Weekly Vulnerabilities Reports > April 1 to 7, 2013
Overview
48 new vulnerabilities reported during this period, including 7 critical vulnerabilities and 11 high severity vulnerabilities. This weekly summary report vulnerabilities in 53 products from 28 vendors including IBM, Mozilla, Canonical, Postgresql, and Microsoft. Vulnerabilities are notably categorized as "Improper Restriction of Operations within the Bounds of a Memory Buffer", "Permissions, Privileges, and Access Controls", "Information Exposure", "Cross-site Scripting", and "Improper Input Validation".
- 46 reported vulnerabilities are remotely exploitables.
- 1 reported vulnerabilities have public exploit available.
- 11 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
- 40 reported vulnerabilities are exploitable by an anonymous user.
- IBM has the most reported vulnerabilities, with 5 reported vulnerabilities.
- Mozilla has the most reported critical vulnerabilities, with 2 reported vulnerabilities.
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
EXPLOITABLE
EXPLOITABLE
AVAILABLE
ANONYMOUSLY
WEB APPLICATION
Vulnerability Details
The following table list reported vulnerabilities for the period covered by this report:
7 Critical Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2013-04-04 | CVE-2013-1903 | Postgresql | Permissions, Privileges, and Access Controls vulnerability in Postgresql PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack vectors. | 10.0 |
2013-04-04 | CVE-2013-1902 | Postgresql | Insecure Temporary File Creation vulnerability in PostgreSQL PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac OS X." | 10.0 |
2013-04-04 | CVE-2013-2762 | Schneider Electric | Cross-Site Request Forgery (CSRF) vulnerability in Schneider-Electric Magelis XBT HMI The Schneider Electric Magelis XBT HMI controller has a default password for authentication of configuration uploads, which makes it easier for remote attackers to bypass intended access restrictions via crafted configuration data. | 10.0 |
2013-04-03 | CVE-2013-0790 | Mozilla | Memory Corruption vulnerability in Mozilla Firefox/Thunderbird/Seamonkey Unspecified vulnerability in the browser engine in Mozilla Firefox before 20.0 on Android allows remote attackers to cause a denial of service (stack memory corruption and application crash) or possibly execute arbitrary code via unknown vectors involving a plug-in. | 10.0 |
2013-04-03 | CVE-2013-0789 | Mozilla | Memory Corruption vulnerability in Mozilla Firefox/Thunderbird/Seamonkey Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0 and SeaMonkey before 2.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the nsContentUtils::HoldJSObjects function and the nsAutoPtr class, and other vectors. | 10.0 |
2013-04-01 | CVE-2013-0659 | Siemens | Unspecified vulnerability in Siemens products The debugging feature on the Siemens CP 1604 and CP 1616 interface cards with firmware before 2.5.2 allows remote attackers to execute arbitrary code via a crafted packet to UDP port 17185. | 10.0 |
2013-04-04 | CVE-2012-4710 | Invensys | Improper Input Validation vulnerability in Invensys Wonderware Win-Xml Exporter 1522.148.0.0 Invensys Wonderware Win-XML Exporter 1522.148.0.0 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference. | 9.3 |
11 High Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2013-04-04 | CVE-2013-1900 | Postgresql Canonical | Numeric Errors vulnerability in multiple products PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions." Per http://www.ubuntu.com/usn/USN-1789-1/ "A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.10 Ubuntu 12.04 LTS Ubuntu 11.10 Ubuntu 10.04 LTS Ubuntu 8.04 LTS" | 8.5 |
2013-04-04 | CVE-2013-0664 | Schneider Electric | Unspecified vulnerability in Schneider-Electric Modicon M340, Modicon Premium and Modicon Quantum PLC The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests. | 8.5 |
2013-04-05 | CVE-2013-0682 | Cogentdatahub Microsoft | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Cogentdatahub products Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 do not properly handle exceptions, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed data in a formatted text command, leading to out-of-bounds access to (1) heap or (2) stack memory. | 7.5 |
2013-04-05 | CVE-2013-0680 | Cogentdatahub Microsoft | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Cogentdatahub products Stack-based buffer overflow in the web server in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long HTTP header. | 7.5 |
2013-04-03 | CVE-2012-6129 | Transmissionbt Canonical Fedoraproject | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets." Per http://www.ubuntu.com/usn/USN-1747-1/ "A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.10 Ubuntu 12.04 LTS Ubuntu 11.10" Per https://bugzilla.redhat.com/show_bug.cgi?id=909934 " This issue affects the version of the transmission package, as shipped with Fedora release of 16. | 7.5 |
2013-04-02 | CVE-2013-2743 | Ithemes Wordpress | Improper Authentication vulnerability in Ithemes Backupbuddy importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter. | 7.5 |
2013-04-02 | CVE-2013-2742 | Ithemes Wordpress | Information Disclosure vulnerability in BackupBuddy 'importbuddy.php' importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script. | 7.5 |
2013-04-02 | CVE-2013-2741 | Ithemes Wordpress | Improper Authentication vulnerability in Ithemes Backupbuddy importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request. | 7.5 |
2013-04-01 | CVE-2013-1163 | Cisco | SQL Injection vulnerability in Cisco Connected Grid Network Management System Multiple SQL injection vulnerabilities in the device-management implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug IDs CSCue14553 and CSCue38746. | 7.5 |
2013-04-01 | CVE-2013-2685 | Asterisk | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Asterisk Open Source Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in a SIP Session Description Protocol (SDP) header. | 7.5 |
2013-04-05 | CVE-2013-0683 | Cogentdatahub Microsoft | Configuration vulnerability in Cogentdatahub products The DataSim and DataPid demonstration clients in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allow remote servers to cause a denial of service (incorrect pointer access and client crash) via malformed data in a formatted text command. | 7.1 |
27 Medium Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2013-04-04 | CVE-2013-0663 | Schneider Electric | Cross-Site Request Forgery (CSRF) vulnerability in Schneider-Electric Modicon M340, Modicon Premium and Modicon Quantum PLC Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials. | 6.8 |
2013-04-03 | CVE-2013-1911 | Mark Burns Ruby Lang | Improper Input Validation vulnerability in Mark Burns Ldoce 0.0.2 lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name. | 6.8 |
2013-04-04 | CVE-2013-1899 | Postgresql Canonical | Code Injection vulnerability in multiple products Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen). | 6.5 |
2013-04-07 | CVE-2013-2770 | Novell | Improper Input Validation vulnerability in Novell Kanaka 2.7/2.7.1 The installation functionality in the Novell Kanaka component before 2.8 for Novell Open Enterprise Server (OES) on Mac OS X does not verify the server's X.509 certificate during an SSL session, which allows man-in-the-middle attackers to spoof servers via an arbitrary certificate. | 5.8 |
2013-04-03 | CVE-2013-0794 | Mozilla | Information Disclosure vulnerability in Mozilla Firefox/SeaMonkey Mozilla Firefox before 20.0 and SeaMonkey before 2.17 do not prevent origin spoofing of tab-modal dialogs, which allows remote attackers to conduct phishing attacks via a crafted web site. | 5.8 |
2013-04-05 | CVE-2013-0681 | Cogentdatahub Microsoft | Improper Input Validation vulnerability in Cogentdatahub products Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed data in a formatted text command. | 5.0 |
2013-04-05 | CVE-2013-1174 | Cisco | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Cisco Hosted Collaboration Solution Cisco Tivoli Business Service Manager (TBSM) in Hosted Collaboration Mediation (HCM) in Cisco Hosted Collaboration Solution allows remote attackers to cause a denial of service (temporary service hang) by sending many TCP packets to certain ports, aka Bug ID CSCue03703. | 5.0 |
2013-04-05 | CVE-2013-0483 | IBM | Cryptographic Issues vulnerability in IBM IMS Enterprise Suite 1.1/2.1/2.2 The login component in SOAP Gateway in IBM IMS Enterprise Suite 1.1, 2.1, and 2.2 uses cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network. | 5.0 |
2013-04-04 | CVE-2013-0128 | Tigertext | Credentials Management vulnerability in Tigertext 3.1 The Contact Customer Support feature in the TigerText Free Private Texting app before 3.1.402 for iOS sends a log-file e-mail message with unencrypted credentials, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to an e-mail endpoint. | 5.0 |
2013-04-03 | CVE-2013-1665 | Openstack | Information Exposure vulnerability in Openstack Folsom and Keystone Essex The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack. | 5.0 |
2013-04-03 | CVE-2013-1664 | Openstack | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Openstack products The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. | 5.0 |
2013-04-02 | CVE-2013-2744 | Ithemes Wordpress | Information Exposure vulnerability in Ithemes Backupbuddy 2.2.25 importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function. | 5.0 |
2013-04-01 | CVE-2013-2686 | Asterisk | Buffer Errors vulnerability in Asterisk Certified Asterisk, Digiumphones and Open Source main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request. | 5.0 |
2013-04-01 | CVE-2013-2264 | Asterisk | Information Exposure vulnerability in Asterisk products The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists, which allows remote attackers to enumerate account names by (1) reading HTTP status codes, (2) reading additional text in a 403 (aka Forbidden) response, or (3) observing whether certain retransmissions occur. | 5.0 |
2013-04-04 | CVE-2013-0125 | C2Enterprise | Cross-Site Scripting vulnerability in C2Enterprise C2 Webresource Cross-site scripting (XSS) vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter. | 4.3 |
2013-04-03 | CVE-2013-0798 | Mozilla | Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox Mozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the app_tmp installation directory in the local filesystem, which allows attackers to modify add-ons before installation via an application that leverages the time window during which app_tmp is used. | 4.3 |
2013-04-03 | CVE-2013-0792 | Mozilla | Information Exposure vulnerability in Mozilla Firefox and Seamonkey Mozilla Firefox before 20.0 and SeaMonkey before 2.17, when gfx.color_management.enablev4 is used, do not properly handle color profiles during PNG rendering, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a grayscale PNG image. | 4.3 |
2013-04-03 | CVE-2012-4546 | Redhat | Configuration vulnerability in Redhat Enterprise Linux 6.0 The default configuration for IPA servers in Red Hat Enterprise Linux 6, when revoking a certificate from an Identity Management replica, does not properly update another Identity Management replica, which causes inconsistent Certificate Revocation Lists (CRLs) to be used and might allow remote attackers to bypass intended access restrictions via a revoked certificate. | 4.3 |
2013-04-03 | CVE-2012-1038 | Juniper | Cross-Site Scripting vulnerability in Juniper Networks Mobility System Software Cross-site scripting (XSS) vulnerability in the WebAAA login functionality (wba_login.html) in Juniper Networks Mobility System Software (MSS) 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions before 7.4 and 7.3 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter name. | 4.3 |
2013-04-02 | CVE-2013-0240 | Gnome Canonical | Cryptographic Issues vulnerability in multiple products Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. | 4.3 |
2013-04-02 | CVE-2012-6550 | Zeroclipboard Project | Cross-Site Scripting vulnerability in Zeroclipboard Project Zeroclipboard 1.0.5/1.0.7 Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via "the clipText returned from the flash object," a different vulnerability than CVE-2013-1808. | 4.3 |
2013-04-01 | CVE-2013-1171 | Cisco | Cross-Site Scripting vulnerability in Cisco Connected Grid Network Management System Multiple cross-site scripting (XSS) vulnerabilities in the element-list implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCue14517, CSCue38914, CSCue38884, CSCue38882, CSCue38881, CSCue38872, CSCue38868, CSCue38866, CSCue38853, and CSCue14540. | 4.3 |
2013-04-01 | CVE-2013-0502 | IBM | Cross-Site Scripting vulnerability in IBM Infosphere Information Server Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server 8.1, 8.5 through FP3, 8.7 through FP2, and 9.1 allows remote attackers to inject arbitrary web script or HTML via a malformed URL. | 4.3 |
2013-04-05 | CVE-2013-0470 | IBM | Configuration vulnerability in IBM Netezza Performance Portal 1.0.2 HTTPD in IBM Netezza Performance Portal 1.0.2 allows remote authenticated users to list application directories containing asset files via a direct request to a directory URI, as demonstrated by listing image files. | 4.0 |
2013-04-04 | CVE-2013-1901 | Postgresql Canonical | Permissions, Privileges, and Access Controls vulnerability in multiple products PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions. | 4.0 |
2013-04-04 | CVE-2013-2761 | Schneider Electric | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Schneider-Electric Modicon M340 Bmxnoe01Xx/Bmxp3420Xx The Schneider Electric M340 BMXNOE01xx and BMXP3420xx PLC modules allow remote authenticated users to cause a denial of service (module crash) via crafted FTP traffic, as demonstrated by the FileZilla FTP client. | 4.0 |
2013-04-01 | CVE-2012-4861 | IBM | Permissions, Privileges, and Access Controls vulnerability in IBM Infosphere Replication Server The web server in InfoSphere Data Replication Dashboard in IBM InfoSphere Replication Server 9.7 and 10.1 through 10.1.0.4 allows remote authenticated users to list directories via a direct request for a directory URL. | 4.0 |
3 Low Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2013-04-07 | CVE-2012-0706 | IBM | Permissions, Privileges, and Access Controls vulnerability in IBM Scale OUT Network Attached Storage 1.3 IBM Scale Out Network Attached Storage (SONAS) 1.3 before 1.3.2.3 requires cleartext storage of LDAP credentials without recommending a less privileged LDAP account, which might allow attackers to obtain sensitive server information by leveraging root access to a client machine. | 3.5 |
2013-04-02 | CVE-2012-6119 | Candlepinproject Redhat | Permissions, Privileges, and Access Controls vulnerability in multiple products Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests. | 2.1 |
2013-04-04 | CVE-2013-2302 | Transware | Information Exposure vulnerability in Transware Active! Mail 6.0 TransWARE Active! mail 6, when an external public interface is used, allows local users to obtain sensitive information belonging to arbitrary users by leveraging shell access, as demonstrated by a TELNET or SSH session to the server. | 1.9 |