SecurityFocus Newsletter #410
[email protected] 18 Jul 2007 23:02:50 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #410
----------------------------------------
This Issue is Sponsored by: Black Hat
Attend Black Hat USA, July 28-August 2 in Las Vegas, the world's premier =
technical event for ICT security experts. Featuring 30 hands-on training =
courses and 90 Briefings presentations with lots of new content and new t=
ools. Network with 4,000 delegates from 70 nations. Visit product displ=
ays by 30 top sponsors in a relaxed setting. =20
http://www.blackhat.com
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1. Security conferences versus practical knowledge
2. Achtung! New German Laws on Cybercrime
II. BUGTRAQ SUMMARY
1. BBS E-Market P_Mode Parameter Remote File Include Vulnerability
2. Samsung Linux Printer Driver SetUID Script Local Privilege Esca=
lation Vulnerability=20
3. Hitachi JP1/NETM/DM Manager Products Unspecified SQL Injection =
Vulnerability
4. Pidgin Unspecified Remote Command Execution Vulnerability
5. CMScout Forums.PHP SQL Injection Vulnerability
6. IRIX inpview Race Condition Vulnerability
7. Drupal LoginToboggan Module Username HTML Injection Vulnerabili=
ty
8. Aigaion Index.PHP SQL Injection Vulnerability
9. Mozilla Thunderbird/SeaMonkey/Firefox Multiple Remote Vulnerabi=
lities
10. RETIRED: Symantec pcAnywhere CIF Files Local Privilege Escalat=
ion Vulnerability
11. RETIRED: MKPortal Multiple Modules SQL Injection Vulnerability
12. 8e6 R3000 Internet Filter Multiple Cross-Site Scripting Vulner=
abilities
13. Symantec AntiVirus Malformed CAB and RAR Compression Remote Vu=
lnerabilities
14. Microsoft Excel Worksheet Remote Code Execution Vulnerability
15. Microsoft .Net Framework Multiple Null Byte Injection Vulnerab=
ilities
16. Apache HTTP Server Worker Process Multiple Denial of Service V=
ulnerabilities
17. Progress and OpenEdge _mprosrv Buffer Overflow Vulnerability
18. policyd W_Read Function Remote Buffer Overflow Vulnerability
19. activeWeb contentserver Permissions Bypass Weakness
20. ActiveWeb Contentserver Multiple Cross-Site Scripting Vulnerab=
ilities
21. RETIRED: Symantec Norton Personal Firewall SuiteOwners Registr=
y Key Security Bypass Vulnerability
22. ActiveWeb Contentserver CMS Client Side Filtering Bypass Vulne=
rability
23. ActiveWeb Contentserver Mimetype Name HTML Injection Vulnerabi=
lity
24. SiteScape Forum Multiple Unspecified Cross-Site Scripting Vuln=
erabilities
25. NetWin SurgeFTP Multiple Remote Vulnerabilities
26. Microsoft Excel Version Information Validation Remote Code Exe=
cution Vulnerability
27. Curl GnuTLS Certificate Verfication Access Validation Vulnerab=
ility
28. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vuln=
erability
29. Trillian URI Handler Remote Code Execution Vulnerabilities
30. LedgerSMB Login.PL Authentication Bypass Vulnerability
31. WordPress Multiple Themes S Parameter Cross-Site Scripting Vul=
nerability
32. SpoonLabs Vivvo CMS Index.PHP SQL Injection Vulnerability
33. Oracle July 2007 Critical Patch Update Multiple Vulnerabilitie=
s
34. Asterisk Multiple Remote Denial of Service Vulnerabilities
35. Asterisk IAX2 Channel Driver IAX2_Write Function Remote Stack =
Buffer Overflow Vulnerability
36. Apple Mac OS X mDNSResponder Variant Unspecified Remote Code E=
xecution Vulnerability
37. Computer Associates Alert Notification Server Multiple Buffer =
Overflow Vulnerabilities
38. QuickerSite Default.ASP Cross-Site Scripting Vulnerability
39. Mozilla Firefox 2.0.0.4 Multiple Remote Vulnerabilities
40. Mozilla Firefox About:Blank IFrame Cross Domain Information Di=
sclosure Vulnerability
41. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
42. Mozilla Firefox URLBar Null Byte File Remote Code Execution Vu=
lnerability
43. Mozilla Firefox WYCIWYG:// URI Cache Zone Bypass Vulnerability
44. Expert Advisor Index.PHP SQL Injection Vulnerability
45. Microsoft Internet Explorer Multiple Browser URI Handler Comma=
nd Injection Vulnerability
46. Dovecot Zlib Plugin Remote Information Disclosure Vulnerabilit=
y
47. PHP Soap Engine Make_HTTP_Soap_Request Weak Nonce HTTP Authent=
ication Weakness
48. PHP Prior to 5.2.2/4.4.7 Multiple Remote Buffer Overflow Vulne=
rabilities
49. MIT Kerberos 5 KAdminD Server Rename_Principal_2_SVC() Functio=
n Stack Buffer Overflow Vulnerability
50. Element CMS S Parameter Cross-Site Scripting Vulnerability
51. Data Dynamics ActiveBar Actbar3.OCX ActiveX Control Multiple I=
nsecure Methods Vulnerabilities
52. Cisco Wide Area Application Services CIFS Remote Denial of Ser=
vice Vulnerability
53. Pictures Rating Index.PHP SQL Injection Vulnerability
54. Oracle April 2007 Security Update Multiple Vulnerabilities
55. Jasmine CMS Profile.PHP HTML Injection Vulnerability
56. Marshal MailMarshal SMTP Spam Quarantine Interface User Passwo=
rd Change Vulnerability
57. Insanely Simple Blog Multiple Input Validation Vulnerabilities
58. ASP Ziyaret=C3=A7i Defteri Multiple HTML Injection Vulnerabili=
ties
59. CubeCart Cart.Inc.PHP SQL Injection Vulnerability
60. MySQL Security Invoker Privilege Escalation Vulnerability
61. MySQL Rename Table Function Access Validation Vulnerability
62. Trend Micro OfficeScan Server CGI Modules Stack Buffer Overflo=
w Vulnerability
63. Trend Micro OfficeScan Management Console Authentication Bypas=
s Vulnerability
64. Apple QuickTime Information Disclosure and Multiple Code Execu=
tion Vulnerabilities
65. Adobe Flash Player SWF File Handling Remote Code Execution Vul=
nerability
66. Apache Tomcat Manager and Host Manager Upload Script Cross-Sit=
e Scripting Vulnerability
67. Apache Tomcat JSP Example Web Applications Cross Site Scriptin=
g Vulnerability
68. X.Org XFS Init Script Insecure Temporary File Creation Vulnera=
bility
69. Perl Net::DNS Remote Multiple Vulnerabilities
70. Kaspersky Anti-Virus 5.5 for Check Point Firewall-1 Denial of =
Service Vulnerability
71. Zoph _Order Multiple SQL Injection Vulnerabilities
72. Disk ARchive Flawed Blowfish-CBC Cryptography Implementation W=
eakness
73. Traffic Stats ReferralUrl.PHP SQL Injection Vulnerability
74. Infinite Responder Unspecified SQL Injection Vulnerability
75. husrevforum Philboard_forum.ASP SQL Injection Vulnerability
76. AIX lchangelv Buffer Overflow Vulnerability
77. IBM Tivoli Provisioning Manager for OS Deployment Divide By Ze=
ro Denial of Service Vulnerability
78. Yahoo! Messenger Address Book Remote Buffer Overflow Vulnerabi=
litiy
79. Netscape Enterprise Accept Buffer Overflow Vulnerability
80. Microsoft IE5 ActiveX "Object for constructing type libraries=
for scriptlets" Vulnerability
81. Omnis Studio 2.4 Weak Database Field Encryption Vulnerability
82. PHP Glob() Function Arbitrary Code Execution Vulnerability
83. Caldera OpenLinux 'smail -D' Command Vulnerability
84. SiteTrafficStats ReferralURL.PHP SQL Injection Vulnerability
85. Citadel WebCit Multiple Input Validation Vulnerabilities
86. HP Serviceguard for Linux Unspecified Local Privilege Escalati=
on Vulnerability
87. TBDev.NET DR TakeProfEdit.PHP HTML Injection Vulnerability
88. InterActual Player IAMCE and IAKey Remote Buffer Overflow Vuln=
erabilities
89. REALTOR 747 Index.PHP SQL Injection Vulnerability
90. Prozilla Directory.PHP SQL Injection Vulnerability
91. paFileDB Search.PHP SQL Injection Vulnerability
92. Microsoft Internet Explorer OnBeforeUnload Javascript Browser =
Entrapment Vulnerability
93. AzDG Dating Gold Multiple Remote File Include Vulnerabilities
94. MzK Blog Katgoster.ASP SQL Injection Vulnerability
95. Opera Web Browser Address Bar URI Spoofing Vulnerability
96. KDE Konqueror Address Bar URI Spoofing Vulnerability
97. RETIRED: Konqueror Web Browser Data: URL Scheme Address Bar Sp=
oofing Vulnerability
98. eSyndiCat Link Directory Multiple SQL Injection Vulnerabilitie=
s
99. Hitachi TP1/Server Base Unspecified Denial Of Service Vulnera=
bility
100. Multiple Hitachi Products GIF Image Buffer Overflow Vulnerabi=
lity
III. SECURITYFOCUS NEWS
1. Flaw auction site highlights disclosure issues
2. Fast flux foils bot-net takedown
3. Lawmakers worry over gov't network breaches
4. Amero case spawns effort to educate
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Manager, Information Security, Slough
2. [SJ-JOB] Sr. Security Analyst, Baltimore
3. [SJ-JOB] Sr. Security Analyst, Denver
4. [SJ-JOB] Senior Software Engineer, New York
5. [SJ-JOB] Jr. Security Analyst, Wilmington
6. [SJ-JOB] Security Architect, Washington
7. [SJ-JOB] Sales Engineer, DC area
8. [SJ-JOB] Application Security Engineer, London
9. [SJ-JOB] Security Engineer, Denver
10. [SJ-JOB] Sales Representative, Livonia
11. [SJ-JOB] Security Engineer, Wilmington
12. [SJ-JOB] Security Engineer, Denver
13. [SJ-JOB] Sr. Security Engineer, Omaha
14. [SJ-JOB] Developer, Sydney
15. [SJ-JOB] Sr. Security Analyst, Washington
16. [SJ-JOB] Sr. Security Analyst, San Antonio
17. [SJ-JOB] Software Engineer, Livonia
18. [SJ-JOB] Penetration Engineer, Wilmington
19. [SJ-JOB] Technical Support Engineer, Mountain View
20. [SJ-JOB] Sr. Security Engineer, Denver
21. [SJ-JOB] Management, Mountain View
22. [SJ-JOB] Security Engineer, Roseland
23. [SJ-JOB] Security Architect, Leatherhead and Europe
24. [SJ-JOB] Security Architect, Bristol or Cheltenham
25. [SJ-JOB] Sr. Security Analyst, Roseland
26. [SJ-JOB] Security Architect, Roseland
27. [SJ-JOB] Security Architect, New York
28. [SJ-JOB] Developer, Redmond
29. [SJ-JOB] Application Security Engineer, Wilmington
30. [SJ-JOB] Sr. Security Analyst, Charlotte
31. [SJ-JOB] Security Architect, Lisle
32. [SJ-JOB] Security Consultant, London, Edinburgh
33. [SJ-JOB] Security Engineer, Dallas
34. [SJ-JOB] Auditor, Columbia
35. [SJ-JOB] Security Architect, Minneapolis
36. [SJ-JOB] Security Engineer, Austin
37. [SJ-JOB] Security Consultant, London, Edinburgh
38. [SJ-JOB] Security Engineer, Washington
39. [SJ-JOB] Jr. Security Analyst, WASHINGTON
40. [SJ-JOB] Application Security Engineer, Washington
41. [SJ-JOB] Sr. Security Engineer, Sunnyvale
42. [SJ-JOB] Director, Information Security, San Mateo
43. [SJ-JOB] Security Consultant, London
44. [SJ-JOB] Security Consultant, London
45. [SJ-JOB] Technical Writer, Washington D.C.
46. [SJ-JOB] Manager, Information Security, St. Louis
47. [SJ-JOB] Sr. Security Analyst, Washington D.C.
48. [SJ-JOB] Software Engineer, Columbia
49. [SJ-JOB] Management, Cleveland
50. [SJ-JOB] Security Architect, Chicago
51. [SJ-JOB] Application Security Architect, Valley Forge
52. [SJ-JOB] Sr. Security Engineer, Chantilly
53. [SJ-JOB] Security Consultant, Detroit
54. [SJ-JOB] Software Engineer, Atlanta
55. [SJ-JOB] Security Engineer, Chantilly
56. [SJ-JOB] Security Consultant, Toronto
57. [SJ-JOB] Security Architect, Washington DC
58. [SJ-JOB] Security Engineer, Irvine
59. [SJ-JOB] Sales Engineer, Reston
60. [SJ-JOB] Application Security Architect, Long Island
61. [SJ-JOB] Security Consultant, Denver
62. [SJ-JOB] Security Consultant, Slough
63. [SJ-JOB] Director, Information Security, Greenwood Village
64. [SJ-JOB] Security Consultant, Washington DC
65. [SJ-JOB] Management, Mt. View
66. [SJ-JOB] Application Security Architect, Washington
67. [SJ-JOB] Security Architect, Charlotte
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
1. Java - JRE, SDK Java Web Start
2. CFP now open for ClubHack, India's own hackers' convention
3. [TOOL] winFuzz (1.0.0.1)
VII. MICROSOFT FOCUS LIST SUMMARY
1. Sync Domain Account password and Local Account password
2. Restrict access
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. Security conferences versus practical knowledge
By Don Parker
While the training industry as a whole has evolved rather well to suit th=
e needs of their clients, the computer conference - specifically the comp=
uter security conference - has declined in relevance to the everyday sys-=
admin and network security practitioners.
http://www.securityfocus.com/columnists/449
2. Achtung! New German Laws on Cybercrime
By Federico Biancuzzi
Germany is passing some new laws regarding cybercrime that might affect s=
ecurity professionals. Federico Biancuzzi interviewed Marco Gercke, one o=
f the experts that was invited to the parliamentary hearing, to learn mor=
e about this delicate subject. They discussed what is covered by the new =
laws, which areas remain in the dark, and how they might affect vulnerabi=
lity disclosure and the use of common tools, such as nmap.
http://www.securityfocus.com/columnists/448
II. BUGTRAQ SUMMARY
--------------------
1. BBS E-Market P_Mode Parameter Remote File Include Vulnerability
BugTraq ID: 24957
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24957
Summary:
BBS E-Market is prone to a remote file-include vulnerability because the =
application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute an arbitrary remote file c=
ontaining malicious script code in the context of the webserver process. =
This may allow the attacker to compromise the application and the underly=
ing system. Other attacks are also possible.
2. Samsung Linux Printer Driver SetUID Script Local Privilege Escalation =
Vulnerability=20
BugTraq ID: 24953
Remote: No
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24953
Summary:
Samsung Linux Printer Driver is prone to a local privilege-escalation vul=
nerability.=20
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges. Successfully exploiting this issue will result in the comp=
lete compromise of affected computers.
3. Hitachi JP1/NETM/DM Manager Products Unspecified SQL Injection Vulnera=
bility
BugTraq ID: 24903
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24903
Summary:
Multiple Hitachi JP1/NETM/DM Manager products are prone to an SQL-injecti=
on vulnerability because the applications fail to properly sanitize user-=
supplied input before using it in an SQL query.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
4. Pidgin Unspecified Remote Command Execution Vulnerability
BugTraq ID: 24904
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24904
Summary:
Pidgin is prone to an unspecified remote command-execution vulnerability =
because the application fails to adequately sanitize user-supplied data.
Attackers can exploit this issue to execute arbitrary commands with the p=
rivileges of the affected application. Successful exploits may facilitate=
a compromise of the application and the affected computer.
5. CMScout Forums.PHP SQL Injection Vulnerability
BugTraq ID: 24906
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24906
Summary:
CMScout is prone to an SQL-injection vulnerability because the applicatio=
n fails to properly sanitize user-supplied input before using it in an SQ=
L query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
This issue affects CMScout 1.23; other versions may also be vulnerable.
6. IRIX inpview Race Condition Vulnerability
BugTraq ID: 1530
Remote: No
Last Updated: 2007-07-14
Relevant URL: http://www.securityfocus.com/bid/1530
Summary:
Certain versions of IRIX ship with a version of inpview that creates file=
s in '/var/tmp/' in an insecure manner and is therefore prone to a race c=
ondition.
InPerson's 'inpview' is a networked multimedia conferencing tool. InPerso=
n provides multiway audio and video conferencing with a shared whiteboard=
, combined into a single, easy-to-use application. You use a separate "ph=
one" tool to place and answer calls.
The 'inpview' program writes out temporary files in the '/var/tmp' direct=
ory. Because these filenames are not random, an attacker can create a sym=
link to a previously created filename and force the SUID 'inpview' to ove=
rwrite the file with 'rw-rw-rw' permissions.
7. Drupal LoginToboggan Module Username HTML Injection Vulnerability
BugTraq ID: 24901
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24901
Summary:
The Drupal LoginToboggan module is prone to an HTML-injection vulnerabili=
ty because it fails to sufficiently sanitize user-supplied input data.
Exploiting this issue may allow an attacker to execute HTML and script co=
de in the context of the affected site, to steal cookie-based authenticat=
ion credentials, or to control how the site is rendered to the user; othe=
r attacks are also possible.
8. Aigaion Index.PHP SQL Injection Vulnerability
BugTraq ID: 24836
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24836
Summary:
Aigaion is prone to an SQL-injection vulnerability because the applicatio=
n fails to properly sanitize user-supplied input before using it in an SQ=
L query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
Aigaion 1.3.3 is vulnerable to this issue.
9. Mozilla Thunderbird/SeaMonkey/Firefox Multiple Remote Vulnerabilities
BugTraq ID: 22694
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/22694
Summary:
The Mozilla Foundation has released six security advisories specifying vu=
lnerabilities in Firefox, SeaMonkey, and Thunderbird.
These vulnerabilities allow attackers to:
- Execute arbitrary code
- Cause denial-of-service conditions
- Perform cross-site scripting attacks
- Obtain potentially sensitive information
- Spoof legitimate content
Other attacks may also be possible.
10. RETIRED: Symantec pcAnywhere CIF Files Local Privilege Escalation Vul=
nerability
BugTraq ID: 19059
Remote: No
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/19059
Summary:
pcAnywhere is prone to a local privilege-escalation vulnerability because=
it fails to secure access to important user-permission configuration fil=
es.=20
A successful exploit of this vulnerability may allow an attacker to remot=
ely access the system with administrator credentials.=20
pcAnywhere 12.5 is vulnerable to this issue; other versions may also be a=
ffected.
RETIRED: This BID is being retired because further investigation indicate=
s that the application is not vulnerable to this issue.
11. RETIRED: MKPortal Multiple Modules SQL Injection Vulnerability
BugTraq ID: 24891
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24891
Summary:
The MKPortal Reviews and Gallery modules are prone to an SQL-injection vu=
lnerability because they fail to sufficiently sanitize user-supplied data=
before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
MKPortal 1.1.1 is vulnerable; other versions may also be affected.
NOTE: This BID is being retired because it duplicates some of the informa=
tion covered in BID 24886 (MKPortal Multiple SQL Injection Vulnerabilitie=
s).
12. 8e6 R3000 Internet Filter Multiple Cross-Site Scripting Vulnerabiliti=
es
BugTraq ID: 24206
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24206
Summary:
The 8e6 R3000 Internet Filter appliance is prone to multiple cross-site s=
cripting vulnerabilities because it fails to properly sanitize user-suppl=
ied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected devic=
e. This may help the attacker steal cookie-based authentication credentia=
ls and launch other attacks.
Firmware versions prior to 2.0.05 are vulnerable.
13. Symantec AntiVirus Malformed CAB and RAR Compression Remote Vulnerabi=
lities
BugTraq ID: 24282
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24282
Summary:
Symantec AntiVirus products that include the Symantec Decomposer are pron=
e to multiple remote vulnerabilities related to the handling of CAB and R=
AR archives. These issues include a denial-of-service vulnerability and a=
buffer-overflow vulnerability.
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary machine code with SYSTEM-level privileges or to cause the affect=
ed application to enter an infinite loop, resulting in a denial-of-servic=
e condition.
14. Microsoft Excel Worksheet Remote Code Execution Vulnerability
BugTraq ID: 22555
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/22555
Summary:
Microsoft Excel is prone to a remote code-execution vulnerability.
Attackers may exploit this issue by enticing victims into opening a malic=
iously crafted Excel file (.xls).
Successful exploits may allow attackers to execute arbitrary code with th=
e privileges of the user running the application. This may facilitate a c=
ompromise of vulnerable computers.
This issue was previously reported as a denial-of-service vulnerability, =
but has been updated to reflect new information.
15. Microsoft .Net Framework Multiple Null Byte Injection Vulnerabilities
BugTraq ID: 24791
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24791
Summary:
Microsoft .NET Framework is prone to multiple NULL-byte injection vulnera=
bilities because it fails to adequately sanitize user-supplied data.
An attacker can exploit these issues to access sensitive information that=
may aid in further attacks; other attacks are also possible.
16. Apache HTTP Server Worker Process Multiple Denial of Service Vulnerab=
ilities
BugTraq ID: 24215
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24215
Summary:
Apache is prone to multiple denial-of-service vulnerabilities.
An attacker with the ability to execute arbitrary server-side script-code=
can exploit these issues to stop arbitrary services on the affected comp=
uter in the context of the master webserver process; other attacks may al=
so be possible.
17. Progress and OpenEdge _mprosrv Buffer Overflow Vulnerability
BugTraq ID: 24675
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24675
Summary:
Progress and OpenEdge are prone to a remote buffer-overflow because the s=
oftware fails to bounds-check user-supplied data before copying it into a=
n insufficiently sized buffer.=20
An attacker could exploit this issue to execute arbitrary code within the=
context of the affected application. Failed exploit attempts will result=
in a denial of service.
The vendor is tracking this issue with number OE00148128.
RSA Security has acknowledged that this vulnerability affects a number of=
their products. Patches and hotfixes are available to RSA SecurCare Onli=
ne customers.
18. policyd W_Read Function Remote Buffer Overflow Vulnerability
BugTraq ID: 24899
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24899
Summary:
The policyd daemon is prone to a remote buffer-overflow vulnerability.=20
An attacker can exploit this issue to execute arbitrary machine code in t=
he context of the affected server. Failed exploit attempts will likely cr=
ash the server, denying service to legitimate users.=20
Versions prior to policyd 1.81 are affected.
19. activeWeb contentserver Permissions Bypass Weakness
BugTraq ID: 24900
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24900
Summary:
activeWeb contentserver is prone to a weakness that may allow an attacker=
to write files to unauthorized locations. A design error in the applicat=
ion allows editor accounts to write files to unauthorized locations, reg=
ardless of the permissions established for the account.
This weakness is confirmed in versions prior to contentserver 5.6.2964.
20. ActiveWeb Contentserver Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 24895
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24895
Summary:
activeWeb contentserver is prone to multiple cross-site scripting vulnera=
bilities because the application fails to properly sanitize user-supplied=
input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may help the attacker steal cookie-based authentication credentials=
and launch other attacks.
Reports indicate that versions prior to contentserver 5.6.2964 are vulner=
able to this issue.
21. RETIRED: Symantec Norton Personal Firewall SuiteOwners Registry Key S=
ecurity Bypass Vulnerability
BugTraq ID: 19585
Remote: No
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/19585
Summary:
Symantec Norton Personal Firewall is prone to a security-bypass vulnerabi=
lity, allowing an attacker to potentially bypass security measures that a=
re used to prevent modification of registry keys that are related to the =
affected software.
An attacker may exploit this vulnerability to bypass Norton's registry pr=
otection mechanism and modify the 'SuiteOwners' registry entry to load an=
arbitrary library file. This will likely lead to further attacks.
The individual who discovered this issue claims to have tested it on Nort=
on Personal Firewall 2006 version 9.1.0.33. Other versions could also be =
affected. Norton Internet Security products that include the vulnerable a=
pplication may also be affected.
RETIRED: This BID is being retired; further investigation indicates that =
the application is not vulnerable to this issue.
22. ActiveWeb Contentserver CMS Client Side Filtering Bypass Vulnerabilit=
y
BugTraq ID: 24898
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24898
Summary:
activeWeb contentserver is prone to a client-side input-validation vulner=
ability because the application fails to sufficiently sanitize user-suppl=
ied data.=20
An attacker can exploit these input-validation vulnerabilities to perform=
various attacks (e.g. cross-site scripting, SQL injection, etc.).
23. ActiveWeb Contentserver Mimetype Name HTML Injection Vulnerability
BugTraq ID: 24896
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24896
Summary:
activeWeb contentserver is prone to an HTML-injection vulnerability becau=
se it fails to sufficiently sanitize user-supplied input data.
Exploiting this issue may allow an attacker to execute HTML and script co=
de in the context of the affected site, to steal cookie-based authenticat=
ion credentials, or to control how the site is rendered to the user; othe=
r attacks are also possible.
Reports indicate that versions prior to contentserver 5.6.2964 are vulner=
able to this issue.
24. SiteScape Forum Multiple Unspecified Cross-Site Scripting Vulnerabili=
ties
BugTraq ID: 24893
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24893
Summary:
SiteScape Forum is prone to multiple cross-site scripting vulnerabilities=
because it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
Reports indicate that these issues affect versions prior to SiteScape Fo=
rum 7.3.
25. NetWin SurgeFTP Multiple Remote Vulnerabilities
BugTraq ID: 24892
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24892
Summary:
SurgeFTP is prone to multiple remote vulnerabilities that include an HTML=
-injection issue and a denial-of-service vulnerability.
=20
These issues reportedly affect SurgeFTP 2.3a1; other versions may be vuln=
erable as well.
26. Microsoft Excel Version Information Validation Remote Code Execution =
Vulnerability
BugTraq ID: 24801
Remote: Yes
Last Updated: 2007-07-13
Relevant URL: http://www.securityfocus.com/bid/24801
Summary:
Microsoft Excel is prone to a remote code-execution vulnerability.
Attackers may exploit this issue by enticing victims into opening a malic=
iously crafted Excel file ('.xls').
Successful exploits may allow attackers to execute arbitrary code with th=
e privileges of the user running the application. This may facilitate a c=
ompromise of vulnerable computers.
27. Curl GnuTLS Certificate Verfication Access Validation Vulnerability
BugTraq ID: 24938
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24938
Summary:
Curl is prone to a vulnerability that permits an attacker to access unaut=
horized websites. The attacker may then launch other attacks.
This issue affects versions prior to Curl 7.16.14. Other applications us=
ing the 'libcurl' library are also affected.
28. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerabili=
ty
BugTraq ID: 24074
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24074
Summary:
FreeType is prone to an integer-overflow vulnerability because it fails t=
o properly validate TTF files.
An attacker may exploit this issue by enticing victims into opening malic=
iously crafted TTF Files.
Successful exploits will allow attackers to execute arbitrary code in the=
context in the context of applications that use the affected library. Fa=
iled exploit attempts will likely result in denial-of-service conditions.
This issue affects FreeType 2.3.4 and prior versions.
29. Trillian URI Handler Remote Code Execution Vulnerabilities
BugTraq ID: 24927
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24927
Summary:
Trillian is prone to remote command- and code-execution vulnerabilities b=
ecause the application fails to properly handle user-supplied input via a=
registered URI.=20
Successfully exploiting these issues allows attackers to execute arbitrar=
y commands or code in the context of the affected application.
30. LedgerSMB Login.PL Authentication Bypass Vulnerability
BugTraq ID: 24940
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24940
Summary:
LedgerSMB is prone to an authentication-bypass vulnerability.
An attacker can exploit this issue to gain unauthorized access to the app=
lication.
This issue affects LedgerSMB 1.2.6 and prior versions.
31. WordPress Multiple Themes S Parameter Cross-Site Scripting Vulnerabil=
ity
BugTraq ID: 24954
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24954
Summary:
Multiple themes for WordPress are prone to a cross-site scripting vulnera=
bility because the application fails to properly sanitize user-supplied i=
nput.=20
=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user. This may help the attacker steal cook=
ie-based authentication credentials and launch other attacks.
These themes for WordPress are reported vulnerable:
BlixKrieg 2.2
Blixed 1.0
Blix 0.9.1
32. SpoonLabs Vivvo CMS Index.PHP SQL Injection Vulnerability
BugTraq ID: 24955
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24955
Summary:
Vivvo CMS is prone to an SQL-injection vulnerability because the applicat=
ion fails to properly sanitize user-supplied input before using it in an =
SQL query.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
This issue affects Vivvo CMS 3.40; other versions may also be vulnerable.
33. Oracle July 2007 Critical Patch Update Multiple Vulnerabilities
BugTraq ID: 24887
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24887
Summary:
Oracle has released a Critical Patch Update advisory for July 2007 to add=
ress multiple vulnerabilities for supported releases. Earlier unsupported=
releases are likely to be affected by these issues as well.
The issues identified by the vendor affect all security properties of the=
Oracle products and present local and remote threats. Various levels of =
authorization are needed to leverage some of the issues, but other issues=
do not require any authorization. The most severe of the vulnerabilities=
could possibly expose affected computers to complete compromise.
34. Asterisk Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 24950
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24950
Summary:
Asterisk is prone to multiple remote denial-of-service vulnerabilities.
Exploiting these issues allows remote attackers to cause the application =
to crash, effectively denying service to legitimate users.
35. Asterisk IAX2 Channel Driver IAX2_Write Function Remote Stack Buffer =
Overflow Vulnerability
BugTraq ID: 24949
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24949
Summary:
Asterisk is prone to a remote stack-based buffer-overflow vulnerability b=
ecause the application fails to bounds-check user-supplied data before co=
pying it into an insufficiently sized buffer.
Successful exploits may allow an attacker to execute arbitrary machine co=
de to compromise an affected computer or to cause a denial-of-service con=
dition.
36. Apple Mac OS X mDNSResponder Variant Unspecified Remote Code Executio=
n Vulnerability
BugTraq ID: 24924
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24924
Summary:
Apple Mac OS X is prone to an unspecified remote code-execution vulnerabi=
lity.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary machine code with superuser privileges, facilitating the complete =
compromise of affected computers. Failed exploit attempts likely result i=
n a denial-of-service condition.
37. Computer Associates Alert Notification Server Multiple Buffer Overflo=
w Vulnerabilities
BugTraq ID: 24947
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24947
Summary:
Computer Associates Alert Notification Server is prone to multiple buffer=
-overflow vulnerabilities because the application fails to bounds-check u=
ser-supplied data before copying it into insufficiently sized buffers.=20
An attacker can exploit these issues to execute arbitrary code with SYSTE=
M privileges. Failed exploit attempts likely result in a denial-of-servic=
e condition.
This issue affects CA products that rely on the Alert Server; the list of=
known affected products is as follows:
CA Threat Manager for the Enterprise (formerly eTrust Integrated Threat M=
anagement) r8
CA Protection Suites r3
BrightStor ARCserve Backup r11.5
BrightStor ARCserve Backup r11.1
BrightStor ARCserve Backup r11 for Windows
BrightStor Enterprise Backup r10.5
BrightStor ARCserve Backup v9.01
BrightStor ARCserve Client agent for Windows
38. QuickerSite Default.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 24948
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24948
Summary:
QuickerSite is prone to a cross-site scripting vulnerability because it f=
ails to properly sanitize user-supplied input.
Exploiting this vulnerability may allow an attacker to perform cross-site=
scripting attacks on unsuspecting users in the context of the affected w=
ebsite. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.
39. Mozilla Firefox 2.0.0.4 Multiple Remote Vulnerabilities
BugTraq ID: 24946
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24946
Summary:
The Mozilla Foundation has released four security advisories specifying m=
ultiple vulnerabilities in Firefox 2.0.0.4.
These vulnerabilities allow attackers to:
- Execute arbitrary code
- Execute code with chrome privileges
- Perform cross-site scripting attacks
- Crash Firefox in a myriad of ways, with evidence of memory corruption.
Other attacks may also be possible.
40. Mozilla Firefox About:Blank IFrame Cross Domain Information Disclosur=
e Vulnerability
BugTraq ID: 24286
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24286
Summary:
Mozilla Firefox is prone to a cross-domain information-disclosure vulnera=
bility because scripts may persist across navigations.=20
A malicious site may be able to modify the iframe of a site in an arbitra=
ry external domain. Attackers could exploit this to gain access to sensit=
ive information that is associated with the external domain. Other attack=
s are also possible, such as executing script code in other browser secur=
ity zones.
This issue is being tracked by Bugzilla Bug 382686 and is reportedly rela=
ted to Bug 343168.
Firefox 2.0.0.4 and prior versions are vulnerable.
41. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
BugTraq ID: 23192
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/23192
Summary:
The 'mod_perl' module is prone to a remote denial-of-service vulnerabilit=
y.
Successful exploits may allow remote attackers to cause denial-of-service=
conditions on the webserver running the mod_perl module.
42. Mozilla Firefox URLBar Null Byte File Remote Code Execution Vulnerabi=
lity
BugTraq ID: 24447
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24447
Summary:
Mozilla Firefox is prone to a remote code-execution vulnerability because=
it fails to adequately sanitize user-supplied input.
Attackers may exploit this issue by enticing victims into visiting a mali=
cious site and followings links with improper file extensions.
Successful exploits may allow an attacker to crash the application or exe=
cute arbitrary code in the context of the affected application. Other att=
acks are also possible.
43. Mozilla Firefox WYCIWYG:// URI Cache Zone Bypass Vulnerability
BugTraq ID: 24831
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24831
Summary:
Mozilla Firefox is prone to a cache-zone-bypass vulnerability because the=
application fails to properly block remote access to special internally =
generated URIs containing cached data.
Exploiting this issue allows remote attackers to access potentially sensi=
tive information and to place markers with similar functionality to cooki=
es onto targeted users' computers, regardless of cookie security settings=
. Information harvested in successful exploits may aid in further attacks=
.
Attackers may also potentially exploit this issue to perform cache-poison=
ing or URL-spoofing attacks.
This issue is being tracked by Mozilla's Bugzilla Bug 387333.
44. Expert Advisor Index.PHP SQL Injection Vulnerability
BugTraq ID: 24943
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24943
Summary:
Expert Advisor is prone to an SQL-injection vulnerability because the app=
lication fails to properly sanitize user-supplied input before using it i=
n an SQL query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
The affected version of the software wasn't reported. We will update this=
BID when more information emerges.
45. Microsoft Internet Explorer Multiple Browser URI Handler Command Inje=
ction Vulnerability
BugTraq ID: 24837
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24837
Summary:
Microsoft Internet Explorer is prone to a vulnerability that lets attacke=
rs inject commands through the 'firefoxurl' and 'navigatorurl' protocol h=
andlers.
Exploiting these issues allows remote attackers to pass and execute arbit=
rary commands and arguments through the 'firefox.exe' and 'navigator.exe'=
processes by employing the 'firefoxurl' and 'navigatorurl' handlers.
An attacker can also employ these issues to carry out cross-browser scrip=
ting attacks by using the '-chrome' argument. This can allow the attacker=
to run JavaScript code with the privileges of trusted Chrome context and=
gain full access to Firefox and Netscape Navigator's resources.
Exploiting these issues would permit remote attackers to influence comman=
d options that can be called through the 'firefoxurl' and 'navigatorurl' =
handlers and therefore execute commands and script code with the privileg=
es of a user running the applications. Successful attacks may result in a=
variety of consequences, including remote unauthorized access.
46. Dovecot Zlib Plugin Remote Information Disclosure Vulnerability
BugTraq ID: 23552
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/23552
Summary:
Dovecot is prone to an information-disclosure vulnerability.=20
An attacker can exploit this issue to access sensitive information that m=
ay lead to further attacks.
47. PHP Soap Engine Make_HTTP_Soap_Request Weak Nonce HTTP Authentication=
Weakness
BugTraq ID: 24034
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24034
Summary:
PHP Soap Engine is prone to an authentication weakness.=20
Successfully exploiting this issue would allow an attacker to obtain info=
rmation about the nonce used for the digest authentication. Information o=
btained may allow the attacker to bypass certain security restrictions an=
d potentially gain unauthorized access to the affected application.
48. PHP Prior to 5.2.2/4.4.7 Multiple Remote Buffer Overflow Vulnerabilit=
ies
BugTraq ID: 23813
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/23813
Summary:
PHP is prone to three remote buffer-overflow vulnerabilities because the =
application fails to perform boundary checks before copying user-supplied=
data to insufficiently sized memory buffers.
An attacker can exploit these issues to execute arbitrary machine code in=
the context of the affected webserver. Failed exploit attempts will like=
ly crash the webserver, denying service to legitimate users.=20
All three issues affect PHP 5.2.1 and prior versions; PHP 4.4.6 and prior=
versions are affected only by one of the issues.
Few details are available at the moment. These issues may have been previ=
ously described in other BIDs. This record may be updated or retired if f=
urther analysis shows that these issues have been reported in the past.
49. MIT Kerberos 5 KAdminD Server Rename_Principal_2_SVC() Function Stack=
Buffer Overflow Vulnerability
BugTraq ID: 24653
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24653
Summary:
Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is prone to =
a stack-based buffer-overflow vulnerability because the software fails to=
adequately bounds-check user-supplied data before copying it to an insuf=
ficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code with adminis=
trative privileges. A successful attack can result in the complete compro=
mise of the application. Failed attempts will likely result in denial-of-=
service conditions.
All 'kadmind' servers run on the master Kerberos server. Since the maste=
r server holds the KDC principal and policy database, an attack may not =
only compromise the affected computer, but could also compromise multipl=
e hosts that use the server for authentication.
Kerberos 5 'kadmind' 1.6.1, 1.5.3, and prior versions are vulnerable.
50. Element CMS S Parameter Cross-Site Scripting Vulnerability
BugTraq ID: 24960
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24960
Summary:
Element CMS is prone to a cross-site scripting vulnerability because the =
application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in =
the browser of an unsuspecting user in the context of the affected site. =
This may help the attacker steal cookie-based authentication credentials =
and launch other attacks.
51. Data Dynamics ActiveBar Actbar3.OCX ActiveX Control Multiple Insecure=
Methods Vulnerabilities
BugTraq ID: 24959
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24959
Summary:
Data Dynamics ActiveBar ActiveX control is prone to multiple vulnerabilit=
ies caused by insecure methods. The problem stems from a design error in =
the affected application.=20
An attacker can exploit this issue to overwrite arbitrary files on the vi=
ctim's computer in the context of the vulnerable application using the Ac=
tiveX control (typically Internet Explorer). Failed exploit attempts will=
likely result in a denial-of-service condition.
=20
These issues affect version 3.1; other versions may also be affected.
52. Cisco Wide Area Application Services CIFS Remote Denial of Service Vu=
lnerability
BugTraq ID: 24956
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24956
Summary:
Cisco Wide Area Application Services software is prone to a remote denial=
-of-service vulnerability.
Exploiting this issue allows remote attackers to cause a device running t=
he affected software to stop processing all types of traffic, effectively=
denying service to legitimate users.
Cisco WAAS software versions 4.0.7 and 4.0.9 are affected.
NOTE: only devices configured with Edge services are vulnerable to this =
issue.
53. Pictures Rating Index.PHP SQL Injection Vulnerability
BugTraq ID: 24945
Remote: Yes
Last Updated: 2007-07-18
Relevant URL: http://www.securityfocus.com/bid/24945
Summary:
Pictures Rating is prone to an SQL-injection vulnerability because the ap=
plication fails to properly sanitize user-supplied input before using it =
in an SQL query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
The affected version of the software has not been reported. We will updat=
e this BID when more information emerges.
54. Oracle April 2007 Security Update Multiple Vulnerabilities
BugTraq ID: 23532
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/23532
Summary:
Oracle has released a Critical Patch Update advisory for April 2007 to ad=
dress these vulnerabilities for supported releases. Earlier unsupported r=
eleases are likely to be affected by these issues as well.
The issues identified by the vendor affect all security properties of the=
Oracle products and present local and remote threats. Various levels of =
authorization are needed to leverage some of the issues, but other issues=
do not require any authorization. The most severe of the vulnerabilities=
could possibly expose affected computers to complete compromise.
55. Jasmine CMS Profile.PHP HTML Injection Vulnerability
BugTraq ID: 24939
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24939
Summary:
Jasmine CMS is prone to an HTML-injection vulnerability because the appli=
cation fails to properly sanitize user-supplied input before using it in =
dynamically generated content.=20
Attacker-supplied HTML and script code would execute in the context of th=
e affected site, potentially allowing the attacker to steal cookie-based =
authentication credentials or to control how the site is rendered to the =
user; other attacks are also possible.
Jasmine CMS 1.0_1 is vulnerable; other versions may also be affected.
56. Marshal MailMarshal SMTP Spam Quarantine Interface User Password Chan=
ge Vulnerability
BugTraq ID: 24936
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24936
Summary:
Marshal MailMarshal SMTP is prone to a vulnerability that may permit atta=
ckers to change arbitrary passwords.
Exploiting this issue may allow an attacker to change an arbitrary user's=
password, bypass the authentication mechanism, and gain unauthorized acc=
ess to the affected application. This may lead to other attacks.
Versions prior to MailMarshal SMTP6.2.1 are vulnerable.
57. Insanely Simple Blog Multiple Input Validation Vulnerabilities
BugTraq ID: 24934
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24934
Summary:
Insanely Simple Blog is prone to multiple input-validation vulnerabilitie=
s, including cross-site scripting, HTML-injection, and SQL-injection issu=
es, because the application fails to properly sanitize user-supplied inpu=
t.
Exploiting these issues could allow an attacker to steal cookie-based aut=
hentication credentials, execute arbitrary script code in the context of =
the webserver process, steal cookie-based authentication credentials, com=
promise the application, obtain sensitive information, access or modify d=
ata, or exploit latent vulnerabilities in the underlying database.
Insanely Simple Blog 0.5 and prior versions are vulnerable.
58. ASP Ziyaret=C3=A7i Defteri Multiple HTML Injection Vulnerabilities
BugTraq ID: 24937
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24937
Summary:
ASP Ziyaret=C3=A7i Defteri is prone to multiple HTML-injection vulnerabil=
ities because it fails to sufficiently sanitize user-supplied input data.
Exploiting these issues may allow an attacker to execute HTML and script =
code in the context of the affected site, to steal cookie-based authentic=
ation credentials, or to control how the site is rendered to the user; ot=
her attacks are also possible.
=20
ASP Ziyaret=C3=A7i Defteri 1.1 is vulnerable; other versions may also be =
affected.
59. CubeCart Cart.Inc.PHP SQL Injection Vulnerability
BugTraq ID: 24100
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24100
Summary:
CubeCart is prone to an SQL-injection vulnerability because it fails to s=
ufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
CubeCart 3.0.16 is reported vulnerable; other versions may also be affect=
ed.
60. MySQL Security Invoker Privilege Escalation Vulnerability
BugTraq ID: 24011
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24011
Summary:
MySQL is prone to a privilege-escalation vulnerability because it fails t=
o adequately restore access privileges during certain routines.
A remote authenticated attacker can exploit this issue to gain elevated p=
rivileges on an affected database.
These versions are vulnerable:
MySQL 5 prior to 5.0.40
MySQL 5.1 prior to 5.1.18
61. MySQL Rename Table Function Access Validation Vulnerability
BugTraq ID: 24016
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24016
Summary:
MySQL is prone to an access-validation vulnerability because it fails to =
perform adequate access control.
Attackers can exploit this issue to rename arbitrary tables. This could r=
esult in denial-of-service conditions and may aid in other attacks.
Versions prior to MySQL 4.1.23, 5.0.42, and 5.1.18 are vulnerable.
62. Trend Micro OfficeScan Server CGI Modules Stack Buffer Overflow Vulne=
rability
BugTraq ID: 24641
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24641
Summary:
Trend Micro OfficeScan Server is prone to a stack buffer-overflow vulnera=
bility because the application fails to properly bounds-check user-suppli=
ed data before copying it into an insufficiently sized memory buffer.
Successful exploits may allow an attacker to execute arbitrary code with =
privileges of the IIS webserver. This may facilitate a complete compromis=
e of vulnerable servers. Failed exploit attempts will likely result in de=
nial-of-service conditions.
Versions prior to Trend Micro OfficeScan 8.0 patch build 1042 are confirm=
ed affected by this issue. Client Server Messaging Security for SMB 3.0, =
3.5, and 3.6 are also vulnerable.
The authentication-bypass issue previously reported in this document has =
been assigned its own BID: 24935 Trend Micro OfficeScan Management Consol=
e Authentication Bypass Vulnerability.
63. Trend Micro OfficeScan Management Console Authentication Bypass Vulne=
rability
BugTraq ID: 24935
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24935
Summary:
Trend Micro OfficeScan is prone to an authentication-bypass vulnerability=
because it fails to adequately handle user-supplied input.
Attackers can exploit this issue to gain unauthorized access to the appli=
cation's web-based management console. Successful attacks will compromise=
the application.
OfficeScan 7.3 is vulnerable; other versions may also be affected.
64. Apple QuickTime Information Disclosure and Multiple Code Execution Vu=
lnerabilities
BugTraq ID: 24873
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24873
Summary:
Apple QuickTime is prone to an information-disclosure and multiple remote=
code-execution vulnerabilities.
Remote attackers may exploit these issues by enticing victims into openin=
g maliciously crafted files or visiting maliciously crafted websites.
Successful exploits may allow attackers to execute arbitrary code in the =
context of a user running the vulnerable application or to obtain sensiti=
ve information. Failed exploit attempts of remote code-execution issues m=
ay result in denial-of-service conditions. Successful exploits of the inf=
ormation-disclosure issue may lead to further attacks.
65. Adobe Flash Player SWF File Handling Remote Code Execution Vulnerabil=
ity
BugTraq ID: 24856
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24856
Summary:
Adobe Flash Player is prone to a remote code-execution vulnerability beca=
use it fails to properly sanitize user-supplied input.=20
An attacker can exploit this issue by tricking an unsuspecting victim int=
o opening a malicious file.
A successful exploit will result in the execution of arbitrary attacker-s=
upplied code in the context of the victim running the vulnerable applicat=
ion.
Adobe Flash Player 9.0.45.0 and earlier, 8.0.34.0 and earlier, and 7.0.69=
.0 and earlier are affected.
66. Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scrip=
ting Vulnerability
BugTraq ID: 24475
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24475
Summary:
Apache Tomcat Manager and Host Manager are prone to a cross-site scripti=
ng vulnerability because the applications fail to properly sanitize user-=
supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user. This may help the attacker steal cook=
ie-based authentication credentials and launch other attacks.
67. Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulne=
rability
BugTraq ID: 24476
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24476
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because it=
fails to properly sanitize user-supplied input.
Exploiting this vulnerability may allow an attacker to perform cross-site=
scripting attacks on unsuspecting users in the context of the affected w=
ebsite. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.
68. X.Org XFS Init Script Insecure Temporary File Creation Vulnerability
BugTraq ID: 24888
Remote: No
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24888
Summary:
The X Font Server (XFS) creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to per=
form symlink attacks to alter the permissions of an arbitrary attacker-su=
pplied file.
69. Perl Net::DNS Remote Multiple Vulnerabilities
BugTraq ID: 24669
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24669
Summary:
The Perl Net::DNS module is prone to a remote denial-of-service vulnerabi=
lity and a cache-poisoning issue.
Successful exploits may allow remote attackers to cause denial-of-service=
conditions or to manipulate cache data, potentially facilitating man-in-=
the-middle and site-impersonation attacks.
Versions prior to Perl Net::DNS 0.60. are reported vulnerable.
70. Kaspersky Anti-Virus 5.5 for Check Point Firewall-1 Denial of Service=
Vulnerability
BugTraq ID: 24932
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24932
Summary:
Kaspersky Anti-Virus 5.5 for Check Point Firewall-1 is prone to a denial-=
of-service vulnerability.
An attacker could exploit an unspecified error to cause the Kaspersky Ant=
i-Virus kernel to freeze. Further details are currently unavailable.
This issue affects Kaspersky Anti-Virus 5.5 for Check Point Firewall-1.
71. Zoph _Order Multiple SQL Injection Vulnerabilities
BugTraq ID: 24933
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24933
Summary:
Zoph is prone to multiple SQL-injection vulnerabilities because it fails =
to sufficiently sanitize user-supplied data before using it in SQL querie=
s.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
72. Disk ARchive Flawed Blowfish-CBC Cryptography Implementation Weakness
BugTraq ID: 24930
Remote: No
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24930
Summary:
Disk ARchive ('dar') is prone to a design error in its cryptographic Blow=
fish-CBC implementation.
The application contains two unique flaws that contribute to a weakening =
of the protections provided under its Blowfish-CBC mode.=20
Versions prior to 'dar' 2.3.4 are vulnerable to this issue.
73. Traffic Stats ReferralUrl.PHP SQL Injection Vulnerability
BugTraq ID: 24929
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24929
Summary:
Traffic Stats is reportedly prone to an SQL-injection vulnerability becau=
se the application fails to properly sanitize user-supplied input before =
using it in an SQL query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
The affected version of the software is currently unknown. We will update=
this BID if more information emerges.
74. Infinite Responder Unspecified SQL Injection Vulnerability
BugTraq ID: 24931
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24931
Summary:
Infinite Responder is prone to an unspecified SQL-injection vulnerability=
because the application fails to properly sanitize user-supplied input b=
efore using it in an SQL query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
Versions prior to Infinite Responder 1.48 are vulnerable to this issue.
75. husrevforum Philboard_forum.ASP SQL Injection Vulnerability
BugTraq ID: 24928
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24928
Summary:
The 'husrevforum' program is prone to an SQL-injection vulnerability beca=
use it fails to properly sanitize user-supplied input before using it in =
an SQL query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
This issue affects husrevforum v 1.0.1 (tr); other versions may be affect=
ed as well.
76. AIX lchangelv Buffer Overflow Vulnerability
BugTraq ID: 389
Remote: No
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/389
Summary:
A buffer overflow can occur in lchangelv under some versions of AIX. Note=
that an attacker must already have the GID or EGID of 'system' to execut=
e lchangelv.
Because lchangelv is SUID root, this overflow will grant the attacker roo=
t privileges.
77. IBM Tivoli Provisioning Manager for OS Deployment Divide By Zero Deni=
al of Service Vulnerability
BugTraq ID: 24942
Remote: Yes
Last Updated: 2007-07-17
Relevant URL: http://www.securityfocus.com/bid/24942
Summary:
IBM Tivoli Provisioning Manager for OS Deployment is prone to a denial-of=
-service vulnerability because the server fails to handle exceptional con=
ditions.=20
An attacker can exploit this issue to crash the affected server, denying =
service to legitimate users.=20
This issue is reported to affect IBM Tivoli Provisioning Manager for OS D=
eployment 5.1.0.2; other versions may be affected.=20
NOTE: The discoverer could not reproduce this vulnerability on IBM Tivoli=
Provisioning Manager for OS Deployment 5.1.0.116.
78. Yahoo! Messenger Address Book Remote Buffer Overflow Vulnerabilitiy
BugTraq ID: 24926
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24926
Summary:
Yahoo! Messenger is prone to a remote buffer-overflow vulnerability becau=
se it fails to perform adequate boundary checks on user-supplied data.
Attackers can exploit this issue to execute arbitrary code in the context=
of the application or to cause denial-of-service conditions.
Yahoo! Messenger 8.1 and prior versions are vulnerable.
79. Netscape Enterprise Accept Buffer Overflow Vulnerability
BugTraq ID: 631
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/631
Summary:
Enterprise Server 3.6 SP2 with the SSL Handshake Patch applied is vulnera=
ble to a buffer overflow that may allow attackers to launch denial-of-ser=
vice attacks and to execute arbitrary commands on the webserver.
80. Microsoft IE5 ActiveX "Object for constructing type libraries for sc=
riptlets" Vulnerability
BugTraq ID: 598
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/598
Summary:
The 'scriptlet.typlib' ActiveX control can create, edit, and overwrite fi=
les on the local disk. This means that an executable text file (e.g. a '.=
hta' file) can be written to the startup folder of a remote machine and w=
ill be executed the next time that machine reboots. Attackers can exploit=
this vulnerability via a malicious web page or an email message.
81. Omnis Studio 2.4 Weak Database Field Encryption Vulnerability
BugTraq ID: 1255
Remote: No
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/1255
Summary:
Omnis Studio 2.4 is a development tool for creating database applications=
. The tool gives developers the option to encrypt database entries. Howev=
er, the encryption scheme used is weak and easily broken with any scienti=
fic calculator (or even pen and paper, if the attacker has a good knowleg=
e of hex and ASCII). Each unencrypted byte is simply replaced with a valu=
e that depends on that byte's original value and the remainder of its pos=
ition in the string divided by 4.
Note that this vulnerability does not affect the security of Omnis Studio=
directly, but will be present in all applications that were designed usi=
ng Omnis Studio.
82. PHP Glob() Function Arbitrary Code Execution Vulnerability
BugTraq ID: 24922
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24922
Summary:
PHP is prone to an arbitrary code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary machine code in t=
he context of the affected application or to cause denial-of-service cond=
itions.
This issue affects PHP 5.2.3 and 4.4.4. Other versions may also be affect=
ed.
83. Caldera OpenLinux 'smail -D' Command Vulnerability
BugTraq ID: 1268
Remote: No
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/1268
Summary:
According to the Caldera advisory (CSSA-1999:001.0), smail's -D option n=
ames the debug file to use. If an attacker submits a UUCP job containing =
the following rmail invocation:=20
=20
rmail -N -D /usr/lib/uucp/.rhosts -oMs "joe\nhostname user\n" uucp=20
=20
where '\n' is a newline, and 'hostname' and 'user' specify the attacki=
ng host and user, then 'smail' will happily append the following to the U=
UCP '.rhosts' file:=20
=20
rmail: Debugging started: pid=3D25919=20
=20
write_log:Received FROM:uucp HOST:joe=20
hostname user=20
PROGRAM:rmail SIZE:99=20
... some more lines ...=20
=20
The attacker can then 'rsh' into the target host and try to exploit the U=
UCP account (e.g. by replacing the 'uux' binary).=20
=20
Note that this hole is also exploitable locally; all you have to do is=
call 'uux rmail ....' to make it work.
84. SiteTrafficStats ReferralURL.PHP SQL Injection Vulnerability
BugTraq ID: 24925
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24925
Summary:
SiteTrafficStats is prone to an SQL-injection vulnerability because it fa=
ils to sufficiently sanitize user-supplied data before using it in an SQL=
query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Currently, we do not know which versions are affected. We will update thi=
s BID as more information emerges.
85. Citadel WebCit Multiple Input Validation Vulnerabilities
BugTraq ID: 24913
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24913
Summary:
Citadel WebCit is prone to multiple input-validation vulnerabilities, inc=
luding multiple HTML-injection issues and a cross-site scripting issue, b=
ecause it fails to sufficiently sanitize user-supplied input data.
Exploiting these issues may allow an attacker to execute HTML and script =
code in the context of the affected site, to steal cookie-based authentic=
ation credentials, or to control how the site is rendered to the user; ot=
her attacks are also possible.
=20
Versions prior to WebCit 7.11 are vulnerable.
86. HP Serviceguard for Linux Unspecified Local Privilege Escalation Vuln=
erability
BugTraq ID: 24920
Remote: No
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24920
Summary:
HP Serviceguard for Linux is prone to an unspecified privilege-escalation=
vulnerability.
Very few technical details are currently available. We will update this B=
ID as more information emerges.
An attacker can exploit this issue to gain local unauthorized access or e=
scalated privileges on affected computers.
87. TBDev.NET DR TakeProfEdit.PHP HTML Injection Vulnerability
BugTraq ID: 24923
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24923
Summary:
TBDev.NET DR is prone to an HTML-injection vulnerability because it fails=
to sufficiently sanitize user-supplied input data.
Exploiting this issue may allow an attacker to execute HTML and script co=
de in the context of the affected site, to steal cookie-based authenticat=
ion credentials, or to control how the site is rendered to the user; othe=
r attacks are also possible.
=20
TBDev.NET DR 010306 and prior versions are vulnerable.
88. InterActual Player IAMCE and IAKey Remote Buffer Overflow Vulnerabili=
ties
BugTraq ID: 24919
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24919
Summary:
InterActual Player contains multiple ActiveX controls that are prone to b=
uffer-overflow vulnerabilities because it fails to properly bounds-check =
user-supplied input before copying it to insufficiently sized memory buff=
ers.
An attacker could exploit these issues by creating a malicious web page t=
hat would initialize the affected ActiveX controllers and execute arbitra=
ry code within the context of the user.
Exploiting this issue could allow an attacker to execute arbitrary code.
These issues affect InterActual Player 2.60.12.0717; other versions may b=
e vulnerable as well.
89. REALTOR 747 Index.PHP SQL Injection Vulnerability
BugTraq ID: 24916
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24916
Summary:
REALTOR 747 is prone to an SQL-injection vulnerability because the applic=
ation fails to properly sanitize user-supplied input before using it in a=
n SQL query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
REALTOR 747 4.0 is affected by this issue; other versions may be affected=
as well.
90. Prozilla Directory.PHP SQL Injection Vulnerability
BugTraq ID: 24915
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24915
Summary:
Prozilla is prone to an SQL-injection vulnerability because the applicati=
on fails to properly sanitize user-supplied input before using it in an S=
QL query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
The affected version is currently unknown. We will update this BID if mor=
e information emerges.
91. paFileDB Search.PHP SQL Injection Vulnerability
BugTraq ID: 24914
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24914
Summary:
paFileDB is prone to an SQL-injection vulnerability because the applicati=
on fails to properly sanitize user-supplied input before using it in an S=
QL query.=20
=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
paFileDB 3.6 is vulnerable to this issue.
92. Microsoft Internet Explorer OnBeforeUnload Javascript Browser Entrapm=
ent Vulnerability
BugTraq ID: 24911
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24911
Summary:
Microsoft Internet Explorer is prone to a vulnerability that allows attac=
kers to trap users at a particular webpage and spoof page transitions.=20
Attackers may exploit this via a malicious page to spoof the contents and=
origin of a page that the victim may trust. This vulnerability may be us=
eful in phishing or other attacks that rely on content spoofing.
Internet Explorer 7 is vulnerable to this issue; other versions may also =
be affected.
93. AzDG Dating Gold Multiple Remote File Include Vulnerabilities
BugTraq ID: 24910
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24910
Summary:
AzDG Dating Gold is prone to multiple remote file-include vulnerabilities=
because the application fails to properly sanitize user-supplied input.=20
=20
An attacker may leverage these issues to execute an arbitrary remote file=
containing malicious script code in the context of the webserver process=
. This may allow the attacker to compromise the application and the under=
lying system. Other attacks are also possible.
AzDG Dating Gold 3.0.5 is vulnerable; other versions may also be affected=
.
94. MzK Blog Katgoster.ASP SQL Injection Vulnerability
BugTraq ID: 24909
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24909
Summary:
MzK Blog is prone to an SQL-injection vulnerability because it fails to s=
ufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
95. Opera Web Browser Address Bar URI Spoofing Vulnerability
BugTraq ID: 24917
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24917
Summary:
Opera Web Browser is affected by a URI-spoofing vulnerability because it =
fails to adequately handle user-supplied data.
=20
An attacker may leverage this issue by padding the URI and inserting arb=
itrary content to spoof the source URI of a file presented to an unsuspec=
ting user. This may lead to a false sense of trust as the victim may be p=
resented with a source URI of a trusted site while interacting with the a=
ttacker's malicious site.
Opera 9.21 is vulnerable; other versions may also be affected.
NOTE: KDE's Konqueror browser is also affected by this issue. Please see =
BID 24912 for more information.
96. KDE Konqueror Address Bar URI Spoofing Vulnerability
BugTraq ID: 24912
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24912
Summary:
KDE Konqueror is affected by a URI-spoofing vulnerability because it fail=
s to adequately handle user-supplied data.
=20
An attacker may leverage this issue by padding the URI and inserting arb=
itrary content to spoof the source URI of a file presented to an unsuspec=
ting user. This may lead to a false sense of trust because the victim may=
be presented with a source URI of a trusted site while interacting with =
the attacker's malicious site.
Konqueror 3.5.7 are vulnerable; other versions may also be affected.
UPDATE: This issue also affects the Opera browser. This BID originally tr=
acked the issue for both products but has been split into two separate BI=
Ds. The issue affecting Opera is now being tracked as BID 24917.
97. RETIRED: Konqueror Web Browser Data: URL Scheme Address Bar Spoofing =
Vulnerability
BugTraq ID: 24918
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24918
Summary:
Konqueror Web Browser is prone to an address bar spoofing vulnerability.=20
=20
An attacker may exploit this vulnerability to spoof the originating URL o=
f a trusted web site. This issue may allow a remote attacker to carry out=
phishing style attacks. =20
Konqueror 3.5.7 on Linux is reported vulnerable to this issue. Previous v=
ersions may be affected as well.=20
NOTE: This BID is being retired because the issue is already being tracke=
d with BID 24912.
98. eSyndiCat Link Directory Multiple SQL Injection Vulnerabilities
BugTraq ID: 24908
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24908
Summary:
eSyndiCat Link Directory is prone to multiple SQL-injection vulnerabiliti=
es because it fails to sufficiently sanitize user-supplied data before us=
ing it in SQL queries.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
99. Hitachi TP1/Server Base Unspecified Denial Of Service Vulnerability
BugTraq ID: 24907
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24907
Summary:
Hitachi TP1/Server Base is prone to an unspecified denial-of-service vul=
nerability.=20
=20
Attackers can exploit this issue to cause denial-of-service conditions.
100. Multiple Hitachi Products GIF Image Buffer Overflow Vulnerability
BugTraq ID: 24905
Remote: Yes
Last Updated: 2007-07-16
Relevant URL: http://www.securityfocus.com/bid/24905
Summary:
Multiple Hitachi products are prone to a buffer-overflow vulnerability be=
cause the applications fail to properly bounds-check user-supplied input =
before copying it to an insufficiently sized memory buffer.
Given the nature of this issue, successful exploits may lead to remote co=
de execution, but this has not been confirmed.
The vulnerability resides in the following software components:
Cosminexus
Processing Kit for XML
Hitachi Developer's Kit for Java
These components are included in various other Hitachi products.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Flaw auction site highlights disclosure issues
By: Robert Lemos
WabiSabiLabi gets mixed reviews, but security pros agree that interesting=
times are ahead.
http://www.securityfocus.com/news/11474
2. Fast flux foils bot-net takedown
By: Robert Lemos
Malicious coders are increasingly playing a shell game, using a technolog=
y known as "fast flux" to make locating key servers more difficult.
http://www.securityfocus.com/news/11473
3. Lawmakers worry over gov't network breaches
By: Robert Lemos
Hearings on the Hill reveal a significant number of security breaches at =
the Departments of Commerce, Defense, Homeland Security, State and Energy=
.
http://www.securityfocus.com/news/11472
4. Amero case spawns effort to educate
By: Robert Lemos
Following a judge's ruling to throw out a verdict based on faulty digital=
forensics, a group of security professionals, legal experts and educator=
s look to the future.
http://www.securityfocus.com/news/11471
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Manager, Information Security, Slough
http://www.securityfocus.com/archive/77/474042
2. [SJ-JOB] Sr. Security Analyst, Baltimore
http://www.securityfocus.com/archive/77/474035
3. [SJ-JOB] Sr. Security Analyst, Denver
http://www.securityfocus.com/archive/77/474044
4. [SJ-JOB] Senior Software Engineer, New York
http://www.securityfocus.com/archive/77/474045
5. [SJ-JOB] Jr. Security Analyst, Wilmington
http://www.securityfocus.com/archive/77/474030
6. [SJ-JOB] Security Architect, Washington
http://www.securityfocus.com/archive/77/474032
7. [SJ-JOB] Sales Engineer, DC area
http://www.securityfocus.com/archive/77/474043
8. [SJ-JOB] Application Security Engineer, London
http://www.securityfocus.com/archive/77/474023
9. [SJ-JOB] Security Engineer, Denver
http://www.securityfocus.com/archive/77/474026
10. [SJ-JOB] Sales Representative, Livonia
http://www.securityfocus.com/archive/77/474031
11. [SJ-JOB] Security Engineer, Wilmington
http://www.securityfocus.com/archive/77/474034
12. [SJ-JOB] Security Engineer, Denver
http://www.securityfocus.com/archive/77/474041
13. [SJ-JOB] Sr. Security Engineer, Omaha
http://www.securityfocus.com/archive/77/474016
14. [SJ-JOB] Developer, Sydney
http://www.securityfocus.com/archive/77/474017
15. [SJ-JOB] Sr. Security Analyst, Washington
http://www.securityfocus.com/archive/77/474022
16. [SJ-JOB] Sr. Security Analyst, San Antonio
http://www.securityfocus.com/archive/77/474024
17. [SJ-JOB] Software Engineer, Livonia
http://www.securityfocus.com/archive/77/474025
18. [SJ-JOB] Penetration Engineer, Wilmington
http://www.securityfocus.com/archive/77/474013
19. [SJ-JOB] Technical Support Engineer, Mountain View
http://www.securityfocus.com/archive/77/474014
20. [SJ-JOB] Sr. Security Engineer, Denver
http://www.securityfocus.com/archive/77/474015
21. [SJ-JOB] Management, Mountain View
http://www.securityfocus.com/archive/77/473576
22. [SJ-JOB] Security Engineer, Roseland
http://www.securityfocus.com/archive/77/473586
23. [SJ-JOB] Security Architect, Leatherhead and Europe
http://www.securityfocus.com/archive/77/473591
24. [SJ-JOB] Security Architect, Bristol or Cheltenham
http://www.securityfocus.com/archive/77/473578
25. [SJ-JOB] Sr. Security Analyst, Roseland
http://www.securityfocus.com/archive/77/473587
26. [SJ-JOB] Security Architect, Roseland
http://www.securityfocus.com/archive/77/473592
27. [SJ-JOB] Security Architect, New York
http://www.securityfocus.com/archive/77/473570
28. [SJ-JOB] Developer, Redmond
http://www.securityfocus.com/archive/77/473577
29. [SJ-JOB] Application Security Engineer, Wilmington
http://www.securityfocus.com/archive/77/473579
30. [SJ-JOB] Sr. Security Analyst, Charlotte
http://www.securityfocus.com/archive/77/473584
31. [SJ-JOB] Security Architect, Lisle
http://www.securityfocus.com/archive/77/473558
32. [SJ-JOB] Security Consultant, London, Edinburgh
http://www.securityfocus.com/archive/77/473563
33. [SJ-JOB] Security Engineer, Dallas
http://www.securityfocus.com/archive/77/473569
34. [SJ-JOB] Auditor, Columbia
http://www.securityfocus.com/archive/77/473583
35. [SJ-JOB] Security Architect, Minneapolis
http://www.securityfocus.com/archive/77/473559
36. [SJ-JOB] Security Engineer, Austin
http://www.securityfocus.com/archive/77/473567
37. [SJ-JOB] Security Consultant, London, Edinburgh
http://www.securityfocus.com/archive/77/473580
38. [SJ-JOB] Security Engineer, Washington
http://www.securityfocus.com/archive/77/473585
39. [SJ-JOB] Jr. Security Analyst, WASHINGTON
http://www.securityfocus.com/archive/77/473539
40. [SJ-JOB] Application Security Engineer, Washington
http://www.securityfocus.com/archive/77/473540
41. [SJ-JOB] Sr. Security Engineer, Sunnyvale
http://www.securityfocus.com/archive/77/473550
42. [SJ-JOB] Director, Information Security, San Mateo
http://www.securityfocus.com/archive/77/473537
43. [SJ-JOB] Security Consultant, London
http://www.securityfocus.com/archive/77/473545
44. [SJ-JOB] Security Consultant, London
http://www.securityfocus.com/archive/77/473561
45. [SJ-JOB] Technical Writer, Washington D.C.
http://www.securityfocus.com/archive/77/473546
46. [SJ-JOB] Manager, Information Security, St. Louis
http://www.securityfocus.com/archive/77/473548
47. [SJ-JOB] Sr. Security Analyst, Washington D.C.
http://www.securityfocus.com/archive/77/473562
48. [SJ-JOB] Software Engineer, Columbia
http://www.securityfocus.com/archive/77/473568
49. [SJ-JOB] Management, Cleveland
http://www.securityfocus.com/archive/77/473530
50. [SJ-JOB] Security Architect, Chicago
http://www.securityfocus.com/archive/77/473536
51. [SJ-JOB] Application Security Architect, Valley Forge
http://www.securityfocus.com/archive/77/473538
52. [SJ-JOB] Sr. Security Engineer, Chantilly
http://www.securityfocus.com/archive/77/473571
53. [SJ-JOB] Security Consultant, Detroit
http://www.securityfocus.com/archive/77/473528
54. [SJ-JOB] Software Engineer, Atlanta
http://www.securityfocus.com/archive/77/473531
55. [SJ-JOB] Security Engineer, Chantilly
http://www.securityfocus.com/archive/77/473547
56. [SJ-JOB] Security Consultant, Toronto
http://www.securityfocus.com/archive/77/473527
57. [SJ-JOB] Security Architect, Washington DC
http://www.securityfocus.com/archive/77/473529
58. [SJ-JOB] Security Engineer, Irvine
http://www.securityfocus.com/archive/77/473508
59. [SJ-JOB] Sales Engineer, Reston
http://www.securityfocus.com/archive/77/473516
60. [SJ-JOB] Application Security Architect, Long Island
http://www.securityfocus.com/archive/77/473519
61. [SJ-JOB] Security Consultant, Denver
http://www.securityfocus.com/archive/77/473520
62. [SJ-JOB] Security Consultant, Slough
http://www.securityfocus.com/archive/77/473507
63. [SJ-JOB] Director, Information Security, Greenwood Village
http://www.securityfocus.com/archive/77/473517
64. [SJ-JOB] Security Consultant, Washington DC
http://www.securityfocus.com/archive/77/473518
65. [SJ-JOB] Management, Mt. View
http://www.securityfocus.com/archive/77/473504
66. [SJ-JOB] Application Security Architect, Washington
http://www.securityfocus.com/archive/77/473505
67. [SJ-JOB] Security Architect, Charlotte
http://www.securityfocus.com/archive/77/473506
V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Java - JRE, SDK Java Web Start
http://www.securityfocus.com/archive/82/473891
2. CFP now open for ClubHack, India's own hackers' convention
http://www.securityfocus.com/archive/82/473887
3. [TOOL] winFuzz (1.0.0.1)
http://www.securityfocus.com/archive/82/473884
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Sync Domain Account password and Local Account password
http://www.securityfocus.com/archive/88/473988
2. Restrict access
http://www.securityfocus.com/archive/88/473787
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: Black Hat
Attend Black Hat USA, July 28-August 2 in Las Vegas, the world's premier =
technical event for ICT security experts. Featuring 30 hands-on training =
courses and 90 Briefings presentations with lots of new content and new t=
ools. Network with 4,000 delegates from 70 nations. Visit product displ=
ays by 30 top sponsors in a relaxed setting. =20
http://www.blackhat.com