NUEVA VULNERABILIDAD, Google Chrome ‘dtoa()’ Remote Code Execution Vulnerability

Google Chrome is prone to a remote code-execution vulnerability.

Successful exploits will allow an attacker to execute arbitrary code in the Chrome sandbox. Failed attacks may cause denial-of-service conditions.

NOTE: This issue is related to BID 35510 (Multiple BSD Distributions ‘gdtoa/misc.c’ Memory Corruption Vulnerability), but because of differences in the code base, it is being assigned its own record.

This issue affects versions prior to Chrome 3.0.195.24.

Published:    Sep 30 2009 12:00AM
Updated:       Oct 01 2009 04:00PM

REFERENCIA DE LA VULNERABILIDAD

GOOGLE REFERENCE

fuente: securityfocus.com

VULNERABILIDAD. Internet Explorer Unspecified Remote Code Execution Vulnerability

Internet Explorer is prone to an unspecified remote code-execution vulnerability.

This issue was demonstrated at the CanSecWest 2009 conference. Technical details are not yet available; we will update this BID as more information emerges.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the browser. Successful exploits will compromise the application and possibly the computer. Failed attacks will cause denial-of-service conditions.

Published:       Mar 19 2009 12:00AM
Updated:     Mar 19 2009 04:26PM

REFERENCIA DE LA VULNERABILIDAD

fuente: securityfocus.com

VULNERABILIDADES. Nuevos vulnerabilidades que afectan al producto Red Hat

Red Hat SBLIM Insecure Library Path Local Privilege Escalation Vulnerability

Red Hat Certificate System Multiple Local Information Disclosure Vulnerabilities

Red Hat Certificate System rhpki-common Security Bypass Weakness

fuente: securityfocus.com

Una vulnerabilidad en Gmail que Google prefiere ignorar

Un ingeniero español publica cómo explotar un agujero de seguridad que permite modificar la clave de acceso de un usuario sin su consentimiento.

Este Informático, ha decidido publicar cómo aprovechar un agujero de seguridad que encontró en Gmail para cambiar la contraseña de un usuario sin su consentimiento, con el consecuente peligro de robo de identidad y acceso a información confidencial que eso conlleva.

Asegura que informó a Google el 1 de agosto de 2007 y, tras una respuesta solicitando información adicional para analizar el problema y otra 15 días más tarde para informar que estaban trabajando en solucionarlo, el buscador no volvió a contactar con él hasta cinco meses después. El 18 de enero, Google contestó a uno de sus correos (en los que solicitaba información sobre el avance del parche para corregir el problema) indicando que el equipo de seguridad de Google no tenía pensado hacer modificaciones al respecto. “Consideramos estos argumentos insuficientes”, dijeron. Tras nuevos intentos de contacto para exigir un arreglo del problema, ayer decidió hacerlo público.

Como explica el propio informático, se trata de una vulnerabilidad del tipo CSRF, que permitiría a un atacante modificar la contraseña de un usuario de Gmail sin su conocimiento. El único modo para autentificar el usuario es mediante una cookie que es enviada automáticamente por el navegador en cada solicitud. Un atacante puede crear una página que incluye las solicitudes de la funcionalidad de Gmail de “Cambiar contraseña ” y modificar las contraseñas de los usuarios quienes, siendo autorizados, visitarían la página del atacante.

fuente: vnunet.es

VULNERABILIDAD. Mozilla Firefox Nested ‘window.print()’ Denial of Service Vulnerability

Mozilla Firefox is prone to a remote denial-of-service vulnerability.

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions.

Firefox 2.0.0.20 is vulnerable; other versions may also be affected.

REFERENCIA DE LA VULNERABILIDAD

EXPLOIT

fuente: securityfocus.com

VULNERABILIDADES. Nuevas variaciones de las vulnerabilidades que afectan PHP

PHP SAPI ‘php_getuid()’ Safe Mode Restriction-Bypass Vulnerability

PHP ‘mbstring’ Extension Buffer Overflow Vulnerability

PHP ZipArchive::extractTo() ‘.zip’ Files Directory Traversal Vulnerability

PHP ‘error_log’ Safe Mode Restriction-Bypass Vulnerability

fuente: securityfocus

VULNERABILIDAD. Adobe Acrobat and Reader are prone to a remote code-execution vulnerability

Adobe Acrobat and Reader are prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application or crash the application, denying service to legitimate users.

The issue affects Reader and Acrobat 9, 8.1.3 and prior, and 7.

REFERENCIA DE LA VULNERABILIDAD

PROOF OF CONCEPT DE LA VULNERABILIDAD

fuente: securityfocus

Riesgos y Tendencias del 2008, Reporte Anual. X-Force

Como viene siendo en los ultimos años X-Force, IBM realiza un completo informe estadistico anual sobre las nuevas tendencias referente a riegos, vulnerabilidades, spam, phising, entre otros y que nos afectan diariamente.

Vulnerabilidades Descubiertas en 2008.
X-Force ha analizado y documentado en 2008, 7406 nuevas vulnerabilidades. En la grafica se ve un gran incremento de vulnerabilidades descubiertas en el 2008.

Tiempo en se han descubierto las vulnerabilidades.
Nos cuentan de que en el 2008 la semana antes de Navidad ha sido la más ocupada es decir donde mas vulnerabilidades se han encontrado. También comentan que el día Martes es donde se observan más vulnerabilidades siendo esto una tendencia que se viene observando desde 2005 y es debido a que este es el día en que muchas compañías desarrolladoras de software utilizan para sacar las nuevas actualización, parches, etc.

Pueden ver el documento completo aqui. X-Force Annual Report.

fuente: ibm.com

Denegación de servicio en Cisco Unified Communications Manager 5.x y 6.x

Cisco ha publicado una actualización para Cisco Unified Communications Manager 5.x y 6.x que corrige un fallo de seguridad que podría permitir que un atacante remoto causase una denegación de servicio.

La solución Unified Communications de Cisco es un conjunto de productos y aplicaciones de comunicaciones que reúne e integra voz, vídeo y datos.

El servicio Certificate Authority Proxy Function (CAPF) no maneja adecuadamente las entradas mal formadas, lo que podría provocar una interrupción de los servicios de voz. El servicio CAPF no está habilitado por defecto.

Cisco, a través de los canales habituales, ha puesto a disposición de sus clientes soluciones para solventar el problema.
Se aconseja consultar la tabla de versiones vulnerables y contramedidas en:
www.cisco.com/warp/public/707/cisco-sa-20090121-cucmcapf.shtml

fuente: hispasec

VULNERABILIDAD. Quake 3 Engine remapShader Command Remote Buffer Overflow Vulnerability

The Quake 3 engine is susceptible to a remote buffer-overflow vulnerability. This issue is due to the application’s failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Remote attackers may exploit this issue to execute arbitrary machine code in the context of affected game clients. Failed exploit attempts will likely crash affected clients.

This vulnerability reportedly affects the following games:
- Quake 3 Arena
- Return to Castle Wolfenstein
- Wolfenstein: Enemy Territory

Other games may also be affected.

fuente:securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. Linux Kernel ‘ndiswrapper’ Remote Buffer Overflow Vulnerability

The Linux Kernel is prone to a remote buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.

The issue affects Linux Kernel 2.6.27; other versions may also be vulnerable.
fuente:securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. Adobe Flash Player Unspecified Remote Security Vulnerability

Adobe Flash Player is prone to an unspecified security vulnerability.

Remote attackers may exploit this vulnerability to compromise an affected computer.

No further technical details are currently available. We will update this BID as more information emerges.

This issue affects Flash Player on Linux platforms.

Versions prior to Flash Player 10.0.15.3 and 9.0.152.0 are vulnerable.

fuente: securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. PowerDNS Malformed Query Handling Weakness

PowerDNS is prone to a weakness caused by dropping malformed DNS queries.

An attacker may leverage this issue to carry out spoofing attacks to manipulate third-party DNS cache data, potentially facilitating man-in-the-middle, site-impersonation, or denial-of-service attacks.

Versions prior to PowerDNS 2.9.21.1 are vulnerable.

fuente: securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness

Apache is prone to a cross-site scripting weakness when handling HTTP request methods that result in 413 HTTP errors.

An attacker may exploit this issue to steal cookie-based authentication credentials and launch other attacks.

Apache 2.0.46 through 2.2.4 are vulnerable; other versions may also be affected.

fuente: securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. Linux Kernel ‘truncate()’ Local Privilege Escalation Vulnerability

The Linux kernel is prone to a local privilege-escalation vulnerability related to the ‘truncate()’ and ‘ftruncate()’ functions.

Versions prior to Linux kernel 2.6.22-rc1 are vulnerable.

fuente: securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. Microsoft Communicator RTCP Unspecified Remote Denial of Service Vulnerability

Microsoft Communicator is prone to a remote denial-of-service vulnerability that affects the Real-time Transport Control Protocol (RTCP) handling. The cause of this issue is unknown.

Exploiting this issue allows remote attackers to crash the application and trigger denial-of-service conditions, denying further service to legitimate users.

This issue affects Microsoft Communicator, Office Communications Server (OCS), and Windows Live Messenger.

fuente: securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. Sun Java System Identity Manager Multiple Vulnerabilities

Sun Java System Identity Manager is prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, multiple cross-site scripting issues, multiple HTML-injection issues, and a directory-traversal vulnerability.

Successful exploits of many of these issues will allow an attacker to completely compromise the affected application.

These issues affect the following versions:

Sun Java System Identity Manager 6.0
Sun Java System Identity Manager 6.0 SP1
Sun Java System Identity Manager 6.0 SP2
Sun Java System Identity Manager 6.0 SP3
Sun Java System Identity Manager 6.0 SP4
Sun Java System Identity Manager 7.0
Sun Java System Identity Manager 7.1

fuente: securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. Cisco IOS MPLS VPN Information Disclosure Vulnerability

Cisco IOS (Internetwork Operating System) is an operating system commonly used on Cisco routers and network switches.

Cisco ISO Multiprotocol Label Switching (MPLS) Virtual Private Networks (VPNs) and VPN Routing and Forwarding Lite (VRF Lite) are prone to an information-disclosure vulnerability.

This vulnerability is tracked by Cisco Bug ID CSCee83237 and CVE-2008-3803.

fuente: securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. Microsoft Internet Explorer 6 RDS.DataControl Denial of Service Vulnerability

Microsoft Internet Explorer version 6 is reportedly prone to a denial-of-service vulnerability because the application fails to perform boundary checks before copying user-supplied data into sensitive process buffers.

This issue is triggered when an attacker convinces a victim user to activate a malicious ActiveX control object.

Remote attackers may exploit this issue to crash Internet Explorer 6, effectively denying service to legitimate users.

A stack-based heap overflow may be possible, and as a result, remote code execution in the context of the user running the affected application may occur. This has not been confirmed.

fuente: securityfocus

REFERENCIA DE LA VULNERABILIDAD

VULNERABILIDAD. Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability

Microsoft Windows is prone to a remote-code execution vulnerability that affects RPC (Remote Procedure Call) handling in the Server service.

An attacker could exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will result in the complete compromise of vulnerable computers. This issue may be prone to widespread automated exploits. Attackers require authenticated access on Windows Vista and Server 2008 platforms to exploit this issue.

This vulnerability affects Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.
fuente: securityfocus

REFERENCIA DE LA VULNERABILIDAD