SecurityFocus Newsletter #408
[email protected] 4 Jul 2007 21:34:58 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #408
----------------------------------------
This Issue is Sponsored by: Watchfire
As web applications become increasingly complex, tremendous amounts of se=
nsitive data - including personal, medical and financial information - ar=
e exchanged, and stored. This paper examines a few vulnerability detectio=
n methods - specifically comparing and contrasting manual penetration tes=
ting with automated scanning tools. Download Watchfire's "Web Application=
Security: Automated Scanning or Manual Penetration Testing?" whitepaper =
today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=3D701700000008yk=
a
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1. Don't Be Evil
2. Persistence of data on storage media
II. BUGTRAQ SUMMARY
1. Yoggie Pico and Pico Pro Backticks Remote Code Execution Vulner=
ability
2. Liesbeth Base CMS Information Disclosure Vulnerability
3. VBZooM Multiple SQL Injection Vulnerabilitie
4. Coppermine Photo Gallery Albmgr.PHP SQL Injection Vulnerability
5. OpenSSH Duplicated Block Remote Denial of Service Vulnerability
6. Sun Java Runtime Environment Image Parsing Buffer Overflow Vuln=
erability
7. Gnome Evolution Format String Vulnerability
8. OpenOffice RTF File Parser Buffer Overflow Vulnerability
9. HP Instant Support ActiveX Control Driver Check Buffer Overflow=
Vulnerability
10. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
11. Libpng Library Remote Denial of Service Vulnerability
12. Sun Solaris Gnome Assistive Technology XScreenSaver Local Arbi=
trary Command Execution Vulnerability
13. PostNuke PNPHPBB2 Module Viewforum.PHP SQL Injection Vulnerabi=
lity
14. MySQLDumper Apache Access Control Authentication Bypass Vulner=
ability
15. GNU GLibC LD.SO Mask Dynamic Loader Integer Overflow Vulnerabi=
lity
16. MyCMS Multiple Input Validation Vulnerabilities
17. SuperCali Index.PHP SQL Injection Vulnerability
18. Girlserv Ads Details_News.PHP SQL Injection Vulnerability
19. Oliver Multiple Cross-Site Scripting Vulnerabilities
20. LightBlog Main.PHP Arbitrary File Upload Vulnerability
21. HP TCP/IP Services for OpenVMS User Enumeration Weakness and S=
ecurity Bypass Vulnerabilities
22. ImLib BMP Image _LoadBMP Function Denial of Service Vulnerabil=
ity
23. PHP Director Videos.PHP SQL Injection Vulnerability
24. GSAMBAD Insecure Temporary File Creation Vulnerability
25. PHP-Fusion ShoutBox_Panel.PHP Cross-Site Scripting Vulnerabili=
ty
26. Flac123 Local__VCentry_Parse_Value() Stack Buffer Overflow Vul=
nerability
27. Moodle Index.PHP Cross Site Scripting Vulnerability
28. BBS100 Multiple Denial of Service Vulnerabilities
29. GIMP PSD File Integer Overflow Vulnerability
30. Asterisk SIP T.38 SDP Parsing Remote Stack Buffer Overflow Vul=
nerabilities
31. Microsoft Internet Explorer Zone Denial of Service Vulnerabili=
ty
32. SoftNews Media Group DataLife Engine Multiple Remote File Incl=
ude Vulnerabilities
33. Claroline $_SERVER['PHP_SELF'] Parameter Multiple Cross-Site S=
cripting Vulnerabilities
34. LightBlog Add_Comment.PHP Cross-Site Scripting Vulnerability
35. SaPHPLesson Show.PHP SQL Injection Vulnerability
36. Free Domain CO.NR Clone Members.PHP SQL Injection Vulnerabilit=
y
37. Efendy Blog Search Field Cross Site Scripting Vulnerability
38. ETicket SERVER[REQUEST_URI] Parameter Multiple HTML Injection =
Vulnerabilities
39. SAPHPLesson Multiple SQL Injection Vulnerabilities
40. SlackRoll Malicious Package Denial of Service Vulnerability
41. SPHPell Multiple Remote File Include Vulnerabilities
42. Mozilla Firefox OnKeyDown Event File Upload Vulnerability
43. Mozilla Firefox About:Blank IFrame Cross Domain Information Di=
sclosure Vulnerability
44. Buddy Zone Multiple SQL Injection Vulnerabilities
45. XCMS Multiple Local File Include Vulnerabilities
46. Ripe Website Manager Multiple Remote File Include and Informat=
ion Disclosure Vulnerabilities
47. Easybe 1-2-3 Music Store Process.PHP Script SQL Injection Vuln=
erability
48. Fireflier-Server Insecure Temporary File Creation Vulnerabilit=
y
49. HispaH Youtube Clone MSG.PHP Script SQL Injection Vulnerabilit=
y
50. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vuln=
erability
51. File(1) Command File_PrintF Integer Underflow Vulnerability
52. File Multiple Denial of Service Vulnerabilities
53. EXIF Library EXIF File Processing Integer Overflow Vulnerabili=
ty
54. LibEXIF Exif_Data_Load_Data_Entry Remote Integer Overflow Vuln=
erability
55. MIT Kerberos 5 KAdminD Server Rename_Principal_2_SVC() Functio=
n Stack Buffer Overflow Vulnerability
56. MIT Kerberos 5 KAdminD Server RPC Type Conversion Stack Buffer=
Overflow Vulnerability
57. MIT Kerberos Administration Daemon RPC Library Free Pointer Re=
mote Code Execution Vulnerability
58. EKG Multiple Remote Denial of Service Vulnerabilities
59. PHPEventCalendar Eventdisplay.PHP Script SQL Injection Vulnera=
bility
60. Linux Kernel USBLCD Memory Consumption Denial Of Service Vulne=
rability
61. Unicon-imc2 Environment Variable Buffer Overflow Vulnerability
62. AV Arcade Cookie[ava_userid] Authentication Bypass Vulnerabili=
ty
63. Gorki Online Santrac Sitesi Uyeler.ASP Multiple HTML Injection=
Vulnerabilities
64. AV Arcade View_Page.PHP SQL Injection Vulnerability
65. Elite Bulletin Board Multiple Input Validation Vulnerabilities
66. Fujitsu ServerView DBASCIIAccess Remote Command Execution Vuln=
erability
67. Fujitsu PRIMERGY BX300 Blade Server Information Disclosure Vul=
nerability
68. Microsoft Windows Registry Access Local Denial of Service Vuln=
erability
69. ESRI ArcSDE Server Stack Buffer Overflow Vulnerability
70. ArcadeBuilder Cookie Data SQL Injection Vulnerability
71. Esqlanelapse Multiple Unspecified Vulnerabilities
72. Sun JavaDoc Tool Cross-Site Scripting Vulnerability
73. EQDKP Login.PHP Arbitrary Variable Overwrite Vulnerability
74. Sun JDK JPG/BMP Parser Multiple Vulnerabilities
75. British Telecommunications Consumer Webhelper Multiple Buffer =
Overflow Vulnerabilities
76. Axis Camera Control ActiveX Control AxisCamControl.OCX Remote =
Buffer Overflow Vulnerability
77. OpenSSH SCP Shell Command Execution Vulnerability
78. Opera Web Browser Running Adobe Flash Player Information Discl=
osure Vulnerability
79. Util-linux Login Security Bypass Vulnerability
80. Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerab=
ilities
81. GDB DWARF Multiple Buffer Overflow Vulnerabilities
82. Sun Solaris Remote IPv6 IPSec Packet Denial of Service Vulnera=
bility
83. OpenLDAP SLAPD Access Control Circumvention Vulnerability
84. RETIRED:Symantec Norton Personal Firewall 2006 SymEvent Driver=
Local Denial of Service Vulnerability
85. Xvid Avi MBCoding.C Remote Code Execution Vulnerability
86. Gnome Evolution Data Server Array Index Memory Access Vulnerab=
ility
87. Sun Java Web Start Arbitrary File Overwrite Privilege Escalati=
on Vulnerability
88. VBZoom Forum.php SQL Injection Vulnerability
89. Firebird SQL Fbserver Remote Buffer Overflow Vulnerability
90. TotalCalendar View_Event Script SQL Injection Vulnerability
91. Retired: MiniBB Language Parameter Local File Include Vulnerab=
ility
92. Wheatblog Login SQL Injection Vulnerability
93. Progress Webspeed _CPYFile.P Unauthorized Access Vulnerability
94. WebAPP Multiple Vulnerabilities
95. WebApp.org and WebApp.net Multiple Input Validation Vulnerabil=
ities
96. Menu Manager Module System Command Remote Command Execution Vu=
lnerability
97. Web-App.Org and Web-App.Net Multiple Cross-Site Scripting Vuln=
erabilities
98. Colored Scripts Easy Message Board Remote Command Execution Vu=
lnerability
99. Web-APP.Org WebAPP Directory Traversal Vulnerability
100. McAfee SecurityCenter Subscription Manager ActiveX Buffer Ove=
rflow Vulnerability
III. SECURITYFOCUS NEWS
1. Lawmakers worry over gov't network breaches
2. Amero case spawns effort to educate
3. Group: Anti-hacking laws can hobble Net security
4. Judge nixes teacher's conviction on porn pop-ups
IV. SECURITY JOBS LIST SUMMARY
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
1. Writing ascii shellcode (\xcc)
2. PacSec 2007 Call For Papers (Nov. 29/30, deadline July 27)
3. Developing exploit for a tricky vulnerability
4. Exotic vulnerability
VII. MICROSOFT FOCUS LIST SUMMARY
1. Help debugging a problem - Virtual Server 2005
2. MS ISA 2004 Server
3. SecurityFocus Microsoft Newsletter #348
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. Don't Be Evil
By Mark Rasch
A series of developments raise the specter that remotely stored or create=
d documents may be subject to subpoena or discovery all without the knowl=
edge or consent of the document's creators.
http://www.securityfocus.com/columnists/447
2. Persistence of data on storage media
By Jamie Ridden
Jamie Ridden discusses the re-use of storage media and how slack space ca=
n prevent sensitive data from being completely removed.
http://www.securityfocus.com/infocus/1891
II. BUGTRAQ SUMMARY
--------------------
1. Yoggie Pico and Pico Pro Backticks Remote Code Execution Vulnerability
BugTraq ID: 24743
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24743
Summary:
Yoggie Pico and Pico Pro are prone to a remote code-execution vulnerabili=
ty because the device fails to sufficiently sanitize user-supplied input.=
=20
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges. A successful exploit will result in the complete compromis=
e of affected devices.
2. Liesbeth Base CMS Information Disclosure Vulnerability
BugTraq ID: 24749
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24749
Summary:
Liesbeth Base CMS is prone to an information-disclosure vulnerability.=20
Exploiting this issue may allow an attacker to access sensitive informati=
on that may aid in further attacks.
3. VBZooM Multiple SQL Injection Vulnerabilitie
BugTraq ID: 18937
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/18937
Summary:
VBZooM is prone to multiple SQL-injection vulnerabilities. These issues a=
re due to a failure in the application to properly sanitize user-supplied=
input before using it in an SQL query.
An attacker may be able to exploit these issues to modify the logic of SQ=
L queries. Successful exploits may allow the attacker to compromise the s=
oftware, retrieve information, or modify data; other consequences are pos=
sible as well.
4. Coppermine Photo Gallery Albmgr.PHP SQL Injection Vulnerability
BugTraq ID: 21894
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/21894
Summary:
Coppermine Photo Gallery is prone to an SQL-injection vulnerability becau=
se the application fails to properly sanitize user-supplied input before =
using it in an SQL query.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase implementation.
Coppermine Photo Gallery versions prior to 1.4.11 are vulnerable.
5. OpenSSH Duplicated Block Remote Denial of Service Vulnerability
BugTraq ID: 20216
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/20216
Summary:
OpenSSH is prone to a remote denial-of-service vulnerability because it f=
ails to properly handle incoming duplicate blocks.
Remote attackers may exploit this issue to consume excessive CPU resource=
s, potentially denying service to legitimate users.
This issue occurs only when OpenSSH is configured to accept SSH Version O=
ne traffic.
6. Sun Java Runtime Environment Image Parsing Buffer Overflow Vulnerabili=
ty
BugTraq ID: 24267
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24267
Summary:
The Sun Java Runtime Environment is prone to a buffer-overflow vulnerabil=
ity because the application fails to bounds-check user-supplied data befo=
re copying it into an insufficiently sized buffer.=20
An attacker can exploit this issue to execute arbitrary code in the conte=
xt of a user who invokes a malicious Java applet.
7. Gnome Evolution Format String Vulnerability
BugTraq ID: 23073
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/23073
Summary:
Gnome Evolution is prone to a format-string vulnerability.=20
This issue presents itself because the application fails to properly sani=
tize user-supplied input before passing it as the format specifier in a s=
hared memo.=20
A successful attack may crash the application or possibly lead to arbitra=
ry code execution. This may facilitate unauthorized access or privilege e=
scalation in the context of the user running the application.
Gnome Evolution version 2.8.2.1 is vulnerable to this issue; other versio=
ns may also be affected.
8. OpenOffice RTF File Parser Buffer Overflow Vulnerability
BugTraq ID: 24450
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24450
Summary:
OpenOffice is prone to a remote heap-based buffer-overflow vulnerability =
because the application fails to bounds-check user-supplied data before c=
opying it into an insufficiently sized buffer.
Remote attackers may exploit this issue by enticing victims into opening =
maliciously crafted RTF files.
An attacker can exploit this issue to execute arbitrary code within the c=
ontext of the affected application. Failed exploit attempts will result i=
n a denial of service.
9. HP Instant Support ActiveX Control Driver Check Buffer Overflow Vulner=
ability
BugTraq ID: 24730
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24730
Summary:
HP Instant Support ActiveX control is prone to a remote buffer-overflow v=
ulnerability because it fails to adequately bounds-check user-supplied in=
put before copying it to an insufficiently sized memory buffer.
Exploiting this issue allows remote attackers to execute arbitrary code i=
n the context of applications using the affected ActiveX control and poss=
ibly to compromise affected computers.
10. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
BugTraq ID: 23192
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/23192
Summary:
The 'mod_perl' module is prone to a remote denial-of-service vulnerabilit=
y.
Successful exploits may allow remote attackers to cause denial-of-service=
conditions on the webserver running the mod_perl module.
11. Libpng Library Remote Denial of Service Vulnerability
BugTraq ID: 24000
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24000
Summary:
The 'libpng' library is prone to a remote denial-of-service vulnerability=
because the library fails to handle malicious PNG files.=20
Successful exploits may allow remote attackers to cause denial-of-service=
conditions on computers running the affected library.
This issue affects 'libpng' 1.2.16 and prior versions.
12. Sun Solaris Gnome Assistive Technology XScreenSaver Local Arbitrary C=
ommand Execution Vulnerability
BugTraq ID: 24314
Remote: No
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24314
Summary:
Sun Solaris, running Gnome sessions with Assistive Technology and xscreen=
saver, is prone to a local arbitrary-command-execution vulnerability.
An attacker can exploit this issue to execute arbitrary commands with the=
privileges of the user running xscreensaver.
13. PostNuke PNPHPBB2 Module Viewforum.PHP SQL Injection Vulnerability
BugTraq ID: 24760
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24760
Summary:
The PostNuke PNPHPBB2 module is prone to an SQL-injection vulnerability b=
ecause it fails to sufficiently sanitize user-supplied data before using =
it in an SQL query.
An attacker can exploit this issue by manipulating the SQL query logic to=
carry out unauthorized actions on the underlying database.
This issue affects PNPHPBB2 1.2i and prior; other versions are also affec=
ted.
14. MySQLDumper Apache Access Control Authentication Bypass Vulnerability
BugTraq ID: 24759
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24759
Summary:
MySQLDumper is prone to an authentication-bypass vulnerability due to a c=
onfiguration error in the apache access control files.
An attacker can exploit this issue to remove the apache access control fi=
les, gain access to protected files and compromise the affected applicati=
on.
15. GNU GLibC LD.SO Mask Dynamic Loader Integer Overflow Vulnerability
BugTraq ID: 24758
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24758
Summary:
GNU glibc is prone to an integer-overflow vulnerability because it fails =
to properly ensure that integer math operations do not result in overflow=
.
An attacker can exploit this issue to execute arbitrary code with super=
user privileges. Successfully exploiting this issue will result in the =
complete compromise of affected application. Failed exploit attempts will=
result in a denial-of-service.=20
Versions 2.5 and prior vulnerable to this issue.
16. MyCMS Multiple Input Validation Vulnerabilities
BugTraq ID: 24757
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24757
Summary:
MyCMS is prone to multiple input-validation vulnerabilities. These includ=
e multiple remote file-include issues, authentication-bypass and arbitrar=
y command-execution vulnerabilities.
Successful exploits will allow remote attackers to execute arbitrary syst=
em commands and PHP script code in the context of the affected webserver,=
bypass authentication and compromise the vulnerable application.
These issues affect MyCMS 0.9.8 and prior.
17. SuperCali Index.PHP SQL Injection Vulnerability
BugTraq ID: 24756
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24756
Summary:
SuperCali is prone to an SQL-injection vulnerability because it fails to =
sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
Version 4.0 is vulnerable; other versions may also be affected.
18. Girlserv Ads Details_News.PHP SQL Injection Vulnerability
BugTraq ID: 24755
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24755
Summary:
Girlserv ads is prone to an SQL-injection vulnerability because it fails =
to sufficiently sanitize user-supplied data before using it in an SQL que=
ry.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
This issue affects version 1.5; prior versions may also be affected.
19. Oliver Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 24754
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24754
Summary:
Oliver is prone to multiple cross-site scripting vulnerabilities because =
it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
20. LightBlog Main.PHP Arbitrary File Upload Vulnerability
BugTraq ID: 24752
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24752
Summary:
LightBlog is prone to an arbitrary-file-upload vulnerability because the =
application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this vulnerability to upload PHP script code and =
execute it in the context of the webserver process.
Version 6.8 is vulnerable; other versions may also be affected.
21. HP TCP/IP Services for OpenVMS User Enumeration Weakness and Security=
Bypass Vulnerabilities
BugTraq ID: 24751
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24751
Summary:
The TCP/IP service for OpenVMS is prone to a user-enumeration weakness an=
d a security-bypass vulnerability.
An attacker can exploit these issues to enumerate valid usernames and to =
aid in brute-force attacks.
These issues affect TCP/IP Services 5.6 for OpenVMS. Other versions may =
also be affected.
22. ImLib BMP Image _LoadBMP Function Denial of Service Vulnerability
BugTraq ID: 24750
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24750
Summary:
ImLib is prone to a denial-of-service vulnerability because the applicati=
on fails to properly process certain BMP image files.
Remote attackers may exploit this issue by enticing victims into opening =
maliciously crafted BMP files.
An attacker could exploit this issue to cause denial-of-service condition=
s on applications using the affected library.
23. PHP Director Videos.PHP SQL Injection Vulnerability
BugTraq ID: 24729
Remote: Yes
Last Updated: 2007-07-02
Relevant URL: http://www.securityfocus.com/bid/24729
Summary:
PHP Director is prone to an SQL-injection vulnerability because it fails =
to sufficiently sanitize user-supplied data before using it in an SQL que=
ry.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
Version 0.21 is vulnerable; other versions may also be affected.
24. GSAMBAD Insecure Temporary File Creation Vulnerability
BugTraq ID: 24717
Remote: No
Last Updated: 2007-07-02
Relevant URL: http://www.securityfocus.com/bid/24717
Summary:
GSAMBAD creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to per=
form symlink attacks, overwriting arbitrary files in the context of the a=
ffected application.=20
An attacker may leverage this issue to corrupt or overwrite arbitrary fil=
es with the privileges of an unsuspecting user that activated the affecte=
d application. Reportedly, attackers can exploit this issue to escalate p=
rivileges.
All versions of GSAMBAD are considered to be vulnerable to this issue.
25. PHP-Fusion ShoutBox_Panel.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 24733
Remote: Yes
Last Updated: 2007-07-02
Relevant URL: http://www.securityfocus.com/bid/24733
Summary:
PHP-Fusion is prone to a cross-site scripting vulnerability. This issue =
is due to a failure in the application to properly sanitize user-supplied=
input.=20
=20
An attacker may leverage this issue to have arbitrary script code execute=
d in the browser of an unsuspecting user in the context of the affected s=
ite. This may facilitate the theft of cookie-based authentication creden=
tials as well as other attacks.
This issue affects version 6.01.10; other versions may also be affected.
26. Flac123 Local__VCentry_Parse_Value() Stack Buffer Overflow Vulnerabil=
ity
BugTraq ID: 24712
Remote: Yes
Last Updated: 2007-06-29
Relevant URL: http://www.securityfocus.com/bid/24712
Summary:
The 'flac123' utility is prone to a stack-based buffer-overflow vulnerabi=
lity because it fails to perform adequate boundary checks on user-supplie=
d data.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of a user running the application. Failed atte=
mpts will likely cause denial-of-service conditions.
This issue affects 'flac123' 0.0.9; other versions may also be affected.
27. Moodle Index.PHP Cross Site Scripting Vulnerability
BugTraq ID: 24748
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24748
Summary:
Moodle is prone to a cross-site scripting vulnerability because it fails =
to properly sanitize user-supplied input.
Exploiting this vulnerability may allow an attacker to perform cross-site=
scripting attacks on unsuspecting users in the context of the affected w=
ebsite. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.
This issue affects Moodle 1.7.1; other versions may also be vulnerable.
28. BBS100 Multiple Denial of Service Vulnerabilities
BugTraq ID: 24747
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24747
Summary:
The 'bbs100' program is prone to multiple denial-of-service vulnerabiliti=
es.
An attacker can exploit these issues to crash the service. Other attacks=
may be possible as well.
=20
Versions prior to bbs100 3.2 are affected.
29. GIMP PSD File Integer Overflow Vulnerability
BugTraq ID: 24745
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24745
Summary:
GIMP is prone to an integer-overflow vulnerability because it fails to pr=
operly bounds-check user-supplied input data before copying it to an insu=
fficiently sized memory buffer.
Successful exploits of this vulnerability allow remote attackers to execu=
te arbitrary machine code in the context of the affected application.
GIMP 2.2.15 is vulnerable to this issue; other versions may also be affec=
ted.
30. Asterisk SIP T.38 SDP Parsing Remote Stack Buffer Overflow Vulnerabil=
ities
BugTraq ID: 23648
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/23648
Summary:
Asterisk is prone to multiple remote stack-based buffer-overflow vulnerab=
ilities because it fails to perform adequate boundary checks on user-supp=
lied data before copying it to insufficiently sized buffers.
Successful exploits may allow an attacker to execute arbitrary machine co=
de to compromise an affected computer or to cause denial-of-service condi=
tions.
Versions prior to Asterisk Open Source 1.4.3, AsteriskNOW Beta 6, and As=
terisk Appliance Developer Kit 0.4.0 are vulnerable.
NOTE: These issues occur only when 't38 fax over SIP' is enabled in 'sip.=
conf'.
31. Microsoft Internet Explorer Zone Denial of Service Vulnerability
BugTraq ID: 24744
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24744
Summary:
Microsoft Internet Explorer is prone to a denial-of-service vulnerability=
because the application fails to handle exceptional conditions.
Remote attackers can exploit this issue to cause the application to hang =
when viewing arbitrary websites.
This issue affects Internet Explorer 6 and 7.
32. SoftNews Media Group DataLife Engine Multiple Remote File Include Vul=
nerabilities
BugTraq ID: 22913
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/22913
Summary:
DataLife Engine is prone to multiple remote file-include vulnerabilities.
=20
An attacker can exploit these issues to include an arbitrary remote file =
containing malicious PHP code and execute it in the context of the webser=
ver process. This may allow the attacker to compromise the application an=
d the underlying system; other attacks are also possible.
Further reports reveals the reported vulnerable parameter is a constant a=
nd not a variable, thus can not be controlled by an attacker. This BID is=
being retired as the application is not vulnerable.
33. Claroline $_SERVER['PHP_SELF'] Parameter Multiple Cross-Site Scriptin=
g Vulnerabilities
BugTraq ID: 24742
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24742
Summary:
Claroline is prone to multiple cross-site scripting vulnerabilities becau=
se it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
Versions prior to Claroline 1.8.4 are vulnerable.
34. LightBlog Add_Comment.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 24741
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24741
Summary:
LightBlog is prone to a cross-site scripting vulnerability because the ap=
plication fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
Versions prior to LightBlog 6 are vulnerable.
35. SaPHPLesson Show.PHP SQL Injection Vulnerability
BugTraq ID: 18117
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/18117
Summary:
SaPHPLesson is prone to an SQL-injection vulnerability. This issue is due=
to a failure in the application to properly sanitize user-supplied input=
before using it in an SQL query.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase implementation.
36. Free Domain CO.NR Clone Members.PHP SQL Injection Vulnerability
BugTraq ID: 24737
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24737
Summary:
Free Domain CO.NR Clone is prone to an SQL-injection vulnerability becaus=
e it fails to sufficiently sanitize user-supplied data before using it in=
an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Free Domain CO.NR Clone 1.0 is vulnerable; other versions may also be aff=
ected.
37. Efendy Blog Search Field Cross Site Scripting Vulnerability
BugTraq ID: 24738
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24738
Summary:
Efendy Blog is prone to a cross-site scripting vulnerability because the =
application fails to properly sanitize user-supplied input.
An attacker may perform cross-site scripting attacks on unsuspecting user=
s in the context of the affected website. As a result, the attacker may b=
e able to steal cookie-based authentication credentials and to launch oth=
er attacks.
This issue affects Efendy Blog 1.0; other versions may also be affected.
38. ETicket SERVER[REQUEST_URI] Parameter Multiple HTML Injection Vulnera=
bilities
BugTraq ID: 24740
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24740
Summary:
eTicket is prone to multiple HTML-injection vulnerabilities because it fa=
ils to sufficiently sanitize user-supplied input data.
Exploiting these issues may allow an attacker to execute HTML and script =
code in the context of the affected site, to steal cookie-based authentic=
ation credentials, or to control how the site is rendered to the user; ot=
her attacks are also possible.
This issue affects eTicket 1.5.1.1; other versions may also be affected.
39. SAPHPLesson Multiple SQL Injection Vulnerabilities
BugTraq ID: 18501
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/18501
Summary:
The saphplesson module is prone to multiple SQL-injection vulnerabilities=
. These issues are due to a failure in the application to properly saniti=
ze user-supplied input before using it in SQL queries.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase implementation.
40. SlackRoll Malicious Package Denial of Service Vulnerability
BugTraq ID: 24739
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24739
Summary:
SlackRoll is prone to a denial-of-service vulnerability.=20
An attacker can exploit this issue to crash the affected application, den=
ying service to legitimate users.=20
This issue affects versions prior to SlackRoll 10.
41. SPHPell Multiple Remote File Include Vulnerabilities
BugTraq ID: 24727
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24727
Summary:
SPHPell is prone to multiple remote file-include vulnerabilities because =
it fails to sufficiently sanitize user-supplied input.
Exploiting these issues may allow an attacker to compromise the applicati=
on and the underlying system; other attacks are also possible.
These issues are reported to affect SPHPell 1.01; other versions may also=
be vulnerable.
42. Mozilla Firefox OnKeyDown Event File Upload Vulnerability
BugTraq ID: 24725
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24725
Summary:
Mozilla Firefox is prone to an information-disclosure vulnerability that =
can allow an attacker to access sensitive files.
This issue stems from a design error resulting from the improper handling=
of form fields.=20
All versions of Firefox are considered vulnerable.
43. Mozilla Firefox About:Blank IFrame Cross Domain Information Disclosur=
e Vulnerability
BugTraq ID: 24286
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24286
Summary:
Mozilla Firefox is prone to a cross-domain information-disclosure vulnera=
bility because scripts may persist across navigations.=20
A malicious site may be able to modify the iframe of a site in an arbitra=
ry external domain. Attackers could exploit this to gain access to sensit=
ive information that is associated with the external domain. Other attack=
s are also possible, such as executing script code in other browser secur=
ity zones.
This issue is being tracked by Bugzilla Bug 382686 and is reportedly rela=
ted to Bug 343168.
Firefox 2.0.0.4 and prior versions are vulnerable.
44. Buddy Zone Multiple SQL Injection Vulnerabilities
BugTraq ID: 24726
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24726
Summary:
Buddy Zone is prone to multiple SQL-injection vulnerabilities because it =
fails to sufficiently sanitize user-supplied data before using it in an S=
QL query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
Buddy Zone 1.5 and prior versions are vulnerable; other versions may also=
be affected.
45. XCMS Multiple Local File Include Vulnerabilities
BugTraq ID: 24724
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24724
Summary:
XCMS is prone to multiple local file-include vulnerabilities because it f=
ails to sufficiently sanitize user-supplied input.=20
Exploiting these issues may allow an attacker to access potentially sensi=
tive information and execute arbitrary local scripts within the context o=
f the webserver process.=20
These issues affect XCMS 1.1; other versions may also be affected.
46. Ripe Website Manager Multiple Remote File Include and Information Dis=
closure Vulnerabilities
BugTraq ID: 24722
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24722
Summary:
Ripe Website Manager is prone to multiple vulnerabilities, including remo=
te file-include issues and an information-disclosure issue, because the =
application fails to sufficiently sanitize user-supplied input and becaus=
e of a desing error.
Exploiting these issues may allow an attacker to compromise the applicati=
on and the underlying system as well as access sensitive information that=
may aid in further attacks.=20
These issues are reported to affect Ripe Website Manager 0.8.9 and earlie=
r versions.
47. Easybe 1-2-3 Music Store Process.PHP Script SQL Injection Vulnerabili=
ty
BugTraq ID: 24723
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24723
Summary:
1-2-3 Music Store is prone to an SQL-injection vulnerability because it f=
ails to sufficiently sanitize user-supplied data before using it in an SQ=
L query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
=20
All versions of 1-2-3 Music Store are considered vulnerable.
48. Fireflier-Server Insecure Temporary File Creation Vulnerability
BugTraq ID: 24718
Remote: No
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24718
Summary:
Fireflier-Server application creates temporary files in an insecure manne=
r.
An attacker with local access could potentially exploit this issue to rem=
ove arbitrary files from the local system. =20
Successfully mounting a symlink attack may allow the attacker to remove s=
ensitive files, which may result in a denial of service. Other attacks ma=
y also be possible.
49. HispaH Youtube Clone MSG.PHP Script SQL Injection Vulnerability
BugTraq ID: 24720
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24720
Summary:
Youtube Clone script is prone to an SQL-injection vulnerability because i=
t fails to sufficiently sanitize user-supplied data before using it in an=
SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
All versions of Youtube Clone are considered vulnerable.
50. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerabili=
ty
BugTraq ID: 24074
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24074
Summary:
FreeType is prone to an integer-overflow vulnerability because it fails t=
o properly validate TTF files.
An attacker may exploit this issue by enticing victims into opening malic=
iously crafted TTF Files.
Successful exploits will allow attackers to execute arbitrary code in the=
context in the context of applications that use the affected library. Fa=
iled exploit attempts will likely result in denial-of-service conditions.
This issue affects FreeType 2.3.4 and prior versions.
51. File(1) Command File_PrintF Integer Underflow Vulnerability
BugTraq ID: 23021
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/23021
Summary:
The file(1) command is prone to an integer-underflow vulnerability becaus=
e the command fails to adequately handle user-supplied data.
An attacker can leverage this issue to corrupt heap memory and execute ar=
bitrary code with the privileges of a user running the command. A success=
ful attack may result in the compromise of affected computers. Failed att=
empts will likely cause denial-of-service conditions.
Versions prior to 4.20 are vulnerable.
52. File Multiple Denial of Service Vulnerabilities
BugTraq ID: 24146
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24146
Summary:
The 'file' utility is prone to multiple denial-of-service vulnerabilities=
because it fails to handle exceptional conditions.=20
An attacker could exploit this issue by enticing a victim to open a speci=
ally crafted file. A denial-of-service condition can occur. Arbitrary cod=
e execution may be possible, but Symantec has not confirmed this.
53. EXIF Library EXIF File Processing Integer Overflow Vulnerability
BugTraq ID: 24461
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24461
Summary:
The 'libexif' library is reported prone to an integer-overflow vulnerabil=
ity. Reportedly, the issue presents itself when the affected library is p=
rocessing malformed EXIF files. =20
=20
Attackers may leverage this issue to execute arbitrary code in the contex=
t of an application that is linked to the vulnerable library. Failed expl=
oit attempts will likely result in denial-of-service conditions.
This issue affects 'libexif' 0.6.13 to 0.6.15; other versions may also be=
affected.
54. LibEXIF Exif_Data_Load_Data_Entry Remote Integer Overflow Vulnerabili=
ty
BugTraq ID: 23927
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/23927
Summary:
The libexif library is prone to an integer-overflow vulnerability because=
the software fails to properly ensure that integer math operations do no=
t result in overflows.
Successful exploits of this vulnerability allow remote attackers to execu=
te arbitrary machine code in the context of an application using the vuln=
erable library. Failed attempts will likely result in denial-of-service c=
onditions.
=20
Versions of libexif prior to 0.6.14 are vulnerable to this issue.
55. MIT Kerberos 5 KAdminD Server Rename_Principal_2_SVC() Function Stack=
Buffer Overflow Vulnerability
BugTraq ID: 24653
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24653
Summary:
Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is prone to =
a stack-based buffer-overflow vulnerability because the software fails to=
adequately bounds-check user-supplied data before copying it to an insuf=
ficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code with adminis=
trative privileges. A successful attack can result in the complete compro=
mise of the application. Failed attempts will likely result in denial-of-=
service conditions.
All 'kadmind' servers run on the master Kerberos server. Since the maste=
r server holds the KDC principal and policy database, an attack may not =
only compromise the affected computer, but could also compromise multipl=
e hosts that use the server for authentication.
Kerberos 5 'kadmind' 1.6.1, 1.5.3, and prior versions are vulnerable.
56. MIT Kerberos 5 KAdminD Server RPC Type Conversion Stack Buffer Overfl=
ow Vulnerability
BugTraq ID: 24657
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24657
Summary:
Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is prone to =
a stack-based buffer-overflow vulnerability because the software fails to=
adequately bounds-check user-supplied data before copying it to an insuf=
ficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code with adminis=
trative privileges. A successful attack can result in the complete compro=
mise of the application. Failed attempts will likely result in denial-of-=
service conditions.
This issue also affects third-party applications using the affected RPC l=
ibrary.
All 'kadmind' servers run on the master Kerberos server. Since the maste=
r server holds the KDC principal and policy database, an attack may not =
only compromise the affected computer, but could also compromise multipl=
e hosts that use the server for authentication.
Kerberos 5 'kadmind' 1.6.1 and prior versions are vulnerable.
57. MIT Kerberos Administration Daemon RPC Library Free Pointer Remote Co=
de Execution Vulnerability
BugTraq ID: 24655
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24655
Summary:
MIT Kerberos 5 Administration Daemon (kadmind) is prone to a remote code-=
execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges, completely compromising affected computers. Failed exploit=
attempts will likely result in a denial-of-service conditions.
All kadmind servers run on the master Kerberos server. Since the master s=
erver holds the KDC principal and policy database, an attack may not only=
compromise the affected computer, but could also compromise multiple hos=
ts that use the server for authentication.
This issue also affects third-party applications using the affected RPC l=
ibrary.
kadmind versions prior to krb5-1.6.1 are vulnerable.
58. EKG Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 24600
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24600
Summary:
EKG is prone to multiple remote denial-of-service vulnerabilities because=
of design errors.
An attacker can trigger these issues to cause denial-of-service condition=
s to legitimate users of the application.
59. PHPEventCalendar Eventdisplay.PHP Script SQL Injection Vulnerability
BugTraq ID: 24721
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24721
Summary:
phpEventCalendar is prone to an SQL-injection vulnerability because it fa=
ils to sufficiently sanitize user-supplied data before using it in an SQL=
query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
phpEventCalendar 0.2.3 and prior versions are reported prone to this issu=
e.
60. Linux Kernel USBLCD Memory Consumption Denial Of Service Vulnerabilit=
y
BugTraq ID: 24734
Remote: No
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24734
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability because it=
fails to limit memory consumption by 'fast writers'.
Attackers can exploit this issue to consume memory, resulting in denial-o=
f-service conditions.
Versions prior to 2.6.22-rc7 are vulnerable.
61. Unicon-imc2 Environment Variable Buffer Overflow Vulnerability
BugTraq ID: 24719
Remote: No
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24719
Summary:
The 'unicon-imc2' package is affected by a local buffer-overflow vulnerab=
ility.=20
This issue presents itself when the affected application handles a long v=
alue supplied through an environment variable.
=20
This issue affects unicon-imc2 3.0.4; oher versions may be affected as we=
ll.
62. AV Arcade Cookie[ava_userid] Authentication Bypass Vulnerability
BugTraq ID: 24736
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24736
Summary:
AV Arcade is prone to an authentication-bypass vulnerability because the =
application fails to check user privileges when accessing the administrat=
ion pages.=20
An attacker can exploit this issue to compromise the application, which m=
ay aid in further attacks.
AV Arcade 2.1b is vulnerable; other versions may also be affected.
63. Gorki Online Santrac Sitesi Uyeler.ASP Multiple HTML Injection Vulner=
abilities
BugTraq ID: 24735
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24735
Summary:
Gorki Online Santrac Sitesi is prone to multiple HTML-injection vulnerabi=
lities because it fails to sufficiently sanitize user-supplied input data=
.
Exploiting these issues may allow an attacker to execute HTML and script =
code in the context of the affected site, to steal cookie-based authentic=
ation credentials, or to control how the site is rendered to the user; ot=
her attacks are also possible.
64. AV Arcade View_Page.PHP SQL Injection Vulnerability
BugTraq ID: 24728
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24728
Summary:
AV Arcade is prone to an SQL-injection vulnerability because it fails to =
sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
AV Arcade 2.1b is vulnerable; other versions may also be affected.
65. Elite Bulletin Board Multiple Input Validation Vulnerabilities
BugTraq ID: 24763
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24763
Summary:
Elite Bulletin Board is prone to multiple input validation vulnerabilitie=
s because, it fails to sufficiently sanitize user-supplied input. These i=
ssues include a vulnerability that permits attackers to modify user profi=
le information and a vulnerability that permits attackers to delete PM me=
ssages.=20
An attacker can exploit these issues to modify user-profiles and delete P=
M messages. This may lead to further attacks.=20
These issues affect versions prior to 1.0.10.
66. Fujitsu ServerView DBASCIIAccess Remote Command Execution Vulnerabili=
ty
BugTraq ID: 24762
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24762
Summary:
Fujitsu ServerView is prone to a remote command-execution vulnerability b=
ecause it fails to adequately sanitized user-supplied data.
Attackers can exploit this issue to execute arbitrary commands with the p=
rivileges of the affected application. Successful attacks will compromise=
the application and underlying webserver; other attacks are also possibl=
e.
Versions prior to 4.50.09 are vulnerable.
67. Fujitsu PRIMERGY BX300 Blade Server Information Disclosure Vulnerabil=
ity
BugTraq ID: 24761
Remote: Yes
Last Updated: 2007-07-04
Relevant URL: http://www.securityfocus.com/bid/24761
Summary:
Fujitsu PRIMERGY BX300 is prone to a remote information-disclosure vulner=
ability because the device fails to properly authenticate users prior to =
granting access to sensitive information.
Exploiting this issue allows remote attackers to gain access to potential=
ly sensitive configuration information from affected devices. This may ai=
d them in further attacks.
68. Microsoft Windows Registry Access Local Denial of Service Vulnerabili=
ty
BugTraq ID: 18995
Remote: No
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/18995
Summary:
Microsoft Windows is prone to a denial-of-service vulnerability.
This issue occurs when a program calls certain API calls for manipulating=
Windows registry keys. This may crash the affected computer.
NOTE: This BID has been revised (July 3, 2007); the issue was originally =
thought to be a vulnerability in Symantec Norton Personal Firewall, but =
further investigation reveals a problem in an underlying OS API.
69. ESRI ArcSDE Server Stack Buffer Overflow Vulnerability
BugTraq ID: 23175
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/23175
Summary:
ESRI ArcSDE Server is prone to a stack-based buffer-overflow vulnerabilit=
y.
An attacker can exploit this issue on an affected computer to execute cod=
e in the context of the affected application.
ESRI ArcSDE Server versions 8.3, 9.0, and 9.1 are vulnerable to this issu=
e.
Note: This BID was initially written as a denial-of-service issue. It has=
been updated to a stack-based buffer-overflow issue because of new infor=
mation.
70. ArcadeBuilder Cookie Data SQL Injection Vulnerability
BugTraq ID: 24731
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24731
Summary:
ArcadeBuilder is prone to an SQL-injection vulnerability because it fails=
to sufficiently sanitize user-supplied data before using it in an SQL qu=
ery.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
ArcadeBuilder 1.7 is vulnerable; other versions may also be affected.
71. Esqlanelapse Multiple Unspecified Vulnerabilities
BugTraq ID: 24732
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24732
Summary:
Esqlanelapse is prone to multiple unspecified vulnerabilities. Few techni=
cal details are currently available. We will update this BID as more info=
rmation emerges.
Versions prior to Esqlanelapse 2.6 are vulnerable to these issues.
72. Sun JavaDoc Tool Cross-Site Scripting Vulnerability
BugTraq ID: 24690
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24690
Summary:
Sun JavaDoc Tool is prone to a cross-site scripting vulnerability.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
73. EQDKP Login.PHP Arbitrary Variable Overwrite Vulnerability
BugTraq ID: 24643
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24643
Summary:
EQdkp is prone to a vulnerability that permits an attacker to overwrite a=
rbitrary variables because of a design error.=20
Successful exploits will result in the compromise of vulnerable applicati=
ons or denial-of-service conditions; other attacks are possible.
EQdkp 1.3.2e and prior versions are vulnerable.
74. Sun JDK JPG/BMP Parser Multiple Vulnerabilities
BugTraq ID: 24004
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24004
Summary:
Sun JDK is prone to a multiple vulnerabilities.=20
An attacker can exploit these issues to crash the affected application, e=
ffectively denying service. The attacker may also be able to execute arbi=
trary code, which may facilitate a compromise of the underlying system.
Sun JDK 1.5.0_07-b03 is vulnerable to these issues; other versions may al=
so be affected.
75. British Telecommunications Consumer Webhelper Multiple Buffer Overflo=
w Vulnerabilities
BugTraq ID: 24219
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24219
Summary:
The British Telecommunications Consumer Webhelper ActiveX control is pron=
e to multiple buffer-overflow vulnerabilities because it fails to bounds-=
check user-supplied data before copying it into an insufficiently sized b=
uffer.=20
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application using the ActiveX control=
(typically Internet Explorer). Failed exploit attempts likely result in =
denial-of-service conditions.
Versions of British Telecommunications Consumer Webhelper ActiveX Control=
prior to 2.0.0.8 are vulnerable to these issues.
76. Axis Camera Control ActiveX Control AxisCamControl.OCX Remote Buffer =
Overflow Vulnerability
BugTraq ID: 23816
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/23816
Summary:
Axis Camera Control is prone to a buffer-overflow vulnerability because i=
t fails to sufficiently bounds-check user-supplied input before copying i=
t to an insufficiently sized memory buffer.
Successful attacks corrupt process memory, allowing arbitrary code to run=
in the context of the client application using the affected ActiveX cont=
rol.
Axis Camera Control versions prior to 2.40.0.0 are vulnerable to this iss=
ue.
77. OpenSSH SCP Shell Command Execution Vulnerability
BugTraq ID: 16369
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/16369
Summary:
OpenSSH is prone to an SCP shell command-execution vulnerability because =
the application fails to properly sanitize user-supplied input before usi=
ng it in a 'system()' function call.
This issue allows attackers to execute arbitrary shell commands with the =
privileges of users executing a vulnerable version of SCP.
This issue reportedly affects OpenSSH 4.2; other versions may also be aff=
ected.
78. Opera Web Browser Running Adobe Flash Player Information Disclosure V=
ulnerability
BugTraq ID: 23437
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/23437
Summary:
Opera Web Browser is prone to an information-disclosure vulnerability whe=
n running Adobe Flash Player.
An attacker can exploit this issue to access potentially sensitive inform=
ation.
These versions are vulnerable:
Opera Web Browser prior to 9.20 for Linux, Solaris, and FreeBSD
Adobe Flash Player prior to 9.0.28.0
This issue also affects the Konqueror web browser.
79. Util-linux Login Security Bypass Vulnerability
BugTraq ID: 24321
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24321
Summary:
The 'login' utility (in 'util-linux') is prone to a security-bypass vulne=
rability because the utility fails to properly validate user privileges.
Exploiting this issue can allow an attacker to bypass certain security re=
strictions and potentially gain unauthorized access.
Versions prior to 'util-linux' 2.12 are vulnerable.
80. Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities
BugTraq ID: 21668
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/21668
Summary:
The Mozilla Foundation has released nine security advisories specifying v=
ulnerabilities in Firefox, SeaMonkey, and Thunderbird.
These vulnerabilities allow attackers to:
- execute arbitrary code
- perform cross-site scripting attacks
- inject arbitrary content
- gain escalated privileges
- crash affected applications and potentially execute arbitrary code.
Other attacks may also be possible.
81. GDB DWARF Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 19802
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/19802
Summary:
GDB is prone to multiple buffer-overflow vulnerabilities because of insu=
fficient bounds-checking when handling DWARF and DWARF2 data.
Attackers could leverage this issue to run arbitrary code outside of a re=
stricted environment; this may lead to privilege escalation.
82. Sun Solaris Remote IPv6 IPSec Packet Denial of Service Vulnerability
BugTraq ID: 24473
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24473
Summary:
Sun Solaris is prone to a denial-of-service vulnerability because the ope=
rating system fails to handle exceptional conditions.=20
An attacker can exploit this issue to cause the affected kernel to panic,=
resulting in a denial-of-service condition.
This issue affects the Solaris 10 operating system.
83. OpenLDAP SLAPD Access Control Circumvention Vulnerability
BugTraq ID: 19832
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/19832
Summary:
OpenLDAP slapd is prone to a vulnerability that allows attackers to circu=
mvent access controls.
=20
An attacker may be able to modify any domain name regardless of the owner=
.
Versions prior to 2.3.25 are vulnerable.
84. RETIRED:Symantec Norton Personal Firewall 2006 SymEvent Driver Local =
Denial of Service Vulnerability
BugTraq ID: 22961
Remote: No
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/22961
Summary:
Norton Personal Firewall 2006 is prone to a local denial-of-service vulne=
rability. This issue occurs when attackers send malformed data to the 'Sy=
mEvent' driver.
A local authenticated attacker may exploit this issue to crash affected c=
omputers, denying service to legitimate users.
This issue is reportedly a regression from the vulnerability described in=
BID 20051 (Symantec Multiple Products SymEvent Driver Local Denial of Se=
rvice Vulnerability). Symantec is currently investigating this issue; thi=
s BID will be updated as more information becomes available.
NOTE: This BID is being retired because it is already covered in BID 2005=
1.
85. Xvid Avi MBCoding.C Remote Code Execution Vulnerability
BugTraq ID: 24561
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24561
Summary:
Xvid is prone to a remote code-exexcution vulnerability due to an array-i=
ndexing error.
Attackers can exploit this issue to execute arbitrary code on an unsuspec=
ting user's computer.
Xvid 1.1.2 is vulnerable; other versions may also be affected.
86. Gnome Evolution Data Server Array Index Memory Access Vulnerability
BugTraq ID: 24567
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24567
Summary:
Evolution is prone to an input-validation error that attackers may exploi=
t to execute arbitrary code. The vulnerability stems from an input-valid=
ation error for a critical array index value.=20
Versions prior to Evolution Data Server 1.11.4 are vulnerable.
87. Sun Java Web Start Arbitrary File Overwrite Privilege Escalation Vuln=
erability
BugTraq ID: 24695
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24695
Summary:
Java Web Start is prone to a vulnerability that can result in privilege e=
scalation.
Attackers can exploit this issue to execute arbitrary code with the privi=
leges of the user running the application.
This issue affects these versions:
Java Web Start in JDK and JRE 5.0 Update 11 (and prior versions)
Java Web Start in SDK and JRE 1.4.2_13 (and prior versions)
88. VBZoom Forum.php SQL Injection Vulnerability
BugTraq ID: 18472
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/18472
Summary:
VBZooM is prone to an SQL-injection vulnerability. This issue is due to a=
failure in the application to properly sanitize user-supplied input befo=
re using it in SQL queries.
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
89. Firebird SQL Fbserver Remote Buffer Overflow Vulnerability
BugTraq ID: 24436
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24436
Summary:
Firebird SQL is prone to a remote buffer-overflow vulnerability.=20
=20
An attacker can exploit this issue to execute arbitrary machine code in t=
he context of the affected database server. Failed exploit attempts will =
likely crash the server, denying service to legitimate users. =20
Firebird SQL 2.0 is vulnerable; previous versions may also be affected.
90. TotalCalendar View_Event Script SQL Injection Vulnerability
BugTraq ID: 24716
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24716
Summary:
TotalCalendar is prone to an SQL-injection vulnerability because it fails=
to sufficiently sanitize user-supplied data before using it in an SQL qu=
ery.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
TotalCalendar 2.402 is reported vulnerable; other versions may also be a=
ffected.
91. Retired: MiniBB Language Parameter Local File Include Vulnerability
BugTraq ID: 24503
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24503
Summary:
miniBB is prone to a local file-include vulnerability because it fails to=
properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
miniBB 2.0.5 is vulnerable to this issue; prior versions may also be affe=
cted.
NOTE: Further analysis reveals that this issue is not exploitable. Theref=
ore, this BID is being retired.
92. Wheatblog Login SQL Injection Vulnerability
BugTraq ID: 24715
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24715
Summary:
Wheatblog is prone to an SQL-injection vulnerability because it fails to =
sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Wheatblog 1.1 is reported vulnerable; other versions may also be affected=
.
93. Progress Webspeed _CPYFile.P Unauthorized Access Vulnerability
BugTraq ID: 23634
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/23634
Summary:
Progress WebSpeed is prone to a vulnerability that lets attackers gain un=
authorized access to and execute administrative scripts.=20
An attacker may leverage this issue to create and execute malicious WebSp=
eed code on the host running the webserver. Such unauthorized access may =
help the attacker launch other attacks.
WebSpeed 3.1a, 3.1d, and 3.1e are vulnerable; other versions may also be =
affected.
NOTE: Further reports suggest that this issue affects only the 'Developme=
nt Mode' of the application. This mode is not intended to be used in prod=
uction systems. This issue is also present when the 'tty' directory is in=
stalled.
94. WebAPP Multiple Vulnerabilities
BugTraq ID: 22691
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/22691
Summary:
WebAPP is prone to multiple vulnerabilities, including cross-site scripti=
ng issues, arbitrary-file-upload issues, remote script-code-execution iss=
ues, and a privilege-escalation issue.
Attackers could exploit these issues to steal cookie-based authentication=
credentials from legitimate users of the site and compromise the applica=
tion and the underlying system; other attacks are also possible.
This issue affects versions prior to WebAPP 0.9.9.6.
95. WebApp.org and WebApp.net Multiple Input Validation Vulnerabilities
BugTraq ID: 24714
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24714
Summary:
WebAPP.org and WebAPP.net are prone to multiple input-validation vulnerab=
ilities because the software fails to sufficiently sanitize user-supplied=
input.
An attacker can exploit these issues to obtain sensitive information, exe=
cute arbitrary script code in the context of the affected application, st=
eal cookie-based authentication credentials, and control how the site is =
rendered to the user; other attacks are also possible.
96. Menu Manager Module System Command Remote Command Execution Vulnerabi=
lity
BugTraq ID: 24453
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/24453
Summary:
The Menu Manager module for WebAPP is prone to a remote command-execution=
vulnerability because it fails to sufficiently sanitize user-supplied in=
put.=20
An attacker can exploit this issue to execute arbitrary system commands w=
ithin the context of the affected webserver.=20
This issue affects Menu Manager Module 1.5 running on WebAPP prior to 0.9=
.9.7.
97. Web-App.Org and Web-App.Net Multiple Cross-Site Scripting Vulnerabili=
ties
BugTraq ID: 17359
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/17359
Summary:
Web-App.Org and Web-App.Net are prone to multiple cross-site scripting vu=
lnerabilities because the applications fail to properly sanitize user-sup=
plied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may help the attacker steal cookie-based authentication credentials=
and launch other attacks.
98. Colored Scripts Easy Message Board Remote Command Execution Vulnerabi=
lity
BugTraq ID: 13637
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/13637
Summary:
Colored Scripts Easy Message Board is prone to a remote command-executio=
n vulnerability because it fails to properly sanitize user-supplied input=
.
99. Web-APP.Org WebAPP Directory Traversal Vulnerability
BugTraq ID: 11028
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/11028
Summary:
WebAPP is reported prone to a directory-traversal vulnerability because t=
he application fails to properly sanitize user-supplied input data.=20
=20
An attacker can exploit this vulnerability to retrieve arbitrary, potenti=
ally sensitive files from the hosting computer with the privileges of the=
webserver. gthe attacker could trivially retrieve DES-encrypted password=
hashes for all users of the application. This may aid the attacker in fu=
rther attacks.
100. McAfee SecurityCenter Subscription Manager ActiveX Buffer Overflow V=
ulnerability
BugTraq ID: 19265
Remote: Yes
Last Updated: 2007-07-03
Relevant URL: http://www.securityfocus.com/bid/19265
Summary:
McAfee SecurityCenter is prone to a stack-based buffer-overflow vulnerabi=
lity. This vulnerability requires a certain amount of user-interaction f=
or an attack to occur, such as visiting a malicious website. A successful=
exploit would let a remote attacker execute code with the privileges of =
the currently logged in user.=20
This issue is reported to affect versions 4.3 through 6.0.22. Please see =
the affected packages section for a list of McAfee consumer products that=
ship with vulnerable versions of the McAfee SecurityCenter.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Lawmakers worry over gov't network breaches
By: Robert Lemos
Hearings on the Hill reveal a significant number of security breaches at =
the Departments of Commerce, Defense, Homeland Security, State and Energy=
.
http://www.securityfocus.com/news/11472
2. Amero case spawns effort to educate
By: Robert Lemos
Following a judge's ruling to throw out a verdict based on faulty digital=
forensics, a group of security professionals, legal experts and educator=
s look to the future.
http://www.securityfocus.com/news/11471
3. Group: Anti-hacking laws can hobble Net security
By: Robert Lemos
A working group of security researchers, digital-rights activists and gov=
ernment prosecutors discuss whether bug hunters can find vulnerabilities =
in Web sites without violating laws.
http://www.securityfocus.com/news/11470
4. Judge nixes teacher's conviction on porn pop-ups
By: Robert Lemos
A Connecticut judge grants a new trial for substitute teacher Julie Amero=
, saying that forensics information discovered after her conviction has d=
irect bearing on her case.
http://www.securityfocus.com/news/11469
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Writing ascii shellcode (\xcc)
http://www.securityfocus.com/archive/82/472801
2. PacSec 2007 Call For Papers (Nov. 29/30, deadline July 27)
http://www.securityfocus.com/archive/82/472810
3. Developing exploit for a tricky vulnerability
http://www.securityfocus.com/archive/82/472526
4. Exotic vulnerability
http://www.securityfocus.com/archive/82/472390
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Help debugging a problem - Virtual Server 2005
http://www.securityfocus.com/archive/88/472718
2. MS ISA 2004 Server
http://www.securityfocus.com/archive/88/472717
3. SecurityFocus Microsoft Newsletter #348
http://www.securityfocus.com/archive/88/472425
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: Watchfire
As web applications become increasingly complex, tremendous amounts of se=
nsitive data - including personal, medical and financial information - ar=
e exchanged, and stored. This paper examines a few vulnerability detectio=
n methods - specifically comparing and contrasting manual penetration tes=
ting with automated scanning tools. Download Watchfire's "Web Application=
Security: Automated Scanning or Manual Penetration Testing?" whitepaper =
today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=3D701700000008yk=
a