SecurityFocus Newsletter #236
John Boletta <[email protected]> Tue, 17 Feb 2004 09:54:59 -0700 (MST)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #236
------------------------------
This Issue is Sponsored by: Spidynamics
ALERT: Attacking SOAP Web Services and Methods of Protection White Paper.
Are you vulnerable? This white paper will cover various types of attacks
based on the SOAP implementation of Web services over HTTP and describes
how you can shield your applications from these assaults. Learn how to
defend against Web services attacks with real step-by-step examples of
hacking methods such as: SQL Injection, Cross Site Scripting and Parameter
Manipulation.
http://www.securityfocus.com/sponsor/SPIDynamics_sf-news_040216
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Wireless Honeypot Trickery
2. Automating Windows Patch Mngt: Part I
II. BUGTRAQ SUMMARY
1. Multiple Oracle Database Parameter/Statement Buffer Overflow...
2. Mambo Open Source Itemid Parameter Cross-Site Scripting Vuln...
3. Cactusoft CactuShop Lite Remote Arbitrary File Deletion Back...
4. Apache-SSL Client Certificate Forging Vulnerability
5. Joe Lumbroso Jack's Formmail.php Unauthorized Remote File Up...
6. Linux VServer Project CHRoot Breakout Vulnerability
7. OpenJournal Authentication Bypassing Vulnerability
8. Apache mod_php Global Variables Information Disclosure Weakn...
9. BolinTech Dream FTP Server User Name Format String Vulnerabi...
10. Brad Fears PHPCodeCabinet comments.php HTML Injection Vulner...
11. The Palace Graphical Chat Client Remote Buffer Overflow Vuln...
12. Multiple Nokia Object Exchange Protocol Message Remote Denia...
13. Nadeo Game Engine Remote Denial of Service Vulnerability
14. PHP-Nuke 'News' Module Cross-Site Scripting Vulnerability
15. Eggdrop Share Module Arbitrary Share Bot Add Vulnerability
16. Sambar Server Results.STM Post Request Buffer Overflow Vulne...
17. Shaun2k2 Palmhttpd Server Remote Denial of Service Vulnerabi...
18. JShop E-Commerce Suite xSearch Cross-Site Scripting Vulnerab...
19. ClamAV Daemon Malformed UUEncoded Message Denial Of Service ...
20. Microsoft Internet Explorer LoadPicture File Enumeration Wea...
21. PHP-Nuke 'Reviews' Module Cross-Site Scripting Vulnerability
22. Caucho Technology Resin Source Code Disclosure Vulnerability
23. PHP-Nuke Public Message SQL Injection Vulnerability
24. Computer Associates eTrust InoculateIT For Linux Vulnerabili...
25. Caucho Technology Resin Directory Listings Disclosure Vulner...
26. Multiple Red-M Red-Alert Remote Vulnerabilities
27. Linux Kernel Samba Share Local Privilege Elevation Vulnerabi...
28. GNU Mailman Malformed Message Remote Denial Of Service Vulne...
29. Microsoft Windows XP HCP URI Handler Arbitrary Command Execu...
30. Microsoft Windows Internet Naming Service Buffer Overflow Vu...
31. MaxWebPortal Multiple Input Validation Vulnerabilities
32. XLight FTP Server Remote Denial Of Service Vulnerability
33. Microsoft Internet Explorer Shell: IFrame Cross-Zone Scripti...
34. Microsoft Internet Explorer Double-Null URI Denial Of Servic...
35. PHPNuke Category Parameter SQL Injection Vulnerability
36. EvolutionX Multiple Remote Buffer Overflow Vulnerabilities
37. Microsoft Virtual PC For Mac Temporary File Privilege Escala...
38. Microsoft ASN.1 Library Length Integer Mishandling Memory Co...
39. Microsoft Baseline Security Analyzer Vulnerability Identific...
40. Microsoft Windows ASN.1 Library Bit String Processing Intege...
41. XFree86 Font Information File Buffer Overflow Vulnerability
42. Samba Mksmbpasswd.sh Insecure User Account Creation Vulnerab...
43. VisualShapers ezContents Multiple Module File Include Vulner...
44. BosDev BosDates SQL Injection Vulnerability
45. Opera Web Browser CLSID File Extension Misrepresentation Vul...
46. Mutt Menu Drawing Remote Buffer Overflow Vulnerability
47. Monkey HTTP Daemon Missing Host Field Denial Of Service Vuln...
48. Microsoft Internet Explorer Unauthorized Clipboard Contents ...
49. Ratbag Game Engine Denial of Service Vulnerability
50. PHPCodeCabinet Multiple Cross-Site Scripting Vulnerabilities
51. Macallan Mail Solution Web Interface Authentication Bypass V...
52. SandSurfer Unspecified User Authentication Vulnerability
53. Sophos Anti-Virus MIME Header Handling Denial Of Service Vul...
54. JelSoft VBulletin Cross-Site Scripting Vulnerability
55. Sophos Anti-Virus Delivery Status Notification Handling Scan...
56. Crob FTP Server Remote Denial Of Service Vulnerability
57. XFree86 CopyISOLatin1Lowered Font_Name Buffer Overflow Vulne...
58. AIM Sniff Temporary File Symlink Attack Vulnerability
59. Mailmgr Insecure Temporary File Creation Vulnerabilities
60. XFree86 Unspecified Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Exploit based on leaked Windows code released
2. Software Bug Contributed to Blackout
3. Cable modem hackers conquer the co-ax
4. Police arrest Forces Reunited 'hacker'
5. Anti-virus industry: white knight or black hat?
6. Rebooting on Mars
IV. SECURITYFOCUS TOP 6 TOOLS
1. NetCallback v1.3.1
2. pfflowd v0.4
3. CECID v1.0.0
4. beltane v2.0.5 (2.x)
5. Samhain v1.8.3
6. pwsafe v0.1.4
V. SECURITYJOBS LIST SUMMARY
1. Senior Business Development Consultant - Switzerland (Thread)
2. Director of Sales & Marketing - Switzerland (Thread)
3. SW Engineer - Client Development - SF Bay Area (Thread)
4. Compliance Professionals with Sarbanes-Oxley, Gramm-... (Thread)
5. SW Engineer - FIPS/Common Criteria - SF Bay Area (Thread)
6. SW Engineer - NW Management - SF Bay Area - Contract (Thread)
7. 3 Check Point Firewall-1 engineering positions in So... (Thread)
8. VoIP Fraud Developer needed! (Thread)
9. Security Risk Assessment (NYC-NJ) (financial Industr... (Thread)
10. <job> Security Applications Sale Engineer-NY City Fu... (Thread)
11. BIS seeks Senior Systems Analyst in security (based... (Thread)
12. Sr. Software Architect - Silicon Valley (Thread)
13. Linux Security Developer (Thread)
14. Software Engineers, INFOSEC, Network - OPEN HOUSE in... (Thread)
15. [repost] job seeker (Thread)
16. Electronic Security / Physical Security Professional... (Thread)
17. D.C. Metro area interview availability 17-19 Februar... (Thread)
18. Jr. Level Perimeter Security - Los Angeles (Thread)
19. Security and Privacy Manages in VA/DC - Federal Mark... (Thread)
20. Security/Privacy Auditor needed- Providence Health, ... (Thread)
21. Application Security Engineer: Senior Consultant (Thread)
22. Senior Associate - Threat and Vulnerability, VA/DC (Thread)
23. Security Audit Principal Engineer (Thread)
24. MetaFrame Password Manager Sr. Security Software Dev... (Thread)
25. MetaFrame Secure Access Manager Sr. Security Softwar... (Thread)
26. Channel Sales New Jersey (Thread)
27. Junior Security Pre Sales - Tampa, FL (Thread)
28. Senior Forensics / CIRT Team Lead Needed ASAP (Thread)
29. Security Product Implementation - Herndon/DC (Thread)
30. Full time and Contract positions for Chicago and New... (Thread)
31. eBay - Principal Software Engineer: Security (Requis... (Thread)
32. Information Security Consultant, London, UK (Thread)
33. Web Services/Application Security Engineering Positi... (Thread)
34. IT Audit and Security Risk Assessment Positions in (... (Thread)
35. Sr. Security Software Developer at Citrix Systems in... (Thread)
36. Looking for a position in the Wash D.C/Baltimore MD ... (Thread)
37. Information Security Incident Response, Forensics & ... (Thread)
38. CS security engineer with JAVA experience for securi... (Thread)
39. Research Engineer Position at Sourcefire - Columbia,... (Thread)
40. Security Software Developer at Citrix Systems in For... (Thread)
41. Security Consultants / Architect roles in the United... (Thread)
42. IT Security Pre-Sales role in Thames Valley , United... (Thread)
43. IT Security & Continuity Consultant vacancy (Thread)
VI. INCIDENTS LIST SUMMARY
1. Something new? bind dos? exploit? (Thread)
2. WebDav Worm? (Thread)
3. buddylinks worm (Thread)
4. New article announcement: Automating Windows Patch M... (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. iis 5 %00 null weirdness (Thread)
2. rsync <= 2.5.7 local buffer overflow (no root today:... (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. PPTP versus L2TP and possible attacks (Thread)
2. PPTP versus L2TP and possible attacks - what next? (Thread)
3. Article Announcement: Wireless Honeypot Trickery (Thread)
4. Command Line Interface for Windows Server 2003 Zippe... (Thread)
5. Article Announcement: Automating Windows Patch Manag... (Thread)
6. MS04-006 patch.. error in verbage? (Thread)
7. Looking for SQL security details (Thread)
8. SecurityFocus Microsoft Newsletter #175 (Thread)
9. Looking for SQL security details (Version 2) (Thread)
IX. SUN FOCUS LIST SUMMARY
1. firewall settings for Solstice Backup 6.1 (Thread)
2. Limit NFS on network adapter (Thread)
X. LINUX FOCUS LIST SUMMARY
1. exporting sudoers, good pratcice ? (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Wireless Honeypot Trickery
By Laurent Oudot
This paper will introduce honeypots as a countermeasure for attacks on
wireless environments using WiFi-related technologies. They can be used to
identify and defeat unsuspecting blackhat attackers.
http://www.securityfocus.com/infocus/1761
2. Automating Windows Patch Mngt: Part I
By Jonathan Hassell
This article, the first in a three-part series, discusses Microsoft's
Software Update Services (SUS) in depth, including installation,
administration, and maintenance.
http://www.securityfocus.com/infocus/1760
II. BUGTRAQ SUMMARY
-------------------
1. Multiple Oracle Database Parameter/Statement Buffer Overflow...
BugTraq ID: 9587
Remote: Yes
Date Published: Feb 05 2004
Relevant URL: http://www.securityfocus.com/bid/9587
Summary:
Oracle is a commercial database product, which is available for a number
of platforms including Microsoft Windows and Unix and Linux variants.
Oracle database has been reported prone to multiple buffer overflow
vulnerabilities when processing certain parameters and functions.
Specifically the TIME_ZONE parameter lacks sufficient boundary checks.
Therefore an excessive value assigned to TIME_ZONE may potentially overrun
the bounds of a buffer in stack-based memory. This may result in the
corruption of memory adjacent to the affected buffer, and ultimately may
provide for arbitrary code execution.
Additionally the NUMTOYMINTERVAL function has been reported prone to a
buffer overflow vulnerability. The issue presents itself due to a lack of
sufficient boundary checks performed on char_expr parameters passed as an
argument to the function. Again this issue may be exploited by passing
excessive data as the second argument to a NUMTOYMINTERVAL statement call.
The NUMTODSINTERVAL function has also been reported prone to a buffer
overflow vulnerability. The issue again presents itself due to a lack of
sufficient boundary checks performed on char_expr parameters passed as an
argument to the function. This issue may be exploited in a similar manner
to the NUMTOYMINTERVAL issue, by passing excessive data as the second
argument to a NUMTODSINTERVAL statement call.
Finally the FROM_TZ function has been reported prone to a buffer overflow
vulnerability. The issue will present itself when excessive data is passed
as the third parameter of a properly formatted FROM_TZ statement call.
Any one of these issues may be exploited to execute arbitrary code with
elevated privileges.
2. Mambo Open Source Itemid Parameter Cross-Site Scripting Vuln...
BugTraq ID: 9588
Remote: Yes
Date Published: Feb 05 2004
Relevant URL: http://www.securityfocus.com/bid/9588
Summary:
Mambo Open Source is a web based content management system.
A vulnerability has been reported to exist in the server that may allow a
remote attacker to execute arbitrary HTML or script code in a user's
browser. The issue occurs due to insufficient sanitization of
user-supplied data via the 'Itemid' parameter of 'index.php' script. An
attacker may exploit this vulnerability by creating a specially crafted
URL that includes malicious HTML code as URI parameters for the server
'index.php' page. The malicious script code may be rendered in a user's
browser upon visiting the link. This attack would occur in the security
context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Other attacks are also possible.
Mambo Open Source version 4.6 has been reported to be prone to this issue,
however, other versions may be affected has well.
3. Cactusoft CactuShop Lite Remote Arbitrary File Deletion Back...
BugTraq ID: 9589
Remote: Yes
Date Published: Feb 06 2004
Relevant URL: http://www.securityfocus.com/bid/9589
Summary:
Cactusoft CactuShop Lite is a web based e-commerce shopping cart system
written in ASP. Cactusoft CactuShop Lite is demo software and not
intended by the vendor for commercial use.
A vulnerability has been reported to exist in the software that may allow
remote attackers to delete arbitrary files on a vulnerable system. The
problem is reported to be caused by user-supplied data passed via the
'strEmailAddress' variable of the AddToMailingList() function. It has
been reported that the AddToMailingList() function is used to store user
e-mail addresses for a mailing list. When a user-supplied e-mail address
is provided, the function checks whether the address starts with the '|||'
characters. If a valid file name is provided after the '|||' characters
instead of an e-mail address, the specified file is deleted from the
system.
Successful exploitation of this issue may allow a remote attacker to
delete arbitrary files on a vulnerable system, which could result in
corruption of files eventually leading to a denial of service issue. This
problem is reported to be a backdoor in the software.
Cactusoft CactuShop Lite version 5.0 has been reported to be prone to this
issue.
4. Apache-SSL Client Certificate Forging Vulnerability
BugTraq ID: 9590
Remote: Yes
Date Published: Feb 06 2004
Relevant URL: http://www.securityfocus.com/bid/9590
Summary:
Apache-SSL is an implementation of SSL (Secure Socket Layer) for the
Apache webserver.
Apache-SSL has been reported to be prone to a vulnerability. The issue
exists when Apache-SSL is configured with SSLVerifyClient set to 1 or 3
and SSLFakeBasicAuth active. It has been reported that a server possessing
the aforementioned configuration may provide a conduit that will allow a
remote attacker to forge a valid client certificate.
The attacker may exploit this issue by connecting to the affected service
and supplying a one-line DN of a valid user along with the password
"password". This will result in the issue of a valid client certificate.
This issue is reported to affect Apache-SSL 1.3.28+1.52 and all earlier
versions.
5. Joe Lumbroso Jack's Formmail.php Unauthorized Remote File Up...
BugTraq ID: 9591
Remote: Yes
Date Published: Feb 06 2004
Relevant URL: http://www.securityfocus.com/bid/9591
Summary:
Jack's Formmail.php is a web based form to e-mail gateway. The
application is written in PHP, however, a Perl version is available as
well.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to gain unauthorized access to a vulnerable server and
upload arbitrary files.
It has been reported that the software verifies the origin of a request
via HTTP referer. Due to improper validation performed in the
'check_referer()' function, an attacker can bypass the checks by supplying
an empty value for HTTP referer. This issue may then allow an attacker to
upload a file via the 'css' variable of 'file.php' script.
Successful exploitation of this issue may allow an attacker to save
malicious files to the system or potentially overwrite sensitive files.
Although unconfirmed, Formmail.php versions 5.0 and prior may be affected
by this issue.
6. Linux VServer Project CHRoot Breakout Vulnerability
BugTraq ID: 9596
Remote: No
Date Published: Feb 06 2004
Relevant URL: http://www.securityfocus.com/bid/9596
Summary:
The Linux VServer Project is implemented with a linux kernel patch and a
group of tools that facilitate the partition of a single linux server into
multiple virtual servers. It is implemented with a combination of
"security contexts", chroot, segmented routing, extended quotas and other
standard tools.
It has been reported that VServer is prone to a breakout vulnerability
that would allow a malicious user to escape from the context of the
virtual server. This issue is due to the VServer application failing to
secure itself against a "chroot-again" style vulnerability. Successful
exploitation of this issue may allow an attacker to gain access to the
file system outside of the chrooted root directory.
This issue is leveraged when processes running in the context of the
virtual server utilize the chroot function. The process would change its
current directory to the root directory of the virtual server. It would
then create a temporary directory and chroot itself to the temporary
directory. The process, however still resides in the directory that is
outside of the one that it has chrooted itself to, and so, by making
multiple calls to chdir( ".." ) it is able to move to the true root
directory of the vulnerable system.
This problem makes it possible for a local user with superuser access in
the virtual server environment to execute commands outside of the VServer
context, and possibly gain unrestricted access to the system.
7. OpenJournal Authentication Bypassing Vulnerability
BugTraq ID: 9598
Remote: Yes
Date Published: Feb 06 2004
Relevant URL: http://www.securityfocus.com/bid/9598
Summary:
OpenJournal is a web-based application implemented using PERL that
features automated file creation, automated index updating, editing of
files through a Web-based interface and automated archiving.
It has been reported that OpenJournal is prone to an authentication bypass
vulnerability. This issue is caused by the application failing to
properly sanitize URI specified parameters. Successful exploitation of
this issue may lead to remote attackers gaining unauthorized access to
online journal files associated with the application, adding new users to
the database as well as a number of other possibilities.
The issue is due to the URI parameter 'uid'. A malevolent user may gain
access to the OpenJournal control panel by assigning a specially crafted
value to the 'uid' parameter in a URI and submitting it to the
application.
8. Apache mod_php Global Variables Information Disclosure Weakn...
BugTraq ID: 9599
Remote: Yes
Date Published: Feb 07 2004
Relevant URL: http://www.securityfocus.com/bid/9599
Summary:
Apache is a freely available, open source web server software package. It
is distributed and maintained by the Apache Group. Mod_PHP is an Apache
module which allows for PHP functionality in websites.
A weakness has been reported to exist in Apache mod_php module that may
allow remote attackers to disclose sensitive information via influencing
global variables.
The issue reportedly presents itself when the php.ini configuration file
has the parameter setting 'register_globals = on'. If a request is made
to a virtual host which has the setting 'php_admin_flag register_globals
off' and another request is made to a different virtual host which does
not have "php_admin_flag register_globals off", the original setting may
continue to exist. This issue could lead to other vulnerabilities such as
php file include, due to an attacker's ability to influence global
variables. An attacker may also be able to disclose sensitive information
in order to gain unauthorized access.
9. BolinTech Dream FTP Server User Name Format String Vulnerabi...
BugTraq ID: 9600
Remote: Yes
Date Published: Feb 07 2004
Relevant URL: http://www.securityfocus.com/bid/9600
Summary:
BolinTech Dream FTP Server is a multithreaded FTP server designed for
Microsoft Windows platforms.
Dream FTP Server has been reported to be prone to a remote format string
vulnerability when processing a malicious request from a client.
The vulnerability presents itself when the server receives a malicious
request containing embedded format string specifiers from a remote client.
Specifically, this issue occurs when supplying a username during FTP
authentication. The source of the problem is incorrect use of a formatted
printing function, which processes data supplied during FTP server
authentication. As a result, format specifiers supplied in this manner
will be interpreted literally and may result in attacker-specified memory
being corrupted or disclosed.
Although it has been demonstrated that this could crash the server, the
vulnerability could also theoretically allow for execution of arbitrary
code on the system hosting the server. This would occur in the security
context of the server process.
Dream FTP Server version 1.02 has been reported to be prone to this issue,
however, it is possible that other versions may be affected by this issue
as well.
10. Brad Fears PHPCodeCabinet comments.php HTML Injection Vulner...
BugTraq ID: 9601
Remote: Yes
Date Published: Feb 07 2004
Relevant URL: http://www.securityfocus.com/bid/9601
Summary:
PHPCodeCabinet is a web based application that allows software developers
to store code snippets from any language.
A vulnerability has been reported in the software that may allow a remote
attacker to execute HTML and script code in a user's browser. The problem
is reported to exist due to improper sanitizing of user-supplied data via
the 'sid' parameter of 'comments.php' script. It may be possible for an
attacker to include malicious HTML code in the vulnerable parameter. The
injected code could then be interpreted by the browser of a user visiting
the vulnerable site. This attack would occur in the security context of
the affected site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Other attacks are also possible.
PHPCodeCabinet versions 0.4 and prior have been reported to be vulnerable
to this issue.
11. The Palace Graphical Chat Client Remote Buffer Overflow Vuln...
BugTraq ID: 9602
Remote: Yes
Date Published: Feb 07 2004
Relevant URL: http://www.securityfocus.com/bid/9602
Summary:
The Palace is a graphical chat client application.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to execute arbitrary code on a vulnerable system in
order to gain unauthorized access. The condition is present due to
insufficient boundary checking.
It has been reported that The Palace chat client allows users to join a
chat server via specially crafted hyperlinks that automatically load the
application and connect to a server:
palace://example:9998/
The issue presents itself when a user attempts to follow a link that is
excessively long such as:
palace://('a'x118)('BBBB')('XXXX')
Immediate consequences of an attack may result in a denial of service
condition. An attacker may leverage the issue by exploiting an unbounded
memory copy operation to overwrite the saved return address/base pointer,
causing an affected procedure to return to an address of their choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the vulnerable user in order to gain
unauthorized access, however, this has not been confirmed at the moment.
The Palace chat client versions 3.5 and prior have been reported to be
prone to this issue.
12. Multiple Nokia Object Exchange Protocol Message Remote Denia...
BugTraq ID: 9603
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9603
Summary:
The 6310i phone is a multi-featured mobile phone distributed and
maintained by Nokia.
Several problems in the handling of Object Exchange (OBEX) protocol have
been identified in the Nokia 6310i that could cause the phone to become
unstable. Because of this, it is possible for an attacker to potentially
deny service to legitimate users of affected phones.
The problem stems from the fact that an attacker can send arbitrary
requests to the phone through the transport means of Bluetooth. By
sending invalid OBEX messages through this vector, the phone can be forced
into an unstable mode, resulting in the reboot of the phone.
Specific details concerning the OBEX issues are not available. It is
conjectured that other Nokia phones may also be affected by this issue.
13. Nadeo Game Engine Remote Denial of Service Vulnerability
BugTraq ID: 9604
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9604
Summary:
Nadeo Game Engine is a multiplayer game engine used in several Nadeo
titles.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to cause a denial of service condition. It has been
reported that Trackmania uses TCP port 2350 for communication. A denial
of service condition may be caused by sending arbitrary data on this port.
Successful exploitation may allow an attacker to cause the software to
crash or hang affectively denying server to users.
14. PHP-Nuke 'News' Module Cross-Site Scripting Vulnerability
BugTraq ID: 9605
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9605
Summary:
PHP-Nuke is a freeware content management system. Implemented in PHP, it
is available for a range of systems, including Unix, Linux, and Microsoft
Windows.
It has been reported that the PHP-Nuke 'News' module is prone to a
cross-site scripting vulnerability. The issue arises due to the module
failing to properly sanitize user-supplied information. The URI parameter
'title' is not properly sanitized of HTML tags. This could allow for
execution of hostile HTML and script code in the web client of a user who
visits a vulnerable web page. This would occur in the security context of
the site hosting the software.
Exploitation could allow for theft of cookie-based authentication
credentials. Other attacks are also possible.
It has been reported that this issue affects versions 6.x - 7.x of the
software, however earlier versions may also be vulnerable.
15. Eggdrop Share Module Arbitrary Share Bot Add Vulnerability
BugTraq ID: 9606
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9606
Summary:
Eggdrop is an Open Source multi-platform IRC (Internet Relay Chat) robot,
designed for IRC channel administration and maintenance. Eggdrop may be
configured as a share Bot, which means that two or more Bots share user
records.
Share.mod, a component of Eggdrop, has been reported prone to a
vulnerability that may result in the compromise of an entire Bot Network.
The issue presents itself due to a programming error in the
check_expired_tbufs() function that results in a failure to implement
intended program logic. This failure will result in every Bot that is
processed by check_expired_tbufs() receiving STAT_OFFERED status. The
attacker may further leverage this issue by employing the share_ufyes()
function, which only checks the STAT_OFFERED status of a prospective Bot,
before granting STAT_SHARE status to a malicious Bot.
If the aforementioned status is obtained, the malicious Bot will be
recognized as a Share Bot and will therefore have the ability to perform
administrative tasks, for example adduser, deluser, chattr, that will be
distributed through the entire Bot network.
An attacker may exploit this condition to gain control of an Eggdrop Bot
network.
16. Sambar Server Results.STM Post Request Buffer Overflow Vulne...
BugTraq ID: 9607
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9607
Summary:
Sambar Server is a commercially-available web server package distributed
by Sambar Technologies. The server supports its own scripting language,
contained in files labeled with the STM extension.
A buffer overflow vulnerability has been reported in the Sambar web
server. The issue is due to a insufficient bounds checking in the POST
data request of '/search/results.stm' script.
Immediate consequences of an attack may result in a denial of service
condition. An attacker may leverage the issue by exploiting an unbounded
memory copy operation to overwrite the saved return address/base pointer,
causing an affected procedure to return to an address of their choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the vulnerable user in order to gain
unauthorized access.
This issue has been reported to affect Sambar Server version 6.0, however
earlier versions may also be affected.
17. Shaun2k2 Palmhttpd Server Remote Denial of Service Vulnerabi...
BugTraq ID: 9608
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9608
Summary:
Shaun2k2 Palmhttpd is a web server for PalmOS. The application is based
on the code base of 'httpd for PalmOS' server by Jim Rees.
A vulnerability has been reported to exist in the software that may allow
an attacker to cause a denial of service condition. It has been reported
that PalmOS can only handle one client connection, however, palmhttpd
allows unlimited number of connections. Due to this, attempting multiple
connections via palmhttpd will result in an error stating "Fatal Error,
NetStack1.c overflowed accept queue", leading to a denial of service
condition in the server and PalmOS.
Shaun2k2 Palmhttpd versions 3.0 and prior may be prone to this issue.
Since the application is an extension of 'httpd for PalmOS' server by Jim
Rees, it is assumed that 'httpd for PalmOS' is vulnerable as well,
however, this product has been discontinued.
18. JShop E-Commerce Suite xSearch Cross-Site Scripting Vulnerab...
BugTraq ID: 9609
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9609
Summary:
JShop E-Commerce Suite is a web based E-Commerce system implemented in
PHP. It is back-ended by a MySQL database.
A vulnerability has been reported to exist in JShop E-Commerce that may
allow a remote user to execute HTML or script code in a user's browser.
The issue is reported to exist due to improper sanitizing of user-supplied
data. It has been reported that HTML and script code may be parsed via the
'xSearch' URI parameter of the 'search.php' script. This vulnerability
makes it possible for an attacker to construct a malicious link containing
HTML or script code that may be rendered in a user's browser upon visiting
that link. This attack would occur in the security context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Other attacks are also possible.
19. ClamAV Daemon Malformed UUEncoded Message Denial Of Service ...
BugTraq ID: 9610
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9610
Summary:
ClamAV is a freely available, open source virus scanning utility. It is
available for the Unix and Linux platforms.
A problem in the handling of specially crafted UUEncoded messages has been
identified in ClamAV. Because of this, an attacker may prevent the
delivery of e-mail to users.
The problem is in the handling of malformed UUEncoded messages. When an
attacker sends an e-mail containing UUEncoded content and the line length
is a value that does not conform to UUEncoding conventions, the ClamAV
program terminates. Because of this, mail delivered to the system that
is routed through the scanner will not arrive at its destination,
resulting in a denial of service.
It should be noted that earlier versions of the software may also be
affected, though no information concerning the scope of the issue is
available.
20. Microsoft Internet Explorer LoadPicture File Enumeration Wea...
BugTraq ID: 9611
Remote: Yes
Date Published: Feb 07 2004
Relevant URL: http://www.securityfocus.com/bid/9611
Summary:
Microsoft Internet Explorer is prone to an issue that may permit a remote
site to enumerate the existence of files on the client system.
This may be exploited via abuse of the VBScript LoadPicture method. This
function is typically used to load an image by returning a reference to a
picture object. The return value of this method will disclose enough
information to determine whether a file requested via the method exists on
the system or not. The source of this issue appears to be that the method
does not adequately verify whether the requested resource is of a
graphical format supported by the method (such as .bmp, .ico, .jpg,
etc.). As a result, the method may be called on any resource and will
return information as to whether the resource was successfully loaded or
not.
A malicious web page could call the vulnerable method to gather
information about whether or not particular files exist on the victim's
system. Exploitation of the weakness may assist in other attacks which
depend on the attacker being able to determine whether or not certain
files on the system exist.
21. PHP-Nuke 'Reviews' Module Cross-Site Scripting Vulnerability
BugTraq ID: 9613
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9613
Summary:
PHP-Nuke is a freeware content management system. Implemented in PHP, it
is available for a range of systems, including Unix, Linux, and Microsoft
Windows.
It has been reported that the PHP-Nuke 'Reviews' module is prone to a
cross-site scripting vulnerability. The issue arises due to the module
failing to properly sanitize user-supplied information. The URI parameter
'title' is not properly sanitized of HTML tags. This could allow for
execution of hostile HTML and script code in the web client of a user who
visits a vulnerable web page. This would occur in the security context of
the site hosting the software.
Exploitation could allow for theft of cookie-based authentication
credentials. Other attacks are also possible.
It has been reported that this issue affects versions 6.x - 7.x of the
software, however earlier versions may also be vulnerable.
22. Caucho Technology Resin Source Code Disclosure Vulnerability
BugTraq ID: 9614
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9614
Summary:
Caucho Resin is a XML application server that provides support for
servlets and JSP. Apache is a freely available, open source web server
software package. It is distributed and maintained by the Apache Group.
A vulnerability has been reported to exist in Resin that may allow a
remote attacker to gain access to sensitive information that could be used
to launch further attacks against a system. The issue has been reported
to present itself on Windows NT/2000 systems running Apache 1.3.29 and
Resin 2.1.12. This issue may allow an attacker to disclose source code of
script files by passing malicious data via a URI parameter. Although
unconfirmed, the cause of this issue may arise from Resin influencing the
behavior of Apache when the two applications are used simultaneously.
An attacker may exploit this condition to reveal information that may be
used to aid in further attacks against the target system.
23. PHP-Nuke Public Message SQL Injection Vulnerability
BugTraq ID: 9615
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9615
Summary:
PHP-Nuke is a freeware content management system. Implemented in PHP, it
is available for a range of systems, including Unix, Linux, and Microsoft
Windows.
It has been reported that the 'public message' feature of PHP-Nuke is
vulnerable to an SQL injection vulnerability. The issue is due to a
failure to properly sanitize the '$p_msg' parameter in the
'public_message()' function of the '/mainfile.php' script.
As PHP-Nuke forces all variables to be global within the context of the
application, the '$p_msg' parameter may be specified in either POST, GET
or COOKIE data. Within the 'public_message()' function, the '$p_msg'
parameter is decoded into the '$c_mid' parameter, which is directly used
in the generation of the SQL query. An attacker could use an SQL Union
command passed via the '$p_msg' parameter to mine data from the database.
As a result of this issue an attacker could modify the logic and structure
of database queries. Other attacks may also be possible, such as gaining
access to sensitive information.
It has been reported that this issue affects versions 6.x - 7.x of the
software, however earlier versions may also be vulnerable.
24. Computer Associates eTrust InoculateIT For Linux Vulnerabili...
BugTraq ID: 9616
Remote: No
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9616
Summary:
Multiple vulnerabilities have been reported in eTrust InoculateIT for
Linux operating systems, including issues with temporary files that could
allow for symbolic link attacks and permissions problems that could permit
local attackers to modify sensitive information.
The following specific vulnerabilities were reported:
The insecure temporary file issues are reported to exist in the following
scripts:
ino/scripts/inoregupdate
scripts/uniftest
scripts/unimove
Due to the way in which these scripts create temporary files, it will be
possible to for a remote attacker to create a symbolic link in the
location that temporary files will be created. This will cause operations
that are intended to be performed on temporary files to be performed on
files pointed to by the malicious symbolic link. The most likely
consequences will be destruction of sensitive files, though in some
circumstances, if the attacker can control the data written in the attack,
it may be possible to gain elevated privileges.
There are insecure permissions on the eTrustAE.lnx/tmp/.caipcs/.sem
directory, allowing local attackers to modify sensitive configuration
files for the software.
The software installs several registry files that contain various software
settings. These registry files are included to simulate software settings
in the Windows Registry on Linux installations of the software. Some of
these files are reported to allow modification by unprivileged local
users, which could be exploited to lower security settings for the
software, such as removing scanned file types from the current user's
registry setting. Hard-coded search paths for executables may also be
embedded in user-modifiable registry files, allowing for execution of
arbitrary code with elevated privileges in some circumstances.
25. Caucho Technology Resin Directory Listings Disclosure Vulner...
BugTraq ID: 9617
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9617
Summary:
Caucho Resin is a XML application server that provides support for
servlets and JSP. Apache is a freely available, open source web server
software package. It is distributed and maintained by the Apache Group.
A vulnerability has been reported in Resin that may allow a remote user to
the disclose directory listings by passing malicious data via a URI
parameter. The issue has been reported to present itself on Windows
NT/2000 systems running Apache 1.3.29 and Resin 2.1.12. Although
unconfirmed, the cause of this issue may arise from Resin influencing the
behavior of Apache when the two applications are used simultaneously.
An attacker may gain access to sensitive information by disclosing
directory listings that could lead to further attacks against the target
system.
26. Multiple Red-M Red-Alert Remote Vulnerabilities
BugTraq ID: 9618
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9618
Summary:
Red-Alert is an airspace monitor for unauthorized wireless network
activity. It is distributed and maintained by Red-M.
Problems in various features have been identified in the Red-M Red-Alert
network monitors. Because of this issues, an attacker may be able to
crash a vulnerable device and eliminate logs, gain unauthorized access to
the administrative interface, or partially evade detection by an affected
device.
The first problem makes it possible for a remote attacker to crash the
device. By requesting an URI from the device web server with a length of
1230 or greater bytes, an attacker could force the host to become unstable
and crash. During the reboot process, the system is not able to log any
activity. Additionally, the reboot results in the loss of any locally
stored logs.
The second problem makes it possible for an unauthorized user to gain
access to the Red-Alert administration interface. Red-Alert does not
properly handle authentication, restricting administrative access solely
on the basis of IP address. In circumstances where network address
translation is performed, a user behind the NAT interface could
potentially gain unauthorized access to the device.
The third problem is in the parsing of Server Set IDs (SSIDs). Systems
with SSIDs that contain one or more space characters (ASCII character 32)
in the name are logged as a single space character. This problem could
allow an attacker to evade location through misrepresentation in log
files.
27. Linux Kernel Samba Share Local Privilege Elevation Vulnerabi...
BugTraq ID: 9619
Remote: No
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9619
Summary:
A local privilege escalation vulnerability has been reported to affect the
2.6 Linux kernel.
The issue appears to exist due to a lack of sufficient sanity checks
performed when executing a file that is hosted on a remote Samba share.
This issue has been reported to occur when a setuid or setgid file is made
available as a shared network resource through the samba service. An
attacker, who has local interactive access to an affected host, may mount
the remote share and execute the remote setuid/setgid application. This
will reportedly result in elevated privileges, as the setuid/setgid bit of
the remote file is honored on the local system. The problem exist because
smb file system is not mounted using mount and ignores the setuid/setgid
permissions from smbmnt.
It should be noted that although this vulnerability has been reported to
affect 2.6 versions of the Linux kernel, other versions might also be
affected.
Conflicting reports suggest that this is expected behavior that results
from the smbmnt utility being setuid root.
It has been reported that the attacker does not have to mount the file
system as a local user. The vulnerability still exists if root mounts the
file system and the attacker can execute a setuid binary on the server.
Unix extensions have to be enabled on both the client and the server for
this issue to occur.
28. GNU Mailman Malformed Message Remote Denial Of Service Vulne...
BugTraq ID: 9620
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9620
Summary:
GNU Mailman is a web integrated software package used for managing
electronic mail discussion and e-newsletter lists. It is freely
distributed under the GNU Public License.
It has been reported that GNU Mailman is prone to a denial of service
vulnerability. An attacker could send a carefully crafted message that
would cause the Mailman process to crash.
Successful exploitation of this issue could deny service to legitimate
users.
29. Microsoft Windows XP HCP URI Handler Arbitrary Command Execu...
BugTraq ID: 9621
Remote: Yes
Date Published: Feb 09 2004
Relevant URL: http://www.securityfocus.com/bid/9621
Summary:
A local Help and Support Center application was introduced with Microsoft
Windows XP. It is an extended version of Help Center applications included
in previous versions of the operating system. An associated protocol
handler 'hcp://' is supported in Windows XP and may be invoked via
Internet Explorer.
The Microsoft Windows XP HCP URI handler has been reported prone to a
vulnerability that may provide for arbitrary command execution. The issue
is alleged to present itself when a specially formatted HCP URI that
references a local resource is processed. If an attacker crafts a
malicious HCP URI that references local content using a file:/// URI, it
may be presented to an unsuspecting user, when this link is followed
arbitrary commands may be invoked in the context of the user who followed
the link.
This issue could also permit remote sites to be opened in the context of
the Local Zone, though this has not been confirmed.
This issue has been reported to be present in Polish versions of Windows
XP SP1; other versions may also be vulnerable. Symantec has not been able
to reproduce this behavior.
30. Microsoft Windows Internet Naming Service Buffer Overflow Vu...
BugTraq ID: 9624
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9624
Summary:
The Microsoft Windows Internet Name Service (WINS) allows the mapping of
NetBIOS names to IP addresses and vice-versa. WINS servers can allow
users to browse for local resources on the network using computer names.
The WINS service is prone to a stack-based buffer overflow.
This issue exists because WINS fails to correctly validate the length of
specially crafted packets received by the service. Exploitation of this
vulnerability has different effects depending upon the Windows version
running the service.
On Windows NT 4.0 and 2000, the WINS service will perform additional
processing, but will return to a normal state after a short period. The
service does not fail on these platforms when receiving malformed packets,
however, a constant stream of these packets could reduce system
performance.
On Windows 2003, these malformed packets will cause the WINS service to
fail. The service will automatically restart, but if the service fails
again after a third restart, it must be restarted manually. The denial of
service occurs on Windows 2003 due to a security feature used during
development called the /GS flag. This feature is meant to detect
stack-based buffer overflow exploitation attempts and reduce the
possibilities of successful exploitation. In this case, the /GS flag
terminates the service in order to prevent arbitrary code execution. It
has been conjectured that if an attacker were to find a way to bypass this
security feature, exploitation could result in the execution of arbitrary
code on the vulnerable system. Code execution would likely occur in the
security context of WINS.
31. MaxWebPortal Multiple Input Validation Vulnerabilities
BugTraq ID: 9625
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9625
Summary:
MaxWebPortal is a web portal and online community system designed to
generate dynamic content using data stored in a SQL/MySQl database.
Multiple vulnerabilities have been discovered in MaxWebPortal.
The following specific issues have been identified:
MaxWebPortal 'dl_showall.asp', 'down.asp', and Personal Messages scripts
have been reported prone to cross-site scripting vulnerabilities.
MaxWebPortal does not adequately filter script code from the 'sub_name'
URI parameter of 'dl_showall.asp' script, making it prone to cross-site
scripting attacks. The 'SendTo' parameter in Personal Messages also
suffers from a lack of input validation. It has been reported that due to
a problem with 'down.asp' script, an attacker can create false
HTTP_REFERER headers which may contain arbitrary HTML and script code as
well.
Attacker-supplied script code may be included in a malicious link to the
vulnerable scripts. The code contained in the affected URI parameters may
be executed in the browser of the web user who visits a malicious link.
Code will be executed in the security context of the system running
MaxWebPortal.
MaxWebPortal is also prone to an SQL injection vulnerability. The
vulnerability exists in the 'SendTo' parameter of Personal Messages
script. This script does not adequately filter SQL syntax from
user-supplied input before including it in a database query. As a result,
remote attackers may influence the logic and structure of database queries
made by the software.
This vulnerability could potentially be exploited to disclose sensitive
information from within the database or even to launch attacks against the
database implementation. The impact may also depend on the capabilities of
the underlying database implementation.
MaxWebPortal has been reported prone to a HTML injection vulnerability as
well. A malicious remote attacker may use the 'register' form when
posting an image name of an Avatar to the forum. The attacker may inject
arbitrary HTML instead of an Avatar into dynamically generated content.
This issue is due to a lack of sufficient sanitization performed on the
affected form field.
MaxWebPortal versions prior to 1.32 have been reported to be prone to
these issues.
32. XLight FTP Server Remote Denial Of Service Vulnerability
BugTraq ID: 9627
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9627
Summary:
XLight FTP server is a commercially available FTP server application built
for the Windows platform.
A remote denial of service vulnerability has been reported to exist in the
XLight FTP server. Due to this issue a remote attacker may be able cause
the affected server to crash, denying service to legitimate users. This
issue is due to insufficient bounds checking.
This issue presents itself when an attacker sends a specially crafted
directory request containing an excessively long string value to the
affected server. When submitted the process will request authentication,
once the given the server process will crash.
It is conjectured that, however implausible, this could be a boundary
condition error with the potential for exploitation. However, no
conclusive proof exists.
Although this issue has been reported to affect version 1.52 of the
software, it is likely that it affects previous versions as well.
33. Microsoft Internet Explorer Shell: IFrame Cross-Zone Scripti...
BugTraq ID: 9628
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9628
Summary:
It has been alleged that Microsoft Internet Explorer is prone to an issue
that may allow hostile script code to access properties of an IFrame that
has been opened in the context of the My Computer Zone. Reportedly, if an
IFrame opens up a local resource using a 'shell:' link, it may be possible
for the page that spawns the IFrame to access properties of the My
Computer Zone. If this issue is exploitable, this could ultimately lead
to execution of malicious script code in the context of the My Computer
Zone, potentially allowing for remote compromise of the client system in
the context of the client user.
These reports have not been confirmed by Symantec and are pending further
investigation. This BID will be updated when further information becomes
available and retired if the alleged issue is not exploitable.
34. Microsoft Internet Explorer Double-Null URI Denial Of Servic...
BugTraq ID: 9629
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9629
Summary:
A problem in the handling of URIs with double nulls has been reported in
Microsoft Internet Explorer. Because of this, it may be possible for a
remote attacker to deny service to legitimate users of an affected system.
The problem is in the handling of URIs with double null characters
(encoded as %00) at the end of a URI. Reports indicate that it is
possible for remote websites to take advantage of this issue by forcing a
user to load a maliciously-crafted URI. Upon exploitation of this issue
by a remote site, the host system executing the browser becomes
resource-bound, experiencing a 100% consumption of processor resources,
and ultimately freezing up entirely.
This issue has been reported to occur with only specific host names, and
only on systems that do not first pass requests through a web proxy
server. A pattern of host names that identifies the scope of this issue
is currently not available. This issue has also been reported to not
occur when the "Do not save encrypted pages to disk" option is enabled,
which is not the default configuration.
Additionally, this option is conjectured to be an issue in a library
component within the browser, as this issue affects Microsoft Internet
Explorer and Microsoft Outlook. This would also likely affect any other
system components that invoke the browser.
35. PHPNuke Category Parameter SQL Injection Vulnerability
BugTraq ID: 9630
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9630
Summary:
PHPNuke is a freely available, open source web content management system.
It is maintained by Francisco Burzi, and available for the Unix, Linux,
and Microsoft Operating Systems.
A vulnerability has been reported to exist in PHPNuke that may allow a
remote attacker to inject malicious SQL syntax into database queries. The
source of this issue is insufficient sanitization of user-supplied input.
The problem is reported to exist in the $category variable contained
within the 'index.php' page. It has been reported that $category is not
sanitized for user-supplied input before it is included in SQL queries
that are later executed by the database. A remote attacker may exploit
this issue while performing a search in 'index.php' to influence SQL query
logic.
A malicious user may influence database queries in order to view or modify
sensitive information, potentially compromising the software or the
database. It has been reported that an attacker may be able to disclose
the administrator password hash by exploiting this issue.
PHPNuke versions 6.9 and prior have been reported to be prone to this
issue, however other versions may be affected as well.
36. EvolutionX Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 9631
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9631
Summary:
EvolutionX is illegal software that is used to replace default Microsoft
XBOX software.
The FTP server that is distributed with EvolutionX has been reported prone
to multiple buffer overflow vulnerabilities. The first of these
vulnerabilities exists post-authentication, and is due to a lack of
sufficient bounds checking performed on arguments that are passed to the
'cd' command. It has been conjectured that an attacker who is
authenticated to the FTP server may potentially exploit this condition to
execute arbitrary code in the context of the affected service. Immediate
consequences of a failed exploit attempt may result in the XBOX appliance
behaving in an unstable manner, or potentially becoming unresponsive until
the appliance is power-cycled.
The second issue exists pre-authentication, excessive data passed as
username:password combination to the affected FTP server will trigger the
buffer overrun. Again, due to the nature of this issue, it has been
conjectured that an attacker may potentially exploit this condition to
execute arbitrary code in the context of the affected service. Again
immediate consequences of a failed exploit attempt may result in the XBOX
appliance behaving in an unstable manner, or potentially becoming
unresponsive until the appliance is power-cycled.
Finally the telnet server that is distributed with EvolutionX has been
reported prone to a buffer overflow vulnerability when handling excessive
data passed as an argument to the 'dir' command. An attacker may exploit
this buffer overflow to deny service to legitimate users of the XBOX
appliance, again it has been conjectured that this issue may be
exploitable to result in arbitrary code execution.
It should be noted that while this vulnerability has been reported to
affect EvolutionX builds 3921 and 3935, other versions might also be
affected.
37. Microsoft Virtual PC For Mac Temporary File Privilege Escala...
BugTraq ID: 9632
Remote: No
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9632
Summary:
Microsoft Virtual PC For Mac is an x86 emulator for Apple Mac OS systems.
Microsoft has reported an issue in Virtual PC for Mac that may permit a
local attacker to gain elevated privileges on a system hosting the
software.
This is due to insecure handling of temporary files by the setuid root
VirtualPC_Services binary, potentially permitting a malicious local user
to create a malicious symbolic link in place of the temporary file
(/tmp/VPCServices_Log). This symbolic link could be constructed to point
to a sensitive system file. When the software is executed, operations
intended to be performed on the temporary file will instead be performed
on the file pointed to by the symbolic link, causing such a file to be
corrupted. Alternatively, if the symbolic link points to a non-existent
file, this file would be created with the attacker's umask settings.
Exploitation could result in corruption of sensitive files and elevation
to root privileges.
38. Microsoft ASN.1 Library Length Integer Mishandling Memory Co...
BugTraq ID: 9633
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9633
Summary:
Microsoft Windows Abstract Syntax Notation 1 (ASN.1) handling Library
(MSASN1.dll) is shipped as a part of the Microsoft Windows Operating
System. The MSASN1 library provides an application programmer's interface
into Microsoft ASN.1 encoding/decoding and processing functions.
A vulnerability has been reported in the Microsoft ASN.1 library. This
issue is related to insufficient checking of data supplied via an
externally supplied length field in ASN.1 BER encoded data.
In particular, ASN.1 BER encoded data consists of a tag number that
specifies how following value data is interpreted, followed by a length
field for that data and then the actual data itself. Supplying an
excessive length field value in the range of 0xFFFFFFFD to 0xFFFFFFFF will
result in an integer overflow during a heap allocation operation. Despite
checks on the length field, there is a separate pointer arithmetic
overflow that occurs in the length verification routine itself that could
cause large amounts of heap memory to be corrupted. This occurs because
the internal ASN1BERDecCheck() length verification function will be
bypassed when length field values in the range of 0xFFFFFFFD to 0xFFFFFFFF
are supplied and then subsequent memory allocation and copying operations
will be performed with excessive values. This could be leveraged to
corrupt sensitive values in memory, resulting in execution of arbitrary
code.
The following specific decoder functions are known to be vulnerable to
this issue:
ASN1BerDecCharString
ASN1BERDecChar16String
ASN1BERDecChar32String
ASN1BERDecEoid
ASN1BERDecGeneralizedTime
ASN1BERDecMultibyteString
ASN1BERDecOctetString
ASN1BERDecOpenType
ASN1BERDecSXVal
ASN1BERDecUTCTime
ASN1BERDecUTF8String
ASN1BERDecZeroCharString
ASN1BERDecZeroChar16String
ASN1BERDecZeroChar32String
ASN1BERDecZeroMultibyteString
This vulnerability is exposed in a number of security related operating
system components, including Kerberos (via UDP port 88), Microsoft IIS
with SSL support enabled and NTLMv2 authentication (via TCP ports 135, 139
and 445). Other components may also be affected, though a comprehensive
list is not available at this time. Client applications which use the
library will be affected, including LSASS.EXE and CRYPT32.DLL (and any
application that relies on CRYPT32.DLL). The vulnerable library is used
frequently in components that handle certificates such as Internet
Explorer and Outlook. Handling of signed ActiveX components could also
present an exposure.
It should be noted that because ASN.1 data will likely be encoded, for
example Kerberos, SSL, IPSec or Base64 encoded, the malicious integer
values may be obfuscated and as a result not easily detectable.
This vulnerability was originally covered in BID 9626, but further
information has been made available which identifies a number of distinct
vulnerabilities in the library and so this specific issue has been
assigned an individual BID.
39. Microsoft Baseline Security Analyzer Vulnerability Identific...
BugTraq ID: 9634
Remote: No
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9634
Summary:
Microsoft Baseline Security Analyzer (MBSA) is a tool which scans a
Microsoft Windows system and creates a security report including a variety
of information about the target system.
A weakness has been identified in MBSA. It has been reported that under
some circumstances MBSA may not properly identify security vulnerabilities
in the target operating system. Various tests have revealed this
condition occurs when a patch has been installed on a machine but the
machine has not been rebooted therefore leaving the host operating system
vulnerable. The weakness in MBSA causes the scanner to still identify the
host operating system as invulnerable. This issue may cause a false sense
of security resulting in leaving the operating system prone to security
vulnerabilities.
Microsoft Baseline Security Analyzer version 1.2 is assumed to be affected
by this issue, however, it is possible that other versions are affected by
this flaw as well.
40. Microsoft Windows ASN.1 Library Bit String Processing Intege...
BugTraq ID: 9635
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9635
Summary:
Microsoft Windows Abstract Syntax Notation 1 (ASN.1) handling Library
(MSASN1.dll) is shipped as a part of the Microsoft Windows Operating
System. The MSASN1 library provides an application programmer's interface
into Microsoft ASN.1 encoding/decoding and processing functions.
Microsoft ASN.1 handling library has been reported prone to an integer
overflow vulnerability that may result in arbitrary heap-based memory
corruption. The issue presents itself in the ASN.1 BER decoding/encoding
routines, specifically the ASN1BERDecBitString() function.
ASN1BERDecBitString() handles constructed bit strings by concatenating
each of the simple bit strings that comprise the compound one. The integer
overflow occurs when a bit string is processed and the number of bits in
the bit string is added to the cumulative total as follows:
lea eax, [ecx+eax+7]
This may provide a conduit for an attacker to trigger a boundary condition
error. When the first bit string processed by ASN1BERDecBitString
possesses a specified signed length of 0xfffffff9(-7), and then the
aforementioned arithmetic (ecx+eax+7) sums the accumulated bits (0) with
the signed length of the bit string (-7). The rounding value (+7) is then
added to the total. This will result in a total assigned length of zero.
It has been reported that this value is then further processed by the
DecMemReAlloc() function call, and ultimately results in a zero-byte chunk
being allocated on the heap. The original bit string lengths are passed to
the function ASN1bitcpy(). This function later performs a memcpy()
operation to copy supplied bit string data into the zero-byte allocated
heap based buffer. This operation will result in the corruption of heap
based management structures, and may ultimately be leveraged by an
attacker to have arbitrary code executed in the context of the affected
process.
This vulnerability is exposed in a number of security related operating
system components, including Kerberos (via UDP port 88), Microsoft IIS
with SSL support enabled and NTLMv2 authentication (via TCP ports 135, 139
and 445). Other components may also be affected, though a comprehensive
list is not available at this time. Client applications which use the
library will be affected, including LSASS.EXE and CRYPT32.DLL (and any
application that relies on CRYPT32.DLL). The vulnerable library is used
frequently in components that handle certificates such as Internet
Explorer and Outlook. Handling of signed ActiveX components could also
present an exposure.
It should be noted that because ASN.1 data will likely be encoded, for
example Kerberos, SSL, IPSec or Base64 encoded, the malicious integer
values may be obfuscated and as a result not easily detectable.
This vulnerability was originally covered in BID 9626, but further
information has been made available which identifies a number of distinct
vulnerabilities in the library and so this specific issue has been
assigned an individual BID.
41. XFree86 Font Information File Buffer Overflow Vulnerability
BugTraq ID: 9636
Remote: No
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9636
Summary:
XFree86 is a freely available open-source implementation of the X Window
System.
It has been reported that the XFree86 X Windows system is prone to a local
buffer overflow vulnerability. The issue arises from improper bounds
checking when parsing the font.alias file.
The issue occurs in the 'ReadFontAlias()' function in the 'dirfile.c' file
and surrounds the 'alias[1024]' buffer. The function reads arbitrary
length tokens from the 'font.alias' file without performing any bounds
checking. The function stops reading the file once white spaces are
reached. It then uses the 'strcpy()' function to copy the input into the
'alias[1024]' buffer. An attacker may exploit this issue to execute
arbitrary code within the context of the XFree86 process, potentially
gaining root privileges on the affected system.
This issue has been reported to affect version 4.1.0 through 4.3.0
inclusive, it is likely however that this issue affects earlier versions
of the software as well.
42. Samba Mksmbpasswd.sh Insecure User Account Creation Vulnerab...
BugTraq ID: 9637
Remote: Yes
Date Published: Feb 10 2004
Relevant URL: http://www.securityfocus.com/bid/9637
Summary:
Samba is a freely available file and printer sharing application
maintained and developed by the Samba Development Team. Samba allows file
and printer sharing between operating systems on the Unix and Microsoft
platforms. Samba ships with several helper scripts, one of these scripts
is mksmbpasswd.sh, which is used to aid in user account creation.
The mksmbpasswd.sh shell script is reported prone to a vulnerability. The
issue results in the creation of insecure user accounts. Specifically it
has been reported that a password initialization problem in the
mksmbpasswd.sh shell script results in user accounts being created with
insecure passwords.
The issue surrounds the passwords for disabled user accounts. In some
cases the affected script may overwrite these passwords with uninitialized
memory. If an attacker were able to ascertain the contents of memory used
to overwrite disabled account passwords they may be able to gain
unauthorized access.
A remote attacker may exploit this issue by accessing a Samba share using
an insecure account that was created using the affected script.
43. VisualShapers ezContents Multiple Module File Include Vulner...
BugTraq ID: 9638
Remote: Yes
Date Published: Feb 11 2004
Relevant URL: http://www.securityfocus.com/bid/9638
Summary:
VisualShapers ezContents is a website content management system based on
PHP and MySQL. It allows multiple users to update and maintain a website.
A vulnerability has been reported to exist in the software that may allow
an attacker to include malicious files containing arbitrary code to be
executed on a vulnerable system. The problem reportedly exists because
remote users may influence the 'GLOBALS[rootdp]' and
'GLOBALS[language_home]' variables in the 'db.php' and 'archivednews.php'
modules.
Remote attackers could potentially exploit this issue via by influencing
the include path to specify a remote malicious PHP script, which will be
executed in the context of the web server hosting the vulnerable software.
This vulnerability is reported to affect ezContents 2.0.2 and prior
running on PHP 4.3.0 or above.
44. BosDev BosDates SQL Injection Vulnerability
BugTraq ID: 9639
Remote: Yes
Date Published: Feb 11 2004
Relevant URL: http://www.securityfocus.com/bid/9639
Summary:
BosDates is a commercially available web based event calendar organization
system. It is implemented using PHP with a MySQL database backend for
Unix and Unix like operating systems as well as Windows.
An SQL injection vulnerability has been reported to affect BosDates
calendar system. The issue arises due to insufficient sanitization of
user-supplied data.
The vulnerability surrounds the 'calendar' parameter passed via the URI of
the 'calendar_download.php' script. The 'calendar' parameter is used in
an SQL statement without being properly sanitized. A malevolent user may
craft an SQL statement and assign it to the improperly sanitized
parameter.
As a result of this issue an attacker may be able to modify the logic and
structure of database queries. This may provide for other attacks, such as
gaining access to sensitive information.
45. Opera Web Browser CLSID File Extension Misrepresentation Vul...
BugTraq ID: 9640
Remote: Yes
Date Published: Feb 11 2004
Relevant URL: http://www.securityfocus.com/bid/9640
Summary:
A vulnerability has been reported in Opera Web Browser that may allow
files to be misrepresented to client users. This issue could be exploited
to deceive users into opening seemingly harmless files which may in fact
be malicious.
The browser appears to present the content to the user as the file name
and type specified after the CLSID, when the actual content type is
determined by the CLSID (which specifies an HTML application). It is not
known at this time where the security flaw lies but it has been
demonstrated that such a filename may be used to misrepresent the file
type. The dot to separate the additional file extension may need to be
URL-encoded (%2E) for exploitation to be successful, though this has not
been confirmed.
This issue could be exploited to disguise executable content in the form
of an HTML application (HTA) file as a file type that may appear innocuous
to a victim user. The file will appear to be of an attacker-specified type
in the file download dialog presented to the user. The user may then
download/open that file under the assumption it is safe, which could
result in execution of malicious code on the client system in the context
of the victim user. It should also be noted that the file name may be
prepended by '...' in the download dialog, to abbreviate the malicious
file name and CLSID extension in the prefix.
This issue could be exploited via a malicious web page or possibly through
e-mail.
Opera versions 7.x have been reported to be prone to this issue, however,
other versions could be affected as well.
46. Mutt Menu Drawing Remote Buffer Overflow Vulnerability
BugTraq ID: 9641
Remote: Yes
Date Published: Feb 11 2004
Relevant URL: http://www.securityfocus.com/bid/9641
Summary:
Mutt is a freely available, open source mail user agent (MUA). It is
available for the Unix and Linux platforms.
A problem in the handling of some types of input has been identified in
Mutt. Because of this, a remote attacker may be able to crash a
vulnerable client.
The problem is in the handling of specially-crafted strings. Upon
embedding particular strings of arbitrary length in an e-mail, a remote
user can force a buffer overflow in the menu drawing function of mutt.
This problem could potentially also be exploited to overwrite arbitrary
structures in process memory, and potentially execute code with the
privileges of the mutt user.
Specifics concerning the mechanics of this bug are not currently
available.
47. Monkey HTTP Daemon Missing Host Field Denial Of Service Vuln...
BugTraq ID: 9642
Remote: Yes
Date Published: Feb 11 2004
Relevant URL: http://www.securityfocus.com/bid/9642
Summary:
Monkey is an open source Web server written in C, based on the HTTP/1.1
protocol. It is available for Linux platforms.
Monkey HTTP Daemon is prone to a denial of service attacks. HTTP GET
requests, which do not include a ?Host? header field, will trigger this
condition. This issue is reportedly due a programming error in the
get_real_string() function.
The server will need to be restarted to regain normal functionality.
48. Microsoft Internet Explorer Unauthorized Clipboard Contents ...
BugTraq ID: 9643
Remote: Yes
Date Published: Feb 11 2004
Relevant URL: http://www.securityfocus.com/bid/9643
Summary:
A vulnerability was reported in Microsoft Internet Explorer that could
permit a remote site to gain access to contents of the client user's
clipboard.
This vulnerability is a variant of similar issues which could permit
scripting operations to gain access to clipboard contents, such as that
described in BID 215 and 3862. This issue employs the
execCommand("Paste") method to copy clipboard contents into small (or
hidden) textarea. Some of this functionality is legitimate and can be
mitigated by disabling the "Allow paste options via scripting" scripting
setting in the browser. However, it does appear that Internet Explorer
does make some attempt to prevent this operation even when the option is
enabled and so this issue does present a security risk because it
demonstrates a means of bypassing these checks. In particular, the paste
operation will fail if it attempts to paste clipboard contents into a
TextRange that is non-displayed using either a CSS display property of
"none" or an HTML input-type property of "hidden". Conversely, the
operation does succeed if clipboard contents are pasted into a textarea
that is either 1x1 pixel in size or with a visibility property of
"hidden".
The impact of exploitation depends entirely on what sort of information is
stored in the user's clipboard at the time of exploitation, though it is
common for user's to copy various credentials into their clipboard. It
should be noted that there will not be any context for the disclosed
clipboard contents so the attacker will have to make assumptions as to
whether the information is of a sensitive nature or not.
49. Ratbag Game Engine Denial of Service Vulnerability
BugTraq ID: 9644
Remote: Yes
Date Published: Feb 11 2004
Relevant URL: http://www.securityfocus.com/bid/9644
Summary:
Ratbag develops PC games for Microsoft Windows platforms. Ratbag games
include Dirt Track Racing, Dirt Track Racing Australia, Leadfoot, Dirt
Track Racing Sprint Cars, Dirt Track Racing 2, and World of Outlaws Sprint
Cars.
A denial of service vulnerability has been identified in the software that
may allow a remote attacker to cause a vulnerable server to crash or hang.
The issue is reported to present itself due to excessive CPU usage caused
by improper validation of user supplied data.
It has been reported that the server calculates the amount of data to be
received from a user by analyzing a 16 bit value located at the beginning
of each data block. This value is also used to calculate the amount of
received data during transfer. An attacker my cause the server to enter
an infinite loop by manipulating this value to a number of bytes that is
greater than the actual data to be transferred to the server.
50. PHPCodeCabinet Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 9645
Remote: Yes
Date Published: Feb 11 2004
Relevant URL: http://www.securityfocus.com/bid/9645
Summary:
The phpCodeCabinet scripts are designed to be a reference library for
personal and professional use. They are implemented in PHP and are freely
distributable under the GNU Public License.
It has been reported that a number of phpCodeCabinet scripts are prone to
cross site scripting vulnerabilities. These issues are reportedly due to a
failure to sanitize user input and so allow HTML and script code that may
facilitate cross-site scripting attacks.
These issue are reported to affect the 'sid' parameter of the
'comments.php' script, the 'cid' parameter of the 'input.php' script, the
'cid' parameter of the 'browser.php' script and the 'cid', 'cf', and 'rfd'
parameters of the 'category.php' script.
This could permit a remote attacker to create a malicious link to the
vulnerable application that includes hostile HTML and script code. If this
link were followed, the hostile code may be rendered in the web browser of
the victim user. This would occur in the security context of the web
server and may allow for theft of cookie-based authentication credentials
or other attacks.
51. Macallan Mail Solution Web Interface Authentication Bypass V...
BugTraq ID: 9646
Remote: Yes
Date Published: Feb 12 2004
Relevant URL: http://www.securityfocus.com/bid/9646
Summary:
Macallan Mail Solution is a mail server for Microsoft Windows operating
systems.
A vulnerability has been reported in Macallan Mail Solution that may
permit remote attackers to bypass authentication for the web interface.
This may be exploited by submitting a specially crafted HTTP GET request
for the administration page of the web interface. Reportedly, if the
request contains an extra slash when specifying the administration page
(for example: //admin.html) then authentication will be bypassed.
There are conflicting reports from the vendor that state that the attacker
will not be able to perform any administrative actions after bypassing
authentication. This could threaten other security properties, such as
exposing sensitive information, though this has not been confirmed.
52. SandSurfer Unspecified User Authentication Vulnerability
BugTraq ID: 9647
Remote: Yes
Date Published: Feb 08 2004
Relevant URL: http://www.securityfocus.com/bid/9647
Summary:
SandSurfer is a web-based time keeping application. It is available for
Unix/Linux variants.
An unspecified vulnerability related to user authentication was reported
in SandSurfer that may allow remote attackers to gain unauthorized access
to the software.
There are no further technical details at the time of writing.
53. Sophos Anti-Virus MIME Header Handling Denial Of Service Vul...
BugTraq ID: 9648
Remote: Yes
Date Published: Feb 12 2004
Relevant URL: http://www.securityfocus.com/bid/9648
Summary:
Sophos Anti-Virus is multi platform computer virus detection software.
Sophos Anti-Virus has been reported prone to a remote denial of service
vulnerability. The issue presents itself when a malicious MIME header that
is terminated at the end of the file in an unexpected manner is
encountered. Because the virus detection engine erroneously continues to
read beyond the end of the file, it will fall into an infinite loop. It
has been conjectured that this will result in a denial of service to the
affected Sophos virus detection software.
This issue has been reported to affect SAVI-compliant Sophos products.
It should be noted that although this issue has been reported to affect
Sophos Anti-Virus version 3.78, other versions might also be affected.
54. JelSoft VBulletin Cross-Site Scripting Vulnerability
BugTraq ID: 9649
Remote: Yes
Date Published: Feb 12 2004
Relevant URL: http://www.securityfocus.com/bid/9649
Summary:
VBulletin is a commercially available web based bulletin board
application. It is implemented in PHP and may be run on Unix and Unix
like operating systems as well as Windows.
It has been reported that VBulletin is prone to a cross-site scripting
vulnerability. This issue is reportedly due to a failure to sanitize user
input and so allow HTML and script code that may facilitate cross-site
scripting attacks.
This issue is reported to affect the 'url' parameter of the 'register.php'
script, which is passed through a URI.
This could permit a remote attacker to create a malicious link to the
vulnerable application that includes hostile HTML and script code. If this
link were followed, the hostile code may be rendered in the web browser of
the victim user. This would occur in the security context of the web
server and may allow for theft of cookie-based authentication credentials
or other attacks.
55. Sophos Anti-Virus Delivery Status Notification Handling Scan...
BugTraq ID: 9650
Remote: Yes
Date Published: Feb 12 2004
Relevant URL: http://www.securityfocus.com/bid/9650
Summary:
Sophos Anti-Virus is multi platform computer virus detection software.
Sophos Anti-Virus has been reported prone to a scanner bypass
vulnerability. The issue presents itself when certain types of Delivery
Status Notification (DSN) are encountered. The vendor has reported that
qmail servers generate this DSN type when they are configured to include
the original email message in a bounce notification. It is reported that
the vulnerability results because the aforementioned DSN will not include
MIME boundary definitions.
An attacker may exploit this condition, to bypass virus scans. This may
result in a false sense of security and malicious code completely
bypassing detection.
It should be noted that although this issue has been reported to affect
Sophos Anti-Virus version 3.78, other versions might also be affected.
56. Crob FTP Server Remote Denial Of Service Vulnerability
BugTraq ID: 9651
Remote: Yes
Date Published: Feb 12 2004
Relevant URL: http://www.securityfocus.com/bid/9651
Summary:
Crob FTP server is a commercially available file transfer utility
developed for the Windows platform.
It has been reported that the Crob FTP server is prone to a remote denial
of service vulnerability. An attacker may exploit this issue to cause the
affected server to crash, denying service to legitimate users.
The issue presents itself when a malicious process creates a connection to
the vulnerable server, and then immediately closes it. The server is
unable to properly deal with this condition and will therefore crash.
This vulnerability was reported for Crob FTP Server 3.5.2, however earlier
versions may also be affected.
57. XFree86 CopyISOLatin1Lowered Font_Name Buffer Overflow Vulne...
BugTraq ID: 9652
Remote: No
Date Published: Feb 12 2004
Relevant URL: http://www.securityfocus.com/bid/9652
Summary:
XFree86 is a freely available open-source implementation of the X Window
System.
It has been reported that the XFree86 X Windows system is prone to a local
buffer overflow vulnerability. The issue arises from improper bounds
checking performed in the CopyISOLatin1Lowered() function on data before
it is copied into a 1024 byte buffer. Specifically, the size of data that
is permitted to be copied is taken from the size of the user-supplied
string, rather than the size of the intended buffer.
It has been reported that excessive data (2048 bytes) read from the
font.alias file, as a value for the lexToken argument of
CopyISOLatin1Lowered(), will overrun the bounds of the font_name buffer.
An attacker may exploit this issue to execute arbitrary code within the
context of the XFree86 process, potentially gaining root privileges on the
affected system.
This issue has been reported to affect version 4.1.0 through 4.3.0
inclusive; it is likely however that this issue affects earlier versions
of the software as well.
58. AIM Sniff Temporary File Symlink Attack Vulnerability
BugTraq ID: 9653
Remote: No
Date Published: Feb 12 2004
Relevant URL: http://www.securityfocus.com/bid/9653
Summary:
AIM Sniff is a network reconnaissance tool that is used to specifically
target AIM traffic.
AIM Sniff has been reported prone to a Symbolic link vulnerability. The
issue presents itself, because the aimSniff.pl script creates temporary
files in an insecure manner. Specifically, when the aimSniff.pl script is
invoked (And debugging mode is enabled) a temporary file "/tmp/AS.log" is
created. To exploit this issue, a local attacker may create a symbolic
link in the "tmp" directory in place of the "/tmp/AS.log" file. The link
will point to an arbitrary file that the attacker wishes to target. When
the vulnerable script is invoked, operations that were supposed for the
temporary file will be carried out on the file that is linked by the
malicious symbolic link.
An attacker may exploit this issue to corrupt arbitrary files. This
corruption may potentially result in the elevation of privileges, or in a
system wide denial of service.
It has been reported that a user will require root privileges to invoke
the affected script; this may magnify the impact of this vulnerability.
59. Mailmgr Insecure Temporary File Creation Vulnerabilities
BugTraq ID: 9654
Remote: No
Date Published: Feb 12 2004
Relevant URL: http://www.securityfocus.com/bid/9654
Summary:
Mailmgr is an application for analyzing Sendmail logs and generating
reports in HTML. It is available for Unix/Linux variants.
Mailmgr is reportedly to be prone to a vulnerability related to temporary
file handling. The specific issue is that a number of temporary files are
created in an insecure manner, potentially providing malicious local users
with an opportunity to launch symbolic link attacks and cause files to be
corrupted.
The following temporary files are created in an insecure manner:
/tmp/mailmgr.unsort
/tmp/mailmgr.tmp
/tmp/mailmgr.sort
It is possible to create a symbolic link that is named after one of these
files. When the program is run by another user, any operations that were
intended to be performed on these files (such as creating them or
appending to them), would actually be performed on the file pointed to by
the symbolic link. The only caveat is that the user running the
application must have permission to write to the file pointed to by the
symbolic link. This would most likely result in a denial of service or
destruction of data as critical or sensitive files may be corrupted, but
under some circumstances this type of vulnerability could lead to elevated
privileges. The possibility of exploiting these particular issues to gain
elevated privileges has not been confirmed.
This issue was reported to exist in Mailmgr 1.2.3. Other versions are
also likely affected.
60. XFree86 Unspecified Vulnerability
BugTraq ID: 9655
Remote: Unknown
Date Published: Feb 12 2004
Relevant URL: http://www.securityfocus.com/bid/9655
Summary:
XFree86 is a freely available open-source implementation of the X Window
System.
XFree86 has been reported prone to an unspecified vulnerability
(CAN-2004-0106). It is likely that this issue is related to BID 9652
(XFree86 CopyISOLatin1Lowered Font_Name Buffer Overflow Vulnerability) and
BID 9636 (XFree86 Font Information File Buffer Overflow Vulnerability),
although this has not been confirmed. The issue is reported to present
itself due to programming flaws in procedures used to parse or read font
files.
It is believed that this issue affects version 4.1.0 through 4.3.0
inclusive, just like BIDs 9652 and 9636; it is likely however that this
issue also affects earlier versions of the software as well.
This BID will be updated as further details regarding this issue are
disclosed.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Exploit based on leaked Windows code released
By: Patrick Gray
A vulnerability in Internet Explorer 5 is the first to surface from last
week's source code spill.
http://www.securityfocus.com/news/8060
2. Software Bug Contributed to Blackout
By: Kevin Poulsen
As the August 14th blackout began, a flaw buried in widely-deployed
General Electric energy management software kept control room operators in
the dark.
http://www.securityfocus.com/news/8016
3. Cable modem hackers conquer the co-ax
By: Kevin Poulsen
A cunning international group of renegade coders raise cable modem hacking
to a whole new level by tinkering with firmware. But all members really
want is a steady job.
http://www.securityfocus.com/news/7977
4. Police arrest Forces Reunited 'hacker'
By: John Leyden, The Register
http://www.securityfocus.com/news/8058
5. Anti-virus industry: white knight or black hat?
By: Richard Forno, The Register
http://www.securityfocus.com/news/8057
6. Rebooting on Mars
By: Matthew Fordahl, The Associated Press
http://www.securityfocus.com/news/8054
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. NetCallback v1.3.1
By: Alexander V. Konstantinou
Relevant URL: http://netcallback.sourceforge.net/
Platforms: Java
Summary:
NetCallback is a Java application permitting the export of TCP and UDP
ports behind a firewall to hosts outside the firewall. This may be useful
in some special cases, for example, centralized control of test (demo)
networks, or connection to applets running in browsers. NetCallback
consists of a public and a private server. The public server executes on a
host outside the firewall and is responsible for receiving port forwarding
requests. The private server is run on a host behind the firewall and is
responsible for contacting the public server and connecting the protected
TCP and/or UDP service to the public server clients. The connection
between public and private servers may optionally be encrypted using SSL.
2. pfflowd v0.4
By: Damien Miller
Relevant URL: http://www.mindrot.org/pfflowd.html
Platforms:
Summary:
pfflowd is a small daemon which converts real-time state expiry messages
from OpenBSD's PF packet filter into Cisco NetFlow datagrams. This allows
very fine- grained traffic accounting in conjunction with NetFlow capable
tools and places almost no incremental load on a PF firewall.
3. CECID v1.0.0
By: covox
Relevant URL: http://cecid.sourceforge.net
Platforms: Os Independent
Summary:
CECID (The CEnsorship CIrcumvention Device) is a PHP script designed to
anonymize and filter HTTP requests, especially for users behind
restrictive firewalls (e.g. workplaces, schools, etc.). It remotely loads
a page that a user specifies, and filters it for words on its 'weighted
phrase list', a list of words commonly blocked by network administrators.
It alters these words to avoid detection, and displays the page requested.
It can also be used for anonymizing HTTP requests, for situations where
cloaking and security are required.
4. beltane v2.0.5 (2.x)
By: rainer
Relevant URL: http://www.la-samhna.de/beltane/
Platforms: Linux
Summary:
Beltane is a Web-based central management console for the samhain file
integrity system. If samhain is used in a client/server setup, beltane
enables the administrator to browse client reports, acknowledge them, and
update file signature databases stored centrally on the log server.
5. Samhain v1.8.3
By: rainer
Relevant URL: http://la-samhna.de/samhain/
Platforms: AIX, Digital UNIX/Alpha, FreeBSD, HP-UX, Linux, Solaris,
Unixware
Summary:
samhain is a daemon that can check file integrity, search the file tree
for SUID files, and detect kernel module rootkits (Linux only). It can be
used either standalone or as a client/server system for centralized
monitoring, with strong (192-bit AES) encryption for client/server
connections and the option to store databases and configuration files on
the server. For tamper resistance, it supports signed
database/configuration files and signed reports/audit logs. It has been
tested on Linux, FreeBSD, Solaris, AIX, HP-UX, and Unixware.
6. pwsafe v0.1.4
By: N. Dade
Relevant URL: http://nsd.dyndns.org/pwsafe/
Platforms: POSIX
Summary:
pwsafe is a command line password database program for Unix. It is
compatible with Counterpane's Win32 Password Safe software. It can also
copy the passwords into the X selection and clipboard, but it doesn't open
a visible window. The encrypted password database uses the same format as
Password Safe 1.9.x. The database is encrypted with blowfish, and a single
passphrase decrypts it all.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Senior Business Development Consultant - Switzerland (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353977
2. Director of Sales & Marketing - Switzerland (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353974
3. SW Engineer - Client Development - SF Bay Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353973
4. Compliance Professionals with Sarbanes-Oxley, Gramm-... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353972
5. SW Engineer - FIPS/Common Criteria - SF Bay Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353971
6. SW Engineer - NW Management - SF Bay Area - Contract (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353970
7. 3 Check Point Firewall-1 engineering positions in So... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353965
8. VoIP Fraud Developer needed! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353963
9. Security Risk Assessment (NYC-NJ) (financial Industr... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353962
10. <job> Security Applications Sale Engineer-NY City Fu... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353817
11. BIS seeks Senior Systems Analyst in security (based... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353802
12. Sr. Software Architect - Silicon Valley (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353763
13. Linux Security Developer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353762
14. Software Engineers, INFOSEC, Network - OPEN HOUSE in... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353761
15. [repost] job seeker (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353733
16. Electronic Security / Physical Security Professional... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353730
17. D.C. Metro area interview availability 17-19 Februar... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353703
18. Jr. Level Perimeter Security - Los Angeles (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353702
19. Security and Privacy Manages in VA/DC - Federal Mark... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353682
20. Security/Privacy Auditor needed- Providence Health, ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353671
21. Application Security Engineer: Senior Consultant (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353670
22. Senior Associate - Threat and Vulnerability, VA/DC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353669
23. Security Audit Principal Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353618
24. MetaFrame Password Manager Sr. Security Software Dev... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353617
25. MetaFrame Secure Access Manager Sr. Security Softwar... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353616
26. Channel Sales New Jersey (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353594
27. Junior Security Pre Sales - Tampa, FL (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353587
28. Senior Forensics / CIRT Team Lead Needed ASAP (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353580
29. Security Product Implementation - Herndon/DC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353568
30. Full time and Contract positions for Chicago and New... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353562
31. eBay - Principal Software Engineer: Security (Requis... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353556
32. Information Security Consultant, London, UK (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353552
33. Web Services/Application Security Engineering Positi... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353547
34. IT Audit and Security Risk Assessment Positions in (... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353541
35. Sr. Security Software Developer at Citrix Systems in... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353538
36. Looking for a position in the Wash D.C/Baltimore MD ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353533
37. Information Security Incident Response, Forensics & ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353529
38. CS security engineer with JAVA experience for securi... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353527
39. Research Engineer Position at Sourcefire - Columbia,... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353509
40. Security Software Developer at Citrix Systems in For... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353506
41. Security Consultants / Architect roles in the United... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353498
42. IT Security Pre-Sales role in Thames Valley , United... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353497
43. IT Security & Continuity Consultant vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/353490
VI. INCIDENTS LIST SUMMARY
--------------------------
1. Something new? bind dos? exploit? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/353978
2. WebDav Worm? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/353976
3. buddylinks worm (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/353857
4. New article announcement: Automating Windows Patch M... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/353773
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. iis 5 %00 null weirdness (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/353938
2. rsync <= 2.5.7 local buffer overflow (no root today:... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/353227
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. PPTP versus L2TP and possible attacks (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/353984
2. PPTP versus L2TP and possible attacks - what next? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/353982
3. Article Announcement: Wireless Honeypot Trickery (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/353981
4. Command Line Interface for Windows Server 2003 Zippe... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/353790
5. Article Announcement: Automating Windows Patch Manag... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/353605
6. MS04-006 patch.. error in verbage? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/353351
7. Looking for SQL security details (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/353283
8. SecurityFocus Microsoft Newsletter #175 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/353282
9. Looking for SQL security details (Version 2) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/353277
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. firewall settings for Solstice Backup 6.1 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/353908
2. Limit NFS on network adapter (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/353906
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. exporting sudoers, good pratcice ? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/353135
XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
[email protected] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer.
Alternatively you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.
If your email address has changed email [email protected] and
ask to be manually removed.
XII. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Spidynamics
ALERT: Attacking SOAP Web Services and Methods of Protection- White Paper
Are you vulnerable? This white paper will cover various types of attacks
based on the SOAP implementation of Web services over HTTP and describes
how you can shield your applications from these assaults Learn how to
defend against Web services attacks with real step- by- step examples of
hacking methods such as: SQL Injection, Cross Site Scripting and Parameter
Manipulation.
http://www.securityfocus.com/sponsor/SPIDynamics_sf-news_040216
------------------------------------------------------------------------