SecurityFocus Newsletter #329

Peter Laborge <[email protected]> Tue, 20 Dec 2005 16:50:52 -0700

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #329
----------------------------------------

This Issue is Sponsored By: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus_en

------------------------------------------------------------------
I. FRONT AND CENTER
1. OpenSSH cutting edge
2. Demystifying Denial-Of-Service attacks, part one
II. BUGTRAQ SUMMARY
1. Flatnuke Index.PHP Directory Traversal Vulnerability
2. APANI Networks EpiForce Agent Denial Of Service Vulnerability
3. Nortel SSL VPN Web Interface Input Validation Vulnerability
4. Positive Software Corporation CP+ Unspecified Perl Security Vulnerability
5. My Album Online Unspecified Directory Traversal Vulnerability
6. Netref Index.php SQL Injection Scripting Vulnerability
7. Horde Turba Multiple HTML Injection Vulnerabilities
8. Horde Mnemo Remote HTML Injection Vulnerabilities
9. Horde Nag Remote HTML Injection Vulnerabilities
10. Magic Book Professional Book.CFM Cross-Site Scripting Vulnerability
11. Horde Application Framework Input Validation Vulnerabilities
12. LogiSphere Multiple Directory Traversal Vulnerabilities
13. Horde Kronolith Multiple HTML Injection Vulnerabilities
14. Sights 'N Sounds Streaming Media Server SWS.EXE Buffer Overflow Vulnerability
15. Horde Application Framework CSV File Upload Code Execution Vulnerability
16. SCO UnixWare UIDAdmin Local Buffer Overflow Vulnerability
17. LocazoList Classifieds SearchDB.ASP Input Validation Vulnerability
18. Opera Web Browser Long Title Element Bookmark Denial of Service Vulnerability
19. Blackboard Academic Suite Frameset.JSP Cross-Domain Frameset Loading Vulnerability
20. Alt-N MDaemon WorldClient Denial Of Service Vulnerability
21. NetGear RP114 SYN Flood Denial Of Service Vulnerability
22. UseBB PHP_SELF Cross-Site Scripting Vulnerability
23. Scout Portal Toolkit Multiple Input Validation Vulnerabilities
24. BTGrup Admin WebController SQL Injection Vulnerability
25. Arab Portal Link.PHP SQL Injection Vulnerabilities
26. Macromedia Flash Media Server 2 Administration Service Remote Denial of Service Vulnerability
27. Microsoft Internet Explorer Dialog Manipulation Vulnerability
28. EveryAuction Auction.PL Cross-Site Scripting Vulnerability
29. Microsoft Internet Explorer HTTPS Proxy Information Disclosure Vulnerability
30. Microsoft Windows Asynchronous Procedure Call Local Privilege Escalation Vulnerability
31. Microsoft Internet Explorer COM Object Instantiation Memory Corruption Vulnerability
32. PHPCoin Coin_CFG.PHP SQL Injection Vulnerability
33. PHPCoin Config.PHP File Include Vulnerability
34. Apple Mac OS X Perl Insecure Privilege Dropping Weakness
35. Apache Mod_IMAP Referer Cross-Site Scripting Vulnerability
36. Opera Web Browser Download Dialog Manipulation File Execution Vulnerability
37. EncapsGallery Gallery.PHP SQL Injection Vulnerability
38. PHPWebGallery Multiple SQL Injection Vulnerabilities
39. Plogger Index.PHP Multiple Input Validation Vulnerabilities
40. VCD-DB Multiple Input Validation Vulnerabilities
41. PHP JackKnife Cross-Site Scripting Vulnerability
42. Mantis View_filters_page.PHP Cross-Site Scripting Vulnerability
43. Link Up Gold Multiple Input Validation Vulnerabilities
44. Snipe Gallery Multiple Input Validation Vulnerabilities
45. mcGallery PRO Multiple Input Validation Vulnerabilities
46. PHP Web Scripts Ad Manager Pro Advertiser_statistic.PHP SQL Injection Vulnerability
47. Jamit Job Board Index.PHP SQL Injection Vulnerability
48. DreamLevels Dream Poll View_Results.PHP SQL Injection Vulnerability
49. CourseForum Technologies ProjectForum Multiple Cross-Site Scripting Vulnerabilities
50. AppServ Open Project Remote Denial of Service Vulnerability
51. MySQL Auction Search Module Cross-Site Scripting Vulnerability
52. PHP Support Tickets Multiple SQL Injection Vulnerabilities
53. CKGold Search.PHP Cross-Site Scripting Vulnerability
54. PHPNuke Content Filtering Byapss Vulnerability
55. WHMCompleteSolution Knowledgebase.PHP Cross-Site Scripting Vulnerability
56. Envolution Multiple Input Validation Vulnerabilities
57. ASP-DEV XM Forum Forum.ASP Cross-Site Scripting Vulnerability
58. ASPBB Multiple SQL Injection Vulnerabilities
59. WikkaWiki TextSearch.PHP Cross-Site Scripting Vulnerability
60. Multiple Linksys Routers LanD Packet Denial Of Service Vulnerability
61. Netref Index.PHP SQL Injection Vulnerability
62. QuickPayPro Multiple Input Validation Vulnerabilities
63. Multiple Unspecified Cisco Catalyst Switches LanD Packet Denial Of Service Vulnerability
64. Trend Micro ServerProtect ISANVWRequest Heap Overflow Vulnerability
65. Trend Micro ServerProtect Relay Heap Overflow Vulnerability
66. Trend Micro ServerProtect RPTServer.ASP Directory Traversal Vulnerability
67. Trend Micro ServerProtect EarthAgent Daemon Denial of Service Vulnerability
68. Westell Versalink 327W LanD Packet Denial Of Service Vulnerability
69. Scientific Atlanta DPX2100 Cable Modem LanD Packet Denial Of Service Vulnerability
70. Limbo CMS Multiple Input Validation Vulnerabilities
71. Trend Micro PC-Cillin Internet Security Local Insecure Permissions Vulnerability
72. Watchfire AppScan QA Remote Buffer Overflow Vulnerability
73. MarmaraWeb E-Commerce Cross-Site Scripting Vulnerability
74. TML CMS Multiple Input Validation Vulnerabilities
75. MarmaraWeb E-Commerce Remote File Include Vulnerability
76. IBM AIX slocal Local Buffer Overflow Vulnerability
77. IBM AIX MUXATMD Local Buffer Overflow Vulnerability
78. IBM AIX GetShell and GetCommand Arbitrary File Overwrite Vulnerability
79. IBM AIX Debug Malloc Tools Local Buffer Overflow Vulnerability
80. Alkacon OpenCMS Login Cross-Site Scripting Vulnerability
81. SiteNet BBS Cross-Site Scripting Vulnerability
82. BBBoard V2 Cross-Site Scripting Vulnerability
83. DCForum DCBoard Script Page Parameter Cross-Site Scripting Vulnerability
84. Atlant Pro Cross-Site Scripting Vulnerabilities
85. AltantForum Multiple Cross-Site Scripting Vulnerabilities
86. CommerceSQL Search Module Cross-Site Scripting Vulnerability
87. eDatCat EDCstore.PL Cross-Site Scripting Vulnerability
88. Soft4e ECW-Cart Multiple Cross-Site Scripting Vulnerabilities
89. ECTOOLS Onlineshop Cross-Site Scripting Vulnerability
90. PPCal Shopping Cart Cross-Site Scripting Vulnerability
91. Zaygo DomainCart Cross-Site Scripting Vulnerability
92. StaticStore Search.CGI Cross-Site Scripting Vulnerability
93. Kryptronic ClickCartPro CP-APP.CGI Cross-Site Scripting Vulnerability
94. The CITY Shop Search Cross-Site Scripting Vulnerability
95. Dick Copits PDEstore Multiple Cross-Site Scripting Vulnerabilities
96. AlmondSoft Almond Classifieds SQL Injection Vulnerability
97. Plexum PlexCart X3 SQL Injection Vulnerability
98. SSH Tectia Server Host Authentication Authorization Bypass Vulnerability
99. Macromedia Cold Fusion MX Multiple Vulnerabilities
100. Macromedia JRun Multiple Vulnerabilities
III. SECURITYFOCUS NEWS
1. Sober virus scares up child-porn confession
2. Researchers: Flaw auctions would improve security
3. eBay pulls vulnerability auction
4. Consumers improving security, but gaps remain
5. Skype under scrutiny for bugs
6. Say hello to the Skype Trojan
7. Shared music abuse bug hits iTunes
8. US cybersecurity all at sea
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Security System Administrator, Waukegan 50 miles north of Chicago
2. [SJ-JOB] Technical Support Engineer, New Castle
3. [SJ-JOB] Disaster Recovery Coordinator, Weehawken
4. [SJ-JOB] Database Security Architect, Washington
5. [SJ-JOB] Compliance Officer, New Castle
6. [SJ-JOB] Director, Information Security, Warren
7. [SJ-JOB] Technical Support Engineer, New Castle
8. [SJ-JOB] Disaster Recovery Coordinator, Stanford
9. [SJ-JOB] Sr. Security Analyst, Dallas Metro Area
10. [SJ-JOB] Auditor, Stanford
11. [SJ-JOB] Sr. Security Engineer, Bay Area
12. [SJ-JOB] Sr. Security Analyst, Woodland Hills
13. [SJ-JOB] Sr. Security Analyst, Tampa Bay / St. Petersburg Area
14. [SJ-JOB] Application Security Engineer, Tampa Bay / St. Petersburg Area
15. [SJ-JOB] Security Architect, ******
16. [SJ-JOB] Security Researcher, Palo Alto
17. [SJ-JOB] Security Consultant, South London
18. [SJ-JOB] Security Consultant, New York
19. [SJ-JOB] Security Engineer, Warren
20. [SJ-JOB] Security Engineer, Reston
21. [SJ-JOB] Security Engineer, New York
22. [SJ-JOB] Sr. Security Analyst, atlanta
23. [SJ-JOB] Jr. Security Analyst, Redwood City
24. [SJ-JOB] Sales Representative, Livonia
25. [SJ-JOB] Sales Representative, Vienna
26. [SJ-JOB] Security Researcher, Redwood City
27. [SJ-JOB] Application Security Engineer, RoseLand
28. [SJ-JOB] Security Director, New York
29. [SJ-JOB] Database Security Engineer, Atlanta
30. [SJ-JOB] CSO, Bay Area
31. [SJ-JOB] Security Consultant, New York
32. [SJ-JOB] Technical Writer, Reading - Berkshire
33. [SJ-JOB] CHECK Team Leader, London - UK Wide
34. [SJ-JOB] Sr. Security Analyst, London - UK Wide
35. [SJ-JOB] Quality Assurance, Ann Arbor
36. [SJ-JOB] Management, Ann Arbor
37. [SJ-JOB] Forensics Engineer, Fort Worth
38. [SJ-JOB] Sr. Security Engineer, Detroit
39. [SJ-JOB] Sr. Security Engineer, Bellevue
40. [SJ-JOB] Developer, Buckinghamshire
41. [SJ-JOB] Technical Support Engineer, Aylesbury
42. [SJ-JOB] Account Manager, Copenhagen
43. [SJ-JOB] Regional Channel Manager, Copenhagen
44. [SJ-JOB] Security Product Marketing Manager, Munich
45. [SJ-JOB] Sr. Security Engineer, Philadelphia
46. [SJ-JOB] Account Manager, Munich
47. [SJ-JOB] Channel / Business Development, Munich
V. INCIDENTS LIST SUMMARY
1. A bit strange ARP queries
2. SF new column announcement: Users inundated with pop-ups, by Scott Granneman
VI. VULN-DEV RESEARCH LIST SUMMARY
1. BETA v2.0 released
2. Linux MIPS shellcode (Big Endian)
3. Metasploit Framework v3.0 Alpha Release 1
VII. MICROSOFT FOCUS LIST SUMMARY
1. sober resurfacing
2. SecurityFocus Microsoft Newsletter #269
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
1. SF new article announcement: OpenSSH cutting edge
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. OpenSSH cutting edge
By Federico Biancuzzi
Federico Biancuzzi interviews OpenSSH developer Damien Miller to discuss features included in the upcoming version 4.3, public key crypto protocols details, timing based attacks and anti-worm measures.
http://www.securityfocus.com/columnists/375

2. Demystifying Denial-Of-Service attacks, part one
By Abhishek Singh, CISSP
This paper provides an introduction to Denial of Service (DoS) attacks, their methodologies, common prevention techniques, and how they differ from Distributed Denial of Service (DDoS) Attacks. This article is intended to be a broad overview for the beginner or intermediate-level administrator on the different types of DoS attacks.
http://www.securityfocus.com/infocus/1853

II. BUGTRAQ SUMMARY
--------------------
1. Flatnuke Index.PHP Directory Traversal Vulnerability
BugTraq ID: 15796
Remote: Yes
Date Published: 2005-12-10
Relevant URL: http://www.securityfocus.com/bid/15796
Summary:
Flatnuke is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

A remote attacker may employ directory traversal strings '../' to read sensitive files containing MD5 password hashes, and create malicious cookie data which may be used to log in as an administrative user. An attacker may then create and execute malicious code, which may be executed within the context of the administrative user's account. This code may be executed within the context of the affected Web server process.

Flatnuke 2.5.6 is affected; earlier versions may also be affected.

2. APANI Networks EpiForce Agent Denial Of Service Vulnerability
BugTraq ID: 15797
Remote: Yes
Date Published: 2005-12-10
Relevant URL: http://www.securityfocus.com/bid/15797
Summary:
EpiForce Agent is prone to a denial of service vulnerability.

Unspecified PROTOS protocol tests will crash the IKE Negotiation Module of the Epiforce Agent application. This will cause the Epiforce application to crash, effectively denying service to legitimate users, until the service is automatically restarted.

No further details regarding this vulnerability are known. This BID will be updated when details become available.

3. Nortel SSL VPN Web Interface Input Validation Vulnerability
BugTraq ID: 15798
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15798
Summary:
Nortel SSL VPN is prone to an input validation vulnerability. This issue could be exploited to cause arbitrary commands to be executed on a user's computer. Cross-site scripting attacks are also possible.

Nortel SSL VPN 4.2.1.6 is vulnerable to this issue; other versions may also be affected.

4. Positive Software Corporation CP+ Unspecified Perl Security Vulnerability
BugTraq ID: 15799
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15799
Summary:
CP+ is prone to an unspecified security vulnerability caused by a vulnerability in Perl.

Due to a lack of information, further details cannot be provided at the moment. This BID will be updated when more information becomes available.

5. My Album Online Unspecified Directory Traversal Vulnerability
BugTraq ID: 15800
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15800
Summary:
My Album Online is prone to an unspecified directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible.

6. Netref Index.php SQL Injection Scripting Vulnerability
BugTraq ID: 15801
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15801
Summary:
Netref is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could also result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Netref 3 is vulnerable to this issue; other versions may also be affected.

7. Horde Turba Multiple HTML Injection Vulnerabilities
BugTraq ID: 15802
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15802
Summary:
Turba is prone to multiple HTML injection vulnerabilities. These are due to a lack of proper validation of user-supplied input before being used in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit these issues to control how the site is rendered to the user; other attacks are also possible.

8. Horde Mnemo Remote HTML Injection Vulnerabilities
BugTraq ID: 15803
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15803
Summary:
Mnemo is prone to multiple HTML injection vulnerabilities.

Mnemo 2.0.2 and prior versions are affected by these issues.

9. Horde Nag Remote HTML Injection Vulnerabilities
BugTraq ID: 15804
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15804
Summary:
Nag is prone to multiple HTML injection vulnerabilities.

Nag 2.0.3 and prior versions are affected by these issues.

10. Magic Book Professional Book.CFM Cross-Site Scripting Vulnerability
BugTraq ID: 15805
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15805
Summary:
Magic Book Professional is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Versions 2.0 and prior are vulnerable; other versions may also be affected.

11. Horde Application Framework Input Validation Vulnerabilities
BugTraq ID: 15806
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15806
Summary:
Horde Application Framework is prone to multiple input validation vulnerabilities. These vulnerabilities could be exploited to perform cross-site scripting attacks. A remote attacker may exploit these vulnerabilities to execute arbitrary HTML and script code in the browser of a vulnerable user.

Horde Application Framework 3.0.7 and earlier are affected by these issues.

12. LogiSphere Multiple Directory Traversal Vulnerabilities
BugTraq ID: 15807
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15807
Summary:
LogiSphere is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

13. Horde Kronolith Multiple HTML Injection Vulnerabilities
BugTraq ID: 15808
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15808
Summary:
Kronolith is prone to multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

14. Sights 'N Sounds Streaming Media Server SWS.EXE Buffer Overflow Vulnerability
BugTraq ID: 15809
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15809
Summary:
Sights 'n Sounds Streaming Media Server is prone to a buffer overflow vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation will likely result in a crash of the 'SWS.exe' application, denying service to legitimate users. Arbitrary code execution may also be possible, this may facilitate privilege escalation to SYSTEM level.

Sights 'n Sounds Streaming Media Server version 2.0.3.b is affected.

15. Horde Application Framework CSV File Upload Code Execution Vulnerability
BugTraq ID: 15810
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15810
Summary:
Horde Application Framework is prone to an arbitrary script code execution vulnerability when uploading CSV files. This is due to a failure of the application to properly sanitize user-supplied input.

Horde Application Framework 3.0.7 and earlier are affected by this issue.

16. SCO UnixWare UIDAdmin Local Buffer Overflow Vulnerability
BugTraq ID: 15811
Remote: No
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15811
Summary:
SCO UnixWare is prone to a local buffer overflow vulnerability.

The vulnerability presents itself when the application processes excessive data supplied to the uidadmin utility.

UnixWare 7.1.3 and UnixWare 7.1.4 are affected by this issue. Previous versions may also be affected.

17. LocazoList Classifieds SearchDB.ASP Input Validation Vulnerability
BugTraq ID: 15812
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15812
Summary:
LocazoList Classifieds is prone to an input validation vulnerability that allows cross-site scripting and SQL injection attacks.

An attacker may also leverage this issue to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could also result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

18. Opera Web Browser Long Title Element Bookmark Denial of Service Vulnerability
BugTraq ID: 15813
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15813
Summary:
Opera Web browser is prone to a denial of service vulnerability when a Web page with a long title element is bookmarked. If this occurs, the browser will not be able to restart after it is closed.

This issue affects Opera running on Windows and Mac OS X. It also affects Japanese users and any users utilizing IME for text input.

19. Blackboard Academic Suite Frameset.JSP Cross-Domain Frameset Loading Vulnerability
BugTraq ID: 15814
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15814
Summary:
Blackboard Academic Suite is prone to a cross-domain frameset loading vulnerability.

Successful exploitation may result in various attacks such as information disclosure and session hijacking. An attacker may also be able to exploit this vulnerability to carry out phishing style attacks.

Blackboard Academic Suite version 6.0 is reportedly affected by this issue.

20. Alt-N MDaemon WorldClient Denial Of Service Vulnerability
BugTraq ID: 15815
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15815
Summary:
MDaemon WorldClient is prone to a denial of service vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to prevent a user from accessing their mail remotely through the WorldClient client application.

21. NetGear RP114 SYN Flood Denial Of Service Vulnerability
BugTraq ID: 15816
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15816
Summary:
The NetGear RP114 device is prone to a denial of service vulnerability.

Communications between the external and internal Ethernet interface may be halted by initiating a TCP SYN flood to the external interface of the device.

This issue allows attackers to block network traffic to arbitrarily targeted network services, effectively denying service to legitimate users of the device.

22. UseBB PHP_SELF Cross-Site Scripting Vulnerability
BugTraq ID: 15817
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15817
Summary:
UseBB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

23. Scout Portal Toolkit Multiple Input Validation Vulnerabilities
BugTraq ID: 15818
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15818
Summary:
Scout Portal Toolkit is prone to multiple input validation vulnerabilities. These are due to a lack of proper validation of user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials or may permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

24. BTGrup Admin WebController SQL Injection Vulnerability
BugTraq ID: 15819
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15819
Summary:
BTGrup Admin WebController is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

25. Arab Portal Link.PHP SQL Injection Vulnerabilities
BugTraq ID: 15820
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15820
Summary:
Arab Portal is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before using it in an SQL query.

26. Macromedia Flash Media Server 2 Administration Service Remote Denial of Service Vulnerability
BugTraq ID: 15822
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15822
Summary:
Macromedia Flash Media Server administration service is prone to a remote denial of service vulnerability.

Successful exploitation may trigger a crash or hang, denying service to legitimate users.

27. Microsoft Internet Explorer Dialog Manipulation Vulnerability
BugTraq ID: 15823
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15823
Summary:
Internet Explorer is prone to a remote code execution vulnerability through manipulation of custom dialog boxes. Keystrokes entered while one of these dialogs is displayed may be buffered and passed to a download dialog, allowing attacker-supplied code to be executed.

28. EveryAuction Auction.PL Cross-Site Scripting Vulnerability
BugTraq ID: 15824
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15824
Summary:
EveryAuction is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

29. Microsoft Internet Explorer HTTPS Proxy Information Disclosure Vulnerability
BugTraq ID: 15825
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15825
Summary:
Microsoft Internet Explorer is prone to an information disclosure vulnerability when using an authenticating proxy server for HTTPS communications. Exploitation of this issue could result in an attacker gaining a user's authentication credentials.

This issue only exists when the authenticating proxy uses Basic Authentication.

30. Microsoft Windows Asynchronous Procedure Call Local Privilege Escalation Vulnerability
BugTraq ID: 15826
Remote: No
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15826
Summary:
Microsoft Windows is susceptible to a local privilege escalation vulnerability. This issue is due to a flaw in the Asynchronous Procedure Calls implementation in Microsoft Windows.

This issue allows local attackers to gain elevated privileges, facilitating the complete compromise of affected computers.

31. Microsoft Internet Explorer COM Object Instantiation Memory Corruption Vulnerability
BugTraq ID: 15827
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15827
Summary:
Microsoft Internet Explorer is prone to a memory corruption vulnerability that is related to the instantiation of COM objects.

COM objects may corrupt system memory and facilitate arbitrary code execution in the context of the currently logged in user on the affected computer.

32. PHPCoin Coin_CFG.PHP SQL Injection Vulnerability
BugTraq ID: 15830
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15830
Summary:
PhpCOIN is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

33. PHPCoin Config.PHP File Include Vulnerability
BugTraq ID: 15831
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15831
Summary:
PhpCOIN is prone to a file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote PHP code and execute it in the context of the Web server process. The attacker can also exploit this issue to include arbitrary local files through the use of directory traversal strings '../'.

Successful exploitation may lead to a compromise of the underlying system; other attacks are also possible.

34. Apple Mac OS X Perl Insecure Privilege Dropping Weakness
BugTraq ID: 15833
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15833
Summary:
Apple Mac OS X's Perl is susceptible to an insecure privilege dropping weakness. This issue is due to a failure of Perl to correctly drop privileges. This issue is conjectured to be present due to a flaw in the compilation options of Perl.

This vulnerability may allow attackers that exploit latent vulnerabilities in Perl applications to gain elevated privileges, increasing the potential for damage. The exact impact of exploitation depends on the specific use and implementation of the privilege dropping facilities in affected Perl applications.

Mac OS X version 10.3.9 is reported vulnerable to this issue. Other versions may also be affected.

35. Apache Mod_IMAP Referer Cross-Site Scripting Vulnerability
BugTraq ID: 15834
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15834
Summary:
mod_imap is prone to a cross-site scripting vulnerability. This issue is due to a failure in the module to properly sanitize user-supplied input.

36. Opera Web Browser Download Dialog Manipulation File Execution Vulnerability
BugTraq ID: 15835
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15835
Summary:
Opera Web Browser is prone to a remote code execution vulnerability through manipulation of dialog boxes.

An attacker can hide a 'File Download' dialog box underneath a new browser window and entice a user into double clicking a specific area in the window.

This may result in the execution of arbitrary files.

37. EncapsGallery Gallery.PHP SQL Injection Vulnerability
BugTraq ID: 15836
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15836
Summary:
EncapsGallery is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

38. PHPWebGallery Multiple SQL Injection Vulnerabilities
BugTraq ID: 15837
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15837
Summary:
PhpWebGallery is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

39. Plogger Index.PHP Multiple Input Validation Vulnerabilities
BugTraq ID: 15839
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15839
Summary:
Plogger is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

40. VCD-DB Multiple Input Validation Vulnerabilities
BugTraq ID: 15840
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15840
Summary:
VCD-db is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

41. PHP JackKnife Cross-Site Scripting Vulnerability
BugTraq ID: 15841
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15841
Summary:
PHP JackKnife is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

42. Mantis View_filters_page.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 15842
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15842
Summary:
Mantis is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

43. Link Up Gold Multiple Input Validation Vulnerabilities
BugTraq ID: 15843
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15843
Summary:
Link Up Gold is prone to multiple input validation vulnerabilities. These issues are due to a lack of proper validation of user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

44. Snipe Gallery Multiple Input Validation Vulnerabilities
BugTraq ID: 15844
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15844
Summary:
Snipe Gallery is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

Snipe Gallery versions 3.1.4 and prior are vulnerable; other versions may also be affected.

45. mcGallery PRO Multiple Input Validation Vulnerabilities
BugTraq ID: 15845
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15845
Summary:
mcGallery PRO is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application,arbitrary local file inclusion and code execution, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

46. PHP Web Scripts Ad Manager Pro Advertiser_statistic.PHP SQL Injection Vulnerability
BugTraq ID: 15847
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15847
Summary:
Ad Manager Pro is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

47. Jamit Job Board Index.PHP SQL Injection Vulnerability
BugTraq ID: 15848
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15848
Summary:
Job Board is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

48. DreamLevels Dream Poll View_Results.PHP SQL Injection Vulnerability
BugTraq ID: 15849
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15849
Summary:
Dream Poll is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

49. CourseForum Technologies ProjectForum Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 15850
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15850
Summary:
ProjectForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

50. AppServ Open Project Remote Denial of Service Vulnerability
BugTraq ID: 15851
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15851
Summary:
AppServ Open Project is reportedly affected by a remote denial of service vulnerability.

AppServ 2.5.3 running on Microsoft Windows platforms was reported to be vulnerable. Other versions may be affected as well.

51. MySQL Auction Search Module Cross-Site Scripting Vulnerability
BugTraq ID: 15852
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15852
Summary:
MySQL Auction is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Versions 3.0 and prior are vulnerable; other versions may also be affected.

52. PHP Support Tickets Multiple SQL Injection Vulnerabilities
BugTraq ID: 15853
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15853
Summary:
PHP Support Tickets is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

53. CKGold Search.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 15854
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15854
Summary:
CKGold is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

54. PHPNuke Content Filtering Byapss Vulnerability
BugTraq ID: 15855
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15855
Summary:
PHPNuke is prone to a content filtering bypass vulnerability. This issue can allow an attacker to bypass content filters and potentially carry out cross-site scripting, HTML injection and other attacks.

PHPNuke 7.9 and prior versions are reported to be vulnerable.

55. WHMCompleteSolution Knowledgebase.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 15856
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15856
Summary:
WHMCompleteSolution is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

56. Envolution Multiple Input Validation Vulnerabilities
BugTraq ID: 15857
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15857
Summary:
Envolution is prone to multiple input validation vulnerabilities.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

57. ASP-DEV XM Forum Forum.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 15858
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15858
Summary:
XM Forum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

58. ASPBB Multiple SQL Injection Vulnerabilities
BugTraq ID: 15859
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15859
Summary:
ASPBB is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

59. WikkaWiki TextSearch.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 15860
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15860
Summary:
WikkaWiki is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

60. Multiple Linksys Routers LanD Packet Denial Of Service Vulnerability
BugTraq ID: 15861
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15861
Summary:
Multiple Linksys devices are prone to a denial of service vulnerability.

These devices are susceptible to a remote denial of service vulnerability when handling TCP 'LanD' packets.

This issue allows remote attackers to crash affected devices, or to temporarily block further network routing functionality. This will deny further network services to legitimate users.

Linksys BEFW11S4 and WRT54GS devices are reportedly affected by this issue. Due to code reuse among devices, other devices may also be affected.

61. Netref Index.PHP SQL Injection Vulnerability
BugTraq ID: 15862
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15862
Summary:
Netref is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

62. QuickPayPro Multiple Input Validation Vulnerabilities
BugTraq ID: 15863
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15863
Summary:
QuickPayPro is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

63. Multiple Unspecified Cisco Catalyst Switches LanD Packet Denial Of Service Vulnerability
BugTraq ID: 15864
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15864
Summary:
Multiple unspecified Cisco Catalyst switches are prone to a denial of service vulnerability.

These devices are susceptible to a remote denial of service vulnerability when handling TCP 'LanD' packets.

This issue allows remote attackers to crash affected devices, or to temporarily block further network routing functionality. This will deny further network services to legitimate users.

As no specific Cisco devices were identified by the reporter of this issue, all Cisco Catalyst devices have been marked as vulnerable. This BID will be updated as further information on affected packages is available.

64. Trend Micro ServerProtect ISANVWRequest Heap Overflow Vulnerability
BugTraq ID: 15865
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15865
Summary:
A remotely exploitable heap-based buffer overflow vulnerability is present in the Trend Micro ServerProtect 'isaNVWRequest.dll' ISAPI component of the Management Console.

An attacker could exploit this issue to execute arbitrary code in the context of the underlying Web server.

This issue is reported to affected ServerProtect 5.58 for Windows running with
Trend Micro Control Manager 2.5/3.0 and Trend Micro Damage Cleanup Server 1.1. Other versions and platforms may be affected as well. It is also possible that other Trend Micro products such as InterScan eManager, InterScan Web Protect, OfficeScan, and Control Manager could be impacted as well.

It is noted that the vulnerability may actually be present in the MFC (Microsoft Foundation Class) ISAPI libraries. This issue may be related to BID 9963 "Microsoft Visual C++ MFC ISAPI Extension Denial Of Service Vulnerability".

65. Trend Micro ServerProtect Relay Heap Overflow Vulnerability
BugTraq ID: 15866
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15866
Summary:
A remotely exploitable heap-based buffer overflow vulnerability is present in the Trend Micro ServerProtect 'relay.dll' component in the Management Console.

An attacker could exploit this issue to execute arbitrary code in the context of the underlying Web server.

This issue is reported to affect ServerProtect 5.58 for Windows running with
Trend Micro Control Manager 2.5/3.0 and Trend Micro Damage Cleanup Server 1.1. Other versions and platforms may be affected as well. It is also possible that other Trend Micro products such as InterScan eManager, InterScan Web Protect, OfficeScan, and Control Manager could be impacted as well.

66. Trend Micro ServerProtect RPTServer.ASP Directory Traversal Vulnerability
BugTraq ID: 15867
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15867
Summary:
ServerProtect is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to retrieve arbitrary files in the context of the affected application. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

This issue has been confirmed in Trend Micro ServerProtect for Windows Management Console 5.58 running with Trend Micro Control Manager 2.5/3.0 and Trend Micro Damage Cleanup Server 1.1. Earlier versions and versions for other platforms may also be vulnerable.

67. Trend Micro ServerProtect EarthAgent Daemon Denial of Service Vulnerability
BugTraq ID: 15868
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15868
Summary:
Trend Micro ServerProtect is prone to a remote denial of service vulnerability when the EarthAgent Daemon processes a malicious packet. This causes the process to consume a large amount of CPU and memory resources, potentially causing the underlying operating system to fail.

This issue affects Trend Micro ServerProtect version 5.58, however, earlier versions may also be affected.

68. Westell Versalink 327W LanD Packet Denial Of Service Vulnerability
BugTraq ID: 15869
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15869
Summary:
Westell Versalink 327W is prone to a denial of service vulnerability.

These devices are susceptible to a remote denial of service vulnerability when handling TCP 'LanD' packets.

This issue allows remote attackers to crash affected devices, or to temporarily block further network routing functionality. This will deny further network services to legitimate users.

Westell Versalink 327W is reportedly affected by this issue. Due to code reuse among devices, other devices may also be affected.

69. Scientific Atlanta DPX2100 Cable Modem LanD Packet Denial Of Service Vulnerability
BugTraq ID: 15870
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15870
Summary:
Scientific Atlanta DPX2100 cable modems are prone to a denial of service vulnerability.

These devices are susceptible to a remote denial of service vulnerability when handling TCP 'LanD' packets.

This issue allows remote attackers to crash affected devices, or to temporarily block further network routing functionality. This will deny further network services to legitimate users.

Scientific Atlanta DPX2100 cable modems are reportedly affected by this issue. Due to code reuse among devices, other devices may also be affected.

70. Limbo CMS Multiple Input Validation Vulnerabilities
BugTraq ID: 15871
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15871
Summary:
Limbo CMS is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out cross-site scripting, SQL injection, and local file include attacks.

Limbo CMS versions 1.0.4.2 and prior are affected by these vulnerabilities.

71. Trend Micro PC-Cillin Internet Security Local Insecure Permissions Vulnerability
BugTraq ID: 15872
Remote: No
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15872
Summary:
Trend Micro PC-Cillin Internet Security is a commercial antivirus and network security package for Microsoft Windows operating systems.

Trend Micro PC-Cillin Internet Security is susceptible to a local insecure permissions vulnerability. This issue is due to a failure of the application to ensure that secure permissions are applied to its application and data files.

This issue allows local unprivileged attackers to disable the security features of the affected application, aiding them in further attacks. They may also overwrite arbitrary binaries that will subsequently be executed with SYSTEM level privileges facilitating the complete compromise of affected computers.

Trend Micro PC-Cillin Internet Security 2005 version 12.00 build 1244 is vulnerable to this issue. Other versions may also be affected.

72. Watchfire AppScan QA Remote Buffer Overflow Vulnerability
BugTraq ID: 15873
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15873
Summary:
AppScan QA is prone to a buffer overflow vulnerability.

The vulnerability presents itself when the application handles a malformed HTTP 401 (Unauthorized) response.

A successful attack may facilitate arbitrary code execution. Exploitation of this vulnerability may allow an attacker to gain unauthorized access to the computer in the context of the application.

AppScan QA 5.0.609 Subscription 7 and 5.0.134 were reported to be vulnerable. Other versions may be affected as well.

73. MarmaraWeb E-Commerce Cross-Site Scripting Vulnerability
BugTraq ID: 15875
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15875
Summary:
E-commerce is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

74. TML CMS Multiple Input Validation Vulnerabilities
BugTraq ID: 15876
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15876
Summary:
TML CMS is prone to multiple input validation vulnerabilities.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

TML CMS 0.5 is reportedly affected. Other versions may be vulnerable as well.

75. MarmaraWeb E-Commerce Remote File Include Vulnerability
BugTraq ID: 15877
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15877
Summary:
E-commerce is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the Web server process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

76. IBM AIX slocal Local Buffer Overflow Vulnerability
BugTraq ID: 15878
Remote: No
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15878
Summary:
slocal is prone to a buffer overflow vulnerability. This issue arises because the application fails to perform boundary checks prior to copying user-supplied data into insufficiently-sized memory buffers.

An attacker can exploit this issue to execute arbitrary code and gain superuser privileges. This will result in a complete compromise of the affected computer.

Very few details are available on this issue; this BID will be updated as further information becomes available.

77. IBM AIX MUXATMD Local Buffer Overflow Vulnerability
BugTraq ID: 15879
Remote: No
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15879
Summary:
IBM AIX muxatmd is prone to a local buffer overflow vulnerability. This issue arises because the application fails to perform boundary checks prior to copying user-supplied data into insufficiently-sized memory buffers.

A successful attack allows arbitrary machine code execution with superuser privileges, due to the affected application being installed with setuid-superuser privileges.

78. IBM AIX GetShell and GetCommand Arbitrary File Overwrite Vulnerability
BugTraq ID: 15880
Remote: No
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15880
Summary:
IBM AIX is prone to an arbitrary file overwrite vulnerability.

This vulnerability affects the getShell and getCommand utilities.

This may result in various attacks such as data corruption and privilege escalation.

AIX 5.3 is vulnerable to this issue.

79. IBM AIX Debug Malloc Tools Local Buffer Overflow Vulnerability
BugTraq ID: 15881
Remote: No
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15881
Summary:
IBM AIX's malloc debugging tools are prone to a local buffer overflow vulnerability. This issue arises because the software fails to perform boundary checks prior to copying user-supplied data into insufficiently-sized memory buffers.

A successful attack allows arbitrary machine code execution with superuser privileges.

80. Alkacon OpenCMS Login Cross-Site Scripting Vulnerability
BugTraq ID: 15882
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15882
Summary:
OpenCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

81. SiteNet BBS Cross-Site Scripting Vulnerability
BugTraq ID: 15883
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15883
Summary:
SiteNet BBS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

82. BBBoard V2 Cross-Site Scripting Vulnerability
BugTraq ID: 15884
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15884
Summary:
bbBoard v2 is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

83. DCForum DCBoard Script Page Parameter Cross-Site Scripting Vulnerability
BugTraq ID: 15885
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15885
Summary:
DCForum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

84. Atlant Pro Cross-Site Scripting Vulnerabilities
BugTraq ID: 15886
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15886
Summary:
Atlant Pro is prone to cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

85. AltantForum Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 15887
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15887
Summary:
AtlantForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

86. CommerceSQL Search Module Cross-Site Scripting Vulnerability
BugTraq ID: 15888
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15888
Summary:
CommerceSQL is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

87. eDatCat EDCstore.PL Cross-Site Scripting Vulnerability
BugTraq ID: 15889
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15889
Summary:
eDatCat is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

88. Soft4e ECW-Cart Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 15890
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15890
Summary:
ECW-Cart is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

89. ECTOOLS Onlineshop Cross-Site Scripting Vulnerability
BugTraq ID: 15891
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15891
Summary:
ECTOOLS Onlineshop is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

90. PPCal Shopping Cart Cross-Site Scripting Vulnerability
BugTraq ID: 15892
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15892
Summary:
PPCal Shopping Cart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

91. Zaygo DomainCart Cross-Site Scripting Vulnerability
BugTraq ID: 15893
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15893
Summary:
Zaygo DomainCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

DomainCart 2.0 and prior versions are reportedly vulnerable.

Zaygo HostingCart 2.0 and prior versions are reportedly vulnerable as well.

92. StaticStore Search.CGI Cross-Site Scripting Vulnerability
BugTraq ID: 15895
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15895
Summary:
StaticStore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Version 1.189A is vulnerable to this issue. Other versions may also be affected.

93. Kryptronic ClickCartPro CP-APP.CGI Cross-Site Scripting Vulnerability
BugTraq ID: 15896
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15896
Summary:
Kryptronic ClickCartPro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Version 5.1 is affected by this issue. Prior versions may also be affected.

94. The CITY Shop Search Cross-Site Scripting Vulnerability
BugTraq ID: 15897
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15897
Summary:
The CITY Shop is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

The CITY Shop version 1.3 is vulnerable to this issue. Prior versions may also be affected.

95. Dick Copits PDEstore Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 15898
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15898
Summary:
Dick Copits PDEstore is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Version 1.8 of PDEstore is affected by these issues. Other versions may also be affected.

96. AlmondSoft Almond Classifieds SQL Injection Vulnerability
BugTraq ID: 15899
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15899
Summary:
AlmondSoft Almond Classifieds is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

97. Plexum PlexCart X3 SQL Injection Vulnerability
BugTraq ID: 15900
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15900
Summary:
Plexum PlexCart X3 is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

98. SSH Tectia Server Host Authentication Authorization Bypass Vulnerability
BugTraq ID: 15903
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15903
Summary:
SSH Tectia Server is susceptible to an authorization bypass vulnerability. This issue is due to a failure of the application to properly validate login credentials when using host-based authentication. Successful host-based authentication is required to exploit this issue, limiting the sources of attack to computers already configured to connect to the server. Host-based authentication is disabled by default in vulnerable servers.

This issue allows remote attackers to logon to computers using the vulnerable application with illegitimate credentials. Privilege escalation and unauthorized access may be possible.

99. Macromedia Cold Fusion MX Multiple Vulnerabilities
BugTraq ID: 15904
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15904
Summary:
Macromedia ColdFusion MX is affect by multiple vulnerabilities.

The following four issues were reported:

- A security vulnerabilty related to the JRun clustered sandbox. This issue affects Macromedia ColdFusion MX 6.0, 6.1. 6.1 with JRun, and 7.0.

- An input validation vulnerability related to the CFMAIL tag. This issue affects Macromedia ColdFusion MX 6.0, 6.1. 6.1 with JRun, and 7.0.

- A security vulnerability related to the CFOBJECT/CreateObject sandbox security setting. This issue affects ColdFusion MX 7.0.

- A security vulnerability that could expose the ColdFusion Administrator password hash to unauthorized parties. This issue affects ColdFusion MX 7.0.

100. Macromedia JRun Multiple Vulnerabilities
BugTraq ID: 15905
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15905
Summary:
Macromedia JRun is affected by multiple security vulnerabilities.

The following issues were reported:

- Multiple vulnerabilities that let remote users gain unauthorized access to Web application source code.

- A denial of service vulnerability in the JRun Web Server component.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Sober virus scares up child-porn confession
By: Robert Lemos
A 20-year-old German man turned himself in to authorities after receiving a copy of the mass-mailing virus, which arrives attached to an e-mail message claiming that law enforcement is investigating the recipient.
http://www.securityfocus.com/news/11365

2. Researchers: Flaw auctions would improve security
By: Robert Lemos
Online auctioneer eBay pulls a seller's second attempt to make money from a vulnerability in Microsoft Excel as security professionals argue that a free market in vulnerabilities could improve software security.
http://www.securityfocus.com/news/11364

3. eBay pulls vulnerability auction
By: Robert Lemos
The online auction giant shuts down the bidding for a vulnerability in Microsoft's Excel spreadsheet program, saying that the sale of flaw research violates the site's policy against encouraging illegal activity.
http://www.securityfocus.com/news/11363

4. Consumers improving security, but gaps remain
By: Robert Lemos
A study of Internet users finds that fewer home PCs had been compromised by spyware or a virus infection than the year before, but the large majority still lack spyware protection, up-to-date antivirus or a properly configured firewall.
http://www.securityfocus.com/news/11361

5. Skype under scrutiny for bugs
By: John Leyden
The recent emergence of two sets of serious security vulnerabilities in Skype, the popular VoIP communications software app, couldn't have come at a worse time for the firm.
http://www.securityfocus.com/news/11354

6. Say hello to the Skype Trojan
By: John Leyden
Virus writers are targeting Skype users with a new Trojan that poses as the latest version of the popular VoIP software.
http://www.securityfocus.com/news/11348

7. Shared music abuse bug hits iTunes
By: John Leyden
Security researchers have discovered a vulnerability in Apple's popular iTunes application which might be exploited to interfere with shared music downloads.
http://www.securityfocus.com/news/11347

8. US cybersecurity all at sea
By: John Leyden
US cybersecurity risks are being poorly managed by the Department of Homeland Security, according to a former US presidential information security advisor.
http://www.securityfocus.com/news/11345

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Security System Administrator, Waukegan 50 miles north of Chicago
http://www.securityfocus.com/archive/77/419869

2. [SJ-JOB] Technical Support Engineer, New Castle
http://www.securityfocus.com/archive/77/419875

3. [SJ-JOB] Disaster Recovery Coordinator, Weehawken
http://www.securityfocus.com/archive/77/419867

4. [SJ-JOB] Database Security Architect, Washington
http://www.securityfocus.com/archive/77/419868

5. [SJ-JOB] Compliance Officer, New Castle
http://www.securityfocus.com/archive/77/419872

6. [SJ-JOB] Director, Information Security, Warren
http://www.securityfocus.com/archive/77/419887

7. [SJ-JOB] Technical Support Engineer, New Castle
http://www.securityfocus.com/archive/77/419865

8. [SJ-JOB] Disaster Recovery Coordinator, Stanford
http://www.securityfocus.com/archive/77/419801

9. [SJ-JOB] Sr. Security Analyst, Dallas Metro Area
http://www.securityfocus.com/archive/77/419806

10. [SJ-JOB] Auditor, Stanford
http://www.securityfocus.com/archive/77/419798

11. [SJ-JOB] Sr. Security Engineer, Bay Area
http://www.securityfocus.com/archive/77/419802

12. [SJ-JOB] Sr. Security Analyst, Woodland Hills
http://www.securityfocus.com/archive/77/419797

13. [SJ-JOB] Sr. Security Analyst, Tampa Bay / St. Petersburg Area
http://www.securityfocus.com/archive/77/419799

14. [SJ-JOB] Application Security Engineer, Tampa Bay / St. Petersburg Area
http://www.securityfocus.com/archive/77/419800

15. [SJ-JOB] Security Architect, ******
http://www.securityfocus.com/archive/77/419796

16. [SJ-JOB] Security Researcher, Palo Alto
http://www.securityfocus.com/archive/77/419734

17. [SJ-JOB] Security Consultant, South London
http://www.securityfocus.com/archive/77/419735

18. [SJ-JOB] Security Consultant, New York
http://www.securityfocus.com/archive/77/419731

19. [SJ-JOB] Security Engineer, Warren
http://www.securityfocus.com/archive/77/419732

20. [SJ-JOB] Security Engineer, Reston
http://www.securityfocus.com/archive/77/419733

21. [SJ-JOB] Security Engineer, New York
http://www.securityfocus.com/archive/77/419730

22. [SJ-JOB] Sr. Security Analyst, atlanta
http://www.securityfocus.com/archive/77/419728

23. [SJ-JOB] Jr. Security Analyst, Redwood City
http://www.securityfocus.com/archive/77/419726

24. [SJ-JOB] Sales Representative, Livonia
http://www.securityfocus.com/archive/77/419727

25. [SJ-JOB] Sales Representative, Vienna
http://www.securityfocus.com/archive/77/419729

26. [SJ-JOB] Security Researcher, Redwood City
http://www.securityfocus.com/archive/77/419725

27. [SJ-JOB] Application Security Engineer, RoseLand
http://www.securityfocus.com/archive/77/419592

28. [SJ-JOB] Security Director, New York
http://www.securityfocus.com/archive/77/419590

29. [SJ-JOB] Database Security Engineer, Atlanta
http://www.securityfocus.com/archive/77/419591

30. [SJ-JOB] CSO, Bay Area
http://www.securityfocus.com/archive/77/419550

31. [SJ-JOB] Security Consultant, New York
http://www.securityfocus.com/archive/77/419552

32. [SJ-JOB] Technical Writer, Reading - Berkshire
http://www.securityfocus.com/archive/77/419547

33. [SJ-JOB] CHECK Team Leader, London - UK Wide
http://www.securityfocus.com/archive/77/419549

34. [SJ-JOB] Sr. Security Analyst, London - UK Wide
http://www.securityfocus.com/archive/77/419551

35. [SJ-JOB] Quality Assurance, Ann Arbor
http://www.securityfocus.com/archive/77/419499

36. [SJ-JOB] Management, Ann Arbor
http://www.securityfocus.com/archive/77/419507

37. [SJ-JOB] Forensics Engineer, Fort Worth
http://www.securityfocus.com/archive/77/419490

38. [SJ-JOB] Sr. Security Engineer, Detroit
http://www.securityfocus.com/archive/77/419491

39. [SJ-JOB] Sr. Security Engineer, Bellevue
http://www.securityfocus.com/archive/77/419505

40. [SJ-JOB] Developer, Buckinghamshire
http://www.securityfocus.com/archive/77/419468

41. [SJ-JOB] Technical Support Engineer, Aylesbury
http://www.securityfocus.com/archive/77/419466

42. [SJ-JOB] Account Manager, Copenhagen
http://www.securityfocus.com/archive/77/419467

43. [SJ-JOB] Regional Channel Manager, Copenhagen
http://www.securityfocus.com/archive/77/419465

44. [SJ-JOB] Security Product Marketing Manager, Munich
http://www.securityfocus.com/archive/77/419464

45. [SJ-JOB] Sr. Security Engineer, Philadelphia
http://www.securityfocus.com/archive/77/419461

46. [SJ-JOB] Account Manager, Munich
http://www.securityfocus.com/archive/77/419462

47. [SJ-JOB] Channel / Business Development, Munich
http://www.securityfocus.com/archive/77/419463

V. INCIDENTS LIST SUMMARY
---------------------------
1. A bit strange ARP queries
http://www.securityfocus.com/archive/75/419598

2. SF new column announcement: Users inundated with pop-ups, by Scott Granneman
http://www.securityfocus.com/archive/75/419449

VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. BETA v2.0 released
http://www.securityfocus.com/archive/82/419718

2. Linux MIPS shellcode (Big Endian)
http://www.securityfocus.com/archive/82/419647

3. Metasploit Framework v3.0 Alpha Release 1
http://www.securityfocus.com/archive/82/419581

VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. sober resurfacing
http://www.securityfocus.com/archive/88/419567

2. SecurityFocus Microsoft Newsletter #269
http://www.securityfocus.com/archive/88/419434

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
1. SF new article announcement: OpenSSH cutting edge
http://www.securityfocus.com/archive/91/419888

X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: Norwich University

http://www.msia.norwich.edu/secfocus_en