4 X Security Team

The next batch of security patches from Oracle will be a biggie: 73 new security vulnerability fixes across hundreds of Oracle products.

According to an advance notice from the database server giant, some of the vulnerabilities affect multiple products and may be exploited over a network without the need for a username and password.

The patches, scheduled for release next Tuesday (April 19, 2011), will affect the following products and components:

Security vulnerabilities addressed by this Critical Patch Update affect the following products:

• Oracle Database 11g Release 2, versions 11.2.0.1, 11.2.0.2
• Oracle Database 11g Release 1, version 11.1.0.7
• Oracle Database 10g Release 2, versions 10.2.0.3, 10.2.0.4, 10.2.0.5
• Oracle Database 10g Release 1, version 10.1.0.5
• Oracle Fusion Middleware 11g Release 1, versions 11.1.1.2.0, 11.1.1.3.0, 11.1.1.4.0
• Oracle Application Server 10g Release 3, version 10.1.3.5.0
• Oracle Application Server 10g Release 2, version 10.1.2.3.0
• Oracle Identity Management 10g, versions 10.1.4.0.1, 10.1.4.3
• Oracle JRockit, versions R27.6.8 and earlier (JDK/JRE 1.4.2, 5, 6), R28.1.1 and earlier (JDK/JRE 5, 6)
• Oracle Outside In Technology, versions 8.3.2.0, 8.3.5.0
• Oracle WebLogic Server, versions 8.1.6, 9.2.3, 9.2.4, 10.0.2, 11gR1 (10.3.2, 10.3.3, 10.3.4)
• Oracle E-Business Suite Release 12, versions 12.0.6, 12.1.1, 12.1.2, 12.1.3
• Oracle E-Business Suite Release 11i, version 11.5.10.2
• Oracle Agile Technology Platform, versions 9.3.0.2, 9.3.1
• Oracle PeopleSoft Enterprise CRM, version 8.9
• Oracle PeopleSoft Enterprise ELS, versions 9.0, 9.1
• Oracle PeopleSoft Enterprise HRMS, versions 9.0, 9.1
• Oracle PeopleSoft Enterprise Portal, versions 8.8, 8.9, 9.0, 9.1
• Oracle PeopleSoft Enterprise People Tools, versions 8.49, 8.50, 8.51
• Oracle JD Edwards OneWorld Tools, version 24.1.x
• Oracle JD Edwards EnterpriseOne Tools, version 8.98.x
• Oracle Siebel CRM Core, versions 7.8.2, 8.0.0, 8.1.1
• Oracle InForm, versions 4.5, 4.6, 5.0
• Oracle Sun Product Suite
• Oracle Open Office, version 3 and StarOffice/StarSuite, versions 7, 8

The highest CVSS 2.0 Base Score for vulnerabilities in this Critical Patch Update is 10.0 for Oracle JRockit of Oracle Fusion Middleware and Sun GlassFish Enterprise Server, Sun Java System Application Server of Oracle Sun Products Suite, the company said.

“Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible.

[Source: zdnet]

Two weeks after the OpenOffice.org team shipped patches for code execution flaws in office suite, Sun Micrososystems has followed up with a high-priority update for StarOffice, which is based on the open-source code.

Sun’s patch, available for Windows, Linux and Solaris, address highly-critical vulnerabilities that could expose users to arbitrary code execution attacks via specially crafted image files.

[ SEE: Code execution flaws haunt OpenOffice ]

As previously reported, the vulnerabilities could be exploited via manipulated WMF and EMF files in StarOffice or StarSuite documents.

OpenOffice.org described the bugs as file-handling heap overflows. Patches are available in OpenOffice 2.4.2.

[Source: zdnet]

Mozilla has released a new version of its flagship Firefox browser to fix a total of 11 vulnerabilities that expose users to code execution, information stealing or denial-of-service attacks.

Four of the 11 flaws covered with the new Firefox 3.0.4 are rated “critical” because of the risk of code execution attacks via specially rigged Web pages.

The four critical vulnerabilities are:

• MFSA 2008-55 Crash and remote code execution in nsFrameManager. A vulnerability in part of Mozilla’s DOM constructing code can be exploited by modifying certain properties of a file input element before it has finished initializing. When the blur method of the modified input element is called, uninitialized memory is accessed by the browser, resulting in a crash. This crash may be used by an attacker to run arbitrary code on a victim’s computer.
• MFSA 2008-54 Buffer overflow in http-index-format parser. This is a flaw in the way Mozilla parses the http-index-format MIME type. By sending a specially crafted 200 header line in the HTTP index response, an attacker can cause the browser to crash and run arbitrary code on the victim’s computer.
• MFSA 2008-53 XSS and JavaScript privilege escalation via session restore. The browser’s session restore feature can be used to violate the same-origin policy and run JavaScript in the context of another site. Any otherwise unexploitable crash can be used to force the user into the session restore state. This vulnerability could also be used by an attacker to run arbitrary JavaScript with chrome privileges.
• MFSA 2008-52 Crashes with evidence of memory corruption. Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

The Firefox update also fixes the following issues:

• MFSA 2008-58 Parsing error in E4X default namespace
• MFSA 2008-57 -moz-binding property bypasses security checks on codebase principals
• MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation
• MFSA 2008-51 file: URIs inherit chrome privileges when opened from chrome
• MFSA 2008-47 Information stealing via local shortcut files

[Source: zdnet]

A remote buffer overflow vulnerability in the Linux Kernel could be exploited by attackers to execute code or cripple affected systems, according to a Gentoo bug report that just became public.

The flaw could allow malicious hackers to launch arbitrary code with kernel-level privileges. This could lead to complete system compromise or, in some cases if an exploit fails, result in denial-of-service attacks.

This from the Gentoo bug report:

• Anders Kaseorg discovered that ndiswrapper did not correctly handle long ESSIDs. If ndiswrapper is in use, a physically near-by attacker could generate specially crafted wireless network traffic and crash the system, leading to a denial of service.

Secunia rates this a “moderately critical” vulnerability:

• The vulnerability is caused due to a boundary error in the ndiswrapper kernel driver when processing wireless network packets. This can be exploited to cause a buffer overflow via an overly long ESSID (Extended Service Set Identifier). Successful exploitation may allow execution of arbitrary code.

The vulnerability (CVE-2008-4395) affects Linux Kernel 2.6.27. As a temporary mitigation, Linux users should disable wireless network card that are not in use.

[Source: zdnet]

Ever since Rob McMillan of IDG published a story giving a preview of our coming Black Hat talk, specifically a preview of the portion of our talk related to GIFARs, media coverage of the research has swirled a bit out of control and there’s been some misconceptions. My co-presenter John Heasman has a write-up on GIFARs that explains this all just a bit more.

We of course want to avoid giving all of the details until Black Hat, where it will be much easier to demonstrate with an example, but this should clear up some of the misconceptions. If you happened to see PDP of Gnucitizen give his talk at Black Hat Amsterdam last year, this combination of images with applets stuff might not be brand new to you. We were unaware of PDP’s research at the time of our discovery, but that was fortunate, for it allowed us to take a different path, using HTTP requests to piggy-back the browser’s cookies. To clarify, PDP’s research and ours is similar only in the fact that we both use applets within images to accomplish our goal of attack. Heasman explains the usefulness of this on his blog, so I won’t rehash it here.

We’re excited to present on this topic, but we are even more excited for what we hope to present at Black Hat Japan, which extends this attack even further, making it more dangerous.

Keep in mind that we consider this an application level issue, as in, the web applications are those most at fault for this issue; however, it is a blended threat issue, since it uses a few weaknesses in the JVM as its exploit vector. If you have read any article that makes it sound like Facebook is vulnerable to this, or eBay, or Google, or any other site out there, please keep in mind that most of the applications out there that accept user uploaded content are vulnerable to this. This is not a flaw that only affects a few sites.

A couple more clarifying points:

• We load the applet, which is also an image from an tag, we will discuss how during the talk.
• The image itself is not causing execution, so theories on how it loads through the tag are not warranted. If we load it through the tag, it will most likely display as an image, or not display at all.
• This is NOT a browser or OS level issue. This attack will work on all operating systems and browsers that support JVM for any application that will accept our content in a way that leaves the applet intact.
• Shrinking, converting, resizing, etc. will NOT necessarily fix this issue as is being suggested on Slashdot. We have been able to attack sites that do resizing, shrinking, or converting as well.
• The way to fix this is to either:
  • Sanitize the incoming content to make sure it is not a combined file (this is extremely hard to do properly).
  • Host the images on a different domain (and I do not mean a different sub-domain). For example, if the image is hosted from images.mysite.com, we can still attack www.mysite.com; however, if the image is hosted from images4mysite.com, we cannot attack www.mysite.com unless we find a different upload vector that places us on the mysite.com domain.
• Even after Sun puts out a patch, it will be a temporary fix, as many sites will still accept user uploaded content and host it from their same domain. New vectors of exploitation will arise, as they already have in the past (see crossdomain.xml policy file uploading from Rios and my talk at DEFCON last year).
• This is not brand new, the idea of combining files together is super old, used and discussed way back in many forensics books. What is new is how we are using this attack vector.

[Source: zdnet]