This issue was addressed by updating the
EUC-JP mapping table.
CVE-ID
CVE-2011-3058 : Masato Kinugawa
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user-mode process may be able to access the first page of
kernel memory
Description: The iOS kernel has checks to validate that the user-
mode pointer and length passed to the copyin and copyout functions
would not result in a user-mode process being able to directly access
kernel memory. The checks were not being used if the length was
smaller than one page. This issue was addressed through additional
validation of the arguments to copyin and copyout.
CVE-ID
CVE-2013-0964 : Mark Dowd of Azimuth Security
Security
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description: Several intermediate CA certificates were mistakenly
issued by TURKTRUST. This issue was addressed by not allowing the
incorrect SSL certificates.
StoreKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: JavaScript may be enabled in Mobile Safari without user
interaction
Description: If a user disabled JavaScript in Safari Preferences,
visiting a site which displayed a Smart App Banner would re-enable
JavaScript without warning the user. This issue was addressed by not
enabling JavaScript when visiting a site with a Smart App Banner.
CVE-ID
CVE-2013-0974 : Andrew Plotkin of Zarfhome Software Consulting, Ben
Madison of BitCloud, Marek Durcek
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2012-2824 : miaubiz
CVE-2012-2857 : Arthur Gerkis
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3687 : kuzzcc
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0951 : Apple
CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2013-0955 : Apple
CVE-2013-0956 : Apple Product Security
CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0968 : Aaron Nelson
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Copying and pasting content on a malicious website may lead
to a cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
content pasted from a different origin. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0962 : Mario Heiderich of Cure53
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
frame elements. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2012-2889 : Sergey Glazunov
WiFi
Available for: iPhone 3GS, iPhone 4, iPod touch (4th generation),
iPad 2
Impact: A remote attacker on the same WiFi network may be able to
temporarily disable WiFi
Description: An out of bounds read issue exists in Broadcom's
BCM4325 and BCM4329 firmware's handling of 802.11i information
elements. This issue was addressed through additional validation of
802.11i information elements.
CVE-ID
CVE-2012-2619 : Andres Blanco and Matias Eissler of Core Security
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device. The version after applying this update
will be "6.1".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRBffvAAoJEPefwLHPlZEwzYgP/0qhsTft9TUGuphoY9tth5WB
D0+8pAKs+1HU+nMOaEKPbK+zdMxblhRNPQyhMuTAQaY5Z/iGn1EXVCTlQBO8esRW
epxNZuhFoaW4wzK9kvw5d/HZ9tfq059ozlFOp1TI2D6J5RwNgxDfigt2PUKCTV4X
u/BONQHIfINYMofgf5897LHYYFSU2+NJj5ouM5dY4Y/kfJkwAnG5AWCAGlEt3QOo
MZdaVv3/itPj4te838FYCVAepel3xBWX0Hhuu87+waHslRrIfQl+EvNk3YZXxWiF
O5Hw9Ng/H8n0sbeA39w0U8tw+q/wPhVexdULgRjBH65+6g7Cu5u+rMuYuRjl8fO/
glLhKZNSrQDa5ZNOraOrF62AFVByHaSxv4cZwo262/6uH93FIBtklMt947GMVQLC
1FT0CIGNJb1/0156bvsABfRScBtK9ZdIUjXhOHMinhQJX3qiBqyKc4/juYPmC9VC
KXk2/K8b0sGWQRc5RuQsSpzkZF9WcrwmgGOBIghp2DLmbAAj0uh2Ttf1GdrOaajR
XpZ2TTJ5qE+IHNU0/etroTYnzjKVjQ0pODrPZj7ALLXULTraXJRJy7fqraUzsHbi
AZiRca+3x/S9nqV0NpTNPZgTwxenox10t0w5vhcBK+SPGga1oVRbtOjGtVIkgoG4
KI3sdgb6PtpZWuIJ6iZA
=J2jv
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Apple iOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA52002
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52002/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
RELEASE DATE:
2013-01-29
DISCUSS ADVISORY:
http://secunia.com/advisories/52002/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/52002/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two security issues and multiple vulnerabilities have been reported
in Apple iOS, which can be exploited by malicious people to conduct
cross-site scripting attacks, bypass certain security restrictions,
and compromise a user's device.
1) An error when handling a validation failure of a AppleID
certificate within the IdentityService can be exploited to
potentially bypass the certificate-based AppleID authentication via
an invalid AppleID certificate.
2) An error exists in International Components for Unicode.
5) Multiple vulnerabilities are caused due to a bundled vulnerable
version of WebKit.
Successful exploitation of vulnerabilities #3 and #5 through #17 may
allow execution of arbitrary code.
18) Certain input pasted from a different origin is not properly
sanitised in WebKit before being used.
19) Certain unspecified input related to frame handling is not
properly sanitised before being returned to the user.
For more information see vulnerability #1 in:
SA50759
NOTE: Additionally a weakness exists within the handling of 802.11i
information elements within Broadcom's BCM4325 and BCM4329 firmware,
which can be exploited to disable WiFi.
PROVIDED AND/OR DISCOVERED BY:
1, 9, 13, and 14) Reported by the vendor
The vendor credits:
3) Mark Dowd, Azimuth Security
4) Andrew Plotkin, Zarfhome Software Consulting, Ben Madison,
BitCloud, and Marek Durcek
6, 7, 8, 10, 11, 15, and 16) Abhishek Arya (Inferno), Google Chrome
Security Team
12) Dominic Cooney, Google and Martin Barbella, Google Chrome
Security Team
17) Aaron Nelson
18) Mario Heiderich, Cure53
ORIGINAL ADVISORY:
APPLE-SA-2013-01-28-1:
http://support.apple.com/kb/HT5642
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0339 | CVE-2013-0963 | Apple iOS 6.1 of Identity Services Vulnerabilities that bypass authentication |
CVSS V2: 2.1 CVSS V3: - Severity: LOW |
Identity Services in Apple iOS before 6.1 does not properly handle validation failures of AppleID certificates, which might allow physically proximate attackers to bypass authentication by leveraging an incorrect assignment of an empty string value to an AppleID.
An attacker can exploit this issue to bypass certain security restrictions, allowing the attacker to perform malicious activities.
Note: This issue was previously discussed in BID 57572 (Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities) but has been given its own record to better document it. Apple iOS for the iPhone, the iPod touch, and the iPad is prone to multiple security vulnerabilities. These issues affect the following components:
Identity Services
Kernel
StoreKit
WebKit
Successfully exploiting these issues may allow attackers to execute arbitrary script code, bypass security restrictions, obtain sensitive information, execute arbitrary code, or crash the affected device. Other attacks are also possible.
This BID is being retired. The following individual records exist to better document the issues:
57576 WebKit CVE-2013-0948 Unspecified Memory Corruption Vulnerability
57580 WebKit CVE-2013-0949 Unspecified Memory Corruption Vulnerability
57581 WebKit CVE-2013-0950 Unspecified Memory Corruption Vulnerability
57582 WebKit CVE-2013-0951 Unspecified Memory Corruption Vulnerability
57583 WebKit CVE-2013-0962 Cross Site Scripting Vulnerability
57584 WebKit CVE-2013-0952 Unspecified Memory Corruption Vulnerability
57585 WebKit CVE-2013-0953 Unspecified Memory Corruption Vulnerability
57586 WebKit CVE-2013-0954 Unspecified Memory Corruption Vulnerability
57587 WebKit CVE-2013-0955 Unspecified Memory Corruption Vulnerability
57588 WebKit CVE-2013-0956 Unspecified Memory Corruption Vulnerability
57589 WebKit CVE-2013-0958 Unspecified Memory Corruption Vulnerability
57590 WebKit CVE-2013-0959 Unspecified Memory Corruption Vulnerability
57591 WebKit CVE-2013-0968 Unspecified Memory Corruption Vulnerability
57595 Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Information Disclosure Vulnerability
57597 Apple iPhone/iPad/iPod touch CVE-2013-0974 Security Bypass Vulnerability
57598 Apple iPhone/iPad/iPod touch Prior to iOS 6.1 CVE-2013-0963 Security Bypass Vulnerability. Apple iOS is an operating system developed by Apple (Apple) for mobile devices.
CVE-ID
CVE-2011-3058 : Masato Kinugawa
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user-mode process may be able to access the first page of
kernel memory
Description: The iOS kernel has checks to validate that the user-
mode pointer and length passed to the copyin and copyout functions
would not result in a user-mode process being able to directly access
kernel memory. The checks were not being used if the length was
smaller than one page.
StoreKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: JavaScript may be enabled in Mobile Safari without user
interaction
Description: If a user disabled JavaScript in Safari Preferences,
visiting a site which displayed a Smart App Banner would re-enable
JavaScript without warning the user. This issue was addressed by not
enabling JavaScript when visiting a site with a Smart App Banner.
CVE-ID
CVE-2012-2824 : miaubiz
CVE-2012-2857 : Arthur Gerkis
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3687 : kuzzcc
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0951 : Apple
CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2013-0955 : Apple
CVE-2013-0956 : Apple Product Security
CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0968 : Aaron Nelson
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Copying and pasting content on a malicious website may lead
to a cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
content pasted from a different origin. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device. The version after applying this update
will be "6.1". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-03-14-1 OS X Mountain Lion v10.8.3 and Security Update
2013-001
OS X Mountain Lion v10.8.3 and Security Update 2013-001 is now
available and addresses the following:
Apache
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: An attacker may be able to access directories that are
protected with HTTP authentication without knowing the correct
credentials
Description: A canonicalization issue existed in the handling of
URIs with ignorable Unicode character sequences. This issue was
addressed by updating mod_hfs_apple to forbid access to URIs with
ignorable Unicode character sequences.
CVE-ID
CVE-2013-0966 : Clint Ruoho of Laconic Security
CoreTypes
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Visiting a maliciously crafted website could allow a Java
Web Start application to be launched automatically even if the Java
plug-in is disabled
Description: Java Web Start applications would run even if the Java
plug-in was disabled. This issue was addressed by removing JNLP files
from the CoreTypes safe file type list, so the Web Start application
will not be run unless the user opens it in the Downloads directory.
CVE-ID
CVE-2013-0967
International Components for Unicode
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of the
EUC-JP encoding, which could lead to a cross-site scripting attack on
EUC-JP encoded websites. This issue was addressed by updating the
EUC-JP mapping table.
CVE-ID
CVE-2011-3058 : Masato Kinugawa
Identity Services
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Authentication relying on certificate-based Apple ID
authentication may be bypassed
Description: An error handling issue existed in Identity Services.
If the user's AppleID certificate failed to validate, the user's
AppleID was assumed to be the empty string. If multiple systems
belonging to different users enter this state, applications relying
on this identity determination may erroneously extend trust. This
issue was addressed by ensuring that NULL is returned instead of an
empty string.
CVE-ID
CVE-2013-0963
ImageIO
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Viewing a maliciously crafted TIFF file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in libtiff's handling of TIFF
images. This issue was addressed through additional validation of
TIFF images.
CVE-ID
CVE-2012-2088
IOAcceleratorFamily
Available for: OS X Mountain Lion v10.8 to v10.8.2
Impact: Viewing a maliciously crafted image may lead to an
unexpected system termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
graphics data. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2013-0976 : an anonymous researcher
Kernel
Available for: OS X Mountain Lion v10.8 to v10.8.2
Impact: Maliciously crafted or compromised applications may be able
to determine addresses in the kernel
Description: An information disclosure issue existed in the handling
of APIs related to kernel extensions. Responses containing an
OSBundleMachOHeaders key may have included kernel addresses, which
may aid in bypassing address space layout randomization protection.
This issue was addressed by unsliding the addresses before returning
them.
CVE-ID
CVE-2012-3749 : Mark Dowd of Azimuth Security, Eric Monti of Square,
and additional anonymous researchers
Login Window
Available for: OS X Mountain Lion v10.8 to v10.8.2
Impact: An attacker with keyboard access may modify the system
configuration
Description: A logic error existed in VoiceOver's handling of the
Login Window, whereby an attacker with access to the keyboard could
launch System Preferences and modify the system configuration. This
issue was addressed by preventing VoiceOver from launching
applications at the Login Window.
CVE-ID
CVE-2013-0969 : Eric A. Schulman of Purpletree Labs
Messages
Available for: OS X Mountain Lion v10.8 to v10.8.2
Impact: Clicking a link from Messages may initiate a FaceTime call
without prompting
Description: Clicking on a specifically-formatted FaceTime:// URL in
Messages could bypass the standard confirmation prompt. This issue
was addressed by additional validation of FaceTime:// URLs.
CVE-ID
CVE-2013-0970 : Aaron Sigel of vtty.com
Messages Server
Available for: Mac OS X Server 10.6.8,
OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may reroute federated Jabber messages
Description: An issue existed in the Jabber server's handling of
dialback result messages. An attacker may cause the Jabber server to
disclose information intended for users of federated servers. This
issue was addressed through improved handling of dialback result
messages.
CVE-ID
CVE-2012-3525
PDFKit
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Viewing a maliciously crafted PDF file may lead to an
unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the handling of ink
annotations in PDF files. This issue was addressed through improved
memory management.
CVE-ID
CVE-2013-0971 : Tobias Klein working with HP TippingPoint's Zero Day
Initiative
Podcast Producer Server
Available for: Mac OS X Server 10.6.8,
OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of XML parameters. This issue was addressed by disabling XML
parameters in the Rails implementation used by Podcast Producer
Server.
CVE-ID
CVE-2013-0156
Podcast Producer Server
Available for: OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of JSON data. This issue was addressed by switching to using the
JSONGem backend for JSON parsing in the Rails implementation used by
Podcast Producer Server.
CVE-ID
CVE-2013-0333
PostgreSQL
Available for: Mac OS X Server 10.6.8,
OS X Lion Server v10.7 to v10.7.5
Impact: Multiple vulnerabilities in PostgreSQL
Description: PostgreSQL was updated to version 9.1.5 to address
multiple vulnerabilities, the most serious of which may allow
database users to read files from the file system with the privileges
of the database server role account. Further information is available
via the PostgreSQL web site at
http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
CVE-ID
CVE-2012-3488
CVE-2012-3489
Profile Manager
Available for: OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of XML parameters. This issue was addressed by disabling XML
parameters in the Rails implementation used by Profile Manager.
CVE-ID
CVE-2013-0156
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'rnet'
boxes in MP4 files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2012-3756 : Kevin Szkudlapski of QuarksLab
Ruby
Available for: Mac OS X Server 10.6.8
Impact: A remote attacker may be able to cause arbitrary code
execution if a Rails application is running
Description: A type casting issue existed in Ruby on Rails' handling
of XML parameters. This issue was addressed by disabling YAML and
symbols in XML parameters in Rails.
CVE-ID
CVE-2013-0156
Security
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description: Several intermediate CA certificates were mistakenly
issued by TURKTRUST. This may allow a man-in-the-middle attacker to
redirect connections and intercept user credentials or other
sensitive information. This issue was addressed by not allowing the
incorrect SSL certificates.
Software Update
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5
Impact: An attacker with a privileged network position may be able
to cause arbitrary code execution
Description: Software Update allowed a man in the middle attacker to
insert plugin content into the marketing text displayed for updates.
This may allow the exploitation of a vulnerable plugin, or facilitate
social engineering attacks involving plugins. This issue does not
affect OS X Mountain Lion systems. This issue was addressed by
preventing plugins from being loaded in Software Update's marketing
text WebView.
CVE-ID
CVE-2013-0973 : Emilio Escobar
Wiki Server
Available for: OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of XML parameters. This issue was addressed by disabling XML
parameters in the Rails implementation used by Wiki Server.
CVE-ID
CVE-2013-0156
Wiki Server
Available for: OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of JSON data. This issue was addressed by switching to using the
JSONGem backend for JSON parsing in the Rails implementation used by
Wiki Server.
CVE-ID
CVE-2013-0333
Malware removal
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Description: This update runs a malware removal tool that will
remove the most common variants of malware. If malware is found, it
presents a dialog notifying the user that malware was removed. There
is no indication to the user if malware is not found.
Note: OS X Mountain Lion v10.8.3 includes the content of
Safari 6.0.3. For further details see "About the security content
of Safari 6.0.3" at http://http//support.apple.com/kb/HT5671
OS X Mountain Lion v10.8.3 and Security Update 2013-001 may be
obtained from the Software Update pane in System Preferences,
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
OS X Mountain Lion v10.8.3, or Security Update
2013-001.
For OS X Mountain Lion v10.8.2
The download file is named: OSXUpd10.8.3.dmg
Its SHA-1 digest is: e6165572e9145ea05aac23fa30372a9b0a0bbf3c
For OS X Mountain Lion v10.8 and v10.8.1
The download file is named: OSXUpdCombo10.8.3.dmg
Its SHA-1 digest is: 1bc49fde5ff6e252aa7908b4cb1f9cb9c8a5fa29
For OS X Lion v10.7.5
The download file is named: SecUpd2013-001.dmg
Its SHA-1 digest is: 5bc540a208c720fce3448f853d852336781e1a17
For OS X Lion Server v10.7.5
The download file is named: SecUpdSrvr2013-001.dmg
Its SHA-1 digest is: e88ff36fc8e88c4c995422d3f2364c56ebe51b07
For Mac OS X v10.6.8
The download file is named: SecUpd2013-001.dmg
Its SHA-1 digest is: dc52d0f7d2db6080c57c7b9252a4d85c5e178450
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2013-001.dmg
Its SHA-1 digest is: fd7946f8d1f1bce0394b6e56c8d7387812e14694
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRQiuBAAoJEPefwLHPlZEwGfgP/0UDCn2KBop3IJ4Ad31yiG3N
gH+yQl4GDONhm/HgrPWGQgcuVI69FmAqk+7arwOL7+7hlsSDQ5uSWDraRdd0EPmO
aq2DxPxt6bYi4fHSrfkvRblVr/PcPxswEEshM82JU60Oy88EDA87bI8yy4qi8KJ4
E8+6O31vLuUeAaHf0SNE8y1p2iKpdmHH/Afo0iAVx3ddm8e8wMVPZ9XbR02pe8MV
qmMWj8icBLNyHGoSl48zm5t4Ah4MS9qgXNjsYY+Mq2AcrqQI5EFTbdWpKFM7SQ1G
UcM6zmeHtKNz8H21MDYKg1UHjo49MZnFb6ahRXN0E3jsPrfO4Co/2t6ogOLRZ90X
2Sd1RfwqYnRZRfwyOAe3htBYDpVEfvU1eaNMoTTHLRKWgarxUoXvww2cjnomAg5y
tg+btVeQfzdHu+yClvioCbYqblKKxJf8lmhiLEgoH2bRaz2L+fluWW9yGQarxmrb
vQ+cMKuy7heyLpNhwRHZioo4/b2K/IZBnkKwH76Ey3yAXnSSAD9xwbFZZAU5J8YQ
liULOm9tv1sUlNHMyTsjplIsFkAIrkl+H43hn3/A+q4TIsDkmtPvOOl4Rc9/5w8H
ZibyLnmr1XgXvd6CgFzIvl7Ink+d/xGHTnlybHszCMzR5o6Rg7sTeQsD34aNymcc
Lz1nnBtRAbfDgARdRX4e
=WUBR
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Apple iOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA52002
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52002/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
RELEASE DATE:
2013-01-29
DISCUSS ADVISORY:
http://secunia.com/advisories/52002/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/52002/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52002
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two security issues and multiple vulnerabilities have been reported
in Apple iOS, which can be exploited by malicious people to conduct
cross-site scripting attacks, bypass certain security restrictions,
and compromise a user's device.
2) An error exists in International Components for Unicode.
5) Multiple vulnerabilities are caused due to a bundled vulnerable
version of WebKit.
Successful exploitation of vulnerabilities #3 and #5 through #17 may
allow execution of arbitrary code.
18) Certain input pasted from a different origin is not properly
sanitised in WebKit before being used.
19) Certain unspecified input related to frame handling is not
properly sanitised before being returned to the user.
For more information see vulnerability #1 in:
SA50759
NOTE: Additionally a weakness exists within the handling of 802.11i
information elements within Broadcom's BCM4325 and BCM4329 firmware,
which can be exploited to disable WiFi.
PROVIDED AND/OR DISCOVERED BY:
1, 9, 13, and 14) Reported by the vendor
The vendor credits:
3) Mark Dowd, Azimuth Security
4) Andrew Plotkin, Zarfhome Software Consulting, Ben Madison,
BitCloud, and Marek Durcek
6, 7, 8, 10, 11, 15, and 16) Abhishek Arya (Inferno), Google Chrome
Security Team
12) Dominic Cooney, Google and Martin Barbella, Google Chrome
Security Team
17) Aaron Nelson
18) Mario Heiderich, Cure53
ORIGINAL ADVISORY:
APPLE-SA-2013-01-28-1:
http://support.apple.com/kb/HT5642
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201302-0420 | No CVE | SAP NetWeaver SPML XML Entity Reference Information Disclosure Vulnerability |
CVSS V2: - CVSS V3: - Severity: LOW |
SAP NetWeaver is the technical foundation of SAP's integrated technology platform and all SAP applications since SAP Business Suite. SAP NetWeaver 7.02 and other versions have errors in the XML parser within the SPML service when validating XML requests and can be exploited to leak local files. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
SAP NetWeaver SPML XML Entity References Information Disclosure
Vulnerability
SECUNIA ADVISORY ID:
SA51573
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51573/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51573
RELEASE DATE:
2013-01-24
DISCUSS ADVISORY:
http://secunia.com/advisories/51573/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51573/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51573
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
ERPScan has reported a vulnerability in SAP NetWeaver, which can be
exploited by malicious people to disclose certain sensitive
information.
disclose local files.
The vulnerability is reported in version 7.02. Other versions may
also be affected.
SOLUTION:
Apply SAP Security Note 1621534.
PROVIDED AND/OR DISCOVERED BY:
Alexey Tyurin, ERPScan.
ORIGINAL ADVISORY:
DSECRG-12-043:
http://erpscan.com/advisories/dsecrg-12-043-sap-netweaver-spml-xml-external-entity/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0351 | CVE-2013-1113 | Cisco Unified Communications Domain Manager Vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager allows remote attackers to inject arbitrary web script or HTML via a crafted parameter value, aka Bug ID CSCue21042.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
This issue is being tracked by Cisco Bug ID CSCue21042. This component features scalable, distributed, and highly available enterprise Voice over IP call processing. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Cisco Unified Communications Domain Manager (CUCDM) Cross-Site
Scripting Vulnerability
SECUNIA ADVISORY ID:
SA51954
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51954/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51954
RELEASE DATE:
2013-01-28
DISCUSS ADVISORY:
http://secunia.com/advisories/51954/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51954/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51954
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Cisco Unified Communications
Domain Manager (CUCDM), which can be exploited by malicious people to
conduct cross-site scripting attacks.
Certain unspecified input is not properly sanitised before being
returned to the user.
SOLUTION:
No official solution is currently available.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1113
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0216 | CVE-2012-1922 |
Sitecom WLM-2501 Vulnerable to cross-site request forgery
Related entries in the VARIoT exploits database: VAR-E-201203-0134, VAR-E-201203-0135 |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921. Sitecom WLM-2501 Contains a cross-site request forgery vulnerability. The Sitecom WLM-2501 is a router device. Sitecom WLM-2501 has multiple CSRF vulnerabilities. Attackers build malicious URIs, entice users to resolve, perform administrator actions in the target user context, and change router parameters
| VAR-201301-0132 | CVE-2012-5689 | ISC BIND Service disruption in ( Violation of representation and named Terminate daemon ) Vulnerabilities |
CVSS V2: 7.1 CVSS V3: - Severity: HIGH |
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record. ISC BIND is prone to a remote denial-of-service vulnerability.
Attackers can exploit this issue to crash the affected application, denying service to legitimate users.
The following are affected:
ISC BIND 9.8.0 through versions 9.8.4-P1
ISC BIND 9.9.0 through versions 9.9.2-P1. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
ISC BIND AAAA Record Lookup Handling Assertion Failure Vulnerability
SECUNIA ADVISORY ID:
SA51969
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51969/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51969
RELEASE DATE:
2013-01-25
DISCUSS ADVISORY:
http://secunia.com/advisories/51969/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51969/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51969
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in ISC BIND, which can be exploited
by malicious people to cause a DoS (Denial of Service). This can be exploited
to trigger an assertion failure and terminate the named process.
Successful exploitation requires that both DNS64 and Response Policy
Zones are configured and that A rewrite rules are maintained but not
AAAA rewrite rules.
The vulnerability is reported in versions 9.8.0 through 9.8.4-P1 and
9.9.0 through 9.9.2-P1.
SOLUTION:
As a workaround ensure that the RPZ contains a AAAA rewrite rule for
every A rewrite rule. The vulnerability will be fixed in a beta
version scheduled to be released on January 24, 2013.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Pories Ediansyah, Institut Teknologi Bandung.
ORIGINAL ADVISORY:
http://www.isc.org/software/bind/advisories/cve-2012-5689
https://kb.isc.org/article/AA-00855
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201401-34
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: BIND: Denial of Service
Date: January 29, 2014
Bugs: #437828, #446094, #453974, #463497, #478316, #483208, #498016
ID: 201401-34
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in BIND, possibly resulting in
Denial of Service.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-dns/bind < 9.9.4_p2 >= 9.9.4_p2
Description
===========
Multiple vulnerabilities have been discovered in BIND. Please review
the CVE identifiers referenced below for details.
Impact
======
A remote attacker may be able to cause a Denial of Service condition.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All BIND users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dns/bind-9.9.4_p2"
References
==========
[ 1 ] CVE-2012-5166
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5166
[ 2 ] CVE-2012-5688
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5688
[ 3 ] CVE-2012-5689
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5689
[ 4 ] CVE-2013-2266
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2266
[ 5 ] CVE-2013-3919
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3919
[ 6 ] CVE-2013-4854
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4854
[ 7 ] CVE-2014-0591
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0591
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201401-34.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ============================================================================
Ubuntu Security Notice USN-2693-1
July 28, 2015
bind9 vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Bind could be made to crash if it received specially crafted network
traffic.
Software Description:
- bind9: Internet Domain Name Server
Details:
Jonathan Foote discovered that Bind incorrectly handled certain TKEY
queries.
(CVE-2015-5477)
Pories Ediansyah discovered that Bind incorrectly handled certain
configurations involving DNS64. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-5689)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
bind9 1:9.9.5.dfsg-9ubuntu0.2
Ubuntu 14.04 LTS:
bind9 1:9.9.5.dfsg-3ubuntu0.4
Ubuntu 12.04 LTS:
bind9 1:9.8.1.dfsg.P1-4ubuntu0.12
In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: bind security and enhancement update
Advisory ID: RHSA-2013:0550-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0550.html
Issue date: 2013-02-21
CVE Names: CVE-2012-5689
=====================================================================
1. Summary:
Updated bind packages that fix one security issue and add one enhancement
are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
3. Description:
The Berkeley Internet Name Domain (BIND) is an implementation of the
Domain Name System (DNS) protocols. BIND includes a DNS server (named); a
resolver library (routines for applications to use when interfacing with
DNS); and tools for verifying that the DNS server is operating correctly.
DNS64 is used to automatically generate DNS records so IPv6 based clients
can access IPv4 systems through a NAT64 server.
A flaw was found in the DNS64 implementation in BIND when using Response
Policy Zones (RPZ). If a remote attacker sent a specially-crafted query to
a named server that is using RPZ rewrite rules, named could exit
unexpectedly with an assertion failure. Note that DNS64 support is not
enabled by default. (CVE-2012-5689)
This update also adds the following enhancement:
* Previously, it was impossible to configure the the maximum number of
responses sent per second to one client. This allowed remote attackers to
conduct traffic amplification attacks using DNS queries with spoofed source
IP addresses. With this update, it is possible to use the new "rate-limit"
configuration option in named.conf and configure the maximum number of
queries which the server responds to. Refer to the BIND documentation for
more details about the "rate-limit" option. (BZ#906312)
All bind users are advised to upgrade to these updated packages, which
contain patches to correct this issue and add this enhancement. After
installing the update, the BIND daemon (named) will be restarted
automatically.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
5. Bugs fixed (http://bugzilla.redhat.com/):
903417 - CVE-2012-5689 bind: denial of service when processing queries and with both DNS64 and RPZ enabled
906312 - bind: Backport Response Rate Limiting (DNS RRL) patch into Red Hat Enterprise Linux 6
6. Package List:
Red Hat Enterprise Linux Desktop (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/bind-9.8.2-0.17.rc1.el6.3.src.rpm
i386:
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-utils-9.8.2-0.17.rc1.el6.3.i686.rpm
x86_64:
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-utils-9.8.2-0.17.rc1.el6.3.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/bind-9.8.2-0.17.rc1.el6.3.src.rpm
i386:
bind-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-chroot-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-sdb-9.8.2-0.17.rc1.el6.3.i686.rpm
x86_64:
bind-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-chroot-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-sdb-9.8.2-0.17.rc1.el6.3.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/bind-9.8.2-0.17.rc1.el6.3.src.rpm
x86_64:
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-utils-9.8.2-0.17.rc1.el6.3.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/bind-9.8.2-0.17.rc1.el6.3.src.rpm
x86_64:
bind-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-chroot-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-sdb-9.8.2-0.17.rc1.el6.3.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/bind-9.8.2-0.17.rc1.el6.3.src.rpm
i386:
bind-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-chroot-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-utils-9.8.2-0.17.rc1.el6.3.i686.rpm
ppc64:
bind-9.8.2-0.17.rc1.el6.3.ppc64.rpm
bind-chroot-9.8.2-0.17.rc1.el6.3.ppc64.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.ppc.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.ppc64.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.ppc.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.ppc64.rpm
bind-utils-9.8.2-0.17.rc1.el6.3.ppc64.rpm
s390x:
bind-9.8.2-0.17.rc1.el6.3.s390x.rpm
bind-chroot-9.8.2-0.17.rc1.el6.3.s390x.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.s390.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.s390x.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.s390.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.s390x.rpm
bind-utils-9.8.2-0.17.rc1.el6.3.s390x.rpm
x86_64:
bind-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-chroot-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-utils-9.8.2-0.17.rc1.el6.3.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/bind-9.8.2-0.17.rc1.el6.3.src.rpm
i386:
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-sdb-9.8.2-0.17.rc1.el6.3.i686.rpm
ppc64:
bind-debuginfo-9.8.2-0.17.rc1.el6.3.ppc.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.ppc64.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.ppc.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.ppc64.rpm
bind-sdb-9.8.2-0.17.rc1.el6.3.ppc64.rpm
s390x:
bind-debuginfo-9.8.2-0.17.rc1.el6.3.s390.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.s390x.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.s390.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.s390x.rpm
bind-sdb-9.8.2-0.17.rc1.el6.3.s390x.rpm
x86_64:
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-sdb-9.8.2-0.17.rc1.el6.3.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/bind-9.8.2-0.17.rc1.el6.3.src.rpm
i386:
bind-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-chroot-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-utils-9.8.2-0.17.rc1.el6.3.i686.rpm
x86_64:
bind-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-chroot-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-libs-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-utils-9.8.2-0.17.rc1.el6.3.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/bind-9.8.2-0.17.rc1.el6.3.src.rpm
i386:
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-sdb-9.8.2-0.17.rc1.el6.3.i686.rpm
x86_64:
bind-debuginfo-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-debuginfo-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.i686.rpm
bind-devel-9.8.2-0.17.rc1.el6.3.x86_64.rpm
bind-sdb-9.8.2-0.17.rc1.el6.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2012-5689.html
https://access.redhat.com/security/updates/classification/#moderate
http://www.isc.org/software/bind/advisories/cve-2012-5689
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFRJnU0XlSAg2UNWIIRAqmKAJ9aw1xBPz0zvjWoO1dx8iwrf3KvTwCgh+FG
AQqiP7kshwm4ZGsABl1I61k=
=gqtc
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
| VAR-201304-0399 | CVE-2013-2761 | Schneider Electric M340 BMXNOE01xx/BMXP3420xx PLC Module Denial of Service Vulnerability |
CVSS V2: 4.0 CVSS V3: - Severity: MEDIUM |
The Schneider Electric M340 BMXNOE01xx and BMXP3420xx PLC modules allow remote authenticated users to cause a denial of service (module crash) via crafted FTP traffic, as demonstrated by the FileZilla FTP client. The SESU tool used by several of these products is used to update software on Windows PC systems. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. Schneider Electric Ethernetmokuai has a cross-site request forgery vulnerability that allows an attacker to build a malicious URI, entice a user to resolve, and perform malicious actions, such as changing passwords, in the context of the target user. The following versions are affected by this vulnerability: Quantum: 140NOE77111 140NOE77101 140NWM10000 M340: BMXNOC0401 BMXNOE0100x BMXNOE011xx Premium: TSXETY4103 TSXETY5103 TSXWMY100. Schneider Electric Ethernet Modules are prone to a denial-of-service vulnerability.
A remote attacker can exploit this issue to crash the module, resulting in denial-of-service conditions.
The following modules are vulnerable:
Ethernet Module M340 BMXNOE01xx
Ethernet Module M340 BMXP3420xx. Schneider Electric software on customer PCs uses the SESU service as a communication mechanism to the Schneider Electric central update server, which can be used to receive software updates on a regular basis. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Schneider Electric Ethernet Modules Cross-Site Request Forgery
Vulnerability
SECUNIA ADVISORY ID:
SA52189
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52189/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=52189
RELEASE DATE:
2013-02-14
DISCUSS ADVISORY:
http://secunia.com/advisories/52189/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/52189/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52189
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Schneider Electric Ethernet
Modules, which can be exploited by malicious people to conduct
cross-site request forgery attacks.
The vulnerability is caused due to the modules allowing users to
perform certain actions via HTTP requests without performing proper
validity checks to verify the requests. This can be exploited to e.g.
change credentials when a logged-in administrator visits a specially
crafted web page.
Quantum:
140NOE77111
140NOE77101
140NWM10000
M340:
BMXNOC0401
BMXNOE0100x
BMXNOE011xx
Premium:
TSXETY4103
TSXETY5103
TSXWMY100
SOLUTION:
No official solution is currently available.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Arthur Gervais.
ORIGINAL ADVISORY:
SEVD-2013-023-01:
http://download.schneider-electric.com/files?L=en&p=&p_docId=&p_docId=&p_Reference=SEVD%202013-023-01&p_EnDocType=Technical%20paper&p_File_Id=36555639&p_File_Name=SEVD-2013-023-01.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0343 | CVE-2013-1102 |
Cisco Wireless LAN Controller Service disruption in ( Device reload ) Vulnerabilities
Related entries in the VARIoT exploits database: VAR-E-201301-0211 |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.0, 7.1 and 7.2 before 7.2.110.0, and 7.3 before 7.3.101.0 allows remote attackers to cause a denial of service (device reload) via crafted IP packets, aka Bug ID CSCtx80743. Service attack.
Exploiting these issues could allow an attacker to deny service to legitimate users, execute arbitrary code, or gain unauthorized access. Other attacks may also be possible. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Cisco Wireless LAN Controllers Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA51965
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51965/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51965
RELEASE DATE:
2013-01-24
DISCUSS ADVISORY:
http://secunia.com/advisories/51965/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51965/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51965
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Cisco Wireless Lan
Controllers, which can be exploited by malicious users to bypass
certain security restrictions and compromise a vulnerable system and
by malicious people to cause a DoS (Denial of Service).
1) An error within the wIPS component when handling certain IP
packets can be exploited to cause a reload.
2) An error when handling certain Session Initiation Protocol (SIP)
packets can be exploited to cause a reload.
3) An input sanitisation error can be exploited to execute arbitrary
code by sending a specially crafted UserAgent string.
4) An error when handling access restrictions can be exploited to
view or modify sensitive information such as configuration files.
The vulnerabilities are reported in the following products:
* Cisco 2000 Series WLC
* Cisco 2100 Series WLC
* Cisco 2500 Series WLC
* Cisco 4100 Series WLC
* Cisco 4400 Series WLC
* Cisco 5500 Series WLC
* Cisco 7500 Series WLC
* Cisco 8500 Series WLC
* Cisco 500 Series Wireless Express Mobility Controllers
* Cisco Wireless Services Module (Cisco WiSM)
* Cisco Wireless Services Module version 2 (Cisco WiSM version 2)
* Cisco NME-AIR-WLC Module for Integrated Services Routers (ISRs)
* Cisco NM-AIR-WLC Module for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
* Cisco Flex 7500 Series Cloud Controller
* Cisco Virtual Wireless Controller
* Cisco Wireless Controller Software for Integrated Services Module
300 and Cisco Services-Ready Engine 700, 710, 900, and 910
SOLUTION:
Apply update (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY:
#1, #2, #3) Reported by the vendor.
#4) The vendor credits Darren Johnson.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0344 | CVE-2013-1103 |
Cisco Wireless LAN Controller Service disruption in (DoS) Vulnerabilities
Related entries in the VARIoT exploits database: VAR-E-201301-0211 |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote attackers to cause a denial of service (Access Point reload) via crafted SIP packets, aka Bug ID CSCts87659.
Exploiting these issues could allow an attacker to deny service to legitimate users, execute arbitrary code, or gain unauthorized access. Other attacks may also be possible. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Cisco Wireless LAN Controllers Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA51965
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51965/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51965
RELEASE DATE:
2013-01-24
DISCUSS ADVISORY:
http://secunia.com/advisories/51965/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51965/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51965
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Cisco Wireless Lan
Controllers, which can be exploited by malicious users to bypass
certain security restrictions and compromise a vulnerable system and
by malicious people to cause a DoS (Denial of Service).
1) An error within the wIPS component when handling certain IP
packets can be exploited to cause a reload.
Successful exploitation requires that Cisco WLCs are configured with
Wireless Intrusion Prevention System (wIPS).
2) An error when handling certain Session Initiation Protocol (SIP)
packets can be exploited to cause a reload.
3) An input sanitisation error can be exploited to execute arbitrary
code by sending a specially crafted UserAgent string.
4) An error when handling access restrictions can be exploited to
view or modify sensitive information such as configuration files.
The vulnerabilities are reported in the following products:
* Cisco 2000 Series WLC
* Cisco 2100 Series WLC
* Cisco 2500 Series WLC
* Cisco 4100 Series WLC
* Cisco 4400 Series WLC
* Cisco 5500 Series WLC
* Cisco 7500 Series WLC
* Cisco 8500 Series WLC
* Cisco 500 Series Wireless Express Mobility Controllers
* Cisco Wireless Services Module (Cisco WiSM)
* Cisco Wireless Services Module version 2 (Cisco WiSM version 2)
* Cisco NME-AIR-WLC Module for Integrated Services Routers (ISRs)
* Cisco NM-AIR-WLC Module for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
* Cisco Flex 7500 Series Cloud Controller
* Cisco Virtual Wireless Controller
* Cisco Wireless Controller Software for Integrated Services Module
300 and Cisco Services-Ready Engine 700, 710, 900, and 910
SOLUTION:
Apply update (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY:
#1, #2, #3) Reported by the vendor.
#4) The vendor credits Darren Johnson.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0345 | CVE-2013-1104 |
Cisco Wireless LAN Controller Arbitrary Code Execution Vulnerability
Related entries in the VARIoT exploits database: VAR-E-201301-0211 |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP User-Agent header, aka Bug ID CSCuc15636. The Cisco Wireless LAN Controller is responsible for system-wide wireless LAN functions such as security policy, intrusion protection, RF management, quality of service, and mobility. Cisco Wireless LAN Controllers fail to properly filter user-supplied input, allowing authenticated remote attackers to send specially crafted UserAgent strings over wired or wireless segments. The software handles specially crafted strings allowing an attacker to execute arbitrary code on the system. Other attacks may also be possible. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Cisco Wireless LAN Controllers Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA51965
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51965/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51965
RELEASE DATE:
2013-01-24
DISCUSS ADVISORY:
http://secunia.com/advisories/51965/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51965/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51965
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Cisco Wireless Lan
Controllers, which can be exploited by malicious users to bypass
certain security restrictions and compromise a vulnerable system and
by malicious people to cause a DoS (Denial of Service).
1) An error within the wIPS component when handling certain IP
packets can be exploited to cause a reload.
Successful exploitation requires that Cisco WLCs are configured with
Wireless Intrusion Prevention System (wIPS).
2) An error when handling certain Session Initiation Protocol (SIP)
packets can be exploited to cause a reload.
4) An error when handling access restrictions can be exploited to
view or modify sensitive information such as configuration files.
The vulnerabilities are reported in the following products:
* Cisco 2000 Series WLC
* Cisco 2100 Series WLC
* Cisco 2500 Series WLC
* Cisco 4100 Series WLC
* Cisco 4400 Series WLC
* Cisco 5500 Series WLC
* Cisco 7500 Series WLC
* Cisco 8500 Series WLC
* Cisco 500 Series Wireless Express Mobility Controllers
* Cisco Wireless Services Module (Cisco WiSM)
* Cisco Wireless Services Module version 2 (Cisco WiSM version 2)
* Cisco NME-AIR-WLC Module for Integrated Services Routers (ISRs)
* Cisco NM-AIR-WLC Module for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
* Cisco Flex 7500 Series Cloud Controller
* Cisco Virtual Wireless Controller
* Cisco Wireless Controller Software for Integrated Services Module
300 and Cisco Services-Ready Engine 700, 710, 900, and 910
SOLUTION:
Apply update (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY:
#1, #2, #3) Reported by the vendor.
#4) The vendor credits Darren Johnson.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0346 | CVE-2013-1105 |
Cisco Wireless LAN Controller Vulnerability in which wireless management settings can be bypassed
Related entries in the VARIoT exploits database: VAR-E-201301-0211 |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 before 7.3.101.0 allow remote authenticated users to bypass wireless-management settings and read or modify the device configuration via an SNMP request, aka Bug ID CSCua60653. The Cisco Wireless LAN Controller is responsible for system-wide wireless LAN functions such as security policy, intrusion protection, RF management, quality of service, and mobility.
Exploiting these issues could allow an attacker to deny service to legitimate users, execute arbitrary code, or gain unauthorized access. Other attacks may also be possible. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Cisco Wireless LAN Controllers Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA51965
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51965/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51965
RELEASE DATE:
2013-01-24
DISCUSS ADVISORY:
http://secunia.com/advisories/51965/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51965/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51965
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Cisco Wireless Lan
Controllers, which can be exploited by malicious users to bypass
certain security restrictions and compromise a vulnerable system and
by malicious people to cause a DoS (Denial of Service).
1) An error within the wIPS component when handling certain IP
packets can be exploited to cause a reload.
Successful exploitation requires that Cisco WLCs are configured with
Wireless Intrusion Prevention System (wIPS).
2) An error when handling certain Session Initiation Protocol (SIP)
packets can be exploited to cause a reload.
3) An input sanitisation error can be exploited to execute arbitrary
code by sending a specially crafted UserAgent string.
4) An error when handling access restrictions can be exploited to
view or modify sensitive information such as configuration files.
The vulnerabilities are reported in the following products:
* Cisco 2000 Series WLC
* Cisco 2100 Series WLC
* Cisco 2500 Series WLC
* Cisco 4100 Series WLC
* Cisco 4400 Series WLC
* Cisco 5500 Series WLC
* Cisco 7500 Series WLC
* Cisco 8500 Series WLC
* Cisco 500 Series Wireless Express Mobility Controllers
* Cisco Wireless Services Module (Cisco WiSM)
* Cisco Wireless Services Module version 2 (Cisco WiSM version 2)
* Cisco NME-AIR-WLC Module for Integrated Services Routers (ISRs)
* Cisco NM-AIR-WLC Module for Integrated Services Routers (ISRs)
* Cisco Catalyst 3750G Integrated WLCs
* Cisco Flex 7500 Series Cloud Controller
* Cisco Virtual Wireless Controller
* Cisco Wireless Controller Software for Integrated Services Module
300 and Cisco Services-Ready Engine 700, 710, 900, and 910
SOLUTION:
Apply update (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY:
#1, #2, #3) Reported by the vendor.
#4) The vendor credits Darren Johnson.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0447 | No CVE | SAP NetWeaver SDM Multiple Security Vulnerabilities |
CVSS V2: - CVSS V3: - Severity: MEDIUM |
SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. The SAP NetWeaver SDM service has an unspecified error that allows an attacker to exploit a vulnerability to bypass authentication and perform restricted operations. SAP NetWeaver is prone to multiple security vulnerabilities. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
SAP NetWeaver SDM Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA51740
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51740/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51740
RELEASE DATE:
2013-01-23
DISCUSS ADVISORY:
http://secunia.com/advisories/51740/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51740/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51740
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
ERPScan has reported multiple vulnerabilities in SAP NetWeaver, which
can be exploited by malicious people to disclose certain sensitive
information, bypass certain security restrictions, and cause a DoS
(Denial of Service).
SOLUTION:
Apply SAP Note 1724516.
PROVIDED AND/OR DISCOVERED BY:
Alexander Polyakov, ERPScan.
ORIGINAL ADVISORY:
SAP:
https://service.sap.com/sap/support/notes/1724516
ERPScan (DSECRG-12-044, DSECRG-12-045, DSECRG-12-046, DSECRG-12-047,
DSECRG-12-048):
http://erpscan.com/advisories/dsecrg-12-044-sap-netweaver-sdm-authentication-bypass/
http://erpscan.com/advisories/dsecrg-12-045-sap-netweaver-sdm-denial-of-service/
http://erpscan.com/advisories/dsecrg-12-046-sap-netweaver-sdm-information-disclosure-and-smbrelay/
http://erpscan.com/advisories/dsecrg-12-047-sap-netweaver-sdm-admin-information-disclosure/
http://erpscan.com/advisories/dsecrg-12-048-sap-netweaver-sdm-admin-dos/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201401-0017 | CVE-2012-3000 |
plural F5 BIG-IP Product APM WebGUI and AVR WebGUI In SQL Injection vulnerability
Related entries in the VARIoT exploits database: VAR-E-201301-0068 |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Multiple SQL injection vulnerabilities in sam/admin/reports/php/saveSettings.php in the (1) APM WebGUI in F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, Edge Gateway, and Analytics and (2) AVR WebGUI in WebAccelerator and WOM 11.2.x before 11.2.0-HF3 and 11.2.x before 11.2.1-HF3 allow remote authenticated users to execute arbitrary SQL commands via the defaultQuery parameter. F5 BIG-IP is an application switch. F5 BIG-IP saveSettings.php fails to properly filter user-submitted input. An authenticated attacker can exploit a vulnerability to submit a malicious SQL query that can access MySQL database information or access system files in the \"mysql\" OS user context. To successfully exploit a vulnerability, you may need to enable Application Security (ASM) or Access Policy (APM).
Versions prior to F5 BIG-IP 11.2.0 are vulnerable. F5 BIG-IP LTM, etc. are all products of F5 Company in the United States. LTM is a local traffic manager; GTM is a wide area traffic manager; WebAccelerator is an application accelerator. The vulnerability is caused by the sam/admin/reports/php/saveSettings.php script not adequately filtering the 'defaultQuery' parameter. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
F5 Products "defaultQuery" SQL Injection Vulnerability
SECUNIA ADVISORY ID:
SA51867
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51867/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51867
RELEASE DATE:
2013-01-25
DISCUSS ADVISORY:
http://secunia.com/advisories/51867/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51867/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51867
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
SEC Consult has reported a vulnerability in F5 Products, which can be
exploited by malicious users to conduct SQL injection attacks. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.
The vulnerability is reported in the following products:
* BIG-IP LTM version 11.x
* BIG-IP GTM version 11.x
* BIG-IP ASM version 11.x
* BIG-IP Link Controller version 11.x
* BIG-IP PSM version 11.x
* BIG-IP APM version 11.x
* BIG-IP Edge Gateway version 11.x
* BIG-IP Analytics version 11.x
SOLUTION:
Update to a fixed version (Please see vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY:
Stefan Viehb\xf6ck, SEC Consult.
ORIGINAL ADVISORY:
sol14154:
http://support.f5.com/kb/en-us/solutions/public/14000/100/sol14154.html
SEC Consult:
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130122-1_F5_BIG-IP_SQL_Injection_v10.txt
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0369 | CVE-2013-0651 | GE Proficy Real-Time Information Portal Multiple Information Disclosure Vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request. GE Proficy Real-Time Information Portal is a Proficy real-time information portal, a real-time manufacturing intelligence application for GE Intelligent Platforms.
Attackers can exploit these issues to gain access to sensitive information that may aid in further attacks. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Proficy Real-Time Information Portal Two Information Disclosure
Security Issues
SECUNIA ADVISORY ID:
SA51746
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51746/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51746
RELEASE DATE:
2013-01-23
DISCUSS ADVISORY:
http://secunia.com/advisories/51746/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51746/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51746
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two security issues have been reported in Proficy Real-Time
Information Portal, which can be exploited by malicious people to
disclose certain sensitive information.
1) The application provides unrestricted access to certain files and
directories, which can be exploited to e.g. retrieve configuration
files.
2) The application exposes certain methods via Java RMI, which can be
exploited to disclose information via RMI call.
The security issues are reported in all supported versions.
SOLUTION:
Apply updates (please see the vendor's advisory for details).
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
ICSA-13-022-01:
http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0370 | CVE-2013-0652 | GE Proficy Real-Time Information Portal Multiple Information Disclosure Vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers to obtain a username listing via an RMI call.
Attackers can exploit these issues to gain access to sensitive information that may aid in further attacks. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Proficy Real-Time Information Portal Two Information Disclosure
Security Issues
SECUNIA ADVISORY ID:
SA51746
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51746/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51746
RELEASE DATE:
2013-01-23
DISCUSS ADVISORY:
http://secunia.com/advisories/51746/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51746/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51746
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Two security issues have been reported in Proficy Real-Time
Information Portal, which can be exploited by malicious people to
disclose certain sensitive information.
1) The application provides unrestricted access to certain files and
directories, which can be exploited to e.g. retrieve configuration
files.
The security issues are reported in all supported versions.
SOLUTION:
Apply updates (please see the vendor's advisory for details).
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
ICSA-13-022-01:
http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------