SecurityFocus Newsletter #352

Peter Laborge <[email protected]> Wed, 31 May 2006 14:57:40 -0600

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #352
----------------------------------------

This issue is sponsored by: SPI Dynamics

EASY TARGETS: Hacking Web Applications- A Step-by-Step Attack Analysis
The speed with which Web Applications are developed make them prime targets for attackers, often these applications were developed so quickly that they are not coded properly or subjected to any security testing. Hackers know this and use it as their weapon. Download *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/web.asp?cs1_ContSupRef=70130000000CRxF

------------------------------------------------------------------
I. FRONT AND CENTER
1. Abandon e-mail!
II. BUGTRAQ SUMMARY
1. Linux Kernel XFS File System Local Information Disclosure Vulnerability
2. Linux Kernel Security Key Functions Local Copy_To_User Race Vulnerability
3. Linux Kernel AF_UNIX Arbitrary Kernel Memory Modification Vulnerability
4. Linux Kernel Local Denial Of Service And Memory Disclosure Vulnerabilities
5. Linux Kernel SCM_SEND Local Denial of Service Vulnerability
6. Linux Kernel PPP Driver Unspecified Remote Denial Of Service Vulnerability
7. Linux Kernel USB io_edgeport Driver Local Integer Overflow Vulnerability
8. Linux Kernel Multiple Local MOXA Serial Driver Buffer Overflow Vulnerabilities
9. Linux Kernel ELF Binary Loading Denial Of Service Vulnerability
10. Linux Kernel Multiple Local Vulnerabilities
11. Linux Kernel Unspecified Local Denial of Service Vulnerability
12. Linux Kernel USB Driver Uninitialized Structure Information Disclosure Vulnerability
13. Linux Kernel Panic Function Call Buffer Overflow Vulnerability
14. Linux kernel do_fork() Memory Leakage Vulnerability
15. Linux Kernel BINFMT_ELF Loader Local Privilege Escalation Vulnerabilities
16. Linux Kernel Floating Point Register Contents Leak Vulnerability
17. Linux Kernel Multiple Device Driver Vulnerabilities
18. Linux Kernel 2.4 RTC Handling Routines Memory Disclosure Vulnerability
19. Linux Kernel SMBFS Multiple Remote Vulnerabilities
20. Linux Kernel Coda_Pioctl Local Buffer Overflow Vulnerability
21. Foing Multiple Remote File Include Vulnerabilities
22. Geeklog Multiple Input Validation Vulnerabilities
23. Blend Portal Blend_common.PHP Remote File Include Vulnerability
24. F@cile Interactive Web P-Themes Cross-Site Scripting Vulnerability
25. F@cile Interactive Web Multiple Remote File Include Vulnerabilities
26. Photoalbum B&W Index.PHP Cross-Site Scripting Vulnerability
27. Linux Kernel DM-Crypt Local Information Disclosure Vulnerability
28. Linux Kernel Proc dentry_unused Corruption Local Denial of Service Vulnerability
29. 4nForum Modules.PHP SQL Injection Vulnerability
30. Linux Kernel Ssockaddr_In.Sin_Zero Kernel Memory Disclosure Vulnerabilities
31. Gnopaste Common.PHP Remote File Include Vulnerability
32. SCO UnixWare Ptrace Local Privilege Escalation Vulnerability
33. Mozilla Firefox Marquee Denial of Service Vulnerability
34. Multiple Mozilla Products Memory Corruption/Code Injection/Access Restriction Bypass Vulnerabilities
35. Mozilla Suite, Firefox, SeaMonkey, and Thunderbird Multiple Remote Vulnerabilities
36. Hitachi Hitsenser3 SQL Injection Vulnerability
37. Etype Eserv Multiple Input Validation Vulnerabilities
38. Microsoft Internet Explorer Malformed HTML Parsing Denial of Service Vulnerability
39. Linux Kernel Multiple SCTP Remote Denial of Service Vulnerabilities
40. ToendaCMS Index.PHP Cross-Site Scripting Vulnerability
41. BMV PostScript File Handling Integer Overflow Vulnerability
42. Linux Kernel Multiple SCTP Remote Denial of Service Vulnerabilities
43. ZipCentral ZIP File Buffer Overflow Vulnerability
44. Linux Kernel SMBFS CHRoot Security Restriction Bypass Vulnerability
45. Vixie Cron PAM_Limits Local Privilege Escalation Vulnerability
46. Linux Kernel CIFS CHRoot Security Restriction Bypass Vulnerability
47. Linux Kernel SCTP-netfilter Remote Denial of Service Vulnerability
48. Linux Kernel IP_ROUTE_INPUT Local Denial of Service Vulnerability
49. Linux Kernel Shared Memory Security Restriction Bypass Vulnerability
50. Linux Kernel RCU signal handling __group_complete_signal Function Unspecified Vulnerability
51. Multiple Vendor AMD CPU Local FPU Information Disclosure Vulnerability
52. Linux Kernel IP ID Information Disclosure Weakness
53. Linux Kernel SYSFS PAGE_SIZE Local Denial of Service Vulnerability
54. Linux Kernel Intel EM64T SYSRET Local Denial of Service Vulnerability
55. Linux Kernel ICMP_Send Remote Denial Of Service Vulnerability
56. Linux Kernel die_if_kernel Local Denial of Service Vulnerability
57. Linux Kernel ELF File Entry Point Denial of Service Vulnerability
58. KTools Remote Buffer Overflow Vulnerability
59. Linux Kernel sys_mbind System Call Local Denial of Service Vulnerability
60. Linux Kernel NFS Client Denial of Service Vulnerability
61. GNU Mailman Large Date Data Denial Of Service Vulnerability
62. GNU Mailman Attachment Scrubber UTF8 Filename Denial Of Service Vulnerability
63. Microsoft Word Unspecified Remote Code Execution Vulnerability
64. Kaspersky Anti-Virus Unspecified Denial Of Service Vulnerability
65. Cyrus SASL Remote Digest-MD5 Denial of Service Vulnerability
66. Linux Kernel MREMAP Local Privilege Escalation Vulnerability
67. Linux Kernel MIPS Ptrace Local Privilege Escalation Vulnerability
68. Linux Kernel ELF Loader Mismatched Architecture Local Denial of Service Vulnerability
69. UBBThreads Index.PHP Cross-Site Scripting Vulnerability
70. PHP Multiple Safe_Mode and Open_Basedir Restriction Bypass Vulnerabilities
71. Linux Kernel Invalid Proc Memory Access Local Denial of Service Vulnerability
72. PHP PHPInfo Large Input Cross-Site Scripting Vulnerability
73. LibTIFF TIFFFetchShortPair Null Pointer Dereference Denial of Service Vulnerability
74. Achievo Class.employee.inc SQL Injection Vulnerability
75. OABoard Forum Script Remote File Include Vulnerability
76. Speedy Asp Discussion Forum Authentication Bypass Vulnerability
77. D-Link Airspot DSA-3100 Gateway Login_error.SHTML Cross-Site Scripting Vulnerability
78. Open Searchable Image Catalogue Multiple Input Validation Vulnerabilities
79. LinuxPrinting.org Foomatic-Filter Command Execution Vulnerability
80. PPPBlog Randompic.PHP Directory Traversal Vulnerability
81. PHP-Nuke Multiple Remote File Include Vulnerabilities
82. PHPMyDesktop|arcade Index.PHP Local File Include Vulnerability
83. Dia Multiple Unspecified Remote Format String Vulnerabilities
84. QJForum Member.ASP SQL Injection Vulnerability
85. LibTiff Double Free Memory Corruption Vulnerability
86. LibTiff Multiple Denial of Service Vulnerabilities
87. LibTiff TIFFFetchData Integer Overflow Vulnerability
88. Nivisec Hacks List Admin_hacks_list.PHP Information Disclosure Vulnerability
89. Multiple Mozilla Products IFRAME JavaScript Execution Vulnerability
90. Fastpublish CMS Multiple Remote File Include Vulnerabilities
91. EVA-Web Multiple Cross-Site Scripting Vulnerabilities
92. CherryPy StaticFilter Directory Traversal Vulnerability
93. Multiple Vendor UNACEV2 Archive File Name Buffer Overflow Vulnerability
94. PHPBB-Amod Lang_Activity.PHP Remote File Include Vulnerability
95. Nukedit Register.ASP Unauthorized Access Vulnerability
96. Linux kernel Uselib() Local Privilege Escalation Vulnerability
97. Linux Kernel Unw_Unwind_To_User Local Denial of Service Vulnerability
98. WikiNi Multiple HTML Injection Vulnerabilities
99. Linux Kernel Symmetrical Multiprocessing Page Fault Local Privilege Escalation Vulnerability
100. Linux Kernel User Triggerable BUG() Unspecified Local Denial of Service Vulnerability
III. SECURITYFOCUS NEWS
1. Veterans Affairs warns of massive privacy breach
2. Blue Security folds under spammer's wrath
3. Diebold voting systems critically flawed
4. Bot software looks to improve peerage
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Manager, Information Security, Chicago
2. [SJ-JOB] Security Auditor, Chicago
3. [SJ-JOB] Security Engineer, Richardson
4. [SJ-JOB] Database Security Engineer, Raleigh
5. [SJ-JOB] Information Assurance Engineer, Arlington
6. [SJ-JOB] Technical Support Engineer, Atlanta
7. [SJ-JOB] Security Engineer, Bethesda
8. [SJ-JOB] Technology Risk Consultant, Eastern Iowa
9. [SJ-JOB] Security Consultant, Bangalore
10. [SJ-JOB] Management, Calgary
11. [SJ-JOB] Sr. Security Analyst, Eastern Iowa
12. [SJ-JOB] Sr. Security Analyst, Silver Spring
13. [SJ-JOB] Sr. Security Analyst, London
14. [SJ-JOB] Application Security Engineer, Portsmouth
15. [SJ-JOB] Technical Support Engineer, Cupertino
16. [SJ-JOB] Channel / Business Development, London
17. [SJ-JOB] Sales Engineer, London
18. [SJ-JOB] Manager, Information Security, London
19. [SJ-JOB] Quality Assurance, Cupertino
20. [SJ-JOB] Security Engineer, Parsippany
21. [SJ-JOB] Sr. Security Engineer, Parsippany
22. [SJ-JOB] Jr. Security Analyst, Bay Area
23. [SJ-JOB] Security Engineer, Chicago
24. [SJ-JOB] Sales Engineer, Mountain View
25. [SJ-JOB] Sales Representative, anywhere
26. [SJ-JOB] Sr. Security Analyst, Glendale (Los Angeles)
27. [SJ-JOB] Manager, Information Security, Washington
28. [SJ-JOB] Penetration Engineer, Parsippany
29. [SJ-JOB] Sales Representative, Chicago
30. [SJ-JOB] Security Consultant, Work Remotely or Charlotte, NC
31. [SJ-JOB] Jr. Security Analyst, Atlanta
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
1. heap overflow foreward consolidation
2. argc issue
3. Finding Function in IAT tables
VII. MICROSOFT FOCUS LIST SUMMARY
1. New SecurityFocus mailing list: Focus-Apple
2. Restricting Remote Registry Access
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Abandon e-mail!
By Kelly Martin
Kelly Martin takes a step back from e-mail's unstoppable phishing-virus-spam epidemic and imagines a world where secure e-mail could be the next big killer app.
http://www.securityfocus.com/columnists/404

II. BUGTRAQ SUMMARY
--------------------
1. Linux Kernel XFS File System Local Information Disclosure Vulnerability
BugTraq ID: 16921
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16921
Summary:
The Linux kernel's XFS filesystem is susceptible to a local information-disclosure vulnerablity. This issue is due to a flaw in the filesystem that may result in previously written data being returned to local users.

This issue allows local malicious users to gain access to potentially sensitive data, aiding them in further attacks.

Linux kernel versions prior to 2.6.15.5 are affected by this issue.

2. Linux Kernel Security Key Functions Local Copy_To_User Race Vulnerability
BugTraq ID: 17084
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17084
Summary:
The Linux kernel is susceptible to a local race-condition vulnerability in its security-key functionality. This issue is due to a race condition that allows attackers to modify an argument of a copy operation after is has been validated, but before it is used.

This vulnerability allows local attackers to crash the kernel, denying service to legitimate users. It may also allow attackers to read portions of kernel memory, and thus gain access to potentially sensitive information. This may aid them in further attacks.

3. Linux Kernel AF_UNIX Arbitrary Kernel Memory Modification Vulnerability
BugTraq ID: 11715
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/11715
Summary:
A serialization error is reported to exist in the AF_UNIX address family; the error creates a race condition. This race condition reportedly allows local users to repeatedly increment arbitrary kernel memory locations.

This vulnerability allows local users to modify arbitrary kernel memory, facilitating privilege escalation; it may possibly allow code execution in the context of the kernel.

Versions prior to 2.4.28 are reportedly affected by this vulnerability.

4. Linux Kernel Local Denial Of Service And Memory Disclosure Vulnerabilities
BugTraq ID: 11754
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/11754
Summary:
The Linux kernel is reported prone to multiple local vulnerabilities:

- A handcrafted 'a.out' file may be used to trigger a local denial-of-service condition. A local attacker may exploit this vulnerability to trigger a system-wide denial of service, potentially resulting in a kernel panic.

- A memory-disclosure vulnerability reportedly affects only SMP computers with more than 4GB of memory. A local attacker may exploit this vulnerability to access random pages of physical memory.

5. Linux Kernel SCM_SEND Local Denial of Service Vulnerability
BugTraq ID: 11921
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/11921
Summary:
Linux kernel is reported prone to a local denial-of-service vulnerability. This issue presents itself in the SCM logical sub-layer of the socket API.

An unprivileged application can craft a malformed auxiliary message and send it to a socket, which results in the kernel invoking '__scm_send()' in a manner that leads to a crash. This issue can allow local attackers to cause a denial-of-service condition on a vulnerable computer. It is not confirmed if this vulnerability can be leveraged to gain elevated privileges.

6. Linux Kernel PPP Driver Unspecified Remote Denial Of Service Vulnerability
BugTraq ID: 12810
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/12810
Summary:
Linux Kernel (Point-to-Point Protocol) PPP Driver is reported prone to an unspecified remote denial-of-service vulnerability.

A successful attack can cause a denial-of-service condition in the server and can prevent access to legitimate users.

Linux Kernel 2.6.8 was reported vulnerable. Subsequent versions may be affected as well.

Due to a lack of details, further information is not available at the moment. This BID will be updated when more information becomes available.

7. Linux Kernel USB io_edgeport Driver Local Integer Overflow Vulnerability
BugTraq ID: 12102
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/12102
Summary:
A local integer-overflow vulnerability affects the Linux kernel's 'io_edgeport' USB driver. This issue is due to the driver's failure to validate integer bounds.

An attacker may leverage this issue to execute arbitrary instructions or cause the affected kernel to crash.

8. Linux Kernel Multiple Local MOXA Serial Driver Buffer Overflow Vulnerabilities
BugTraq ID: 12195
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/12195
Summary:
The MOXA serial driver in the Linux kernel is reported prone to multiple buffer-overflow vulnerabilities. The driver fails to perform proper bounds checks before copying user-supplied data to fixed-size memory buffers.

These vulnerabilities reside in the 'drivers/char/moxa.c' file.

The vulnerable functions perform a 'copy_from_user()' call to copy user-supplied, user-space data to a fixed-size, static kernel memory buffer (moxaBuff) of 10240 bytes in length while using the user-supplied length argument as passed from 'MoxaDriverIoctl()'. This reportedly results in improperly bounded operations, potentially causing locally exploitable buffer overflows.

Linux kernels from 2.2 through 2.4 and 2.6 are all reported prone to these vulnerabilities.

9. Linux Kernel ELF Binary Loading Denial Of Service Vulnerability
BugTraq ID: 12101
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/12101
Summary:
The Linux kernel is affected by a denial-of-service vulnerability that occurs when malformed ELF binaries are loaded.

An attacker may leverage this issue to cause the affected kernel to crash, denying service to legitimate users.

10. Linux Kernel Multiple Local Vulnerabilities
BugTraq ID: 11956
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/11956
Summary:
The Linux kernel is reported prone to multiple local vulnerabilities. The following individual issues are reported:

- An integer overflow is reported to exist in 'ip_options_get()' of the 'ip_options.c' kernel source file. This vulnerability is reported to exist only in the 2.6 kernel tree. Although unconfirmed, due to its nature this issue presumably may be further leveraged to execute arbitrary code with ring-0 privileges.

A local attacker may exploit this vulnerability to deny service to legitimate users. Other attacks are also likely possible.

- A second integer-overflow vulnerability is reported to exist in the 'vc_resize()' function of the Linux kernel. This vulnerability is reported to exist in the 2.6 and 2.4 kernel trees. Although unconfirmed, due to its nature this issue presumably may be further leveraged to execute arbitrary code with ring-0 privileges.

A local attacker may exploit this vulnerability to deny service to legitimate users. Other attacks are also likely possible.

- A memory leak is reported to exist in 'ip_options_get()' of the 'ip_options.c' kernel source file. This vulnerability is reported to exist in the 2.6, and 2.4 kernel tree.

A local attacker may exploit this vulnerability to consume kernel heap memory resources and in doing so may impact system performance, ultimately resulting in a denial of service to legitimate users.

11. Linux Kernel Unspecified Local Denial of Service Vulnerability
BugTraq ID: 10783
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/10783
Summary:
Linux kernel is reported prone to an unspecified local denial-of-service vulnerability. Reportedly, this issue affects only ia64 systems. A local attacker can exploit this issue by dereferencing a NULL pointer and causing a kernel panic. Successful exploitation will lead to a denial-of-service condition in a vulnerable computer.

No further details are available at this time. This issue will be updated as more information becomes available.

12. Linux Kernel USB Driver Uninitialized Structure Information Disclosure Vulnerability
BugTraq ID: 10892
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/10892
Summary:
Certain Linux Kernel USB drivers are prone to a vulnerability that may permit a local attacker to access unauthorized contents of kernel memory. This could reportedly reveal sensitive information to the attacker.

13. Linux Kernel Panic Function Call Buffer Overflow Vulnerability
BugTraq ID: 10233
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/10233
Summary:
The panic() function call of the Linux kernel has been reported prone to a buffer-overflow vulnerability.

The vulnerability is reported to present itself when an unbounded vsprintf() call within panic() copies user-supplied data into a fixed buffer. Reportedly, a user may be able to overrun the bounds of the affected buffer and corrupt adjacent memory. Because this buffer resides in kernel memory space, an attacker may be able to exploit this issue to corrupt kernel memory, access memory contents, and -- although unconfirmed -- execute arbitrary code. Some reports, however, indicate that this
vulnerability is not exploitable.

14. Linux kernel do_fork() Memory Leakage Vulnerability
BugTraq ID: 10221
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/10221
Summary:
The Linux kernel is reported prone to a memory-leakage vulnerability. The issue exists because memory for child processes is allocated but never freed.

This issue has been identified in kernel versions 2.4 and 2.6.

15. Linux Kernel BINFMT_ELF Loader Local Privilege Escalation Vulnerabilities
BugTraq ID: 11646
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/11646
Summary:
Multiple vulnerabilities have been identified in the Linux ELF binary loader. These issues can allow local attackers to gain elevated privileges. The source of these issues resides in the 'load_elf_binary' function of the 'binfmt_elf.c' file.

The first issue results from an improper check performed on the return value of the 'kernel_read()' function. An attacker may gain control over execution flow of a setuid binary by modifying the memory layout of a binary.

The second issue results from improper error-handling when the 'mmap()' function fails.

The third vulnerability results from a bad return value when the program interpreter (linker) is mapped into memory. It is reported that this issue occurs only in the 2.4.x versions of the Linux kernel.

The fourth issue presents itself because a user can execute a binary with a malformed interpreter name string. This issue can lead to a system crash.

The final issue resides in the 'execve()' code. This issue may allow an attacker to disclose sensitive data that can potentially be used to gain elevated privileges.

These issues are currently undergoing further analysis. This BID will be updated and divided into separate BIDS in the future.

16. Linux Kernel Floating Point Register Contents Leak Vulnerability
BugTraq ID: 10687
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/10687
Summary:
The Linux kernel is reported prone to a data-disclosure vulnerability.

Reportedly, this issue may permit a malicious executable to access the contents of floating-point registers that belong to another process.

This vulnerability is reported to affect only ia64 systems.

17. Linux Kernel Multiple Device Driver Vulnerabilities
BugTraq ID: 10566
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/10566
Summary:
The Linux kernel is reported prone to multiple device-driver issues. These issues were found during a recent audit of the Linux kernel source.

The following drivers are reportedly affected by these issues:

aironet
asus_acpi
decnet
mpu401
msnd
pss

These issues may reportedly allow attackers to access kernel memory or gain escalated privileges on the affected computer.

18. Linux Kernel 2.4 RTC Handling Routines Memory Disclosure Vulnerability
BugTraq ID: 9154
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/9154
Summary:
The Linux kernel 2.4 tree has been reported prone to a memory-disclosure vulnerability. The issue is reported to present itself in kernel realtime clock (RTC) interface procedures and may result in kernel memory stack data being leaked into userland. The problem stems from an internal RTC structure that isn't properly initialized with zeros before being read, potentially returning random contents of kernel stack memory when this operation occurs. This could expose sensitive information such as
credentials to unprivileged users.

19. Linux Kernel SMBFS Multiple Remote Vulnerabilities
BugTraq ID: 11695
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/11695
Summary:
The Linux kernel is reported prone to multiple remote vulnerabilities in the SMBFS network filesystem.

These vulnerabilities may lead to the execution of attacker-supplied machine code, information disclosure of kernel memory, or crashes of the kernel, denying service to legitimate users.

Versions of the kernel in both the 2.4 and the 2.6 series are reported prone to various issues.

20. Linux Kernel Coda_Pioctl Local Buffer Overflow Vulnerability
BugTraq ID: 14967
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/14967
Summary:
Linux kernel is prone to a local buffer-overflow vulnerability.

Specifically, the vulnerability affects the 'coda_pioctl()' function of the 'pioctl.c' file.

A successful attack may result in a denial-of-service condition or arbitrary code execution with superuser privileges.

This issue may be related to the issues described in BID 12239 (Linux Kernel Multiple Unspecified Vulnerabilities).

21. Foing Multiple Remote File Include Vulnerabilities
BugTraq ID: 17963
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/17963
Summary:
Foing is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

22. Geeklog Multiple Input Validation Vulnerabilities
BugTraq ID: 18154
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18154
Summary:
Geeklog is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

Geeklog version 1.4.0sr2 is vulnerable; other versions may also be affected.

23. Blend Portal Blend_common.PHP Remote File Include Vulnerability
BugTraq ID: 18153
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18153
Summary:
Blend Portal is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.2.0; other versions may also be vulnerable.

24. F@cile Interactive Web P-Themes Cross-Site Scripting Vulnerability
BugTraq ID: 18151
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18151
Summary:
F@cile Interactive Web is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect versions 0.8.41 through to 0.8.5; other versions may also be vulnerable.

25. F@cile Interactive Web Multiple Remote File Include Vulnerabilities
BugTraq ID: 18149
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18149
Summary:
F@cile Interactive Web is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Some of these issues may be exploited to include only local files; this will depend on the current site configuration.

These issues affect versions 0.8.41 through to 0.8.5; other versions may also be vulnerable.

26. Photoalbum B&W Index.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 18142
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18142
Summary:
Photoalbum B&W is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Photoalbum B&W version 1.3 is vulnerable to this issue; other versions may also be affected.

27. Linux Kernel DM-Crypt Local Information Disclosure Vulnerability
BugTraq ID: 16301
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16301
Summary:
The Linux kernel 'dm-crypt' module is susceptible to a local information-disclosure vulnerability. This issue is due to the module's failure to properly zero-sensitive memory buffers before freeing the memory.

This issue may allow local attackers to gain access to potentially sensitive memory that contains information on the cryptographic key used for the encrypted storage. This may aid attackers in further attacks.

This issue affects the 2.6 series of the Linux kernel.

28. Linux Kernel Proc dentry_unused Corruption Local Denial of Service Vulnerability
BugTraq ID: 18183
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18183
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a flaw in the 'proc' filesystem.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

This issue affects Linux kernel versions 2.6.15 through 2.6.17-rc5 on multiprocessor computers running SMP kernels. Other kernel versions may also be affected.

29. 4nForum Modules.PHP SQL Injection Vulnerability
BugTraq ID: 18184
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18184
Summary:
4nForum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

30. Linux Kernel Ssockaddr_In.Sin_Zero Kernel Memory Disclosure Vulnerabilities
BugTraq ID: 17203
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17203
Summary:
The Linux kernel is affected by local memory-disclosure vulnerabilities. These issues are due to the kernel's failure to properly clear previously used kernel memory before returning it to local users.

These issues allow an attacker to read kernel memory and potentially gather information to use in further attacks.

31. Gnopaste Common.PHP Remote File Include Vulnerability
BugTraq ID: 18180
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18180
Summary:
The gnopaste tool is prone to a remote file-include vulnerability. As a result, remote users may specify external PHP scripts to be included by the application.

This could result in the execution of arbitrary PHP code in the context of the webserver hosting the application.

32. SCO UnixWare Ptrace Local Privilege Escalation Vulnerability
BugTraq ID: 16765
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16765
Summary:
SCO UnixWare is prone to a local privilege-escalation vulnerability.

This issue allows local attackers to 'ptrace' privileged processes. Attackers may call arbitrary system calls, and then alter the behavior of the traced process, leading to a full system compromise.

SCO UnixWare 7.1.3 and 7.1.4 are vulnerable.

33. Mozilla Firefox Marquee Denial of Service Vulnerability
BugTraq ID: 18165
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18165
Summary:
Mozilla Firefox is prone to a denial-of-service vulnerability when parsing certain HTML content.

Successfully exploiting this issue allows attackers to consume excessive CPU resources in affected browsers, denying service to legitimate users.

Mozilla Firefox version 1.5.0.3 is vulnerable to this issue; other versions and products may also be affected.

34. Multiple Mozilla Products Memory Corruption/Code Injection/Access Restriction Bypass Vulnerabilities
BugTraq ID: 16476
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16476
Summary:
Multiple Mozilla products are prone to multiple vulnerabilities. These issues include various memory-corruption, code-injection, and access-restriction-bypass vulnerabilities. Other undisclosed issues may have also been addressed in the various updated vendor applications.

Successful exploitation of these issues may permit an attacker to execute arbitrary code in the context of the affected application. This may facilitate a compromise of the affected computer; other attacks are also possible.

35. Mozilla Suite, Firefox, SeaMonkey, and Thunderbird Multiple Remote Vulnerabilities
BugTraq ID: 17516
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17516
Summary:
The Mozilla Foundation has released nine security advisories specifying security vulnerabilities in Mozilla Suite, Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- execute arbitrary machine code in the context of the vulnerable application
- crash affected applications
- gain elevated privileges in JavaScript code, potentially allowing remote machine code execution
- gain access to potentially sensitive information
- bypass security checks
- spoof window contents.

Other attacks may also be possible.

The issues described here will be split into individual BIDs as the information embargo on the Mozilla Bugzilla entries is lifted and as further information becomes available. This BID will then be retired.

These issues are fixed in:
- Mozilla Firefox versions 1.0.8 and 1.5.0.2
- Mozilla Thunderbird versions 1.0.8 and 1.5.0.2
- Mozilla Suite version 1.7.13
- Mozilla SeaMonkey version 1.0.1

36. Hitachi Hitsenser3 SQL Injection Vulnerability
BugTraq ID: 18181
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18181
Summary:
HITSENSER3 is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Versions 01-02 through 01-08 are vulnerable to this issue.

37. Etype Eserv Multiple Input Validation Vulnerabilities
BugTraq ID: 18179
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18179
Summary:
Eserv is prone to multiple input-validation vulnerabilities. These issues include directory-traversal and code-disclosure vulnerabilities.

An attacker can exploit these issues to read other users' email messages, create and rename directories, delete arbitrary empty directories, and access the source code of arbitrary script files.

These issues affect version 3.25; other versions may also be vulnerable.

38. Microsoft Internet Explorer Malformed HTML Parsing Denial of Service Vulnerability
BugTraq ID: 18112
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18112
Summary:
Microsoft Internet Explorer is affected by a denial-of-service vulnerability. This issue arises because the application fails to handle exceptional conditions in a proper manner.

An attacker may exploit this issue by enticing a user to visit a malicious site, resulting in a denial-of-service condition in the application.

This issue results in a NULL-pointer dereference, causing the application to crash. If attackers can manipulate the pointer being dereferenced, code execution may be possible. Note that this has not been confirmed.

Since exploiting this issue requires only standard HTML, it may not be easily mitigated.

Internet Explorer 6 is vulnerable to this issue; other versions may also be affected. This issue will reportedly crash Microsoft Outlook as well.

39. Linux Kernel Multiple SCTP Remote Denial of Service Vulnerabilities
BugTraq ID: 17955
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17955
Summary:
The Linux kernel SCTP module is susceptible to remote denial-of-service vulnerabilities. These issues are triggered when the kernel handles unexpected SCTP packets.

These issues allow remote attackers to trigger kernel deadlock and infinite recursion, denying further service to legitimate users.

The Linux kernel version 2.6.16 is vulnerable to these issues; prior versions may also be affected.

40. ToendaCMS Index.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 18178
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18178
Summary:
ToendaCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

41. BMV PostScript File Handling Integer Overflow Vulnerability
BugTraq ID: 15153
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/15153
Summary:
BMV is prone to an integer-overflow vulnerability.

This issue arises when the application handles a malformed PostScript file.

A successful attack may result in arbitrary code execution leading to unauthorized access. Reports indicate that on some distributions, BMV is installed setuid root by default. This may allow an attacker to gain superuser privileges by exploiting this issue.

42. Linux Kernel Multiple SCTP Remote Denial of Service Vulnerabilities
BugTraq ID: 17910
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17910
Summary:
The Linux kernel SCTP module is susceptible to remote denial-of-service vulnerabilities. These issues are triggered when the kernel handles unexpected SCTP packets.

These issues allow remote attackers to trigger kernel panics, denying further service to legitimate users.

Note that a valid SCTP endpoint must be listening.

The Linux kernel version 2.6.16 is vulnerable to these issues; prior versions may also be affected.

43. ZipCentral ZIP File Buffer Overflow Vulnerability
BugTraq ID: 18160
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18160
Summary:
ZipCentral is susceptible to a buffer-overflow vulnerability. The application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

This issue allows attackers to execute arbitrary machine code in the context of users running the affected application.

Version 4.01 of ZipCentral is vulnerable to this issue; prior versions may also be affected.

44. Linux Kernel SMBFS CHRoot Security Restriction Bypass Vulnerability
BugTraq ID: 17735
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17735
Summary:
The Linux Kernel is prone to a vulnerability that allows attackers to bypass a security restriction. This issue is due to a failure in the kernel to properly sanitize user-supplied data.

The problem affects chroot inside of an SMB-mounted filesystem ('smbfs'). A local attacker who is bounded by the chroot can exploit this issue to bypass the chroot restriction and gain unauthorized access to the filesystem.

45. Vixie Cron PAM_Limits Local Privilege Escalation Vulnerability
BugTraq ID: 18108
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18108
Summary:
Vixie cron is susceptible to a local privilege-escalation vulnerability. This issue is due to the application's failure to properly drop superuser privileges in certain circumstances when executing jobs.

This issue allows local attackers that have been authorized to execute cron jobs to execute arbitrary commands with superuser privileges. This facilitates the complete compromise of affected computers.

Vixie cron version 4.1 is vulnerable to this issue when used in conjunction with pam_limits. Other versions may also be affected.

46. Linux Kernel CIFS CHRoot Security Restriction Bypass Vulnerability
BugTraq ID: 17742
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17742
Summary:
The Linux Kernel is prone to a vulnerability that allows attackers to bypass a security restriction. This issue is due to a failure in the kernel to properly sanitize user-supplied data.

The problem affects chroot inside of an SMB-mounted filesystem ('cifs'). A local attacker who is bounded by the chroot can exploit this issue to bypass the chroot restriction and gain unauthorized access to the filesystem.

47. Linux Kernel SCTP-netfilter Remote Denial of Service Vulnerability
BugTraq ID: 17806
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17806
Summary:
The Linux kernel netfilter module is susceptible to a remote denial-of-service vulnerability.

This issue is triggered when excessive kernel memory is consumed in an infinite loop. This problem stems from a memory leak in the kernel's 'SCTP-netfilter' code.

This issue allows remote attackers to consume excessive kernel memory, eventually leading to an out-of-memory condition and ultimately to a denial of service for legitimate users.

Kernel versions prior to 2.6.16.13 are vulnerable to this issue.

48. Linux Kernel IP_ROUTE_INPUT Local Denial of Service Vulnerability
BugTraq ID: 17593
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17593
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a design error in the 'ip_route_input()' function.

This vulnerability allows local users to panic the kernel, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.6.16.8.

49. Linux Kernel Shared Memory Security Restriction Bypass Vulnerability
BugTraq ID: 17587
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17587
Summary:
The Linux kernel is prone to a vulnerability regarding access to shared memory.

A local attacker could potentially gain read and write access to shared memory and write access to read-only tmpfs filesystems, bypassing security restrictions.

An attacker can exploit this issue to possibly corrupt applications and their data when the applications use temporary files or shared memory.

50. Linux Kernel RCU signal handling __group_complete_signal Function Unspecified Vulnerability
BugTraq ID: 17640
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17640
Summary:
Linux Kernel is prone to a local unspecified vulnerability.

This issue exists in the '__group_complete_signal' function of the RCU signal-handling facility.

Due to a lack of details, further information cannot be provided at the moment. This BID will be updated when more details are available.

51. Multiple Vendor AMD CPU Local FPU Information Disclosure Vulnerability
BugTraq ID: 17600
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17600
Summary:
Multiple vendors' operating systems are prone to a local information-disclosure vulnerability. This issue is due to a flaw in the operating systems that fail to properly use AMD CPUs.

Local attackers may exploit this vulnerability to gain access to potentially sensitive information regarding other processes executing on affected computers. This may aid attackers in retrieving information regarding cryptographic keys or other sensitive information.

This issue affects Linux and FreeBSD operating systems that use generations 7 and 8 AMD CPUs.

52. Linux Kernel IP ID Information Disclosure Weakness
BugTraq ID: 17109
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17109
Summary:
The Linux kernel is susceptible to a remote information-disclosure weakness. This issue is due to an implementation flaw of a zero 'ip_id' information-disclosure countermeasure.

This issue allows remote attackers to use affected computers in stealth network port and trust scans.

The Linux kernel 2.6 series, as well as some kernels in the 2.4 series, are affected by this weakness.

53. Linux Kernel SYSFS PAGE_SIZE Local Denial of Service Vulnerability
BugTraq ID: 17402
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17402
Summary:
Linux kernel is susceptible to a local denial-of-service vulnerability.

This issue arises in SYSFS and allows local attackers to crash the kernel, denying service to legitimate users.

Kernel versions 2.6.12 to versions prior to 2.6.17-rc1 are affected.

54. Linux Kernel Intel EM64T SYSRET Local Denial of Service Vulnerability
BugTraq ID: 17541
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17541
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue arises in Intel EM64T CPUs when returning program control using SYSRET.

This vulnerability allows local users to crash the kernel, denying further service to legitimate users.

55. Linux Kernel ICMP_Send Remote Denial Of Service Vulnerability
BugTraq ID: 16532
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16532
Summary:
Linux kernel is prone to a remote denial-of-service vulnerability.

Remote attackers can exploit this vulnerability to crash affected kernels, effectively denying service to legitimate users.

Linux kernel versions 2.6.15.2 and prior in the 2.6 series are vulnerable to this issue.

56. Linux Kernel die_if_kernel Local Denial of Service Vulnerability
BugTraq ID: 16993
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16993
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a design error in the 'die_if_kernel()' function.

This vulnerability allows local users to panic the kernel, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.6.15.6 running on Itanium systems.

57. Linux Kernel ELF File Entry Point Denial of Service Vulnerability
BugTraq ID: 16925
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16925
Summary:
Linux kernel is prone to a denial-of-service vulnerability when processing a malformed ELF file. This issue occurs only on Intel EM64T processors.

Linux kernel versions prior to 2.6.15.5 are affected by this issue.

58. KTools Remote Buffer Overflow Vulnerability
BugTraq ID: 15600
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/15600
Summary:
The ktools library is prone to a remote buffer-overflow vulnerability.

An attacker may execute arbitrary code with the privileges of the application and gain unauthorized remote access.

Version 0.3 (and prior) of ktools is vulnerable to this issue.

59. Linux Kernel sys_mbind System Call Local Denial of Service Vulnerability
BugTraq ID: 16924
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16924
Summary:
The Linux kernel 'sys_mbind' system call is prone to a local denial-of-service vulnerability. This issue is due to a lack of proper input sanitization in the system call's arguments.

This issue allows local users to panic the kernel, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.6.15.5.

60. Linux Kernel NFS Client Denial of Service Vulnerability
BugTraq ID: 16922
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16922
Summary:
Linux kernel NFS client is prone to a denial-of-service vulnerability. An unprivileged local user can panic the NFS client and cause it to fail.

This issue was addressed in Linux kernel 2.6.15.5; earlier versions are vulnerable.

61. GNU Mailman Large Date Data Denial Of Service Vulnerability
BugTraq ID: 16248
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16248
Summary:
GNU Mailman is prone to a denial-of-service attack. This issue affects Mailman's email date parsing.

The vulnerability could be triggered by mailing-list posts and will impact the availability of mailing lists hosted by the application.

62. GNU Mailman Attachment Scrubber UTF8 Filename Denial Of Service Vulnerability
BugTraq ID: 15408
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/15408
Summary:
GNU Mailman is prone to denial-of-service attacks. This issue affects the attachment-scrubber utility.

The vulnerability could be triggered by mailing-list posts and will impact the availability of mailing lists hosted by the application.

63. Microsoft Word Unspecified Remote Code Execution Vulnerability
BugTraq ID: 18037
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18037
Summary:
Microsoft Word is prone to an unspecified remote code-execution vulnerability.

Reports indicate that this issue can allow remote attackers to execute arbitrary code on a vulnerable computer by supplying a malicious Word document to a user. This issue is being actively exploited in the wild to place a backdoor named Backdoor.Ginwui on targeted computers through a trojan named Trojan.Mdropper.H.

Due to a lack of details, further information is not available at the moment. This BID will be updated as more details become available.

64. Kaspersky Anti-Virus Unspecified Denial Of Service Vulnerability
BugTraq ID: 16942
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16942
Summary:
Kaspersky Anti-Virus is prone to a denial-of-service vulnerability. This is due to a failure in the application to handle unspecified files.

Attackers could cause the application to consume excessive CPU and memory resources, resulting in a denial of service.

Versions 5.0.5 and 5.5.3 of Kaspersky Anti-Virus for UNIX are vulnerable to this issue; other versions and platforms may also be affected.

Further details about this vulnerability are currently unavailable. This BID will be updated as more information is disclosed.

Note that the vendor cannot reproduce this issue.

65. Cyrus SASL Remote Digest-MD5 Denial of Service Vulnerability
BugTraq ID: 17446
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17446
Summary:
Cyrus SASL is affected by a remote denial-of-service vulnerability. This issue occurs before successful authentication, allowing anonymous remote attackers to trigger it.

This vulnerability allows remote attackers to crash services using the affected SASL library, denying service to legitimate users.

This issue reportedly affects version 2.1.18 of Cyrus SASL; other versions may also be affected.

66. Linux Kernel MREMAP Local Privilege Escalation Vulnerability
BugTraq ID: 18177
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18177
Summary:
The Linux kernel is susceptible to a local privilege-escalation vulnerability. This issue occurs due to an unspecified flaw in 'mremap'.

This issue allows local attackers to gain superuser privileges, facilitating the complete compromise of affected computers.

Linux kernel versions prior to 2.4.25 are vulnerable to this issue.

67. Linux Kernel MIPS Ptrace Local Privilege Escalation Vulnerability
BugTraq ID: 18176
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18176
Summary:
The Linux kernel is susceptible to a local privilege-escalation vulnerability. This issue occurs only on MIPS architectures.

This issue allows local attackers to gain superuser privileges, facilitating the complete compromise of affected computers.

Specific information regarding affected versions is not currently available; this BID will be updated as further information is disclosed.

68. Linux Kernel ELF Loader Mismatched Architecture Local Denial of Service Vulnerability
BugTraq ID: 18174
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18174
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a flaw in the ELF object file loader.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.4.25.

69. UBBThreads Index.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 18152
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18152
Summary:
UBBThreads is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

70. PHP Multiple Safe_Mode and Open_Basedir Restriction Bypass Vulnerabilities
BugTraq ID: 17439
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17439
Summary:
PHP is prone to multiple 'safe_mode' and 'open_basedir' restriction-bypass vulnerabilities. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

These vulnerabilities would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code, when the 'safe_mode' and 'open_basedir' restrictions are expected to isolate the users from each other.

These issues are reported to affect PHP versions 4.4.2 and 5.1.2; other versions may also be vulnerable.

71. Linux Kernel Invalid Proc Memory Access Local Denial of Service Vulnerability
BugTraq ID: 18173
Remote: No
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18173
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a flaw in the 'proc' filesystem.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.4.27.

72. PHP PHPInfo Large Input Cross-Site Scripting Vulnerability
BugTraq ID: 17362
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/17362
Summary:
PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

73. LibTIFF TIFFFetchShortPair Null Pointer Dereference Denial of Service Vulnerability
BugTraq ID: 18172
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18172
Summary:
The LibTIFF library is prone to a denial-of-service vulnerability. The library fails to handle exceptional conditions.

Successful exploits of this vulnerability will cause the application using the affected library to crash, effectively denying service to legitimate users.

Version 3.8.0 and prior are considered vulnerable to this issue.

74. Achievo Class.employee.inc SQL Injection Vulnerability
BugTraq ID: 18171
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18171
Summary:
Achievo is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

To successfully exploit this vulnerability, an attacker must have access to the 'Employee Administration' page.

Versions 1.1.0 and 1.2 are vulnerable; other versions may also be affected.

75. OABoard Forum Script Remote File Include Vulnerability
BugTraq ID: 16105
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/16105
Summary:
The oaBoard application is prone to a remote file-include vulnerability. As a result, remote users may specify external PHP scripts to be included by the application.

This could result in the execution of arbitrary PHP code in the context of the webserver hosting the application.

76. Speedy Asp Discussion Forum Authentication Bypass Vulnerability
BugTraq ID: 18170
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18170
Summary:
Speedy Asp Discussion Forum is prone to an authentication-bypass vulnerability. The issue occurs because the affected script fails to require proper authentication credentials.

An attacker can exploit this issue to bypass authentication, potentially allowing the attacker to gain administrative access to the web application. This could aid in further attacks on the affected computer.

77. D-Link Airspot DSA-3100 Gateway Login_error.SHTML Cross-Site Scripting Vulnerability
BugTraq ID: 18168
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18168
Summary:
The D-Link Airspot DSA-3100 Gateway device is prone to a cross-site scripting vulnerability. This issue is due to a failure to properly sanitize user-supplied input.

78. Open Searchable Image Catalogue Multiple Input Validation Vulnerabilities
BugTraq ID: 18169
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18169
Summary:
Open Searchable Image Catalogue is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Open Searchable Image Catalogue versions 0.7 and earlier are vulnerable to these issues.

79. LinuxPrinting.org Foomatic-Filter Command Execution Vulnerability
BugTraq ID: 11184
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/11184
Summary:
Reportedly, the LinuxPrinting.org Foomatic-Filter is affected by an arbitrary command-execution vulnerability. Although unconfirmed, this issue is likely due to the affected script's failure to properly validate input when issuing shell commands.

An attacker may exploit this issue to execute arbitrary commands as the printer user on a computer running the vulnerable software.

80. PPPBlog Randompic.PHP Directory Traversal Vulnerability
BugTraq ID: 18189
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18189
Summary:
pppBlog is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

81. PHP-Nuke Multiple Remote File Include Vulnerabilities
BugTraq ID: 18186
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18186
Summary:
PHP-Nuke is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

82. PHPMyDesktop|arcade Index.PHP Local File Include Vulnerability
BugTraq ID: 18185
Remote: Yes
Last Updated: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18185
Summary:
phpMyDesktop|arcade is prone to a local file-include vulnerability. This may allow unauthorized users to view files and to execute local scripts.

An attacker may also be able to execute arbitrary code by way of uploaded images.

83. Dia Multiple Unspecified Remote Format String Vulnerabilities
BugTraq ID: 18166
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18166
Summary:
Dia is prone to multiple unspecified format-string vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input before including it in the format-specifier argument of formatted-printing functions.

A successful attack may crash the application or lead to arbitrary code execution.

Specific information regarding affected versions of Dia is not currently available; this BID will be updated as further information is disclosed.

84. QJForum Member.ASP SQL Injection Vulnerability
BugTraq ID: 18164
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18164
Summary:
qjForum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

85. LibTiff Double Free Memory Corruption Vulnerability
BugTraq ID: 17733
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/17733
Summary:
Applications using the LibTIFF library are prone to a double-free vulnerability; a fix is available.

Attackers may be able to exploit this issue to cause denial-of-service conditions in affected applications using a vulnerable version of the library; arbitrary code execution may also be possible.

86. LibTiff Multiple Denial of Service Vulnerabilities
BugTraq ID: 17730
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/17730
Summary:
LibTIFF is affected by multiple denial-of-service vulnerabilities.

An attacker can exploit these vulnerabilities to cause a denial of service in applications using the affected library.

87. LibTiff TIFFFetchData Integer Overflow Vulnerability
BugTraq ID: 17732
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/17732
Summary:
Applications using the LibTIFF library are prone to an integer-overflow vulnerability.

An attacker could exploit this vulnerability to execute arbitrary code in the context of the vulnerable application that uses the affected library. Failed exploit attempts will likely cause denial-of-service conditions.

88. Nivisec Hacks List Admin_hacks_list.PHP Information Disclosure Vulnerability
BugTraq ID: 18162
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18162
Summary:
Nivisec Hacks List is prone to an information-disclosure vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve the contents of arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

Nivisec Hacks List versions 1.2 and prior are vulnerable; other versions may be affected.

89. Multiple Mozilla Products IFRAME JavaScript Execution Vulnerability
BugTraq ID: 16770
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/16770
Summary:
Multiple Mozilla products are prone to a script-execution vulnerability.

The vulnerability presents itself when an attacker supplies a specially crafted email to a user containing malicious script code in an IFRAME and the user tries to reply to the mail. Arbitrary JavaScript can be executed even if the user has disabled JavaScript execution in the client.

The following mozilla products are vulnerable to this issue:
- Mozilla Thunderbird, versions prior to 1.5.0.2, and prior to 1.0.8
- Mozilla SeaMonkey, versions prior to 1.0.1
- Mozilla Suite, versions prior to 1.7.13

90. Fastpublish CMS Multiple Remote File Include Vulnerabilities
BugTraq ID: 18163
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18163
Summary:
Fastpublish CMS is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

These issues affect version 1.6.9.d; other versions may also be vulnerable.

91. EVA-Web Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 18161
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18161
Summary:
EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These vulnerabilities are reported to affect versions 2.1.2 and earlier.

92. CherryPy StaticFilter Directory Traversal Vulnerability
BugTraq ID: 16760
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/16760
Summary:
CherryPy is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

Versions prior to 2.1.1 are vulnerable.

93. Multiple Vendor UNACEV2 Archive File Name Buffer Overflow Vulnerability
BugTraq ID: 14759
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/14759
Summary:
Multiple products are prone to a buffer overflow when handling ACE archives that contain files with overly long names.

This may be exploited to execute arbitrary code in the context of the user who is running the application. The vulnerability is considered remotely exploitable in nature because malicious ACE archives will likely originate from an external, untrusted source.

94. PHPBB-Amod Lang_Activity.PHP Remote File Include Vulnerability
BugTraq ID: 18155
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18155
Summary:
phpBB-Amod is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

This issue affects version 2.0; other versions may also be vulnerable.

95. Nukedit Register.ASP Unauthorized Access Vulnerability
BugTraq ID: 18157
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18157
Summary:
The nukedit application is prone to an unauthorized-access vulnerability. This issue is due to a failure in the application to properly validate credentials before granting access to sensitive scripts.

An attacker can exploit this issue to create an administrative account, ultimately gaining administrative access.

This issue affects version 4.9.6; earlier versions may also be vulnerable.

96. Linux kernel Uselib() Local Privilege Escalation Vulnerability
BugTraq ID: 12190
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/12190
Summary:
Linux kernel is reported prone to a local privilege-escalation vulnerability. This issue arises in the 'uselib()' functions of the Linux binary-format loader as a result of a race condition. Successful exploitation of this vulnerability can allow a local attacker to gain elevated privileges on a vulnerable computer.

The ELF and a.out loaders are reportedly affected by this vulnerability.

97. Linux Kernel Unw_Unwind_To_User Local Denial of Service Vulnerability
BugTraq ID: 13266
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/13266
Summary:
A local denial-of-service vulnerability affects the Linux kernel.

A local attacker may leverage this issue to cause an affected Linux kernel to panic, effectively denying service to legitimate users.

98. WikiNi Multiple HTML Injection Vulnerabilities
BugTraq ID: 18156
Remote: Yes
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18156
Summary:
WikiNi is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

These issues are reported to affect version 0.4.2 and earlier.

99. Linux Kernel Symmetrical Multiprocessing Page Fault Local Privilege Escalation Vulnerability
BugTraq ID: 12244
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/12244
Summary:
A local privilege-escalation vulnerability affects the page-fault handler of the Linux Kernel on symmetric multiprocessor (SMP) computers. This issue is due to a race-condition error that may allow an attacker to gain superuser privileges.

A malicious local attacker may exploit this issue to gain superuser privileges on an affected computer.

100. Linux Kernel User Triggerable BUG() Unspecified Local Denial of Service Vulnerability
BugTraq ID: 12261
Remote: No
Last Updated: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/12261
Summary:
Linux Kernel is reported prone to a local denial-of-service vulnerability.

Reportedly, this issue presents itself when a user creates a large Virtual Memory Area (VMA) that overlaps with arg pages during the exec() system call.

Successful exploitation will lead to a denial-of-service condition in a vulnerable computer.

No further details are available at this time. This issue will be updated as more information becomes available.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Veterans Affairs warns of massive privacy breach
By: Robert Lemos
The records of nearly 26.5 million veterans--including names, social security numbers and dates of birth--were stolen from the home of a federal employee.
http://www.securityfocus.com/news/11393

2. Blue Security folds under spammer's wrath
By: Robert Lemos
Under threat of further attacks on its service and users, an Israeli anti-spam startup decides to shutter its service.

http://www.securityfocus.com/news/11392

3. Diebold voting systems critically flawed
By: Robert Lemos
Concerns raised by a rural county in Utah helped an electronic voting watchdog discover a critical vulnerability in Diebold Election Systems' touchscreen terminal--a flaw that state election officials and security experts warn could pose a risk to elections.
http://www.securityfocus.com/news/11391

4. Bot software looks to improve peerage
By: Robert Lemos
Threatened by investigators' ability to tap into chat-based command-and-control networks, bot masters increasingly look to peer-to-peer communications, encryption and other technologies to hide their tracks.
http://www.securityfocus.com/news/11390

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Manager, Information Security, Chicago
http://www.securityfocus.com/archive/77/435433

2. [SJ-JOB] Security Auditor, Chicago
http://www.securityfocus.com/archive/77/435434

3. [SJ-JOB] Security Engineer, Richardson
http://www.securityfocus.com/archive/77/435435

4. [SJ-JOB] Database Security Engineer, Raleigh
http://www.securityfocus.com/archive/77/435428

5. [SJ-JOB] Information Assurance Engineer, Arlington
http://www.securityfocus.com/archive/77/435429

6. [SJ-JOB] Technical Support Engineer, Atlanta
http://www.securityfocus.com/archive/77/435430

7. [SJ-JOB] Security Engineer, Bethesda
http://www.securityfocus.com/archive/77/435432

8. [SJ-JOB] Technology Risk Consultant, Eastern Iowa
http://www.securityfocus.com/archive/77/435355

9. [SJ-JOB] Security Consultant, Bangalore
http://www.securityfocus.com/archive/77/435356

10. [SJ-JOB] Management, Calgary
http://www.securityfocus.com/archive/77/435359

11. [SJ-JOB] Sr. Security Analyst, Eastern Iowa
http://www.securityfocus.com/archive/77/435360

12. [SJ-JOB] Sr. Security Analyst, Silver Spring
http://www.securityfocus.com/archive/77/435353

13. [SJ-JOB] Sr. Security Analyst, London
http://www.securityfocus.com/archive/77/435354

14. [SJ-JOB] Application Security Engineer, Portsmouth
http://www.securityfocus.com/archive/77/435322

15. [SJ-JOB] Technical Support Engineer, Cupertino
http://www.securityfocus.com/archive/77/435318

16. [SJ-JOB] Channel / Business Development, London
http://www.securityfocus.com/archive/77/435319

17. [SJ-JOB] Sales Engineer, London
http://www.securityfocus.com/archive/77/435320

18. [SJ-JOB] Manager, Information Security, London
http://www.securityfocus.com/archive/77/435321

19. [SJ-JOB] Quality Assurance, Cupertino
http://www.securityfocus.com/archive/77/435317

20. [SJ-JOB] Security Engineer, Parsippany
http://www.securityfocus.com/archive/77/435259

21. [SJ-JOB] Sr. Security Engineer, Parsippany
http://www.securityfocus.com/archive/77/435260

22. [SJ-JOB] Jr. Security Analyst, Bay Area
http://www.securityfocus.com/archive/77/435261

23. [SJ-JOB] Security Engineer, Chicago
http://www.securityfocus.com/archive/77/435262

24. [SJ-JOB] Sales Engineer, Mountain View
http://www.securityfocus.com/archive/77/435255

25. [SJ-JOB] Sales Representative, anywhere
http://www.securityfocus.com/archive/77/435256

26. [SJ-JOB] Sr. Security Analyst, Glendale (Los Angeles)
http://www.securityfocus.com/archive/77/435257

27. [SJ-JOB] Manager, Information Security, Washington
http://www.securityfocus.com/archive/77/435251

28. [SJ-JOB] Penetration Engineer, Parsippany
http://www.securityfocus.com/archive/77/435252

29. [SJ-JOB] Sales Representative, Chicago
http://www.securityfocus.com/archive/77/435026

30. [SJ-JOB] Security Consultant, Work Remotely or Charlotte, NC
http://www.securityfocus.com/archive/77/435027

31. [SJ-JOB] Jr. Security Analyst, Atlanta
http://www.securityfocus.com/archive/77/435028

V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. heap overflow foreward consolidation
http://www.securityfocus.com/archive/82/435303

2. argc issue
http://www.securityfocus.com/archive/82/434998

3. Finding Function in IAT tables
http://www.securityfocus.com/archive/82/434997

VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. New SecurityFocus mailing list: Focus-Apple
http://www.securityfocus.com/archive/88/435437

2. Restricting Remote Registry Access
http://www.securityfocus.com/archive/88/433671

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This issue is sponsored by: SPI Dynamics

https://download.spidynamics.com/1/ad/web.asp?cs1_ContSupRef=70130000000CRxF