SecurityFocus Newsletter #406

SecurityFocus Newsletter #406
----------------------------------------

This Issue is Sponsored by: VeriSign

Increase customer confidence at transaction time with the latest breakthr=
ough in online security - Extended Validation SSL from VeriSign. Extended=
 Validation triggers a green address bar in Microsoft IE7, which proves s=
ite identity.  Learn more at:=20

http://clk.atdmt.com/SFI/go/srv0890000047sfi/direct/01/


SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I.    FRONT AND CENTER
       1. Embedded Problems
       2. Security Analogies
II.   BUGTRAQ SUMMARY
       1. Nortel Networks PC Client Soft Phone Message Parsing Module Buf=
fer Overflow Vulnerability
       2. AOL Instant Messenger SIP Invite Message Denial of Service Vuln=
erability
       3. Linux Kernel MinCore User Space Access Locking Local Denial of =
Service Vulnerability
       4. PostgreSQL SECURITY DEFINER Function Local Privilege Escalation=
 Vulnerability
       5. PHPListPro Topsite Entry Page HTML Injection Vulnerability
       6. Papoo CMS Multiple HTML Injection Vulnerabilities
       7. Novell exteNd Director LocalExec.OCX ActiveX Control Remote Com=
mand Execution Vulnerability
       8. OpenOffice RTF File Parser Buffer Overflow Vulnerability
       9. ClamAV Multiple Unspecified Vulnerabilities
       10. Clam AntiVirus ClamAV OLE2 Parser Remote Denial Of Service Vul=
nerability
       11. Clam AntiVirus ClamAV RAR Handling Remote Denial Of Service Vu=
lnerability
       12. Apple Safari for Windows Unspecified Remote Code Execution and=
 Denial of Service Vulnerabilities
       13. Kaspersky Internet Security 6 SSDT Hooks Multiple Local Vulner=
abilities
       14. WordPress AndyBlue Theme Searchform.PHP Cross-Site Scripting V=
ulnerability
       15. Novell NetWare XNFS.NLM Remote Denial Of Service Vulnerability
       16. Util-linux Login Security Bypass Vulnerability
       17. Linux Kernel ATM SkBuff Dereference Remote Denial of Service V=
ulnerability
       18. Linux Kernel Omnikey CardMan 4040 Driver Local Buffer Overflow=
 Vulnerability
       19. Linux Kernel IPV6_Getsockopt_Sticky Memory Leak Information Di=
sclosure Vulnerability
       20. Linux Kernel Key_Alloc_Serial() Local Denial of Service Vulner=
ability
       21. Linux Kernel NETLINK_FIB_LOOKUP Local Denial of Service Vulner=
ability
       22. Linux Kernel NFSACL Denial of Service Vulnerability
       23. Apple Safari for Windows Content and URLBar Spoofing Vulnerabi=
lity
       24. Linux Kernel ISDN PPP Remote Denial of Service Vulnerability
       25. Linux Kernel ISDN PPP CCP Reset State Timer Denial of Service =
Vulnerability
       26. Linux Kernel Multiple IPV6 Packet Filtering Bypass Vulnerabili=
ties
       27. Snom-320 SIP Phone Remote Phone Dialing Unauthorized Access Vu=
lnerability
       28. Snom-320 SIP Remote Unauthorized Access Vulnerability
       29. PHPMailer Remote Shell Command Execution Vulnerability
       30. MPlayer Multiple CDDB Parsing Buffer Overflow Vulnerabilities
       31. IGeneric IG Shop Multiple PHP Code Execution Vulnerabilities
       32. Red Hat Sendmail Localhost.Localdomain Email Spoofing Vulnerab=
ility
       33. F-Secure Multiple Anti-Virus Products LHA and RAR Archives Sca=
n Bypass Vulnerability
       34. Libpng Library Remote Denial of Service Vulnerability
       35. LibPNG Graphics Library PNG_SET_SPLT Remote Denial of Service =
Vulnerability
       36. Tidylib for PHP Library Remote Buffer Overflow Vulnerability
       37. Microsoft Internet Explorer NavCancel.HTM Cross-Site Scripting=
 Vulnerability
       38. Microsoft Internet Explorer Prototype Variable Uninitialized M=
emory Corruption Vulnerability
       39. Microsoft Internet Explorer Language Pack Installation Remote =
Code Execution Vulnerability
       40. Microsoft Internet Explorer CSS Tag Memory Corruption Vulnerab=
ility
       41. Microsoft Internet Explorer URLMON.DLL COM Object Instantiatio=
n Remote Code Execution Vulnerability
       42. Microsoft Internet Explorer Speech API 4 COM Object Instantiat=
ion Buffer Overflow Vulnerabilities
       43. Microsoft Windows SChannel Security Remote Code Execution Vuln=
erability
       44. Microsoft Win32 API Parameter Validation Remote Code Execution=
 Vulnerability
       45. Vixie Cron ST_Nlink Check Local Denial of Service Vulnerabilit=
y
       46. FuseTalk AuthError.CFM SQL Injection Vulnerability
       47. Open ISCSI Multiple Local Denial Of Service Vulnerabilities
       48. MaraDNS Multiple Remote Denial of Service Vulnerabilities
       49. British Telecommunications Consumer Webhelper Multiple Buffer =
Overflow Vulnerabilities
       50. YABB Multiple Local File Include Vulnerabilities
       51. Apache Tomcat Accept-Language Cross Site Scripting Vulnerabili=
ty
       52. STPHP EasyNews PRO Unspecified Script HTML Injection Vulnerabi=
lity
       53. PHPPgAdmin SQLEdit.PHP Cross Site Scripting Vulnerability
       54. Cerulean Studios Trillian Word Wrapping UTF-8 Encoded String H=
eap Buffer Overflow Vulnerability
       55. APOP Protocol Insecure MD5 Hash Weakness
       56. Avaya 4602SW SIP Phone Security Bypass Vulnerability
       57. Avaya One-X Desktop Edition SIP Header Denial Of Service Vulne=
rability
       58. Avaya 4602SW SIP Phone Cnonce Parameter Authentication Spoofin=
g Vulnerability
       59. Aastra 9112i SIP Phone SIP Message Denial Of Service Vulnerabi=
lity
       60. Nortel Networks PC Client Soft Phone SIP Message Parsing Modul=
e Denial of Service Vulnerability
       61. RealNetworks GameHouse GHDLCTL.DLL ActiveX Control Multiple Bu=
ffer Overflow Vulnerabilities
       62. Avaya One-X Desktop Edition Phone SIP Remote  Buffer Overflow =
Vulnerability
       63. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerabil=
ity
       64. Fuzzylime Low.PHP Cross Site Scripting Vulnerability
       65. Solar Empire Game_Listing.PHP SQL Injection Vulnerability
       66. DKret Search Widget HTML Injection Vulnerability
       67. PHP Hosting Biller Index.PHP Cross Site Scripting Vulnerabilit=
y
       68. WIKINDX Localization Module Unspecified Authentication Bypass =
Vulnerability
       69. WebIf OutConfig Parameter Local File Include Vulnerability
       70. TDizin Arama.ASP Cross-Site Scripting Vulnerability
       71. WSPortal Content.PHP SQL Injection Vulnerability
       72. FCKeditor Alternative Data Stream Arbitrary File Upload Vulner=
ability
       73. PHPListPro Addsite.PHP HTML Injection Vulnerability
       74. MailWasher Server LDAP Unauthorized Folder Access Vulnerabilit=
y
       75. Utopia News Pro Login.PHP Cross Site Scripting Vulnerability
       76. FuseTalk Index.CFM SQL Injection Vulnerability
       77. PHPMailer Data() Function Remote Denial of Service Vulnerabili=
ty
       78. Menu Manager Module System Command Remote Command Execution Vu=
lnerability
       79. IBM WebSphere Application Server Unspecified Vulnerabilities
       80. MIT Kerberos 5 KAdminD Server Stack Buffer Overflow Vulnerabil=
ity
       81. Mozilla Products Multiple Remote Vulnerabilities
       82. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
       83. WmFrog Insecure Temporary File Creation Vulnerability
       84. EXIF Library EXIF File Processing Integer Overflow Vulnerabili=
ty
       85. Apache Tomcat JK Connector Double Encoding Security Bypass Vul=
nerability
       86. MiniBB Language Parameter Local File Include Vulnerability
       87. YourFreeScreamer Form.PHP Remote File Include Vulnerability
       88. Apple Safari for Windows Document.Location Denial of Service V=
ulnerability
       89. Apple Safari for Windows Corefoundation.DLL Denial of Service =
Vulnerability
       90. PHPMyInventory Global.Inc.PHP Remote File Include Vulnerabilit=
y
       91. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vuln=
erability
       92. Linux Kernel BINFMT_ELF PT_INTERP Local Information Disclosure=
 Vulnerability
       93. Linux Kernel AppleTalk ATalk_Sum_SKB Function Denial Of Servic=
e Vulnerability
       94. Linux Kernel Dev_Queue_XMIT Local Denial of Service Vulnerabil=
ity
       95. Linux Kernel Bluetooth CAPI Packet Remote Buffer Overflow Vuln=
erability
       96. Linux Kernel IPv6 TCP Sockets Local Denial of Service Vulnerab=
ility
       97. Linux Kernel AIO_Setup_Ring Local Denial of Service Vulnerabil=
ity
       98. Linux Kernel ISO9660 Denial of Service Vulnerability
       99. Linux Kernel ListXATTR Local Denial of Service Vulnerability
       100. Linux Kernel UnMap_HugePage_Area Local Denial of Service Vuln=
erability
III.  SECURITYFOCUS NEWS
       1. Group: Anti-hacking laws can hobble Net security
       2. Judge nixes teacher's conviction on porn pop-ups
       3. Zero-day sales not "fair" -- to researchers
       4. Insecure plug-ins pose danger to Firefox users
IV.   SECURITY JOBS LIST SUMMARY
V.    INCIDENTS LIST SUMMARY
       1. Suspicious files in /tmp
       2. send to MAC A, reply from MAC B, same IP. Whats going on ?
VI.   VULN-DEV RESEARCH LIST SUMMARY
       1. CFP: 3rd European Conference on Computer Network Defense (EC2ND=
) in Crete, Greece
       2. Static Code Analysis - Nuts and Bolts
VII.  MICROSOFT FOCUS LIST SUMMARY
       1. SecurityFocus Microsoft Newsletter #346
VIII. SUN FOCUS LIST SUMMARY
IX.   LINUX FOCUS LIST SUMMARY
X.    UNSUBSCRIBE INSTRUCTIONS
XI.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Embedded Problems
By Federico Biancuzzi
Federico Biancuzzi interviews Barnaby Jack to discuss the vector rewrite =
attack, which architectures are vulnerable, how to defend the integrity o=
f the exception vector table, some firmware extraction methods, and what =
bad things you can do on a cheap SOHO router.
http://www.securityfocus.com/columnists/446

2. Security Analogies
By Scott Granneman
Scott Granneman discusses security analogies and their function in educat=
ing the masses on security concepts.
http://www.securityfocus.com/columnists/445


II.  BUGTRAQ SUMMARY
--------------------
1. Nortel Networks PC Client Soft Phone Message Parsing Module Buffer Ove=
rflow Vulnerability
BugTraq ID: 24531
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24531
Summary:
Nortel Networks PC Client soft phone is prone to a buffer-overflow vulner=
ability because the application fails to properly bounds-check user-suppl=
ied data before copying it to an insufficiently sized memory buffer.=20
=20
Successful exploits can allow remote attackers to execute arbitrary machi=
ne code in the context of the affected application. Failed exploit attemp=
ts will likely result in denial-of-service conditions.

2. AOL Instant Messenger SIP Invite Message Denial of Service Vulnerabili=
ty
BugTraq ID: 24533
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24533
Summary:
AOL Instant Messenger is prone to a denial-of-service vulnerability becau=
se the application fails to handle specially crafted SIP messages.=20

An attacker can exploit this issue to crash the affected application, den=
ying service to legitimate users.=20

This issue affects AOL Instant Messenger 6.1.32.1; prior versions may als=
o be affected.

3. Linux Kernel MinCore User Space Access Locking Local Denial of Service=
 Vulnerability
BugTraq ID: 21663
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/21663
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability due to a d=
esign error.

A local attacker can exploit this issue to cause the kernel to become unr=
esponsive, denying further service to  legitimate users.

Linux Kernel versions prior to 2.4.33.6 are vulnerable.

4. PostgreSQL SECURITY DEFINER Function Local Privilege Escalation Vulner=
ability
BugTraq ID: 23618
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/23618
Summary:
PostgreSQL is prone to a local privilege-escalation vulnerability.

Exploiting this issue allows local attackers to escalate privileges in th=
e context of the 'security_definer' function.=20

PostgreSQL versions prior to 8.2.4, 8.1.9, 8.0.13, 7.4.17, and 7.3.19 are=
 vulnerable to this issue.

5. PHPListPro Topsite Entry Page HTML Injection Vulnerability
BugTraq ID: 24495
Remote: Yes
Last Updated: 2007-06-16
Relevant URL: http://www.securityfocus.com/bid/24495
Summary:
phpListPro is prone to an HTML-injection vulnerability because the applic=
ation fails to properly sanitize user-supplied input before using it in d=
ynamically generated content.=20
=20
Attacker-supplied HTML and script code would run in the context of the af=
fected site, potentially allowing the attacker to steal cookie-based auth=
entication credentials and to control how the site is rendered to the use=
r; other attacks are also possible.

This issue affects phpListPro 2.0.1; other versions may also be affected.

6. Papoo CMS Multiple HTML Injection Vulnerabilities
BugTraq ID: 24494
Remote: Yes
Last Updated: 2007-06-16
Relevant URL: http://www.securityfocus.com/bid/24494
Summary:
Papoo CMS is prone to multiple HTML-injection vulnerabilities because it =
fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script =
code in the context of the affected site, to steal cookie-based authentic=
ation credentials, or to control how the site is rendered to the user; ot=
her attacks are also possible.

These issues affects Papoo 3.6; prior versions may also be affected.

7. Novell exteNd Director LocalExec.OCX ActiveX Control Remote Command Ex=
ecution Vulnerability
BugTraq ID: 24493
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24493
Summary:
Novell exteNd Director is prone to a remote command-execution vulnerabili=
ty because the application fails to sanitize user-supplied data passed th=
rough an unspecified URI parameter.
=20
Attackers can leverage this issue to execute arbitrary code in the contex=
t of the application using the affected control (typically Internet Explo=
rer).

8. OpenOffice RTF File Parser Buffer Overflow Vulnerability
BugTraq ID: 24450
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24450
Summary:
OpenOffice is prone to a remote heap-based buffer-overflow vulnerability =
because the application fails to bounds-check user-supplied data before c=
opying it into an insufficiently sized buffer.

Remote attackers may exploit this issue by enticing victims into opening =
maliciously crafted RTF files.

An attacker can exploit this issue to execute arbitrary code within the c=
ontext of the affected application. Failed exploit attempts will result i=
n a denial of service.

9. ClamAV Multiple Unspecified Vulnerabilities
BugTraq ID: 24358
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24358
Summary:
ClamAV is prone to multiple unspecified vulnerabilities.

These issues arise because the software incorrectly calculates the end of=
 a buffer and gives improper permissions to temporary files.

Versions prior to ClamAV 0.90.3 are vulnerable to these issues.

10. Clam AntiVirus ClamAV OLE2 Parser Remote Denial Of Service Vulnerabil=
ity
BugTraq ID: 24316
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24316
Summary:
ClamAV is prone to a denial-of-service vulnerability when handling malfor=
med OLE2 files.

A successful attack may allow an attacker to cause denial-of-service cond=
itions.
=20
Versions prior to ClamAV 0.90.3 are affected.

11. Clam AntiVirus ClamAV RAR Handling Remote Denial Of Service Vulnerabi=
lity
BugTraq ID: 24289
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24289
Summary:
ClamAV is prone to a denial-of-service vulnerability.

A successful attack may allow an attacker to cause denial-of-service cond=
itions.

12. Apple Safari for Windows Unspecified Remote Code Execution and Denial=
 of Service Vulnerabilities
BugTraq ID: 24433
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24433
Summary:
Apple Safari for Windows is prone to multiple remote code-execution and d=
enial-of-service vulnerabilities.

An attacker may exploit these issues by enticing victims into opening a m=
aliciously crafted HTML document.

Successful exploits can allow attackers to execute arbitrary code in the =
context of the affected browser or to cause denial-of-service conditions.
=20
Safari 3 public beta for Windows is reported vulnerable.

One of these issues may be related to BID 24431: Apple Safari for Windows=
 Unspecified Denial of Service Vulnerability.

NOTE: Apple has released Safari  3.0.1 Beta for Windows

 UPDATE (June 14, 2007): Safari 2.0.4 is vulnerable; prior versions may a=
lso be affected.

13. Kaspersky Internet Security 6 SSDT Hooks Multiple Local Vulnerabiliti=
es
BugTraq ID: 24491
Remote: No
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24491
Summary:
Kaspersky Internet Security 6 is prone to multiple local vulnerabilities.

Exploiting these vulnerabilities allows local attackers to crash affected=
 computers, denying service to legitimate users. Attackers might also be =
able to gain elevated privileges by executing arbitrary machine code in t=
he context of the kernel, but this has not been confirmed.

Kaspersky Internet Security 6.0.2.614 and 6.0.2.621 are vulnerable; other=
 versions may also be affected.

NOTE: These issues may be related to BID 23326 (Kaspersky Internet Securi=
ty Suite Klif.SYS Drive Local Heap Overflow Vulnerability), but this has =
not been confirmed. If we find that this BID is a duplicate, we will reti=
re it and merge its information into BID 23326.

14. WordPress AndyBlue Theme Searchform.PHP Cross-Site Scripting Vulnerab=
ility
BugTraq ID: 24490
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24490
Summary:
The AndyBlue theme for WordPress is prone to a cross-site scripting vulne=
rability because the application fails to properly sanitize user-supplied=
 input.=20
=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user. This may help the attacker steal cook=
ie-based authentication credentials and launch other attacks.

The AndyBlue theme for WordPress 1.4 is vulnerable; other versions may al=
so be affected.

15. Novell NetWare XNFS.NLM Remote Denial Of Service Vulnerability
BugTraq ID: 24489
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24489
Summary:
Novell NetWare is prone to a remote denial-of-service vulnerability becau=
se of inadequate boundary checks.

A remote attacker can exploit this issue to deny access to legitimate use=
rs and possibly to execute code, but this has not been confirmed.

NetWare 6.5 SP6 is vulnerable; other versions may also be affected.

16. Util-linux Login Security Bypass Vulnerability
BugTraq ID: 24321
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24321
Summary:
The 'login' utility (in 'util-linux') is prone to a security-bypass vulne=
rability because the utility fails to properly validate user privileges.

Exploiting this issue can allow an attacker to bypass certain security re=
strictions and potentially gain unauthorized access.

Versions prior to 'util-linux' 2.12 are vulnerable.

17. Linux Kernel ATM SkBuff Dereference Remote Denial of Service Vulnerab=
ility
BugTraq ID: 20363
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/20363
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability.

This issue is triggered when the kernel processes incoming ATM data.

Exploiting this vulnerability may allow remote attackers to crash the aff=
ected kernel, resulting in denial-of-service conditions.

This issue affects only systems that have ATM hardware and are configured=
 for ATM kernel support.

Kernel versions from 2.6.0 up to and including 2.6.17 are vulnerable to t=
his issue.

18. Linux Kernel Omnikey CardMan 4040 Driver Local Buffer Overflow Vulner=
ability
BugTraq ID: 22870
Remote: No
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/22870
Summary:
The Linux kernel is prone to a local buffer-overflow vulnerability becaus=
e it fails to properly bounds-check user-supplied input before using it i=
n a memory copy operation.

This issue allows local attackers to overwrite kernel memory with arbitra=
ry data, potentially allowing them to execute malicious machine code in t=
he context of affected kernels. Exploiting this vulnerability facilitates=
 the complete compromise of affected computers.

Linux kernel versions prior to 2.6.21-rc3 are affected by this issue.

19. Linux Kernel IPV6_Getsockopt_Sticky Memory Leak Information Disclosur=
e Vulnerability
BugTraq ID: 22904
Remote: No
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/22904
Summary:
Linux Kernel is prone to an information-disclosure vulnerability because =
it fails to handle unexpected user-supplied input.

Successful exploits will allow attackers to obtain portions of kernel mem=
ory. Information harvested may be used in further attacks.

Kernel versions 2.6.0 up to 2.6.20.1 are vulnerable to this issue.

20. Linux Kernel Key_Alloc_Serial() Local Denial of Service Vulnerability
BugTraq ID: 22539
Remote: No
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/22539
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability.

A successful attack can allow local attackers to trigger a crash and deny=
 service to legitimate users.
=20
Kernel versions 2.6.x are vulnerable.

21. Linux Kernel NETLINK_FIB_LOOKUP Local Denial of Service Vulnerability
BugTraq ID: 23677
Remote: No
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/23677
Summary:
The Linux kernel is prone to a denial-of-service vulnerability. This issu=
e presents itself when a NETLINK message is misrouted.

A local attacker may exploit this issue to trigger an infinite-recursion =
stack-based overflow in the kernel. This results in a denial of service t=
o legitimate users.

Versions prior to 2.6.20.8 are vulnerable.

22. Linux Kernel NFSACL Denial of Service Vulnerability
BugTraq ID: 22625
Remote: No
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/22625
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability.=20

An attacker can exploit this issue to crash the affected computer, denyin=
g service to legitimate users.

This issue affects the Linux kernel 2.6 series up to 2.6.20.

23. Apple Safari for Windows Content and URLBar Spoofing Vulnerability
BugTraq ID: 24484
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/24484
Summary:
Apple Safari 3.0.1 Beta for Windows is prone to a vulnerability that lets=
 attackers spoof window titles and URL bars.

Attackers may exploit this vulnerability via a malicious webpage to spoof=
 the contents and origin of a page that the victim may trust. Attackers m=
ay find this issue useful in phishing or other attacks that rely on conte=
nt spoofing.

Safari 3.0.1 (522.12.12) on Windows 2003 SE SP2 is reported vulnerable; o=
ther versions may also be affected.

24. Linux Kernel ISDN PPP Remote Denial of Service Vulnerability
BugTraq ID: 21835
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/21835
Summary:
The Linux kernel is prone to a denial-of-service vulnerability.
=20
An attacker can exploit this issue to cause an affected kernel to crash, =
effectively denying service to legitimate users.

Versions prior to 2.4.34 are vulnerable to this issue.

25. Linux Kernel ISDN PPP CCP Reset State Timer Denial of Service Vulnera=
bility
BugTraq ID: 21883
Remote: No
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/21883
Summary:
The Linux kernel is prone to a denial-of-service vulnerability because it=
 fails to handle exceptional conditions.=20

An attacker can exploit this issue to crash the affected kernel, denying =
service to legitimate users.

26. Linux Kernel Multiple IPV6 Packet Filtering Bypass Vulnerabilities
BugTraq ID: 20955
Remote: Yes
Last Updated: 2007-06-15
Relevant URL: http://www.securityfocus.com/bid/20955
Summary:
The Linux kernel is prone to multiple IPv6 packet-filtering-bypass vulner=
abilities because of insufficient handling of fragmented packets.

An attacker could exploit these issues to bypass ip6_table filtering rule=
s. This could result in a false sense of security because filtering rules=
 set up by system administrators can be bypassed in order to access servi=
ces that are otherwise protected.

27. Snom-320 SIP Phone Remote Phone Dialing Unauthorized Access Vulnerabi=
lity
BugTraq ID: 24535
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24535
Summary:
The snom 320 SIP VoIP phone is prone to a remote vulnerability that may a=
llow an attacker to dial a random number.

28. Snom-320 SIP Remote Unauthorized Access Vulnerability
BugTraq ID: 24532
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24532
Summary:
The snom 320 SIP VoIP phone is prone to a remote unauthorized-access vuln=
erability that may lead to information disclosure.

A remote attacker can exploit this issue to gain access to potentially se=
nsitive information.

29. PHPMailer Remote Shell Command Execution Vulnerability
BugTraq ID: 24417
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24417
Summary:
PHPMailer is prone to a vulnerability that allows attackers to execute ar=
bitrary shell commands because the software fails to sanitize user-suppli=
ed input.

This issue affects PHPMailer when configured to use sendmail.

An attacker may leverage this issue to execute arbitrary shell commands o=
n an affected computer with the privileges of the application using the a=
ffected class utility.

PHPMailer 1.73 and prior versions are vulnerable to this issue.

30. MPlayer Multiple CDDB Parsing Buffer Overflow Vulnerabilities
BugTraq ID: 24339
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24339
Summary:
MPlayer is prone to multiple buffer-overflow vulnerabilities when it atte=
mpts to process malformed album and category titles. These issues occur b=
ecause the application fails to perform proper bounds-checking on user-su=
pplied data before copying it to an insufficiently sized memory buffer.

An attacker may exploit these issues to execute arbitrary code with the p=
rivileges of the user that activated the vulnerable application. This may=
 facilitate unauthorized access or privilege escalation.

MPlayer 1.0rc1 is vulnerable to these issues; other versions may also be =
affected.

31. IGeneric IG Shop Multiple PHP Code Execution Vulnerabilities
BugTraq ID: 21875
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/21875
Summary:
The iG Shop application is prone to multiple PHP code-execution vulnerabi=
lities.

An attacker can exploit these issues to execute arbitrary malicious PHP c=
ode in the context of the webserver process. This may help the attacker c=
ompromise the application and the underlying system; other attacks are al=
so possible.

These issues affect iG Shop 1.0 and 1.4; other versions may be vulnerable=
 as well.

32. Red Hat Sendmail Localhost.Localdomain Email Spoofing Vulnerability
BugTraq ID: 23742
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/23742
Summary:
Red Hat Sendmail is prone to a vulnerability that permits an attacker to =
send spoofed emails.

A successful exploit may allow an attacker to impersonate the localhost w=
hen sending an email message.

This issue affects Sendmail on Red Hat systems due to a configuration err=
or. It is not currently known if this issue affects other releases of the=
 software.

33. F-Secure Multiple Anti-Virus Products LHA and RAR Archives Scan Bypas=
s Vulnerability
BugTraq ID: 24525
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24525
Summary:
Multiple F-Secure Anti-Virus products are prone to a vulnerability that m=
ay allow certain compressed archives to bypass the scan engine.

An attacker may exploit this issue by sending maliciously crafted RAR or =
LHA archives to victims.

Successful exploits will allow attackers to distribute compressed archive=
s containing malicious code that will not be detected by the antivirus ap=
plication.

34. Libpng Library Remote Denial of Service Vulnerability
BugTraq ID: 24000
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24000
Summary:
The 'libpng' library is prone to a remote denial-of-service vulnerability=
 because the library fails to handle malicious PNG files.=20

Successful exploits may allow remote attackers to cause denial-of-service=
 conditions on computers running the affected library.

This issue affects 'libpng' 1.2.16 and prior versions.

35. LibPNG Graphics Library PNG_SET_SPLT Remote Denial of Service Vulnera=
bility
BugTraq ID: 21078
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/21078
Summary:
LibPNG is reported prone to a denial-of-service vulnerability. The librar=
y fails to perform proper bounds-checking of user-supplied input, which l=
eads to an out-of-bounds read error.

Attackers may exploit this vulnerability to crash an application that rel=
ies on the affected library.

36. Tidylib for PHP Library Remote Buffer Overflow Vulnerability
BugTraq ID: 24527
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24527
Summary:
Tidylib for PHP is prone to a remote buffer-overflow vulnerability becaus=
e the library fails to perform boundary checks before copying user-suppli=
ed data to insufficiently sized memory buffers.

An attacker can exploit this issue to execute arbitrary machine code in t=
he context of the application using the affected library. Failed exploit =
attempts will likely cause a crash, denying service to legitimate users.=20

This issue affects Tidylib for PHP 040603; other versions may also be aff=
ected.

37. Microsoft Internet Explorer NavCancel.HTM Cross-Site Scripting Vulner=
ability
BugTraq ID: 22966
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/22966
Summary:
Microsoft Internet Explorer is prone to a cross-site scripting vulnerabil=
ity because the application fails to sufficiently sanitize user-supplied =
data.

An attacker can exploit this issue to spoof the contents of the Navigatio=
n canceled page, steal cookie-based authentication credentials, and obtai=
n other sensitive information. Successful exploits may assist in phishing=
 or other attacks that rely on content spoofing.

38. Microsoft Internet Explorer Prototype Variable Uninitialized Memory C=
orruption Vulnerability
BugTraq ID: 24418
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24418
Summary:
Microsoft Internet Explorer is prone to a memory-corruption vulnerability=
 when accessing objects that are improperly instantiated or deleted.

An attacker may exploit this issue by enticing victims into opening a mal=
iciously crafted webpage.

 Successfully exploiting this issue allows remote attackers to execute ar=
bitrary machine code in the context of the affected application, facilita=
ting the remote compromise of affected computers.

39. Microsoft Internet Explorer Language Pack Installation Remote Code Ex=
ecution Vulnerability
BugTraq ID: 24429
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24429
Summary:
Microsoft Internet Explorer is prone to remote code-execution vulnerabili=
ty because of a race-condition in its language-pack installation support.

A remote attacker can exploit this issue to execute arbitrary code in the=
 context of the user running the vulnerable application.

40. Microsoft Internet Explorer CSS Tag Memory Corruption Vulnerability
BugTraq ID: 24423
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24423
Summary:
Microsoft Internet Explorer is prone to a remote code-execution vulnerabi=
lity because the application fails to properly handle certain CSS data.

A remote attacker can exploit this issue to execute arbitrary code in the=
 context of the user running the vulnerable application.

41. Microsoft Internet Explorer URLMON.DLL COM Object Instantiation Remot=
e Code Execution Vulnerability
BugTraq ID: 24372
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24372
Summary:
Microsoft Internet Explorer is prone to remote code-execution vulnerabili=
ty.=20

A remote attacker can exploit this issue to execute arbitrary code in the=
 context of the user running the vulnerable application.

42. Microsoft Internet Explorer Speech API 4 COM Object Instantiation Buf=
fer Overflow Vulnerabilities
BugTraq ID: 24426
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24426
Summary:
Microsoft Internet Explorer is prone to multiple buffer-overflow vulnerab=
ilities when instantiating certain COM objects.

An attacker may exploit these issues by enticing victims into opening a m=
aliciously crafted webpage.

     Successfully exploiting these issues allows remote attackers to exec=
ute arbitrary machine code in the context of the affected application, fa=
cilitating the remote compromise of affected computers.

43. Microsoft Windows SChannel Security Remote Code Execution Vulnerabili=
ty
BugTraq ID: 24416
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24416
Summary:
The Microsoft Windows Schannel security package is prone to a remote code=
-execution vulnerability.=20

This vulnerability occurs when processing and validating server-sent digi=
tal signatures by the client application.

A remote attacker could exploit this issue by convincing a victim to visi=
t a malicious website. Remote code execution is possible, but may be extr=
emely difficult. In most cases, denial-of-service conditions will occur.

44. Microsoft Win32 API Parameter Validation Remote Code Execution Vulner=
ability
BugTraq ID: 24370
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24370
Summary:
The Microsoft Win32 API is prone to remote code execution.=20

An attacker could exploit this issue to execute code in the context of th=
e user visiting a malicious webpage.

45. Vixie Cron ST_Nlink Check Local Denial of Service Vulnerability
BugTraq ID: 23520
Remote: No
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/23520
Summary:
Vixie Cron is prone to a local denial-of-service vulnerability.=20

This issue occurs when attackers create hard file links to cron files bel=
onging to both privileged and normal users.

A local attacker may exploit this issue to prevent cron files owned by pr=
ivileged and non-privileged users from being executed at startup or on th=
e next reload of the cron database.

Vixie Cron versions prior to 4.1-r10 are vulnerable.

46. FuseTalk AuthError.CFM SQL Injection Vulnerability
BugTraq ID: 24528
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24528
Summary:
FuseTalk is prone to an SQL-injection vulnerability because the applicati=
on fails to properly sanitize user-supplied input before using it in an S=
QL query.=20

A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.

NOTE: Specific vulnerable versions were not disclosed. Reports also indic=
ate that this issue has been addressed in the latest version of the appli=
cation.

47. Open ISCSI Multiple Local Denial Of Service Vulnerabilities
BugTraq ID: 24471
Remote: No
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24471
Summary:
Open-iSCSI is prone to multiple local denial-of-service vulnerabilities.

A local attacker can exploit these issues to deny legitimate user access =
to the server daemon.

48. MaraDNS Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 24337
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24337
Summary:
MaraDNS is prone to multiple remote denial-of-service vulnerabilities bec=
ause of memory leaks.
=20
Successfully exploiting these issues allows remote attackers to crash aff=
ected servers by exhausting memory resources. This will deny further serv=
ice to legitimate users.

Versions in the 1.2 and 1.3 series prior to 1.2.12.06 and 1.3.05 are vuln=
erable to these issues.

49. British Telecommunications Consumer Webhelper Multiple Buffer Overflo=
w Vulnerabilities
BugTraq ID: 24219
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24219
Summary:
The British Telecommunications Consumer Webhelper ActiveX control is pron=
e to multiple buffer-overflow vulnerabilities because it fails to bounds-=
check user-supplied data before copying it into an insufficiently sized b=
uffer.=20

Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application using the ActiveX control=
 (typically Internet Explorer). Failed exploit attempts likely result in =
denial-of-service conditions.

Versions of British Telecommunications Consumer Webhelper ActiveX Control=
 prior to 2.0.0.8 are vulnerable to these issues.

50. YABB Multiple Local File Include Vulnerabilities
BugTraq ID: 24529
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24529
Summary:
YaBB is prone to multiple local file-include vulnerabilities because the =
application fails to adequately sanitize user-supplied input.

Exploiting these issues may allow an attacker to access potentially sensi=
tive information that may aid in further attacks.

This issue affects YaBB 2.1 and prior versions.

51. Apache Tomcat Accept-Language Cross Site Scripting Vulnerability
BugTraq ID: 24524
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24524
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because th=
e application fails to properly sanitize user-supplied input. =20
=20
An attacker can exploit this vulnerability to inject HTML and script code=
 into the browser of an unsuspecting victim. The attacker may then steal =
cookie-based authentication credentials and launch other attacks.

This issue may have been reported as part of the vulnerabilities describe=
d in BID 24058 (Apache Tomcat Documentation Sample Application Multiple C=
ross-Site Scripting Vulnerabilities).  Symantec has not been able to conf=
irm this information. We will update this BID when more information emerg=
es.

52. STPHP EasyNews PRO Unspecified Script HTML Injection Vulnerability
BugTraq ID: 24512
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24512
Summary:
STphp EasyNews PRO is prone to an HTML-injection vulnerability because it=
 fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script co=
de in the context of the affected site, to steal cookie-based authenticat=
ion credentials, or to control how the site is rendered to the user; othe=
r attacks are also possible.
=20
STphp EasyNews PRO 4.0 is vulnerable; other versions may also be affected=
.

53. PHPPgAdmin SQLEdit.PHP Cross Site Scripting Vulnerability
BugTraq ID: 24115
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24115
Summary:
phpPgAdmin is prone to a cross-site scripting vulnerability.=20

Exploiting this vulnerability may allow an attacker to perform cross-site=
 scripting attacks on unsuspecting users in the context of the affected w=
ebsite. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.

 phpPgAdmin 4.1.1 is reported vulnerable; other versions may also be affe=
cted.

54. Cerulean Studios Trillian Word Wrapping UTF-8 Encoded String Heap Buf=
fer Overflow Vulnerability
BugTraq ID: 24523
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24523
Summary:
Trillian is prone to a heap-based buffer-overflow vulnerability because t=
he application fails to bounds-check user-supplied data before copying it=
 into an insufficiently sized buffer.=20

An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of the currently logged-in user. Failed exploit attempts will res=
ult in a denial of service.=20
=20
This issue affects Trillian 3.1.5.1; prior versions may also be affected.

55. APOP Protocol Insecure MD5 Hash Weakness
BugTraq ID: 23257
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/23257
Summary:
Applications that implement the APOP protocol may be vulnerable to a pass=
word-hash weakness. This issue occurs because the MD5 hash algorithm fail=
s to properly prevent collisions.

Attackers may exploit this issue in man-in-the-middle attacks to potentia=
lly gain access to the first three characters of passwords. This will inc=
rease the likelihood of successful brute-force attacks against APOP authe=
ntication.

To limit the possibility of successful exploits, applications that implem=
ent the APOP protocol should set up safeguards to ensure that message IDs=
 are RFC-compliant.

Mozilla Thunderbird, Evolution, mutt, and fetchmail are reportedly affect=
ed by this issue.

56. Avaya 4602SW SIP Phone Security Bypass Vulnerability
BugTraq ID: 24544
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24544
Summary:
The Avaya 4602SW SIP Phone is prone to a security-bypass vulnerability be=
cause it accepts SIP requests from random source IP addresses.

An attacker can exploit this issue to bypass security restrictions. The a=
ttacker may then be able to transmit malicious messages to the device.

This issue affects The Avaya 4602 SW IP Phone (Model 4602D02A).

57. Avaya One-X Desktop Edition SIP Header Denial Of Service Vulnerabilit=
y
BugTraq ID: 24541
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24541
Summary:
Avaya one-X Desktop Edition phone is prone to a remote denial-of-service =
vulnerability.

An attacker can exploit this issue to crash the phone, denying service to=
 legitimate users.

Versions 2.1.0.70 and prior are vulnerable.

58. Avaya 4602SW SIP Phone Cnonce Parameter Authentication Spoofing Vulne=
rability
BugTraq ID: 24539
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24539
Summary:
The  Avaya 4602SW SIP Phone and SIP call server is prone to an authentica=
tion spoofing vulnerability.

 This allows an attacker to impersonate a SIP call server, compromising t=
he confidentiality of a victim's phone conversations.

59. Aastra 9112i SIP Phone SIP Message Denial Of Service Vulnerability
BugTraq ID: 24537
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24537
Summary:
Aastra 9112i SIP Phone is prone to a denial-of-service vulnerability beca=
use, the device fails to handle specially crafted SIP messages.

An attacker can exploit this issue to crash the affected device, denying =
service to legitimate users.=20

This issue affects Firmware 1.4.0.1049, Boot version: 1.1.0.10.

60. Nortel Networks PC Client Soft Phone SIP Message Parsing Module Denia=
l of Service Vulnerability
BugTraq ID: 24536
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24536
Summary:
Nortel Networks PC Client Soft Phone is prone to a remote denial-of-servi=
ce vulnerability, because the application fails to properly handle malfor=
med data.

Successful exploits can allow remote attackers to crash the affected appl=
ication, denying further service to legitimate users.

61. RealNetworks GameHouse GHDLCTL.DLL ActiveX Control Multiple Buffer Ov=
erflow Vulnerabilities
BugTraq ID: 24534
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24534
Summary:
The RealNetworks GameHouse dldisplay ActiveX Control is prone to multiple=
 buffer-overflow vulnerability because the application fails to bounds-ch=
eck user-supplied data before copying it into an insufficiently sized buf=
fer.=20

Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application using the Gamehouse appli=
cation. Failed exploit attempts will likely result in denial-of-service c=
onditions.

An attacker may exploit these issues by enticing victims into visiting a =
maliciously crafted web page.

62. Avaya One-X Desktop Edition Phone SIP Remote  Buffer Overflow Vulnera=
bility
BugTraq ID: 24530
Remote: Yes
Last Updated: 2007-06-19
Relevant URL: http://www.securityfocus.com/bid/24530
Summary:
Avaya One-X Desktop Edition phone is prone to a remote buffer-overflow vu=
lnerability because it fails to perform adequate boundary checks on user-=
supplied input.

An attacker can exploit this issue to disable the call receiving function=
ality of affected phones.

Versions 2.1.0.70 and prior are vulnerable.

63. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerability
BugTraq ID: 22231
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/22231
Summary:
ISC BIND is prone to a remote denial-of-service vulnerability because the=
 application fails to properly handle malformed DNSSEC validation request=
s.

Successfully exploiting this issue allows remote attackers to crash affec=
ted DNS servers, denying further service to legitimate users.

64. Fuzzylime Low.PHP Cross Site Scripting Vulnerability
BugTraq ID: 24522
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24522
Summary:
Fuzzylime is prone to a cross-site scripting vulnerability because it fai=
ls to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site=
 scripting attacks on unsuspecting users in the context of the affected w=
ebsite. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.

Fuzzylime 1.01b and prior versions are vulnerable to this issue.

65. Solar Empire Game_Listing.PHP SQL Injection Vulnerability
BugTraq ID: 24519
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24519
Summary:
Solar Empire is prone to an SQL-injection vulnerability because the appli=
cation fails to properly sanitize user-supplied input before using it in =
an SQL query.=20

A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.

This issue affects Solar Empire 2.9.1.1; other versions may also be vulne=
rable.

66. DKret Search Widget HTML Injection Vulnerability
BugTraq ID: 24518
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24518
Summary:
dKret is prone to an HTML-injection vulnerability because the application=
 fails to properly sanitize user-supplied input before using it in dynami=
cally generated content.=20
=20
Attacker-supplied HTML and script code would run in the context of the af=
fected site, potentially allowing the attacker to steal cookie-based auth=
entication credentials and to control how the site is rendered to the use=
r; other attacks are also possible.

This issue affects versions prior to dKret 2.6.

67. PHP Hosting Biller Index.PHP Cross Site Scripting Vulnerability
BugTraq ID: 24517
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24517
Summary:
Php Hosting Biller is prone to a cross-site scripting vulnerability becau=
se it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site=
 scripting attacks on unsuspecting users in the context of the affected w=
ebsite. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.

This issue affects Php Hosting Biller 1.0; other versions may also be vul=
nerable.

68. WIKINDX Localization Module Unspecified Authentication Bypass Vulnera=
bility
BugTraq ID: 24508
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24508
Summary:
WIKINDX Localization Module is prone to an unspecified authentication-byp=
ass vulnerability.

Exploiting this issue could allow an attacker to access certain administr=
ative sections of the application. This may facilitate a complete comprom=
ise of the vulnerable application.
=20
Versions prior to WIKINDX Localization Module 1.2 are vulnerable to this =
issue.

69. WebIf OutConfig Parameter Local File Include Vulnerability
BugTraq ID: 24516
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24516
Summary:
WebIf is prone to a local file-include vulnerability because it fails to =
properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.

70. TDizin Arama.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 24515
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24515
Summary:
TDizin is prone to a cross-site scripting vulnerability because it fails =
to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site=
 scripting attacks on unsuspecting users in the context of the affected w=
ebsite. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.

71. WSPortal Content.PHP SQL Injection Vulnerability
BugTraq ID: 24513
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24513
Summary:
WSPortal is prone to an SQL-injection vulnerability because the applicati=
on fails to properly sanitize user-supplied input before using it in an S=
QL query.=20

A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.

This issue affects WSPortal 1.0; other versions may also be vulnerable.

72. FCKeditor Alternative Data Stream Arbitrary File Upload Vulnerability
BugTraq ID: 24510
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24510
Summary:
FCKeditor is prone to an arbitrary file-upload vulnerability because the =
application fails to sufficiently sanitize user-supplied input.

Attackers can exploit this vulnerability to upload arbitrary PHP files an=
d execute it in the context of the webserver process.

This issue affects FCKeditor 2.4.3; other versions may also be affected.

73. PHPListPro Addsite.PHP HTML Injection Vulnerability
BugTraq ID: 24509
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24509
Summary:
phpListPro is prone to an HTML-injection vulnerability because the applic=
ation fails to properly sanitize user-supplied input before using it in d=
ynamically generated content.=20
=20
Attacker-supplied HTML and script code would run in the context of the af=
fected site, potentially allowing the attacker to steal cookie-based auth=
entication credentials and to control how the site is rendered to the use=
r; other attacks are also possible.

This issue affects phpListPro 2.0.1; other versions may also be affected.

NOTE: This record may be a duplicate of the vulnerability discussed in BI=
D 24495 (PHPListPro Topsite Entry Page HTML Injection Vulnerability). As =
more information emerges, we may update (or possibly retire) this BID.

74. MailWasher Server LDAP Unauthorized Folder Access Vulnerability
BugTraq ID: 24507
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24507
Summary:
MailWasher Server is prone to a vulnerability that may allow remote attac=
kers to access sensitive data.

This issue affects versions prior to MailWasher Server 2.2.1.

75. Utopia News Pro Login.PHP Cross Site Scripting Vulnerability
BugTraq ID: 24506
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24506
Summary:
Utopia News Pro is prone to a cross-site scripting vulnerability because =
it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site=
 scripting attacks on unsuspecting users in the context of the affected w=
ebsite. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.

Utopia News Pro 1.4.0 is vulnerable to this issue; other versions may als=
o be vulnerable.

76. FuseTalk Index.CFM SQL Injection Vulnerability
BugTraq ID: 24498
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24498
Summary:
FuseTalk is prone to an SQL-injection vulnerability because the applicati=
on fails to properly sanitize user-supplied input before using it in an S=
QL query.=20

A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.

This issue affects FuseTalk 2.0; other versions may also be vulnerable.

77. PHPMailer Data() Function Remote Denial of Service Vulnerability
BugTraq ID: 13805
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/13805
Summary:
PHPMailer is affected by a remote denial-of-service vulnerability.=20

An attacker can send an email message with a malformed header field to in=
itiate an infinite loop in the application. This eventually leads to a cr=
ash due to resource exhaustion.=20

PHPMailer 1.72 and prior versions are affected by this issue.

78. Menu Manager Module System Command Remote Command Execution Vulnerabi=
lity
BugTraq ID: 24453
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24453
Summary:
The Menu Manager module for WebAPP is prone to a remote command-execution=
 vulnerability because it fails to sufficiently sanitize user-supplied in=
put.=20

An attacker can exploit this issue to execute arbitrary system commands w=
ithin the context of the affected webserver.=20

This issue affects Menu Manager Module 1.5 running on WebAPP prior to 0.9=
.9.7.

79. IBM WebSphere Application Server Unspecified Vulnerabilities
BugTraq ID: 24505
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24505
Summary:
IBM WebSphere Application Server is prone to multiple unspecified vulnera=
bilities.=20

Although very little information is known about these issues, some of the=
m may lead to denial-of-service conditions and allow attackers to bypass =
certain restrictions. We will update this BID as more information emerges=
.

Versions prior to 6.1.0 Fix Pack 9 are vulnerable to these issues.

80. MIT Kerberos 5 KAdminD Server Stack Buffer Overflow Vulnerability
BugTraq ID: 23285
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/23285
Summary:
Kerberos 5 kadmind (Kerberos Administration Daemon) server is prone to a =
stack-based buffer-overflow vulnerability because the software fails to a=
dequately bounds-check user-supplied data before copying it to an insuffi=
ciently sized buffer.

An attacker can exploit this issue to execute arbitrary code with adminis=
trative privileges. A successful attack can result in the complete compro=
mise of the application. Failed attempts will likely result in denial-of-=
service conditions.

All kadmind servers run on  the master Kerberos server. Since the master =
server holds the KDC principal  and policy database, an attack may not on=
ly compromise the affected computer,  but could also compromise multiple =
hosts that use the server for  authentication.

Kerberos 5 kadmind 1.6 and prior versions are vulnerable.

81. Mozilla Products Multiple Remote Vulnerabilities
BugTraq ID: 24242
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24242
Summary:
The Mozilla Foundation has released six security advisories specifying vu=
lnerabilities in Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- Execute arbitrary code
- Cause denial-of-service conditions
- Perform cross-site scripting attacks
- Obtain potentially sensitive information
- Spoof legitimate content

Other attacks may also be possible.

82. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
BugTraq ID: 23192
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/23192
Summary:
The 'mod_perl' module is prone to a remote denial-of-service vulnerabilit=
y.

Successful exploits may allow remote attackers to cause denial-of-service=
 conditions on the webserver running the mod_perl module.

83. WmFrog Insecure Temporary File Creation Vulnerability
BugTraq ID: 24504
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24504
Summary:
The WmFrog application creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to per=
form symlink attacks, overwriting arbitrary files in the context of the a=
ffected application.=20

An attacker may leverage this issue to corrupt or overwrite arbitrary fil=
es with the privileges of an unsuspecting user that activated the affecte=
d application. Reportedly, attackers can exploit this issue to escalate p=
rivileges.

Versions prior to WmFrog 0.2.0 are vulnerable to this issue.

84. EXIF Library EXIF File Processing Integer Overflow Vulnerability
BugTraq ID: 24461
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24461
Summary:
The 'libexif' library is reported prone to an integer-overflow vulnerabil=
ity. Reportedly, the issue presents itself when the affected library is p=
rocessing malformed EXIF files. =20
=20
Attackers may leverage this issue to execute arbitrary code in the contex=
t of an application that is linked to the vulnerable library. Failed expl=
oit attempts will likely result in denial-of-service conditions.

This issue affects 'libexif' 0.6.13 to 0.6.15; other versions may also be=
 affected.

85. Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerabil=
ity
BugTraq ID: 24147
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24147
Summary:
Apache HTTP server running with the Tomcat JK Web Server Connector is pro=
ne to a security-bypass vulnerability because it decodes request URLs mul=
tiple times.

Exploiting this issue allows attackers to access restricted files in the =
Tomcat web directory. This can expose sensitive information that could he=
lp attackers launch further attacks.

This issue is present in versions of Apache Tomcat JK Connector prior to =
1.2.23.

86. MiniBB Language Parameter Local File Include Vulnerability
BugTraq ID: 24503
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24503
Summary:
miniBB is prone to a local file-include vulnerability because it fails to=
 properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.

miniBB 2.0.5 is vulnerable to this issue; prior versions may also be affe=
cted.

87. YourFreeScreamer Form.PHP Remote File Include Vulnerability
BugTraq ID: 24500
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24500
Summary:
YourFreeScreamer is prone to a remote file-include vulnerability because =
it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application=
 and the underlying system; other attacks are also possible.

This issue affects YourFreeScreamer 1.0; other versions may also be vulne=
rable.

88. Apple Safari for Windows Document.Location Denial of Service Vulnerab=
ility
BugTraq ID: 24499
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24499
Summary:
Apple Safari for Windows is prone to a denial-of-service vulnerability be=
cause it fails to properly handle user-supplied input.

An attacker may exploit this issue by enticing victims into opening a mal=
iciously crafted HTML document.

Successful exploits can allow attackers to crash the affected browser, re=
sulting in denial-of-service conditions.

Safari 3.0 and 3.0.1 public beta for Windows are reported vulnerable.

NOTE: At the time of writing, Symantec was unable to reproduce this vulne=
rability. We are investigating this issue further and will update this BI=
D as more information emerges.

89. Apple Safari for Windows Corefoundation.DLL Denial of Service Vulnera=
bility
BugTraq ID: 24497
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24497
Summary:
Apple Safari for Windows is prone to a denial-of-service vulnerability be=
cause it fails to properly handle user-supplied input.

An attacker may exploit this issue by enticing victims into opening a mal=
iciously crafted HTML document.

Successful exploits can allow attackers to crash the affected browser, re=
sulting in denial-of-service conditions. Attackers may also be able to ex=
ecute arbitrary code, but Symantec had not confirmed this.

Safari 3.0.1 public beta for Windows is reported vulnerable.

90. PHPMyInventory Global.Inc.PHP Remote File Include Vulnerability
BugTraq ID: 24496
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24496
Summary:
phpMyInventory is prone to a remote file-include vulnerability because it=
 fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application=
 and the underlying system; other attacks are also possible.

This issue affects phpMyInventory 2.8; earlier versions may also be vulne=
rable.

91. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerabili=
ty
BugTraq ID: 24074
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/24074
Summary:
FreeType is prone to an integer-overflow vulnerability because it fails t=
o properly validate TTF files.

An attacker may exploit this issue by enticing victims into opening malic=
iously crafted TTF Files.

Successful exploits will allow attackers to execute arbitrary code in the=
 context in the context of applications that use the affected library. Fa=
iled exploit attempts will likely result in denial-of-service conditions.

This issue affects FreeType 2.3.4 and prior versions.

92. Linux Kernel BINFMT_ELF PT_INTERP Local Information Disclosure Vulner=
ability
BugTraq ID: 22903
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/22903
Summary:
The Linux kernel is prone to a vulnerability in the Linux ELF binary load=
er. Exploiting this issue can allow local attackers to gain access to pri=
vileged information.

An attacker may be able to obtain sensitive data that can potentially be =
used to gain elevated privileges.

 This issue is a variant of the vulnerability assigned CVE candidate ID C=
AN-2004-1073, which is documented in BID 11646.

Linux Kernel versions in the 2.6.0 branch prior to 2.6.20 are vulnerable;=
 versions in the 2.4.0 branch may also be affected.

93. Linux Kernel AppleTalk ATalk_Sum_SKB Function Denial Of Service Vulne=
rability
BugTraq ID: 23376
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/23376
Summary:
The Linux kernel is prone to a denial-of-service vulnerability. This issu=
e presents itself when malformed AppleTalk frames are processed.

An attacker can exploit this issue to crash host computers, effectively d=
enying service to legitimate users.

Versions prior to 2.6.20.5 are vulnerable.

94. Linux Kernel Dev_Queue_XMIT Local Denial of Service Vulnerability
BugTraq ID: 22317
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/22317
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability.

A local attacker can exploit this issue to corrupt data and cause the ker=
nel to become unresponsive, denying further service to  legitimate users.

95. Linux Kernel Bluetooth CAPI Packet Remote Buffer Overflow Vulnerabili=
ty
BugTraq ID: 21604
Remote: Yes
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/21604
Summary:
The Linux kernel is prone to a remote buffer-overflow vulnerability becau=
se the kernel fails to bounds-check user-supplied data before copying it =
into an insufficiently sized buffer.=20

An attacker may exploit this issue to execute arbitrary code with kernel-=
level privileges, facilitating the complete compromise of affected comput=
ers. Failed exploit attempts will result in denial-of-service conditions.=
=20

Versions prior to 2.4.33.5 are vulnerable to this issue.

96. Linux Kernel IPv6 TCP Sockets Local Denial of Service Vulnerability
BugTraq ID: 23104
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/23104
Summary:
The Linux kernel is prone to a denial-of-service vulnerability.

Exploiting this issue allows local attackers to cause the kernel to crash=
, effectively denying service to legitimate users. Attackers may also be =
able to execute arbitrary code with elevated privileges, but this has not=
 been confirmed.

This issue affects the Linux kernel 2.6 series.

97. Linux Kernel AIO_Setup_Ring Local Denial of Service Vulnerability
BugTraq ID: 22193
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/22193
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability beca=
use the kernel fails to properly initialize a variable.

Exploiting this issue allows local attackers to cause kernel crashes, den=
ying service to legitimate users.

98. Linux Kernel ISO9660 Denial of Service Vulnerability
BugTraq ID: 20920
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/20920
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. Thi=
s issue affects the code that handles the ISO9660 filesystem.

An attacker can exploit this issue to crash the affected computer, denyin=
g service to legitimate users.

99. Linux Kernel ListXATTR Local Denial of Service Vulnerability
BugTraq ID: 22316
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/22316
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability.

Successful exploits will result in denial-of-service conditions or potent=
ially privilege escalation.

100. Linux Kernel UnMap_HugePage_Area Local Denial of Service Vulnerabili=
ty
BugTraq ID: 20362
Remote: No
Last Updated: 2007-06-18
Relevant URL: http://www.securityfocus.com/bid/20362
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability beca=
use the kernel fails to properly handle unexpected errors.

Exploiting this issue allows local, unprivileged attackers to cause kerne=
l crashes, denying service to legitimate users.

Linux kernel versions 2.6.0 through 2.6.12 are vulnerable to this issue.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Group: Anti-hacking laws can hobble Net security
By: Robert Lemos
A working group of security researchers, digital-rights activists and gov=
ernment prosecutors discuss whether bug hunters can find vulnerabilities =
in Web sites without violating laws.
http://www.securityfocus.com/news/11470

2. Judge nixes teacher's conviction on porn pop-ups
By: Robert Lemos
A Connecticut judge grants a new trial for substitute teacher Julie Amero=
, saying that forensics information discovered after her conviction has d=
irect bearing on her case.
http://www.securityfocus.com/news/11469

3. Zero-day sales not "fair" -- to researchers
By: Robert Lemos
A security analyst tries his hand at selling two vulnerabilities and find=
s that economics and time are against him.
http://www.securityfocus.com/news/11468

4. Insecure plug-ins pose danger to Firefox users
By: Robert Lemos
A security researcher warns that an insecure update mechanism for some of=
 the open-source browser's third-party add-ons could allow an attacker th=
e ability to install malicious code.
http://www.securityfocus.com/news/11467

IV.  SECURITY JOBS LIST SUMMARY
-------------------------------
V.   INCIDENTS LIST SUMMARY
---------------------------
1. Suspicious files in /tmp
http://www.securityfocus.com/archive/75/471627

2. send to MAC A, reply from MAC B, same IP. Whats going on ?
http://www.securityfocus.com/archive/75/471263

VI.  VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. CFP: 3rd European Conference on Computer Network Defense (EC2ND) in Cr=
ete, Greece
http://www.securityfocus.com/archive/82/471677

2. Static Code Analysis - Nuts and Bolts
http://www.securityfocus.com/archive/82/471253

VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #346
http://www.securityfocus.com/archive/88/471449

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
 body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and a=
sk to be manually removed.

XI.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: VeriSign

Increase customer confidence at transaction time with the latest breakthr=
ough in online security - Extended Validation SSL from VeriSign. Extended=
 Validation triggers a green address bar in Microsoft IE7, which proves s=
ite identity.  Learn more at:=20

http://clk.atdmt.com/SFI/go/srv0890000047sfi/direct/01/