SecurityFocus Newsletter #327

Peter Laborge <[email protected]> Tue, 06 Dec 2005 14:19:14 -0700

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #327
----------------------------------------

This Issue is Sponsored By: Watchfire AppScan

Available now! AppScan version 6.0. Others can assess web applications for vulnerabilities. Only AppScan shows you how to fix them. See for yourself. Evaluate AppScan 6.0 today.

https://www.watchfire.com/securearea/appscanauditdownload.aspx?id=701300000002gRE

------------------------------------------------------------------
I. FRONT AND CENTER
1. Evading NIDS, revisited
2. Regaining control
II. BUGTRAQ SUMMARY
1. PBLang Bulletin Board System Multiple HTML Injection Vulnerabilities
2. Athena PHP Website Administration Remote File Include Vulnerability
3. PHPGreetz Remote File Include Vulnerability
4. Q-News Remote File Include Vulnerability
5. Unalz Archive Filename Buffer Overflow Vulnerability
6. Enterprise Connector SQL Injection Vulnerabilities
7. Zainu SQL Injection Vulnerabilities
8. Babe Logger SQL Injection Vulnerabilities
9. Top Music Module SQL Injection Vulnerabilities
10. PHPWordPress Multiple SQL Injection Vulnerabilities
11. Bedeng PSP SQL Injection Vulnerabilities
12. Nelogic Nephp Publisher SQL Injection Vulnerabilities
13. Softbiz Resource Repository Script SQL Injection Vulnerabilities
14. BerliOS SourceWell SQL Injection Vulnerability
15. AllWeb Search SQL Injection Vulnerability
16. K-Search SQL Injection Vulnerabilities
17. EdmoBBS SQL Injection Vulnerabilities
18. JBB SQL Injection Vulnerabilities
19. UGroup SQL Injection Vulnerabilities
20. ShockBoard Offset Parameter SQL Injection Vulnerability
21. Netzbrett P_Entry Parameter SQL Injection Vulnerability
22. SimpleBBS Search Module Parameters SQL Injection Vulnerability
23. ADC2000 NG Pro SQL Injection Vulnerabilities
24. Simple Document Management System SQL Injection Vulnerabilities
25. Nicecoder iDesk FAQ.PHP SQL Injection Vulnerability
26. PDJK-support Suite Multiple SQL Injection Vulnerabilities
27. Randshop Multiple SQL Injection Vulnerabilities
28. KTools Remote Buffer Overflow Vulnerability
29. FreeWebStat Multiple Cross-Site Scripting Vulnerabilities
30. Cisco IOS HTTP Service HTML Injection Vulnerability
31. PHP Web Statistik Content Injection Vulnerabilities
32. Helpdesk Issue Manager Multiple SQL Injection Vulnerabilities
33. OASYS Lite Search.ASP Cross-Site Scripting Vulnerability
34. WebCalendar Multiple SQL Injection Vulnerabilities
35. OKBSYS Lite Search.ASP Cross-Site Scripting Vulnerability
36. WebCalendar Export_Handler.PHP File Corruption Vulnerability
37. GuppY Error.PHP Remote File Include and Command Execution Vulnerability
38. GuppY Multiple Local File Include and Information Disclosure Vulnerabilities
39. PHP Doc System Local File Include Vulnerability
40. SearchSolutions Multiple Products Cross-Site Scripting Vulnerabilities
41. Microsoft Windows SynAttackProtect Predictable Hash Remote Denial of Service Vulnerability
42. Gallery Multiple Input Validation Vulnerabilities
43. Sun Java Runtime Environment Multiple Privilege Escalation Vulnerabilities
44. Panda Software Antivirus Library ZOO Archive Heap Overflow Vulnerability
45. ASP-Rider Default.ASP SQL Injection Vulnerability
46. Cisco Security Agent Unspecified Local Privilege Escalation Vulnerability
47. QNX Phgrafx Local Buffer Overflow Vulnerability
48. Kadu Remote Denial of Service Vulnerability
49. PHP Upload Center Index.PHP Directory Traversal Vulnerability
50. Fantastic Scripts Fantastic News News.PHP SQL Injection Vulnerability
51. Xaraya Directory Traversal Vulnerability
52. DotClear Unspecified Trackback Vulnerability
53. Linux Kernel PTraced Child Auto-Reap Local Denial of Service Vulnerability
54. PHP Upload Center Directory Traversal Vulnerability
55. Linux Kernel Time_Out_Leases PrintK Local Denial of Service Vulnerability
56. DMANews Multiple SQL Injection Vulnerabilities
57. Perl Perl_sv_vcatpvfn Format String Integer Wrap Vulnerability
58. DRZES HMS Register_domain.PHP Cross-Site Scripting Vulnerability
59. Entergal MX Multiple SQL Injection Vulnerabilities
60. BosDates Multiple SQL Injection Vulnerabilities
61. Post Affiliate Pro Index.PHP SQL Injection Vulnerability
62. GhostScripter Amazon Shop Search.PHP SQL Injection Vulnerability
63. KBase Express Multiple SQL Injection Vulnerabilities
64. ltwCalendar Calendar.PHP SQL Injection Vulnerability
65. Orca Knowledgebase Knowledgebase.PHP SQL Injection Vulnerability
66. Orca Blog Blog.PHP SQL Injection Vulnerability
67. Orca Ringmaker Ringmaker.PHP SQL Injection Vulnerability
68. FAQ System Multiple SQL Injection Vulnerabilities
69. Survey System Survey.PHP SQL Injection Vulnerability
70. Linux Kernel PTrace CLONE_THREAD Local Denial of Service Vulnerability
71. N-13 News SQL Injection Vulnerability
72. DRZES HMS Multiple SQL Injection Vulnerabilities
73. NuFW Malformed Packet Remote Denial Of Service Vulnerability
74. pcAnywhere Authentication Denial of Service Vulnerability
75. Apple Mac OS X Security Update 2005-009 Multiple Vulnerabilities
76. CenterICQ Malformed Packet Handling Remote Denial of Service Vulnerability
77. SocketKB Index.PHP SQL Injection Vulnerability
78. PHPAlbum Local File Include Vulnerability
79. Softbiz B2B Trading Marketplace Multiple SQL Injection Vulnerabilities
80. Softbiz FAQ Multiple SQL Injection Vulnerabilities
81. Atlantis Knowledge Base Search.PHP SQL Injection Vulnerability
82. FAQRing Answer.PHP SQL Injection Vulnerability
83. WSN Knowledge Base Multiple SQL Injection Vulnerabilities
84. O-Kiraku Nikki Nikki.PHP SQL Injection Vulnerability
85. 88Scripts Event Calendar Index.PHP SQL Injection Vulnerability
86. Instant Photo Gallery Multiple SQL Injection Vulnerabilities
87. Microsoft Internet Explorer CSS Import Cross-Domain Restriction Bypass Vulnerability
88. Tradesoft CMS Multiple SQL Injection Vulnerabilities
89. WebCalendar Multiple SQL Injection Vulnerabilities
90. Drupal Image Upload HTML Injection Vulnerability
91. Citrix Multiple Applications Login Form Cross-Site Scripting Vulnerability
92. Lore Article.PHP SQL Injection Vulnerability
93. Astaro Security Linux ISAKMP IKE Traffic Denial of Service Vulnerability
94. DotClear Session.PHP SQL Injection Vulnerability
95. Avaya TN2602AP IP Media Resource 320 Remote Denial of Service Vulnerability
96. FastJar Archive Extraction Directory Traversal Vulnerability
97. Microsoft Windows CreateRemoteThread Local Denial of Service Vulnerability
98. MXChange Multiple Unspecified Input Validation Vulnerabilities
99. WebCalendar Layers_Toggle.PHP HTTP Response Splitting Vulnerability
100. Drupal View User Profile Authorization Bypass Vulnerability
III. SECURITYFOCUS NEWS
1. Federal flaw database commits to grading system
2. Mac OS X security under scrutiny
3. Texas puts Sony BMG in its sights
4. Sony BMG's copy-protection problems grow
5. Skype under scrutiny for bugs
6. Say hello to the Skype Trojan
7. Shared music abuse bug hits iTunes
8. US cybersecurity all at sea
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Auditor, Washington
2. [SJ-JOB] Security Auditor, Baltimore
3. [SJ-JOB] Auditor, Baltimore
4. [SJ-JOB] Information Assurance Engineer, Washington
5. [SJ-JOB] Account Manager, Atlanta
6. [SJ-JOB] Security Auditor, Raleigh
7. [SJ-JOB] Auditor, Raleigh
8. [SJ-JOB] Auditor, Philadelphia
9. [SJ-JOB] Security Auditor, Richmond
10. [SJ-JOB] Sales Representative, Sacramento
11. [SJ-JOB] Sales Representative, Pittsburgh
12. [SJ-JOB] Auditor, Richmond
13. [SJ-JOB] Security Auditor, Philadelphia
14. [SJ-JOB] Security Auditor, Chicago
15. [SJ-JOB] Security Auditor, Dallas
16. [SJ-JOB] Auditor, Chicago
17. [SJ-JOB] Auditor, Dallas
18. [SJ-JOB] Technical Editor, Kenitra
19. [SJ-JOB] Sales Engineer, Central United States
20. [SJ-JOB] Security Engineer, Reston
21. [SJ-JOB] Sales Engineer, West / West Coast
22. [SJ-JOB] Security Engineer, Ft. Lauderdale
23. [SJ-JOB] Sales Representative, Ft. Lauderdale
24. [SJ-JOB] Auditor, Detroit
25. [SJ-JOB] Security Auditor, Detroit
26. [SJ-JOB] Auditor, New York
27. [SJ-JOB] Security Auditor, New York
28. [SJ-JOB] Developer, New York
29. [SJ-JOB] Security Engineer, Cupertino
30. [SJ-JOB] Sr. Security Engineer, Cupertino
31. [SJ-JOB] Technical Marketing Engineer, Redwood City
32. [SJ-JOB] Account Manager, Washington
33. [SJ-JOB] Security Auditor, Boston
34. [SJ-JOB] Security Engineer, Alexandria
35. [SJ-JOB] VP of Marketing, London or Milton Keynes (prefered)
36. [SJ-JOB] Security Architect, Brussels
37. [SJ-JOB] Sales Representative, Newport Beach, CA
38. [SJ-JOB] Auditor, Columbus
39. [SJ-JOB] Security Auditor, Columbus
40. [SJ-JOB] Auditor, Atlanta
41. [SJ-JOB] Security System Administrator, New York
42. [SJ-JOB] Information Assurance Engineer, Clarksburg (Montgomery County)
43. [SJ-JOB] Director, Information Security, ST. PETERSBURG
44. [SJ-JOB] Security Consultant, London
45. [SJ-JOB] Security Architect, New York
46. [SJ-JOB] Security Engineer, Boston
47. [SJ-JOB] Instructor, Sacramento
48. [SJ-JOB] Security Auditor, Riyadh
49. [SJ-JOB] Auditor, Los Angeles
50. [SJ-JOB] Auditor, Miami
51. [SJ-JOB] Security Auditor, Miami
52. [SJ-JOB] Security Auditor, Atlanta
53. [SJ-JOB] Security Auditor, Los Angeles
V. INCIDENTS LIST SUMMARY
1. administrivia: bounces, vacation messages, etc...
2. DNS Query Details from 209.200.168.66
3. Strange DNS queries
VI. VULN-DEV RESEARCH LIST SUMMARY
VII. MICROSOFT FOCUS LIST SUMMARY
1. Changing local admin PW using vb logon script - can it be encrypted?
2. Changing local admin PW using vb logon script - can it be encrypted?
3. Prohibiting Index Server does not prevent information leakage in IIS 6.0
4. SecurityFocus Microsoft Newsletter #267
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
1. Security, Distributed firewalling application...long ;-)
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Evading NIDS, revisited
By Sumit Siddharth
This article looks at some of the most popular IDS evasion attack techniques, based on fragmentation or using the TTL field. Snort's configuration and response to these attacks will also be discussed.
http://www.securityfocus.com/infocus/1852

2. Regaining control
By Kelly Martin
Securing endpoint systems by locking them down using complex software brings back memories of another era, where business computers were once used for business applications only - and businesses retained control over their assets and data.
http://www.securityfocus.com/columnists/372

II. BUGTRAQ SUMMARY
--------------------
1. PBLang Bulletin Board System Multiple HTML Injection Vulnerabilities
BugTraq ID: 15573
Remote: Yes
Date Published: 2005-11-26
Relevant URL: http://www.securityfocus.com/bid/15573
Summary:
PBLang is prone to multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Other similar HTML injection issues have been documented for PBLang version 4.65. This issue may be related to those documented in the following BIDs:
- 14728, PBLang Bulletin Board System Multiple Remote Vulnerabilities
- 14766, PBLang Bulletin Board System HTML Injection Vulnerability

2. Athena PHP Website Administration Remote File Include Vulnerability
BugTraq ID: 15574
Remote: Yes
Date Published: 2005-11-26
Relevant URL: http://www.securityfocus.com/bid/15574
Summary:
Athena PHP Website Administration is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

3. PHPGreetz Remote File Include Vulnerability
BugTraq ID: 15575
Remote: Yes
Date Published: 2005-11-26
Relevant URL: http://www.securityfocus.com/bid/15575
Summary:
phpGreetz is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

4. Q-News Remote File Include Vulnerability
BugTraq ID: 15576
Remote: Yes
Date Published: 2005-11-26
Relevant URL: http://www.securityfocus.com/bid/15576
Summary:
Q-News is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

5. Unalz Archive Filename Buffer Overflow Vulnerability
BugTraq ID: 15577
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15577
Summary:
unalz is prone to a buffer overflow vulnerability. This issue is exposed when the application extracts an ALZ archive that contains a file with a long name.

This vulnerability could be exploited to execute arbitrary code in the context of the user who extracts a malicious archive.

6. Enterprise Connector SQL Injection Vulnerabilities
BugTraq ID: 15578
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15578
Summary:
Enterprise Connector is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

7. Zainu SQL Injection Vulnerabilities
BugTraq ID: 15579
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15579
Summary:
Zainu is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

8. Babe Logger SQL Injection Vulnerabilities
BugTraq ID: 15580
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15580
Summary:
Babe Logger is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

9. Top Music Module SQL Injection Vulnerabilities
BugTraq ID: 15581
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15581
Summary:
Top Music Module for PHP-Nuke is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

10. PHPWordPress Multiple SQL Injection Vulnerabilities
BugTraq ID: 15582
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15582
Summary:
PHPWordPress is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

PHPWordPress versions up to and including 3.0 are reported to be vulnerable; other versions may also be affected.

11. Bedeng PSP SQL Injection Vulnerabilities
BugTraq ID: 15583
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15583
Summary:
Bedeng PSP is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

12. Nelogic Nephp Publisher SQL Injection Vulnerabilities
BugTraq ID: 15584
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15584
Summary:
Nelogic Nephp Publisher is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

13. Softbiz Resource Repository Script SQL Injection Vulnerabilities
BugTraq ID: 15585
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15585
Summary:
Softbiz Resource Repository Script is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

14. BerliOS SourceWell SQL Injection Vulnerability
BugTraq ID: 15586
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15586
Summary:
BerliOS SourceWell is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

15. AllWeb Search SQL Injection Vulnerability
BugTraq ID: 15587
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15587
Summary:
AllWeb Search is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

16. K-Search SQL Injection Vulnerabilities
BugTraq ID: 15588
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15588
Summary:
K-Search is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

17. EdmoBBS SQL Injection Vulnerabilities
BugTraq ID: 15589
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15589
Summary:
edmoBBS is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

18. JBB SQL Injection Vulnerabilities
BugTraq ID: 15590
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15590
Summary:
JBB is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

19. UGroup SQL Injection Vulnerabilities
BugTraq ID: 15591
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15591
Summary:
UGroup is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

20. ShockBoard Offset Parameter SQL Injection Vulnerability
BugTraq ID: 15592
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15592
Summary:
ShockBoard is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

21. Netzbrett P_Entry Parameter SQL Injection Vulnerability
BugTraq ID: 15593
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15593
Summary:
Netzbrett is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

22. SimpleBBS Search Module Parameters SQL Injection Vulnerability
BugTraq ID: 15594
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15594
Summary:
SimpleBBS is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

23. ADC2000 NG Pro SQL Injection Vulnerabilities
BugTraq ID: 15595
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15595
Summary:
ADC2000 NG Pro is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

24. Simple Document Management System SQL Injection Vulnerabilities
BugTraq ID: 15596
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15596
Summary:
Simple Document Management System (SDMS) is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

25. Nicecoder iDesk FAQ.PHP SQL Injection Vulnerability
BugTraq ID: 15597
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15597
Summary:
Nicecoder iDesk is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Version 1.0 is reported to be vulnerable; other versions may also be affected.

26. PDJK-support Suite Multiple SQL Injection Vulnerabilities
BugTraq ID: 15598
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15598
Summary:
PDJK-support Suite is prone to multiple SQL injection vulnerabilities. These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

PDJK-support retail version 1.1a is reported to be vulnerable; other versions may also be affected.

27. Randshop Multiple SQL Injection Vulnerabilities
BugTraq ID: 15599
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15599
Summary:
Randshop is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

All versions of Randshop are reported to be affected.

28. KTools Remote Buffer Overflow Vulnerability
BugTraq ID: 15600
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15600
Summary:
ktools is prone to a remote buffer overflow vulnerability.

An attacker may execute arbitrary code with the privileges of the application and gain unauthorized remote access.

ktools 0.3 and prior versions are vulnerable to this issue.

29. FreeWebStat Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 15601
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15601
Summary:
FreeWebStat is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

FreeWebStat version 1.0 rev37 is reported to affected; other versions may also be vulnerable.

30. Cisco IOS HTTP Service HTML Injection Vulnerability
BugTraq ID: 15602
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15602
Summary:
Cisco IOS HTTP service is reportedly prone to an HTML injection vulnerability.

An attacker can submit malicious HTML and script code through the '/level/15/exec/-/buffers/assigned' and /level/15/exec/-/buffers/all' scripts. This code may be executed in the browser of an administrator when they attempt to view the contents of memory buffers through the vulnerable scripts of the HTTP service.

This vulnerable has been reported to affect versions of IOS from 11.0 through 12.4. Cisco IOS XR is not vulnerable. As this is a HTML injection vulnerability that targets users of the IOS web interface, devices with the HTTP service disabled are not affected.

Cisco has confirmed this advisory. See Cisco security advisory "cisco-sa-20051201-http" in the reference section.

31. PHP Web Statistik Content Injection Vulnerabilities
BugTraq ID: 15603
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15603
Summary:
PHP Web Statistik is prone to multiple content injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. The vulnerabilities could allow for HTML injection and cross-site scripting attacks.

An attacker may leverage these issues to have arbitrary script and HTML code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials, and also exploit these issues to control how the site is rendered to the user.

32. Helpdesk Issue Manager Multiple SQL Injection Vulnerabilities
BugTraq ID: 15604
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15604
Summary:
Helpdesk Issue Manager is prone to multiple SQL injection vulnerabilities.

Helpdesk Issue Manager 0.9 and prior versions are reportedly affected.

33. OASYS Lite Search.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 15605
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15605
Summary:
OASYS Lite is prone to a cross-site scripting vulnerability affecting the 'search.asp' script.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

OASYS Lite 1.0 and prior versions are affected.

34. WebCalendar Multiple SQL Injection Vulnerabilities
BugTraq ID: 15606
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15606
Summary:
WebCalendar is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

WebCalendar version 1.0.1 is reported to be vulnerable; other versions may also be affected.

35. OKBSYS Lite Search.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 15607
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15607
Summary:
OKBSYS Lite is prone to a cross-site scripting vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'search.asp' script.

This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

OKBSYS Lite 1.0 and prior versions are affected.

36. WebCalendar Export_Handler.PHP File Corruption Vulnerability
BugTraq ID: 15608
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15608
Summary:
WebCalendar is prone to a file corruption vulnerability. This is due to a lack of proper validation of user-supplied input.

An attacker may leverage this issue to corrupt files with the privileges of an unsuspecting user running a vulnerable version of the affected application.

Version 1.0.1 is reported to be vulnerable; other versions may also be affected.

37. GuppY Error.PHP Remote File Include and Command Execution Vulnerability
BugTraq ID: 15609
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15609
Summary:
GuppY is prone to a remote file include vulnerability.

Data supplied to the 'error.php' script is not properly sanitized, allowing attackers to specify remotely-hosted script files to be executed in the context of the Web server hosting the vulnerable software.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process.

An attacker can also pass malicious PHP commands through this script to be executed on an affected server, which could facilitate unauthorized access as well.

GuppY 4.5.9 and prior versions are vulnerable.

38. GuppY Multiple Local File Include and Information Disclosure Vulnerabilities
BugTraq ID: 15610
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15610
Summary:
GuppY is affected by multiple local file include and information disclosure vulnerabilities.

An attacker may leverage these issues to execute arbitrary server-side script code that resides on an affected computer with the privileges of the Web server process. This may potentially facilitate unauthorized access.

It should be noted that these issues may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. An attacker can employ directory traversal sequences and NULL characters to disclose arbitrary files.

GuppY 4.5.9 and prior versions are vulnerable.

39. PHP Doc System Local File Include Vulnerability
BugTraq ID: 15611
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15611
Summary:
PHP Doc System is prone to a local file include vulnerability. This is due to a lack of proper sanitization of user-supplied input.

This may facilitate the unauthorized viewing of files and unauthorized execution of local PHP code.

PHP Doc System 1.5.1 and prior versions are reported to be vulnerable; other versions may also be affected.

40. SearchSolutions Multiple Products Cross-Site Scripting Vulnerabilities
BugTraq ID: 15612
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15612
Summary:
SearchSolutions SearchFeed, RevenuePilot, and Google API are prone to cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

41. Microsoft Windows SynAttackProtect Predictable Hash Remote Denial of Service Vulnerability
BugTraq ID: 15613
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15613
Summary:
Microsoft Windows is prone to a denial of service vulnerability.

The vulnerability arises due to a design error in the function responsible for the hash table management for 'SynAttackProtect'. Reports indicate that the affected function used by the TCP/IP stack creates a predictable hash, allowing an attacker to send a large number of SYN packets with an identical hash value.

A successful attack can eventually lead to a denial of service condition due to the lookup algorithm becoming very inefficient at performing searches.

42. Gallery Multiple Input Validation Vulnerabilities
BugTraq ID: 15614
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15614
Summary:
Gallery is prone to cross-site scripting and information disclosure vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

An attacker may leverage the information disclosure issue to allow disclosure of authentication credentials and all content within the context of the affected Web server application. It should be noted that site administrators can deactivate this module to disarm the flaw.

No further details have been provided.

The vendor has released version 2.0.2 to address the issue.

43. Sun Java Runtime Environment Multiple Privilege Escalation Vulnerabilities
BugTraq ID: 15615
Remote: Yes
Date Published: 2005-11-28
Relevant URL: http://www.securityfocus.com/bid/15615
Summary:
Sun JRE is susceptible to various privilege escalation vulnerabilities.

These issues can allow remote Java applications to read/write local files and execute arbitrary applications in the context of an affected user.

Further details are not available at this time. This BID will be updated as further information is disclosed.

44. Panda Software Antivirus Library ZOO Archive Heap Overflow Vulnerability
BugTraq ID: 15616
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15616
Summary:
Panda Software Antivirus products are prone to a heap overflow vulnerability. This issue is exposed when the antivirus library attempts to decompress ZOO archive files.

Successful exploitation will result in execution of arbitrary code in the context of an affected application. The issue could affect desktop, gateway, and server antivirus applications on supported platforms. A number of third-party applications may also employ the affected library and could also be vulnerable. A conclusive list of affected products is not available at this time.

45. ASP-Rider Default.ASP SQL Injection Vulnerability
BugTraq ID: 15617
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15617
Summary:
ASP-Rider is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

46. Cisco Security Agent Unspecified Local Privilege Escalation Vulnerability
BugTraq ID: 15618
Remote: No
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15618
Summary:
Cisco Security Agent is susceptible to an unspecified local privilege escalation vulnerability. This issue only affects computers running affected versions of Cisco Security Agent on the Microsoft Windows platform.

Further details are not currently available, this BID will be updated as information becomes available.

This issue allows local attackers to gain SYSTEM level privileges on computers running the affected software.

47. QNX Phgrafx Local Buffer Overflow Vulnerability
BugTraq ID: 15619
Remote: No
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15619
Summary:
QNX phgrafx is prone to a local buffer overflow vulnerability.

Reports indicate that the affected utility has setuid-superuser privileges, which allows a successful attack to result in arbitrary machine code execution with superuser privileges.

QNX 6.3.0 is reportedly vulnerable, however, it is possible that other versions are affected as well.

48. Kadu Remote Denial of Service Vulnerability
BugTraq ID: 15620
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15620
Summary:
Kadu is prone to a remote denial of service vulnerability.

Reports indicate that this vulnerability presents itself when the client handles a specially crafted message from a Gadu-Gadu server.

Kadu 0.4.2 and 0.5.0pre were reported to be vulnerable. Other versions may be affected as well.

49. PHP Upload Center Index.PHP Directory Traversal Vulnerability
BugTraq ID: 15621
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15621
Summary:
PHP Upload Center is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

An attacker can exploit this issue to retrieve arbitrary remote files on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

50. Fantastic Scripts Fantastic News News.PHP SQL Injection Vulnerability
BugTraq ID: 15622
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15622
Summary:
Fantastic News is prone to an SQL injection vulnerability.

Fantastic News 2.1.1 and prior versions are affected.

51. Xaraya Directory Traversal Vulnerability
BugTraq ID: 15623
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15623
Summary:
Xaraya is prone to a directory traversal vulnerability.

Reports indicate that an attacker can supply directory traversal sequences through the 'module' parameter of the 'index.php' script to place files in arbitrary locations on a Web server.

If an attacker places malicious script files on a Web server and is able to execute them, this issue could facilitate a remote compromise. Other attacks including data corruption and denial of service are also possible.

Xaraya 1.0.0 RC4 and prior versions are affected.

52. DotClear Unspecified Trackback Vulnerability
BugTraq ID: 15624
Remote: Unknown
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15624
Summary:
DotClear is prone to an unspecified vulnerability relating to trackbacks.

No further details have been provided; this BID will be updated when further information is available.

DotClear version 1.2.1 is reported to be affected by this vulnerability; the vendor has released version 1.2.2 to address this issue.

53. Linux Kernel PTraced Child Auto-Reap Local Denial of Service Vulnerability
BugTraq ID: 15625
Remote: No
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15625
Summary:
Linux kernel is susceptible to a local denial of service vulnerability.

The kernel improperly auto-reaps processes when they are being ptraced, leading to an invalid pointer. Further operations on this pointer result in a kernel crash.

This issue allows local users to crash the kernel, denying service to legitimate users.

Kernel versions prior to 2.6.15 are vulnerable to this issue.

54. PHP Upload Center Directory Traversal Vulnerability
BugTraq ID: 15626
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15626
Summary:
PHP Upload Center is prone to a directory traversal vulnerability.

A remote attacker may exploit this vulnerability to reveal files that contain potentially sensitive information. Information that is harvested in this manner may then be used to aid in further attacks against the software and the computer that is hosting the software.

All versions of PHP Upload Center are considered to be vulnerable at the moment.

55. Linux Kernel Time_Out_Leases PrintK Local Denial of Service Vulnerability
BugTraq ID: 15627
Remote: No
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15627
Summary:
Linux kernel is susceptible to a local denial of service vulnerability.

This issue is triggered by consuming excessive kernel log memory by obtaining numerous file lock leases. Once the leases timeout, the event will be logged, and kernel memory will be consumed.

This issue allows local attackers to consume excessive kernel memory, eventually leading to an out-of-memory condition, and a denial of service for legitimate users.

Kernel versions prior to 2.6.15-rc3 are vulnerable to this issue.

56. DMANews Multiple SQL Injection Vulnerabilities
BugTraq ID: 15628
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15628
Summary:
DMANews is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 0.904 and 0.910 are vulnerable; other versions may also be affected.

57. Perl Perl_sv_vcatpvfn Format String Integer Wrap Vulnerability
BugTraq ID: 15629
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15629
Summary:
Perl is susceptible to a format string vulnerability. This issue is due to a failure of the programming language to properly handle format specifiers in formatted printing functions.

An attacker may leverage this issue to write to arbitrary process memory, facilitating code execution in the context of the Perl interpreter process. This can result in unauthorized remote access.

Developers should treat the formatted printing functions in Perl as equivalently vulnerable to exploitation as the C library versions, and properly sanitize all data passed in the format specifier argument.

All applications that utilize formatted printing functions in an unsafe manner should be considered exploitable.

58. DRZES HMS Register_domain.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 15630
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15630
Summary:
DRZES HMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

DRZES HMS version 3.2 and earlier are vulnerable; other versions may also be affected.

59. Entergal MX Multiple SQL Injection Vulnerabilities
BugTraq ID: 15631
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15631
Summary:
Entergal MX is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 2.0 and prior are vulnerable; other versions may also be affected.

60. BosDates Multiple SQL Injection Vulnerabilities
BugTraq ID: 15632
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15632
Summary:
BosDates is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 4.0 and prior are vulnerable; other versions may also be affected.

61. Post Affiliate Pro Index.PHP SQL Injection Vulnerability
BugTraq ID: 15633
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15633
Summary:
Post Affiliate Pro is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 2.0.4 and prior are vulnerable; other versions may also be affected.

62. GhostScripter Amazon Shop Search.PHP SQL Injection Vulnerability
BugTraq ID: 15634
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15634
Summary:
GhostScripter Amazon Shop is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 5.0.0 and prior are vulnerable; other versions may also be affected.

63. KBase Express Multiple SQL Injection Vulnerabilities
BugTraq ID: 15635
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15635
Summary:
KBase Express is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 1.0.0 and prior are vulnerable; other versions may also be affected.

64. ltwCalendar Calendar.PHP SQL Injection Vulnerability
BugTraq ID: 15636
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15636
Summary:
ltwCalendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 4.1.3 and prior are vulnerable; other versions may also be affected.

65. Orca Knowledgebase Knowledgebase.PHP SQL Injection Vulnerability
BugTraq ID: 15637
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15637
Summary:
Orca Knowledgebase is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Version 2.1b is vulnerable; other versions may also be affected.

66. Orca Blog Blog.PHP SQL Injection Vulnerability
BugTraq ID: 15638
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15638
Summary:
Orca Blog is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Version 1.3b is vulnerable; other versions may also be affected.

67. Orca Ringmaker Ringmaker.PHP SQL Injection Vulnerability
BugTraq ID: 15639
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15639
Summary:
Orca Ringmaker is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Version 2.3c is vulnerable; other versions may also be affected.

68. FAQ System Multiple SQL Injection Vulnerabilities
BugTraq ID: 15640
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15640
Summary:
FAQ System is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 1.1 and prior are vulnerable; other versions may also be affected.

69. Survey System Survey.PHP SQL Injection Vulnerability
BugTraq ID: 15641
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15641
Summary:
Survey System is prone to multiple SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 1.1 and prior are vulnerable; other versions may also be affected.

70. Linux Kernel PTrace CLONE_THREAD Local Denial of Service Vulnerability
BugTraq ID: 15642
Remote: No
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15642
Summary:
Linux kernel is susceptible to a local denial of service vulnerability.

In instances where a process is created via the 'clone' system call with the 'CLONE_THREAD' argument is ptraced, the kernel fails to properly ensure that the ptracing process is not attempting to trace itself.

This issue allows local users to crash the kernel, denying service to legitimate users.

Kernel versions prior to 2.6.14.2 are vulnerable to this issue.

71. N-13 News SQL Injection Vulnerability
BugTraq ID: 15643
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15643
Summary:
N-13 News is prone to an SQL injection vulnerability.

All versions of N-13 News are considered to be affected at the moment.

72. DRZES HMS Multiple SQL Injection Vulnerabilities
BugTraq ID: 15644
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15644
Summary:
DRZES HMS is prone to multiple SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before it is used in SQL queries.

DRZES HMS Version 3.2 and prior are reported to be vulnerable; earlier versions may also be affected.

73. NuFW Malformed Packet Remote Denial Of Service Vulnerability
BugTraq ID: 15645
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15645
Summary:
NuFW is susceptible to a remote denial of service vulnerability. This issue is due to a failure of the application to properly handle malformed network packets from authenticated users.

This issue results in the 'nuauth' application crashing, denying service to further users.

NuFW versions prior to 1.0.16, as well as the development version 1.1, are affected by this issue.

74. pcAnywhere Authentication Denial of Service Vulnerability
BugTraq ID: 15646
Remote: Yes
Date Published: 2005-11-29
Relevant URL: http://www.securityfocus.com/bid/15646
Summary:
Symantec pcAnywhere is vulnerable to a buffer overflow vulnerability. Because the flaw can be triggered prior to authentication, the vulnerability is exploitable by remote attackers without valid credentials. It is confirmed that the vulnerability can be exploited to cause a denial of service. Supported versions 11.0.1 and 11.5.1 are confirmed affected. Previous versions are vulnerable and users are advised to upgrade to the latest supported version.

Patches are available.

75. Apple Mac OS X Security Update 2005-009 Multiple Vulnerabilities
BugTraq ID: 15647
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15647
Summary:
Apple has released Security Update 2005-008 to address multiple Mac OS X local and remote vulnerabilities.

The following vulnerabilities were addressed by the security update:

Apache2 is prone to cross-site scripting in specific configurations.

apache_mod_ssl is prone to an authentication bypass.

CoreFoundation is prone to a denial of service or potential arbitrary code execution.

curl is prone to arbitrary code execution when using NTLM authentication to connect to a malicious HTTP server.

iodbcadmintool is prone to a local privilege escalation vulnerability.

OpenSSL may be forced to utilize the SSLv2 protocol.

passwordserver may allow local users to obtain elevated privileges.

Safari is prone to arbitrary code execution when processing regular expressions.

Safari is also prone to a directory traversal issue that could allow files to be downloaded outside of the specified download directory.

Safari is prone to an issue that could allow JavaScript dialog boxes to provide misleading information.

Safari is vulnerable to remote code execution when visiting Web sites with WebKit-based applications.

sudo may allow local privilege escalation in certain configurations.

syslog may allow system log entries to be forged.

These vulnerabilities will be separated into individual BIDs upon further analysis of the issues.

76. CenterICQ Malformed Packet Handling Remote Denial of Service Vulnerability
BugTraq ID: 15649
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15649
Summary:
CenterICQ is prone to a remote denial of service vulnerability.

The vulnerability presents itself when the client is running on a computer that is directly connected to the Internet and handles malformed packets on the listening port for ICQ messages.

A successful attack can cause the client to crash.

77. SocketKB Index.PHP SQL Injection Vulnerability
BugTraq ID: 15650
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15650
Summary:
SocketKB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

78. PHPAlbum Local File Include Vulnerability
BugTraq ID: 15651
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15651
Summary:
phpAlbum is prone to a local file include vulnerability.

An attacker may leverage this issue to execute arbitrary server-side script code that resides on an affected computer with the privileges of the Web server process.

It should be noted that this issue may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server.

phpAlbum 0.2.3 and prior is reported to be vulnerable.

79. Softbiz B2B Trading Marketplace Multiple SQL Injection Vulnerabilities
BugTraq ID: 15652
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15652
Summary:
Softbiz B2B Trading Marketplace is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 1.1 and prior are reported to be vulnerable; other versions may also be affected.

80. Softbiz FAQ Multiple SQL Injection Vulnerabilities
BugTraq ID: 15653
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15653
Summary:
Softbiz FAQ is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 1.1 and prior are reported to be vulnerable; other versions may also be affected.

81. Atlantis Knowledge Base Search.PHP SQL Injection Vulnerability
BugTraq ID: 15654
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15654
Summary:
Atlantis Knowledge Base is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 3.0 and prior are reported to be vulnerable; other versions may also be affected.

82. FAQRing Answer.PHP SQL Injection Vulnerability
BugTraq ID: 15655
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15655
Summary:
FAQRing is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 3.0 and prior are reported to be vulnerable; other versions may also be affected.

83. WSN Knowledge Base Multiple SQL Injection Vulnerabilities
BugTraq ID: 15656
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15656
Summary:
WSN Knowledge Base is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 1.2.0 and prior are reported to be vulnerable; other versions may also be affected.

84. O-Kiraku Nikki Nikki.PHP SQL Injection Vulnerability
BugTraq ID: 15657
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15657
Summary:
O-Kiraku Nikki is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 1.3 and prior are reported to be vulnerable; other versions may also be affected.

85. 88Scripts Event Calendar Index.PHP SQL Injection Vulnerability
BugTraq ID: 15658
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15658
Summary:
88Scripts Event Calendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions 2.0 and prior are reported to be vulnerable; other versions may also be affected.

86. Instant Photo Gallery Multiple SQL Injection Vulnerabilities
BugTraq ID: 15659
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15659
Summary:
Instant Photo Gallery is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Versions v1 and prior are reported to be vulnerable; other versions may also be affected.

87. Microsoft Internet Explorer CSS Import Cross-Domain Restriction Bypass Vulnerability
BugTraq ID: 15660
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15660
Summary:
Microsoft Internet Explorer is prone to an issue that allows a violation of the cross-domain security model.

The vulnerability arises as Internet Explorer does not properly parse CSS files and facilitates imports of files that are not valid CSS files.

This allows attackers to disclose HTML and script code from the remote site that was improperly imported as a CSS file. This site may exist in another domain than the site that exploits the issue.

An attacker may exploit this issue to steal sensitive information, which may aid in other attacks.

88. Tradesoft CMS Multiple SQL Injection Vulnerabilities
BugTraq ID: 15661
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15661
Summary:
Tradesoft CMS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

89. WebCalendar Multiple SQL Injection Vulnerabilities
BugTraq ID: 15662
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15662
Summary:
WebCalendar is prone to multiple SQL injection vulnerabilities.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Version 1.0.1. is vulnerable; other versions may also be affected.

90. Drupal Image Upload HTML Injection Vulnerability
BugTraq ID: 15663
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15663
Summary:
Drupal is prone to an HTML injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content.

This issue is only present when using the Microsoft Internet Explorer Web browser.

91. Citrix Multiple Applications Login Form Cross-Site Scripting Vulnerability
BugTraq ID: 15664
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15664
Summary:
Citrix MetaFrame Secure Access Manager and Citrix NFuse Elite are prone to a cross-site scripting vulnerability. These issues are due to a failure in the applications to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

92. Lore Article.PHP SQL Injection Vulnerability
BugTraq ID: 15665
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15665
Summary:
Lore is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

93. Astaro Security Linux ISAKMP IKE Traffic Denial of Service Vulnerability
BugTraq ID: 15666
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15666
Summary:
Astaro Security Linux is prone to a denial of service when handling malformed IKE traffic.

It is conjectured that the issue can occur if a packet with a malformed payload is sent during an IKE exchange causing the daemon to crash.

94. DotClear Session.PHP SQL Injection Vulnerability
BugTraq ID: 15667
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15667
Summary:
DotClear is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

95. Avaya TN2602AP IP Media Resource 320 Remote Denial of Service Vulnerability
BugTraq ID: 15668
Remote: Yes
Date Published: 2005-11-30
Relevant URL: http://www.securityfocus.com/bid/15668
Summary:
Avaya TN2602AP IP Media Resource 320 is prone to a remote denial of service vulnerability.

A successful attack can result in a memory leak and lead to a denial of service condition due to a crash.

Avaya TN2602AP IP Media Resource 320 versions prior to vintage 9 firmware are vulnerable to this issue.

96. FastJar Archive Extraction Directory Traversal Vulnerability
BugTraq ID: 15669
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15669
Summary:
Fastjar is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied data.

An attacker can exploit this vulnerability to overwrite arbitrary files in the context of the user utilizing the vulnerable application. Depending on the files overwritten this could result in a crash of the system or facilitate unauthorized access; other attacks are also possible.

97. Microsoft Windows CreateRemoteThread Local Denial of Service Vulnerability
BugTraq ID: 15671
Remote: No
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15671
Summary:
Microsoft Windows is prone to a local denial of service vulnerability. This issue can allow an attacker to trigger a system wide denial of service condition or terminate arbitrary processes.

Reports indicate that a process can call the 'CreateRemoteThread' function to trigger this issue.

It was reported that this attack can be carried out by a local unprivileged user.

98. MXChange Multiple Unspecified Input Validation Vulnerabilities
BugTraq ID: 15672
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15672
Summary:
MXChange is prone to multiple unspecified input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

MXChange is prone to unspecified cross-site scripting and SQL injection vulnerabilities.

99. WebCalendar Layers_Toggle.PHP HTTP Response Splitting Vulnerability
BugTraq ID: 15673
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15673
Summary:
WebCalendar is prone to an HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.

WebCalendar 1.0.1 is vulnerable; other versions may also be affected.

100. Drupal View User Profile Authorization Bypass Vulnerability
BugTraq ID: 15674
Remote: Yes
Date Published: 2005-12-01
Relevant URL: http://www.securityfocus.com/bid/15674
Summary:
Drupal is prone to an authorization bypass vulnerability. This issue is due to an unspecified error when the application is running under PHP5.

An attacker can exploit this vulnerability to bypass permissions and gain access to user profiles; this may result in information disclosure.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Federal flaw database commits to grading system
By: Robert Lemos
The National Vulnerability Database adopts the Common Vulnerability Scoring System and assigns severity rankings to more than 13,000 published flaws.
http://www.securityfocus.com/news/11360

2. Mac OS X security under scrutiny
By: Robert Lemos
Flaw finders and hackers have taken a shine to Apple's polished operating system, but some say that recent security problems are more than just skin deep.
http://www.securityfocus.com/news/11359

3. Texas puts Sony BMG in its sights
By: Robert Lemos
UPDATE: The Attorney General for Texas announces the state is suing Sony BMG, calling the company's copy-protection technology "illegal spyware." The EFF files a lawsuit on the same day.
http://www.securityfocus.com/news/11358

4. Sony BMG's copy-protection problems grow
By: Robert Lemos
As researchers find more security issues with the music giant's protection software and legislators criticize overly broad restrictions on digital media, Sony BMG decides to pull CDs from stores, release a better removal tool and offer consumers the ability to return the discs.
http://www.securityfocus.com/news/11357

5. Skype under scrutiny for bugs
By: John Leyden
The recent emergence of two sets of serious security vulnerabilities in Skype, the popular VoIP communications software app, couldn't have come at a worse time for the firm.
http://www.securityfocus.com/news/11354

6. Say hello to the Skype Trojan
By: John Leyden
Virus writers are targeting Skype users with a new Trojan that poses as the latest version of the popular VoIP software.
http://www.securityfocus.com/news/11348

7. Shared music abuse bug hits iTunes
By: John Leyden
Security researchers have discovered a vulnerability in Apple's popular iTunes application which might be exploited to interfere with shared music downloads.
http://www.securityfocus.com/news/11347

8. US cybersecurity all at sea
By: John Leyden
US cybersecurity risks are being poorly managed by the Department of Homeland Security, according to a former US presidential information security advisor.
http://www.securityfocus.com/news/11345

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Auditor, Washington
http://www.securityfocus.com/archive/77/418661

2. [SJ-JOB] Security Auditor, Baltimore
http://www.securityfocus.com/archive/77/418674

3. [SJ-JOB] Auditor, Baltimore
http://www.securityfocus.com/archive/77/418664

4. [SJ-JOB] Information Assurance Engineer, Washington
http://www.securityfocus.com/archive/77/418679

5. [SJ-JOB] Account Manager, Atlanta
http://www.securityfocus.com/archive/77/418663

6. [SJ-JOB] Security Auditor, Raleigh
http://www.securityfocus.com/archive/77/418667

7. [SJ-JOB] Auditor, Raleigh
http://www.securityfocus.com/archive/77/418670

8. [SJ-JOB] Auditor, Philadelphia
http://www.securityfocus.com/archive/77/418662

9. [SJ-JOB] Security Auditor, Richmond
http://www.securityfocus.com/archive/77/418650

10. [SJ-JOB] Sales Representative, Sacramento
http://www.securityfocus.com/archive/77/418648

11. [SJ-JOB] Sales Representative, Pittsburgh
http://www.securityfocus.com/archive/77/418649

12. [SJ-JOB] Auditor, Richmond
http://www.securityfocus.com/archive/77/418652

13. [SJ-JOB] Security Auditor, Philadelphia
http://www.securityfocus.com/archive/77/418651

14. [SJ-JOB] Security Auditor, Chicago
http://www.securityfocus.com/archive/77/418644

15. [SJ-JOB] Security Auditor, Dallas
http://www.securityfocus.com/archive/77/418638

16. [SJ-JOB] Auditor, Chicago
http://www.securityfocus.com/archive/77/418639

17. [SJ-JOB] Auditor, Dallas
http://www.securityfocus.com/archive/77/418643

18. [SJ-JOB] Technical Editor, Kenitra
http://www.securityfocus.com/archive/77/418647

19. [SJ-JOB] Sales Engineer, Central United States
http://www.securityfocus.com/archive/77/418592

20. [SJ-JOB] Security Engineer, Reston
http://www.securityfocus.com/archive/77/418601

21. [SJ-JOB] Sales Engineer, West / West Coast
http://www.securityfocus.com/archive/77/418603

22. [SJ-JOB] Security Engineer, Ft. Lauderdale
http://www.securityfocus.com/archive/77/418596

23. [SJ-JOB] Sales Representative, Ft. Lauderdale
http://www.securityfocus.com/archive/77/418602

24. [SJ-JOB] Auditor, Detroit
http://www.securityfocus.com/archive/77/418584

25. [SJ-JOB] Security Auditor, Detroit
http://www.securityfocus.com/archive/77/418580

26. [SJ-JOB] Auditor, New York
http://www.securityfocus.com/archive/77/418581

27. [SJ-JOB] Security Auditor, New York
http://www.securityfocus.com/archive/77/418590

28. [SJ-JOB] Developer, New York
http://www.securityfocus.com/archive/77/418579

29. [SJ-JOB] Security Engineer, Cupertino
http://www.securityfocus.com/archive/77/418400

30. [SJ-JOB] Sr. Security Engineer, Cupertino
http://www.securityfocus.com/archive/77/418401

31. [SJ-JOB] Technical Marketing Engineer, Redwood City
http://www.securityfocus.com/archive/77/418287

32. [SJ-JOB] Account Manager, Washington
http://www.securityfocus.com/archive/77/418288

33. [SJ-JOB] Security Auditor, Boston
http://www.securityfocus.com/archive/77/418285

34. [SJ-JOB] Security Engineer, Alexandria
http://www.securityfocus.com/archive/77/418282

35. [SJ-JOB] VP of Marketing, London or Milton Keynes (prefered)
http://www.securityfocus.com/archive/77/418283

36. [SJ-JOB] Security Architect, Brussels
http://www.securityfocus.com/archive/77/418284

37. [SJ-JOB] Sales Representative, Newport Beach, CA
http://www.securityfocus.com/archive/77/418281

38. [SJ-JOB] Auditor, Columbus
http://www.securityfocus.com/archive/77/418311

39. [SJ-JOB] Security Auditor, Columbus
http://www.securityfocus.com/archive/77/418313

40. [SJ-JOB] Auditor, Atlanta
http://www.securityfocus.com/archive/77/418314

41. [SJ-JOB] Security System Administrator, New York
http://www.securityfocus.com/archive/77/418303

42. [SJ-JOB] Information Assurance Engineer, Clarksburg (Montgomery County)
http://www.securityfocus.com/archive/77/418309

43. [SJ-JOB] Director, Information Security, ST. PETERSBURG
http://www.securityfocus.com/archive/77/418295

44. [SJ-JOB] Security Consultant, London
http://www.securityfocus.com/archive/77/418296

45. [SJ-JOB] Security Architect, New York
http://www.securityfocus.com/archive/77/418297

46. [SJ-JOB] Security Engineer, Boston
http://www.securityfocus.com/archive/77/418267

47. [SJ-JOB] Instructor, Sacramento
http://www.securityfocus.com/archive/77/418269

48. [SJ-JOB] Security Auditor, Riyadh
http://www.securityfocus.com/archive/77/418268

49. [SJ-JOB] Auditor, Los Angeles
http://www.securityfocus.com/archive/77/418265

50. [SJ-JOB] Auditor, Miami
http://www.securityfocus.com/archive/77/418264

51. [SJ-JOB] Security Auditor, Miami
http://www.securityfocus.com/archive/77/418266

52. [SJ-JOB] Security Auditor, Atlanta
http://www.securityfocus.com/archive/77/418262

53. [SJ-JOB] Security Auditor, Los Angeles
http://www.securityfocus.com/archive/77/418263

V. INCIDENTS LIST SUMMARY
---------------------------
1. administrivia: bounces, vacation messages, etc...
http://www.securityfocus.com/archive/75/418466

2. DNS Query Details from 209.200.168.66
http://www.securityfocus.com/archive/75/418153

3. Strange DNS queries
http://www.securityfocus.com/archive/75/418074

VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Changing local admin PW using vb logon script - can it be encrypted?
http://www.securityfocus.com/archive/88/418575

2. Changing local admin PW using vb logon script - can it be encrypted?
http://www.securityfocus.com/archive/88/418259

3. Prohibiting Index Server does not prevent information leakage in IIS 6.0
http://www.securityfocus.com/archive/88/418256

4. SecurityFocus Microsoft Newsletter #267
http://www.securityfocus.com/archive/88/418148

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
1. Security, Distributed firewalling application...long ;-)
http://www.securityfocus.com/archive/91/418029

X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: Watchfire AppScan

Available now! AppScan version 6.0. Others can assess web applications for vulnerabilities. Only AppScan shows you how to fix them. See for yourself. Evaluate AppScan 6.0 today.

https://www.watchfire.com/securearea/appscanauditdownload.aspx?id=701300000002gRE