SecurityFocus Newsletter #403
[email protected] 31 May 2007 17:05:09 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #403
----------------------------------------
This Issue is Sponsored by: ByteCrusher
def: "Crunch!"
1. noun - "The pleasing sound of malicious new security threats to y=
our computer splattering against WindowZones protection"
The sad truth is that it takes up to 8 hours for anti-virus companies to =
get off their laurels and fix a new security vulnerability. WindowZones, =
by ByteCrusher Labs, gets there first - preventing infectious bugs from g=
etting in the door to begin with. =20
http://landing.bytecrusher.com/windowzones/sflanding1.aspx?Referrer=3Dsf-=
A21sfWZ-wz1&cm_mmc=3DSecurity%20Focus-_-USA-_-Newsletter-_-Newsletter%3A%=
20Other%3A%20A21%3A%20sfWZ%3A%20wz1
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1. Security Analogies
2. Your Space, My Space, Everybody's Space
II. BUGTRAQ SUMMARY
1. Microsoft Internet Information Server Hit Highlighting Authenti=
cation Bypass Vulnerability
2. WrenSoft Zoom Search Engine Cross-Site Scripting Vulnerability
3. XFree86 Multiple Unspecified Integer Overflow Vulnerabilities
4. Website Generator Multiple Remote Cross Site Scripting Vulnerab=
ilities
5. CPCommerce Manufacturer.PHP SQL Injection Vulnerability
6. Apple QuickTime for Java Unspecified Remote Heap Buffer Overflo=
w Vulnerability
7. PHP Str_Replace() Integer Overflow Vulnerability
8. PHP Printf() Function 64bit Casting Multiple Format String Vuln=
erabilities.
9. Media Technology Group CDPass ActiveX Control Multiple Buffer O=
verflow Vulnerabilities
10. DOMJudge Receive Function Remote Buffer Overflow Vulnerability
11. British Telecommunications Consumer Webhelper Multiple Buffer =
Overflow Vulnerabilities
12. Apache HTTP Server Worker Process Multiple Denial of Service V=
ulnerabilities
13. Geeklog CAPTCHA Plugin _CONF[path] Remote File Include Vulnera=
bility
14. Uebimiau Error.PHP Multiple Input Validation Vulnerabilities
15. DGNews NewsID Parameter SQL Injection Vulnerability
16. LeadTools Raster Dialog File_D Object LTRDF14E.DLL ActiveX Con=
trol Buffer Overflow Vulnerability
17. Avira Antivir Antivirus Multiple Remote Vulnerabilities
18. Fundanemt SpellCheck.PHP Remote Command Execution Vulnerabilit=
y
19. Apple Mac OS X VPND Local Format String Vulnerability
20. Apple Mac OS X 2007-005 Multiple Security Vulnerabilities
21. Sun Solaris INETD(1M) Local Denial of Service Vulnerability
22. Sun Solaris IKED(1M) Denial of Service Vulnerability
23. MIT Kerberos 5 KAdminD Server Stack Buffer Overflow Vulnerabil=
ity
24. XOOPS ResManager Module Edit_day.PHP SQL Injection Vulnerabili=
ty
25. UltraISO Cue File Stack Buffer Overflow Vulnerability
26. InGate Firewall And SIParator Multiple Unspecified Vulnerabili=
ties
27. Apache HTTP Server Multiple Vulnerabilities
28. Mozilla Firefox Resource Directory Traversal Vulnerability
29. Mozilla Products Multiple Remote Vulnerabilities
30. Mozilla FireFox FTP PASV Port-Scanning Vulnerability
31. APOP Protocol Insecure MD5 Hash Weakness
32. Mozilla Firefox Document.Cookie Path Argument Denial of Servic=
e Vulnerability
33. Mozilla Firefox Popup Blocker Cross Zone Security Bypass Weakn=
ess
34. Apache Tomcat JK Connector Double Encoding Security Bypass Vul=
nerability
35. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vuln=
erability
36. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerabil=
ity
37. Adobe Flash Player Plugin HTTP Header Injection Weakness
38. Net-SNMP Unspecified Remote Stream-Based Protocol Denial Of Se=
rvice Vulnerability
39. HP-UX IPCS Core File Buffer Overflow Vulnerability
40. SunOS /usr/lib/lpd Arbitrary File Deletion Vulnerability
41. Vizayn Urun Tanitim Sistemi Default.ASP SQL Injection Vulnerab=
ility
42. RPC Portmapper Denial of Sevice Vulnerability
43. Sun Java System Messenger Express Cross-Site Scripting Vulnera=
bility
44. Xine DirectShow Loader Remote Buffer Overflow Vulnerability
45. MPlayer DMO File Parsing Buffer Overflow Vulnerability
46. F-Secure Multiple Products Real-time Scanning Component Local =
Privilege Escalation Vulnerability
47. Particle Gallery Search.PHP Cross-Site Scripting Vulnerability
48. Multiple Vendor e-commerce Shopping Cart Information Disclosur=
e Vulnerability
49. Netopia R9100 Router Denial of Service Vulnerability
50. F-Secure Anti-Virus LHA Processing Buffer Overflow Vulnerabili=
ty
51. Multiple F-Secure Products Packed Executables and Archives Den=
ial of Service Vulnerability
52. F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vul=
nerability
53. Sun Java Web Proxy Server Multiple Buffer Overflow Vulnerabili=
ties
54. Particle Blogger Archives.PHP SQL Injection Vulnerability
55. British Telecommunications Webhelper Multiple Buffer Overflow =
Vulnerabilities
56. LeadTools Raster ISIS Object LTRIS14e.DLL ActiveX Control Buff=
er Overflow Vulnerability
57. LeadTools Raster Document Object Library LTRDC14E.DLL ActiveX =
Control Buffer Overflow Vulnerability
58. SCO OpenServer Auditsh HOME Environment Variable Buffer Overfl=
ow Vulnerability
59. Ademco ATNBaseLoader100 ActiveX Control Buffer Overflow Vulner=
ability
60. Dart Zip Compression DartZip.DLL ActiveX Control Buffer Overfl=
ow Vulnerability
61. 3com Switches Backdoor Vulnerability
62. Dart Communications PowerTCP Service DartService.DLL ActiveX C=
ontrol Buffer Overflow Vulnerabilities
63. LeadTools Raster Dialog File Object LTRDF14E.DLL ActiveX Contr=
ol Buffer Overflow Vulnerability
64. Microsoft Office 2000 UA OUACTRL.OCX ActiveX Control Buffer Ov=
erflow Vulnerability
65. AdminBot-MX Live_Status.Lib.PHP Remote File Include Vulnerabil=
ity
66. Sky Software Shell MegaPack ActiveX ShComboBox ActiveX Control=
Buffer Overflow Vulnerability
67. Dart ZipLite Compression DartZipLite.DLL ActiveX Control Buffe=
r Overflow Vulnerability
68. LeadTools ISIS Control Ltisi14E.OCX ActiveX Control Buffer Ove=
rflow Vulnerability
69. EDraw Office Viewer Component ActiveX Control Arbitrary File D=
elete Vulnerability
70. CesarFTP Remote CWD Denial of Service Vulnerability
71. KSign KSignSWAT ActiveX Control Multiple Buffer Overflow Vulne=
rabilities
72. Pegasus ImagN ActiveX Control IMW32O40.OCX Buffer Overflow Vul=
nerability
73. Alt-N MDaemon Mail Relaying Vulnerability
74. LeadTools Raster Object Library LTRTM14e.DLL ActiveX WriteData=
ToFile File Overwrite Vulnerability
75. LeadTools Raster Object Library LTRTM14e.DLL ActiveX Control B=
uffer Overflow Vulnerability
76. DotClear Unspecified Trackback Vulnerability
77. LeadTools Thumbnail Browser ActiveX Control LTTMB14E.OCX Buffe=
r Overflow Vulnerability
78. LeadTools JPEG2000 ActiveX Control Buffer Overflow Vulnerabili=
ty
79. PHPWCMS Multiple Remote File Include Vulnerabilities
80. PrecisionID Barcode PrecisionID_Barcode.DLL ActiveX Control Bu=
ffer Overflow Vulnerability
81. Windy Road Vistered Little Theme Skin Parameter Directory Trav=
ersal Vulnerability
82. EDraw Office Viewer Component EDrawOfficeViewer.OCX ActiveX Co=
ntrol Buffer Overflow Vulnerability
83. Zenturi ProgramChecker SASATL.DLL ActiveX Control Multiple Buf=
fer Overflow Vulnerabilities
84. Apple Quicktime For Java Variant Information Disclosure Vulner=
ability
85. File Multiple Denial of Service Vulnerabilities
86. Trolltech QT UTF-8 Sequences Input Validation Vulnerability
87. FileCloset Unspecified Arbitrary File Upload Vulnerability
88. XFSDump XFS_FSR Insecure Temporary File Creation Vulnerability
89. Quagga BGPD UPDATE Message Remote Denial Of Service Vulnerabil=
ity
90. PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass=
Vulnerability
91. PHP PHP_Binary Heap Information Leak Vulnerability
92. PHP Hash Table Overwrite Arbitrary Code Execution Vulnerabilit=
y
93. PHP Session Data Deserialization Arbitrary Code Execution Vuln=
erability
94. PHP ZVAL Reference Counter Integer Overflow Vulnerability
95. Pheap Config.PHP Pheap_Login Authentication Bypass Vulnerabili=
ty
96. PHP Ini_Restore() Safe_Mode and Open_Basedir Restriction Bypas=
s Vulnerability
97. Algorithmic Research PrivateWire Online Registration Remote Bu=
ffer Overflow Vulnerability
98. Multiple Vendor TCP Packet Fragmentation Handling Denial Of Se=
rvice Vulnerability
99. SalesCart Shopping Cart Reorder2.ASP Multiple SQL Injection Vu=
lnerabilities
100. Apple Mac OS X 10.3.5 Released - Multiple Vulnerabilities Fix=
ed
III. SECURITYFOCUS NEWS
1. Insecure plug-ins pose danger to Firefox users
2. Peer-to-peer networks co-opted for DOS attacks
3. "Data storm" blamed for nuclear-plant shutdown
4. Experts scramble to quash IPv6 flaw
IV. SECURITY JOBS LIST SUMMARY
V. INCIDENTS LIST SUMMARY
1. Survey on Supercomputer Cluster Security
VI. VULN-DEV RESEARCH LIST SUMMARY
1. Help developing exploit
VII. MICROSOFT FOCUS LIST SUMMARY
1. Reconstruction of MS terminal services sessions
2. SecurityFocus Microsoft Newsletter #343
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
1. Survey on Supercomputer Cluster Security
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. Security Analogies
By Scott Granneman
Scott Granneman discusses security analogies and their function in educat=
ing the masses on security concepts.
http://www.securityfocus.com/columnists/445
2. Your Space, My Space, Everybody's Space
By Mark Rasch
Privacy is about protecting data when somebody wants it for some purpose.=
It is easy to protect data that nobody wants.
http://www.securityfocus.com/columnists/444
II. BUGTRAQ SUMMARY
--------------------
1. Microsoft Internet Information Server Hit Highlighting Authentication =
Bypass Vulnerability
BugTraq ID: 24105
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24105
Summary:
Microsoft IIS is prone to an authentication-bypass vulnerability due to i=
ts implementation of 'Hit-highlighting' functionality.
Attackers can exploit this issue to access private files hosted on an IIS=
website. Successful exploits may allow attackers to gain access to poten=
tially sensitive information. Other attacks are possible.
NOTE: Presumably, accessing a Trusted Zone may allow attackers to execute=
commands; this has not been confirmed.
2. WrenSoft Zoom Search Engine Cross-Site Scripting Vulnerability
BugTraq ID: 8823
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/8823
Summary:
WrenSoft Zoom Search Engine is prone to a cross-site scripting issue in t=
he software's search module. A remote attacker may be able to execute HTM=
L or script code in a user's browser. =20
=20
The problem occurs because the software fails to properly sanitize user-s=
upplied input. An attacker may be able to a construct a malicious link co=
ntaining HTML or script code that may be rendered in a user's browser upo=
n visiting that link. This attack would occur in the security context of =
the vulnerable site.
3. XFree86 Multiple Unspecified Integer Overflow Vulnerabilities
BugTraq ID: 8514
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/8514
Summary:
Multiple integer-overflow vulnerabilities have been discovered in the XFr=
ee86 font libraries. The problem occurs because of insufficient sanity ch=
ecks on integers passed to clients from an X font server. As a result, an=
unexpected buffer overrun may occur within the stack or heap space of pr=
ocess memory. An attacker could potentially exploit this to execute arbit=
rary code within a target X client.=20
=20
Precise technical details regarding these vulnerabilities are currently u=
navailable; as further information is released, this BID will be updated =
accordingly.
4. Website Generator Multiple Remote Cross Site Scripting Vulnerabilities
BugTraq ID: 14338
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/14338
Summary:
Website Generator is prone to multiple cross-site scripting vulnerabiliti=
es.=20
=20
An attacker may leverage any of these issues to execute arbitrary script =
code in the browser of an unsuspecting user in the context of the affecte=
d site. This may help the attacker steal cookie-based authentication cred=
entials and launch other attacks.
5. CPCommerce Manufacturer.PHP SQL Injection Vulnerability
BugTraq ID: 24223
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24223
Summary:
cpCommerce is prone to an SQL-injection vulnerability because it fails to=
sufficiently sanitize user-supplied data before using it in an SQL query=
.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
cpCommerce 1.1.0 is reported vulnerable; other versions may also be affec=
ted.
6. Apple QuickTime for Java Unspecified Remote Heap Buffer Overflow Vulne=
rability
BugTraq ID: 24221
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24221
Summary:
Apple QuickTime for Java is prone to a remote heap-based buffer-overflow =
vulnerability because the application fails to properly bounds-check user=
-supplied input prior to copying it to an insufficiently sized buffer.
Exploiting this issue allows remote attackers to execute arbitrary machin=
e code in the context of the affected application, facilitating the remot=
e compromise of affected computers. Failed exploit attempts will result i=
n a denial of service.
7. PHP Str_Replace() Integer Overflow Vulnerability
BugTraq ID: 23233
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23233
Summary:
PHP is prone to an integer-overflow vulnerability because it fails to ens=
ure that integer values aren't overrun. Attackers may exploit this issue =
to cause a buffer-overflow and corrupt process memory.
Exploiting this issue may allow attackers to execute arbitrary machine co=
de in the context of the affected application. Failed exploit attempts wi=
ll likely result in a denial-of-service condition.
This issue affects PHP versions prior to 4.4.5 and 5.2.1.
8. PHP Printf() Function 64bit Casting Multiple Format String Vulnerabili=
ties.
BugTraq ID: 23219
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23219
Summary:
PHP is prone to multiple format-string vulnerabilities due to a design er=
ror when casting 64-bit variables to 32 bits.
Attackers may be able to exploit these issues to execute arbitrary code i=
n the context of the webserver process or to cause denial-of-service cond=
itions.
These issues affect PHP versions prior to 4.4.5 and 5.2.1 running on 64-b=
it computers.
9. Media Technology Group CDPass ActiveX Control Multiple Buffer Overflow=
Vulnerabilities
BugTraq ID: 24220
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24220
Summary:
CDPass ActiveX control is prone to multiple stack-based buffer-overflow v=
ulnerabilities because the application fails to bounds-check user-supplie=
d data before copying it into an insufficiently sized buffer.=20
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application using the ActiveX control=
(typically Internet Explorer). Failed exploit attempts likely result in =
denial-of-service conditions.
10. DOMJudge Receive Function Remote Buffer Overflow Vulnerability
BugTraq ID: 24218
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24218
Summary:
DOMjudge is prone to a buffer-overflow vulnerability because it fails to =
adequately bounds-check user-supplied data before copying it to an insuff=
iciently sized memory buffer.
An attacker may exploit this issue by enticing victims into opening a mal=
icious email link.
Successful exploits may allow attackers to execute arbitrary code in the =
context of the application. Failed attempts may cause denial-of-service c=
onditions.
This issue affects versions of DOMjudge prior to 2.0.0 RC1.
11. British Telecommunications Consumer Webhelper Multiple Buffer Overflo=
w Vulnerabilities
BugTraq ID: 24219
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24219
Summary:
The British Telecommunications Consumer Webhelper ActiveX control is pron=
e to multiple buffer-overflow vulnerabilities because the application fai=
ls to bounds-check user-supplied data before copying it into an insuffici=
ently sized buffer.=20
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application using the ActiveX control=
(typically Internet Explorer). Failed exploit attempts likely result in =
denial-of-service conditions.
Versions of British Telecommunications Consumer Webhelper ActiveX Control=
prior to 2.0.0.8 are vulnerable to these issues.
12. Apache HTTP Server Worker Process Multiple Denial of Service Vulnerab=
ilities
BugTraq ID: 24215
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24215
Summary:
Apache is prone to multiple denial-of-service vulnerabilities.
An attacker with the ability to execute arbitrary server-side script-code=
can exploit these issues to stop arbitrary services on the affected comp=
uter in the context of the master webserver process; other attacks may al=
so be possible.
13. Geeklog CAPTCHA Plugin _CONF[path] Remote File Include Vulnerability
BugTraq ID: 24214
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24214
Summary:
The Geeklog CAPTCHA plugin is prone to a remote file-include vulnerabilit=
y because it fails to sufficiently sanitize user-supplied input.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
This issue affects Geeklog CAPTCHA 2.1.1; prior versions may also be affe=
cted.
14. Uebimiau Error.PHP Multiple Input Validation Vulnerabilities
BugTraq ID: 24210
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24210
Summary:
Uebimiau is prone to multiple input-validation vulnerabilities, including=
cross-site scripting issues and an information-disclosure issue, because=
the application fails to properly sanitize user-supplied input.
Attackers can exploit these issues to steal cookie-based authentication c=
redentials, to control how the site is rendered to the user, or to gain a=
ccess to information that could aid in further attacks.
Uebimiau 2.7.2 and 2.7.10 are vulnerable; other versions may also be affe=
cted.
15. DGNews NewsID Parameter SQL Injection Vulnerability
BugTraq ID: 24212
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24212
Summary:
DGNews is prone to an SQL-injection vulnerability because the application=
fails to properly sanitize user-supplied input before using it in an SQL=
query.=20
Successful exploits could allow an attacker to compromise the application=
, access or modify data, or exploit vulnerabilities in the underlying dat=
abase.
DGNews 2.1 is reported vulnerable; other versions may also be affected.
16. LeadTools Raster Dialog File_D Object LTRDF14E.DLL ActiveX Control Bu=
ffer Overflow Vulnerability
BugTraq ID: 24153
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24153
Summary:
LEADTOOLS Raster Dialog File_D Object Library ActiveX control is prone to=
a buffer-overflow vulnerability because the application fails to bounds-=
check user-supplied data before copying it into an insufficiently sized b=
uffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
Raster Dialog File_D Object 14.5.0.44 is vulnerable to this issue; other =
versions may also be affected.
17. Avira Antivir Antivirus Multiple Remote Vulnerabilities
BugTraq ID: 24187
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24187
Summary:
Avira Antivir Antivirus is prone to multiple remote vulnerabilities.
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary machine code with elevated privileges, facilitating the complete=
compromise of affected computers. Attackers may also trigger denial-of-s=
ervice conditions by crashing the application or causing infinite loops.
These issues affect:
Avira Antivir AVPack versions prior to 7.03.00.09
Engine versions prior to 7.04.00.24
18. Fundanemt SpellCheck.PHP Remote Command Execution Vulnerability
BugTraq ID: 24185
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24185
Summary:
Fundanemt is prone to a remote command-execution vulnerability because it=
fails to sufficiently sanitize user-supplied input.=20
An Attacker can exploit this issue to execute arbitrary system commands w=
ith the privileges of the webserver process.
This issue affects Fundanemt 2.2.0 and prior versions.
19. Apple Mac OS X VPND Local Format String Vulnerability
BugTraq ID: 24208
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24208
Summary:
Apple Mac OS X's VPN service daemon is prone to a format-string vulnerabi=
lity because it fails to properly sanitize user-supplied input before pas=
sing it as the format specifier to a formatted-printing function.
Attackers may exploit this issue to crash the application or execute arbi=
trary code with superuser privileges. Successful exploits can result in =
a complete compromise of vulnerable computers.
Apple Mac OS X Server 10.4.9 and prior versions are vulnerable to this is=
sue.
This issue was originally included in BID 24144 (Apple Mac OS X 2007-005 =
Multiple Security Vulnerabilities), but has been given its own record.
20. Apple Mac OS X 2007-005 Multiple Security Vulnerabilities
BugTraq ID: 24144
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24144
Summary:
Apple Mac OS X is prone to multiple security vulnerabilities.
These issues affect Mac OS X and various applications, including Alias Ma=
nager, CoreGraphics, crontabs, iChat, and PPP.
Attackers may exploit these issues to execute arbitrary code, trigger den=
ial-of-service conditions, escalate privileges, and potentially compromis=
e vulnerable computers. Both local and remote vulnerabilities are present=
.
Apple Mac OS X 10.4.9 and prior versions are vulnerable to these issues.
21. Sun Solaris INETD(1M) Local Denial of Service Vulnerability
BugTraq ID: 24213
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24213
Summary:
Sun Solaris inetd(1M) is prone to a local denial-of-service vulnerability=
.
An attacker can exploit this issue to disable the inetd daemon, resulting=
in denial-of-service conditions.
22. Sun Solaris IKED(1M) Denial of Service Vulnerability
BugTraq ID: 24209
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24209
Summary:
The 'in.iked' service for Sun Solaris is prone to a denial-of-service vul=
nerability because the application fails to handle exceptional conditions=
.=20
An attacker can exploit this issue to crash the affected service, denying=
service to legitimate users.
23. MIT Kerberos 5 KAdminD Server Stack Buffer Overflow Vulnerability
BugTraq ID: 23285
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23285
Summary:
Kerberos 5 kadmind (Kerberos Administration Daemon) server is prone to a =
stack-based buffer-overflow vulnerability because the software fails to a=
dequately bounds-check user-supplied data before copying it to an insuffi=
ciently sized buffer.
An attacker can exploit this issue to execute arbitrary code with adminis=
trative privileges. A successful attack can result in the complete compro=
mise of the application. Failed attempts will likely result in denial-of-=
service conditions.
All kadmind servers run on the master Kerberos server. Since the master =
server holds the KDC principal and policy database, an attack may not on=
ly compromise the affected computer, but could also compromise multiple =
hosts that use the server for authentication.
Kerberos 5 kadmind 1.6 and prior versions are vulnerable.
24. XOOPS ResManager Module Edit_day.PHP SQL Injection Vulnerability
BugTraq ID: 23997
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23997
Summary:
XOOPS 'resmanager' module is prone to an SQL-injection vulnerability beca=
use it fails to sufficiently sanitize user-supplied data before using it =
in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects 'resmanager' 1.21; other versions may also be affected=
.
25. UltraISO Cue File Stack Buffer Overflow Vulnerability
BugTraq ID: 24140
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24140
Summary:
UltraISO is prone to a remote stack-based buffer-overflow vulnerability b=
ecause it fails to adequately bounds-check user-supplied data before copy=
ing it to an insufficiently sized memory buffer.=20
Successful exploits may allow attackers to execute arbitrary code with th=
e privileges of the affected application. Failed exploit attempts will li=
kely result in denial-of-service conditions.
UltraISO 8.6.2.2011 is vulnerable; other versions may also be affected.
26. InGate Firewall And SIParator Multiple Unspecified Vulnerabilities
BugTraq ID: 24207
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24207
Summary:
Ingate Firewall and SIParator are prone to multiple unspecified vulnerabi=
lities.
An attacker may gain access to sensitive information and bypass SIP authe=
ntication requirements.
Very few details are available at this time. We will update this BID as m=
ore information emerges.
Versions prior to 4.5.2 are vulnerable.
27. Apache HTTP Server Multiple Vulnerabilities
BugTraq ID: 8226
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/8226
Summary:
Apache is vulnerable to multiple vulnerabilities, including denial-of-ser=
vice issues, file-descriptor leakage, and logging failures.
Apache HTTP Server 1.3.28 has been released in response to these issues.
28. Mozilla Firefox Resource Directory Traversal Vulnerability
BugTraq ID: 24191
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24191
Summary:
Mozilla Firefox is prone to a directory-traversal vulnerability because i=
t fails to adequately sanitize user-supplied data.
An attacker can exploit this issue to access arbitrary files on an unsusp=
ecting user's computer. Successful exploits can expose potentially sensit=
ive information that could aid in further attacks.
Firefox 2.0.0.3 and prior versions are vulnerable.
29. Mozilla Products Multiple Remote Vulnerabilities
BugTraq ID: 24242
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24242
Summary:
The Mozilla Foundation has released six security advisories specifying vu=
lnerabilities in Firefox, SeaMonkey, and Thunderbird.
These vulnerabilities allow attackers to:
- Execute arbitrary code
- Cause denial-of-service conditions
- Perform cross-site scripting attacks
- Obtain potentially sensitive information
- Spoof legitimate content
Other attacks may also be possible.
30. Mozilla FireFox FTP PASV Port-Scanning Vulnerability
BugTraq ID: 23082
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/23082
Summary:
Mozilla Firefox is prone to vulnerability that may allow attackers to obt=
ain potentially sensitive information.
A successful exploit of this issue would cause the affected application=
to connect to arbitrary TCP ports and potentially reveal sensitive infor=
mation about services that are running on the affected computer. Informat=
ion obtained may aid attackers in further attacks.
31. APOP Protocol Insecure MD5 Hash Weakness
BugTraq ID: 23257
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/23257
Summary:
Applications that implement the APOP protocol may be vulnerable to a pass=
word-hash weakness. This issue occurs because the MD5 hash algorithm fail=
s to properly prevent collisions.
Attackers may exploit this issue in man-in-the-middle attacks to potentia=
lly gain access to the first three characters of passwords. This will inc=
rease the likelihood of successful brute-force attacks against APOP authe=
ntication.
To limit the possibility of successful exploits, applications that implem=
ent the APOP protocol should set up safeguards to ensure that message IDs=
are RFC-compliant.
Mozilla Thunderbird, Evolution, mutt, and fetchmail are reportedly affect=
ed by this issue.
32. Mozilla Firefox Document.Cookie Path Argument Denial of Service Vulne=
rability
BugTraq ID: 22879
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22879
Summary:
Mozilla Firefox is prone to a remote denial-of-service vulnerability.=20
An attacker may exploit this vulnerability to cause Mozilla Firefox to cr=
ash, resulting in denial-of-service conditions.=20
Little is known regarding this vulnerability; this BID will be updated wh=
en more information is disclosed.
=20
Mozilla Firefox 2.0.0.2 is prone to this issue; other versions may also b=
e affected.
Attackers may be able to bypass cookie domain and path restrictions, but =
this has not been confirmed.
33. Mozilla Firefox Popup Blocker Cross Zone Security Bypass Weakness
BugTraq ID: 22396
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22396
Summary:
Mozilla Firefox is prone to a cross-zone security-bypass weakness. This i=
ssue allows attackers to open 'file://' URIs from remote websites.
By exploiting this issue in conjunction with other weaknesses or vulnerab=
ilities, attackers may be able to execute arbitrary script code with the =
elevated privileges that are granted to scripts when they are executed fr=
om local sources.
Mozilla Firefox 1.5.0.9 is affected by this issue; other versions may be =
affected as well.
34. Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerabil=
ity
BugTraq ID: 24147
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24147
Summary:
Apache HTTP server running with the Tomcat JK Web Server Connector is pro=
ne to a security-bypass vulnerability because it decodes request URLs mul=
tiple times.
Exploiting this issue allows attackers to access restricted files in the =
Tomcat web directory. This can expose sensitive information that could he=
lp attackers launch further attacks.
This issue is present in versions of Apache Tomcat JK Connector prior to =
1.2.23.
35. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerabili=
ty
BugTraq ID: 24074
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24074
Summary:
FreeType is prone to an integer-overflow vulnerability because it fails t=
o properly validate TTF files.
An attacker may exploit this issue by enticing victims into opening malic=
iously crafted TTF Files.
Successful exploits will allow attackers to execute arbitrary code in the=
context in the context of applications that use the affected library. Fa=
iled exploit attempts will likely result in denial-of-service conditions.
This issue affects FreeType 2.3.4 and prior versions.
36. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerability
BugTraq ID: 22231
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22231
Summary:
ISC BIND is prone to a remote denial-of-service vulnerability because the=
application fails to properly handle malformed DNSSEC validation request=
s.
Successfully exploiting this issue allows remote attackers to crash affec=
ted DNS servers, denying further service to legitimate users.
37. Adobe Flash Player Plugin HTTP Header Injection Weakness
BugTraq ID: 20592
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/20592
Summary:
Adobe Flash Player Plugin is prone to a weakness that permits the injecti=
on of arbitrary HTTP headers because it fails to sanitize user-supplied i=
nput.
A successful attack may allow attackers to perform arbitrary HTTP request=
s facilitating cross-site request forgery, cross-site scripting, HTTP req=
uest smuggling, and other attacks.=20
Since this weakness would typically be used as one component in a larger =
attack scenario, the consequences of an attack will depend on the vulnera=
bilities exploited along with this weakness.
Version 9.0.16 for Windows and 7.0.63 for Linux are affected by this issu=
e.
38. Net-SNMP Unspecified Remote Stream-Based Protocol Denial Of Service V=
ulnerability
BugTraq ID: 14168
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/14168
Summary:
Net-SNMP is prone to a remote denial-of-service vulnerability. The issue =
is exposed when Net-SNMP is configured to have an open stream-based proto=
col port, such as TCP.=20
The exact details describing this issue are not available. This BID will =
be updated when more information emerges.
39. HP-UX IPCS Core File Buffer Overflow Vulnerability
BugTraq ID: 7216
Remote: No
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/7216
Summary:
The HP-UX 'ipcs' utility is prone to a locally exploitable buffer-overflo=
w condition because the software fails to properly bounds-check core file=
names. This utility may be installed setgid 'sys' on vulnerable systems;=
attackers may exploit this issue to gain these privileges.=20
=20
This issue was reported with 'ipcs' on HP-UX 11.00; other versions are al=
so likely affected.
40. SunOS /usr/lib/lpd Arbitrary File Deletion Vulnerability
BugTraq ID: 25
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/25
Summary:
SunOS LPD is prone to a vulnerability that can can allow attackers to del=
ete arbitrary system files.
These issues are Sun Bug IDs 1040453 and 1057834.
41. Vizayn Urun Tanitim Sistemi Default.ASP SQL Injection Vulnerability
BugTraq ID: 24238
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24238
Summary:
Vizayn Urun Tanitim Sistemi is prone to an SQL-injection vulnerability be=
cause it fails to sufficiently sanitize user-supplied data before using i=
t in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
This issue affects Vizayn Urun Tanitim Sistemi 0.2; other versions may al=
so be affected.
42. RPC Portmapper Denial of Sevice Vulnerability
BugTraq ID: 1892
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/1892
Summary:
A remote root vulnerability exists in certain versions of rpcbind portmap=
per.=20
RPC (Remote Procedure Call) allows a program to request a service from a=
program located in another computer in a network without requiring detai=
led information on the network configuration.
An attacker capable of forging a pmap_set/pmap_unset udp packet can caus=
e the remote host to register or unregister arbitrary RPC programs.
This can permit an attacker to carry out a denial of services by disabli=
ng key services on the target host, including mountd, nfsd and ypserv.
Because it allows a malicious local user to register rpc programs on the=
server, depending on the program the attacker chooses to register, this =
vulnerability can allow a compromise of root privilege, potentially exten=
ding to other systems on the local network.
In addition to the affected platforms listed, other versions have yet to =
be tested, and may be vulnerable as well.
43. Sun Java System Messenger Express Cross-Site Scripting Vulnerability
BugTraq ID: 20832
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/20832
Summary:
Sun Java System Messenger Express is prone to a cross-site scripting vuln=
erability because the application fails to properly sanitize user-supplie=
d input.=20
An attacker may leverage this issue to have arbitrary script code execute=
in the browser of an unsuspecting user in the context of the affected si=
te. This may help the attacker steal cookie-based authentication credenti=
als and launch other attacks.
Specific information regarding affected versions of Sun Java System Messe=
nger Express is not currently available; this BID will be updated as more=
information is disclosed.
44. Xine DirectShow Loader Remote Buffer Overflow Vulnerability
BugTraq ID: 22933
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22933
Summary:
Xine is prone to a remote buffer-overflow vulnerability because the appli=
cation fails to perform boundary checks before copying user-supplied inpu=
t into finite-sized buffers.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary machine code in the context of the application and to compromise a=
ffected computers.
45. MPlayer DMO File Parsing Buffer Overflow Vulnerability
BugTraq ID: 22771
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22771
Summary:
MPlayer is prone to a buffer-overflow vulnerability when it attempts to p=
rocess malformed video files. This issue occurs because the application f=
ails to perform proper bounds-checking on user-supplied data before copyi=
ng it to an insufficiently sized memory buffer.
An attacker may exploit this issue to execute arbitrary code with the pri=
vileges of the user that activated the vulnerable application. This may f=
acilitate unauthorized access or privilege escalation.
MPlayer 1.0rc1 is vulnerable to this issue; previous versions may also be=
affected.
46. F-Secure Multiple Products Real-time Scanning Component Local Privile=
ge Escalation Vulnerability
BugTraq ID: 24237
Remote: No
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24237
Summary:
Multiple F-Secure workstation and file-server products are prone to a loc=
al privilege-escalation vulnerability.
=20
Exploiting this vulnerability allows local attackers to gain superuser or=
SYSTEM-level privileges, leading to a complete compromise of the affecte=
d computer.
47. Particle Gallery Search.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 24236
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24236
Summary:
Particle Gallery is prone to a cross-site scripting vulnerability because=
the application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.
This issue affects Particle Gallery 1.0.1 and prior versions.
48. Multiple Vendor e-commerce Shopping Cart Information Disclosure Vulne=
rability
BugTraq ID: 2299
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/2299
Summary:
The affected packages may not have been properly configured and maintaine=
d. As a result, an attacker exploiting this vulnerability will be able t=
o obtain detailed private customer information, including credit card num=
bers, order details, addresses, telephone numbers, etc.
49. Netopia R9100 Router Denial of Service Vulnerability
BugTraq ID: 2287
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/2287
Summary:
The Netopia R9100 Router, running firmware version 4.6, is vulnerable to=
a denial of service attack. Subsequent (and current) versions of the pr=
oduct are not vulnerable.=20
=20
Under very specific circumstances, it is possible to cause the affected r=
outer to halt. By attempting to make a looped connection from the router=
's IP address back to the same address, the unit will crash.=20
=20
This prevents user disconnect logging and may assist the attacker in carr=
ying out further attacks on the affected host or other systems on its net=
work.
50. F-Secure Anti-Virus LHA Processing Buffer Overflow Vulnerability
BugTraq ID: 24235
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24235
Summary:
Multiple F-Secure Anti-Virus applications are prone to a buffer-overflow =
vulnerability when they process certain files. This issue occurs because =
the applications fail to properly check boundaries on user-supplied data =
before copying it to an insufficiently sized memory buffer.
Successful exploits can allow attackers to execute arbitrary code with th=
e privileges of the vulnerable application. Failed exploit attempts will =
likely result in denial-of-service conditions.
51. Multiple F-Secure Products Packed Executables and Archives Denial of =
Service Vulnerability
BugTraq ID: 24234
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24234
Summary:
Multiple F-Secure products are prone to a denial-of-service vulnerability=
because the software fails to handle exceptional conditions.=20
An attacker can exploit this issue to cause a denial-of-service conditon.
52. F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vulnerabil=
ity
BugTraq ID: 24233
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24233
Summary:
F-Secure Policy Manager is prone to a remote denial-of-service vulnerabil=
ity because the application fails to propelry handle unexpected condition=
s.
Exploiting this issue allows remote attackers to crash affected applicati=
ons, denying further service to legitimate users. The vendor states that =
this application is typically available only to internal networks, making=
remote exploits over the Internet less likely.
Versions of F-Secure Policy Manager prior to 7.01 are vulnerable.
53. Sun Java Web Proxy Server Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 24165
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24165
Summary:
Sun Java System Web Proxy Server is prone to multiple buffer-overflow vul=
nerabilities because the application fails to bounds-check user-supplied =
data before copying it into an insufficiently sized buffer.=20
An attacker can exploit these issues to execute arbitrary code with super=
user privileges, leading to the complete compromise of affected computers=
. Failed exploit attempts will result in a denial of service.
These issues affect Web Proxy Server 4.0.3; prior versions may also be af=
fected.
54. Particle Blogger Archives.PHP SQL Injection Vulnerability
BugTraq ID: 24232
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24232
Summary:
Particle Blogger is prone to an SQL-injection vulnerability because it fa=
ils to sufficiently sanitize user-supplied data before using it in an SQL=
query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
55. British Telecommunications Webhelper Multiple Buffer Overflow Vulnera=
bilities
BugTraq ID: 24216
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24216
Summary:
The British Telecommunications Webhelper ActiveX control is prone to mult=
iple buffer-overflow vulnerabilities because the application fails to bou=
nds-check user-supplied data before copying it into an insufficiently siz=
ed buffer.=20
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application using the ActiveX control=
(typically Internet Explorer). Failed exploit attempts likely result in =
denial-of-service conditions.
Versions of British Telecommunications Webhelper ActiveX Control prior to=
1.0.0.7 are vulnerable to these issues.
56. LeadTools Raster ISIS Object LTRIS14e.DLL ActiveX Control Buffer Over=
flow Vulnerability
BugTraq ID: 24193
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24193
Summary:
LEADTOOLS Raster ISIS ActiveX control is prone to a buffer-overflow vulne=
rability because the application fails to bounds-check user-supplied data=
before copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
LEADTOOLS ISIS ActiveX control 14.5.0.44 is vulnerable to this issue; oth=
er versions may also be affected.
57. LeadTools Raster Document Object Library LTRDC14E.DLL ActiveX Control=
Buffer Overflow Vulnerability
BugTraq ID: 24179
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24179
Summary:
LEADTOOLS Raster OCR Document Object Library ActiveX control is prone to =
a buffer-overflow vulnerability because the application fails to bounds-c=
heck user-supplied data before copying it into an insufficiently sized bu=
ffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
LEADTOOLS Raster OCR Document Object Library ActiveX control 14.5.0.44 is=
vulnerable to this issue; other versions may also be affected.
58. SCO OpenServer Auditsh HOME Environment Variable Buffer Overflow Vuln=
erability
BugTraq ID: 13062
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/13062
Summary:
The SCO OpenServer auditsh application is affected by a local buffer over=
flow vulnerability. =20
=20
This issue presents itself when the affected application handles the HOME=
environment variable.
59. Ademco ATNBaseLoader100 ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24172
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24172
Summary:
Ademco ATNBaseLoader100 ActiveX control is prone to a buffer-overflow vul=
nerability because the application fails to bounds-check user-supplied da=
ta before copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
Ademco ATNBaseLoader100 ActiveX control 5.4.0.6 is vulnerable to this iss=
ue; other versions may also be affected.
60. Dart Zip Compression DartZip.DLL ActiveX Control Buffer Overflow Vuln=
erability
BugTraq ID: 24163
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24163
Summary:
Dart Zip Compression for ActiveX is prone to a buffer-overflow vulnerabil=
ity because the application fails to bounds-check user-supplied data befo=
re copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
Dart Zip Compression for ActiveX 1.8.5.3 is vulnerable to this issue; oth=
er versions may also be affected.
NOTE: Due to code reuse, this issue is similar or possibly identical to t=
he one described in BID 24099 (Dart ZipLite Compression DartZipLite.DLL A=
ctiveX Control Buffer Overflow Vulnerability). This has not been confirme=
d.
61. 3com Switches Backdoor Vulnerability
BugTraq ID: 88
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/88
Summary:
There exists an undocumented access level in current (and possibly previo=
us) versions of 3Com's "intelligent" and "extended" switching software fo=
r LanPlex/Corebuilder switches. In addition to the "admin", "read", and =
"write" accounts, there is a "debug" account with a password of "synnet" =
on shipped images (including those available for download from infodeli.3=
com.com). The versions of firmware this was tested under include 7.0.1 an=
d 8.1.1. =20
=20
The debug account has all the privileges of the admin account plus some =
debugging commands not available to any other ID. They can change all the=
other access password without knowing the old password. In addition, the=
y can get to the "underlying OS shell".=20
=20
If you allow "remote administration" (telnet access), an attacker can obt=
ain full control of your switches.=20
=20
Yes:=20
LanPlex/Corebuilder 2500s (SW 7.x and 8.x)=20
Corebuilder 3500 (ver 1.0.0)=20
3Com LANplex 2500 (rev 7.15) with Version 7.0.1-19 - Built 01/17/97 02:4=
1:17 PM=20
LinkSwitch=20
=20
No:=20
Superstack II=20
LinkSwitch=20
FMS-II Superstack Hub P/N 3c16630a
62. Dart Communications PowerTCP Service DartService.DLL ActiveX Control =
Buffer Overflow Vulnerabilities
BugTraq ID: 24142
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24142
Summary:
Dart Communications PowerTCP Service control is prone to multiple buffer-=
overflow vulnerabilities because the application fails to bounds-check us=
er-supplied data before copying it into an insufficiently sized buffer.=20
Successfully exploiting these issues allow remote attackers to execute ar=
bitrary code in the context of the application using the ActiveX control =
(typically Internet Explorer). Failed exploit attempts likely result in d=
enial-of-service conditions.
These issues affect PowerTCP Service 3.1.3.3; other versions may also be =
affected.
63. LeadTools Raster Dialog File Object LTRDF14E.DLL ActiveX Control Buff=
er Overflow Vulnerability
BugTraq ID: 24133
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24133
Summary:
LEADTOOLS Raster Thumbnail Object Library ActiveX control is prone to a b=
uffer-overflow vulnerability because the application fails to bounds-chec=
k user-supplied data before copying it into an insufficiently sized buffe=
r.=20
Successfully exploiting this issue allows remBrowser ote attackers to exe=
cute arbitrary code in the context of the application using the ActiveX c=
ontrol (typically Internet Explorer). Failed exploit attempts likely resu=
lt in denial-of-service conditions.
Thumbnail Object Library ActiveX control 14.5.0.44 is vulnerable to this =
issue; other versions may also be affected.
64. Microsoft Office 2000 UA OUACTRL.OCX ActiveX Control Buffer Overflow =
Vulnerability
BugTraq ID: 24118
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24118
Summary:
Microsoft Office 2000 UA ActiveX Control is prone to a buffer-overflow vu=
lnerability because the application fails to bounds-check user-supplied d=
ata before copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
65. AdminBot-MX Live_Status.Lib.PHP Remote File Include Vulnerability
BugTraq ID: 24231
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24231
Summary:
AdminBot-MX is prone to a remote file-include vulnerability because it fa=
ils to sufficiently sanitize user-supplied input.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
This issue affects AdminBot-MX 9.0.5; other versions may also be vulnerab=
le.
66. Sky Software Shell MegaPack ActiveX ShComboBox ActiveX Control Buffer=
Overflow Vulnerability
BugTraq ID: 24113
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24113
Summary:
Sky Software Shell MegaPack ActiveX ShComboBox ActiveX control is prone t=
o a buffer-overflow vulnerability because the application fails to bounds=
-check user-supplied data before copying it into an insufficiently sized =
buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
Shell MegaPack ActiveX 8.0 is vulnerable to this issue; other versions ma=
y also be affected.
67. Dart ZipLite Compression DartZipLite.DLL ActiveX Control Buffer Overf=
low Vulnerability
BugTraq ID: 24099
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24099
Summary:
The Dart ZipLite Compression ActiveX control is prone to a buffer-overflo=
w vulnerability because the application fails to bounds-check user-suppli=
ed data before copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
Dart ZipLite Compression ActiveX control 1.8.5.3 is vulnerable to this is=
sue; other versions may also be affected.
68. LeadTools ISIS Control Ltisi14E.OCX ActiveX Control Buffer Overflow V=
ulnerability
BugTraq ID: 24093
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24093
Summary:
LEADTOOLS ISIS ActiveX control is prone to a buffer-overflow vulnerabilit=
y because the application fails to bounds-check user-supplied data before=
copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
LEADTOOLS ISIS ActiveX control 14.5.0.44 is vulnerable to this issue; oth=
er versions may also be affected.
69. EDraw Office Viewer Component ActiveX Control Arbitrary File Delete V=
ulnerability
BugTraq ID: 24230
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24230
Summary:
The EDraw Office Viewer Component ActiveX Control is prone to an arbitrar=
y-file-delete vulnerability.=20
An attacker can exploit this issue to delete arbitrary files on the affec=
ted computer. Successful attacks can result in denial-of-service conditio=
ns.
70. CesarFTP Remote CWD Denial of Service Vulnerability
BugTraq ID: 7949
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/7949
Summary:
A vulnerability has been reported for CesarFTP. Reportedly, an attacker m=
ay crash a target server by supplying excessive data as the argument to t=
he 'CWD' command. This may result in the server hanging, effectively deny=
ing service to other legitimate FTP users.
71. KSign KSignSWAT ActiveX Control Multiple Buffer Overflow Vulnerabilit=
ies
BugTraq ID: 24088
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24088
Summary:
KSign KSignSWAT ActiveX control is prone to multiple buffer-overflow vuln=
erabilities because the application fails to bounds-check user-supplied d=
ata before copying it into an insufficiently sized buffer.=20
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application using the ActiveX control=
(typically Internet Explorer). Failed exploit attempts likely result in =
denial-of-service conditions.
KSign KSignSWAT ActiveX control 2.0.3.3 is vulnerable; other versions may=
also be affected.
72. Pegasus ImagN ActiveX Control IMW32O40.OCX Buffer Overflow Vulnerabil=
ity
BugTraq ID: 24086
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24086
Summary:
Pegasus ImagN ActiveX control is prone to a buffer-overflow vulnerability=
because the application fails to bounds-check user-supplied data before =
copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
Pegasus ImagN ActiveX control 4.0 is vulnerable; other versions may also =
be affected.
73. Alt-N MDaemon Mail Relaying Vulnerability
BugTraq ID: 3200
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/3200
Summary:
MDaemon is an email server which supports most common internet mail proto=
cols offered by Alt-N Technologies. =20
=20
A vulnerability has been discovered in MDaemon which could allow a user t=
o specify the address in the 'From' field prior to sending an email messa=
ge. Thus, upon the recipient receiving the mail message, the point of ori=
gination will be false. This issue could be manipulated to carry out unau=
thorized email relaying.
74. LeadTools Raster Object Library LTRTM14e.DLL ActiveX WriteDataToFile =
File Overwrite Vulnerability
BugTraq ID: 24075
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24075
Summary:
LEADTOOLS Raster Thumbnail Object Library ActiveX control is prone to a v=
ulnerability that lets attackers overwrite arbitrary files on the victim =
computer in the context of the application using the ActiveX control (typ=
ically Internet Explorer). This issue occurs because the application fail=
s to properly sanitize user-supplied input.
Thumbnail Object Library ActiveX control 14.5.0.44 is vulnerable to this =
issue; other versions may also be affected.
75. LeadTools Raster Object Library LTRTM14e.DLL ActiveX Control Buffer O=
verflow Vulnerability
BugTraq ID: 24057
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24057
Summary:
LEADTOOLS Raster Thumbnail Object Library ActiveX control is prone to a b=
uffer-overflow vulnerability because the application fails to bounds-chec=
k user-supplied data before copying it into an insufficiently sized buffe=
r.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
Thumbnail Object Library ActiveX control 14.5.0.44 is vulnerable to this =
issue; other versions may also be affected.
76. DotClear Unspecified Trackback Vulnerability
BugTraq ID: 15624
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/15624
Summary:
DotClear is prone to an unspecified vulnerability relating to trackbacks.=
=20
=20
No further details have been provided; this BID will be updated when furt=
her information is available.=20
=20
DotClear version 1.2.1 is reported to be affected by this vulnerability; =
the vendor has released version 1.2.2 to address this issue.
77. LeadTools Thumbnail Browser ActiveX Control LTTMB14E.OCX Buffer Overf=
low Vulnerability
BugTraq ID: 24053
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24053
Summary:
LEADTOOLS Thumbnail Browser ActiveX control is prone to a buffer-overflow=
vulnerability because the application fails to bounds-check user-supplie=
d data before copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
LEADTOOLS Thumbnail Browser ActiveX control 14.5.0.44 is vulnerable; othe=
r versions may also be affected.
78. LeadTools JPEG2000 ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24040
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24040
Summary:
LEADTOOLS JPEG2000 ActiveX control is prone to a buffer-overflow vulnerab=
ility because the application fails to bounds-check user-supplied data be=
fore copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
LEADTOOLS JPEG2000 ActiveX control 14.5.0.35 is vulnerable; other version=
s may also be affected.
79. PHPWCMS Multiple Remote File Include Vulnerabilities
BugTraq ID: 15436
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/15436
Summary:
phpwcms is prone to multiple remote file include vulnerabilities. These i=
ssues are due to a failure in the application to properly sanitize user-s=
upplied input.=20
=20
An attacker may leverage these issues to disclose sensitive information. =
This may help with further attacks on the affected computer.
80. PrecisionID Barcode PrecisionID_Barcode.DLL ActiveX Control Buffer Ov=
erflow Vulnerability
BugTraq ID: 24010
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24010
Summary:
PrecisionID Barcode ActiveX control is prone to a buffer-overflow vulnera=
bility because the application fails to bounds-check user-supplied data b=
efore copying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
PrecisionID Barcode ActiveX control 1.9 is vulnerable; other versions may=
also be affected.
81. Windy Road Vistered Little Theme Skin Parameter Directory Traversal V=
ulnerability
BugTraq ID: 24178
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24178
Summary:
Vistered Little is prone to a directory-traversal vulnerability because i=
t fails to properly sanitize user-supplied input.=20
An attacker can exploit this vulnerability to retrieve arbitrary files fr=
om the vulnerable system in the context of the webserver process. Informa=
tion obtained may aid in further attacks.
This issue affects Vistered Little 1.6a; other versions may also be affec=
ted.
82. EDraw Office Viewer Component EDrawOfficeViewer.OCX ActiveX Control B=
uffer Overflow Vulnerability
BugTraq ID: 24229
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24229
Summary:
EDraw Office Viewer Component ActiveX control is prone to a buffer-overfl=
ow vulnerability because it fails to bounds-check user-supplied data befo=
re copying it into an insufficiently sized buffer.
An attacker can exploit this issue to cause a denial-of-service condition=
. Arbitrary code execution may be possible, but has not been confirmed.=20
This issue affects EDraw Office Viewer Component 4.0.5.20; other versions=
may also be affected.
83. Zenturi ProgramChecker SASATL.DLL ActiveX Control Multiple Buffer Ove=
rflow Vulnerabilities
BugTraq ID: 24217
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24217
Summary:
Several Zenturi ProgramChecker ActiveX controls are prone to multiple buf=
fer-overflow vulnerabilities because they fail to bounds-check user-suppl=
ied data before copying it into an insufficiently sized buffer.
Successfully exploiting these issues allow remote attackers to execute ar=
bitrary code in the context of the application using the ActiveX control =
(typically Internet Explorer). Failed exploit attempts likely result in d=
enial-of-service conditions.
84. Apple Quicktime For Java Variant Information Disclosure Vulnerability
BugTraq ID: 24222
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24222
Summary:
Apple QuickTime for Java is prone to an information-disclosure vulnerabil=
ity.=20
Attackers may exploit this issue by convincing victims into visiting a ma=
licious website.
Exploiting this issue may allow remote attackers to view memory that may =
contain sensitive information.
85. File Multiple Denial of Service Vulnerabilities
BugTraq ID: 24146
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24146
Summary:
The 'file' utility is prone to multiple denial-of-service vulnerabilities=
because it fails to handle exceptional conditions.=20
An attacker could exploit this issue by enticing a victim to open a speci=
ally crafted file. A denial-of-service condition can occur. Arbitrary cod=
e execution may be possible, but Symantec has not confirmed this.
86. Trolltech QT UTF-8 Sequences Input Validation Vulnerability
BugTraq ID: 23269
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23269
Summary:
Trolltech QT is prone to an input-validation vulnerability because the ap=
plication fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to exploit other issues in applicatio=
ns that employ the affected library. A successful attack may allow the at=
tacker to execute arbitrary HTML and script code in the browser of an uns=
uspecting user in the context of the affected site. This may help the att=
acker steal cookie-based authentication credentials and launch other atta=
cks. =20
=20
Qt 3.3.8 and 4.2.3 are known to be vulnerable to this issue; other versio=
ns may be affected as well.
87. FileCloset Unspecified Arbitrary File Upload Vulnerability
BugTraq ID: 24228
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24228
Summary:
FileCloset is prone to an arbitrary-file-upload vulnerability.=20
An attacker can exploit this vulnerability to upload PHP script code and =
execute it in the context of the webserver process.
88. XFSDump XFS_FSR Insecure Temporary File Creation Vulnerability
BugTraq ID: 23922
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23922
Summary:
The xfsdump 'xfs_fsr' utility creates temporary files in an insecure mann=
er.=20
An attacker with local access could potentially exploit this issue to per=
form symlink attacks, overwriting arbitrary files in the context of the a=
ffected application.=20
Successfully exploiting a symlink attack may allow the attacker to overwr=
ite or corrupt sensitive files. This may result in a denial of service; o=
ther attacks may also be possible.
This issue affects xfsdump 2.2.38; other versions may be affected as well=
.
89. Quagga BGPD UPDATE Message Remote Denial Of Service Vulnerability
BugTraq ID: 23417
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23417
Summary:
Quagga is prone to a remote denial-of-service vulnerability because it fa=
ils to handle a malformed multi-protocol message.
A remote attacker can exploit this issue by submitting a maliciously craf=
ted message to the application.
Successful exploits will cause the Quagga 'bgpd' daemon to abort, denyin=
g further service to legitimate users.
Quagga 0.99.6 and prior versions (0.99 branch) as well as 0.98.6 and prio=
r versions (0.98 branch) are vulnerable.
90. PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulner=
ability
BugTraq ID: 23183
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23183
Summary:
PHP is prone to a 'open_basedir' restriction-bypass vulnerability due to=
a design error.
Successful exploits could allow an attacker to access sensitive informati=
on or to write files in unauthorized locations.
This vulnerability would be an issue in shared-hosting configurations whe=
re multiple users can create and execute arbitrary PHP script code; in su=
ch cases, the 'safe_mode' and 'open_basedir' restrictions are expected to=
isolate users from each other.
The following versions are vulnerable:
PHP 4 up to and including 4.4.6
PHP 5 up to and including 5.2.1
91. PHP PHP_Binary Heap Information Leak Vulnerability
BugTraq ID: 22805
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/22805
Summary:
PHP 'php_binary' serialization handler is prone to a heap-information lea=
k.
The vulnerability arises because of a missing boundary check in the extra=
ction of variable names. A local attacker can exploit this issue to obtai=
n sensitive information (such as heap offsets and canaries) that may aid =
in other attacks.
These versions are affected:
PHP4 versions prior to 4.4.5
PHP5 versions prior to 5.2.1
Updates are available.
92. PHP Hash Table Overwrite Arbitrary Code Execution Vulnerability
BugTraq ID: 23119
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23119
Summary:
PHP is prone to an arbitrary-code-execution vulnerability.=20
An attacker may exploit this issue to execute arbitrary code within the c=
ontext of the affected webserver.
This issue affects PHP 4 (prior to 4.4.5) and PHP 5 (prior to 5.2.1).
93. PHP Session Data Deserialization Arbitrary Code Execution Vulnerabili=
ty
BugTraq ID: 23120
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23120
Summary:
PHP is prone to an arbitrary-code-execution vulnerability.=20
An attacker may exploit this issue to execute arbitrary code within the c=
ontext of the affected webserver.
This issue affects PHP 4 versions prior to 4.4.5 and PHP 5 versions prior=
to 5.2.1.
94. PHP ZVAL Reference Counter Integer Overflow Vulnerability
BugTraq ID: 22765
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/22765
Summary:
PHP is prone to an integer-overflow vulnerability because it fails to ens=
ure that integer values are not overrun.
A local attacker can exploit this vulnerability to execute arbitrary PHP =
scripts within the context of the affected application. Failed exploit at=
tempts will likely cause denial-of-service conditions.
Note: According to 'MOPB-04-2007:PHP 4 unserialize() ZVAL Reference Count=
er Overflow', this issue may be remotely triggered in PHP 4.4.4 environme=
nts because many legacy PHP applications still use 'unserialize()' on use=
r-supplied data. 'Unserialize()' uses the '__wakeup()' method of deserial=
ized objects in an unsafe manner that may lead to remote arbitrary code e=
xecution. This BID has been changed to reflect the possibility of remote =
exploitation in PHP 4.4.4 environments.
95. Pheap Config.PHP Pheap_Login Authentication Bypass Vulnerability
BugTraq ID: 24227
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24227
Summary:
Pheap is prone to an authentication-bypass vulnerability due to a design =
error.=20
An attacker can exploit this vulnerability to bypass authentication and e=
xecute arbitrary commands in the context of the site administrator.
96. PHP Ini_Restore() Safe_Mode and Open_Basedir Restriction Bypass Vulne=
rability
BugTraq ID: 19933
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/19933
Summary:
PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulne=
rability. Successful exploits could allow an attacker to access sensitive=
information or to write files in unauthorized locations.
This vulnerability would be an issue in shared-hosting configurations whe=
re multiple users can create and execute arbitrary PHP script code; in su=
ch cases, the 'safe_mode' and 'open_basedir' restrictions are expected to=
isolate users from each other.
These issues are reported to affect PHP versions 5.1.6, 4.4.4, and earlie=
r.
Reports indicate that fixes may be available to address this issue, but t=
his has not been confirmed.
97. Algorithmic Research PrivateWire Online Registration Remote Buffer Ov=
erflow Vulnerability
BugTraq ID: 18647
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/18647
Summary:
PrivateWire online registration is prone to a remote buffer-overflow vuln=
erability.=20
The application fails to properly check boundary conditions when handling=
GET requests.
This issue allows attackers to execute arbitrary machine code in the cont=
ext of the affected application software.=20
PrivateWire 3.7 is vulnerable to this issue; previous versions may also b=
e affected.
98. Multiple Vendor TCP Packet Fragmentation Handling Denial Of Service V=
ulnerability
BugTraq ID: 11258
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/11258
Summary:
Multiple vendor implementations of the TCP stack are reported prone to a =
remote denial-of-service vulnerability.=20
The issue is reported to present itself due to inefficiencies present whe=
n handling fragmented TCP packets.=20
The discoverer of this issue has dubbed the attack style the "New Dawn at=
tack"; it is a variation of a previously reported attack that was named t=
he "Rose Attack".=20
A remote attacker may exploit this vulnerability to deny service to an af=
fected computer.=20
Microsoft Windows 2000/XP, Linux kernel 2.4 tree, and undisclosed Cisco s=
ystems are reported prone to this vulnerability; other products may also =
be affected.
99. SalesCart Shopping Cart Reorder2.ASP Multiple SQL Injection Vulnerabi=
lities
BugTraq ID: 24226
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24226
Summary:
SalesCart Shopping Cart is prone to multiple SQL-injection vulnerabilitie=
s because it fails to sufficiently sanitize user-supplied data before usi=
ng it in an SQL query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
100. Apple Mac OS X 10.3.5 Released - Multiple Vulnerabilities Fixed
BugTraq ID: 10904
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/10904
Summary:
Apple has released Mac OS X 10.3.5. This release addresses a number of se=
curity vulnerabilities.=20
=20
The following new issues were reported:=20
=20
A remote vulnerability in the Apple Safari Web browser may allow a remote=
attacker to steal potentially sensitive form data.=20
=20
A denial-of-service vulnerability in the operating system may allow a rem=
ote attacker to disable network traffic. =20
=20
These issues have been addressed in Mac OS X 10.3.5. Individual BIDs wil=
l be created upon further analysis.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Insecure plug-ins pose danger to Firefox users
By: Robert Lemos
A security researcher warns that an insecure update mechanism for some of=
the open-source browser's third-party add-ons could allow an attacker th=
e ability to install malicious code.
http://www.securityfocus.com/news/11467
2. Peer-to-peer networks co-opted for DOS attacks
By: Robert Lemos
Attackers compromise the hub servers of the DC++ peer-to-peer network, tu=
rning hundreds of thousands of clients into hard-to-stop distributed deni=
al-of-service attacks.
http://www.securityfocus.com/news/11466
3. "Data storm" blamed for nuclear-plant shutdown
By: Robert Lemos
A Congressional committee calls for the Nuclear Regulatory Commission to =
further investigate the cause of excessive network traffic that shut down=
an Alabama nuclear plant.
http://www.securityfocus.com/news/11465
4. Experts scramble to quash IPv6 flaw
By: Robert Lemos
Only a few weeks after researchers raised the design issue in the next-ge=
neration Internet protocol, two drafts to the Internet Engineering Task F=
orce propose different fixes.
http://www.securityfocus.com/news/11463
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
V. INCIDENTS LIST SUMMARY
---------------------------
1. Survey on Supercomputer Cluster Security
http://www.securityfocus.com/archive/75/469615
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Help developing exploit
http://www.securityfocus.com/archive/82/469719
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Reconstruction of MS terminal services sessions
http://www.securityfocus.com/archive/88/469865
2. SecurityFocus Microsoft Newsletter #343
http://www.securityfocus.com/archive/88/469513
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
1. Survey on Supercomputer Cluster Security
http://www.securityfocus.com/archive/91/469540
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: ByteCrusher
def: "Crunch!"
1. noun - "The pleasing sound of malicious new security threats to y=
our computer splattering against WindowZones protection"
The sad truth is that it takes up to 8 hours for anti-virus companies to =
get off their laurels and fix a new security vulnerability. WindowZones, =
by ByteCrusher Labs, gets there first - preventing infectious bugs from g=
etting in the door to begin with. =20
http://landing.bytecrusher.com/windowzones/sflanding1.aspx?Referrer=3Dsf-=
A21sfWZ-wz1&cm_mmc=3DSecurity%20Focus-_-USA-_-Newsletter-_-Newsletter%3A%=
20Other%3A%20A21%3A%20sfWZ%3A%20wz1