SecurityFocus Newsletter #396
[email protected] 10 Apr 2007 23:36:04 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #396
----------------------------------------
This Issue is Sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!=
"- White Paper=20
Blind SQL Injection can deliver total control of your server to a hacker =
giving them the ability to read, write and=20
manipulate all data stored in your backend systems! Download this *FREE* =
white paper from SPI Dynamics for a=20
complete guide to protection!=20
https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=3D70160000000Cl=
cR
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1. Metasploit 3.0 day
2. Blanket Discovery for Stolen Laptops
II. BUGTRAQ SUMMARY
1. Hewlet Packard HP-UX Portable File System Unspecified Privilege=
Escalation Vulnerability
2. LibWPD Library Multiple Buffer Overflow Vulnerabilities
3. Kaspersky AntiVirus SysInfo ActiveX Control Arbitrary File Exfi=
ltration Vulnerability
4. Kaspersky Antivirus Engine ARJ Archive Remote Heap Overflow Vul=
nerability
5. Kaspersky AntiVirus Prod60 ActiveX Control Arbitrary File Exfil=
tration Vulnerability
6. Xoops Jobs Module Index.PHP SQL Injection Vulnerability
7. XOOPS WF-Link Module Viewcat.PHP SQL Injection Vulnerability
8. Microsoft April 2007 Advance Notification Multiple Vulnerabilit=
ies
9. Sisplet CMS Komentar.PHP Remote File Include Vulnerability
10. Lite-CMS Index.PHP Local File Include Vulnerability
11. CodeWand PHPBrowse Include_Stream.Inc.PHP Remote File Include =
Vulnerability
12. PHP-Generics _App_Relative_Path Multiple Remote File Include V=
ulnerabilities
13. Kaspersky Internet Security Suite Klif.SYS Driver Local Heap O=
verflow Vulnerability
14. Centrino Intel PRO/Wireless Network Connection Drivers Remote =
Code Execution Vulnerability
15. LedgerSMB Unspecified SQL Injection Vulnerabilities
16. XOOPS Multiple Modules ViewCat.PHP SQL Injection Vulnerabiliti=
es
17. Linux Kernel IPV6_Getsockopt_Sticky Memory Leak Information Di=
sclosure Vulnerability
18. XMMS Skins Integer Overflow And Underflow Vulnerabilities
19. Linux Kernel Omnikey CardMan 4040 Driver Local Buffer Overflow=
Vulnerability
20. VMware Unspecified Buffer Overflow Vulnerability
21. Zlib Compression Library gzprintf() Buffer Overrun Vulnerabili=
ty
22. Zlib Compression Library Decompression Buffer Overflow Vulnera=
bility
23. XOOPS Rha7 Downloads Module Visit.PHP SQL Injection Vulnerabil=
ity
24. GNU Texinfo Insecure Temporary File Creation Vulnerability
25. PHPBB Mutant Mutant_Functions.PHP Remote File Include Vulnerab=
ility
26. IrfanView Multiple BMP Denial of Service Vulnerabilities
27. Microsoft Windows UPnP Remote Stack Buffer Overflow Vulnerabil=
ity
28. Windows VDM Zero Page Race Condition Local Privilege Escalatio=
n Vulnerability
29. Microsoft Agent URI Processing Remote Code Execution Vulnerabi=
lity
30. Microsoft Windows CSRSS CSRFinalizeContext Local Privilege Esc=
alation Vulnerability
31. Microsoft Windows CSRSS HardError Messages Denial of Service V=
ulnerability
32. Microsoft Windows CSRSS MSGBox Remote Code Execution Vulnerabi=
lity
33. MIT Kerberos 5 KAdminD Server Stack Buffer Overflow Vulnerabil=
ity
34. MIT Kerberos Administration Daemon Kadmind Double Free Memory =
Corruption Vulnerabilities
35. MIT Kerberos 5 Telnet Daemon Authentication Bypass Vulnerabili=
ty
36. OpenOffice Meta Character Remote Shell Command Execution Vulne=
rability
37. Microsoft Internet Explorer Script Error Handling Remote Code =
Execution Vulnerability
38. Microsoft Content Management Server Remote Code Execution Vuln=
erability
39. Microsoft Content Management Server Cross-Site Scripting Vulne=
rability
40. Microsoft Windows Cursor And Icon ANI Format Handling Remote B=
uffer Overflow Vulnerability
41. HIOX Free Guest Book Index.PHP HTML Injection Vulnerability
42. Apple AirPort Extreme Base Station Firmware Information Disclo=
sure Vulnerability
43. IPSec-Tools Remote Denial Of Service Vulnerability
44. PHP121 Instant Messenger php121db.PHP Local File Include Vulne=
rability
45. OpenSSH Duplicated Block Remote Denial of Service Vulnerabilit=
y
46. CattaDoc Arbitrary Files Information Disclosure Vulnerability
47. Xrousse Beryo Downloadpic.PHP Arbitrary File Download Vulnerab=
ility
48. Linux Kernel DCCP Proto.C Buffer Overflow Vulnerability
49. Battle.net Clan Script Login.PHP SQL Injection Vulnerability
50. Einfacher Passworschutz Index.PHP Cross-Site Scripting Vulnera=
bility
51. Microsoft Windows Help File Unspecified Heap Overflow Vulnerab=
ility
52. Portable OpenSSH GSSAPI Remote Code Execution Vulnerability
53. IPIX Image Well ActiveX Controls Multiple Buffer Overflow Vuln=
erabilities
54. eCardMAX HotEditor Keyboard.PHP Local File Include Vulnerabili=
ty
55. Linux Kernel AppleTalk ATalk_Sum_SKB Function Denial Of Servic=
e Vulnerability
56. Pathos Warn.PHP Remote File Include Vulnerability
57. AOL AIM and ICQ Clients Directory Traversal Vulnerability
58. JustSystem Ichitaro Unspecified Remote Code Execution Vulnerab=
ility
59. DeskPro Login.PHP HTML Injection Vulnerability
60. Microsoft Word 2007 WWLib.DLL Unspecified Document File Buffer=
Overflow Vulnerability
61. Yahoo! Messenger Audio Conferencing ActiveX Control Remote Buf=
fer Overflow Vulnerability
62. Microsoft Windows GDI Invalid Window Size Local Privilege Esca=
lation Vulnerability
63. IrfanView Cursor And Icon ANI Format Handling Remote Buffer Ov=
erflow Vulnerability
64. Microsoft Windows Graphics Rendering Engine GDI Local Privileg=
e Escalation Vulnerability
65. Microsoft Windows Graphics Device Interface Font Rasterizer Lo=
cal Privilege Escalation Vulnerability
66. Microsoft Windows Graphics Rendering Engine EMF File Privilege=
Escalation Vulnerability
67. ScarNews Scarnews.Inc.PHP Local File Include Vulnerability
68. SignKorea SKCrypAX ActiveX Control Multiple Buffer Overflow Vu=
lnerabilities
69. Microsoft Windows GDI WMF Remote Denial of Service Vulnerabili=
ty
70. Microsoft Windows Explorer ANI File Denial of Service Vulnerab=
ility
71. ArchiveXpert Multiple Directory Traversal Vulnerabilities
72. Requestit Index.PHP Remote File Include Vulnerability
73. UBB.Threads UBBThreads.PHP SQL Injection Vulnerability
74. QuizShock Auth.PHP HTML Injection Vulnerability
75. DirectAdmin Multiple Cross-Site Scripting Vulnerabilities
76. EBoard Member.PHP Local File Include Vulnerability
77. phpGalleryScript Init.Gallery.PHP Remote File Include Vulnerab=
ility
78. MyNews Week_Events.PHP Remote File Include Vulnerability
79. SmodCMS Dictionary.PHP SQL Injection Vulnerability
80. Youngzsoft CMailServer Comment Parameter Cross-Site Scripting =
Vulnerability
81. Microsoft Windows GDI Kernel Local Privilege Escalation Vulner=
ability
82. CompreXX Multiple Directory Traversal Vulnerabilities
83. Intervations FileCopa Unspecified Remote Stack Buffer Overflow=
Vulnerability
84. X.Org LibXFont Multiple Integer Overflow Vulnerabilities
85. Youngzsoft CMailServer Signup.ASP Cross-Site Scripting Vulnera=
bility
86. PHP Filter_Var FILTER_VALIDATE_EMAIL Newline Injection Vulnera=
bility
87. WitShare Index.PHP Local File Include Vulnerability
88. Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
89. PHP GD Extension WBMP File Integer Overflow Vulnerabilities
90. GNU GV Stack Buffer Overflow Vulnerability
91. SmodBIP Index.PHP SQL Injection Vulnerability
92. Man Command -H Flag Local Buffer Overflow Vulnerability
93. Nuke ET User Account Deletion Input Validation Vulnerability
94. Livor Index.PHP Cross-Site Scripting Vulnerability
95. SQL-Ledger/LedgerSMB Insecure User Access Restriction Vulnerab=
ility
96. Winamp LibSNDFile.DLL Component Remote Code Execution Vulnerab=
ility
97. Winamp IN_Mod.DLL Plugin Remote Code Execution Vulnerability
98. Firebug Rep.JS Script Code Injection Vulnerability
99. WebSpell Picture.PHP Multiple Local File Include Vulnerabiliti=
es
100. ImageMagick DCM XWD Formats Multiple Integer Overflow Vulnera=
bilities
III. SECURITYFOCUS NEWS
1. Developers warned to secure AJAX design
2. TJX theft tops 45.6 million card numbers
3. Groups team to test secure-coding skill
4. Oracle sues rival for hacking, data theft
IV. SECURITY JOBS LIST SUMMARY
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
VII. MICROSOFT FOCUS LIST SUMMARY
1. [Fwd: Finding License Codes for Re-install]
2. Running commands on workstations from domain controller
3. blocking thru IE
4. SecurityFocus Microsoft Newsletter #336
5. Discovering Active Direcory users with blank passwords
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. Metasploit 3.0 day
By Federico Biancuzzi
The Metasploit Framework is a development platform for creating security =
tools and exploits. Federico Biancuzzi interviewed H D Moore to discuss w=
hat's new in release 3.0, the new license of the framework, plans for fea=
tures and exploits development, and the links among the bad guys and Meta=
sploit and the law.
http://www.securityfocus.com/columnists/439
2. Blanket Discovery for Stolen Laptops
By Mark Rasch
Mark Rasch discusses the legal issues behind the discovery and recovery o=
f stolen laptops that use LoJack-style homing devices to announce their l=
ocation, and the location of the thieves, anywhere in the world.
http://www.securityfocus.com/columnists/438
II. BUGTRAQ SUMMARY
--------------------
1. Hewlet Packard HP-UX Portable File System Unspecified Privilege Escala=
tion Vulnerability
BugTraq ID: 23401
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23401
Summary:
HP-UX running PFS (Portable File System) is prone to an unspecified privi=
lege-escalation vulnerability.
Remote attackers can exploit this issue to gain elevated privileges on af=
fected computers.
2. LibWPD Library Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 23006
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23006
Summary:
The libwpd library is prone to multiple buffer-overflow vulnerabilities b=
ecause it fails to adequately check boundaries on user-supplied input.
A successful exploit could let a remote attacker execute arbitrary code i=
n the context of an application using the affected library.
Version 0.8.7 is vulnerable; other versions prior to 0.8.9 may also be af=
fected.
3. Kaspersky AntiVirus SysInfo ActiveX Control Arbitrary File Exfiltratio=
n Vulnerability
BugTraq ID: 23325
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23325
Summary:
Kaspersky Anti-Virus is prone to an arbitrary-file-exfiltration vulnerabi=
lity.
An attacker can exploit this issue to steal files from a victim machine.
This issue affects Kaspersky Anti-Virus 6.0 and Kaspersky Internet Securi=
ty 6.0.
4. Kaspersky Antivirus Engine ARJ Archive Remote Heap Overflow Vulnerabil=
ity
BugTraq ID: 23346
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23346
Summary:
Kaspersky Anti-Virus Engine is prone to a remote heap-overflow vulnerabil=
ity because it fails to perform sufficient boundary checks on user-suppli=
ed data before copying it to a buffer.
An attacker could leverage this issue to execute arbitrary code with SYST=
EM-level privileges. A successful exploit could result in the complete co=
mpromise of affected computers.
5. Kaspersky AntiVirus Prod60 ActiveX Control Arbitrary File Exfiltration=
Vulnerability
BugTraq ID: 23345
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23345
Summary:
Kaspersky AntiVirus is prone to an arbitrary-file-exfiltration vulnerabil=
ity.
An attacker can exploit this issue to steal files from a victim machine.
This issue affects Kaspersky Anti-Virus 6.0 and Kaspersky Internet Securi=
ty 6.0.
6. Xoops Jobs Module Index.PHP SQL Injection Vulnerability
BugTraq ID: 23344
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23344
Summary:
The XOOPS Jobs module is prone to an SQL-injection vulnerability because =
it fails to sufficiently sanitize user-supplied data before using it in a=
n SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
This issue affects Jobs 2.4 and prior versions; other versions may also b=
e affected.
7. XOOPS WF-Link Module Viewcat.PHP SQL Injection Vulnerability
BugTraq ID: 23340
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23340
Summary:
The XOOPS WF-Link module is prone to an SQL-injection vulnerability becau=
se it fails to sufficiently sanitize user-supplied data before using it i=
n an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
This issue affects WF-Link 1.03; prior versions may also be affected.
8. Microsoft April 2007 Advance Notification Multiple Vulnerabilities
BugTraq ID: 23335
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23335
Summary:
Microsoft has released advance notification that the vendor will be relea=
sing five security bulletins on April 10, 2007. The highest severity rati=
ng for these issues is 'Critical'.
Further details about these issues are not currently available. Individua=
l BIDs will be created for each issue; this record will be removed when t=
he security bulletins are released.
9. Sisplet CMS Komentar.PHP Remote File Include Vulnerability
BugTraq ID: 23334
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23334
Summary:
Sisplet CMS is prone to a remote file-include vulnerability because it fa=
ils to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
Version 05.10 is vulnerable; other versions may also be affected.
10. Lite-CMS Index.PHP Local File Include Vulnerability
BugTraq ID: 23330
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23330
Summary:
Lite-CMS is prone to a local file-include vulnerability because it fails =
to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
Version 0.2.1 is vulnerable; other versions may also be affected.
11. CodeWand PHPBrowse Include_Stream.Inc.PHP Remote File Include Vulnera=
bility
BugTraq ID: 23329
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23329
Summary:
phpBrowse is prone to a remote file-include vulnerability because it fail=
s to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
12. PHP-Generics _App_Relative_Path Multiple Remote File Include Vulnerab=
ilities
BugTraq ID: 23328
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23328
Summary:
PHP-Generics is prone to multiple remote file-include vulnerabilities bec=
ause it fails to sufficiently sanitize user-supplied data.
Exploiting these issues may allow an attacker to compromise the applicati=
on and the underlying system; other attacks are also possible.
These issues affect version 1.0 beta; other versions may also be vulnerab=
le.
13. Kaspersky Internet Security Suite Klif.SYS Driver Local Heap Overflow=
Vulnerability
BugTraq ID: 23326
Remote: No
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/23326
Summary:
Kaspersky Internet Security Suite is prone to a heap-overflow vulnerabili=
ty because it fails to perform sufficient boundary checks on user-supplie=
d data before copying it to a buffer.
An attacker could leverage this issue to execute arbitrary code with kern=
el-level privileges. A successful exploit could result in the complete co=
mpromise of the affected system.
Kaspersky Internet Security Suite 6.0.1.411 for Microsoft Windows is repo=
rted vulnerable; previous versions may be vulnerable as well.
14. Centrino Intel PRO/Wireless Network Connection Drivers Remote Code Ex=
ecution Vulnerability
BugTraq ID: 19864
Remote: Yes
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/19864
Summary:
Intel PRO/Wireless Network Connection drivers are prone to a remote code-=
execution vulnerability.
An attacker may trigger this vulnerability to corrupt memory and execute =
arbitrary code in the vulnerable system with kernel-level credentials.
A successful attack can result in a complete compromise of the affected c=
omputer.
15. LedgerSMB Unspecified SQL Injection Vulnerabilities
BugTraq ID: 20749
Remote: Yes
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/20749
Summary:
LedgerSMB is prone to multiple unspecified SQL-injection vulnerabilities =
because it fails to properly sanitize user-supplied input before using it=
in an SQL query.=20
A successful attack could allow an attacker to compromise the application=
, access or modify data, gain administrative access to the application, o=
r exploit vulnerabilities in the underlying database implementation.
LedgerSMB 1.1.0 is vulnerable to these issues; other versions may be vuln=
erable as well.
16. XOOPS Multiple Modules ViewCat.PHP SQL Injection Vulnerabilities
BugTraq ID: 23229
Remote: Yes
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/23229
Summary:
Multiple XOOPS Modules are prone to SQL-injection vulnerabilities because=
they fail to sufficiently sanitize user-supplied data before using it in=
an SQL query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database implementation.
17. Linux Kernel IPV6_Getsockopt_Sticky Memory Leak Information Disclosur=
e Vulnerability
BugTraq ID: 22904
Remote: No
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/22904
Summary:
Linux Kernel is prone to an information-disclosure vulnerability because =
it fails to handle unexpected user-supplied input.
Successful exploits will allow attackers to obtain portions of kernel mem=
ory. Information harvested may be used in further attacks.
Kernel versions 2.6.0 up to 2.6.20.1 are vulnerable to this issue.
18. XMMS Skins Integer Overflow And Underflow Vulnerabilities
BugTraq ID: 23078
Remote: Yes
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/23078
Summary:
XMMS is prone to an integer-overflow vulnerability and an integer-underfl=
ow vulnerability because it fails to adequately handle user-supplied data=
.
An attacker can leverage these issues to corrupt stack-based memory and e=
xecute arbitrary code with the privileges of a user running the applicati=
on. A successful attack may result in the compromise of affected computer=
s. Failed attempts will likely cause denial-of-service conditions.
Version 1.2.10 is vulnerable; other versions may also be affected.
19. Linux Kernel Omnikey CardMan 4040 Driver Local Buffer Overflow Vulner=
ability
BugTraq ID: 22870
Remote: No
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/22870
Summary:
The Linux kernel is prone to a local buffer-overflow vulnerability becaus=
e it fails to properly bounds-check user-supplied input before using it i=
n a memory copy operation.
This issue allows local attackers to overwrite kernel memory with arbitra=
ry data, potentially allowing them to execute malicious machine code in t=
he context of affected kernels. Exploiting this vulnerability facilitates=
the complete compromise of affected computers.
Linux kernel versions prior to 2.6.21-rc3 are affected by this issue.
20. VMware Unspecified Buffer Overflow Vulnerability
BugTraq ID: 23322
Remote: No
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/23322
Summary:
VMware is prone to an unspecified buffer-overflow vulnerability because t=
he application fails to bounds-check user-supplied data before copying it=
into an insufficiently sized buffer.=20
An attacker can exploit this issue to execute arbitrary code with adminis=
trative privileges. Successfully exploiting this issue will result in the=
complete compromise of affected computers. Failed exploit attempts will =
result in a denial of service.
21. Zlib Compression Library gzprintf() Buffer Overrun Vulnerability
BugTraq ID: 6913
Remote: Yes
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/6913
Summary:
A buffer-overrun vulnerability has been reported in the Zlib compression =
library. Due to the use of 'vsprintf()' by an internal Zlib function, an =
attacker can cause memory to become corrupted. This buffer overrun occurs=
becuase the software fails to check the boundaries of user-supplied data=
given to the 'gzprintf()' function. =20
=20
Successful exploitation of this vulnerability may allow an attacker to ex=
ecute arbitrary instructions.=20
=20
Note that only Zlib 1.1.4 has been reported vulnerable to this issue. It =
is not yet known whether earlier versions are also affected.
22. Zlib Compression Library Decompression Buffer Overflow Vulnerability
BugTraq ID: 14340
Remote: Yes
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/14340
Summary:
Zlib is susceptible to a buffer-overflow vulnerability. This issue is due=
to the library's failure to properly handle unexpected input to its deco=
mpression routines.=20
Certain values used during decompression are incorrectly specified, allow=
ing invalid inflate input to corrupt memory.=20
This vulnerability allows attackers to crash applications that use the af=
fected library. This could also potentially allow for arbitrary code exec=
ution in the context of an affected application.
23. XOOPS Rha7 Downloads Module Visit.PHP SQL Injection Vulnerability
BugTraq ID: 23320
Remote: Yes
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/23320
Summary:
The XOOPS Rha7 Downloads module is prone to an SQL-injection vulnerabilit=
y because it fails to sufficiently sanitize user-supplied data before usi=
ng it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
This issue affects Rha7 Downloads 1.0; prior versions may also be affecte=
d.
24. GNU Texinfo Insecure Temporary File Creation Vulnerability
BugTraq ID: 14854
Remote: No
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/14854
Summary:
Texinfo creates temporary files in an insecure manner. The issue resides =
in the 'textindex.c' file.=20
=20
Exploitation would most likely result in loss of data or a denial of serv=
ice if critical files are overwritten in the attack. Other attacks may be=
possible as well.
25. PHPBB Mutant Mutant_Functions.PHP Remote File Include Vulnerability
BugTraq ID: 23319
Remote: Yes
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/23319
Summary:
Mutant is prone to a remote file-include vulnerability because it fails t=
o sufficiently sanitize user-supplied input.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
This issue affects Mutant 0.9.2; other versions may also be vulnerable.
26. IrfanView Multiple BMP Denial of Service Vulnerabilities
BugTraq ID: 23318
Remote: Yes
Last Updated: 2007-04-06
Relevant URL: http://www.securityfocus.com/bid/23318
Summary:
IrfanView is prone to multiple denial-of-service vulnerabilities because =
the application fails to properly handle malformed BMP image files.
Successfully exploiting these issues allows attackers to crash the affect=
ed application. Due to the nature of the issues, code execution may also =
be possible, but this has not been confirmed.
IrfanView 3.99 is affected; other versions may also be vulnerable.
27. Microsoft Windows UPnP Remote Stack Buffer Overflow Vulnerability
BugTraq ID: 23371
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23371
Summary:
Microsoft Windows is prone to a remote stack-based buffer-overflow vulner=
ability because it fails to adequately bounds-check user-supplied data be=
fore copying it to an insufficiently sized memory buffer. This occurs whe=
n handling certain HTTP requests.
To exploit this issue, an attacker must be in the same network segment as=
the victim.
Successful exploits may allow attackers to execute arbitrary code with th=
e privileges of the affected service. Failed exploits attempts will likel=
y result in denial-of-service conditions.
28. Windows VDM Zero Page Race Condition Local Privilege Escalation Vulne=
rability
BugTraq ID: 23367
Remote: No
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23367
Summary:
Microsoft Windows is prone to a local privilege-escalation vulnerability =
because of a race condition in the Virtual DOS Machine (VDM).=20
A local attacker can exploit this issue to execute arbitrary code with ke=
rnel-level privileges. A successful exploit will result in the complete c=
ompromise of affected computers. Failed exploit attempts will result in a=
denial-of-service condition.
29. Microsoft Agent URI Processing Remote Code Execution Vulnerability
BugTraq ID: 23337
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23337
Summary:
The Microsoft Agent ActiveX control is prone to remote code execution.=20
An attacker could exploit this issue to execute code in the context of th=
e user visiting a malicious web page.
Note that users who are running Windows Internet Explorer 7 are not affec=
ted by this vulnerability.
30. Microsoft Windows CSRSS CSRFinalizeContext Local Privilege Escalation=
Vulnerability
BugTraq ID: 23338
Remote: No
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23338
Summary:
Microsoft Windows CSRSS (client/server run-time subsystem) is prone to lo=
cal privilege-escalation vulnerability.
Successful attacks will result in the complete compromise of affected com=
puters.
31. Microsoft Windows CSRSS HardError Messages Denial of Service Vulnerab=
ility
BugTraq ID: 21688
Remote: No
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/21688
Summary:
Microsoft Windows is prone to a local denial-of-service vulnerability bec=
ause the operating system fails to handle certain API calls with unexpect=
ed parameters.
A local unprivileged attacker may exploit this issue by executing a malic=
ious application.
Successful exploits will allow attackers to crash the operating system, d=
enying further service to legitimate users.
32. Microsoft Windows CSRSS MSGBox Remote Code Execution Vulnerability
BugTraq ID: 23324
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23324
Summary:
Microsoft Windows CSRSS (client/server run-time subsystem) MsgBox is pron=
e to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with SYSTEM-=
level privileges.
Note that this issue can also be exploited locally by an authenticated us=
er to gain elevated privileges.
Under default settings, Windows Vista is not prone to remote attacks that=
attempt to exploit this issue.
Update: This issue was originally disclosed as part of BID 21688, but ha=
s now been assigned its own record.
33. MIT Kerberos 5 KAdminD Server Stack Buffer Overflow Vulnerability
BugTraq ID: 23285
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23285
Summary:
Kerberos 5 kadmind (Kerberos Administration Daemon) server is prone to a =
stack-based buffer-overflow vulnerability because the software fails to a=
dequately bounds-check user-supplied data before copying it to an insuffi=
ciently sized buffer.
An attacker can exploit this issue to execute arbitrary code with adminis=
trative privileges. A successful attack can result in the complete compro=
mise of the application. Failed attempts will likely result in denial-of-=
service conditions.
All kadmind servers run on the master Kerberos server. Since the master =
server holds the KDC principal and policy database, an attack may not on=
ly compromise the affected computer, but could also compromise multiple =
hosts that use the server for authentication.
Kerberos 5 kadmind 1.6 and prior versions are vulnerable.
34. MIT Kerberos Administration Daemon Kadmind Double Free Memory Corrupt=
ion Vulnerabilities
BugTraq ID: 23282
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23282
Summary:
MIT Kerberos 5 is prone to a double-free memory-corruption vulnerability.
An attacker can exploit this issue to execute arbitrary code with superus=
er or SYSTEM-level privileges, completely compromising affected computers=
. Failed exploit attempts will likely result in a denial-of-service condi=
tions.
This issue also affects third-party applications using the affected API.
35. MIT Kerberos 5 Telnet Daemon Authentication Bypass Vulnerability
BugTraq ID: 23281
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23281
Summary:
MIT Kerberos 5 is prone to an authentication-bypass vulnerability.=20
An attacker can exploit this issue to gain superuser or SYSTEM-level priv=
ileges on the affected computer. Successfully exploiting this issue will =
result in the complete compromise of affected computers.
This issue occurs in Kerberos 5 versions 1.6 and prior.
36. OpenOffice Meta Character Remote Shell Command Execution Vulnerabilit=
y
BugTraq ID: 22812
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/22812
Summary:
OpenOffice is prone to a vulnerability that allows arbitrary shell comman=
ds to run because the software fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary shell commands o=
n an affected computer with the privileges of the applicaiton.
37. Microsoft Internet Explorer Script Error Handling Remote Code Executi=
on Vulnerability
BugTraq ID: 21552
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/21552
Summary:
Microsoft Internet Explorer is prone to a remote code-execution vulnerabi=
lity.=20
This vulnerability is related to how the browser handles script errors. A=
n attacker may exploit this vulnerability to execute arbitrary code in th=
e context of the user running the affected browser.
38. Microsoft Content Management Server Remote Code Execution Vulnerabili=
ty
BugTraq ID: 22861
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/22861
Summary:
Microsoft Content Management Server (MCMS) is prone to an arbitrary code-=
execution vulnerability because the software fails to properly validate u=
ser-supplied input.
Exploiting this issue allows remote attackers to execute arbitrary machin=
e code on affected computers with the privileges of the vulnerable applic=
ation.
39. Microsoft Content Management Server Cross-Site Scripting Vulnerabilit=
y
BugTraq ID: 22860
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/22860
Summary:
Microsoft Content Management Server (MCMS) is prone to an unspecified cro=
ss-site scripting vulnerability because the application fails to properly=
sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials, =
spoof content, or perform actions on behalf of the victim user; this coul=
d aid in further attacks.
40. Microsoft Windows Cursor And Icon ANI Format Handling Remote Buffer O=
verflow Vulnerability
BugTraq ID: 23194
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23194
Summary:
Microsoft Windows is prone to a stack buffer-overflow vulnerability becau=
se of insufficient format validation that occurs when handling malformed =
ANI cursor or icon files.
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of an unsuspecting user. A successful attack can result in the co=
mpromise of affected user accounts and computers.
This issue affects Windows Vista, Windows XP SP2, and Windows Server 2003=
SP1 when running Internet Explorer 6 and 7; other versions and client ap=
plications may also be affected.
Microsoft has recently disclosed that Outlook 2007 is not vulnerable, tha=
t Windows Mail on Vista is vulnerable in replying to or forwarding emails=
containing malicious ANI files, and that Outlook Express is vulnerable t=
o this issue.
Third-party applications such as browsers that handle ANI files and call =
the ANI rendering functionality in GDI pose an attack vector for this vul=
nerability.
41. HIOX Free Guest Book Index.PHP HTML Injection Vulnerability
BugTraq ID: 23397
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23397
Summary:
HIOX FREE Guest Book is prone to an HTML-injection vulnerability because =
it fails to sufficiently sanitize user-supplied input data.
Exploiting this issue may allow an attacker to execute HTML and script co=
de in the context of the affected site, to steal cookie-based authenticat=
ion credentials, or to control how the site is rendered to the user; othe=
r attacks are also possible.
=20
HIOX FREE Guest Book 4.0 is vulnerable; other versions may also be affect=
ed.
42. Apple AirPort Extreme Base Station Firmware Information Disclosure Vu=
lnerability
BugTraq ID: 23396
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23396
Summary:
Apple AirPort Extreme Base Station is prone to an information-disclosure =
vulnerability.
An attacker can exploit this issue to view filenames on a password-protec=
ted AirPort Disk without supplying a password.
Firmware versions prior to 7.1 are vulnerable.
43. IPSec-Tools Remote Denial Of Service Vulnerability
BugTraq ID: 23394
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23394
Summary:
IPSec-Tools is affected by a remote denial-of-service vulnerability becau=
se the application fails to properly handle certain network packets.
A successful attack allows a remote attacker to crash the application, de=
nying further service to legitimate users.
IPSec-Tools versions prior to 0.6.7 are vulnerable to this issue.
44. PHP121 Instant Messenger php121db.PHP Local File Include Vulnerabilit=
y
BugTraq ID: 23392
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23392
Summary:
PHP121 is prone to a local file-include vulnerability because it fails to=
properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
PHP121 2.2 is vulnerable; other versions may also be affected.
45. OpenSSH Duplicated Block Remote Denial of Service Vulnerability
BugTraq ID: 20216
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/20216
Summary:
OpenSSH is prone to a remote denial-of-service vulnerability because it f=
ails to properly handle incoming duplicate blocks.
Remote attackers may exploit this issue to consume excessive CPU resource=
s, potentially denying service to legitimate users.
This issue occurs only when OpenSSH is configured to accept SSH Version O=
ne traffic.
46. CattaDoc Arbitrary Files Information Disclosure Vulnerability
BugTraq ID: 23390
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23390
Summary:
cattaDoc is prone to a remote information-disclosure vulnerability.
An attacker can leverage this issue to access sensitive data that could a=
id in further attacks.
47. Xrousse Beryo Downloadpic.PHP Arbitrary File Download Vulnerability
BugTraq ID: 23387
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23387
Summary:
Xrousse Beryo is prone to an issue that allows an attacker to download ar=
bitrary files.
The attacker can exploit this issue to obtain sensitive information and d=
ownload arbitrary files from the webserver.
This issue affects Xrousse Beryo 2.4 and prior versions.
48. Linux Kernel DCCP Proto.C Buffer Overflow Vulnerability
BugTraq ID: 23384
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23384
Summary:
The Linux kernel is prone to a buffer-overflow vulnerability because it f=
ails to adequately bounds-check user-supplied data before copying it to a=
n insufficiently sized buffer.
An attacker can exploit this issue to cause denial-of-service conditions.=
Arbitrary code execution may also be possible, but this has not been con=
firmed.
Versions prior to 2.6.20.5 are vulnerable.
49. Battle.net Clan Script Login.PHP SQL Injection Vulnerability
BugTraq ID: 23383
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23383
Summary:
Battle.net Clan Script is prone to an SQL-injection vulnerability because=
it fails to sufficiently sanitize user-supplied data before using it in =
an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
Battle.net Clan Script 1.5 is vulnerable; other versions may also be affe=
cted.
50. Einfacher Passworschutz Index.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 23395
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23395
Summary:
Einfacher Passworschutz is prone to a cross-site scripting vulnerability =
because the application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
51. Microsoft Windows Help File Unspecified Heap Overflow Vulnerability
BugTraq ID: 23382
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23382
Summary:
The Microsoft Windows Help File viewer is reported prone to a heap-overfl=
ow vulnerability because it fails to perform boundary checks before copyi=
ng user-supplied data into insufficiently sized memory buffers.
This vulnerability presents itself when the application handles a special=
ly crafted Windows Help ('.hlp') file.
=20
A successful attack may facilitate arbitrary code execution in the contex=
t of a vulnerable user who opens a malicious file. Failed exploit attempt=
s will likely result in denial-of-service conditions.
52. Portable OpenSSH GSSAPI Remote Code Execution Vulnerability
BugTraq ID: 20241
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/20241
Summary:
Portable OpenSSH is prone to a remote code-execution vulnerability. The i=
ssue derives from a race condition in a vulnerable signal handler.
Reportedly, under specific conditions, it is theoretically possible to ex=
ecute code remotely prior to authentication when GSSAPI authentication is=
enabled. This has not been confirmed; the chance of a successful exploit=
of this nature is considered minimal.=20
On non-Portable OpenSSH implementations, this same race condition can be =
exploited to cause a pre-authentication denial of service.=20
This issue occurs when OpenSSH and Portable OpenSSH are configured to acc=
ept GSSAPI authentication.
53. IPIX Image Well ActiveX Controls Multiple Buffer Overflow Vulnerabili=
ties
BugTraq ID: 23379
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23379
Summary:
IPIX Image Well ActiveX controls are prone to multiple buffer-overflow vu=
lnerabilities because the software fails to properly bounds-check user-su=
pplied data before copying it into an insufficiently sized memory buffer.
Exploiting these issues allows remote attackers to execute arbitrary code=
in the context of applications using the affected ActiveX controls and t=
o compromise affected computers. Failed attempts will likely result in de=
nial-of-service conditions.
54. eCardMAX HotEditor Keyboard.PHP Local File Include Vulnerability
BugTraq ID: 23377
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23377
Summary:
eCardMAX HotEditor is prone to a local file-include vulnerability because=
it fails to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
HotEditor 4.0 is vulnerable; other versions may also be affected. This is=
sue also affects versions that may be integrated into phpBB2, MyBB, Simpl=
e Machine Forum, and PunBB Forum.
55. Linux Kernel AppleTalk ATalk_Sum_SKB Function Denial Of Service Vulne=
rability
BugTraq ID: 23376
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23376
Summary:
The Linux kernel is prone to a denial-of-service vulnerability. This issu=
e presents itself when malformed AppleTalk frames are processed.
An attacker can exploit this issue to crash host computers, effectively d=
enying service to legitimate users.
Versions prior to 2.6.20.5 are vulnerable.
56. Pathos Warn.PHP Remote File Include Vulnerability
BugTraq ID: 23393
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23393
Summary:
Pathos is prone to a remote file-include vulnerability because it fails t=
o sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
This issue affects Pathos 0.92-2; other versions may also be vulnerable.
57. AOL AIM and ICQ Clients Directory Traversal Vulnerability
BugTraq ID: 23391
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23391
Summary:
AOL AIM and ICQ Clients are prone to a directory-traversal vulnerability =
because the software fails to properly sanitize user-supplied input durin=
g a file transfer.
An attacker may exploit this issue by enticing victims into receiving a m=
alicious file via the application.
Successful exploits will allow attackers to save files on arbitrary locat=
ions on a victim's computer.
58. JustSystem Ichitaro Unspecified Remote Code Execution Vulnerability
BugTraq ID: 23386
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23386
Summary:
Ichitaro is prone to an unspecified remotely exploitable code-execution v=
ulnerability.
Remote attackers may exploit this issue to execute arbitrary code within =
the context of the affected system or to cause a denial of service.=20
Few details are available regarding this issue. This BID will be updated =
when more information emerges.
59. DeskPro Login.PHP HTML Injection Vulnerability
BugTraq ID: 23381
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23381
Summary:
DeskPRO is prone to an HTML-injection scripting vulnerability because the=
application fails to properly sanitize user-supplied input.=20
Attacker-supplied HTML and script code would execute in the context of th=
e affected site, potentially allowing the attacker to steal cookie-based =
authentication credentials or to control how the site is rendered to the =
user; other attacks are also possible.
DeskPRO 2.0.1 is vulnerable to this issue.
60. Microsoft Word 2007 WWLib.DLL Unspecified Document File Buffer Overfl=
ow Vulnerability
BugTraq ID: 23380
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23380
Summary:
Microsoft Word is prone to a buffer-overflow vulnerability because the ap=
plication fails to properly bounds-check user-supplied data before copyin=
g it to an insufficiently sized memory buffer.
=20
An attacker can exploit this issue by enticing a victim to open a malicio=
us Word file.
Successful exploits may allow an attacker to execute arbitrary code in th=
e context of the currently logged-in user. Failed exploit attempts will l=
ikely result in denial-of-service conditions.
61. Yahoo! Messenger Audio Conferencing ActiveX Control Remote Buffer Ove=
rflow Vulnerability
BugTraq ID: 23291
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23291
Summary:
The Audio Conferencing ActiveX control shipped with Yahoo! Messenger is p=
rone to a buffer-overflow vulnerability. The software fails to perform su=
fficient bounds-checking of user-supplied input before copying it to an i=
nsufficiently sized memory buffer.
Yahoo! Messenger versions released prior to March 13, 2007 are vulnerable=
to this issue.
62. Microsoft Windows GDI Invalid Window Size Local Privilege Escalation =
Vulnerability
BugTraq ID: 23277
Remote: No
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23277
Summary:
Microsoft Windows is prone to a local privilege-escalation vulnerability.
An attacker can exploit this issue to execute arbitrary code with SYSTEM-=
level privileges. A successful exploit will result in the complete compro=
mise of affected computers. Failed exploit attempts will result in a deni=
al-of-service condition.
63. IrfanView Cursor And Icon ANI Format Handling Remote Buffer Overflow =
Vulnerability
BugTraq ID: 23262
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23262
Summary:
IrfanView is prone to a buffer-overflow vulnerability because it fails to=
validate formats. Specifically, the issue occurs when handling malformed=
ANI cursor or icon files.
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of an unsuspecting user. A successful attack can result in the co=
mpromise of affected user accounts and computers.
This issue affects version 3.99.
64. Microsoft Windows Graphics Rendering Engine GDI Local Privilege Escal=
ation Vulnerability
BugTraq ID: 23273
Remote: No
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23273
Summary:
Microsoft Windows Graphics Rendering Engine is prone to local privilege-e=
scalation vulnerability.
=20
Successful exploits may result in a complete compromise of affected compu=
ters.
65. Microsoft Windows Graphics Device Interface Font Rasterizer Local Pri=
vilege Escalation Vulnerability
BugTraq ID: 23276
Remote: No
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23276
Summary:
Microsoft Windows GDI Font Rasterizer is prone to a local privilege-escal=
ation vulnerability.
An attacker can exploit this issue to gain complete control of an affecte=
d computer. Failed attempts will likely cause the operating system to cra=
sh, resulting in denial-of-service conditions.
66. Microsoft Windows Graphics Rendering Engine EMF File Privilege Escala=
tion Vulnerability
BugTraq ID: 23278
Remote: No
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23278
Summary:
Microsoft Windows Graphics Rendering Engine is prone to a local privilege=
-escalation vulnerability when rendering malformed EMF image files.
=20
An attacker may exploit this issue to execute arbitrary code with SYSTEM-=
level privileges, facilitating the complete compromise of affected comput=
ers.
67. ScarNews Scarnews.Inc.PHP Local File Include Vulnerability
BugTraq ID: 23375
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23375
Summary:
ScarNews is prone to a local file-include vulnerability because it fails =
to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
ScarNews 1.2.1 is vulnerable; other versions may also be affected.
68. SignKorea SKCrypAX ActiveX Control Multiple Buffer Overflow Vulnerabi=
lities
BugTraq ID: 23374
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23374
Summary:
SignKorea SKCrypAX is prone to multiple remote buffer-overflow vulnerabil=
ities because the application fails to properly bounds-check user-supplie=
d data before copying it into an insufficiently sized memory buffer.
Exploiting these issues allows remote attackers to execute arbitrary code=
in the context of applications using the affected ActiveX control and to=
compromise affected computers. Failed attempts will likely result in den=
ial-of-service conditions.
These issues affect SKCrypAX 5.4.1.2; other versions may also be affected=
.
69. Microsoft Windows GDI WMF Remote Denial of Service Vulnerability
BugTraq ID: 23275
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23275
Summary:
Microsoft Windows is prone to a remote denial-of-service vulnerability be=
cause the software fails to handle malicious WMF files.=20
Exploiting this issue may cause Microsoft Windows to crash, denying servi=
ce to legitimate users.
70. Microsoft Windows Explorer ANI File Denial of Service Vulnerability
BugTraq ID: 23373
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23373
Summary:
Windows Explorer is prone to a denial-of-service vulnerability.
An attacker could exploit this issue to cause Explorer to crash, effectiv=
ely denying service. Arbitrary code execution may be possible, but this h=
as not been confirmed.
This issue affects Windows Explorer on Microsoft Windows XP SP2; other op=
erating systems and versions may also be affected.
71. ArchiveXpert Multiple Directory Traversal Vulnerabilities
BugTraq ID: 23372
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23372
Summary:
ArchiveXpert is prone to multiple directory-traversal vulnerabilities bec=
ause it fails to properly sanitize user-supplied input.=20
An attacker can exploit this issue to extract files into arbitrary direct=
ories and overwrite arbitrary files. Successful exploits may aid in furth=
er attacks.
These issues affect ArchiveXpert 2.02 build 80; other versions may also b=
e affected.
72. Requestit Index.PHP Remote File Include Vulnerability
BugTraq ID: 23370
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23370
Summary:
Requestit is prone to a remote file-include vulnerability because it fail=
s to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
This issue affects Requestit 1.0b; other versions may also be vulnerable.
73. UBB.Threads UBBThreads.PHP SQL Injection Vulnerability
BugTraq ID: 23369
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23369
Summary:
UBB.threads is prone to an SQL-injection vulnerability because it fails t=
o sufficiently sanitize user-supplied data before using it in an SQL quer=
y.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
UBB.threads 6.1.1 and prior versions are vulnerable; other versions may a=
lso be affected.
74. QuizShock Auth.PHP HTML Injection Vulnerability
BugTraq ID: 23368
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23368
Summary:
QuizShock is prone to an HTML-injection scripting vulnerability because t=
he application fails to properly sanitize user-supplied input.=20
Attacker-supplied HTML and script code would execute in the context of th=
e affected site, potentially allowing the attacker to steal cookie-based =
authentication credentials or to control how the site is rendered to the =
user; other attacks are also possible.
QuizShock 1.5.8 through 1.6.1 are vulnerable.
75. DirectAdmin Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 21049
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/21049
Summary:
DirectAdmin is prone to multiple cross-site scripting vulnerabilities bec=
ause it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may help the attacker steal cookie-based authentication credentials=
and launch other attacks.
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affec=
ted.
76. EBoard Member.PHP Local File Include Vulnerability
BugTraq ID: 23365
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23365
Summary:
eBoard is prone to a local file-include vulnerability because it fails to=
properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
eBoard 1.0.7 is vulnerable; other versions may also be affected.
77. phpGalleryScript Init.Gallery.PHP Remote File Include Vulnerability
BugTraq ID: 23399
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23399
Summary:
phpGalleryScript is prone to a remote file-include vulnerability because =
it fails to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
This issue affects phpGalleryScript 1.0; other versions may also be vulne=
rable.
78. MyNews Week_Events.PHP Remote File Include Vulnerability
BugTraq ID: 23398
Remote: Yes
Last Updated: 2007-04-10
Relevant URL: http://www.securityfocus.com/bid/23398
Summary:
MyNews is prone to a remote file-include vulnerability because it fails t=
o properly sanitize user-supplied input.
An attacker can exploit this issue to include arbitrary remote files cont=
aining malicious PHP code and execute it in the context of the webserver =
process. This may allow the attacker to compromise the application and to=
gain access to the underlying system.
This issue affects MyNews 4.2.2 and prior versions.
79. SmodCMS Dictionary.PHP SQL Injection Vulnerability
BugTraq ID: 23364
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23364
Summary:
SmodCMS is prone to an SQL-injection vulnerability because it fails to su=
fficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
SmodCMS 2.10 and prior versions are vulnerable.
80. Youngzsoft CMailServer Comment Parameter Cross-Site Scripting Vulnera=
bility
BugTraq ID: 23363
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23363
Summary:
Youngzsoft CMailServer is prone to a cross-site scripting vulnerability b=
ecause the application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
Youngzsoft CMailServer 5.4.3 is vulnerable to this issue; other versions =
may also be affected.
81. Microsoft Windows GDI Kernel Local Privilege Escalation Vulnerability
BugTraq ID: 20940
Remote: No
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/20940
Summary:
Microsoft Windows is prone to a local privilege-escalation vulnerability =
because data structures mapped by the GDI Kernel can be re-mapped as read=
-write by other processes.
An attacker could exploit this issue to execute arbitrary machine code wi=
th SYSTEM-level privileges. A successful exploit could result in the comp=
lete compromise of the affected computer. Failed attempts could cause den=
ial-of-service conditions.
82. CompreXX Multiple Directory Traversal Vulnerabilities
BugTraq ID: 23362
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23362
Summary:
CompreXX is prone to multiple directory-traversal vulnerabilities because=
it fails to properly sanitize user-supplied input.=20
An attacker can exploit this issue to extract files into arbitrary direct=
ories and overwrite arbitrary files. Successful exploits may aid in furth=
er attacks.
These issues affect CompreXX 4.1; other versions may also be affected.
83. Intervations FileCopa Unspecified Remote Stack Buffer Overflow Vulner=
ability
BugTraq ID: 23056
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23056
Summary:
FileCopa is prone to a buffer-overflow vulnerability because it fails to =
adequately bounds-check user-supplied data before copying it to an insuff=
iciently sized buffer.
An attacker can exploit this issue to execute arbitrary code in the conte=
xt of the application. Failed attempts may cause denial-of-service condit=
ions.
84. X.Org LibXFont Multiple Integer Overflow Vulnerabilities
BugTraq ID: 23283
Remote: No
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23283
Summary:
The 'libXfont' library is prone to multiple local integer-overflow vulner=
abilities because it fails to adequately bounds-check user-supplied data.
An attacker can exploit these vulnerabilities to execute arbitrary code w=
ith superuser privileges. Failed exploit attempts will likely cause denia=
l-of-service conditions.
These issues affect libXfont 1.2.2; other versions may also be vulnerable=
.
85. Youngzsoft CMailServer Signup.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 23360
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23360
Summary:
Youngzsoft CMailServer is prone to a cross-site scripting vulnerability b=
ecause the application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
Youngzsoft CMailServer 5.3.4 is vulnerable to this issue; other versions =
may also be affected.
86. PHP Filter_Var FILTER_VALIDATE_EMAIL Newline Injection Vulnerability
BugTraq ID: 23359
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23359
Summary:
PHP is prone to an email-newline-injection vulnerability because it fails=
to properly sanitize user-supplied input.
Exploiting this issue may allow a malicious user to create arbitrary emai=
l headers, and then create and transmit spam messages from the affected c=
omputer.
87. WitShare Index.PHP Local File Include Vulnerability
BugTraq ID: 23358
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23358
Summary:
WitShare is prone to a local file-include vulnerability because it fails =
to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
WitShare 0.9 is vulnerable; other versions may also be affected.
88. Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
BugTraq ID: 19204
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/19204
Summary:
Apache mod_rewrite is prone to an off-by-one buffer-overflow condition.=20
The vulnerability arising in the mod_rewrite module's ldap scheme handlin=
g allows for potential memory corruption when an attacker exploits certai=
n rewrite rules.=20
An attacker may exploit this issue to trigger a denial-of-service conditi=
on. Reportedly, arbitrary code execution may be possible as well.
89. PHP GD Extension WBMP File Integer Overflow Vulnerabilities
BugTraq ID: 23357
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23357
Summary:
PHP's GD extension is prone to two integer-overflow vulnerabilities becau=
se it fails to ensure that integer values aren't overrun.
Successfully exploiting these issues allows attackers to crash the affect=
ed application, potentially denying service to legitimate users. Due to t=
he nature of the issues, code execution may also be possible, but this ha=
s not been confirmed.
PHP 5.2.1 and prior versions are vulnerable.
90. GNU GV Stack Buffer Overflow Vulnerability
BugTraq ID: 20978
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/20978
Summary:
GNU gv is prone to a stack-based buffer-overflow vulnerability because th=
e application fails to properly bounds-check user-supplied data before co=
pying it into an insufficiently sized memory buffer.=20
Exploiting this issue allows attackers to execute arbitrary machine code =
in the context of users running the affected application. Failed attempts=
will likely crash the application, resulting in denial-of-service condit=
ions.
Version 3.6.2 is reported vulnerable; other versions may also be affected=
.
NOTE: Various other applications may employ embedded GNU gv code and coul=
d also be vulnerable as a result.
91. SmodBIP Index.PHP SQL Injection Vulnerability
BugTraq ID: 23356
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23356
Summary:
SmodBIP is prone to an SQL-injection vulnerability because it fails to su=
fficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
SmodBIP 1.06 and prior versions are vulnerable.
92. Man Command -H Flag Local Buffer Overflow Vulnerability
BugTraq ID: 23355
Remote: No
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23355
Summary:
The 'man' command is prone to a local buffer-overflow vulnerability becau=
se it fails to properly bounds-check user-supplied input before using it =
in a memory copy operation.
NOTE: Presumably, this issue is exploitable only when 'man' has been inst=
alled setuid.
Exploiting this issue allows attackers to execute malicious machine code =
with the privileges of the 'man' utility. This can result in the compromi=
se of affected computers. Failed exploit attempts will likely result in d=
enial-of-service conditions.
93. Nuke ET User Account Deletion Input Validation Vulnerability
BugTraq ID: 23354
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23354
Summary:
Nuke ET is prone to an input-validation vulnerability because it fails to=
verify user-supplied data before performing certain actions.
An attacker can exploit this issue to delete arbitrary user accounts from=
the application.
Nuke ET 3.4 and prior versions are vulnerable.
94. Livor Index.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 23353
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23353
Summary:
Livor is prone to a cross-site scripting vulnerability because the applic=
ation fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
Livor 2.5 is vulnerable; other versions may also be affected.
95. SQL-Ledger/LedgerSMB Insecure User Access Restriction Vulnerability
BugTraq ID: 23352
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23352
Summary:
SQL-Ledger/LedgerSMB is prone to an access-restriction vulnerability beca=
use it fails to adequately implement ACLs (Acess Control Lists) for SQL d=
atabase access.
Exploiting this issue can allow an attacker to compromise the application=
, access or modify data, or exploit latent vulnerabilities in the underly=
ing database implementation.
All versions of SQL-Ledger and LedgerSMB are prone to this issue.
NOTE: This issue is documented in LedgerSMB documentation.
96. Winamp LibSNDFile.DLL Component Remote Code Execution Vulnerability
BugTraq ID: 23351
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23351
Summary:
Winamp is prone to a remote code-execution vulnerability resulting from a=
n off-by-zero memory-corruption error.
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of the user running the application.
Winamp 5.33 is vulnerable; other versions may also be affected.
97. Winamp IN_Mod.DLL Plugin Remote Code Execution Vulnerability
BugTraq ID: 23350
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23350
Summary:
The IN_MOD.DLL plugin for Winamp is prone to a remote code-execution issu=
e because it fails to handle malformed files.
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of the user running the application.
IN_MOD.DLL 5.33 is vulnerable; other versions may also be affected.
98. Firebug Rep.JS Script Code Injection Vulnerability
BugTraq ID: 23349
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23349
Summary:
Firebug is prone to a script-code-injection vulnerability because it fail=
s to adequately escape user-supplied data.
An attacker can exploit this issue to execute arbitrary script code in th=
e context of the application.
Versions prior to 1.04 are vulnerable.
99. WebSpell Picture.PHP Multiple Local File Include Vulnerabilities
BugTraq ID: 23348
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23348
Summary:
WebSPELL is prone to multiple local file-include vulnerabilities because =
the application fails to adequately sanitize user-supplied input.
Exploiting these issues may allow an attacker to access potentially sensi=
tive information that may aid in further attacks.
WebSPELL 4.01.02 and prior versions are vulnerable.
100. ImageMagick DCM XWD Formats Multiple Integer Overflow Vulnerabilitie=
s
BugTraq ID: 23347
Remote: Yes
Last Updated: 2007-04-09
Relevant URL: http://www.securityfocus.com/bid/23347
Summary:
ImageMagick is prone to multiple integer-overflow vulnerabilities because=
it fails to adequately handle user-supplied data.
An attacker can exploit these issues to execute arbitrary code in the con=
text of the application. Failed exploit attempts will likely cause denial=
-of-service conditions.
ImageMagick 6.2.9 through 6.3.3-4 are vulnerable.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Developers warned to secure AJAX design
By: Robert Lemos
A flaw in the way many asynchronous JavaScript and XML (AJAX) frameworks =
use the scripting to communicate data between a server and client allows =
malicious sites to hijack the conversation.
http://www.securityfocus.com/news/11456
2. TJX theft tops 45.6 million card numbers
By: Robert Lemos
In its annual filing to the U.S. Securities and Exchange Commission, the =
retail giant states that it will never be able to fully account for all t=
he data stolen.
http://www.securityfocus.com/news/11455
3. Groups team to test secure-coding skill
By: Robert Lemos
A coalition of security companies and organizations team to create assess=
ment tests to certify programmers knowledge of secure-coding practices.
http://www.securityfocus.com/news/11454
4. Oracle sues rival for hacking, data theft
By: Robert Lemos
The database and enterprise software firm files a lawsuit against competi=
tor SAP claiming that the German firm pilfered an enormous number of docu=
ments and software from Oracle's customer-only support systems.
http://www.securityfocus.com/news/11453
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. [Fwd: Finding License Codes for Re-install]
http://www.securityfocus.com/archive/88/465217
2. Running commands on workstations from domain controller
http://www.securityfocus.com/archive/88/465105
3. blocking thru IE
http://www.securityfocus.com/archive/88/465056
4. SecurityFocus Microsoft Newsletter #336
http://www.securityfocus.com/archive/88/464824
5. Discovering Active Direcory users with blank passwords
http://www.securityfocus.com/archive/88/464483
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!=
"- White Paper=20
Blind SQL Injection can deliver total control of your server to a hacker =
giving them the ability to read, write and=20
manipulate all data stored in your backend systems! Download this *FREE* =
white paper from SPI Dynamics for a=20
complete guide to protection!=20
https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=3D70160000000Cl=
cR