----------------------------------------------------------------------

Do you need accurate and reliable IDS / IPS / AV detection rules?

Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/

----------------------------------------------------------------------

TITLE:
Vignette VCM Unspecified Security Bypass Vulnerability

SECUNIA ADVISORY ID:
SA31983

VERIFY ADVISORY:
http://secunia.com/advisories/31983/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
>From remote

SOFTWARE:
Vignette V7
http://secunia.com/advisories/product/1630/

DESCRIPTION:
A vulnerability has been reported in Vignette, which can be exploited
by malicious users to bypass certain security restrictions.

The vulnerability is caused due to an unspecified error in Vignette
Content Management (VCM), which can be exploited to gain
administrative access and e.g. create, approve, and publish content
or change application configurations.

The vulnerability affects Vignette Content Management versions
7.3.0.5, 7.3.1, 7.3.1.1, 7.4, and 7.5.

SOLUTION:
VCM 7.3.1 through 7.5:
The vendor has released an update that reportedly fixes the
vulnerability (KB 9872).
http://support.vignette.com/VOLSS/KB/View/1,,9872.html (requires
login)

VCM 7.3.0.5:
The vendor is currently working on a fix.

PROVIDED AND/OR DISCOVERED BY:
National Australia Bank's Security Assurance Team

ORIGINAL ADVISORY:
Vignette:
http://dialog.vignette.com/hm?g=1.2jds7.bky8.rs.0.27gqh.htk8&h=1

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------