Joomla! Security News
- [20131101] Core XSS Vulnerability
- [20131102] Core XSS Vulnerability
- [20131103] Core XSS Vulnerability
[20131101] Core XSS Vulnerability in Joomla
Posted: 06 Nov 2013 10:47 AM PST
- Project: Joomla!
- SubProject: All
- Severity: High
- Versions: 2.5.14 and earlier 2.5.x versions. 3.1.5 and earlier 3.x versions.
- Exploit type: XSS Vulnerability
- Reported Date: 2013-October-25
- Fixed Date: 2013-November-06
- CVE Number:
Description
Inadequate filtering leads to XSS vulnerability in com_contact.
Affected Installs
Joomla! version 2.5.14 and earlier 2.5.x versions; and version 3.1.5 and earlier 3.0.x versions.
Solution
Upgrade to version 2.5.15, 3.1.6 or 3.2.
Contact
The JSST at the Joomla! Security Center.
Reported By: Osanda Malith
[20131102] Core XSS Vulnerability in Joomla
Posted: 06 Nov 2013 10:47 AM PST
- Project: Joomla!
- SubProject: All
- Severity: Moderate
- Versions: 2.5.14 and earlier 2.5.x versions. 3.1.5 and earlier 3.x versions.
- Exploit type: XSS Vulnerability
- Reported Date: 2013-October-06
- Fixed Date: 2013-November-06
- CVE Number:
Description
Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.
Affected Installs
Joomla! version 2.5.14 and earlier 2.5.x versions; and version 3.1.5 and earlier 3.0.x versions.
Solution
Upgrade to version 2.5.15, 3.1.6 or 3.2.
Contact
The JSST at the Joomla! Security Center.
Reported By: Osanda Malith
[20131103] Core XSS Vulnerability in Joomla
Posted: 06 Nov 2013 10:47 AM PST
- Project: Joomla!
- SubProject: All
- Severity: Moderate
- Versions: 2.5.14 and earlier 2.5.x versions. 3.1.5 and earlier 3.x versions.
- Exploit type: XSS Vulnerability
- Reported Date: 2013-October-26
- Fixed Date: 2013-November-06
- CVE Number:
Description
Inadequate filtering leads to XSS vulnerability in com_contact.
Affected Installs
Joomla! version 2.5.14 and earlier 2.5.x versions; and version 3.1.5 and earlier 3.0.x versions.
Solution
Upgrade to version 2.5.15, 3.1.6 or 3.2.
Contact
The JSST at the Joomla! Security Center.
Reported By: Osanda Malith
Microsoft Security Bulletin: Cumulative Security Update for Internet Explorer (2862772)
This Microsoft security update resolves eleven privately reported vulnerabilities in Internet Explorer.
The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Maximum Severity Rating and Vulnerability Impact: Critical – Remote Code Execution
Restart Requirement: Requires restart
Affected Software: Microsoft Windows, Internet Explorer
Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution
This security update resolves a privately reported vulnerability in the Unicode Scripts Processor included in Microsoft Windows.
The vulnerability could allow remote code execution if a user viewed a specially crafted document or webpage with an application that supports embedded OpenType fonts.
An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Maximum Severity Rating and Vulnerability Impact: Critical – Remote Code Execution
Restart Requirement: May require restart
Affected Software: Microsoft Windows
Serious Security Warning – Windows XP
Did you know that Microsoft is stopping all support for Windows XP?
This could be a huge threat for your business, as systems running Windows XP will be out of support, so no more updates and patches will be available for your computers.
Say goodbye to security and say hello to vulnerability!
You are entitled to receive security updates until April 9 2014, after this date you will be left with an operating system that is completely obsolete from a security perspective, thus exposing your business to cyber-attacks, data theft, malware, phishing and fraudulent activities perpetrated by external attackers using your own systems.
What’s on the mind of the cybercriminal?
Did you know that cyber-criminals are purposely delaying new attacks on Windows XP? This way they can be more effective in attacking your computers once Microsoft shuts down support, so your systems will be left permanently insecure and open to exploitation. In fact you won’t even notice you have been hacked, until your network goes down, your data is leaked and you receive a call from a customer, partner or supplier inquiring as to the source of confidential information. Your competition will probably hear your name too.
Why should you care?
Unfortunately, you may be held accountable for any consequences, in addition to financial losses and a blow to your reputation as a business. Considering Microsoft operating systems (windows xp) are used by most businesses worldwide, ignoring a fundamental warning about this system becoming totally insecure in the near future cannot do much good.
Think of it as if you were doing 50,000 miles per year with your old car, running on bald tyres in mid-winter, on a road full of potholes. Would you ignore warnings from the DVLA, the car and tyre manufacturer? Your insurance would probably fail you as well. Why risk it?
Act now – you are already late!
You should consider upgrading to Windows 7 or even Windows 8 today, save time and money and most importantly, prevent your computers from being hacked into and your data leaked. If you have not yet done so, you are late, according to Microsoft: http://windows.microsoft.com/en-GB/windows/products/lifecycle
Restrict access to Java applets on your Business Network
Network administrators unable to disable Java in web browsers may be able to help mitigate this and other Java vulnerabilities by restricting access to Java applets. This may be accomplished by using proxy server rules, for example. Blocking or whitelisting web requests to .jar and .class files can help to prevent Java from being used by untrusted sources.
Filtering requests that contain a Java User-Agent header may also be effective. For example, this technique can be used in environments where Java is required on the local intranet.
The proxy can be configured to allow Java requests locally, but block them when the destination is a site on the internet.
How to Disable the Java content in a particular browser
Internet Explorer
The only way to completely disable Java in Internet Explorer (IE) is to disable Java through the Java Control Panel or uninstall Java
Firefox
- Click on the Firefox tab and then select Add-ons
- In the Add-ons Manager window, select Plugins
- Click Java (TM) Platform plugin to select it
- Click Disable (if the button displays Enable then Java is already disabled)
Chrome
- Click on the Chrome menu, and then select Settings.
- At the bottom of Settings window, click Show advanced settings
- Scroll down to the Privacy section and click on Content Settings.
- In the Content Settings panel, scroll down to the Plug-ins section.
- Under the Plug-ins section, click Disable individual plug-ins.
- In the Plugins panel, scroll to the Java section. Click Disable to disable the Java Plug-in.
- Close and restart the browser to enable the changes.
Note: Alternatively, you can access the Plug-ins settings by typing about:plugins in the browser address bar.
Safari
- Choose Safari Preferences
- Choose the Security option
- Deselect Enable Java
- Close Safari Preferences window
