[SECURITY] [DSA 3149-1] condor security update

Debian Security Advisory DSA-3149-1                   security@debian.org
http://www.debian.org/security/                        Sebastien Delafond
February 02, 2015                      http://www.debian.org/security/faq
- ------------------------------------------------------------
-------------

Package        : condor
CVE ID         : CVE-2014-8126
Debian Bug     : 775276

Florian Weimer, of Red Hat Product Security, discovered an issue in
condor, a distributed workload management system. Upon job completion,
it can optionally notify a user by sending an email; the mailx
invocation used in that process allowed for any authenticated user
able to submit jobs, to execute arbitrary code with the privileges of
the condor user.

For the stable distribution (wheezy), this problem has been fixed in
version 7.8.2~dfsg.1-1+deb7u3.

For the upcoming stable distribution (jessie) and unstable
distribution (sid), this problem has been fixed in version
8.2.3~dfsg.1-6.

We recommend that you upgrade your condor packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

CVE-2014-8779: SSH Host keys on Pexip Infinity

Summary
=======

The operating system used by Pexip Infinity does not create unique SSH
host keys on deployment of new Management and Conferencing Nodes, using
fixed host keys instead. Host keys are used to verify the identity of
the remote host when connecting to it over SSH. These keys are contained
in the publicly available software image.

An attacker with privileged network access may make use of these keys to
spoof the identity of a Pexip Infinity installation or conduct
man-in-the-middle attacks on administrative SSH sessions. This may
permit the attacker access to credentials used to authenticate sessions
over SSH and provide shell access to the affected systems.

This issue is resolved in Pexip Infinity version 8.

References
=========
CVE-2014-8779
http://pexip.com/security-bulletins

Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385

Information
------------
Advisory by Netsparker
Name: XSS Vulnerability in Blubrry PowerPress
Affected Software : Blubrry PowerPress
Affected Versions: 6.0 and possibly below
Vendor Homepage : https://wordpress.org/plugins/powerpress/
Vulnerability Type : Cross-site Scripting
Severity : Important
CVE-ID: CVE-2015-1385
Netsparker Advisory Reference : NS-15-001

Description
-----------
By exploiting a Cross-site scripting vulnerability the attacker can
hijack a logged in user?s session. This means that the malicious
hacker can change the logged in user?s password and invalidate the
session of the victim while the hacker maintains access. As seen from
the XSS example in this article, if a web application is vulnerable to
cross-site scripting and the administrator?s session is hijacked, the
malicious hacker exploiting the vulnerability will have full admin
privileges on that web application.

Netsparker finds and reports security issues and vulnerabilities such
as SQL Injection and Cross-site Scripting (XSS) in all websites and
web applications regardless of the platform and the technology they
are built on. Netsparker's unique detection and exploitation
techniques allows it to be dead accurate in reporting hence it's the
first and the only False Positive Free web application security
scanner.
--------------------

Proof of Concept URLs for XSS in Blubrry PowerPress WordPress plugin:

/wp-admin/admin.php?page=powerpress/powerpressadmin_
categoryfeeds.php&action=powerpress-editcategoryfeed&cat=1';"--></style></scRipt><scRipt>alert(0x014068)</scRipt>

For more information on cross-site scripting vulnerabilities read the
following article on Cross-site Scripting (XSS) -
https://www.netsparker.com/web-vulnerability-scanner/vulnerability-security-checks-index/crosssite-scripting-xss/

Advisory Timeline
--------------------
22/01/2015 - First Contact
26/01/2015 - Vulnerability fixed
29/01/2015 - Advisory released

Solution
--------------------
Download version 6.0.1 which includes fix for this vulnerability.

Credits & Authors
--------------------
These issues have been discovered by Omar Kurt while testing
Netsparker Web Application Security Scanner -
https://www.netsparker.com/web-vulnerability-scanner/

About Netsparker
--------------------
Netsparker finds and reports security issues and vulnerabilities such
as SQL Injection and Cross-site Scripting (XSS) in all websites and
web applications regardless of the platform and the technology they
are built on. Netsparker's unique detection and exploitation
techniques allows it to be dead accurate in reporting hence it's the
first and the only False Positive Free web application security
scanner. For more information visit our website on
https://www.netsparker.com