[guru] IBM biztonsagi frissitesek
DATE: Tue, 09 Mar 2010 00:56:25 +0100
AIX termékcsalád:
-----------------
Stack buffer overflow hibát találtak a Calendar Manager Service Daemon-ban
(rpm.cmsd).
Informix termékcsalád:
----------------------
Az Informix librpc.dll több stack és heap buffer overflow hibát is tartalmaz,
ezt az ISM Portmapper szervíz (portmap.exe) is használja. A távoli támadó
SYSTEM jogokkal kódot futtathat a rendszeren.
Egyéb:
------
Az IBM Cognos Server tomcat szervének konfigurációja egy beépített, manager
jogú felhasználót is tartalmaz default jelszóval.
Az IBM Websphere Portal Server és Lotus Web Content Management rendszerei
XSS hibát tartalmaznak a login lapon.
Az IBM Lotus Domino "Domino Web Access" ActiveX vezérlője stack buffer
overflow hibát tartalmaz túl hosszú URL-ek feldolgozásakor.
--- Begin Message ---
Hey guys,
Just now I saw that iDefense did not include in their advisory the
triggering code for this
(http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825).
I believe it's very important to test your
systems and verify the released patch.
So here we go:
http://www.kernelhacking.com/rodrigo/exploits/cmsd_exploit.c
Regards,
Rodrigo (BSDaemon).
--
Rodrigo Rubira Branco (BSDaemon)
"Kernel Hacking: If you really know, you can hack!"
--- End Message ---
--- Begin Message ---
ZDI-10-018: IBM Cognos Server Backdoor Account Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-018
February 18, 2010
-- Affected Vendors:
IBM
-- Affected Products:
IBM Cognos
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 9494.
For further product information on the TippingPoint IPS, visit:
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows remote attackers to execute remote code on
vulnerable installations of IBM Cognos Server. Proper authentication is
not required to exploit this vulnerability.
The specific flaw exists due to a hidden manager-level account with a
default password defined in the user configuration of the bundled Tomcat
server. This server can be reached via HTTP on TCP port 19300. A
malicious attacker can use this account to manage or deploy a servlet
onto the server. By abusing this ability a remote attacker can execute
arbitrary code under the context of the user running the Tomcat server.
-- Vendor Response:
IBM has issued an update to correct this vulnerability. More
details can be found at:
http://www-01.ibm.com/support/docview.wss?uid=swg21419065
-- Disclosure Timeline:
2010-01-15 - Vulnerability reported to vendor
2010-02-18 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* AbdulAziz Hariri of Insight Technologies
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
--- End Message ---
--- Begin Message ---
Hacktics Research Group Security Advisory
http://www.hacktics.com/#view=Resources%7CAdvisory
By Oren Hafif, Hacktics.
24-Feb-2010
===========
I. Overview
===========
During a penetration test performed by Hacktics' experts, certain
vulnerabilities were identified in an IBM Websphere Portal Server and Lotus
Web Content Management deployment. Further research has identified that the
login page of the IBM Lotus Workplace Web Content Management is vulnerable
to Reflected Cross Site Scripting attacks.
A friendly formatted version of this advisory is available in:
http://www.hacktics.com/content/advisories/AdvIBM20100224.html
===============
II. The Finding
===============
An attacker can inject script into a URL pointing at the vulnerable page,
and attack system users by sending it to them. Users, who follow the link,
will be attacked with the injected script.
============
III. Details
============
The login page takes the query string from the request URL and embeds it
into the HTML response as the value of a form field named success. The
attack is done by escaping the field (">), followed by the relevant script,
as seen in the following URL:
http://[host]:[port]/wps/wcm/webinterface/login/login.jsp?";><script>maliciou
s_script</script><b%20"
Note: The content of this parameter is used as part of a page redirection
performed after the login. Even without XSS exploitation, this can be used
for invalidated redirection.
===========
IV. Exploit
===========
The exploit is performed by replacing malicious_script with the relevant
javascript payload. An evasion for simple XSS signature protection (where
applicable), can allow executing the same script without using HTML tags, as
seen in the following sample:
http://[host]:[port]/wps/wcm/webinterface/login/login.jsp?";
style="tr:expression(malicious_script)
=============================
V. Vendor's Response/Solution
=============================
IBM has released a patch for this vulnerability, as well as a proposed
workaround. For additional details please refer to:
http://www-01.ibm.com/support/docview.wss?uid=swg21421469
====================
VI. Affected Systems
====================
WebSphere Portal, Lotus Web Content Management and Workspace Web Content
Management versions:
6.1.0.0, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.1.5.0
6.0.1.0, 6.1.0.2, 6.1.0.3, 6.1.0.4, 6.1.0.5, 6.1.0.6, 6.1.0.7
6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.0.0.4
5.1.0.0, 5.1.0.1, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.5
Lotus Quickr services for WebSphere Portal versions:
8.0, 8.0.0.2, 8.1, 8.1.1, 8.1.1.1
===========
VII. Credit
===========
The vulnerability was discovered by Oren Hafif of Hacktics Ltd.
---
Ofer Maor
CTO, Hacktics
Chairman, OWASP Israel
Web: www.hacktics.com
--- End Message ---
--- Begin Message ---
ZDI-10-022: IBM Informix librpc.dll Multiple Remote Code Execution Vulnerabilities
http://www.zerodayinitiative.com/advisories/ZDI-10-022
March 1, 2010
-- CVE ID:
CVE-2009-2753
-- Affected Vendors:
IBM
-- Affected Products:
IBM Informix
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 5937.
For further product information on the TippingPoint IPS, visit:
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of both IBM Informix Dynamic Server and EMC
Legato Networker. User interaction is not required to exploit this
vulnerability.
The specific flaws exist within the RPC protocol parsing library,
librpc.dll, utilized by the ISM Portmapper service (portmap.exe) bound
by default to TCP port 36890. During authentication, a lack of proper
sanity checking on supplied parameter sizes can result in exploitable
stack and heap based buffer overflows leading to arbitrary code
execution under the context of the SYSTEM user.
-- Vendor Response:
IBM states that this issue was first fixed in: IDS 10.00.TC9, IDS
11.10.TC3 Recommended fix pack version: IDS 10.00.TC10, IDS 11.10.TC3 4.
URL to APAR or fixpack Fix pack download URL:
http://www-933.ibm.com/support/fixcentral/
APAR URLs
http://www.ibm.com/support/docview.wss?uid=swg1IC55329
http://www.ibm.com/support/docview.wss?uid=swg1IC55330
-- Disclosure Timeline:
2008-02-07 - Vulnerability reported to vendor
2010-03-01 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Sebastian Apelt (sebastian.apelt@siberas.de)
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
--- End Message ---
--- Begin Message ---
iDefense Security Advisory 03.02.10
http://labs.idefense.com/intelligence/vulnerabilities/
Mar 02, 2010
I. BACKGROUND
IBM Lotus Domino includes an ActiveX control called Domino Web Access,
which provides Web-based access for Lotus Notes users. The control
features functionality that is used for uploading files and clearing
the cache upon logout. For more information, see the vendor's site
found at the following link.
http://www-01.ibm.com/software/lotus/products/inotes/
II. DESCRIPTION
Remote exploitation of a stack-based buffer overflow vulnerability in
IBM Corp.'s Lotus Domino Web Access ActiveX control could allow an
attacker to execute arbitrary code with the privileges of the current
user.
The vulnerabe function takes an attacker-controlled URL, and copies it
into a fixed-size stack buffer. No validation checks are performed on
the length of the URL. By passing in a long URL string, it is possible
to trigger a stack-based buffer overflow, resulting in the execution of
arbitrary code.
III. ANALYSIS
Exploitation of this vulnerability results in the execution of arbitrary
code with the privileges of the user viewing the Web page. To exploit
this vulnerability, a targeted user must load a malicious Web page
created by an attacker. An attacker typically accomplishes this via
social engineering or injecting content into compromised, trusted
sites. After the user visits the malicious Web page, no further user
interaction is needed.
The vulnerability is a stack-based buffer overflow, and there are no
compiler/runtime protections such as stack cookies or safe exception
handling in the module. As such, reliable exploitation is trivial.
IV. DETECTION
iDefense has confirmed the existence of this vulnerability in Lotus
Domino Web Access version 8.0.2. Previous versions may also be
affected. The libraries that contain the vulnerable code are dwa8.dll
and dwa8w.dll. IBM states that Lotus Domino Web Access versions 6.5,
7.0 and 8.0 are affected.
V. WORKAROUND
The vulnerable ActiveX controls can be disabled in Internet Explorer by
setting the kill bit for the following CLSIDs:
{3BFFE033-BF43-11d5-A271-00A024A51325}
{983A9C21-8207-4B58-BBB8-0EBC3D7C5505}
{E008A543-CEFB-4559-912F-C27C2B89F13B}
VI. VENDOR RESPONSE
IBM has released a solution which addresses this issue. Information
about downloadable vendor updates can be found by clicking on the URLs
shown.
http://www-01.ibm.com/support/docview.wss?rs=463&uid=swg21421808
VII. CVE INFORMATION
A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.
VIII. DISCLOSURE TIMELINE
09/18/2008 Initial Vendor Notification
09/24/2008 Initial Vendor Reply
03/02/2010 Coordinated Public Disclosure
IX. CREDIT
This vulnerability was reported to iDefense by Elazar Broad.
Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events
http://labs.idefense.com/
X. LEGAL NOTICES
Copyright © 2010 iDefense, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
--- End Message ---