SecurityFocus Newsletter #421
[email protected] 3 Oct 2007 18:22:47 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #421
----------------------------------------
This issue is Sponsored by: Watchfire:
Methodologies & Tools for Web Application Security Assessment=20
With the rapid rise in the number and types of security threats, web appl=
ication security assessments should be considered a crucial phase in the =
development of any web application. What methodology should be followed? =
What tools can accelerate the assessment process? See for yourself. Downl=
oad this Whitepaper today!=20
https://www.watchfire.com/securearea/whitepapers.aspx?id=3D7017000000093z=
q
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1.Passive Network Analysis
2.Windows Anti-Debug Reference
II. BUGTRAQ SUMMARY
1. Sina UC BROWSER2UC.DLL ActiveX Control Multiple Remote Stack Bu=
ffer Overflow Vulnerabilities
2. HP Mercury Quality Center ActiveX Control Buffer Overflow Vulne=
rability
3. Tor ControlPort Missing Authentication Unauthorized Access Vuln=
erability
4. MD-Pro Index.PHP Firefox ID SQL Injection Vulnerability
5. Public Media Manager newstopic_inc.php Remote File Include Vuln=
erability
6. OpenSSL Montgomery Exponentiation Side-Channel Local Informatio=
n Disclosure Vulnerability
7. Sun Fire X2100 M2 And X2200 M2 ELOM Unauthorized Access Vulnera=
bility
8. Linux Kernel PTrace NULL Pointer Dereference Local Denial Of Se=
rvice Vulnerability
9. Linux Kernel JFFS2 Filesystem Security Bypass Vulnerability
10. Linux Kernel CIFS Local Privilege Escalation Vulnerability
11. Apple iPhone Mail Unauthorized tel: Initiation Vulnerability
12. Apple iPhone Mobile Safari Cross-Domain URI Disclosure Vulnera=
bility
13. Axis Communications 2100 Network Camera Multiple Input Validat=
ion Vulnerabilities
14. Zomplog admin/upload_files.php Unauthorized Access Vulnerabili=
ty
15. Apple iPhone Mobile Safari Browser Window Properties Same Orig=
in Policy Bypass Vulnerability
16. Apple iPhone 1.1.1 Mobile Safari Browser iFrame Same Origin Po=
licy Bypass Vulnerability
17. Samba MS-RPC Remote Shell Command Execution Vulnerability
18. Samba Deferred CIFS File Open Denial of Service Vulnerability
19. Samba NDR RPC Request DFSEnum Heap-Based Buffer Overflow Vulne=
rability
20. Samba NDR RPC Request NetSetFileSecurity Heap-Based Buffer Ove=
rflow Vulnerability
21. Samba NDR RPC Request RFNPCNEX Heap-Based Buffer Overflow Vuln=
erability
22. Samba NDR RPC Request LsarLookupSids/LsarLookupSids2 Heap-Base=
d Buffer Overflow Vulnerability
23. Samba SID Names Local Privilege Escalation Vulnerability
24. Samba NDR RPC Request LsarAddPrivilegesToAccount Heap-Based Bu=
ffer Overflow Vulnerability
25. Apple iPhone Safari Browser Same Domain Content Manipulation V=
ulnerability
26. Cisco Catalyst 6500 and Cisco 7600 Loopback Access Control Byp=
ass Vulnerability
27. Sun Solaris Thread Handling Local Denial Of Service Vulnerabil=
ity
28. Sun Solaris Human Interface Device Local Denial of Service Vul=
nerability
29. Pidgin MSN Nudge Messages Remote Denial Of Service Vulnerabili=
ty
30. Linux Kernel USB PWC Driver Local Denial Of Service Vulnerabil=
ity
31. Linux Kernel Ptrace Local Privilege Escalation Vulnerability
32. X.Org X Font Server Multiple Memory Corruption Vulnerabilities
33. Libpng Library Remote Denial of Service Vulnerability
34. ELinks HTTPS POST Request Information Disclosure Weakness
35. Poppawid ChildWindow.Inc.PHP Remote File Include Vulnerability
36. MIT Kerberos 5 KAdminD Server SVCAuth_GSS_Validate Stack Buffe=
r Overflow Vulnerability
37. Altnet Download Manager ADM4 ActiveX Buffer Overflow Vulnerabi=
lity
38. CenterTools DriveLock Remote Buffer Overflow Vulnerability
39. Xen pygrub TOOLS/PYGRUB/SRC/GRUBCONF.PY Local Command Injectio=
n Vulnerability
40. Computer Associates BrightStor Hierarchical Storage Manager Cs=
Agent Multiple Remote Vulnerabilities
41. QEMU Multiple Local Vulnerabilities
42. OpenSSL SSL_Get_Shared_Ciphers Off-by-One Buffer Overflow Vuln=
erability
43. id Software Doom 3 Engine Console String Visualization Format =
String Vulnerability
44. DVDdb Multiple Cross Site Scripting Vulnerabilities
45. iScripts MultiCart Multiple SQL Injection Vulnerabilities
46. Ruby Net::HTTP SSL Insecure Certificate Validation Weakness
47. id3lib Insecure Temporary File Creation Vulnerability
48. Google Mini Search Appliance IE Parameter Cross-Site Scripting=
Vulnerability
49. SmbFTPD SMBDirList Format String Vulnerability
50. Microsoft Windows Logon Process Remote Buffer Overflow Vulnera=
bility
51. Microsoft Windows Management Local Privilege Escalation Vulner=
ability
52. Microsoft Windows Utility Manager Local Privilege Escalation V=
ulnerability
53. Microsoft Windows Local Descriptor Table Local Privilege Escal=
ation Vulnerability
54. MPlayer AVIHeader.C Heap Based Buffer Overflow Vulnerability
55. XOOPS Uploader Class Arbitrary File Upload Vulnerability
56. Quicksilver Forums Information Disclosure Vulnerability and PM=
Deletion Vulnerability
57. Segue CMS themesdir Parameter Remote File Include Vulnerabilit=
y
58. OdysseySuite Mailbox.MWS Cross-Site Scripting Vulnerability
59. Ohesa Emlak Portal Multiple SQL Injection Vulnerabilities
60. CyberLink PowerDVD CLAVSetting.DLL Arbitrary File Overwrite Vu=
lnerability
61. EDraw Office Viewer Component FtpDownloadFile ActiveX Buffer O=
verflow Vulnerability
62. EDraw Office Viewer Component HttpDownloadFileToTempDir Active=
X Buffer Overflow Vulnerability
63. rPath rMake Local Privilege Escalation Vulnerability
64. Check Point SecurePlatform Multiple Buffer Overflow Vulnerabil=
ities
65. Ilient SysAid Cross-Site Request Forgery Vulnerability
66. X-script Guestbook mes_add.php Multiple SQL Injection Vulnerab=
ilities
67. AlstraSoft Affiliate Network Pro Multiple Access Validation Vu=
lnerabilities
68. FSD Exechelp And Execmulticast Multiple Remote Buffer Overflow=
Vulnerabilities
69. ASP Product Catalog Default.ASP SQL Injection Vulnerability
70. libsndfile FLAC.C Buffer Overflow Vulnerability
71. Monolith Lithtech Game Engine Multiple Remote Format String Vu=
lnerabilities
72. i-Systems Inc. Feedreader3 RSS Feed HTML-Injection Vulnerabili=
ty
73. Epic Games Unreal Engine Logging Function Remote Denial of Ser=
vice Vulnerability
74. Microsoft Process Monitor SSDT Hooks Multiple Local Vulnerabil=
ities
75. Y&K Iletisim Formu Multiple HTML-Injection Vulnerabilities
76. X-Scripts X-Statistics X-Statistics.PHP SQL Injection Vulnerab=
ility
77. OpenSSL SSL_Get_Shared_Ciphers Buffer Overflow Vulnerability
78. eGov Manager Multiple Cross-Site Scripting Vulnerabilities
79. phpFreeLog log.php Local File Include Vulnerability
80. Expanded Calendar PHP-Fusion Module Show_Single.PHP SQL Inject=
ion Vulnerability
81. phpwcms-xt HTML_MENU_DirPath Multiple Remote File Include Vuln=
erabilities
82. Microsoft Windows Vista ARP Table Entries Denial of Service Vu=
lnerability
83. Netkamp Emlak Scripti Multiple Input Validation Vulnerabilitie=
s
84. Trolltech Qt ToUnicode Function Off By One Buffer Overflow Vul=
nerability
85. MySQL Access Validation and Denial of Service Vulnerabilities
86. Open Translation Engine Header.PHP Remote File Include Vulnera=
bility
87. GNU Emacs Image Processing Remote Denial of Service Vulnerabil=
ity
88. GNU Tar Hostile Destination Path Variant Vulnerability
89. GNU Tar Hostile Destination Path Vulnerability
90. PopTop PPTP Server GRE Packet Denial Of Service Vulnerability
91. Balsa Fetch Command Remote Stack Buffer Overflow Vulnerability
92. GroupLink eHelpDesk Multiple Cross-Site Scripting Vulnerabilit=
ies
93. actSite NEWS.PHP Local File Include Vulnerability
94. actSite BASE.PHP BASECFG[BASEDIR] Parameter Remote File Includ=
e Vulnerability
95. phpBB openID OPENID_ROOT_PATH Parameter Remote File Include Vu=
lnerability
96. Linux Kernel ALSA snd-page-alloc Local Proc File Information D=
isclosure Vulnerability
97. T1lib intT1_Env_GetCompletePath Buffer Overflow Vulnerability
98. Bugzilla Multiple Remote Vulnerabilities
99. MXBB MX Glance Module PHPBB_Root_Path Remote File Include Vuln=
erability
100. MambAds Mambo Component CAID Parameter SQL Injection Vulnerab=
ility
III. SECURITYFOCUS NEWS
1. DHS, Unisys scrutinized after data breach
2. Customers: TD Ameritrade failed to warn of breach
3. Max Vision charged with hacking -- again
4. Embassy leaks highlight pitfalls of Tor
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Security Architect, St. Louis
2. [SJ-JOB] Penetration Engineer, FLEX
3. [SJ-JOB] Penetration Engineer, FLEX
4. [SJ-JOB] Penetration Engineer, Munich/Hamburg - FLEX other area=
s
5. [SJ-JOB] Security Engineer, Hartford / Middletown
6. [SJ-JOB] Application Security Engineer, New York
7. [SJ-JOB] Security Engineer, Cupertino
8. [SJ-JOB] Manager, Information Security, St. Louis
9. [SJ-JOB] Sr. Product Manager, Cupertino
10. [SJ-JOB] Penetration Engineer, Hong Kong
11. [SJ-JOB] Jr. Security Analyst, Washington
12. [SJ-JOB] Jr. Security Analyst, Gurgaon
13. [SJ-JOB] Security Engineer, Leeds
14. [SJ-JOB] Software Engineer, St. Paul
15. [SJ-JOB] Technical Support Engineer, Columbia
16. [SJ-JOB] Security Consultant, London
17. [SJ-JOB] Security System Administrator, jacksonville
18. [SJ-JOB] Security System Administrator, jacksonville
19. [SJ-JOB] Information Assurance Analyst, Washington
20. [SJ-JOB] Information Assurance Engineer, Washington
21. [SJ-JOB] Security Engineer, Tucson
22. [SJ-JOB] Security Consultant, Arlington
23. [SJ-JOB] Sr. Security Engineer, Tucson
24. [SJ-JOB] Sr. Security Engineer, Herndon
25. [SJ-JOB] Security Engineer, Arlington
26. [SJ-JOB] Security Consultant, Arlington
27. [SJ-JOB] Security Product Manager, Mountain View
28. [SJ-JOB] Sales Engineer, Atlanta
29. [SJ-JOB] Sales Engineer, Detroit
30. [SJ-JOB] Sr. Product Manager, Mountain View
31. [SJ-JOB] Software Engineer, Livonia
32. [SJ-JOB] Forensics Engineer, Mountain View
33. [SJ-JOB] Software Engineer, Columbia
34. [SJ-JOB] Security Engineer, KANSAS CITY
35. [SJ-JOB] Software Engineer, Livonia
36. [SJ-JOB] Customer Service, St. Paul
37. [SJ-JOB] Security Consultant, New York
38. [SJ-JOB] Customer Support, Mountain View
39. [SJ-JOB] Customer Service, Mountain View
40. [SJ-JOB] Information Assurance Analyst, Chantilly
41. [SJ-JOB] Security Engineer, Philadelphia
42. [SJ-JOB] Instructor, Novi
43. [SJ-JOB] Sr. Security Analyst, Leatherhead / Reading
44. [SJ-JOB] Senior Software Engineer, Mountain View
45. [SJ-JOB] Senior Software Engineer, St.Louis
46. [SJ-JOB] Security Engineer, Reading
47. [SJ-JOB] Application Security Engineer, St.Louis
48. [SJ-JOB] Security Consultant, Reading
49. [SJ-JOB] Manager, Information Security, New York
50. [SJ-JOB] Software Engineer, Redmond
51. [SJ-JOB] Jr. Security Analyst, Calgary
V. INCIDENTS LIST SUMMARY
1. Interesting mail sender
VI. VULN-DEV RESEARCH LIST SUMMARY
VII. MICROSOFT FOCUS LIST SUMMARY
1. SecurityFocus Microsoft Newsletter #361
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1.Passive Network Analysis
By Stephen Barish
In sports, it's pretty much accepted wisdom that home teams have the adva=
ntage; that's why teams with winning records on the road do so well in th=
e playoffs. But for some reason we rarely think about "the home field adv=
antage" when we look at defending our networks.=20
http://www.securityfocus.com/infocus/1894
2.Windows Anti-Debug Reference
By Nicolas Falliere
This paper classifies and presents several anti-debugging techniques used=
on Windows NT-based operating systems.=20
http://www.securityfocus.com/infocus/1893
II. BUGTRAQ SUMMARY
--------------------
1. Sina UC BROWSER2UC.DLL ActiveX Control Multiple Remote Stack Buffer Ov=
erflow Vulnerabilities
BugTraq ID: 21958
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/21958
Summary:
Sina UC ActiveX control is prone to multiple remote stack-based buffer-ov=
erflow vulnerabilities because the application fails to properly bounds-c=
heck user-supplied data before copying it into an insufficiently sized me=
mory buffer.
Exploiting these issues allows remote attackers to execute arbitrary code=
in the context of applications using the affected ActiveX control and to=
compromise affected computers. Failed attempts will likely result in den=
ial-of-service conditions.
Sina UC 2006 and prior versions are vulnerable to this issue.
2. HP Mercury Quality Center ActiveX Control Buffer Overflow Vulnerabilit=
y
BugTraq ID: 23239
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/23239
Summary:
HP Mercury Quality Center ActiveX control is prone to a remote buffer-ove=
rflow vulnerability because it fails to adequately bounds-check user-supp=
lied input before copying it to an insufficiently sized memory buffer.
Exploiting this issue allows remote attackers to execute arbitrary code i=
n the context of applications using the affected ActiveX control and poss=
ibly to compromise affected computers.
HP Mercury Quality Center 8.2 SP1 and 9.0 are vulnerable to this issue.
3. Tor ControlPort Missing Authentication Unauthorized Access Vulnerabili=
ty
BugTraq ID: 25188
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25188
Summary:
Tor is prone to an unauthorized-access vulnerability due to a design erro=
r when handling multiple connections to the ControlPort.
An attacker can exploit this issue to reconfigure Tor and significantly w=
eaken the anonymity provided by the software.=20
Tor 0.1.2.15 is confirmed vulnerable; previous versions may also be affec=
ted.
4. MD-Pro Index.PHP Firefox ID SQL Injection Vulnerability
BugTraq ID: 25864
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25864
Summary:
MD-Pro is prone to an SQL-injection vulnerability because the application=
fails to properly sanitize user-supplied input before using it in an SQL=
query.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
MD-Pro 1.0.76 is vulnerable to this issue; other versions may also be aff=
ected.
5. Public Media Manager newstopic_inc.php Remote File Include Vulnerabili=
ty
BugTraq ID: 25860
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25860
Summary:
Public Media Manager is prone to a remote file-include vulnerability beca=
use the application fails to properly sanitize user-supplied input before=
using it in a PHP 'include()' function call.=20
An attacker may leverage this issue to execute arbitrary server-side scri=
pt code on an affected computer with the privileges of the webserver proc=
ess.=20
This issue affects Public Media Manager 1.3; other versions may also be v=
ulnerable.
6. OpenSSL Montgomery Exponentiation Side-Channel Local Information Discl=
osure Vulnerability
BugTraq ID: 25163
Remote: No
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25163
Summary:
OpenSSL is prone to a local information-disclosure vulnerability because =
of an implementation flaw in the RSA algorithm.
Successfully exploiting this issue allows local attackers to gain access =
to private key information of other processes that use the affected libra=
ry. Information harvested may aid in further attacks.
OpenSSL 0.9.8 is vulnerable to this issue; other versions may also be aff=
ected.
7. Sun Fire X2100 M2 And X2200 M2 ELOM Unauthorized Access Vulnerability
BugTraq ID: 25863
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25863
Summary:
Sun Fire X2100 M2 and X2200 M2 servers are prone to a vulnerability that =
allows unauthorized access.
This issue affects the Embedded Lights Out Manager (ELOM).
Remote attackers can leverage this issue to use a vulnerable server as a =
proxy for sending spam email messages.
8. Linux Kernel PTrace NULL Pointer Dereference Local Denial Of Service V=
ulnerability
BugTraq ID: 25801
Remote: No
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25801
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability.
This issue occurs because of a NULL-pointer dereference in certain 'ptrac=
e' operations.
A local attacker can exploit this issue to crash the affected kernel, den=
ying service to legitimate users.
9. Linux Kernel JFFS2 Filesystem Security Bypass Vulnerability
BugTraq ID: 25838
Remote: No
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25838
Summary:
The Linux kernel is prone to a security-bypass vulnerability because the =
software fails to properly store POSIX ACLs in the JFFS2 filesystem.
A local attacker may exploit this issue to bypass ACL security restrictio=
ns, which may lead to other attacks.
10. Linux Kernel CIFS Local Privilege Escalation Vulnerability
BugTraq ID: 25672
Remote: No
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25672
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability.
An attacker could exploit this issue to execute arbitrary code with the p=
rivileges of the victim.
11. Apple iPhone Mail Unauthorized tel: Initiation Vulnerability
BugTraq ID: 25862
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25862
Summary:
Apple iPhone is prone to a vulnerability that lets attackers make unautho=
rized phone calls.
This issue affects the phone's Mail application.
Attackers may exploit this issue to initiate unauthorized telephone calls=
to arbitrary phone numbers.
NOTE: This issue was initially disclosed along with several other issues =
in BID 25834 (Apple iPhone 1.1.1 Update Multiple Security Vulnerabilitie=
s). Each issue has been assigned its own BID to better document the detai=
ls.
Versions prior to iPhone 1.1.1 are vulnerable.
12. Apple iPhone Mobile Safari Cross-Domain URI Disclosure Vulnerability
BugTraq ID: 25859
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25859
Summary:
Apple iPhone is prone to an information-disclosure vulnerability.
This issue affects the phone's Mobile Safari application.
Attackers may exploit this issue to access potentially sensitive informat=
ion; other attacks are also possible.
NOTE: This issue was initially disclosed along with several other issues =
in BID 25834 (Apple iPhone 1.1.1 Update Multiple Security Vulnerabilities=
). Each issue has been assigned its own BID to better document the detail=
s.
Versions prior to iPhone 1.1.1 are vulnerable.
13. Axis Communications 2100 Network Camera Multiple Input Validation Vul=
nerabilities
BugTraq ID: 25837
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25837
Summary:
Axis Communications 2100 Network Camera is prone to multiple input-valida=
tion vulnerabilities, including a cross-site scripting issue, multiple HT=
ML-injection issues, and a cross-site request-forgery issue, because the =
application fails to properly sanitize user-supplied input.
Exploiting these issues could allow an attacker to execute arbitrary scri=
pt code in the context of the webserver process, control how the site is =
rendered to the user, compromise the application, obtain sensitive inform=
ation, and access or modify data.
These issues affect 2100 Network Cameras with firmware version 2.43; othe=
r firmware versions and models may also be affected.
14. Zomplog admin/upload_files.php Unauthorized Access Vulnerability
BugTraq ID: 25861
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25861
Summary:
Zomplog is prone to an unauthorized-access vulnerability because it fails=
to adequately limit access to administrative scripts.=20
An attacker can exploit this vulnerability to upload arbitrary code and e=
xecute it in the context of the webserver process. This may allow the att=
acker to gain unauthorized access or to escalate privileges; other attack=
s are also possible.=20
This issue affects Zomplog 3.8.1; other versions may also be vulnerable.
15. Apple iPhone Mobile Safari Browser Window Properties Same Origin Poli=
cy Bypass Vulnerability
BugTraq ID: 25857
Remote: Yes
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/25857
Summary:
Apple iPhone Mobile Safari Browser is prone to a vulnerability that allow=
s attackers to bypass the same-origin policy.
Attackers can exploit this issue to execute arbitrary JavaScript in the c=
ontext of another domain.
Versions prior to iPhone 1.1.1 are vulnerable.
NOTE: This issue was initially disclosed along with several other issues =
in BID 25834 (Apple iPhone 1.1.1 Update Multiple Security Vulnerabilities=
). Each issue has been assigned its own BID to better document the detail=
s.
16. Apple iPhone 1.1.1 Mobile Safari Browser iFrame Same Origin Policy By=
pass Vulnerability
BugTraq ID: 25850
Remote: Yes
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/25850
Summary:
Apple iPhone Mobile Safari Browser is prone to a vulnerability that lets =
attackers bypass the same-origin policy.
Attackers can exploit this issue to execute arbitrary JavaScript in the c=
ontext of another domain.
Versions prior to iPhone 1.1.1 are vulnerable.
NOTE: This issue was initially disclosed along with several other issues =
in BID 25834 (Apple iPhone 1.1.1 Update Multiple Security Vulnerabilities=
). Each issue has been assigned its own BID to better document the detail=
s.
17. Samba MS-RPC Remote Shell Command Execution Vulnerability
BugTraq ID: 23972
Remote: Yes
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/23972
Summary:
Samba is prone to a vulnerability that allows attackers to execute arbitr=
ary shell commands because the software fails to sanitize user-supplied i=
nput.
An attacker may leverage this issue to execute arbitrary shell commands o=
n an affected computer with the privileges of the application.
This issue affects Samba 3.0.0 to 3.0.25rc3.
18. Samba Deferred CIFS File Open Denial of Service Vulnerability
BugTraq ID: 22395
Remote: No
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/22395
Summary:
The smbd daemon is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to consume excessive memory resources,=
ultimately crashing the affected application.
This issue affects Samba versions 3.0.6 through 3.0.23d, inclusive.
19. Samba NDR RPC Request DFSEnum Heap-Based Buffer Overflow Vulnerabilit=
y
BugTraq ID: 24198
Remote: Yes
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/24198
Summary:
Samba is prone to a remote heap-based buffer-overflow vulnerability becau=
se it fails to properly bounds-check user-supplied data before copying it=
to an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges, facilitating the complete remote compromise of affected co=
mputers. Failed exploit attempts will result in a denial of service.
This issue affects Samba 3.0.25rc3 and prior versions.
20. Samba NDR RPC Request NetSetFileSecurity Heap-Based Buffer Overflow V=
ulnerability
BugTraq ID: 24196
Remote: Yes
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/24196
Summary:
Samba is prone to a remote heap-based buffer-overflow vulnerability becau=
se it fails to properly bounds-check user-supplied data before copying it=
to an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges, facilitating the complete remote compromise of affected co=
mputers. Failed exploit attempts will result in a denial of service.
This issue affects Samba 3.0.25rc3 and prior versions.
21. Samba NDR RPC Request RFNPCNEX Heap-Based Buffer Overflow Vulnerabili=
ty
BugTraq ID: 24197
Remote: Yes
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/24197
Summary:
Samba is prone to a remote heap-based buffer-overflow vulnerability becau=
se it fails to properly bounds-check user-supplied data before copying it=
to an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges, facilitating the complete remote compromise of affected co=
mputers. Failed exploit attempts will result in a denial of service.
This issue affects Samba 3.0.25rc3 and prior versions.
22. Samba NDR RPC Request LsarLookupSids/LsarLookupSids2 Heap-Based Buffe=
r Overflow Vulnerability
BugTraq ID: 24195
Remote: Yes
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/24195
Summary:
Samba is prone to a remote heap-based buffer-overflow vulnerability becau=
se it fails to properly bounds-check user-supplied data before copying it=
to an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges, facilitating the complete remote compromise of affected co=
mputers. Failed exploit attempts will result in a denial of service.
This issue affects Samba 3.0.25rc3 and prior versions.
23. Samba SID Names Local Privilege Escalation Vulnerability
BugTraq ID: 23974
Remote: No
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/23974
Summary:
Samba is prone to a local privilege-escalation vulnerability due to a log=
ic error in the 'smbd' daemon's internal security stack.
An attacker can exploit this issue to temporarily perform SMB/CIFS operat=
ions with superuser privileges. The attacker may leverage this issue to g=
ain superuser access to the server.
Samba 3.0.23d through 3.0.25pre2 are vulnerable.
24. Samba NDR RPC Request LsarAddPrivilegesToAccount Heap-Based Buffer Ov=
erflow Vulnerability
BugTraq ID: 23973
Remote: Yes
Last Updated: 2007-09-29
Relevant URL: http://www.securityfocus.com/bid/23973
Summary:
Samba is prone to a remote heap-based buffer-overflow vulnerability becau=
se it fails to properly bounds-check user-supplied data before copying it=
to an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges, facilitating the complete remote compromise of affected co=
mputers. Failed exploit attempts will result in a denial of service.
This issue affects Samba 3.0.25rc3 and prior versions.
This BID previously documented multiple heap-based buffer-overflow vulner=
abilities affecting Samba. Each issue has been assigned its own individua=
l record. The issues are covered in this BID and the following records:
=20
BID 24195 - Samba NDR RPC Request LsarLookupSids/LsarLookupSids2 Heap-Bas=
ed Buffer Overflow Vulnerability
BID 24196 - Samba NDR RPC Request NetSetFileSecurity Heap-Based Buffer Ov=
erflow Vulnerability
BID 24197 - Samba NDR RPC Request RFNPCNEX Heap-Based Buffer Overflow Vul=
nerability
BID 24198 - Samba NDR RPC Request DFSEnum Heap-Based Buffer Overflow Vuln=
erability
25. Apple iPhone Safari Browser Same Domain Content Manipulation Vulnerab=
ility
BugTraq ID: 25852
Remote: Yes
Last Updated: 2007-09-28
Relevant URL: http://www.securityfocus.com/bid/25852
Summary:
Apple iPhone Safari browser is prone to a vulnerability regarding conten=
t between HTTP and HTTPS pages served from the same domain.=20
An attacker can exploit this issue to execute arbitrary script code in th=
e context of the HTTPS webpages.
Versions prior to iPhone 1.1.1 are vulnerable.
NOTE: This issue was initially disclosed along with several other issues =
in BID 25834 (Apple iPhone 1.1.1 Update Multiple Security Vulnerabilitie=
s). Each issue has been assigned its own BID to better document the deta=
ils.
26. Cisco Catalyst 6500 and Cisco 7600 Loopback Access Control Bypass Vul=
nerability
BugTraq ID: 25822
Remote: Yes
Last Updated: 2007-09-28
Relevant URL: http://www.securityfocus.com/bid/25822
Summary:
Cisco Catalyst 6500 and Cisco 7600 devices are prone to a vulnerability t=
hat may allow attackers to bypass access control lists (ACL).
Attackers may leverage this issue to access a device from an unauthorized=
remote location; this may aid in further attacks.
27. Sun Solaris Thread Handling Local Denial Of Service Vulnerability
BugTraq ID: 25821
Remote: No
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25821
Summary:
Sun Solaris is prone to a local denial-of-service vulnerability because o=
f a race condition in the affected kernel.=20
An attacker could exploit this issue to cause a kernel panic, denying fur=
ther service to legitimate users
28. Sun Solaris Human Interface Device Local Denial of Service Vulnerabil=
ity
BugTraq ID: 25814
Remote: No
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25814
Summary:
Sun Solaris is prone to a local denial-of-service vulnerability.
This issue stems from an unspecified error in the Human Interface Device =
(HID) Class Driver. Local attackers may exploit this issue to trigger ker=
nel panics or system hangs, denying service to legitimate users.=20
These versions are affected:
Solaris 8, 9, and 10 SPARC
Solaris 9 and 10 x86
29. Pidgin MSN Nudge Messages Remote Denial Of Service Vulnerability
BugTraq ID: 25872
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25872
Summary:
Pidgin is prone to a remote denial-of-service vulnerability because it fa=
ils to handle specially crafted messages.
Attackers can exploit this issue to crash the application, denying servic=
e to legitimate users.
Versions prior to Pidgin 2.2.1 are vulnerable.
30. Linux Kernel USB PWC Driver Local Denial Of Service Vulnerability
BugTraq ID: 25504
Remote: No
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25504
Summary:
The Linux Kernel is prone to a local denial-of-service vulnerability beca=
use it fails to properly free resources of USB PWC devices.
Attackers can exploit this issue to block the USB subsystem, resulting in=
denial-of-service conditions.
Versions prior to 2.6.22.6 are vulnerable.
31. Linux Kernel Ptrace Local Privilege Escalation Vulnerability
BugTraq ID: 25774
Remote: No
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25774
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability.
Exploiting this issue may allow local attackers to gain elevated privileg=
es, facilitating the complete compromise of affected computers.
Versions of Linux kernel prior to 2.4.35.3 and 2.6.22.7 are vulnerable to=
this issue.
32. X.Org X Font Server Multiple Memory Corruption Vulnerabilities
BugTraq ID: 25898
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25898
Summary:
X.Org X Font Server (XFS) is prone to multiple memory-corruption vulnerab=
ilities, including an integer-overflow issue and a heap-based memory-corr=
uption issue.=20
An attacker could exploit this issue to execute arbitrary code with the p=
rivileges of the X Font Server. Failed exploit attempts will likely resul=
t in a denial-of-service condition.=20
NOTE: These issues are exploitable remotely only on Solaris operating sys=
tems; by default the server is listening on TCP port 7100. For other UNIX=
-like operating systems, an attacker can exploit these issues only locall=
y.
These issues affect X Font Server 1.0.4; prior versions may also be affec=
ted.
33. Libpng Library Remote Denial of Service Vulnerability
BugTraq ID: 24000
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/24000
Summary:
The 'libpng' library is prone to a remote denial-of-service vulnerability=
because the library fails to handle malicious PNG files.=20
Successful exploits may allow remote attackers to cause denial-of-service=
conditions on computers running the affected library.
This issue affects 'libpng' 1.2.16 and prior versions.
34. ELinks HTTPS POST Request Information Disclosure Weakness
BugTraq ID: 25799
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25799
Summary:
ELinks is prone to an information disclosure weakness.
In certain circumstances, the application may not encrypt HTTP POST data =
sent to servers using SSL.
This issue creates a false sense of security for a user because they may =
assume that sensitive data is being encrypted before it is sent to the re=
mote server.
=20
Versions prior to ELinks 0.11.3 are vulnerable to this issue.
35. Poppawid ChildWindow.Inc.PHP Remote File Include Vulnerability
BugTraq ID: 25897
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25897
Summary:
Poppawid is prone to a remote file-include vulnerability because it fails=
to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
Poppawid 2.7 is vulnerable; other versions may also be affected.
36. MIT Kerberos 5 KAdminD Server SVCAuth_GSS_Validate Stack Buffer Overf=
low Vulnerability
BugTraq ID: 25534
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25534
Summary:
Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is prone to =
a stack-based buffer-overflow vulnerability because the software fails to=
adequately bounds-check user-supplied data before copying it to an insuf=
ficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges. A successful attack can result in the complete compromise =
of the application. Failed attempts will likely result in denial-of-servi=
ce conditions.
All 'kadmind' servers run on the master Kerberos server. Since the maste=
r server holds the KDC principal and policy database, an attack may not =
only compromise the affected computer, but could also compromise multipl=
e hosts that use the server for authentication.
Kerberos 5 'kadmind' 1.4 through 1.6.2 are vulnerable; third-party applic=
ations using the affected RPC library are also affected.
37. Altnet Download Manager ADM4 ActiveX Buffer Overflow Vulnerability
BugTraq ID: 25903
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25903
Summary:
Altnet Download Manager ADM4 ActiveX control is prone to a buffer-overflo=
w vulnerability because it fails to bounds-check user-supplied data befor=
e copying it into an insufficiently sized buffer.
Attackers can exploit this issue to cause a denial-of-service condition o=
r execute arbitrary code.
This issue affects Altnet Download Manager 4.0; other versions may also b=
e affected. KaZaA and Grokster are considered to be vulnerable as well.
38. CenterTools DriveLock Remote Buffer Overflow Vulnerability
BugTraq ID: 25902
Remote: Yes
Last Updated: 2007-10-03
Relevant URL: http://www.securityfocus.com/bid/25902
Summary:
CenterTools DriveLock is prone to a remote buffer-overflow vulnerability =
because it fails to adequately bounds-check user-supplied data before cop=
ying it to an insufficiently sized buffer.
Attackers can exploit this issue to execute arbitrary code within the con=
text of the affected application. Failed exploit attempts will result in =
a denial of service.=20
This issue is reported to affect DriveLock and DriveLock Security Reporti=
ng Center versions 5.0 and prior; other versions may also be affected.
39. Xen pygrub TOOLS/PYGRUB/SRC/GRUBCONF.PY Local Command Injection Vulne=
rability
BugTraq ID: 25825
Remote: No
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25825
Summary:
Xen is prone to a local command-injection vulnerability that can lead to =
privilege escalation.
This issue occurs because the application fails to validate input in the =
'tools/pygrub/src/GrubConf.py' script.
This vulnerability affects Xen 3.0.3; other versions may be affected as w=
ell.
40. Computer Associates BrightStor Hierarchical Storage Manager CsAgent M=
ultiple Remote Vulnerabilities
BugTraq ID: 25823
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25823
Summary:
Computer Associates BrightStor Hierarchical Storage Manager is prone to m=
ultiple remote vulnerabilities.
A remote attacker may exploit these issues to execute arbitrary code wit=
h SYSTEM-level privileges. Successful exploits can result in a complete c=
ompromise of affected computers. Other attacks and failed exploit attempt=
s may also cause denial-of-service conditions.
BrightStor Hierarchical Storage Manager r11.5 is affected.
41. QEMU Multiple Local Vulnerabilities
BugTraq ID: 23731
Remote: No
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/23731
Summary:
QEMU is prone to multiple locally exploitable buffer-overflow and denial-=
of-service vulnerabilities. The buffer-overflow issues occur because the =
software fails to properly check boundaries of user-supplied input when c=
opying it to insufficiently sized memory buffers. The denial-of-service i=
ssues stem from design errors.
Attackers may be able to exploit these issues to escalate privileges or t=
rigger denial-of-service conditions.
42. OpenSSL SSL_Get_Shared_Ciphers Off-by-One Buffer Overflow Vulnerabili=
ty
BugTraq ID: 25831
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25831
Summary:
OpenSSL is prone to an off-by-one buffer-overflow vulnerability because t=
he library fails to properly bounds-check user-supplied input before copy=
ing it to an insufficiently sized memory buffer.
Successfully exploiting this issue may allow attackers to execute arbitra=
ry machine code in the context of applications that use the affected libr=
ary, but this has not been confirmed. Failed exploit attempts may crash a=
pplications, denying service to legitimate users.
=20
NOTE: This issue was introduced in the fix for the vulnerability describe=
d in BID 20249 (OpenSSL SSL_Get_Shared_Ciphers Buffer Overflow Vulnerabil=
ity).
43. id Software Doom 3 Engine Console String Visualization Format String =
Vulnerability
BugTraq ID: 25893
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25893
Summary:
id Software Doom 3 engine is prone to a format-string vulnerability.
Exploiting this issue will allow attackers to execute arbitrary code with=
the permissions of a user running the application. Failed attacks will l=
ikely cause denial-of-service conditions.=20
Several games that use the Doom 3 engine are affected, including Doom 3, =
Quake 4, and Prey.
44. DVDdb Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 23764
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/23764
Summary:
DVDdb is prone to multiple cross-site scripting vulnerabilities because t=
he application fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to steal cookie-based authentication=
credentials and launch other attacks.
DVDdb 0.6 and prior versions are reported vulnerable.
45. iScripts MultiCart Multiple SQL Injection Vulnerabilities
BugTraq ID: 25895
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25895
Summary:
iScripts MultiCart is prone to multiple SQL-injection vulnerabilities bec=
ause it fails to sufficiently sanitize user-supplied data before using it=
in an SQL query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
iScripts MultiCart 1.0 is vulnerable; other versions may also be affected=
.
46. Ruby Net::HTTP SSL Insecure Certificate Validation Weakness
BugTraq ID: 25847
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25847
Summary:
Ruby's Net::HTTP library is prone to an insecure-certificate-validation w=
eakness because the library fails to properly perform validity checks on =
X.509 certificates.
Successfully exploiting this issue may allow attackers to perform man-in-=
the-middle attacks against applications that insecurely use the affected =
library. Other attacks may also be possible.
47. id3lib Insecure Temporary File Creation Vulnerability
BugTraq ID: 25372
Remote: No
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25372
Summary:
The id3lib library creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to per=
form symlink attacks, overwriting arbitrary files in the context of appli=
cations using the affected library.
Successfully mounting a symbolic-link attack may allow the attacker to ov=
erwrite or corrupt sensitive files, which may result in a denial of servi=
ce. Other attacks may also be possible.
48. Google Mini Search Appliance IE Parameter Cross-Site Scripting Vulner=
ability
BugTraq ID: 25894
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25894
Summary:
Google Mini Search Appliance is prone to a cross-site scripting vulnerabi=
lity.
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.=20
This issue affects Google Mini Search Appliance 3.4.14; other versions ma=
y also be affected.
49. SmbFTPD SMBDirList Format String Vulnerability
BugTraq ID: 25871
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25871
Summary:
SmbFTPD is prone to a format-string vulnerability.=20
This issue presents itself because the application fails to properly sani=
tize filenames.
A successful attack may allow attackers to crash the application or possi=
bly to execute arbitrary code in the context of the user running the appl=
ication.
Versions prior to SmbFTPD 0.97 are vulnerable to this issue.
50. Microsoft Windows Logon Process Remote Buffer Overflow Vulnerability
BugTraq ID: 10126
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/10126
Summary:
Microsoft Windows logon process 'winlogon' is prone to a remote buffer-ov=
erflow vulnerability. The issue occurs when the vulnerable host is a memb=
er of an Active Directory domain. When processing logon information, the =
logon process reads data from the Active Directory. This read call fails =
to sufficiently perform boundary checks on received data before copying i=
t into a reserved buffer in process memory.=20
=20
Supplied data that exceeds the size of the allocated buffer in the logon =
process's memory will overrun its bounds and will corrupt memory that is =
adjacent to the affected buffer.
51. Microsoft Windows Management Local Privilege Escalation Vulnerability
BugTraq ID: 10125
Remote: No
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/10125
Summary:
Microsoft Windows Management is prone to a local privilege-escalation vul=
nerability that may allow a local attacker to execute arbitrary attacker-=
supplied code with SYSTEM privileges.
52. Microsoft Windows Utility Manager Local Privilege Escalation Vulnerab=
ility
BugTraq ID: 10124
Remote: No
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/10124
Summary:
Microsoft Utility Manager is prone to a local privilege-escalation vulner=
ability that may allow a local attacker to execute arbitrary code with SY=
STEM privileges.
53. Microsoft Windows Local Descriptor Table Local Privilege Escalation V=
ulnerability
BugTraq ID: 10122
Remote: No
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/10122
Summary:
Microsoft Windows Local Descriptor Table programming interface is prone t=
o a privilege-escalation vulnerability.
=20
A local attacker may be able to create a malicious entry in the Local Des=
criptor Table. This entry may point into protected memory. Since this mem=
ory space is reserved for kernel operations, the attacker will likely exp=
loit this condition to execute arbitrary code with elevated privileges.
54. MPlayer AVIHeader.C Heap Based Buffer Overflow Vulnerability
BugTraq ID: 25648
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25648
Summary:
MPlayer is prone to a heap-based buffer-overflow vulnerability because it=
fails to perform adequate boundary checks on user-supplied input data.
Attackers can exploit this issue to execute arbitrary code with the privi=
leges of the user running the application. Failed attacks will result in =
denial-of-service conditions.
MPlayer 1.0rc1 is vulnerable; other versions may also be affected.
NOTE: The vendor states that this issue is present only on operating syst=
ems with a 'calloc' implementation that is prone to an integer-overflow i=
ssue.
55. XOOPS Uploader Class Arbitrary File Upload Vulnerability
BugTraq ID: 25878
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25878
Summary:
XOOPS is prone to an arbitrary-file-upload vulnerability because the appl=
ication fails to sufficiently sanitize user-supplied input.
An attacker can exploit this vulnerability to upload PHP script code and =
execute it in the context of the webserver process.
56. Quicksilver Forums Information Disclosure Vulnerability and PM Deleti=
on Vulnerability
BugTraq ID: 25887
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25887
Summary:
Quicksilver Forums is prone to two vulnerabilities:
- An information-disclosure issue
- An issue that permits unauthorized users to delete PMs.=20
An attacker can exploit these issues to obtain sensitive information and =
to remove other users' PMs. These issues may lead to further attacks.=20
Versions prior to Quicksilver 1.4.1 are affected.
57. Segue CMS themesdir Parameter Remote File Include Vulnerability
BugTraq ID: 25889
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25889
Summary:
Segue CMS is prone to a remote file-include vulnerability because the app=
lication fails to properly sanitize user-supplied input before using it i=
n a PHP 'include()' function call.=20
An attacker may leverage this issue to execute arbitrary server-side scri=
pt code on an affected computer with the privileges of the webserver proc=
ess.=20
This issue affects Segue CMS 1.8.4; other versions may also be vulnerable=
.
58. OdysseySuite Mailbox.MWS Cross-Site Scripting Vulnerability
BugTraq ID: 25891
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25891
Summary:
OdysseySuite is prone to a cross-site scripting vulnerability because the=
application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
59. Ohesa Emlak Portal Multiple SQL Injection Vulnerabilities
BugTraq ID: 25880
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25880
Summary:
Ohesa Emlak Portal is prone to multiple SQL-injection vulnerabilities bec=
ause it fails to adequately sanitize user-supplied input before using it =
in an SQL query.
A successful exploit may allow an attacker to compromise the application,=
access or modify data, or exploit latent vulnerabilities in the underlyi=
ng database.
Ohesa Emlak Portal 1.0 is vulnerable; other versions may also be affected=
.
60. CyberLink PowerDVD CLAVSetting.DLL Arbitrary File Overwrite Vulnerabi=
lity
BugTraq ID: 25888
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25888
Summary:
CyberLink PowerDVD ActiveX control is prone to a vulnerability that lets =
attackers overwrite arbitrary local files. This may aid in further attack=
s.
61. EDraw Office Viewer Component FtpDownloadFile ActiveX Buffer Overflow=
Vulnerability
BugTraq ID: 25892
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25892
Summary:
EDraw Office Viewer Component ActiveX control is prone to a buffer-overfl=
ow vulnerability because it fails to bounds-check user-supplied data befo=
re copying it into an insufficiently sized buffer.
An attacker can exploit this issue to cause a denial-of-service condition=
and possibly to execute arbitrary code, but has not been confirmed.=20
This issue affects EDraw Office Viewer Component 5.3; other versions may =
also be affected.
62. EDraw Office Viewer Component HttpDownloadFileToTempDir ActiveX Buffe=
r Overflow Vulnerability
BugTraq ID: 25593
Remote: Yes
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25593
Summary:
EDraw Office Viewer Component ActiveX control is prone to a buffer-overfl=
ow vulnerability because it fails to bounds-check user-supplied data befo=
re copying it into an insufficiently sized buffer.
An attacker can exploit this issue to cause a denial-of-service condition=
and possibly to execute arbitrary code, but has not been confirmed.=20
This issue affects EDraw Office Viewer Component 5.2; other versions may =
also be affected.
63. rPath rMake Local Privilege Escalation Vulnerability
BugTraq ID: 25899
Remote: No
Last Updated: 2007-10-02
Relevant URL: http://www.securityfocus.com/bid/25899
Summary:
rPath rMake is prone to a local privilege-escalation vulnerability that s=
tems from a design error.
An attacker may exploit this vulnerability to execute arbitrary code with=
superuser privileges. This may facilitate a complete compromise of affec=
ted computers.
This vulnerability affects rMake 1.0.11; other versions may also be affec=
ted.
64. Check Point SecurePlatform Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 25886
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25886
Summary:
Applications that use the Check Point SecurePlatform are prone to multipl=
e buffer-overflow vulnerabilities because the platform fails to perform a=
dequate boundary checks on user-supplied data.
An attacker an exploit these issues to execute arbitrary code in the cont=
ext of the application. Failed attempts could crash the application and d=
eny service to legitimate users.
This issue is locally exploitable, but remote exploits may also be possib=
le.
This issue affects SecurePlatform R60; other versions may also be affecte=
d.
65. Ilient SysAid Cross-Site Request Forgery Vulnerability
BugTraq ID: 25885
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25885
Summary:
SysAid is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to use a victim's curre=
ntly active session to perform actions with the application.
This issue affects SysAid 4.5.03 and 4.5.04; other versions may also be a=
ffected.
66. X-script Guestbook mes_add.php Multiple SQL Injection Vulnerabilities
BugTraq ID: 25890
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25890
Summary:
X-script Guestbook is prone to multiple SQL-injection vulnerabilities bec=
ause it fails to properly sanitize user-supplied input before using it in=
SQL queries.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
These issues affect X-script Guestbook 1.3a; other versions may also be v=
ulnerable.
67. AlstraSoft Affiliate Network Pro Multiple Access Validation Vulnerabi=
lities
BugTraq ID: 25882
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25882
Summary:
AlstraSoft Affiliate Network Pro is prone to multiple access-validation v=
ulnerabilities because it fails to restrict access to certain administrat=
ive scripts.
A successful exploit will allow an attacker to compromise the application=
, access or modify data, or exploit latent vulnerabilities in the underly=
ing computer.
Affiliate Network Pro 8.0 is vulnerable; other versions may also be affec=
ted.
68. FSD Exechelp And Execmulticast Multiple Remote Buffer Overflow Vulner=
abilities
BugTraq ID: 25883
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25883
Summary:
FSD is prone to multiple remote buffer-overflow vulnerabilities because t=
he application fails to perform adequate boundary-checks on user-supplied=
data.=20
An attacker can exploit these issues to execute arbitrary code within the=
context of the affected application. Failed exploit attempts will result=
in a denial-of-service condition.
These issues affect FSD 2.052 d9 and 3.0000 d9; other versions may also b=
e affected.
69. ASP Product Catalog Default.ASP SQL Injection Vulnerability
BugTraq ID: 25884
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25884
Summary:
ASP Product Catalog is prone to an SQL-injection vulnerability because it=
fails to sufficiently sanitize user-supplied data before using it in an =
SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects ASP Product Catalog 1.0 Beta 1; other versions may als=
o be vulnerable.
70. libsndfile FLAC.C Buffer Overflow Vulnerability
BugTraq ID: 25758
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25758
Summary:
The 'libsndfile' library is prone to a heap-based buffer-overflow vulnera=
bility because it fails to perform adequate boundary checks on user-suppl=
ied data.
Attackers can exploit this issue to execute arbitrary code with the permi=
ssion of an application using the library. This can compromise the affect=
ed application and possibly the underlying computer. Failed attacks will =
likely cause denial-of-service conditions.
=20
This issue affects libsndfile 1.0.17; previous versions may also be vulne=
rable.
71. Monolith Lithtech Game Engine Multiple Remote Format String Vulnerabi=
lities
BugTraq ID: 11610
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/11610
Summary:
Lithtech game engine is prone to multiple remote format-string vulnerabil=
ities because of incorrect usage of 'printf()'-type functions. Format spe=
cifiers can be supplied directly to vulnerable functions from external da=
ta. =20
=20
A denial-of-service condition arises when a vulnerable server handles a m=
alformed request.=20
=20
Exploiting these issues may also allow an attacker to write to arbitrary =
process memory and potentially execute code. Any code executed through th=
is vulnerability could potentially run with the privileges of the server.
72. i-Systems Inc. Feedreader3 RSS Feed HTML-Injection Vulnerability
BugTraq ID: 25849
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25849
Summary:
Feedreader3 is prone to an HTML-injection vulnerability.=20
Attacker-supplied HTML and script code could run in the context of the a=
ffected browser, potentially allowing an attacker to steal cookie-based a=
uthentication credentials or to control how the site is rendered to the u=
ser. Other attacks are also possible.=20
This issue affects Feedreader3 3.10; other versions may also be affected=
.
73. Epic Games Unreal Engine Logging Function Remote Denial of Service Vu=
lnerability
BugTraq ID: 25374
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25374
Summary:
The Unreal Engine is prone to a remote denial-of-service vulnerability be=
cause the application fails to properly bounds-check user-supplied input.
Successfully exploiting this issue allows remote attackers to corrupt app=
lication memory in a manner that causes a crash. Remote code execution ma=
y be possible, but this has not been confirmed.
Versions of Unreal Engine that are included in Unreal Tournament 2003 and=
2004 are vulnerable. Given the reuse of the engine in multiple other pro=
ducts, other games and versions are also likely vulnerable.
This vulnerability also affects America's Army 2.8.2 when Punkbuster is e=
nabled on the local server; other versions may also be vulnerable.
74. Microsoft Process Monitor SSDT Hooks Multiple Local Vulnerabilities
BugTraq ID: 25719
Remote: No
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25719
Summary:
Process Monitor is prone to multiple local vulnerabilities.
Exploiting these vulnerabilities allows local attackers to crash affected=
computers, denying service to legitimate users. Attackers might also be =
able to gain elevated privileges by executing arbitrary machine code in t=
he context of the kernel, but this has not been confirmed.
Process Monitor 1.22 is vulnerable to these issues; other versions may al=
so be affected.
75. Y&K Iletisim Formu Multiple HTML-Injection Vulnerabilities
BugTraq ID: 25874
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25874
Summary:
Y&K Iletisim Formu is prone to multiple HTML-injection vulnerabilities.
Exploiting these issues allows attackers to execute arbitrary HTML or scr=
ipt code in a user's browser session in the context of an affected site. =
This may allow the attacker to steal cookie-based authentication credenti=
als and launch other attacks.
This issue affects Iletisim Formu 1.0; other versions may also be affecte=
d.
76. X-Scripts X-Statistics X-Statistics.PHP SQL Injection Vulnerability
BugTraq ID: 19237
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/19237
Summary:
X-Statistics is prone to an SQL-injection vulnerability because it fails =
to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase implementation.
X-Statistics 1.20 is vulnerable to this issue.
77. OpenSSL SSL_Get_Shared_Ciphers Buffer Overflow Vulnerability
BugTraq ID: 20249
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/20249
Summary:
OpenSSL is prone to a buffer-overflow vulnerability because the library f=
ails to properly bounds-check user-supplied input before copying it to an=
insufficiently sized memory buffer.
Successfully exploiting this issue may result in the execution of arbitra=
ry machine code in the context of applications that use the affected libr=
ary. Failed exploit attempts may crash applications, denying service to l=
egitimate users.
78. eGov Manager Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 25881
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25881
Summary:
eGov Manager is prone to multiple cross-site scripting vulnerabilities be=
cause it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
79. phpFreeLog log.php Local File Include Vulnerability
BugTraq ID: 25873
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25873
Summary:
phpFreeLog is prone to a local file-include vulnerability because it fail=
s to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized remote user to view files=
and execute local scripts in the context of the webserver process.
This issue affects phpFreeLog alpha 0.2.0; other versions may also be vul=
nerable.
80. Expanded Calendar PHP-Fusion Module Show_Single.PHP SQL Injection Vul=
nerability
BugTraq ID: 25876
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25876
Summary:
The Expanded Calendar module for PHP-Fusion is prone to an SQL-injection =
vulnerability because it fails to sufficiently sanitize user-supplied dat=
a before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation. A successful attack could help the attacke=
r gain unauthorized access.
Expanded Calendar 2.01 is vulnerable; other versions may also be affected=
.
81. phpwcms-xt HTML_MENU_DirPath Multiple Remote File Include Vulnerabili=
ties
BugTraq ID: 25879
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25879
Summary:
The 'phpwcms-xt' application is prone to multiple remote file-include vul=
nerabilities because it fails to properly sanitize user-supplied input be=
fore using it in a PHP 'require_once()' function call.=20
An attacker may leverage these issues to execute arbitrary server-side sc=
ript code on an affected computer with the privileges of the webserver pr=
ocess.=20
These issues affect phpwcms-xt 0.0.7-beta; other versions may also be vul=
nerable.
82. Microsoft Windows Vista ARP Table Entries Denial of Service Vulnerabi=
lity
BugTraq ID: 23266
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/23266
Summary:
Microsoft Windows Vista is prone to a denial-of-service vulnerability.=20
Remote attackers may exploit this issue by submitting malicious ARP reque=
sts to the vulnerable computer. To exploit this issue, attackers must hav=
e access to the local network segment of a target computer.
=20
Remote attackers can exploit this issue to cause the network interface to=
stop responding, denying further service to legitimate users.
83. Netkamp Emlak Scripti Multiple Input Validation Vulnerabilities
BugTraq ID: 25875
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25875
Summary:
Netkamp Emlak Scripti is prone to multiple input-validation vulnerabiliti=
es, including multiple HTML-injection issues and an SQL-injection issue, =
because the application fails to sanitize user-supplied input.
A successful exploit may allow an attacker to steal cookie-based authenti=
cation credentials, execute malicious script code, compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
84. Trolltech Qt ToUnicode Function Off By One Buffer Overflow Vulnerabil=
ity
BugTraq ID: 25657
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25657
Summary:
Qt is prone to a buffer-overflow vulnerability because the framework fail=
s to perform adequate boundary checks on user-supplied data.=20
An attacker can exploit this issue to execute arbitrary code within the c=
ontext of applications that use the affected framework. Failed exploit at=
tempts will result in a denial-of-service condition.
85. MySQL Access Validation and Denial of Service Vulnerabilities
BugTraq ID: 25017
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25017
Summary:
MySQL is prone to a access-validation vulnerability and a denial-of-servi=
ce vulnerability.=20
An attacker can exploit these issues to create arbitrary MySQL tables or =
to crash the affected application, denying service to legitimate users.
This issue affects versions prior to MySQL 5.0.45.
86. Open Translation Engine Header.PHP Remote File Include Vulnerability
BugTraq ID: 23793
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/23793
Summary:
Open Translation Engine is prone to a remote file-include vulnerability b=
ecause it fails to sufficiently sanitize user-supplied input.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
Open Translation Engine versions prior to 0.9.2 are vulnerable.
87. GNU Emacs Image Processing Remote Denial of Service Vulnerability
BugTraq ID: 24570
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/24570
Summary:
The 'emacs' program is prone to a remote denial-of-service vulnerability =
because it fails to handle malicious image files.=20
Successful exploits may allow remote attackers to cause denial-of-service=
conditions on computers running the affected application.
88. GNU Tar Hostile Destination Path Variant Vulnerability
BugTraq ID: 5834
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/5834
Summary:
GNU 'tar' 1.13.25 contains a vulnerability in the handling of pathnames f=
or archived files.=20
By specifying a path for an archived item that points outside the expecte=
d directory scope, the creator of the archive can cause the file to be ex=
tracted to arbitrary locations on the filesystem, including paths contain=
ing system binaries and other sensitive or confidential information.=20
An attacker could use this to create or overwrite binaries in any desired=
location.=20
This issue is a variant of the vulnerability described in BID 3024. It is=
not known whether earlier versions are also affected by this variant.
89. GNU Tar Hostile Destination Path Vulnerability
BugTraq ID: 3024
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/3024
Summary:
GNU tar contains a vulnerability in the handling of pathnames for archive=
d files.=20
=20
By specifying a path for an archived item that points outside the expecte=
d directory scope, an attacker can cause the file to be extracted to arbi=
trary locations on the filesystem, including paths containing system bina=
ries and other sensitive or confidential information. =20
=20
By default, tar will overwrite existing files without warning the user. =
Since tar can override umask settings, the output file can be rendered ex=
ecutable.=20
=20
An attacker can exploit this issue to create or overwrite binaries in any=
desired location. The attacker may be able to elevate privileges, potent=
ially to 'root'.
Versions prior to GNU Tar 1.13.19 are affected.
90. PopTop PPTP Server GRE Packet Denial Of Service Vulnerability
BugTraq ID: 23886
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/23886
Summary:
PoPToP PPTP Server is prone to a denial-of-service vulnerability because =
it fails to adequately handle certain malformed packet data.
Attackers can exploit this issue to disconnect arbitrary PPTP connections=
.
PoPToP PPTP Server 1.3.4 is vulnerable; other versions may also be affect=
ed.
91. Balsa Fetch Command Remote Stack Buffer Overflow Vulnerability
BugTraq ID: 25777
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25777
Summary:
Balsa is prone to a remote stack-based buffer-overflow vulnerability beca=
use the application fails to perform adequate boundary-checks on user-sup=
plied data.=20
This issue affects the application's IMAP functionality.
An attacker can exploit this issue to execute arbitrary machine code with=
in the context of the user running the application. Failed exploit attemp=
ts will result in a denial-of-service vulnerability.
Versions prior to Balsa 2.3.20 are vulnerable.
92. GroupLink eHelpDesk Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 25870
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25870
Summary:
eHelpDesk is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
=20
These issues affect eHelpDesk 6.2.2; other versions may also be affected=
.
93. actSite NEWS.PHP Local File Include Vulnerability
BugTraq ID: 25869
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25869
Summary:
actSite is prone to a local file-include vulnerability because it fails t=
o properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized remote user to view files=
and execute local scripts in the context of the webserver process.
This issue affects actSite 1.56; other versions may also be vulnerable.
94. actSite BASE.PHP BASECFG[BASEDIR] Parameter Remote File Include Vulne=
rability
BugTraq ID: 25868
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25868
Summary:
actSite is prone to a remote file-include vulnerability because it fails =
to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
This issue affects actSite 1.99.1 Beta; other versions may also be affect=
ed.
95. phpBB openID OPENID_ROOT_PATH Parameter Remote File Include Vulnerabi=
lity
BugTraq ID: 25867
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25867
Summary:
The phpBB openID module is prone to a remote file-include vulnerability b=
ecause it fails to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
This issue affects phpBB openID 0.2.0; other versions may also be affecte=
d.
96. Linux Kernel ALSA snd-page-alloc Local Proc File Information Disclosu=
re Vulnerability
BugTraq ID: 25807
Remote: No
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25807
Summary:
The Linux kernel is prone to an information-disclosure vulnerability.
Successful exploits will allow attackers to obtain portions of kernel mem=
ory. Information harvested may aid in further attacks.
Versions of the Linux kernel prior to 2.6.22.8 are vulnerable.
97. T1lib intT1_Env_GetCompletePath Buffer Overflow Vulnerability
BugTraq ID: 25079
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25079
Summary:
T1lib is prone to a buffer-overflow vulnerability because the library fai=
ls to perform boundary checks before copying user-supplied data to insuff=
iciently sized memory buffers.
=20
An attacker can exploit this issue to execute arbitrary machine code in t=
he context of applications that use the affected library. Failed exploit =
attempts will likely trigger crashes, denying service to legitimate users=
. =20
We do not know which versions of T1lib are affected.
98. Bugzilla Multiple Remote Vulnerabilities
BugTraq ID: 25425
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25425
Summary:
Bugzilla is prone to multiple remote vulnerabilities, including an HTML-i=
njection issue, a remote command-injection issue, and an information-disc=
losure issue.
An attacker can exploit these issues to execute arbitrary code and comman=
ds with the privileges of the webserver process, steal cookie-based authe=
ntication credentials, and obtain sensitive information.=20
These issues affects Bugzilla 2.20.4, 2.22.2, 3.0, 3.1; prior versions o=
f the 2.20 and 2.22 branches are also affected.
99. MXBB MX Glance Module PHPBB_Root_Path Remote File Include Vulnerabili=
ty
BugTraq ID: 25866
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25866
Summary:
The mxBB MX Glance module is prone to a remote file-include vulnerability=
because it fails to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
This issue affects MX Glance 2.3.3; other versions may also be affected.
100. MambAds Mambo Component CAID Parameter SQL Injection Vulnerability
BugTraq ID: 25865
Remote: Yes
Last Updated: 2007-10-01
Relevant URL: http://www.securityfocus.com/bid/25865
Summary:
MambAds is prone to an SQL-injection vulnerability because it fails to su=
fficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
MambAds 1.5 is vulnerable; other versions may also be affected.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. DHS, Unisys scrutinized after data breach
By: Robert Lemos
A Congressional committee claims that Unisys allowed malicious code to in=
fect federal systems.
http://www.securityfocus.com/news/11489
2. Customers: TD Ameritrade failed to warn of breach
By: Robert Lemos
Numerous account holders complained over the past year that the consumer =
brokerage had sold or leaked e-mail addresses to pump-and-dump spammers.
http://www.securityfocus.com/news/11488
3. Max Vision charged with hacking -- again
By: Robert Lemos
Federal prosecutors charge former security consultant Max Butler, better =
known amongst security researchers as "Max Vision," alleging that he supp=
lied and managed a ring of identity thieves.
http://www.securityfocus.com/news/11487
4. Embassy leaks highlight pitfalls of Tor
By: Robert Lemos
The security researcher that posted the e-mail addresses and passwords fo=
r 100 accounts at embassies and political groups reveals that he exploite=
d the victims' incorrect usage of the Tor Project's anonymous Web surfing=
software.
http://www.securityfocus.com/news/11486
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Security Architect, St. Louis
http://www.securityfocus.com/archive/77/481368
2. [SJ-JOB] Penetration Engineer, FLEX
http://www.securityfocus.com/archive/77/481369
3. [SJ-JOB] Penetration Engineer, FLEX
http://www.securityfocus.com/archive/77/481371
4. [SJ-JOB] Penetration Engineer, Munich/Hamburg - FLEX other areas
http://www.securityfocus.com/archive/77/481372
5. [SJ-JOB] Security Engineer, Hartford / Middletown
http://www.securityfocus.com/archive/77/481364
6. [SJ-JOB] Application Security Engineer, New York
http://www.securityfocus.com/archive/77/481367
7. [SJ-JOB] Security Engineer, Cupertino
http://www.securityfocus.com/archive/77/481370
8. [SJ-JOB] Manager, Information Security, St. Louis
http://www.securityfocus.com/archive/77/481373
9. [SJ-JOB] Sr. Product Manager, Cupertino
http://www.securityfocus.com/archive/77/481374
10. [SJ-JOB] Penetration Engineer, Hong Kong
http://www.securityfocus.com/archive/77/481365
11. [SJ-JOB] Jr. Security Analyst, Washington
http://www.securityfocus.com/archive/77/481361
12. [SJ-JOB] Jr. Security Analyst, Gurgaon
http://www.securityfocus.com/archive/77/481366
13. [SJ-JOB] Security Engineer, Leeds
http://www.securityfocus.com/archive/77/481350
14. [SJ-JOB] Software Engineer, St. Paul
http://www.securityfocus.com/archive/77/481351
15. [SJ-JOB] Technical Support Engineer, Columbia
http://www.securityfocus.com/archive/77/481359
16. [SJ-JOB] Security Consultant, London
http://www.securityfocus.com/archive/77/481360
17. [SJ-JOB] Security System Administrator, jacksonville
http://www.securityfocus.com/archive/77/481362
18. [SJ-JOB] Security System Administrator, jacksonville
http://www.securityfocus.com/archive/77/481349
19. [SJ-JOB] Information Assurance Analyst, Washington
http://www.securityfocus.com/archive/77/481353
20. [SJ-JOB] Information Assurance Engineer, Washington
http://www.securityfocus.com/archive/77/481358
21. [SJ-JOB] Security Engineer, Tucson
http://www.securityfocus.com/archive/77/481345
22. [SJ-JOB] Security Consultant, Arlington
http://www.securityfocus.com/archive/77/481352
23. [SJ-JOB] Sr. Security Engineer, Tucson
http://www.securityfocus.com/archive/77/481343
24. [SJ-JOB] Sr. Security Engineer, Herndon
http://www.securityfocus.com/archive/77/481344
25. [SJ-JOB] Security Engineer, Arlington
http://www.securityfocus.com/archive/77/481332
26. [SJ-JOB] Security Consultant, Arlington
http://www.securityfocus.com/archive/77/481333
27. [SJ-JOB] Security Product Manager, Mountain View
http://www.securityfocus.com/archive/77/481342
28. [SJ-JOB] Sales Engineer, Atlanta
http://www.securityfocus.com/archive/77/481330
29. [SJ-JOB] Sales Engineer, Detroit
http://www.securityfocus.com/archive/77/481331
30. [SJ-JOB] Sr. Product Manager, Mountain View
http://www.securityfocus.com/archive/77/481346
31. [SJ-JOB] Software Engineer, Livonia
http://www.securityfocus.com/archive/77/481322
32. [SJ-JOB] Forensics Engineer, Mountain View
http://www.securityfocus.com/archive/77/481325
33. [SJ-JOB] Software Engineer, Columbia
http://www.securityfocus.com/archive/77/481334
34. [SJ-JOB] Security Engineer, KANSAS CITY
http://www.securityfocus.com/archive/77/481311
35. [SJ-JOB] Software Engineer, Livonia
http://www.securityfocus.com/archive/77/481314
36. [SJ-JOB] Customer Service, St. Paul
http://www.securityfocus.com/archive/77/481320
37. [SJ-JOB] Security Consultant, New York
http://www.securityfocus.com/archive/77/481323
38. [SJ-JOB] Customer Support, Mountain View
http://www.securityfocus.com/archive/77/481312
39. [SJ-JOB] Customer Service, Mountain View
http://www.securityfocus.com/archive/77/481313
40. [SJ-JOB] Information Assurance Analyst, Chantilly
http://www.securityfocus.com/archive/77/481321
41. [SJ-JOB] Security Engineer, Philadelphia
http://www.securityfocus.com/archive/77/481294
42. [SJ-JOB] Instructor, Novi
http://www.securityfocus.com/archive/77/481300
43. [SJ-JOB] Sr. Security Analyst, Leatherhead / Reading
http://www.securityfocus.com/archive/77/481301
44. [SJ-JOB] Senior Software Engineer, Mountain View
http://www.securityfocus.com/archive/77/481302
45. [SJ-JOB] Senior Software Engineer, St.Louis
http://www.securityfocus.com/archive/77/481303
46. [SJ-JOB] Security Engineer, Reading
http://www.securityfocus.com/archive/77/481295
47. [SJ-JOB] Application Security Engineer, St.Louis
http://www.securityfocus.com/archive/77/481310
48. [SJ-JOB] Security Consultant, Reading
http://www.securityfocus.com/archive/77/481292
49. [SJ-JOB] Manager, Information Security, New York
http://www.securityfocus.com/archive/77/481293
50. [SJ-JOB] Software Engineer, Redmond
http://www.securityfocus.com/archive/77/481304
51. [SJ-JOB] Jr. Security Analyst, Calgary
http://www.securityfocus.com/archive/77/481291
V. INCIDENTS LIST SUMMARY
---------------------------
1. Interesting mail sender
http://www.securityfocus.com/archive/75/480919
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #361
http://www.securityfocus.com/archive/88/481007
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This issue is Sponsored by: Watchfire:
Methodologies & Tools for Web Application Security Assessment=20
With the rapid rise in the number and types of security threats, web appl=
ication security assessments should be considered a crucial phase in the =
development of any web application. What methodology should be followed? =
What tools can accelerate the assessment process? See for yourself. Downl=
oad this Whitepaper today!=20
https://www.watchfire.com/securearea/whitepapers.aspx?id=3D7017000000093z=
q