SecurityFocus Newsletter #340

Peter Laborge <[email protected]> Tue, 07 Mar 2006 15:42:30 -0700

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #340
----------------------------------------

This Issue is Sponsored by: Watchfire

Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? See for yourself. Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701300000007kr1

------------------------------------------------------------------
I. FRONT AND CENTER
1. The big DRM mistake
2. The value of vulnerabilities
II. BUGTRAQ SUMMARY
1. Invision Power Board Showtopic SQL Injection Vulnerability
2. Flex Multiple Unspecified Vulnerabilities
3. OpenSSH Remote PAM Denial Of Service Vulnerability
4. Mozilla Thunderbird Multiple Remote Information Disclosure Vulnerabilities
5. Lighttpd Remote Script Disclosure Vulnerability
6. Compex NetPassage WPE54G Denial Of Service Vulnerability
7. Linux Kernel die_if_kernel Local Denial of Service Vulnerability
8. VBZoom Forum Show.PHP MainID SQL Injection Vulnerability
9. FFmpeg LibAVCodec Heap Buffer Overflow Vulnerability
10. XPDF JPX Stream Reader Remote Heap Buffer Overflow Vulnerability
11. Sun Solaris UUSTAT Local Buffer Overflow Vulnerability
12. Sun Solaris Operating System Unspecified Privilege Escalation Vulnerability
13. Sun Solaris LPSCHED Multiple Local Vulnerabilities
14. Microsoft IIS Authentication Method Disclosure Vulnerability
15. Mozilla/Netscape/Firefox Browsers Domain Name Remote Buffer Overflow Vulnerability
16. Mozilla Browser/Firefox Arbitrary Command Execution Vulnerability
17. SuSE YaST Online Update Script Signature Verification Bypass Vulnerability
18. FreeBSD Remote NFS RPC Request Denial of Service Vulnerability
19. Perl Perl_sv_vcatpvfn Format String Integer Wrap Vulnerability
20. SquirrelMail Multiple Cross-Site Scripting and IMAP Injection Vulnerabilities
21. Oracle Diagnostics Multiple Vulnerabilities
22. PEHEPE Membership Management System Remote PHP Script Code Injection Vulnerability
23. PEHEPE Membership Management System Sol_menu.PHP Cross-Site Scripting Vulnerability
24. Squid Proxy SSLConnectTimeout Remote Denial Of Service Vulnerability
25. CrossFire Denial Of Service Vulnerability
26. Simplog Information Disclosure Vulnerability
27. Linux Kernel sys_mbind System Call Local Denial of Service Vulnerability
28. Mozilla Browser/Firefox DOM Objects Spoofing Vulnerability
29. Papoo Multiple SQL Injection Vulnerabilities
30. Mozilla Browser/Firefox Arbitrary HTTP Request Injection Vulnerability
31. Linux Kernel XFS File System Local Information Disclosure Vulnerability
32. GNU Tar Invalid Headers Buffer Overflow Vulnerability
33. VBulletin Profile.PHP Email Field HTML Injection Vulnerability
34. LetterMerger Local Information Disclosure Vulnerability
35. Apache mod_python FileSession Code Execution Vulnerability
36. IRSSI DCC ACCEPT Denial of Service Vulnerability
37. PCRE Regular Expression Heap Overflow Vulnerability
38. PluggedOut Nexus forgotten_password.PHP SQL Injection Vulnerability
39. Apache CGI Byterange Request Denial of Service Vulnerability
40. Apache mod_disk_cache Module Client Authentication Credential Storage Weakness
41. Apache HTTP Request Smuggling Vulnerability
42. Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability
43. RevilloC MailServer Remote Buffer Overflow Vulnerability
44. Eschew.Net PHPBannerExchange ResetPW.PHP Directory Traversal Vulnerability
45. Zoo Misc.c Buffer Overflow Vulnerability
46. Up-IMAPProxy Multiple Unspecified Remote Format String Vulnerabilities
47. Apple Mac OS X Unspecified Local Vulnerability
48. Apache mod_ssl SSLCipherSuite Restriction Bypass Vulnerability
49. Apache mod_include Local Buffer Overflow Vulnerability
50. UKiWEB UKiBoard FCE.PHP BBCode HTML Injection Vulnerability
51. Apple Mac OS X Perl Insecure Privilege Dropping Weakness
52. DCI-Designs Dawaween Poems.PHP SQL Injection Vulnerability
53. Guestbox HTML Injection Vulnerability
54. LibTIFF TIFFOpen Buffer Overflow Vulnerability
55. PHP Apache 2 Local Denial of Service Vulnerability
56. XPDF Multiple Unspecified Vulnerabilities
57. Tutos Multiple Remote Input Validation Vulnerabilities
58. Apple Mac OS X Archive Metadata Command Execution Vulnerability
59. Libdbi-perl Unspecified Insecure Temporary File Creation Vulnerability
60. Sun Java Runtime Environment Multiple Privilege Escalation Vulnerabilities
61. GNUTLS LibTASN1 DER Decoding Denial of Service Vulnerabilities
62. Microsoft Visual Studio DBP and SLN Files DataProject Buffer Overflow Vulnerability
63. NCP Secure Client Multiple Vulnerabilities
64. IBM WebSphere Application Server JSP Source Code Disclosure Vulnerability
65. SMBlog Arbitrary PHP Command Execution Vulnerability
66. Issue Dealer Information Disclosure Vulnerability
67. Noah's Classifieds Index.PHP Multiple Cross-Site Scripting Vulnerabilities
68. Noah's Classifieds Local File Include Vulnerability
69. ProFTPD _xlate_ascii_write() Buffer Overrun Vulnerability
70. Mozilla Browser/Firefox JavaScript Engine Integer Overflow Vulnerability
71. Akarru Social BookMarking Engine Users.PHP SQL Injection Vulnerability
72. Comvigo IM Lock 2006 Insecure Password Storage Vulnerability
73. CyBoards PHP Lite Process_post.PHP SQL Injection Vulnerability
74. Sauerbraten Multiple Remote Vulnerabilities
75. Fantastic News Archive.PHP Remote Code Execution Vulnerability
76. D2-Shoutbox SQL Injection Vulnerability
77. Evo-Dev evoBlog Comment Post HTML Injection Vulnerability
78. Tenes Empanadas Graciela Remote Denial Of Service Vulnerability
79. Monopd Remote Denial Of Service Vulnerability
80. Game-Panel Login.PHP Cross-Site Scripting Vulnerability
81. Microsoft Internet Explorer Java Applet Handling Denial of Service Vulnerability
82. M-Phorum Remote File Include Vulnerability
83. Freeciv Remote Denial Of Service Vulnerability
84. Bitweaver Title Field HTML Injection Vulnerability
85. Acme Labs thttpd HTPasswd Multiple Vulnerabilities
86. RunCMS Bigshow.PHP Cross-Site Scripting Vulnerability
87. VBZoom Profile.PHP Cross-Site Scripting Vulnerability
88. DVGuestbook Multiple Cross-Site Scripting Vulnerabilities
89. Noah's Classifieds Index.PHP Remote File Include Vulnerability
90. Sendcard Multiple Unspecified SQL Injection Vulnerabilities
91. Limbo CMS Frontpage Arbitrary PHP Command Execution Vulnerability
92. GNOME Evolution Denial Of Service Vulnerability
93. Cisco IOS TCLSH AAA Command Authorization Bypass Vulnerability
94. 4images Index.PHP Remote File Include Vulnerability
95. Leif M. Wright Blog HTML Injection Vulnerability
96. Leif M. Wright Blog.CGI Authorization Bypass Vulnerability
97. AddSoft StoreBot Manage.ASP Cross-Site Scripting Vulnerability
98. AddSoft StoreBot MgrLogin.ASP SQL Injection Vulnerability
99. MyPHPNuke Multiple Cross-Site Scripting Vulnerabilities
100. NetworkActiv Web Server Remote Script Disclosure Vulnerability
III. SECURITYFOCUS NEWS
1. Antivirus groups fight over Crossover sharing
2. Triple threat to Mac OS X largely academic
3. Private identities become a corporate focus
4. Startup tries to spin a safer Web
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Quality Assurance, Redwood City
2. [SJ-JOB] Developer, Columbia MD
3. [SJ-JOB] Sr. Security Analyst, West Mifflin
4. [SJ-JOB] Developer, Columbia
5. [SJ-JOB] Security Engineer, Ann Arbor
6. [SJ-JOB] Sr. Security Analyst, San Antonio
7. [SJ-JOB] Jr. Security Analyst, San Antonio
8. [SJ-JOB] Sr. Security Engineer, San Antonio
9. [SJ-JOB] Security Engineer, Austin
10. [SJ-JOB] Security Engineer, San Antonio
11. [SJ-JOB] Sr. Security Engineer, Arlington
12. [SJ-JOB] Sales Engineer, Seattle
13. [SJ-JOB] Security Consultant, UK Wide
14. [SJ-JOB] Security Engineer, Richmond
15. [SJ-JOB] Manager, Information Security, London
16. [SJ-JOB] Security Consultant, London
17. [SJ-JOB] Technical Marketing Engineer, Sunnyvale
18. [SJ-JOB] Security Consultant, Ottawa
19. [SJ-JOB] Disaster Recovery Coordinator, London
20. [SJ-JOB] Security Researcher, Redwood City
21. [SJ-JOB] Security Researcher, Sunnyvale
22. [SJ-JOB] Chief Scientist, Herndon
23. [SJ-JOB] Sr. Security Engineer, DC/Chantilly
24. [SJ-JOB] Jr. Security Analyst, East Anglia
25. [SJ-JOB] Security Engineer, Knoxville
26. [SJ-JOB] Security Consultant, Work Remotely or Charlotte
27. [SJ-JOB] Security Consultant, Leeds
28. [SJ-JOB] Manager, Information Security, Arcade
29. [SJ-JOB] Sales Engineer, New York
30. [SJ-JOB] Security Consultant, Liverpool
31. [SJ-JOB] Application Security Architect, Tokyo
32. [SJ-JOB] Security Architect, Chicago
33. [SJ-JOB] Security Consultant, Anywhere in U.S.
34. [SJ-JOB] Auditor, New York
35. [SJ-JOB] Sr. Security Engineer, New York
36. [SJ-JOB] Jr. Security Analyst, Redwood Shores
37. [SJ-JOB] Security Consultant, Redmond
V. INCIDENTS LIST SUMMARY
1. Call For Papers - DRFWS 2006
2. Detecting Cisco IOS probes
3. Scans for telnetd on DNS servers.
4. Bot net? SPAM Bounces...
5. Internet SSH scans
6. Strange Traffic to ports 139 and 137 from a machine with no data
VI. VULN-DEV RESEARCH LIST SUMMARY
1. SyScan'06 Call For Papers
VII. MICROSOFT FOCUS LIST SUMMARY
1. Administrivia: Holidays
2. Questions regarding EFS
3. programming Aeronet card for authentication and configuration in embedded XP
4. SecurityFocus Microsoft Newsletter #280
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
1. IPS HLBR 1.0 released (off-topic)
2. New SecurityFocus article published.
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. The big DRM mistake
By Scott Granneman
Digital Rights Managements hurts paying customers, destroys Fair Use rights, renders customers' investments worthless, and can always be defeated. Why are consumers and publishers being forced to use DRM?
http://www.securityfocus.com/columnists/390

2. The value of vulnerabilities
By Jason Miller
There is value in finding vulnerabilities. Yet many people believe that a vulnerability doesn't exist until it is disclosed to the public. We know that vulnerabilities need to be disclosed, but what role do vendors have to make these issues public?
http://www.securityfocus.com/columnists/391

II. BUGTRAQ SUMMARY
--------------------
1. Invision Power Board Showtopic SQL Injection Vulnerability
BugTraq ID: 16971
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16971
Summary:

Invision Power Board is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

2. Flex Multiple Unspecified Vulnerabilities
BugTraq ID: 16896
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16896
Summary:
Flex is reportedly prone to multiple unspecified security vulnerabilities. The cause and impact of these issues are currently unknown.

Flex versions 2.5.31 and prior are vulnerable.

3. OpenSSH Remote PAM Denial Of Service Vulnerability
BugTraq ID: 16892
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16892
Summary:
OpenSSH is susceptible to a remote denial-of-service vulnerability. This issue is due to a design flaw when handling connections when configured to use OpenPAM authentication system.

This issue may be exploited by remote attackers to deny SSH service to legitimate users.

OpenSSH in conjunction with OpenPAM on FreeBSD versions 5.3 and 5.4 are affected by this issue. Other operating systems and versions may also be affected.

4. Mozilla Thunderbird Multiple Remote Information Disclosure Vulnerabilities
BugTraq ID: 16881
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16881
Summary:
Mozilla Thunderbird is susceptible to multiple remote information-disclosure vulnerabilities. These issues are due to the application's failure to properly enforce the restriction for downloading remote content in email messages.

These issues allow remote attackers to gain access to potentially sensitive information, aiding them in further attacks. Attackers may also exploit these issues to know whether and when users read email messages.

Mozilla Thunderbird version 1.5 is vulnerable to these issues; other versions may also be affected.

5. Lighttpd Remote Script Disclosure Vulnerability
BugTraq ID: 16893
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16893
Summary:

The 'lighttpd' webserver is prone to an information-disclosure vulnerability. An attacker may obtain the source code of script files.

Scripts may contain sensitive information that may aid in further attacks launched against the target computer.

Versions prior to 1.4.10a of lighttpd for Windows are vulnerable.

6. Compex NetPassage WPE54G Denial Of Service Vulnerability
BugTraq ID: 16894
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16894
Summary:
NetPassage WPE54G is prone to a remote denial-of-service vulnerability. This issue is due to a failure in the device to properly handle user-supplied input.

An attacker can exploit this issue to crash the affected device, effectively denying service to legitimate users.

7. Linux Kernel die_if_kernel Local Denial of Service Vulnerability
BugTraq ID: 16993
Remote: No
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16993
Summary:

The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a design error and arises in the 'die_if_kernel()' function.

This vulnerability allows local users to panic the kernel, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.6.15.6 running on Itanium systems.

8. VBZoom Forum Show.PHP MainID SQL Injection Vulnerability
BugTraq ID: 16955
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16955
Summary:
VBZooM Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

9. FFmpeg LibAVCodec Heap Buffer Overflow Vulnerability
BugTraq ID: 15743
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/15743
Summary:
FFmpeg's libavcodec is susceptible to a heap buffer-overflow vulnerability. This issue is due to the library's failure to properly bounds-check user-supplied data before using it in memory allocation and copy operations.

Attackers may exploit this vulnerability to execute arbitrary code in the context of applications that use an affected version of the libavcodec library.

An attacker can exploit this issue by enticing a user to open a malformed PNG file with an application that uses a vulnerable version of libavcodec. If the application is configured as the default handler for PNG files, this could present a viable web or email attack vector -- when the PNG is clicked from an appropriate client application, the application using the vulnerable library will automatically be invoked.

10. XPDF JPX Stream Reader Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 15721
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/15721
Summary:
The 'xpdf' utility is reported prone to a remote buffer-overflow vulnerability. This issue exists because the application fails to perform proper boundary checks before copying user-supplied data into process buffers. A remote attacker may execute arbitrary code in the context of a user running the application. As a result, the attacker can gain unauthorized access to the vulnerable computer.

Reportedly, this issue presents itself in the 'JPXStream::readCodestream' function residing in the 'xpdf/JPXStream.cc' file.

This issue is reported to affect xpdf 3.01, but earlier versions are likely prone to this vulnerability as well. Applications using embedded xpdf code may also be vulnerable.

The 'kpdf' utility reportedly incorporates vulnerable xpdf code. Version 0.5 of kpdf is prone to this issue, but other versions may also be affected.

11. Sun Solaris UUSTAT Local Buffer Overflow Vulnerability
BugTraq ID: 16193
Remote: No
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16193
Summary:
Sun Solaris uustat utility is prone to a local buffer overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code and gain 'uucp' user privileges which correspond to user ID 5 by default.

12. Sun Solaris Operating System Unspecified Privilege Escalation Vulnerability
BugTraq ID: 16224
Remote: No
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16224
Summary:
Sun Solaris on x86 platforms is prone to an unspecified privilege escalation vulnerability.

This vulnerability is due to an unspecified security issue which may allow a local unprivileged user to gain elevated privileges or panic the kernel.

This issue affects the Solaris 9 and 10 operating system.

13. Sun Solaris LPSCHED Multiple Local Vulnerabilities
BugTraq ID: 16245
Remote: No
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16245
Summary:
Sun Solaris lpsched is prone to multiple unspecified local vulnerabilities.

Successful attacks could lead to a denial of service condition in the computer due to data corruption. The LP print service may be stopped as well.

14. Microsoft IIS Authentication Method Disclosure Vulnerability
BugTraq ID: 4235
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/4235
Summary:
Microsoft IIS supports Basic and NTLM authentication. Reportedly, the authentication methods supported by a given IIS server can be revealed to an attacker through the inspection of returned error messages, even when anonymous access is also granted.

When a valid authentication request is submitted for either message with an invalid username and password, an error message will be returned. This happens even if anonymous access to the requested resource is allowed. An attacker may be able to use this information to launch further intelligent attacks against the server, or to launch a brute-force password attack against a known username.

15. Mozilla/Netscape/Firefox Browsers Domain Name Remote Buffer Overflow Vulnerability
BugTraq ID: 14784
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/14784
Summary:
Mozilla/Netscape/Firefox are reported prone to a remote buffer-overflow vulnerability when handling a malformed URI.

A successful attack may result in a crash of the application or the execution of arbitrary code.

Firefox 1.0.6 and 1.5 Beta 1 are vulnerable to this issue. Mozilla 1.7.11 and Netscape 8.0.3.3 and 7.2 are affected as well.

16. Mozilla Browser/Firefox Arbitrary Command Execution Vulnerability
BugTraq ID: 14888
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/14888
Summary:
Mozilla Browser/Firefox are affected by an arbitrary command-execution vulnerability.

This attack would occur in the context of the user running the vulnerable application and may facilitate unauthorized remote access.

Mozilla Firefox 1.0.6 running on UNIX-based platforms is reportedly vulnerable. Other versions and applications employing Firefox functionality may be vulnerable as well.

Mozilla Browser 1.7.x versions and Thunderbird 1.x versions are also vulnerable to this issue.

17. SuSE YaST Online Update Script Signature Verification Bypass Vulnerability
BugTraq ID: 16889
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16889
Summary:

SuSE YaST Online Update (YOU) is prone to a signature-bypass vulnerability. This could allow any script to be supplied and executed by the YOU utility. To exploit this issue, an attacker would have to be able to manipulate files on a YOU mirror or perform a man-in-the-middle attack.

18. FreeBSD Remote NFS RPC Request Denial of Service Vulnerability
BugTraq ID: 16838
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16838
Summary:
FreeBSD is susceptible to a remote denial-of-service vulnerability. This issue is due to a flaw in affected versions of the kernel that potentially results in a crash when handling malformed RPC messages through TCP.

This issue allows remote attackers to cause affected systems to crash, denying further network service to legitimate users.

19. Perl Perl_sv_vcatpvfn Format String Integer Wrap Vulnerability
BugTraq ID: 15629
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/15629
Summary:
Perl is susceptible to a format-string vulnerability. This issue is due to the programming language's failure to properly handle format specifiers in formatted-printing functions.

An attacker may leverage this issue to write to arbitrary process memory, facilitating code execution in the context of the Perl interpreter process. This can result in unauthorized remote access.

Developers should treat the formatted printing functions in Perl as equivalently vulnerable to exploitation as the C library versions, and should properly sanitize all data passed in the format-specifier argument.

All applications that use formatted-printing functions in an unsafe manner should be considered exploitable.

20. SquirrelMail Multiple Cross-Site Scripting and IMAP Injection Vulnerabilities
BugTraq ID: 16756
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16756
Summary:
SquirrelMail is susceptible to multiple cross-site scripting and IMAP-injection vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input.

An attacker may leverage any of the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

An attacker may leverage the IMAP-injection issue to execute arbitrary IMAP commands on the configured IMAP server. This may aid attackers in further attacks as well as allow them to exploit latent vulnerabilities in the IMAP server.

21. Oracle Diagnostics Multiple Vulnerabilities
BugTraq ID: 16844
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16844
Summary:

The Oracle Diagnostics module is susceptible to multiple vulnerabilities. These issues include insecure permissions, insecure default access, and SQL injection.

- Insecure-permissions vulnerability. This may allow remote attackers to gain access to potentially sensitive information that may aid them in further attacks.

- Default-access vulnerabilities. Successful exploits could allow an attacker to gain access to potentially sensitive information that may aid them in further attacks.

- Unspecified SQL-injection issues. Successful exploits could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Oracle has released the 'Diagnostics Support Pack February 2006' with 'Oracle Diagnostics 2.3 RUP A' to address these vulnerabilities. This update addresses the vulnerabilities for supported releases. Earlier, unsupported releases are likely to be affected by the issues as well.

Other issues may have also been addressed with these fixes. This BID will be updated as further information is disclosed.

22. PEHEPE Membership Management System Remote PHP Script Code Injection Vulnerability
BugTraq ID: 16887
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16887
Summary:
PEHEPE Membership Management System is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to facilitate a compromise of the application and the underlying system; other attacks are also possible.

PEHEPE Membership Management System version 3 is vulnerable to this issue; other versions may also be affected.

23. PEHEPE Membership Management System Sol_menu.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 16885
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16885
Summary:
PEHEPE Membership Management System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

24. Squid Proxy SSLConnectTimeout Remote Denial Of Service Vulnerability
BugTraq ID: 14731
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/14731
Summary:
A remote denial-of-service vulnerability affects the Squid Proxy. The application fails to properly handle exceptional network requests.

A remote attacker may leverage this issue to crash the affected Squid Proxy, denying service to legitimate users.

25. CrossFire Denial Of Service Vulnerability
BugTraq ID: 16883
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16883
Summary:

CrossFire is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the application to crash by activating the 'oldsocketmode' option, and then sending an overly large request to the server application.

An attacker may cause the application to crash, thus denying service to legitimate users; remote code execution may also be possible.

26. Simplog Information Disclosure Vulnerability
BugTraq ID: 16965
Remote: Yes
Last Updated: 2006-03-04
Relevant URL: http://www.securityfocus.com/bid/16965
Summary:
Simplog is prone to an information disclosure vulnerability. The application fails to properly sanitize user-supplied input.

Attackers may exploit this issue to gain access to potentially sensitive information, aiding them in further attacks.

Simplog version 1.0.2 is vulnerable to these issues; other versions may also be affected.

27. Linux Kernel sys_mbind System Call Local Denial of Service Vulnerability
BugTraq ID: 16924
Remote: No
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16924
Summary:
The Linux kernel 'sys_mbind' system call is prone to a local denial-of-service vulnerability. This issue is due to a lack of proper input sanitization in the system call's arguments.

This issue allows local users to panic the kernel, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.6.15.5.

28. Mozilla Browser/Firefox DOM Objects Spoofing Vulnerability
BugTraq ID: 14921
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/14921
Summary:
Mozilla and Firefox are prone to a DOM object spoofing vulnerability. Successful exploitation could allow a remote attacker to execute arbitrary script code with elevated privileges.

29. Papoo Multiple SQL Injection Vulnerabilities
BugTraq ID: 16020
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16020
Summary:

Papoo is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

These issues affect version 2.1.2; other versions may also be vulnerable.

30. Mozilla Browser/Firefox Arbitrary HTTP Request Injection Vulnerability
BugTraq ID: 14923
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/14923
Summary:
Mozilla and Firefox browsers are prone to a vulnerability that permits the injection of arbitrary HTTP requests. This issue is due to a failure in the application to properly sanitize user-supplied input.

This issue can be used to exploit server or proxy flaws from the user's machine, or to fool a server or proxy into thinking a single request is a stream of separate requests.

31. Linux Kernel XFS File System Local Information Disclosure Vulnerability
BugTraq ID: 16921
Remote: No
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16921
Summary:
The Linux kernel's XFS filesystem is susceptible to a local information-disclosure vulnerablity. This issue is due to a flaw in the filesystem that may result in previously written data being returned to local users.

This issue allows local malicious users to gain access to potentially sensitive data, aiding them in further attacks.

Linux kernel versions prior to 2.6.15.5 are affected by this issue.

32. GNU Tar Invalid Headers Buffer Overflow Vulnerability
BugTraq ID: 16764
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16764
Summary:

GNU Tar is prone to a buffer overflow when handling invalid headers. Successful exploitation could potentially lead to arbitrary code execution, though this has not been confirmed.

Tar versions 1.14 and above are vulnerable.

33. VBulletin Profile.PHP Email Field HTML Injection Vulnerability
BugTraq ID: 16919
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16919
Summary:
vBulletin is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

This issue is reported to affect vBulletin versions 3.0.12 through 3.5.3. Other versions may also be affected.

34. LetterMerger Local Information Disclosure Vulnerability
BugTraq ID: 16917
Remote: No
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16917
Summary:

LetterMerger is prone to a local information-disclosure vulnerability. This issue exists because the application stores data with insecure permissions in a Microsoft Access database.

LetterMerger 1.2 is vulnerable; other versions may also be affected.

35. Apache mod_python FileSession Code Execution Vulnerability
BugTraq ID: 16916
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16916
Summary:

Apache mod_python is prone to a code-execution vulnerability.

Presumably, this issue can be exploited remotely through a specially crafted session cookie. However, conflicting details also suggest that only local attackers can exploit this vulnerability. This information will be updated when more details become available.

A successful attack may facilitate a remote compromise in the context of the server. Local attacks may be possible as well.

36. IRSSI DCC ACCEPT Denial of Service Vulnerability
BugTraq ID: 16913
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16913
Summary:

The irssi client is prone to a denial-of-service vulnerability. The issue occurs when handling malicious DCC transfers.

Versions 0.8.9 and 0.8.10rc5 of irssi are vulnerable; other versions may also be affected.

37. PCRE Regular Expression Heap Overflow Vulnerability
BugTraq ID: 14620
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/14620
Summary:
PCRE is prone to a heap-overflow vulnerability. This issue is due to the library's failure to properly perform boundary checks on user-supplied input before copying data to an internal memory buffer.

The impact of successful exploitation of this vulnerability depends on the application and the user credentials using the vulnerable library. A successful attack may ultimately permit an attacker to control the contents of critical memory control structures and write arbitrary data to arbitrary memory locations.

38. PluggedOut Nexus forgotten_password.PHP SQL Injection Vulnerability
BugTraq ID: 16915
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16915
Summary:
PluggedOut Nexus is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Nexus 0.1 is reportedly affected by this issue.

39. Apache CGI Byterange Request Denial of Service Vulnerability
BugTraq ID: 14660
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/14660
Summary:
Apache is prone to a denial of service when handling large CGI byterange requests.

40. Apache mod_disk_cache Module Client Authentication Credential Storage Weakness
BugTraq ID: 9933
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/9933
Summary:
Apache's mod_disk_cache module is reported to be prone to a weakness that could result in an attacker gaining access to proxy or standard authentication credentials. The mod_disk_cache module is reported to store HTTP hop-by-hop headers including user login and password information in plaintext format on disk.

An attacker could use this issue in conjunction with other possible vulnerabilities in a host to gain access to user authentication credentials. Successful exploitation of this issue may lead to further attacks against vulnerable users of the affected host.

Apache versions 2.0.49 and prior with mod_disk_cache enabled are assumed to be affected by this issue.

41. Apache HTTP Request Smuggling Vulnerability
BugTraq ID: 14106
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/14106
Summary:
Apache is prone to an HTTP-request-smuggling attack.

A specially crafted request with a 'Transfer-Encoding: chunked' header and a 'Content-Length' header can cause the server to forward a reassembled request with the original 'Content-Length' header. As a result, the malicious request may piggyback on the valid HTTP request.

This attack may result in cache poisoning, cross-site scripting, session hijacking, and other attacks.

This issue was originally described in BID 13873 (Multiple Vendor Multiple HTTP Request Smuggling Vulnerabilities). Due to the availability of more details and vendor confirmation, the issue is now a new BID.

42. Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability
BugTraq ID: 14721
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/14721
Summary:
Apache 2.x mod_ssl is prone to a restriction-bypass vulnerability. This issue presents itself when mod_ssl is configured to be used with the 'SSLVerifyClient' directive.

This issue allows attackers to bypass security policies to gain access to locations that are configured to be forbidden for clients without a valid client certificate.

43. RevilloC MailServer Remote Buffer Overflow Vulnerability
BugTraq ID: 16997
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16997
Summary:

RevilloC MailServer is prone to a remote buffer overflow vulnerability.

This can faciliate a remote compromise due to arbitrary code execution.

RevilloC MailServer 1.21 is reported affected, however, other versions may be vulnerable as well.

44. Eschew.Net PHPBannerExchange ResetPW.PHP Directory Traversal Vulnerability
BugTraq ID: 16996
Remote: Yes
Last Updated: 2006-03-07
Relevant URL: http://www.securityfocus.com/bid/16996
Summary:
phpBannerExchange is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

This issue affects phpBannerExchange versions 2.0 and earlier.

45. Zoo Misc.c Buffer Overflow Vulnerability
BugTraq ID: 16790
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16790
Summary:
Zoo is prone to a buffer-overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data before using it in a finite-sized buffer.

An attacker can exploit this issue to execute arbitrary code in the context of the victim user running the affected application.

46. Up-IMAPProxy Multiple Unspecified Remote Format String Vulnerabilities
BugTraq ID: 15048
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/15048
Summary:
up-IMAPProxy is reported prone to multiple unspecified remote format string vulnerabilities.

Successful exploitation could result in a failure of the application or arbitrary code execution in the context of the application.

Specific details of these issues are not currently known. This BID will be updated when further information becomes available.

47. Apple Mac OS X Unspecified Local Vulnerability
BugTraq ID: 16967
Remote: No
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16967
Summary:

Apple Mac OS X is reportedly prone to an unspecified local vulnerability.

A successful attack may allow a local attacker to gain elevated privileges on a vulnerable computer.

All versions of Mac OS X are considered to be vulnerable.

Due to a lack of information, further details cannot be provided at the moment. This BID will be updated when more information becomes available.

This issue was originally considered to be a remotely exploitable vulnerability, however, new information suggests that this issue may only be exploited by a local attacker.

48. Apache mod_ssl SSLCipherSuite Restriction Bypass Vulnerability
BugTraq ID: 11360
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/11360
Summary:
Apache 2.x mod_ssl is reported prone to a restriction-bypass vulnerability. This issue presents itself when mod_ssl is configured to be used with the 'SSLCipherSuite' directive in a 'Directory' or 'Location' context. Reportedly, this vulnerability allows a client to use any cipher suite allowed by the virtual host configuration regardless of cipher suites specified for a specific directory. This can allow an attacker to bypass security policies and use potentially weaker encryption types than
allowed.

Apache versions 2.0.35 to 2.0.52 are reported vulnerable to this issue.

49. Apache mod_include Local Buffer Overflow Vulnerability
BugTraq ID: 11471
Remote: No
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/11471
Summary:
The problem presents itself when the affected module attempts to parse mod_include-specific tag values. A failure to properly validate the lengths of user-supplied tag strings before copying them into finite buffers facilitates the overflow.

A local attacker may leverage this issue to execute arbitrary code on the affected computer with the privileges of the affected Apache server.

50. UKiWEB UKiBoard FCE.PHP BBCode HTML Injection Vulnerability
BugTraq ID: 16912
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16912
Summary:
UKiBoard is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected site, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

51. Apple Mac OS X Perl Insecure Privilege Dropping Weakness
BugTraq ID: 15833
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/15833
Summary:
Apple Mac OS X's Perl is susceptible to an insecure privilege-dropping weakness. This issue is due to Perl's failure to correctly drop privileges. Presumably, the cause of this issue is a flaw in Perl's compilation options.

This vulnerability may allow attackers that exploit latent vulnerabilities in Perl applications to gain elevated privileges, increasing the potential for damage. The exact impact of exploitation depends on the specific use and implementation of the privilege-dropping facilities in affected Perl applications.

Mac OS X version 10.3.9 is reported vulnerable to this issue. Other versions may also be affected.

52. DCI-Designs Dawaween Poems.PHP SQL Injection Vulnerability
BugTraq ID: 16909
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16909
Summary:
Dawaween is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Dawaween 1.03 is reportedly affected by this issue.

53. Guestbox HTML Injection Vulnerability
BugTraq ID: 16751
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16751
Summary:
Guestbox is prone to an HTML-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

54. LibTIFF TIFFOpen Buffer Overflow Vulnerability
BugTraq ID: 13585
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/13585
Summary:
LibTIFF is prone to a buffer-overflow vulnerability. The issue occurs in the 'TIFFOpen()' function when malformed TIFF files are opened. Successful exploitation could lead to arbitrary code execution.

55. PHP Apache 2 Local Denial of Service Vulnerability
BugTraq ID: 15177
Remote: No
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/15177
Summary:
PHP is prone to a local denial-of-service vulnerability when it is used as an Apache 2 module.

Reports indicate that due to a bug in the apache2handler SAPI (of the 'sapi_apache2.c' file), this issue triggers a segmentation fault and leads to a crash in the server.

This issue affects PHP versions prior to 5.1.0 final and 4.4.1 final.

56. XPDF Multiple Unspecified Vulnerabilities
BugTraq ID: 16748
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16748
Summary:

The 'xpdf' utility is reportedly prone to multiple unspecified security vulnerabilities. The cause and impact of these issues are currently unknown.

All versions of xpdf are considered vulnerable at the moment. This BID will update when more information becomes available.

57. Tutos Multiple Remote Input Validation Vulnerabilities
BugTraq ID: 11221
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/11221
Summary:
Tutos is reported prone to multiple remote input-validation vulnerabilities. These issues exist due to insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting and SQL-injection attacks.

These issue reportedly affect Tutos 1.1.2004-04-14.

58. Apple Mac OS X Archive Metadata Command Execution Vulnerability
BugTraq ID: 16736
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16736
Summary:

Apple Mac OS X is prone to an arbitrary command-execution vulnerability when processing metadata in archive files. Commands would be executed in the context of the user opening the archive file.

Attackers can reportedly use Safari and Apple Mail as exploitation vectors for this vulnerability.

Mac OS X 10.4.5 is reported to be vulnerable. Earlier versions may also be affected.

59. Libdbi-perl Unspecified Insecure Temporary File Creation Vulnerability
BugTraq ID: 12360
Remote: No
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/12360
Summary:
The 'libdbi-perl' utility is affected by an unspecified insecure temporary file-creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the presence of a file before writing to it.

An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application.

Debian has reported that this vulnerability affects libdbi-perl 1.21 running on Debian GNU/Linux 3.0 alias 'woody'. Other versions may be affected as well.

60. Sun Java Runtime Environment Multiple Privilege Escalation Vulnerabilities
BugTraq ID: 15615
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/15615
Summary:
Sun JRE is susceptible to various privilege-escalation vulnerabilities.

These issues can allow remote Java applications to read/write local files and execute arbitrary applications in the context of an affected user.

Further details are not available at this time. This BID will be updated as more information is disclosed.

61. GNUTLS LibTASN1 DER Decoding Denial of Service Vulnerabilities
BugTraq ID: 16568
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16568
Summary:
Libtasn1 is prone to multiple denial-of-service vulnerabilities. A remote attacker can send specifically crafted data to trigger these flaws, leading to denial-of-service condition.

These issues have been addressed in Libtasn1 versions 0.2.18; earlier versions are vulnerable.

62. Microsoft Visual Studio DBP and SLN Files DataProject Buffer Overflow Vulnerability
BugTraq ID: 16953
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16953
Summary:
Microsoft Visual Studio is prone to a buffer-overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer.

This issue allows attackers to execute arbitrary code in the context of the user viewing a malicious file. As viewing a project file is usually considered to be a safe operation, users may have a false sense of security by attempting to inspect unknown code prior to compiling or executing it.

This vulnerability may be remotely exploited due to project files originating from untrusted sources.

Visual Studio 6 is reportedly vulnerable to this issue; other versions may also be affected.

63. NCP Secure Client Multiple Vulnerabilities
BugTraq ID: 16906
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16906
Summary:
NCP Secure Client is susceptible to multiple vulnerabilities.

The following issues have been identified:
- Firewall rules designed to allow only specific applications to access the network may be bypassed.
- Some applications are prone to local command-line-argument buffer-overflow vulnerabilities.
- The VPN client is susceptible to a remote denial-of-service vulnerability.
- The VPN client is susceptible to a local privilege-escalation vulnerability.

These issues allow local attackers to gain SYSTEM-level privileges, allowing them to completely compromise affected computers. Remote attackers may consume excessive CPU resources, denying service to legitimate users.

NCP Secure Client version 8.11 Build 146 on the Microsoft Windows platform is vulnerable to these issues; other versions may also be affected.

64. IBM WebSphere Application Server JSP Source Code Disclosure Vulnerability
BugTraq ID: 16908
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16908
Summary:
IBM WebSphere Application Server is prone to a sourcecode-disclosure vulnerability. An attacker can exploit this issue by supplying malformed HTTP requests to the server to disclose JSP sourcecode.

This issue allows remote attackers to gain access to the contents of potentially sensitive JSP source pages, aiding them in further attacks.

65. SMBlog Arbitrary PHP Command Execution Vulnerability
BugTraq ID: 16905
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16905
Summary:
SMBlog is prone to an arbitrary command-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary PHP commands on the vulnerable computer in the context of the webserver process.

66. Issue Dealer Information Disclosure Vulnerability
BugTraq ID: 16884
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16884
Summary:
Issue Dealer is prone to an information-disclosure vulnerability. This issue is due to a design error in the application.

This issue allows remote attackers to gain access to potentially sensitive unpublished web-log information, possibly aiding them in further attacks.

Versions prior to 0.9.96 are affected.

67. Noah's Classifieds Index.PHP Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 16772
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16772
Summary:
Noah's Classifieds is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

68. Noah's Classifieds Local File Include Vulnerability
BugTraq ID: 16778
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16778
Summary:
Noah's Classifieds is prone to a local file-include vulnerability. This may facilitate the unauthorized viewing of files and unauthorized execution of local scripts.

Version 1.3.0 is vulnerable; other versions may be affected as well.

69. ProFTPD _xlate_ascii_write() Buffer Overrun Vulnerability
BugTraq ID: 9782
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/9782
Summary:
A remotely exploitable buffer overrun was reported in ProFTPD. This issue is due to insufficient bounds checking of user-supplied data in the '_xlate_ascii_write()' function, permitting an attacker to overwrite two bytes of memory adjacent to the affected buffer. The attacker may be able to exploit this to execute arbitrary code in the context of the server. The attacker may trigger this issue by submitting a RETR command to the server.

70. Mozilla Browser/Firefox JavaScript Engine Integer Overflow Vulnerability
BugTraq ID: 14917
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/14917
Summary:
Mozilla Browser/Firefox are affected by an integer-overflow vulnerability in their JavaScript engine. A remote attacker may exploit this issue by creating a malicious site and enticing users to visit it.

A successful attack may facilitate unauthorized remote access to a vulnerable computer.

Netscape Browser 8.0.3.3, Netscape 7.2, and K-Meleon 0.9 are also vulnerable.

71. Akarru Social BookMarking Engine Users.PHP SQL Injection Vulnerability
BugTraq ID: 16989
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16989
Summary:

Akarru Social BookMarking Engine is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Versions prior to 0.4.3.4 are vulnerable; other versions may also be affected.

72. Comvigo IM Lock 2006 Insecure Password Storage Vulnerability
BugTraq ID: 16988
Remote: No
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16988
Summary:
A local insecure password storage vulnerability affects Comvigo IM Lock 2006. This issue is due to a failure of the application to store passwords with secure permissions by default.

A local attacker may leverage this issue to gain access to the administrative password for the vulnerable application. Attackers may utilize this to bypass the security measures enforced by the application.

73. CyBoards PHP Lite Process_post.PHP SQL Injection Vulnerability
BugTraq ID: 16987
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16987
Summary:
CyBoards PHP Lite is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

CyBoards PHP Lite 1.25 and prior are reportedly affected by this issue.

74. Sauerbraten Multiple Remote Vulnerabilities
BugTraq ID: 16986
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16986
Summary:
Sauerbraten is susceptible to multiple remote vulnerabilities.

The following issues have been identified:
- A buffer overflow vulnerability that affects both clients and servers
- An invalid memory access denial of service vulnerability that affects both clients and servers.
- An invalid map file processing denial of service vulnerability that affects clients.
- A invalid memory access denial of service vulnerability that affects servers.

These issues allow remote attackers to execute arbitrary machine code in the context of affected application. Attackers may also crash both clients and servers, denying service to legitimate users.

75. Fantastic News Archive.PHP Remote Code Execution Vulnerability
BugTraq ID: 16985
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16985
Summary:

Fantastic News is prone to a code-execution vulnerability.

Presumably, an attacker can exploit this issue to execute arbitrary malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Fantastic News version 2.1.2 and prior are vulnerable; other versions may also be affected.

76. D2-Shoutbox SQL Injection Vulnerability
BugTraq ID: 16984
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16984
Summary:

D2-Shoutbox is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

77. Evo-Dev evoBlog Comment Post HTML Injection Vulnerability
BugTraq ID: 16983
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16983
Summary:
evoBlog is prone to an HTML-injection vulnerability.

78. Tenes Empanadas Graciela Remote Denial Of Service Vulnerability
BugTraq ID: 16982
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16982
Summary:

Tenes Empanadas Graciela is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the application to crash by activating the 'oldsocketmode' option, and then sending an overly large request to the server application.

An attacker may cause the application to crash, thus denying service to legitimate users.

79. Monopd Remote Denial Of Service Vulnerability
BugTraq ID: 16981
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16981
Summary:
The Monopd game server is prone to a remote denial of service vulnerability.

A remote attacker may exploit this issue to deny service for legitimate users.

80. Game-Panel Login.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 16979
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16979
Summary:
Game-Panel is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

81. Microsoft Internet Explorer Java Applet Handling Denial of Service Vulnerability
BugTraq ID: 16978
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16978
Summary:
Microsoft Internet Explorer is affected by a denial of service vulnerability. This issue arises because the application fails to handle exceptional conditions in a proper manner. This issue only presents itself when Sun's Java runtime environment is installed and configured to be the default handler for Java applets.

An attacker may exploit this issue by enticing a user to visit a malicious site resulting in a denial of service condition in the application.

Specific version information for Microsoft Internet Explorer and the Java runtime are not currently available. This BID will be updated as further information is disclosed.

82. M-Phorum Remote File Include Vulnerability
BugTraq ID: 16977
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16977
Summary:

m-phorum is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This issue is reported to affect versions 0.2 and earlier; other versions may also be vulnerable.

83. Freeciv Remote Denial Of Service Vulnerability
BugTraq ID: 16975
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16975
Summary:
The Freeciv game server is reported prone to a remote denial of service vulnerability.

A remote attacker may exploit this issue to deny service for legitimate users.

84. Bitweaver Title Field HTML Injection Vulnerability
BugTraq ID: 16973
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16973
Summary:
bitweaver is prone to an HTML-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in dynamically generated content.

This issue is reported to affect version 1.2.1; other versions may also be vulnerable.

85. Acme Labs thttpd HTPasswd Multiple Vulnerabilities
BugTraq ID: 16972
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16972
Summary:
Multiple buffer-overflow vulnerabilities exist in the 'htpasswd' utility included with thttpd. These vulnerabilities are due to improper bounds checking of user-supplied input prior to copying it into insufficiently sized memory buffers.

'htpasswd' is also susceptible to a command-execution vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.

Since the program is not installed setuid by default, this vulnerability does not normally have a local impact. However, this may be an issue if the software is called from a CGI script or if it is used in conjunction with 'sudo' or other such privilege escalation utilities. An attacker may be able to supply malformed data to the program which will cause the overflow to occur.

The 'htpasswd' utility in thttpd was originally copied from Apache, therefore these issues may be similar to the one described in BID 13777, Apache HTPasswd User Command Line Argument Buffer Overflow Vulnerability.

Version 2.25b is vulnerable to these issues; prior versions are also likely affected.

86. RunCMS Bigshow.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 16970
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16970
Summary:
RunCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

87. VBZoom Profile.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 16969
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16969
Summary:
vbzoom is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

88. DVGuestbook Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 16968
Remote: Yes
Last Updated: 2006-03-06
Relevant URL: http://www.securityfocus.com/bid/16968
Summary:

DVGuestbook is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

89. Noah's Classifieds Index.PHP Remote File Include Vulnerability
BugTraq ID: 16780
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16780
Summary:
Noah's Classifieds is prone to a remote file-include vulnerability.

An attacker can exploit this issue to execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Version 1.3.0 is vulnerable; other versions may also be affected.

90. Sendcard Multiple Unspecified SQL Injection Vulnerabilities
BugTraq ID: 16900
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16900
Summary:
Sendcard is prone to multiple unspecified SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

These issues affect Sendcard versions prior to 3.3.0.

91. Limbo CMS Frontpage Arbitrary PHP Command Execution Vulnerability
BugTraq ID: 16902
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16902
Summary:

Limbo CMS is prone to an arbitrary command-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary PHP commands on the vulnerable computer in the context of the webserver process.

92. GNOME Evolution Denial Of Service Vulnerability
BugTraq ID: 16899
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16899
Summary:
A denial-of-service vulnerability has been reported in Evolution.

A remote attacker may cause a denial-of-service condition in the application, effectively denying service to legitimate users.

93. Cisco IOS TCLSH AAA Command Authorization Bypass Vulnerability
BugTraq ID: 16383
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16383
Summary:
Cisco IOS is prone to a remote AAA command authorization-bypass vulnerability. This issue is due to the software's failure to properly enforce command authorization restrictions in the TCL shell.

This issue allows remote attackers to bypass AAA command authorization checks and to gain elevated access to affected devices.

This issue is documented by Cisco bug ID CSCeh73049http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCeh73049.

94. 4images Index.PHP Remote File Include Vulnerability
BugTraq ID: 16855
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16855
Summary:
4images is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

95. Leif M. Wright Blog HTML Injection Vulnerability
BugTraq ID: 16715
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16715
Summary:
Blog is prone to an HTML-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in dynamically generated content.

This issue is reported to affect version 3.5; other versions may also be vulnerable.

96. Leif M. Wright Blog.CGI Authorization Bypass Vulnerability
BugTraq ID: 16714
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16714
Summary:

Blog is prone to an authorization-bypass vulnerability. This issue is due to a failure in the application to properly verify a user's credentials.

An attacker can exploit this vulnerability to bypass authentication and gain access as an administrative user; this may facilitate a compromise of the application.

Version 3.5 is vulnerable; other versions may also be affected.

97. AddSoft StoreBot Manage.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 16898
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16898
Summary:

StoreBot is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

98. AddSoft StoreBot MgrLogin.ASP SQL Injection Vulnerability
BugTraq ID: 16897
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16897
Summary:

StoreBot is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

99. MyPHPNuke Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 16815
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16815
Summary:
MyPHPNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

100. NetworkActiv Web Server Remote Script Disclosure Vulnerability
BugTraq ID: 16895
Remote: Yes
Last Updated: 2006-03-05
Relevant URL: http://www.securityfocus.com/bid/16895
Summary:

NetworkActiv Web Server is prone to an information-disclosure vulnerability. An attacker may obtain the source code of script files.

Scripts may contain sensitive information that may aid in further attacks launched against the target computer.

NetworkActiv Web Server versions prior to 3.5.16 are vulnerable.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Antivirus groups fight over Crossover sharing
By: Robert Lemos
A young antivirus group's attempts to leverage a rare exclusive virus discovery into greater membership has earned it criticism from the old guard of antivirus companies.
http://www.securityfocus.com/news/11379

2. Triple threat to Mac OS X largely academic
By: Robert Lemos
Two worms and an exploit for Apple's operating system hardly threaten consumers' computers, but should act as a wake-up call for Mac users.
http://www.securityfocus.com/news/11378

3. Private identities become a corporate focus
By: Robert Lemos
Technology companies at the RSA Security Conference expound on the privacy benefits of online services that authenticate users based on the least amount of information possible.
http://www.securityfocus.com/news/11377

4. Startup tries to spin a safer Web
By: Robert Lemos
Armed with client-side honeypots and a low-cost team in India, a group of MIT graduates aims to create a system to warn Web surfers about the seedier sites, and outright malicious servers, on the Internet.
http://www.securityfocus.com/news/11376

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Quality Assurance, Redwood City
http://www.securityfocus.com/archive/77/426929

2. [SJ-JOB] Developer, Columbia MD
http://www.securityfocus.com/archive/77/426930

3. [SJ-JOB] Sr. Security Analyst, West Mifflin
http://www.securityfocus.com/archive/77/426926

4. [SJ-JOB] Developer, Columbia
http://www.securityfocus.com/archive/77/426927

5. [SJ-JOB] Security Engineer, Ann Arbor
http://www.securityfocus.com/archive/77/426928

6. [SJ-JOB] Sr. Security Analyst, San Antonio
http://www.securityfocus.com/archive/77/426859

7. [SJ-JOB] Jr. Security Analyst, San Antonio
http://www.securityfocus.com/archive/77/426860

8. [SJ-JOB] Sr. Security Engineer, San Antonio
http://www.securityfocus.com/archive/77/426856

9. [SJ-JOB] Security Engineer, Austin
http://www.securityfocus.com/archive/77/426857

10. [SJ-JOB] Security Engineer, San Antonio
http://www.securityfocus.com/archive/77/426858

11. [SJ-JOB] Sr. Security Engineer, Arlington
http://www.securityfocus.com/archive/77/426851

12. [SJ-JOB] Sales Engineer, Seattle
http://www.securityfocus.com/archive/77/426850

13. [SJ-JOB] Security Consultant, UK Wide
http://www.securityfocus.com/archive/77/426852

14. [SJ-JOB] Security Engineer, Richmond
http://www.securityfocus.com/archive/77/426853

15. [SJ-JOB] Manager, Information Security, London
http://www.securityfocus.com/archive/77/426819

16. [SJ-JOB] Security Consultant, London
http://www.securityfocus.com/archive/77/426820

17. [SJ-JOB] Technical Marketing Engineer, Sunnyvale
http://www.securityfocus.com/archive/77/426821

18. [SJ-JOB] Security Consultant, Ottawa
http://www.securityfocus.com/archive/77/426822

19. [SJ-JOB] Disaster Recovery Coordinator, London
http://www.securityfocus.com/archive/77/426818

20. [SJ-JOB] Security Researcher, Redwood City
http://www.securityfocus.com/archive/77/426677

21. [SJ-JOB] Security Researcher, Sunnyvale
http://www.securityfocus.com/archive/77/426673

22. [SJ-JOB] Chief Scientist, Herndon
http://www.securityfocus.com/archive/77/426689

23. [SJ-JOB] Sr. Security Engineer, DC/Chantilly
http://www.securityfocus.com/archive/77/426708

24. [SJ-JOB] Jr. Security Analyst, East Anglia
http://www.securityfocus.com/archive/77/426715

25. [SJ-JOB] Security Engineer, Knoxville
http://www.securityfocus.com/archive/77/426625

26. [SJ-JOB] Security Consultant, Work Remotely or Charlotte
http://www.securityfocus.com/archive/77/426571

27. [SJ-JOB] Security Consultant, Leeds
http://www.securityfocus.com/archive/77/426573

28. [SJ-JOB] Manager, Information Security, Arcade
http://www.securityfocus.com/archive/77/426572

29. [SJ-JOB] Sales Engineer, New York
http://www.securityfocus.com/archive/77/426546

30. [SJ-JOB] Security Consultant, Liverpool
http://www.securityfocus.com/archive/77/426543

31. [SJ-JOB] Application Security Architect, Tokyo
http://www.securityfocus.com/archive/77/426545

32. [SJ-JOB] Security Architect, Chicago
http://www.securityfocus.com/archive/77/426621

33. [SJ-JOB] Security Consultant, Anywhere in U.S.
http://www.securityfocus.com/archive/77/426544

34. [SJ-JOB] Auditor, New York
http://www.securityfocus.com/archive/77/426366

35. [SJ-JOB] Sr. Security Engineer, New York
http://www.securityfocus.com/archive/77/426357

36. [SJ-JOB] Jr. Security Analyst, Redwood Shores
http://www.securityfocus.com/archive/77/426354

37. [SJ-JOB] Security Consultant, Redmond
http://www.securityfocus.com/archive/77/426356

V. INCIDENTS LIST SUMMARY
---------------------------
1. Call For Papers - DRFWS 2006
http://www.securityfocus.com/archive/75/426966

2. Detecting Cisco IOS probes
http://www.securityfocus.com/archive/75/426910

3. Scans for telnetd on DNS servers.
http://www.securityfocus.com/archive/75/426781

4. Bot net? SPAM Bounces...
http://www.securityfocus.com/archive/75/426723

5. Internet SSH scans
http://www.securityfocus.com/archive/75/426630

6. Strange Traffic to ports 139 and 137 from a machine with no data
http://www.securityfocus.com/archive/75/426352

VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. SyScan'06 Call For Papers
http://www.securityfocus.com/archive/82/426838

VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Administrivia: Holidays
http://www.securityfocus.com/archive/88/426709

2. Questions regarding EFS
http://www.securityfocus.com/archive/88/426490

3. programming Aeronet card for authentication and configuration in embedded XP
http://www.securityfocus.com/archive/88/426424

4. SecurityFocus Microsoft Newsletter #280
http://www.securityfocus.com/archive/88/426457

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
1. IPS HLBR 1.0 released (off-topic)
http://www.securityfocus.com/archive/91/426920

2. New SecurityFocus article published.
http://www.securityfocus.com/archive/91/426453

X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: Watchfire

https://www.watchfire.com/securearea/whitepapers.aspx?id=701300000007kr1