SecurityFocus Newsletter #349

Peter Laborge <[email protected]> Wed, 10 May 2006 09:04:10 -0600

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #349
----------------------------------------

This issue is sponsored by: Unatek

The 2006 Web Services Security Conference & Exhibition - May 25-26 Marriott Conference Center, University of Maryland, College Park, Maryland
The 2006 Web Services Security Conference is the forum for senior executives, industry and government leaders, and legal and academic experts to present the state-of-the-art of Web services and online transactions security practice.Hear from respected inventors, pioneers, business leaders and leading experts on: Intrusion prevention, Web services security, SSO authentication, Risk Management, Identity management, Legal issues on Identity management. Explore how to: Reduce risks in eCommerce Web
service, Expand your business base, Promote product sale, Showcase your cutting-edge capabilities.

Get the Details and Register at: http://www.unatek.com/conference.htm or Call 301-583-4629.

------------------------------------------------------------------
I. FRONT AND CENTER
1. Innovative ways to fool people
2. Malicious cryptography, part 1
II. BUGTRAQ SUMMARY
1. Yukihiro Matsumoto Ruby XMLRPC Server Denial of Service Vulnerability
2. Quake 3 Engine remapShader Command Remote Buffer Overflow Vulnerability
3. Mozilla Suite, Firefox, SeaMonkey, and Thunderbird Multiple Remote Vulnerabilities
4. PHP PHPInfo Large Input Cross-Site Scripting Vulnerability
5. PHP Html_Entity_Decode() Information Disclosure Vulnerability
6. Microsoft Infotech Storage Library Heap Corruption Vulnerability
7. IA-Calendar Multiple Input Validation Vulnerabilities
8. Quake 3 Engine Server Information Disclosure Vulnerability
9. Ozzywork Galeri Admin Login SQL Injection Vulnerability
10. Novell NetWare Distributed Print Services Integer Overflow Vulnerability
11. OpenOBEX IRCP Arbitrary File Overwrite Vulnerability
12. IdealBB Multiple Input Validation Vulnerabilities
13. IBM Websphere Application Server Multiple Vulnerabilities
14. DUWare DUGallery Login SQL Injection Vulnerability
15. Dokeos LDAP_VAR.INC.PHP Remote File Include Vulnerability
16. Intel PROset/Wireless Local Information Disclosure Vulnerability
17. ICQ Banner Ad Cross-Application Scripting Vulnerability
18. Linux Kernel Multiple SCTP Remote Denial of Service Vulnerabilities
19. Microsoft Exchange Server Calendar Remote Code Execution Vulnerability
20. Sophos Anti-Virus CAB File Scanning Remote Heap Overflow Vulnerability
21. Ocean12 Calendar Manager Pro Multiple Input Validation Vulnerabilities
22. Red Hat redhat-config-nfs Exported Shares Configuration Vulnerability
23. PHPRaid Multiple Remote File Include Vulnerabilities
24. Claroline Multiple Remote File Include Vulnerabilities
25. Singapore Index.PHP Cross-Site Scripting Vulnerability
26. MySQL Remote Information Disclosure and Buffer Overflow Vulnerabilities
27. Paul A. Rombouts PDNSD Unspecified Buffer Overflow Vulnerability
28. Paul A. Rombouts PDNSD DNS Query Denial Of Service Vulnerability
29. Apache Mod_IMAP Referer Cross-Site Scripting Vulnerability
30. GNU Tar Invalid Headers Buffer Overflow Vulnerability
31. Macromedia Flash Multiple Unspecified Security Vulnerabilities
32. Perl Perl_sv_vcatpvfn Format String Integer Wrap Vulnerability
33. EDirectoryPro Search_result.ASP SQL Injection Vulnerability
34. EImagePro Multiple SQL Injection Vulnerabilities
35. Multiple Vendor UNACEV2 Archive File Name Buffer Overflow Vulnerability
36. ISPConfig Session.INC.PHP Remote File Include Vulnerability
37. MyBB Showthread.PHP SQL Injection Vulnerability
38. EPublisherPro Moreinfo.ASP Cross-Site Scripting Vulnerability
39. IPSec-Tools IKE Message Handling Denial of Service Vulnerability
40. Openswan IKE Traffic Denial Of Service Vulnerabilities
41. X-POLL Add.PHP Input Validation Vulnerability
42. Sun Solaris LibIKE IKE Exchange Denial Of Service Vulnerability
43. PHPBB Global Variable Deregistration Bypass Vulnerabilities
44. phpBB Avatar Upload HTML Injection Vulnerability
45. LibTiff TIFFToRGB Denial of Service Vulnerability
46. Graphviz Insecure Temporary File Creation Vulnerability
47. Mozilla Firefox iframe.contentWindow.focus Deleted Object Reference Vulnerability
48. Timobraun Dynamic Galerie Multiple Input Validation Vulnerabilities
49. Cisco Secure ACS Insecure Password Storage Vulnerability
50. IBM WebSphere Application Server Welcome Page Security Restriction Bypass Vulnerability
51. PHP-Fusion Multiple Local File Include Vulnerabilities
52. Linux Kernel IP_VS_CONN_FLUSH Local Denial of Service Vulnerability
53. PSToText Arbitrary Script Code Execution Vulnerability
54. Linux Kernel Console Keymap Local Command Injection Vulnerability
55. Linux Orinoco Driver Remote Information Disclosure Vulnerability
56. Linux Kernel Multiple Memory Leak Local Denial Of Service Vulnerabilities
57. Linux Kernel World Writable SYSFS DRM Debug File Vulnerability
58. Linux Kernel USB Subsystem Local Denial Of Service Vulnerability
59. XN--Gol-kma 2005-Comments-Script Komentare.PHP Multiple Cross-Site Scripting Vulnerabilities
60. Linux Kernel 64-Bit SMP Routing_ioctl() Local Denial of Service Vulnerability
61. Linux Kernel Netfilter Ipt_recent Remote Denial of Service Vulnerability
62. Linux Kernel Raw_sendmsg() Kernel Memory Access Vulnerability
63. Inter7 Vpopmail Authentication Bypass Vulnerability
64. Linux Kernel Sendmsg() Local Buffer Overflow Vulnerability
65. GhostScript Insecure Temporary File Creation Vulnerability
66. FaktoryStudios EasyEvent Index.PHP Cross-Site Scripting Vulnerability
67. Util-Linux UMount Remounting Filesystem Option Clearing Vulnerability
68. Multiple Cisco Products WebSense Content Filtering Bypass Vulnerability
69. EvoTopsite Index.PHP Multiple SQL Injection Vulnerabilities
70. Fetchmail Missing Email Header Remote Denial of Service Vulnerability
71. StatIt Visible_count_inc.PHP Remote File Include Vulnerability
72. ACal Day.PHP Remote File Include Vulnerability
73. Microsoft Windows MSDTC Heap Buffer Overflow Vulnerability
74. Microsoft Windows MSDTC Invalid Memory Access Denial Of Service Vulnerability
75. Sudo Perl Environment Variable Handling Security Bypass Vulnerability
76. SmartISoft phpListPro Config.PHP Remote File Include Vulnerability
77. Macromedia Flash Array Index Memory Access Vulnerability
78. Maxx Schedule Multiple Input Validation Vulnerabilities
79. Online Universal Payment System Script Multiple Input Validation Vulnerabilities
80. Creative Community Portal Multiple SQL Injection Vulnerabilities
81. EQDKP DBal.PHP Remote File Include Vulnerability
82. Dropbear SSH Server Remote Buffer Overflow Vulnerability
83. Drupal Project Module HTML Injection Vulnerability
84. Avahi Buffer Overflow and Denial Of Service Vulnerabilities
85. MultiCalendars All_calendars.ASP SQL Injection Vulnerability
86. LibTiff Double Free Memory Corruption Vulnerability
87. LibTiff Multiple Denial of Service Vulnerabilities
88. LibTiff TIFFFetchData Integer Overflow Vulnerability
89. GDK-Pixbuf BMP Image Processing Double Free Remote Denial of Service Vulnerability
90. GDK-Pixbuf Multiple Vulnerabilities
91. Intervations FileCopa User Command Remote Buffer Overflow Vulnerability
92. VP-ASP Shopping Cart Shopcurrency.ASP SQL Injection Vulnerability
93. TZipBuilder ZIP File Buffer Overflow Vulnerability
94. Lynx NNTP Article Header Buffer Overflow Vulnerability
95. Lynx URI Handlers Arbitrary Command Execution Vulnerability
96. Phil's Bookmark Script Admin.PHP Authentication Bypass Vulnerability
97. Nagios Remote Negative Content-Length Buffer Overflow Vulnerability
98. Cyrus SASL Remote Digest-MD5 Denial of Service Vulnerability
99. Multiple Mozilla Products Memory Corruption/Code Injection/Access Restriction Bypass Vulnerabilities
100. Mozilla Thunderbird IFRAME JavaScript Execution Vulnerability
III. SECURITYFOCUS NEWS
1. Bot software looks to improve peerage
2. Breach case could curtail Web flaw finders
3. E-mail authentication gaining steam
4. Browsers feel the fuzz
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Security System Administrator, Westlake Village
2. [SJ-JOB] Security System Administrator, Westlake Village
3. [SJ-JOB] Channel / Business Development, San Jose
4. [SJ-JOB] Security System Administrator, Austin
5. [SJ-JOB] Developer, Kansas City
6. [SJ-JOB] Sr. Security Engineer, Bethesda
7. [SJ-JOB] Security Consultant, Philly
8. [SJ-JOB] Forensics Engineer, Costa Mesa
9. [SJ-JOB] Senior Software Engineer, San Francisco
10. [SJ-JOB] Sr. Product Manager, San Francisco
11. [SJ-JOB] Application Security Architect, Redmond
12. [SJ-JOB] Software Engineer, New York
13. [SJ-JOB] Instructor, Dammam
14. [SJ-JOB] Software Engineer, Herndon
15. [SJ-JOB] Software Engineer, Philadelphia
16. [SJ-JOB] Account Manager, Atlanta
17. [SJ-JOB] Security Engineer, Dallas
18. [SJ-JOB] Account Manager, Minneapolis
19. [SJ-JOB] Sales Engineer, Atlanta
20. [SJ-JOB] Senior Software Engineer, Toronto
21. [SJ-JOB] Channel / Business Development, Boston
22. [SJ-JOB] Software Engineer, Overland
23. [SJ-JOB] Sales Representative, Nashville
24. [SJ-JOB] Security Architect, Dallas/Fort Worth
25. [SJ-JOB] Security Engineer, Costa Mesa
26. [SJ-JOB] Management, SAN DIEGO
27. [SJ-JOB] Security Architect, San Jose
V. INCIDENTS LIST SUMMARY
1. Weblog software XSS attack?
VI. VULN-DEV RESEARCH LIST SUMMARY
1. INFIGO-2006-05-03: Multiple FTP Servers vulnerabilities
2. DIA file name handling format string
VII. MICROSOFT FOCUS LIST SUMMARY
1. USB device installation problem
2. Autorun in screensaver
3. Sniffer question
4. Patch Management on Critical Servers (Healthcare)
5. windows 2003 1wan 2lan => vpn to ech private lan?
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Innovative ways to fool people
By Scott Granneman
Scott Granneman's latest column looks at recent security examples where people have been fooled in increasingly innovative ways: from keyloggers used in a massive bank heist and new Trojans that encrypt data and request ransom money, to real financial rip-offs that extend out from online virtual gaming worlds like World of Warcraft.
http://www.securityfocus.com/columnists/401

2. Malicious cryptography, part 1
By Frederic Raynal
This two-part article series looks at how cryptography is a double-edged sword: it is used to make us safer, but it is also being used for malicious purposes within sophisticated viruses. Part one introduces the concepts behind cryptovirology and offers examples of malicious potential with the SuckIt rootkit and a possible SSH worm. It then introduces armored viruses that use shape shifting (polymorphism and metamorphism) to avoid detection.
http://www.securityfocus.com/infocus/1865

II. BUGTRAQ SUMMARY
--------------------
1. Yukihiro Matsumoto Ruby XMLRPC Server Denial of Service Vulnerability
BugTraq ID: 17645
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17645
Summary:
Ruby is affected by a denial-of-service vulnerability in the WEBrick HTTP server. This issue is due to the use of blocking network operations. Ruby's implementation of XML/RPC is also affected, since it uses the vulnerable WEBrick server.

This issue allows remote attackers to cause affected webservers to fail to respond to further legitimate requests.

Ruby versions prior to 1.8.3 are affected by this issue.

2. Quake 3 Engine remapShader Command Remote Buffer Overflow Vulnerability
BugTraq ID: 17857
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17857
Summary:
The Quake 3 engine is susceptible to a remote buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Remote attackers may exploit this issue to execute arbitrary machine code in the context of affected game clients. Failed exploit attempts will likely crash affected clients.

This vulnerability reportedly affects the following games:
- Quake 3 Arena
- Return to Castle Wolfenstein
- Wolfenstein: Enemy Territory

Other games may also be affected.

3. Mozilla Suite, Firefox, SeaMonkey, and Thunderbird Multiple Remote Vulnerabilities
BugTraq ID: 17516
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17516
Summary:
The Mozilla Foundation has released nine security advisories specifying security vulnerabilities in Mozilla Suite, Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- execute arbitrary machine code in the context of the vulnerable application
- crash affected applications
- gain elevated privileges in JavaScript code, potentially allowing remote machine code execution
- gain access to potentially sensitive information
- bypass security checks
- spoof window contents.

Other attacks may also be possible.

The issues described here will be split into individual BIDs as the information embargo on the Mozilla Bugzilla entries is lifted and as further information becomes available. This BID will then be retired.

These issues are fixed in:
- Mozilla Firefox versions 1.0.8 and 1.5.0.2
- Mozilla Thunderbird versions 1.0.8 and 1.5.0.2
- Mozilla Suite version 1.7.13
- Mozilla SeaMonkey version 1.0.1

4. PHP PHPInfo Large Input Cross-Site Scripting Vulnerability
BugTraq ID: 17362
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17362
Summary:
PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

5. PHP Html_Entity_Decode() Information Disclosure Vulnerability
BugTraq ID: 17296
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17296
Summary:
PHP 'html_entity_decode()' function is prone to an information-disclosure vulnerability. This issue arises when a script using the function accepts data from a remote untrusted source and returns the function's result to an attacker.

Information that the attacker gathers by exploiting this vulnerability may aid in other attacks.

PHP versions prior to 5.1.3-RC1 are vulnerable to this issue.

6. Microsoft Infotech Storage Library Heap Corruption Vulnerability
BugTraq ID: 17926
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17926
Summary:
Microsoft Windows is susceptible to a heap-corruption vulnerability while attempting to read specially crafted CHM or ITS files. This occurs in the 'ITSS.DLL' library.

This vulnerability allows remote attackers to execute arbitrary machine code in the context of applications utilizing the affected library.

Attackers may exploit this issue by coercing users to open malicious CHM or ITS files with Internet Explorer, or when users attempt to decompile these files with the 'hh -decompile' command. CHM files are considered unsafe files, so there is a possibility that advanced users or security researchers may attempt to decompile these files in order to inspect their contents.

7. IA-Calendar Multiple Input Validation Vulnerabilities
BugTraq ID: 17925
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17925
Summary:
IA-Calendar is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

8. Quake 3 Engine Server Information Disclosure Vulnerability
BugTraq ID: 17924
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17924
Summary:
The Quake 3 engine is susceptible to a remote information-disclosure vulnerability. This issue is due to a failure of affected game servers to ensure that only appropriate files may be sent to remote users.

This issue allows remote attackers to gain access to the potentially sensitive contents of arbitrary files on the computer hosting vulnerable game servers. This occurs with the privileges of the targeted game server.

This vulnerability reportedly affects the following games:
- Quake 3 Arena
- Return to Castle Wolfenstein
- Star Trek Voyager: Elite Force

Other games may also be affected.

9. Ozzywork Galeri Admin Login SQL Injection Vulnerability
BugTraq ID: 17923
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17923
Summary:
Ozzywork Galeri is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful attack could allow an attacker to compromise the application, access or modify data, gain administrative access to the application, or exploit vulnerabilities in the underlying database implementation.

10. Novell NetWare Distributed Print Services Integer Overflow Vulnerability
BugTraq ID: 17922
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17922
Summary:
Novell NetWare Distributed Print Services is prone to an integer-overflow vulnerability.

An attacker could exploit this vulnerability to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely cause denial-of-service conditions.

11. OpenOBEX IRCP Arbitrary File Overwrite Vulnerability
BugTraq ID: 17921
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17921
Summary:
OpenOBEX's ircp utility is susceptible to a remote file-overwrite vulnerability. This issue is due to a failure of the application to verify that a destination file does not exist prior to creating one during file transfers.

This issue allows remote attackers to overwrite arbitrary files with arbitrary data. This may aid in further attacks.

OpenOBEX version 1.2 is vulnerable to this issue; other versions may also be affected.

12. IdealBB Multiple Input Validation Vulnerabilities
BugTraq ID: 17920
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17920
Summary:
IdealBB is prone to multiple input-validation vulnerabilities. The issues include remote file include, information disclosure, cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, execute remote PHP code in the context of the webserver process, disclose sensitive information, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

13. IBM Websphere Application Server Multiple Vulnerabilities
BugTraq ID: 17919
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17919
Summary:

IBM Websphere Application Server is prone to multiple vulnerabilities.

These issues include vulnerabilities of unknown impact, information disclosure vulnerabilities, and security bypass vulnerabilities.

Other potentially security related issues were also addressed.

14. DUWare DUGallery Login SQL Injection Vulnerability
BugTraq ID: 17918
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17918
Summary:
DUGallery is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

15. Dokeos LDAP_VAR.INC.PHP Remote File Include Vulnerability
BugTraq ID: 17915
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17915
Summary:
Dokeos is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.6.4; other versions may also be affected.

16. Intel PROset/Wireless Local Information Disclosure Vulnerability
BugTraq ID: 17914
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17914
Summary:
Intel PROset/Wireless software is susceptible to a local information-disclosure vulnerability. This issue is due to insecure permissions being applied to shared-memory segments.

This issue allows local, unprivileged attackers to gain access to potentially sensitive network configuration and authentication information. Information gathered by exploiting this issue will aid them in further attacks.

Version 10.1.0.33 of the Intel PROset/Wireless software is vulnerable to this issue; other versions may also be affected.

17. ICQ Banner Ad Cross-Application Scripting Vulnerability
BugTraq ID: 17913
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17913
Summary:

ICQ is prone to a cross-application scripting vulnerability. This issue is a result of the application accessing content in a different and presumably higher security context than the original content.

An attacker can exploit this issue to have arbitrary attacker-supplied HTML or JavaScript executed on a victim user's computer in the 'My Computer' security zone.

18. Linux Kernel Multiple SCTP Remote Denial of Service Vulnerabilities
BugTraq ID: 17910
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17910
Summary:
The Linux kernel SCTP module is susceptible to remote denial-of-service vulnerabilities. These issues are triggered when unexpected SCTP packets are handled by the kernel.

These issues allow remote attackers to trigger kernel panics, denying further service to legitimate users.

A valid SCTP endpoint must be listening in order to exploit these issues.

The Linux kernel version 2.6.16 is vulnerable to these issues; prior versions may also be affected.

19. Microsoft Exchange Server Calendar Remote Code Execution Vulnerability
BugTraq ID: 17908
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17908
Summary:

Microsoft Exchange Server is prone to a vulnerability that may let attackers execute code remotely. This issue is exposed when the server handles emails that contain malicious calendar data that is included in meeting requests.

If the issue is successfully exploited, this could completely compromise the computer hosting the mail server.

20. Sophos Anti-Virus CAB File Scanning Remote Heap Overflow Vulnerability
BugTraq ID: 17876
Remote: Yes
Last Updated: 2006-05-08
Relevant URL: http://www.securityfocus.com/bid/17876
Summary:
A remote heap-overflow vulnerability exists in Sophos Anti-Virus Library when scanning CAB files. This issue is due to the library's failure to properly bounds-check user-supplied input before copying data to an internal memory buffer.

Successfully exploiting this vulnerability could result in arbitrary code execution with the privileges of the application.

21. Ocean12 Calendar Manager Pro Multiple Input Validation Vulnerabilities
BugTraq ID: 17877
Remote: Yes
Last Updated: 2006-05-08
Relevant URL: http://www.securityfocus.com/bid/17877
Summary:
Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

22. Red Hat redhat-config-nfs Exported Shares Configuration Vulnerability
BugTraq ID: 11240
Remote: Yes
Last Updated: 2006-05-08
Relevant URL: http://www.securityfocus.com/bid/11240
Summary:
Red Hat redhat-config-nfs is affected by a vulnerability when exporting share configurations. The application fails to apply proper settings to the affected network file system (NFS) shares.

This issue would cause some NFS option, such as 'all_squash', to fail to be applied, potentially giving administrators a false sense of security.

23. PHPRaid Multiple Remote File Include Vulnerabilities
BugTraq ID: 17875
Remote: Yes
Last Updated: 2006-05-08
Relevant URL: http://www.securityfocus.com/bid/17875
Summary:
The phpRaid application is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

24. Claroline Multiple Remote File Include Vulnerabilities
BugTraq ID: 17873
Remote: Yes
Last Updated: 2006-05-08
Relevant URL: http://www.securityfocus.com/bid/17873
Summary:
Claroline is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

These issues also affect Dokeos version 1.6.4; earlier versions may also be vulnerable.

25. Singapore Index.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 17874
Remote: Yes
Last Updated: 2006-05-08
Relevant URL: http://www.securityfocus.com/bid/17874
Summary:
The 'singapore' application is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

26. MySQL Remote Information Disclosure and Buffer Overflow Vulnerabilities
BugTraq ID: 17780
Remote: Yes
Last Updated: 2006-05-08
Relevant URL: http://www.securityfocus.com/bid/17780
Summary:
MySQL is susceptible to multiple remote vulnerabilities:

- A buffer-overflow vulnerability due to insufficient bounds-checking of user-supplied data before copying it to an insufficiently sized memory buffer. This issue allows remote attackers to execute arbitrary machine code in the context of affected database servers. Failed exploit attempts will likely crash the server, denying further service to legitimate users.

- Two information-disclosure vulnerabilities due to insufficient input-sanitization and bounds-checking of user-supplied data. These issues allow remote users to gain access to potentially sensitive information that may aid them in further attacks.

27. Paul A. Rombouts PDNSD Unspecified Buffer Overflow Vulnerability
BugTraq ID: 17720
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17720
Summary:
The pdnsd DNS server is prone to an unspecified buffer-overflow vulnerability. A successful exploit may result in a denial of service or arbitrary code execution.

Details regarding the precise nature of this vulnerability are not currently available. This record will be updated when more information is available.

28. Paul A. Rombouts PDNSD DNS Query Denial Of Service Vulnerability
BugTraq ID: 17694
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17694
Summary:
The pdnsd DNS server is prone to a remote denial-of-service vulnerability. This issue is due to a failure in the application to properly handle DNS queries.

An attacker can exploit this issue to consume excessive memory, and then to crash the affected service, effectively denying service to legitimate users.

The vendor has addressed this issue in version 1.2.4-par; earlier versions are reportedly vulnerable.

29. Apache Mod_IMAP Referer Cross-Site Scripting Vulnerability
BugTraq ID: 15834
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/15834
Summary:
Apache's mod_imap module is prone to a cross-site scripting vulnerability. This issue is due to the module's failure to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

30. GNU Tar Invalid Headers Buffer Overflow Vulnerability
BugTraq ID: 16764
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/16764
Summary:

GNU Tar is prone to a buffer overflow when handling invalid headers. Successful exploitation could potentially lead to arbitrary code execution, but this has not been confirmed.

Tar versions 1.14 and above are vulnerable.

31. Macromedia Flash Multiple Unspecified Security Vulnerabilities
BugTraq ID: 17106
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17106
Summary:
The Macromedia Flash plug-in is susceptible to multiple unspecified vulnerabilities.

An attacker can potentially exploit these vulnerabilities to execute arbitrary code. The most likely vector of attack is through a malicious SWF file that has been designed to trigger the vulnerability and has been placed on a website. A denial-of-service condition may also occur.

Versions of the Flash Player prior to 7.0.63.0 and 8.0.24.0 are vulnerable to these issues.

32. Perl Perl_sv_vcatpvfn Format String Integer Wrap Vulnerability
BugTraq ID: 15629
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/15629
Summary:
Perl is susceptible to a format-string vulnerability. This issue is due to the programming language's failure to properly handle format specifiers in formatted-printing functions.

An attacker may leverage this issue to write to arbitrary process memory, facilitating code execution in the context of the Perl interpreter process. This can result in unauthorized remote access.

Developers should treat the formatted printing functions in Perl as equivalently vulnerable to exploitation as the C library versions, and should properly sanitize all data passed in the format-specifier argument.

All applications that use formatted-printing functions in an unsafe manner should be considered exploitable.

33. EDirectoryPro Search_result.ASP SQL Injection Vulnerability
BugTraq ID: 17912
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17912
Summary:
EDirectoryPro is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

34. EImagePro Multiple SQL Injection Vulnerabilities
BugTraq ID: 17911
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17911
Summary:
EImagePro is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploits could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

35. Multiple Vendor UNACEV2 Archive File Name Buffer Overflow Vulnerability
BugTraq ID: 14759
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/14759
Summary:
Multiple products are prone to a buffer overflow when handling ACE archives that contain files with overly long names.

This may be exploited to execute arbitrary code in the context of the user who is running the application. The vulnerability is considered remotely exploitable in nature because malicious ACE archives will likely originate from an external, untrusted source.

36. ISPConfig Session.INC.PHP Remote File Include Vulnerability
BugTraq ID: 17909
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17909
Summary:
ISPConfig is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

This issue affects version 2.2.2; other versions may also be affected.

37. MyBB Showthread.PHP SQL Injection Vulnerability
BugTraq ID: 17904
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17904
Summary:

MyBB is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful attack could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

MyBB 1.1.1 is reported to be affected to this issue. Other versions may be vulnerable as well.

38. EPublisherPro Moreinfo.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 17907
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17907
Summary:
EPublisherPro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

39. IPSec-Tools IKE Message Handling Denial of Service Vulnerability
BugTraq ID: 15523
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/15523
Summary:
IPsec-Tools is prone to a denial-of-service vulnerability. This issue is due to a failure in the application to handle exceptional conditions when in 'AGGRESSIVE' mode.

An attacker can exploit this issue to crash the application, thus denying service to legitimate users.

These vulnerabilities were discovered by, and may be reproduced by, the University of Oulu Secure Programming Group PROTOS IPSec Test Suite.

40. Openswan IKE Traffic Denial Of Service Vulnerabilities
BugTraq ID: 15416
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/15416
Summary:
Openswan is prone to multiple denial-of-service vulnerabilities in their ISAKMP implementation. Only attackers with access to the pre-shared key may exploit these issues, and only when the affected IKE daemon is configured to use aggressive mode.

These issues were discovered with the PROTOS ISAKMP Test Suite and are related to the handling of malformed IKEv1 traffic.

The vulnerabilities are believed to affect Openswan 2.x releases prior to 2.4.2.

41. X-POLL Add.PHP Input Validation Vulnerability
BugTraq ID: 17901
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17901
Summary:
X-POLL is prone to an input-validation vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

42. Sun Solaris LibIKE IKE Exchange Denial Of Service Vulnerability
BugTraq ID: 17902
Remote: Yes
Last Updated: 2006-05-10
Relevant URL: http://www.securityfocus.com/bid/17902
Summary:
Sun Solaris is prone to a denial-of-service vulnerability. This issue exists in the 'libike' IKE implementation and may impact the availability of the 'in.iked' daemon.

This issue was discovered using the Oulu University Secure Programming Group (OUSPG) PROTOS ISAKMP Test Suite.

43. PHPBB Global Variable Deregistration Bypass Vulnerabilities
BugTraq ID: 15243
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15243
Summary:
phpBB is prone to multiple vulnerabilities resulting from improper deregistration of global variables.

These issues may allow remote attackers to execute arbitrary PHP code, carry out SQL injection, HTML injection, and cross-site scripting attacks.

phpBB 2.0.17 and prior versions are affected by these issues.

44. phpBB Avatar Upload HTML Injection Vulnerability
BugTraq ID: 15170
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15170
Summary:
phpBB is prone to an HTML injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

This issue is only present when using the Microsoft Internet Explorer Web browser.

45. LibTiff TIFFToRGB Denial of Service Vulnerability
BugTraq ID: 17809
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17809
Summary:
LibTIFF is affected by a denial-of-service vulnerability.

An attacker can exploit this vulnerability to cause a denial of service in applications using the affected library.

46. Graphviz Insecure Temporary File Creation Vulnerability
BugTraq ID: 15050
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15050
Summary:
Graphviz creates temporary files in an insecure manner.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.

Graphviz 2.2.1 is reportedly affected, however, other versions may be vulnerable as well.

47. Mozilla Firefox iframe.contentWindow.focus Deleted Object Reference Vulnerability
BugTraq ID: 17671
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17671
Summary:
Mozilla Firefox is prone to a vulnerability when rendering malformed JavaScript content. An attacker could exploit this issue to cause the browser to fail or potentially execute arbitrary code.

Firefox versions 1.5 through to 1.5.0.2 running on Windows and Linux platforms are affected.

48. Timobraun Dynamic Galerie Multiple Input Validation Vulnerabilities
BugTraq ID: 17896
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17896
Summary:
Dynamic Galerie is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

49. Cisco Secure ACS Insecure Password Storage Vulnerability
BugTraq ID: 16743
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/16743
Summary:
Cisco Secure ACS is susceptible to an insecure password-storage vulnerability. This issue is due to a failure of the application to properly secure sensitive password information.

This issue allows attackers to gain access to encrypted passwords and to the key used to encrypt them. This allows them to obtain the plaintext passwords, aiding them in attacking other services that depend on the ACS server for authentication.

Cisco Secure Access Control Server for Windows versions 3.x are affected by this issue.

50. IBM WebSphere Application Server Welcome Page Security Restriction Bypass Vulnerability
BugTraq ID: 17900
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17900
Summary:
IBM WebSphere Application Server is prone to a security restriction-bypass vulnerability. This issue is due to the application's failure to properly enforce security restrictions.

This issue allows remote attackers to gain access to the contents of potentially sensitive web pages, aiding them in further attacks.

51. PHP-Fusion Multiple Local File Include Vulnerabilities
BugTraq ID: 17898
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17898
Summary:
PHP-Fusion is prone to multiple local file-include vulnerabilities. This may allow unauthorized users to view files and to execute local scripts.

An attacker may also be able to execute arbitrary code by way of uploaded avatars.

52. Linux Kernel IP_VS_CONN_FLUSH Local Denial of Service Vulnerability
BugTraq ID: 15528
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15528
Summary:
Linux Kernel is reported prone to a local denial-of-service vulnerability.

Reports indicate that the 'ip_vs_conn_flush' function may allow local users to cause a denial of service due to a NULL-pointer dereference.

Kernel versions prior to 2.6.13 and 2.4.32-pre2 are affected.

53. PSToText Arbitrary Script Code Execution Vulnerability
BugTraq ID: 17897
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17897
Summary:
The pstotext utility is susceptible to an arbitrary command-execution vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input.

If pstotext is called with command-line arguments containing user-supplied data, attackers can execute arbitrary script code in the context of the application calling the vulnerable utility. This may aid attackers in the remote compromise of computers that use the utility in CGI scripts or in a printer-queue application.

Version 1.9 of pstotext is vulnerable to this issue; other versions may also be affected.

54. Linux Kernel Console Keymap Local Command Injection Vulnerability
BugTraq ID: 15122
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15122
Summary:
The Linux kernel is susceptible to a local command-injection vulnerability via console keymap modifications. This issue occurs because unprivileged users can alter the system-wide console keymap.

Local users may modify the console keymap to include scripted macro commands. This allows attackers to execute arbitrary commands with the privileges of the user that uses the console after them, potentially facilitating privilege escalation.

55. Linux Orinoco Driver Remote Information Disclosure Vulnerability
BugTraq ID: 15085
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15085
Summary:
The Orinoco drivers for Linux kernels are susceptible to a remote information-disclosure vulnerability. This issue is due to the driver sending uninitialized kernel memory in small network packets.

Remote attackers may exploit this issue to access potentially sensitive kernel memory, aiding them in further attacks.

56. Linux Kernel Multiple Memory Leak Local Denial Of Service Vulnerabilities
BugTraq ID: 15076
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15076
Summary:
Two local denial-of-service vulnerabilities affect the Linux kernel. These issues are due to a design flaw that creates memory leaks.

Local attackers may exploit these vulnerabilities to consume excessive kernel resources, likely triggering a kernel crash and denying service to legitimate users.

These issues affect Linux kernel versions prior to 2.6.14-rc4.

57. Linux Kernel World Writable SYSFS DRM Debug File Vulnerability
BugTraq ID: 15154
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15154
Summary:
Linux kernel is prone to an issue where a world writable file is created in SYSFS. Exploitation could allow an attacker to obtain sensitive information.

58. Linux Kernel USB Subsystem Local Denial Of Service Vulnerability
BugTraq ID: 14955
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/14955
Summary:
A local denial-of-service vulnerability affects the Linux kernel's USB subsystem. This issue is due to the kernel's failure to properly handle unexpected conditions when trying to handle URBs (USB Request Blocks).

Local attackers may exploit this vulnerability to trigger a kernel 'oops' on computers where the vulnerable USB subsystem is enabled. This would deny service to legitimate users.

59. XN--Gol-kma 2005-Comments-Script Komentare.PHP Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 17895
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17895
Summary:
2005-Comments-Script is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

60. Linux Kernel 64-Bit SMP Routing_ioctl() Local Denial of Service Vulnerability
BugTraq ID: 14902
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/14902
Summary:
A local denial-of-service vulnerability affects the Linux kernel on 64-bit Symmetric Multi-Processor (SMP) platforms.

Specifically, the vulnerability presents itself due to an omitted call to the 'sockfd_put()' function in the 32-bit-compatible 'routing_ioctl()' function.

The 32-bit-compatible 'tiocgdev ioctl()' function on x86-64 platforms is affected by this issue as well.

61. Linux Kernel Netfilter Ipt_recent Remote Denial of Service Vulnerability
BugTraq ID: 14791
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/14791
Summary:
Linux Kernel is reported prone to a local denial-of-service vulnerability.

An attacker can exploit this issue by sending specially crafted packets to a vulnerable computer employing the 'ipt_recent' module.

A successful attack can cause a denial-of-service condition.

62. Linux Kernel Raw_sendmsg() Kernel Memory Access Vulnerability
BugTraq ID: 14787
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/14787
Summary:
Linux Kernel is prone to a kernel memory-access vulnerability.

This issue affects the 'raw_sendmsg()' function and can allow a local attacker to access kernel memory or manipulate the hardware state due to unauthorized access to I/O ports.

Linux kernel 2.6.10 is reportedly vulnerable, but other versions are likely to be affected as well.

63. Inter7 Vpopmail Authentication Bypass Vulnerability
BugTraq ID: 17894
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17894
Summary:
Inter7 vpopmail is susceptible to a remote authentication-bypass vulnerability. This issue is due to a logic flaw in the application while handling plaintext password authentication during SMTP AUTH or APOP connections.

This issue allows remote attackers to bypass authentication checks and to gain unauthorized access to SMTP and POP servers. This may aid them in further attacks.

Versions 5.4.14 and 5.4.15 of vpopmail are vulnerable to this issue; other versions may also be affected.

64. Linux Kernel Sendmsg() Local Buffer Overflow Vulnerability
BugTraq ID: 14785
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/14785
Summary:
Linux kernel is prone to a local buffer-overflow vulnerability.

The vulnerability affects 'sendmsg()' when malformed user-supplied data is copied from userland to kernel memory.

A successful attack can allow a local attacker to trigger an overflow, which may lead to a denial-of-service condition due to memory corruption. Arbitrary code execution resulting in privilege escalation is possible as well.

65. GhostScript Insecure Temporary File Creation Vulnerability
BugTraq ID: 11285
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/11285
Summary:

Ghostscript creates temporary files in an insecure manor. This issue is likely due to a design error that causes the application to fail to verify the presence of a file before writing to it.

An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. Reportedly, this issue is unlikely to facilitate privilege escalation.

66. FaktoryStudios EasyEvent Index.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 17891
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17891
Summary:
EasyEvent is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

67. Util-Linux UMount Remounting Filesystem Option Clearing Vulnerability
BugTraq ID: 14816
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/14816
Summary:
Util-linux is susceptible to a filesystem-option-clearing vulnerability. This issue is due to a design flaw that improperly clears mounted-filesystem options in certain circumstances.

This vulnerability allows attackers to clear mounted-filesystem options, allowing them to execute setuid applications to gain elevated privileges. Other attacks are also possible.

68. Multiple Cisco Products WebSense Content Filtering Bypass Vulnerability
BugTraq ID: 17883
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17883
Summary:
Multiple Cisco products are susceptible to a content-filtering bypass vulnerability. This issue is due to a failure of the software to properly recognize HTTP request traffic.

This issue allows users to bypass content-filtering and access forbidden websites.

Cisco is tracking this issue as Bug IDs CSCsc67612, CSCsc68472, and CSCsd81734.http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCsd81734

69. EvoTopsite Index.PHP Multiple SQL Injection Vulnerabilities
BugTraq ID: 17893
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17893
Summary:
evoTopsite is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploits could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

70. Fetchmail Missing Email Header Remote Denial of Service Vulnerability
BugTraq ID: 15987
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15987
Summary:
Fetchmail is affected by a remote denial-of-service vulnerability. This issue is due to the application's failure to handle unexpected input. This issue occurs only when Fetchmail is configured in 'multidrop' mode.

71. StatIt Visible_count_inc.PHP Remote File Include Vulnerability
BugTraq ID: 17887
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17887
Summary:
StatIt is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

72. ACal Day.PHP Remote File Include Vulnerability
BugTraq ID: 17886
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17886
Summary:
ACal is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

73. Microsoft Windows MSDTC Heap Buffer Overflow Vulnerability
BugTraq ID: 17905
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17905
Summary:
Microsoft Windows Distributed Transaction Coordinator is prone to a remote heap buffer-overflow vulnerability. This issue is due to the failure of the software to properly bounds check user-supplied input prior to copying it to an insufficiently sized memory buffer.

This BID is flagged with the 'Conflicting Details' credibility rating because of the descrepancy between the vendor and the discoverer as to the possibility of remote code execution.

Microsoft states that this issue may only be exploited to disrupt the MSDTC service, and any services that depend on MSDTC. The discoverer of this issue states that it may be exploited for remote code execution.

This vulnerability affects Windows NT and Windows 2000 by default, since the service comes enabled. The vulnerability only affects Windows XP and Windows Server 2003 if the service is manually enabled.

74. Microsoft Windows MSDTC Invalid Memory Access Denial Of Service Vulnerability
BugTraq ID: 17906
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17906
Summary:
Microsoft Windows Distributed Transaction Coordinator is prone to a denial-of-service vulnerability.

This vulnerability can be exploited remotely to disrupt the MSDTC service, and any services that depend on MSDTC.

75. Sudo Perl Environment Variable Handling Security Bypass Vulnerability
BugTraq ID: 15394
Remote: No
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15394
Summary:
Sudo is prone to a security-bypass vulnerability that could lead to arbitrary code execution. This issue is due to an error in the application when handling the 'PERLLIB', 'PERL5LIB', and 'PERL5OPT' environment variables when tainting is ignored.

An attacker can exploit this vulnerability to bypass security restrictions and include arbitrary library files.

To exploit this vulnerability, an attacker must be able to run Perl scripts through Sudo.

76. SmartISoft phpListPro Config.PHP Remote File Include Vulnerability
BugTraq ID: 17448
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17448
Summary:
phpListPro is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

77. Macromedia Flash Array Index Memory Access Vulnerability
BugTraq ID: 15332
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15332
Summary:
The Flash plug-in is vulnerable to an input-validation error that can be reliably exploited to execute arbitrary code. The vulnerability is due to an input-validation error for a critical array index value.

An attacker can exploit this vulnerability to execute arbitrary code. The most likely vector of attack is through a malicious SWF file designed to trigger the vulnerability that has been placed on a website.

Macromedia Flash 6 and 7 are reported affected.

78. Maxx Schedule Multiple Input Validation Vulnerabilities
BugTraq ID: 17892
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17892
Summary:
Maxx Schedule is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Maxx Schedule version 1.0 is vulnerable to these issues; other versions may also be affected.

79. Online Universal Payment System Script Multiple Input Validation Vulnerabilities
BugTraq ID: 17889
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17889
Summary:
Online Universal Payment System Script is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

80. Creative Community Portal Multiple SQL Injection Vulnerabilities
BugTraq ID: 17890
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17890
Summary:
Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

81. EQDKP DBal.PHP Remote File Include Vulnerability
BugTraq ID: 17888
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17888
Summary:
EQdkp is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

82. Dropbear SSH Server Remote Buffer Overflow Vulnerability
BugTraq ID: 15923
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15923
Summary:
Dropbear SSH Server is prone to a remote buffer-overflow vulnerability.

Specifically, the vulnerability presents itself when the application handles excessive string data supplied by an authenticated user.

A successful attack may facilitate arbitrary code execution. Exploitation of this vulnerability may allow an attacker to gain superuser access to the computer.

Dropbear SSH Server versions prior to 0.47 are affected.

83. Drupal Project Module HTML Injection Vulnerability
BugTraq ID: 17885
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17885
Summary:
Drupal is prone to an HTML-injection vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

84. Avahi Buffer Overflow and Denial Of Service Vulnerabilities
BugTraq ID: 17884
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17884
Summary:
Avahi is susceptible to multiple remote vulnerabilities.

A buffer-overflow vulnerability and denial-of-service vulnerability affect Avahi, and potentially allow remote attackers to execute arbitrary machine code and to crash the affected application.

Versions prior to 0.6.10 are vulnerable to these issues.

85. MultiCalendars All_calendars.ASP SQL Injection Vulnerability
BugTraq ID: 17903
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17903
Summary:
MultiCalendars is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 3.0 is reported to be vulnerable; other versions may also be affected.

86. LibTiff Double Free Memory Corruption Vulnerability
BugTraq ID: 17733
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17733
Summary:
Applications using the LibTIFF library are prone to a double-free vulnerability; a fix is available.

Attackers may be able to exploit this issue to cause denial-of-service conditions in affected applications using a vulnerable version of the library; arbitrary code execution may also be possible.

87. LibTiff Multiple Denial of Service Vulnerabilities
BugTraq ID: 17730
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17730
Summary:
LibTIFF is affected by multiple denial-of-service vulnerabilities.

An attacker can exploit these vulnerabilities to cause a denial of service in applications using the affected library.

88. LibTiff TIFFFetchData Integer Overflow Vulnerability
BugTraq ID: 17732
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17732
Summary:
Applications using the LibTIFF library are prone to an integer-overflow vulnerability.

An attacker could exploit this vulnerability to execute arbitrary code in the context of the vulnerable application that uses the affected library. Failed exploit attempts will likely cause denial-of-service conditions.

89. GDK-Pixbuf BMP Image Processing Double Free Remote Denial of Service Vulnerability
BugTraq ID: 12950
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/12950
Summary:
The gdk-pixbuf library is reported prone to a denial-of-service vulnerability. This issue arises due to a double-free condition.

Reportedly, this vulnerability presents itself when an application that is linked against the library handles malformed bitmap (.bmp) image files.

A successful attack may result in a denial-of-service condition. It is not confirmed whether this vulnerability could be leveraged to execute arbitrary code.

The gdk-pixbuf 0.22.0 and gtk2 2.4.14 packages are known to be vulnerable to this issue. Other versions are likely affected as well.

This BID will be updated when more information becomes available.

90. GDK-Pixbuf Multiple Vulnerabilities
BugTraq ID: 11195
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/11195
Summary:
Multiple vulnerabilities have been reported in gdk-pixbuf.

The first vulnerability in the library presents itself when the library tries to decode BMP images. In certain circumstances, the library may enter into an infinite loop and consume CPU resources, thus halting further execution of applications using the library.

The second and third vulnerabilities occur when the library tries to decode XPM images. Specially crafted image files could either crash applications using the affected library, or allow for the execution of attacker-supplied code.

The fourth and last vulnerability occurs when the library tries to decode ICO images. Specially crafted ICO files could cause applications to crash.

These vulnerabilities allow attackers to crash applications or to execute arbitrary code in the context of applications that use the affected library.

91. Intervations FileCopa User Command Remote Buffer Overflow Vulnerability
BugTraq ID: 17881
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17881
Summary:
FileCopa is prone to a buffer-overflow vulnerability when handling data through the USER command.
Reportedly, passing excessive data may overflow a finite-sized internal memory buffer. A successful attack may result in memory corruption as memory adjacent to the buffer is overwritten with user-supplied data.

This issue may lead to a denial-of-service condition or the execution of arbitrary code.

92. VP-ASP Shopping Cart Shopcurrency.ASP SQL Injection Vulnerability
BugTraq ID: 17882
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17882
Summary:
VP-ASP Shopping Cart is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Versions prior to 6.08 are vulnerable; other versions may also be affected.

93. TZipBuilder ZIP File Buffer Overflow Vulnerability
BugTraq ID: 17880
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17880
Summary:
TZipBuilder is susceptible to a buffer-overflow vulnerability. The application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

This issue allows attackers to execute arbitrary machine code in the context of users running the affected application.

Version 1.79.03.01 of TZipBuilder is vulnerable to this issue; prior versions may also be affected.

94. Lynx NNTP Article Header Buffer Overflow Vulnerability
BugTraq ID: 15117
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15117
Summary:
Lynx is prone to a buffer overflow when handling NNTP article headers.

This issue may be exploited when the browser handles NNTP content, such as through 'news:' or 'nntp:' URIs. Successful exploitation will result in code execution in the context of the program user.

95. Lynx URI Handlers Arbitrary Command Execution Vulnerability
BugTraq ID: 15395
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/15395
Summary:
Lynx is prone to an arbitrary command-execution vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input.

A remote attacker can exploit this vulnerability by tricking a victim user into following a malicious link, thus enabling the attacker to execute arbitrary commands in the context of the victim user.

96. Phil's Bookmark Script Admin.PHP Authentication Bypass Vulnerability
BugTraq ID: 17878
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17878
Summary:
Phil's Bookmark script is prone to an authentication-bypass vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials.

An attacker can exploit this issue to bypass authentication and gain admin access to the affected application. This could aid in further attacks on the affected computer.

97. Nagios Remote Negative Content-Length Buffer Overflow Vulnerability
BugTraq ID: 17879
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17879
Summary:
Nagios is susceptible to a remote buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue allows remote attackers to execute arbitrary machine code in the context of hosting webservers.

Nagios versions prior to 2.3 in the 2.x series, and versions prior to 1.4 in the 1.x series are vulnerable to this issue.

98. Cyrus SASL Remote Digest-MD5 Denial of Service Vulnerability
BugTraq ID: 17446
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/17446
Summary:
Cyrus SASL is affected by a remote denial-of-service vulnerability. This issue occurs before successful authentication, allowing anonymous remote attackers to trigger it.

This vulnerability allows remote attackers to crash services using the affected SASL library, denying service to legitimate users.

This issue reportedly affects version 2.1.18 of Cyrus SASL; other versions may also be affected.

99. Multiple Mozilla Products Memory Corruption/Code Injection/Access Restriction Bypass Vulnerabilities
BugTraq ID: 16476
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/16476
Summary:
Multiple Mozilla products are prone to multiple vulnerabilities. These issues include various memory-corruption, code-injection, and access-restriction-bypass vulnerabilities. Other undisclosed issues may have also been addressed in the various updated vendor applications.

Successful exploitation of these issues may permit an attacker to execute arbitrary code in the context of the affected application. This may facilitate a compromise of the affected computer; other attacks are also possible.

100. Mozilla Thunderbird IFRAME JavaScript Execution Vulnerability
BugTraq ID: 16770
Remote: Yes
Last Updated: 2006-05-09
Relevant URL: http://www.securityfocus.com/bid/16770
Summary:
Mozilla Thunderbird is prone to a script-execution vulnerability.

The vulnerability presents itself when an attacker supplies a specially crafted email to a user containing malicious script code in an IFRAME and the user tries to reply to the mail. Arbitrary JavaScript can be executed even if the user has disabled JavaScript execution in the client.

Mozilla Thunderbird 1.0.7 and prior versions are reportedly affected.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Bot software looks to improve peerage
By: Robert Lemos
Threatened by investigators' ability to tap into chat-based command-and-control networks, bot masters increasingly look to peer-to-peer communications, encryption and other technologies to hide their tracks.
http://www.securityfocus.com/news/11390

2. Breach case could curtail Web flaw finders
By: Robert Lemos
Security researchers and legal experts voice concern over the prosecution of an information-technology professional for computer intrusion after he allegedly breached a university's online application system while researching a flaw without the school's permission.
http://www.securityfocus.com/news/11389

3. E-mail authentication gaining steam
By: Robert Lemos
A host of software companies, security firms and Internet service providers meet in Chicago to urge corporations and bulk e-mail senders to adopt authentication technologies.
http://www.securityfocus.com/news/11388

4. Browsers feel the fuzz
By: Robert Lemos
Security researchers are starting to aim network fuzzers away from servers and toward browsers, finding that dozens of flaws have been missed.
http://www.securityfocus.com/news/11387

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Security System Administrator, Westlake Village
http://www.securityfocus.com/archive/77/433510

2. [SJ-JOB] Security System Administrator, Westlake Village
http://www.securityfocus.com/archive/77/433512

3. [SJ-JOB] Channel / Business Development, San Jose
http://www.securityfocus.com/archive/77/433513

4. [SJ-JOB] Security System Administrator, Austin
http://www.securityfocus.com/archive/77/433508

5. [SJ-JOB] Developer, Kansas City
http://www.securityfocus.com/archive/77/433509

6. [SJ-JOB] Sr. Security Engineer, Bethesda
http://www.securityfocus.com/archive/77/433507

7. [SJ-JOB] Security Consultant, Philly
http://www.securityfocus.com/archive/77/433237

8. [SJ-JOB] Forensics Engineer, Costa Mesa
http://www.securityfocus.com/archive/77/433261

9. [SJ-JOB] Senior Software Engineer, San Francisco
http://www.securityfocus.com/archive/77/433236

10. [SJ-JOB] Sr. Product Manager, San Francisco
http://www.securityfocus.com/archive/77/433238

11. [SJ-JOB] Application Security Architect, Redmond
http://www.securityfocus.com/archive/77/433232

12. [SJ-JOB] Software Engineer, New York
http://www.securityfocus.com/archive/77/433233

13. [SJ-JOB] Instructor, Dammam
http://www.securityfocus.com/archive/77/433234

14. [SJ-JOB] Software Engineer, Herndon
http://www.securityfocus.com/archive/77/433235

15. [SJ-JOB] Software Engineer, Philadelphia
http://www.securityfocus.com/archive/77/433239

16. [SJ-JOB] Account Manager, Atlanta
http://www.securityfocus.com/archive/77/433226

17. [SJ-JOB] Security Engineer, Dallas
http://www.securityfocus.com/archive/77/433227

18. [SJ-JOB] Account Manager, Minneapolis
http://www.securityfocus.com/archive/77/433228

19. [SJ-JOB] Sales Engineer, Atlanta
http://www.securityfocus.com/archive/77/433225

20. [SJ-JOB] Senior Software Engineer, Toronto
http://www.securityfocus.com/archive/77/433224

21. [SJ-JOB] Channel / Business Development, Boston
http://www.securityfocus.com/archive/77/433218

22. [SJ-JOB] Software Engineer, Overland
http://www.securityfocus.com/archive/77/433219

23. [SJ-JOB] Sales Representative, Nashville
http://www.securityfocus.com/archive/77/432919

24. [SJ-JOB] Security Architect, Dallas/Fort Worth
http://www.securityfocus.com/archive/77/432915

25. [SJ-JOB] Security Engineer, Costa Mesa
http://www.securityfocus.com/archive/77/432916

26. [SJ-JOB] Management, SAN DIEGO
http://www.securityfocus.com/archive/77/432917

27. [SJ-JOB] Security Architect, San Jose
http://www.securityfocus.com/archive/77/432918

V. INCIDENTS LIST SUMMARY
---------------------------
1. Weblog software XSS attack?
http://www.securityfocus.com/archive/75/432972

VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. INFIGO-2006-05-03: Multiple FTP Servers vulnerabilities
http://www.securityfocus.com/archive/82/433314

2. DIA file name handling format string
http://www.securityfocus.com/archive/82/433313

VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. USB device installation problem
http://www.securityfocus.com/archive/88/433355

2. Autorun in screensaver
http://www.securityfocus.com/archive/88/433357

3. Sniffer question
http://www.securityfocus.com/archive/88/433354

4. Patch Management on Critical Servers (Healthcare)
http://www.securityfocus.com/archive/88/433214

5. windows 2003 1wan 2lan => vpn to ech private lan?
http://www.securityfocus.com/archive/88/432951

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This issue is sponsored by: Unatek

Get the Details and Register at: http://www.unatek.com/conference.htm or Call 301-583-4629.