SecurityFocus Newsletter #431
[email protected] 11 Dec 2007 19:54:41 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #431
----------------------------------------
This issue is Sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Cross-Site Scripting Attack"- White Paper=
=20
Cross-site scripting vulnerabilities in web apps allow hackers to comprom=
ise confidential information, steal cookies and create requests that can =
be mistaken for those of a valid user!! Download this *FREE* white paper =
from SPI Dynamics for a complete guide to protection!=20
https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=3D70160000000D8=
v9
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1.Copyrights and Wrongs
2.The Man in the Machine
II. BUGTRAQ SUMMARY
1. Valve Software Half-Life CSTRIKE Server Remote Denial of Servic=
e Vulnerability
2. Mozilla Firefox Multiple Remote Unspecified Memory Corruption V=
ulnerabilities
3. DOSBox Unauthorized File System Access Vulnerability
4. Bitweaver 2.0.0 and Prior Multiple Input Validation Vulnerabili=
ties
5. RoundCube Webmail CSS Expression Input Validation Vulnerability
6. GESTDOWN Multiple SQL Injection Vulnerabilities
7. Falcon Series One Multiple Input Validation Vulnerabilities
8. E-Xoops Multiple SQL Injection Vulnerabilities
9. WordPress wp-db.php Character Set SQL Injection Vulnerability
10. bttlxe Forum Multiple SQL Injection and Cross-Site Scripting V=
ulnerabilities
11. SquirrelMail G/PGP Encryption Plugin Access Validation And Inp=
ut Validation Vulnerabilities
12. webSPELL Usergallery.PHP and Calendar.PHP Multiple Cross-Site =
Scripting Vulnerabilities
13. HFS HTTP File Server Arbitrary File Upload Vulnerability
14. Autonomy KeyView Lotus 1-2-3 File Multiple Buffer Overflow Vul=
nerabilities
15. SiteBar Multiple Input Validation Vulnerabilities
16. S9Y Serendipity Remote RSS sidebar Plugin Cross Site Scripting=
Vulnerability
17. Heimdal FTPD gss_userok() Free Uninitialized Pointer Memory Co=
rruption Vulnerability
18. wwwstats Clickstats.PHP Multiple HTML Injection Vulnerabilitie=
s
19. Computer Associates BrightStor ARCserve Backup mediasvr calogg=
erd Denial Of Service Vulnerabilities
20. XIGLA SOFTWARE Absolute Banner Manager .NET SQL Injection Vuln=
erability
21. PenPal Multiple SQL Injection Vulnerabilities
22. Computer Associates BrightStor ARCserve Backup Multiple Remote=
Vulnerabilities
23. SING Log Option Local Privilege Escalation Vulnerability
24. Lxlabs HyperVM Cross-Site Scripting Vulnerability
25. CA BrightStor ARCserve Backup Memory Corruption Remote Code Ex=
ecution Vulnerabilities
26. phpBB .PNG and .RAR Multiple Arbitrary File Upload Vulnerabili=
ties
27. ZABBIX daemon_start Local Privilege Escalation Vulnerability
28. GNU Emacs Local Variable Handling Code Execution Vulnerability
29. Dominion Web DWdirectory Search Parameter SQL Injection Vulner=
ability
30. Trolltech Qt QTextEdit Multiple Format String Vulnerabilities
31. Falt4 CMS Multiple Input Validation Vulnerabilities
32. Flat PHP Board Multiple Remote Vulnerabilities
33. SquirrelMail G/PGP Encryption Plug-in Multiple Remote Command =
Execution Vulnerabilities
34. ActiveKB Index.PHP SQL Injection Vulnerability
35. ActiveKB NX Index.PHP Cross-Site Scripting Vulnerability
36. Samba Send_MailSlot Stack-Based Buffer Overflow Vulnerability
37. Linux Kernel IEEE80211 HDRLen Remote Denial Of Service Vulnera=
bility
38. Drupal TAXONOMY_SELECT_NODES() SQL Injection Vulnerability
39. Linux Kernel SysFS_ReadDir NULL Pointer Dereference Vulnerabil=
ity
40. Linux Kernel wait_task_stopped Local Denial of Service Vulnera=
bility
41. Mozilla Firefox and SeaMonkey Windows.Location Property HTTP R=
eferer Header Spoofing Weakness
42. Trolltech Qt ToUnicode Function Off By One Buffer Overflow Vul=
nerability
43. Nagios Unspecified Cross-Site Scripting Vulnerability
44. p3mbo Content Injector Index.PHP Id Parameter SQL Injection Vu=
lnerability
45. Firebird Process_Packet Remote Buffer Overflow Vulnerability
46. SH-News Comments.PHP SQL Injection Vulnerability
47. Mozilla Firefox Jar URI Cross-Site Scripting Vulnerability
48. OpenOffice HSQLDB Database Engine Unspecified Java Code Execut=
ion Vulnerability
49. Linux Kernel TCP_Input.C Remote Denial of Service Vulnerabilit=
y
50. Ruby-GNOME2 Gtk::MessageDialog.new Function Format String Vuln=
erability
51. Lookup Insecure Temporary File Creation Vulnerability
52. Novell NetMail and M+NetMail Antivirus Agent Multiple Heap Buf=
fer Overflow Vulnerabilities
53. Mozilla Products Multiple Remote Vulnerabilities
54. Xpdf Multiple Remote Stream.CC Vulnerabilities
55. X.Org X Font Server Multiple Memory Corruption Vulnerabilities
56. Eggdrop Server Module Message Handling Remote Buffer Overflow =
Vulnerability
57. Borland InterBase Multiple Remote Buffer Overflow Vulnerabilit=
ies
58. ACE Image Hosting Script Albums.PHP SQL Injection Vulnerabilit=
y
59. PEAR::MDB2 BLOB Field Information Disclosure Vulnerability
60. Cisco 7940 SIP Phone INVITE Message Remote Denial of Service V=
ulnerability
61. PolDoc Document Management System Download_File.PHP Directory =
Traversal Vulnerability
62. MySQL Access Validation and Denial of Service Vulnerabilities
63. MySQL Server RENAME TABLE System Table Overwrite Vulnerability
64. MySQL Server InnoDB CONVERT_SEARCH_MODE_TO_INNOBASE Function D=
enial Of Service Vulnerability
65. Winamp MP4 File Parsing Buffer Overflow Vulnerability
66. Ext2 Filesystem Utilities e2fsprogs libext2fs Multiple Unspeci=
fied Integer Overflow Vulnerabilities
67. Simple HTTPD Aux Remote Denial of Service Vulnerability
68. Microsoft Internet Explorer DHTML Object Memory Corruption Vul=
nerability
69. Easy File Sharing Web Server Directory Traversal and Multiple =
Information Disclosure Vulnerabilities
70. Apache Tomcat JSP Example Web Applications Cross Site Scriptin=
g Vulnerability
71. Apache Tomcat Host Manager Servlet Cross Site Scripting Vulner=
ability
72. Apache Tomcat Multiple Remote Information Disclosure Vulnerabi=
lities
73. Apache Tomcat Manager and Host Manager Upload Script Cross-Sit=
e Scripting Vulnerability
74. Apache HTTP Server Tomcat Directory Traversal Vulnerability
75. Apache Tomcat WebDav Remote Information Disclosure Vulnerabili=
ty
76. netkit-ftp getreply() Uninitialized Output Stream Memory Corru=
ption Vulnerability
77. IBM Hardware Management Console Unspecified Privilege Escalati=
on Vulnerability
78. netkit-ftpd dataconn() Uninitialized File Stream Memory Corrup=
tion Vulnerability
79. Cairo PNG Image Processing Remote Integer Overflow Vulnerabili=
ty
80. TCExam Multiple Unspecified SQL Injection Vulnerabilities
81. WordPress Edit-Post-Rows.PHP Cross-Site Scripting Vulnerabilit=
y
82. Websense Reporting Tools Login Page Cross-Site Scripting Vulne=
rability
83. Squid Proxy Cache Update Reply Processing Remote Denial of Ser=
vice Vulnerability
84. 3ivx MPEG-4 Multiple Remote Stack Based Buffer Overflow Vulner=
abilities
85. PCRE Regular Expression Library Multiple Integer and Buffer Ov=
erflow Vulnerabilities
86. Python ImageOP Module Multiple Integer Overflow Vulnerabilitie=
s
87. Python PyLocale_strxfrm Function Remote Information Leak Vulne=
rability
88. RETIRED: Media Player Classic Unspecified Remote Stack Buffer =
Overflow Vulnerability
89. SyndeoCMS MAIN.INC.PHP Remote File Include Vulnerability
90. Joomla! Index.PHP Multiple SQL Injection Vulnerabilities
91. Apache::AuthCAS Cookie SQL Injection Vulnerability
92. WebDoc Multiple SQL Injection Vulnerabilities
93. Firefly Media Server Multiple Information Disclosure and Denia=
l of Service Vulnerabilities
94. SHTTPD Multiple File Access And Directory Traversal Vulnerabil=
ities
95. NFSv4 ID Mapper nfsidmap Username Lookup Local Privilege Escal=
ation Vulnerability
96. Monalbum Multiple Remote Vulnerabilities
97. Thomson Speedtouch 716 URL Parameter Cross-Site Scripting Vuln=
erability
98. PHP-Nuke autohtml.php Local File Include Vulnerability
99. BarracudaDrive Web Server Denial of Service and Multiple Input=
Validation Vulnerabilities
100. BadBlue Directory Traversal and Buffer Overflow Vulnerability
III. SECURITYFOCUS NEWS
1. Researchers reverse Netflix anonymization
2. Group drafts rules to nix credit-card storage=20
3. Task force aims to improve U.S. cybersecurity
4. Court filings double estimate of TJX breach
IV. SECURITY JOBS LIST SUMMARY
V. INCIDENTS LIST SUMMARY
1. FW: Anyone have a reason for 2x the email flow today?
2. HITBSecConf2007 Malaysia Videos Now Available
3. Anyone have a reason for 2x the email flow today?
VI. VULN-DEV RESEARCH LIST SUMMARY
1. HITBSecConf2007 Malaysia Videos Now Available
2. SEH and overwrite EIP
VII. MICROSOFT FOCUS LIST SUMMARY
1. SecurityFocus Microsoft Newsletter #371
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1.Copyrights and Wrongs
By Mark Rasch
On October 1, 2007, Jammie Thomas -- a single mother living in Brainerd, =
Minnesota -- was sued in civil court for copyright infringement by the Re=
cording Industry Association of America. Three days later, the jury retur=
ned the verdict; Ms. Thomas was liable for willfully infringing the copyr=
ights on 24 songs. The fine: $222,000.=20
http://www.securityfocus.com/columnists/460
2.The Man in the Machine
By Federico Biancuzzi
In April 2007, when two security researchers demonstrated a flaw in the n=
ext-generation IPv6 routing scheme that would allow attackers to signific=
antly amplify any denial-of-service attack by a factor of at least 80, ne=
tworking expert Jun-ichiro "Itojun" Hagino worked to get Internet enginee=
rs to take the threat seriously.=20
http://www.securityfocus.com/columnists/459
II. BUGTRAQ SUMMARY
--------------------
1. Valve Software Half-Life CSTRIKE Server Remote Denial of Service Vulne=
rability
BugTraq ID: 16619
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/16619
Summary:
Valve Software Half-Life CSTRIKE Dedicated Server is reportedly prone to =
a remote denial-of-service vulnerability.
Half-Life CSTRIKE 1.6 Dedicated Server for Windows and Linux are prone to=
this vulnerability. Earlier versions may also be affected.
2. Mozilla Firefox Multiple Remote Unspecified Memory Corruption Vulnerab=
ilities
BugTraq ID: 26593
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26593
Summary:
The Mozilla Foundation has released a security advisory disclosing three =
unspecified memory-corruption vulnerabilities.
Successfully exploiting these issues may allow attackers to execute code,=
facilitating the compromise of affected computers. Failed exploit attemp=
ts will likely crash the application.
Versions prior to Mozilla Firefox 2.0.0.10 and Mozilla SeaMonkey 1.1.7 ar=
e vulnerable to these issues.
3. DOSBox Unauthorized File System Access Vulnerability
BugTraq ID: 26802
Remote: No
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26802
Summary:
DOSBox is prone to a vulnerability that may allow a client application to=
access files on the host operating system.
The application does not properly restrict access to specific commands th=
at may allow a client application to access arbitrary files on the host c=
omputer.
This issue affects DOSBox 0.72 and earlier. The CVS repository, at the ti=
me of this writing, is also reported vulnerable.
4. Bitweaver 2.0.0 and Prior Multiple Input Validation Vulnerabilities
BugTraq ID: 26801
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26801
Summary:
Bitweaver is prone to multiple input-validation vulnerabilities because t=
he application fails to sufficiently sanitize user-supplied input includi=
ng multiple cross-site scripting vulnerabilities, multiple HTML-injection=
vulnerabilities and an SQL-injection vulnerability.
A successful exploit of these vulnerabilities could allow an attacker to =
compromise the application, access or modify data, steal cookie-based aut=
hentication credentials, or exploit vulnerabilities in the underlying dat=
abase implementation. Other attacks are also possible.
Bitweaver 2.0.0 and prior are vulnerable to these issues.
5. RoundCube Webmail CSS Expression Input Validation Vulnerability
BugTraq ID: 26800
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26800
Summary:
RoundCube Webmail is prone to an input-validation vulnerability because =
it fails to sanitize HTML email messages.
=20
Attackers can exploit this issue to execute arbitrary script code in the =
browser of an unsuspecting user. Successful attacks can allow attackers t=
o steal cookie-based authentication credentials from legitimate users of =
the site; other attacks are also possible.
=20
RoundCube Webmail 0.1rc2 is vulnerable; other versions may also be affe=
cted.
6. GESTDOWN Multiple SQL Injection Vulnerabilities
BugTraq ID: 26799
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26799
Summary:
GESTDOWN is prone to multiple SQL-injection vulnerabilities because it fa=
ils to sufficiently sanitize user-supplied data before using it in an SQL=
query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
GESTDOWN 1.00 Beta is vulnerable; other versions may also be affected.
7. Falcon Series One Multiple Input Validation Vulnerabilities
BugTraq ID: 26798
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26798
Summary:
Falcon Series One is prone to multiple input-validation vulnerabilities b=
ecause it fails to properly sanitize user-supplied input.
These issues include a remote file-include vulnerability and multiple HTM=
L-injection vulnerabilities.
Exploiting these issues can allow attacker-supplied HTML or script code t=
o run in the context of the affected site, potentially allowing the attac=
ker to steal cookie-based authentication credentials and to control how t=
he site is rendered to the user; other attacks are also possible.=20
Falcon Series One 1.4.3 stable is vulnerable; other versions may also be =
affected.
8. E-Xoops Multiple SQL Injection Vulnerabilities
BugTraq ID: 26796
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26796
Summary:
E-Xoops is prone to multiple SQL-injection vulnerabilities because it fai=
ls to sufficiently sanitize user-supplied data before using it in an SQL =
query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
9. WordPress wp-db.php Character Set SQL Injection Vulnerability
BugTraq ID: 26795
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26795
Summary:
WordPress is prone to an SQL-injection vulnerability because it fails to =
sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database implementation.
10. bttlxe Forum Multiple SQL Injection and Cross-Site Scripting Vulnerab=
ilities
BugTraq ID: 26790
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26790
Summary:
bttlxe Forum is prone to multiple input-validation vulnerabilities, inclu=
ding SQL-injection issues and a cross-site scripting issue, because it fa=
ils to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based aut=
hentication credentials, compromise the application, access or modify dat=
a, or exploit latent vulnerabilities in the underlying database.
These issues affect bttlxe Forum 2.0; other versions may also be affected=
.
11. SquirrelMail G/PGP Encryption Plugin Access Validation And Input Vali=
dation Vulnerabilities
BugTraq ID: 26788
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26788
Summary:
The G/PGP encryption plugin for SquirrelMail is prone to an input-validat=
ion vulnerability and an access-validation vulnerability.
Attackers can exploit these issues to inject arbitrary script code into p=
ublic key data or to delete and overwrite arbitrary files with the privil=
eges of the application.
SquirrelMail G/PGP Encryption Plugin versions 2.0, 2.0.1, and 2.1 are vul=
nerable; other versions may also be affected.
NOTE: One or more of these issues may already have been documented in the=
following BIDs, but sufficient information is not currently available to=
distinguish between them:
- 24782, SquirrelMail G/PGP Encryption Plug-in Unspecified Remote Command=
Execution Vulnerability
- 24828, SquirrelMail G/PGP Encryption Plug-in Multiple Unspecified Remot=
e Command Execution Vulnerabilities
- 24874, SquirrelMail G/PGP Encryption Plug-in Multiple Remote Command Ex=
ecution
Vulnerabilities
12. webSPELL Usergallery.PHP and Calendar.PHP Multiple Cross-Site Scripti=
ng Vulnerabilities
BugTraq ID: 26787
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26787
Summary:
webSPELL is prone to multiple cross-site scripting vulnerabilities becaus=
e it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
webSPELL 4.01.02 is affected; other versions may also be vulnerable.
13. HFS HTTP File Server Arbitrary File Upload Vulnerability
BugTraq ID: 26732
Remote: Yes
Last Updated: 2007-12-08
Relevant URL: http://www.securityfocus.com/bid/26732
Summary:
HFS HTTP File Server is prone to a vulnerability that lets attackers uplo=
ad files and place them in arbitrary locations on the server. The issue o=
ccurs because the software fails to adequately sanitize user-supplied inp=
ut.=20
A successful exploit may allow the attacker to upload malicious files and=
potentially execute them; this may lead to various attacks.
This issue affects versions prior to HTTP File Server 2.2b.
14. Autonomy KeyView Lotus 1-2-3 File Multiple Buffer Overflow Vulnerabil=
ities
BugTraq ID: 26604
Remote: Yes
Last Updated: 2007-12-08
Relevant URL: http://www.securityfocus.com/bid/26604
Summary:
Autonomy KeyView is prone to multiple buffer-overflow vulnerabilities.=20
Successfully exploiting these issues could allow an attacker to execute a=
rbitrary code in the context of the user running the application. =20
Multiple applications incorporate the vulnerable KeyView component, so th=
ey are also considered vulnerable to these issues.
NOTE: These issues are similar to those described in BID 26175 (Autonomy =
KeyView Multiple Buffer Overflow Vulnerabilities) but affect a different =
component.
15. SiteBar Multiple Input Validation Vulnerabilities
BugTraq ID: 26126
Remote: Yes
Last Updated: 2007-12-08
Relevant URL: http://www.securityfocus.com/bid/26126
Summary:
SiteBar is prone to multiple input-validation vulnerabilities because it =
fails to properly sanitize user-supplied input.
These issues include:
- A local file-include vulnerability
- Multiple arbitrary-script-code-execution vulnerabilities
- Multiple cross-site scripting vulnerabilities
- A URI-redirection vulnerability.
Exploiting these issues can allow attackers to access potentially sensiti=
ve information, to execute arbitrary script code in the context of the we=
bserver process, to steal cookie-based authentication credentials, and to=
redirect users to malicious webpages.
SiteBar 3.3.8 and prior versions are vulnerable.
16. S9Y Serendipity Remote RSS sidebar Plugin Cross Site Scripting Vulner=
ability
BugTraq ID: 26783
Remote: Yes
Last Updated: 2007-12-08
Relevant URL: http://www.securityfocus.com/bid/26783
Summary:
S9Y Serendipity Remote RSS sidebar plugin is prone to a cross-site script=
ing vulnerability because it fails to sufficiently sanitize user-supplied=
data.
Exploiting this issue allows an attacker to execute arbitrary HTML or scr=
ipt code in a user's browser session in the context of an affected site. =
This may allow the attacker to steal cookie-based authentication credenti=
als and launch other attacks.
This issue affects S9Y Serendipity versions prior to 1.2.1.
17. Heimdal FTPD gss_userok() Free Uninitialized Pointer Memory Corruptio=
n Vulnerability
BugTraq ID: 26758
Remote: Yes
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/26758
Summary:
Heimdal is prone to a memory-corruption vulnerability because it performs=
a 'free()' call on an uninitialized pointer.
This issue affects the application's FTP daemon.
The implications of this issue are currently unknown. Arbitrary code exec=
ution or denial-of-service attacks may be possible. We will update this B=
ID as more information emerges.
Heimdal 0.7.2 and prior versions are vulnerable.
18. wwwstats Clickstats.PHP Multiple HTML Injection Vulnerabilities
BugTraq ID: 26759
Remote: Yes
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/26759
Summary:
The 'wwwstats' program is prone to multiple HTML-injection vulnerabilitie=
s because it fails to sufficiently sanitize user-supplied input data.
Exploiting these issues may allow an attacker to execute HTML and script =
code in the context of the affected site, to steal cookie-based authentic=
ation credentials, or to control how the site is rendered to the user; ot=
her attacks are also possible.
Versions prior to wwwstats 3.22 are vulnerable.
19. Computer Associates BrightStor ARCserve Backup mediasvr caloggerd Den=
ial Of Service Vulnerabilities
BugTraq ID: 24017
Remote: Yes
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/24017
Summary:
Computer Associates BrightStor ARCserve Backup is prone to multiple denia=
l-of-service vulnerabilities due to memory-corruption issues caused by er=
rors in processing arguments passed to RPC procedures.
A remote attacker may exploit these issues to crash the affected services=
, resulting in denial-of-service conditions.
The following applications are affected:
=20
BrightStor ARCserve Backup v9.01, r11.1, r11.5, r11 for Windows
BrightStor Enterprise Backup r10.5
CA Server Protection Suite r2,=20
CA Business Protection Suite r2
CA Business Protection Suite for Microsoft Small Business Server Standar=
d Edition r2
CA Business Protection Suite for Microsoft Small Business Server Premium=
Edition r2
20. XIGLA SOFTWARE Absolute Banner Manager .NET SQL Injection Vulnerabili=
ty
BugTraq ID: 26754
Remote: Yes
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/26754
Summary:
Absolute Banner Manager .NET is prone to an SQL-injection vulnerability b=
ecause it fails to sufficiently sanitize user-supplied data before using =
it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Absolute Banner Manager .NET 4.0 is reported vulnerable; other versions m=
ay be affected as well.
21. PenPal Multiple SQL Injection Vulnerabilities
BugTraq ID: 26755
Remote: Yes
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/26755
Summary:
PenPal is prone to multiple SQL-injection vulnerabilities because it fail=
s to sufficiently sanitize user-supplied data before using it in an SQL q=
uery.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
These issues affect PenPal 2.0; other versions may also be vulnerable.
22. Computer Associates BrightStor ARCserve Backup Multiple Remote Vulner=
abilities
BugTraq ID: 26015
Remote: Yes
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/26015
Summary:
Computer Associates BrightStor ARCserve is prone to multiple remote vulne=
rabilities, including buffer-overflow issues, memory-corruption issues, a=
nd privilege-escalation issues.
Successful exploits allow remote attackers to cause denial-of-service con=
ditions, execute arbitrary machine code in the context of the affected ap=
plication, or perform actions with elevated privileges. This may result i=
n a complete compromise of affected computers.
The following applications are affected:
=20
BrightStor ARCserve Backup v9.01, r11.1, r11.5, r11 for Windows
BrightStor Enterprise Backup r10.5
CA Server Protection Suite r2,=20
CA Business Protection Suite r2
CA Business Protection Suite for Microsoft Small Business Server Standar=
d Edition r2
CA Business Protection Suite for Microsoft Small Business Server Premium=
Edition r2
23. SING Log Option Local Privilege Escalation Vulnerability
BugTraq ID: 26679
Remote: No
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/26679
Summary:
SING is prone to a local privilege-escalation vulnerability.
Exploiting this issue may allow local attackers to gain elevated privileg=
es, facilitating the complete compromise of affected computers.
SING 1.1 is vulnerable to this issue; other versions may also be affected=
.
24. Lxlabs HyperVM Cross-Site Scripting Vulnerability
BugTraq ID: 26751
Remote: Yes
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/26751
Summary:
HyperVM is prone to a cross-site scripting vulnerability because the appl=
ication fails to properly sanitize user-supplied input.=20
=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user. This may help the attacker steal cook=
ie-based authentication credentials and launch other attacks.
This issue affects HyperVM 2.0.
25. CA BrightStor ARCserve Backup Memory Corruption Remote Code Execution=
Vulnerabilities
BugTraq ID: 24680
Remote: Yes
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/24680
Summary:
Computer Associates BrightStor ARCserve Backup is prone to remote code-ex=
ecution vulnerabilities due to memory-corruption issues.
Successfully exploiting these issues would allow an attacker to corrupt m=
emory and execute arbitrary code in the context of the affected applicati=
on. This in turn may result in a complete compromise of affected computer=
s.
The following applications are affected:
BrightStor ARCserve Backup v9.01, r11.1, r11.5, r11 for Windows
BrightStor Enterprise Backup r10.5
CA Server Protection Suite r2,=20
CA Business Protection Suite r2
CA Business Protection Suite for Microsoft Small Business Server Standard=
Edition r2
CA Business Protection Suite for Microsoft Small Business Server Premium =
Edition r2
26. phpBB .PNG and .RAR Multiple Arbitrary File Upload Vulnerabilities
BugTraq ID: 26740
Remote: Yes
Last Updated: 2007-12-07
Relevant URL: http://www.securityfocus.com/bid/26740
Summary:
phpBB is prone to multiple vulnerabilities that allow attackers to upload=
arbitrary files because it fails to properly verify the content of attac=
hments posted to web-log entries.
Exploiting these issues may allow an attacker to upload arbitrary code an=
d execute it in the context of the webserver process.
phpBB 2.0.22 is vulnerable; other versions may also be affected.
UPDATE (December 7, 2007): The vendor refutes these issues, indicating t=
hat files cannot be uploaded to posts.
27. ZABBIX daemon_start Local Privilege Escalation Vulnerability
BugTraq ID: 26680
Remote: No
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26680
Summary:
ZABBIX is prone to a local privilege-escalation vulnerability.=20
An attacker can exploit this issue to execute commands with superuser pri=
vileges. Successfully exploiting this issue will result in the complete c=
ompromise of affected computers.
This issue affects ZABBIX 1.4.2; prior versions may also be affected.
28. GNU Emacs Local Variable Handling Code Execution Vulnerability
BugTraq ID: 26327
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26327
Summary:
Emacs is prone to a vulnerability that lets attackers execute arbitrary c=
ode.
Due to a design error, the application ignores certain security settings =
and modifies local variables.
=20
By supplying a malicious file, an attacker can exploit this issue to carr=
y out various attacks, including executing arbitrary code in the context =
of the application. This may facilitate remote unauthorized access.
=20
This issue affects Emacs 22.1; other versions may be vulnerable as well.
29. Dominion Web DWdirectory Search Parameter SQL Injection Vulnerability
BugTraq ID: 26779
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26779
Summary:
Dominion Web DWdirectory is prone to an SQL-injection vulnerability becau=
se it fails to sufficiently sanitize user-supplied data before using it i=
n an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects DWdirectory 2.1 and prior versions.
30. Trolltech Qt QTextEdit Multiple Format String Vulnerabilities
BugTraq ID: 25154
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/25154
Summary:
Trolltech Qt is prone to multiple format-string vulnerabilities because i=
t fails to securely display error messages.
Exploiting these issues can allow remote attackers to execute arbitrary c=
ode in the context of the application using the framework or to cause den=
ial-of-service conditions.
These issues affect only Qt 3; other versions of Qt are not affected. Not=
e that KDE and other applications that use the affected framework are inh=
erently affected.
31. Falt4 CMS Multiple Input Validation Vulnerabilities
BugTraq ID: 26786
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26786
Summary:
Falt4 Extreme CMS is prone to three input-validation vulnerabilities, inc=
luding cross-site scripting and SQL-injection issues, that occur because =
the application fails to adequately sanitize user-supplied input.
A successful exploit may allow an attacker to steal cookie-based authenti=
cation credentials, compromise the application, access or modify data, or=
exploit latent vulnerabilities in the underlying database.
This issue was reported to affect Falt4 Extreme (RC4). Other versions may=
also be affected.
32. Flat PHP Board Multiple Remote Vulnerabilities
BugTraq ID: 26782
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26782
Summary:
Flat PHP Board is prone to multiple remote vulnerabilities, including rem=
ote arbitrary-code-execution, file-include, security-bypass, and informat=
ion-disclosure issues.
Exploiting these issues may allow an attacker to compromise the applicati=
on and a webserver hosting the vulnerable software; other attacks are als=
o possible.
These issues affect Flat PHP Board 1.2 and prior versions.
33. SquirrelMail G/PGP Encryption Plug-in Multiple Remote Command Executi=
on Vulnerabilities
BugTraq ID: 24874
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/24874
Summary:
Vulnerabilities in the SquirrelMail G/PGP encryption plugin may allow att=
ackers to execute shell commands and PHP script code. These issues occur =
because the application fails to sufficiently sanitize user-supplied data=
.
Commands and scripts would run in the context of the webserver hosting th=
e vulnerable software.
Three separate shell command-injection vulnerabilities and one local file=
-include vulnerability are present in various versions of the affected pl=
ugin. One of these issues has been addressed in G/PGP Encryption 2.1, but=
the others are still unfixed.
One or more of these issues may already have been documented in the follo=
wing BIDs, but sufficient information is not currently available to disti=
nguish between them:
- 24782, SquirrelMail G/PGP Encryption Plug-in Unspecified Remote Command=
Execution Vulnerability
- 24828, SquirrelMail G/PGP Encryption Plug-in Multiple Unspecified Remot=
e Command Execution Vulnerabilities
All affected BIDs will be updated when more information is released.
34. ActiveKB Index.PHP SQL Injection Vulnerability
BugTraq ID: 25820
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/25820
Summary:
ActiveKB is prone to an SQL-injection vulnerability because it fails to s=
ufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
UPDATE December 11, 2007: The vendor refutes thi=
s issue stating they are unable to replicate the vulnerability.
35. ActiveKB NX Index.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 26027
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26027
Summary:
ActiveKB NX is prone to a cross-site scripting vulnerability because it f=
ails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal potentially sensitive information and lau=
nch other attacks.
This issue affects ActiveKB NX 2.6; other versions may also be vulnerable=
.
36. Samba Send_MailSlot Stack-Based Buffer Overflow Vulnerability
BugTraq ID: 26791
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26791
Summary:
Samba is prone to a remote stack-based buffer-overflow vulnerability beca=
use it fails to properly bounds-check user-supplied data before copying i=
t to an insufficiently sized memory buffer.
NOTE: This issue occurs only when the 'domain logons' option is enabled.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges. Successful attacks will completely compromise affected com=
puters. Failed exploit attempts will result in a denial of service.
37. Linux Kernel IEEE80211 HDRLen Remote Denial Of Service Vulnerability
BugTraq ID: 26337
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26337
Summary:
The Linux kernel ieee80211 driver is prone to a remote denial-of-service =
vulnerability because it fails to perform adequate boundary checks on use=
r-supplied data.
An attacker can exploit this issue to crash a victim computer, effectivel=
y denying service.
Versions prior to Linux kernel 2.6.22.11 are vulnerable.
38. Drupal TAXONOMY_SELECT_NODES() SQL Injection Vulnerability
BugTraq ID: 26735
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26735
Summary:
Drupal is prone to an SQL-injection vulnerability because it fails to suf=
ficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Versions prior to Drupal 4.7.9 and 5.4 are vulnerable.
39. Linux Kernel SysFS_ReadDir NULL Pointer Dereference Vulnerability
BugTraq ID: 24631
Remote: No
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/24631
Summary:
The Linux kernel is prone to a NULL-pointer dereference vulnerability.
A local attacker can exploit this issue to crash the affected kernel, den=
ying service to legitimate users.=20
UPDATE (June 26, 2007): Given the nature of this issue, remote code execu=
tion may also be possible but has not been confirmed.
40. Linux Kernel wait_task_stopped Local Denial of Service Vulnerability
BugTraq ID: 26477
Remote: No
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26477
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability beca=
use it fails to properly handle certain process-exit conditions.
Attackers can exploit this issue to trigger kernel crashes, denying servi=
ce to legitimate users.
Linux kernel versions prior to 2.6.23.8 as well as 2.6.24-rc1 and 2.6.24=
-rc1 are vulnerable.
41. Mozilla Firefox and SeaMonkey Windows.Location Property HTTP Referer =
Header Spoofing Weakness
BugTraq ID: 26589
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26589
Summary:
Mozilla Firefox and SeaMonkey are prone to a weakness that allows an atta=
cker to spoof HTTP Referer headers. This issue stems from a race conditio=
n in the affected application. The weakness arises because of a small tim=
ing difference when using a modal 'alert()' dialog, which allows users to=
generate fake HTTP Referer headers.
An attacker can exploit this issue to spoof HTTP referer headers. This ma=
y cause other security mechanisms that rely on this data to fail or to re=
turn misleading information.
This issue affects versions prior to Mozilla FireFox 2.0.0.10 and Mozill=
a SeaMonkey 1.1.7.
42. Trolltech Qt ToUnicode Function Off By One Buffer Overflow Vulnerabil=
ity
BugTraq ID: 25657
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/25657
Summary:
Qt is prone to a buffer-overflow vulnerability because the framework fail=
s to perform adequate boundary checks on user-supplied data.=20
An attacker can exploit this issue to execute arbitrary code within the c=
ontext of applications that use the affected framework. Failed exploit at=
tempts will result in a denial-of-service condition.
43. Nagios Unspecified Cross-Site Scripting Vulnerability
BugTraq ID: 26152
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26152
Summary:
Nagios is prone to an unspecified cross-site scripting vulnerability beca=
use it fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.
Versions prior to Nagios 2.10 are vulnerable.
44. p3mbo Content Injector Index.PHP Id Parameter SQL Injection Vulnerabi=
lity
BugTraq ID: 26781
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26781
Summary:
p3mbo Content Injector is prone to an SQL-injection vulnerability because=
it fails to sufficiently sanitize user-supplied data before using it in =
an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects Content Injector 1.53; other versions may also be vuln=
erable.
45. Firebird Process_Packet Remote Buffer Overflow Vulnerability
BugTraq ID: 26011
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26011
Summary:
Firebird is prone to a remote stack-based buffer-overflow vulnerability.=20
=20
An attacker can exploit this issue to execute arbitrary machine code in t=
he context of the affected database server. Failed exploit attempts will =
likely crash the server, denying service to legitimate users. =20
Firebird 2.0.2 is vulnerable; previous versions may also be affected.
46. SH-News Comments.PHP SQL Injection Vulnerability
BugTraq ID: 26778
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26778
Summary:
SH-News is prone to an SQL-injection vulnerability because it fails to su=
fficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects SH-News 3.0; other versions may also be vulnerable.
47. Mozilla Firefox Jar URI Cross-Site Scripting Vulnerability
BugTraq ID: 26385
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26385
Summary:
Mozilla Firefox is prone to a cross-site scripting vulnerability because =
the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue to steal cookie-based authentication c=
redentials and other sensitive data that may aid in further attacks.
48. OpenOffice HSQLDB Database Engine Unspecified Java Code Execution Vul=
nerability
BugTraq ID: 26703
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26703
Summary:
OpenOffice is prone to a code-execution vulnerability.
Successful exploits allow remote attackers to execute arbitrary Java code=
in the context of the vulnerable application.
Versions prior to OpenOffice 2.3.1 are vulnerable.
49. Linux Kernel TCP_Input.C Remote Denial of Service Vulnerability
BugTraq ID: 26474
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26474
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability bec=
ause it fails to adequately sanitize specially crafted ACK responses.
Attackers can exploit this issue to cause a NULL-pointer dereference and =
crash the kernel.
Linux kernel versions prior to 2.6.23.8 as well as 2.6.24-rc1 and 2.6.24=
-rc1 are vulnerable.
50. Ruby-GNOME2 Gtk::MessageDialog.new Function Format String Vulnerabili=
ty
BugTraq ID: 26616
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26616
Summary:
The Ruby-GNOME2 library is prone to a format-string vulnerability because=
it fails to properly sanitize user-supplied input before passing it as t=
he format specifier to a formatted-printing function.
An attacker can exploit this issue to execute arbitrary machine code in t=
he context of an application using the affected library. A successful att=
ack will compromise the application. Failed attempts may cause denial-of-=
service conditions.
=20
This issue affects Ruby-GNOME2 0.16.0; other version may be also vulnera=
ble.
51. Lookup Insecure Temporary File Creation Vulnerability
BugTraq ID: 23026
Remote: No
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/23026
Summary:
Lookup creates temporary files in an insecure manner.=20
An attacker with local access could potentially exploit this issue to per=
form symlink attacks, overwriting arbitrary files in the context of the a=
ffected application.=20
Successfully exploiting a symlink attack may allow the attacker to overwr=
ite or corrupt sensitive files. This may result in a denial of service; o=
ther attacks may also be possible.
Lookup version 1.4 is vulnerable to this issue; other versions may also b=
e affected.
52. Novell NetMail and M+NetMail Antivirus Agent Multiple Heap Buffer Ove=
rflow Vulnerabilities
BugTraq ID: 26753
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26753
Summary:
Novell NetMail and M+NetMail are prone to multiple heap-based buffer-over=
flow vulnerabilities. These issues occur because the applications fail to=
perform adequate boundary checks on user-supplied data.
A successful exploit will allow remote attackers to execute arbitrary cod=
e in the context of the affected software. Failed exploit attempts may re=
sult in denial-of-service conditions.
53. Mozilla Products Multiple Remote Vulnerabilities
BugTraq ID: 24242
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/24242
Summary:
The Mozilla Foundation has released six security advisories specifying vu=
lnerabilities in Firefox, SeaMonkey, and Thunderbird.
These vulnerabilities allow attackers to:
- Execute arbitrary code
- Cause denial-of-service conditions
- Perform cross-site scripting attacks
- Obtain potentially sensitive information
- Spoof legitimate content
Other attacks may also be possible.
54. Xpdf Multiple Remote Stream.CC Vulnerabilities
BugTraq ID: 26367
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26367
Summary:
Xpdf is prone to multiple remote vulnerabilities because of flaws in vari=
ous functions in the 'Stream.cc' source file.
Attackers exploit these issues by coercing users to view specially crafte=
d PDF files with the affected application.
Successfully exploiting these issues allows attackers to execute arbitrar=
y machine code in the context of the vulnerable application. This facilit=
ates the remote compromise of affected computers.
Xpdf 3.02pl1 is vulnerable to these issues; other versions may also be af=
fected.
55. X.Org X Font Server Multiple Memory Corruption Vulnerabilities
BugTraq ID: 25898
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/25898
Summary:
X.Org X Font Server (XFS) is prone to multiple memory-corruption vulnerab=
ilities, including an integer-overflow issue and a heap-based memory-corr=
uption issue.=20
An attacker could exploit this issue to execute arbitrary code with the p=
rivileges of the X Font Server. Failed exploit attempts will likely resul=
t in a denial-of-service condition.=20
NOTE: These issues are exploitable remotely only on Solaris operating sys=
tems; by default the server is listening on TCP port 7100. For other UNIX=
-like operating systems, an attacker can exploit these issues only locall=
y.
These issues affect X Font Server 1.0.4; prior versions may also be affec=
ted.
56. Eggdrop Server Module Message Handling Remote Buffer Overflow Vulnera=
bility
BugTraq ID: 24070
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/24070
Summary:
Eggdrop Server Module is prone to a remote buffer-overflow vulnerability =
because the application fails to bounds-check user-supplied data before c=
opying it into an insufficiently sized buffer.=20
An attacker can exploit this issue to execute arbitrary code within the c=
ontext of the affected application. Failed exploit attempts will result i=
n a denial-of-service condition.
=20
Eggdrop 1.6.18 is known to be vulnerable; other versions may be affected =
as well.
57. Borland InterBase Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 25917
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/25917
Summary:
Borland InterBase is prone to multiple remote buffer-overflow vulnerabili=
ties because the application fails to bounds-check user-supplied input be=
fore copying it into an insufficiently sized memory buffer.
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary machine code with SYSTEM-Level privileges. This will result in a=
complete compromise of affected computers.
Borland InterBase 2007 for Linux and Windows is considered vulnerable.
58. ACE Image Hosting Script Albums.PHP SQL Injection Vulnerability
BugTraq ID: 26780
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26780
Summary:
ACE Image Hosting Script is prone to an SQL-injection vulnerability becau=
se it fails to sufficiently sanitize user-supplied data before using it i=
n an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
59. PEAR::MDB2 BLOB Field Information Disclosure Vulnerability
BugTraq ID: 26382
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26382
Summary:
PEAR::MDB2 is prone to an information-disclosure vulnerability because th=
e library fails to securely handle URIs in BLOB and CLOB database fields.
Successfully exploiting this issue allows attackers to access potentially=
sensitive information that may aid in further attacks. Because of the un=
known nature of applications that use the affected library, other attacks=
may also be possible.
MDB2 2.5.0a1 is vulnerable to this issue; other versions may also be affe=
cted.
60. Cisco 7940 SIP Phone INVITE Message Remote Denial of Service Vulnerab=
ility
BugTraq ID: 26711
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26711
Summary:
Cisco 7940 SIP phones are prone to a denial-of-service vulnerability beca=
use the device fails to handle specially crafted SIP INVITE messages.=20
Exploiting this issue allows remote attackers to cause the device to fail=
to respond to further call requests and to potentially crash, denying se=
rvice to legitimate users.
This issue affects version P0S3-08-7-00 of Cisco 7940 SIP phones; other =
versions may also be affected.
61. PolDoc Document Management System Download_File.PHP Directory Travers=
al Vulnerability
BugTraq ID: 26775
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26775
Summary:
PolDoc Document Management System is prone to a directory-traversal vulne=
rability because it fails to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to access potentiall=
y sensitive information that could aid in further attacks.
PolDoc Document Management System 0.96 is vulnerable to this issue; other=
versions may also be affected.
62. MySQL Access Validation and Denial of Service Vulnerabilities
BugTraq ID: 25017
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/25017
Summary:
MySQL is prone to a access-validation vulnerability and a denial-of-servi=
ce vulnerability.=20
An attacker can exploit these issues to create arbitrary MySQL tables or =
to crash the affected application, denying service to legitimate users.
This issue affects versions prior to MySQL 5.0.45.
63. MySQL Server RENAME TABLE System Table Overwrite Vulnerability
BugTraq ID: 26765
Remote: No
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26765
Summary:
MySQL is prone to a local denial-of-service vulnerability because the dat=
abase server fails to properly handle unexpected symbolic links.
Exploiting this issue allows attackers with local access to affected comp=
uters to overwrite MySQL system tables. Further attacks against the MySQL=
database and potentially the underlying operating system may be possible=
.
This issue affects versions prior to MySQL 5.0.51.
64. MySQL Server InnoDB CONVERT_SEARCH_MODE_TO_INNOBASE Function Denial O=
f Service Vulnerability
BugTraq ID: 26353
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26353
Summary:
MySQL is prone to a remote denial-of-service vulnerability because the da=
tabase server fails to properly handle unexpected input.
Exploiting this issue allows remote attackers to crash affected database =
servers, denying service to legitimate users. Attackers must be able to e=
xecute arbitrary SQL statements on affected servers, which requires valid=
credentials to connect to affected servers.
This issue affects MySQL 5.1.23 and prior versions.
65. Winamp MP4 File Parsing Buffer Overflow Vulnerability
BugTraq ID: 23723
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/23723
Summary:
Winamp is prone to a buffer-overflow vulnerability when it attempts to pr=
ocess certain files. This issue occurs because the application fails to p=
roperly check boundaries on user-supplied data before copying it to an in=
sufficiently sized memory buffer.
Successful exploits can allow attackers to execute arbitrary code with th=
e privileges of the user running the vulnerable application. Failed explo=
it attempts will likely result in denial-of-service conditions.
This issue affects Winamp 5.02 through 5.34.
UPDATE: The vendor states that this issue will be addressed in Winamp 5.3=
5.
66. Ext2 Filesystem Utilities e2fsprogs libext2fs Multiple Unspecified In=
teger Overflow Vulnerabilities
BugTraq ID: 26772
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26772
Summary:
e2fsprogs is prone to multiple unspecified integer-overflow vulnerabiliti=
es because the application fails to bounds-check user-supplied data befor=
e copying it into an insufficiently sized buffer.
An attacker can exploit these issues to execute arbitrary code within the=
context of the affected application. Failed exploit attempts will result=
in a denial of service.
e2fsprogs versions 1.38 through 1.40.2 are vulnerable; other versions may=
also be affected.
67. Simple HTTPD Aux Remote Denial of Service Vulnerability
BugTraq ID: 26813
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26813
Summary:
Simple HTTPD is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to cause the affected application to c=
rash, effectively denying service to legitimate users.
This issue affects Simple HTTPD 1.3; other versions may also be affected.
68. Microsoft Internet Explorer DHTML Object Memory Corruption Vulnerabil=
ity
BugTraq ID: 26427
Remote: Yes
Last Updated: 2007-12-11
Relevant URL: http://www.securityfocus.com/bid/26427
Summary:
Microsoft Internet Explorer is prone to a remote memory-corruption vulner=
ability because it fails to adequately handle user-supplied input to cert=
ain DHTML object methods.
Attackers can exploit this issue to execute arbitrary code in the context=
of a user running the application. Successful attacks would compromise t=
he application and possibly the underlying computer. Failed attacks will =
cause denial-of-service conditions.
69. Easy File Sharing Web Server Directory Traversal and Multiple Informa=
tion Disclosure Vulnerabilities
BugTraq ID: 26771
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26771
Summary:
Easy File Sharing Web Server is prone to a directory-traversal and multip=
le information-disclosure vulnerabilities.
Successfully exploiting these issues allows remote attackers to upload fi=
les to arbitrary locations and to access potentially sensitive informatio=
n, which may aid in further attacks.
Easy File Sharing Web Server 4.5 is vulnerable to these issues; other ver=
sions may also be affected.
70. Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulne=
rability
BugTraq ID: 24476
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/24476
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because it=
fails to properly sanitize user-supplied input.
Exploiting this vulnerability may allow an attacker to perform cross-site=
scripting attacks on unsuspecting users in the context of the affected w=
ebsite. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.
71. Apache Tomcat Host Manager Servlet Cross Site Scripting Vulnerability
BugTraq ID: 25314
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/25314
Summary:
Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vul=
nerability because the application fails to properly sanitize user-suppli=
ed input. =20
=20
An attacker can exploit this vulnerability to inject HTML and script code=
into the browser of an unsuspecting victim. The attacker may then steal =
cookie-based authentication credentials and launch other attacks.
Apache Tomcat 5.5.0 through 5.5.24 and 6.0.0 through 6.0.13 are affected.
72. Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities
BugTraq ID: 25316
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/25316
Summary:
Apache Tomcat is prone to multiple information-disclosure vulnerabilities=
because it fails to adequately sanitize user-supplied data.
Attackers can exploit these issues to access potentially sensitive data t=
hat may aid in further attacks.
Versions prior to Apache Tomcat 6.0.14 are vulnerable.
73. Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scrip=
ting Vulnerability
BugTraq ID: 24475
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/24475
Summary:
Apache Tomcat Manager and Host Manager are prone to a cross-site scripti=
ng vulnerability because the applications fail to properly sanitize user-=
supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user. This may help the attacker steal cook=
ie-based authentication credentials and launch other attacks.
74. Apache HTTP Server Tomcat Directory Traversal Vulnerability
BugTraq ID: 22960
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/22960
Summary:
Apache HTTP servers running with the Tomcat servlet container are prone t=
o a directory-traversal vulnerability because it fails to sufficiently sa=
nitize user-supplied input data.
Exploiting this issue allows attackers to access arbitrary files in the T=
omcat webroot. This can expose sensitive information that could help the =
attacker launch further attacks.
Versions in the 5.0 series prior to 5.5.22 and in the 6.0 series prior to=
6.0.10 are vulnerable.
75. Apache Tomcat WebDav Remote Information Disclosure Vulnerability
BugTraq ID: 26070
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26070
Summary:
Apache Tomcat is prone to a remote information-disclosure vulnerability
Remote attackers can exploit this issue to obtain the contents of sensiti=
ve files stored on the server.
76. netkit-ftp getreply() Uninitialized Output Stream Memory Corruption V=
ulnerability
BugTraq ID: 26764
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26764
Summary:
The 'netkit-ftp' package is prone to a memory-corruption vulnerability be=
cause it performs an 'fclose()' call on an uninitialized output stream.
Successful attacks will cause denial-of-service conditions. Other attacks=
may also be possible.
This issue affects netkit-ftp 0.17; other versions may also be affected.
77. IBM Hardware Management Console Unspecified Privilege Escalation Vuln=
erability
BugTraq ID: 26769
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26769
Summary:
IBM Hardware Management Console is prone to an unspecified privilege-esca=
lation vulnerability.
Currently, very little is known about this issue. We will update this BID=
as more information emerges.
This issue affects Hardware Management Console Version 3 Release 3.7; oth=
er versions may also be affected.
78. netkit-ftpd dataconn() Uninitialized File Stream Memory Corruption Vu=
lnerability
BugTraq ID: 26763
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26763
Summary:
The 'netkit-ftpd' package is prone to a memory-corruption vulnerability b=
ecause it performs an 'fclose()' call on an uninitialized FILE pointer.
Successful attacks will cause denial-of-service conditions and may allow =
arbitrary code to run, but this has not been confirmed. We will update th=
is BID as more information emerges.
This issue affects 'netkit-ftpd' 0.17; other versions may also be affecte=
d.
79. Cairo PNG Image Processing Remote Integer Overflow Vulnerability
BugTraq ID: 26650
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26650
Summary:
Cairo is prone to an integer-overflow vulnerability because it fails to e=
nsure that integer values aren't overrun. Attackers may exploit this issu=
e to overflow a buffer and to corrupt process memory.
Attackers may be able to execute arbitrary machine code in the context of=
an affected application. Failed exploit attempts will likely result in a=
denial-of-service condition.
This issue affects versions prior to Cairo 1.4.12.
80. TCExam Multiple Unspecified SQL Injection Vulnerabilities
BugTraq ID: 26760
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26760
Summary:
TCExam is prone to multiple SQL-injection vulnerabilities because it fail=
s to sufficiently sanitize user-supplied data before using it in an SQL q=
uery.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
Versions prior to TCExam 5.1.000 are vulnerable.
81. WordPress Edit-Post-Rows.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 26228
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26228
Summary:
WordPress is prone to a cross-site scripting vulnerability because the ap=
plication fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
This issue affects WordPress 2.3; other versions may also be vulnerable.
82. Websense Reporting Tools Login Page Cross-Site Scripting Vulnerabilit=
y
BugTraq ID: 26793
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26793
Summary:
Websense Reporting Tools is prone to a cross-site scripting vulnerability=
because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.
83. Squid Proxy Cache Update Reply Processing Remote Denial of Service Vu=
lnerability
BugTraq ID: 26687
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26687
Summary:
Squid is prone to a remote denial-of-service vulnerability because the pr=
oxy server fails to perform boundary checks before copying user-supplied =
data into process buffers.
Successfully exploiting this issue allows remote attackers to crash the a=
ffected application, denying further service to legitimate users. Attacke=
rs may also be able to execute arbitrary code, but this has not been conf=
irmed.
This issue affects Squid 2.6.STABLE16 and prior versions. All Squid-3 sna=
pshots and prereleases up to the November 28 snapshot are also vulnerable=
.
84. 3ivx MPEG-4 Multiple Remote Stack Based Buffer Overflow Vulnerabiliti=
es
BugTraq ID: 26773
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26773
Summary:
3ivx MPEG-4 is prone to multiple stack-based buffer-overflow issues becau=
se it fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application. Failed exploit attempts =
likely result in denial-of-service conditions.
3ivx MPEG-4 5.0.1 is vulnerable; other versions may also be affected.
NOTE: This BID originally listed Windows Media Player as vulnerable but =
it has been updated to reflect that the issues reside in 3ivx MPEG-4.
85. PCRE Regular Expression Library Multiple Integer and Buffer Overflow =
Vulnerabilities
BugTraq ID: 26462
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26462
Summary:
PCRE regular-expression library is prone to multiple integer- and buffer-=
overflow vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, cause denia=
l-of-service conditions, or launch other attacks in the context of the ap=
plication using the affected library.
86. Python ImageOP Module Multiple Integer Overflow Vulnerabilities
BugTraq ID: 25696
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/25696
Summary:
Python's imageop module is prone to multiple integer-overflow vulnerabili=
ties because it fails to properly bounds-check user-supplied input to ens=
ure that integer operations do not overflow.
To successfully exploit these issues, an attacker must be able to control=
the arguments to imageop functions. Remote attackers may be able to do t=
his, depending on the nature of applications that use the vulnerable func=
tions.
Attackers would likely submit invalid or specially crafted images to appl=
ications that perform imageop operations on the data.
A successful exploit may allow attacker-supplied machine code to run in t=
he context of affected applications, facilitating the remote compromise o=
f computers.
87. Python PyLocale_strxfrm Function Remote Information Leak Vulnerabilit=
y
BugTraq ID: 23887
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/23887
Summary:
Python applications that use the 'PyLocale_strxfrm' function are prone to=
an information leak.
Exploiting this issue allows remote attackers to read portions of memory.=
=20
Python 2.4.4-2 and 2.5 are confirmed vulnerable to this issue.
88. RETIRED: Media Player Classic Unspecified Remote Stack Buffer Overflo=
w Vulnerability
BugTraq ID: 26774
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26774
Summary:
Media Player Classic is prone to a stack-based buffer-overflow issue beca=
use it fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the user running the application. Failed ex=
ploit attempts likely result in denial-of-service conditions.
RETIRED: This BID is being retired. This issue affects 3ivx MPEG-4, Pleas=
e see BID 26773 (3ivx MPEG-4 Multiple Remote Stack Buffer Overflow Vulner=
abilities) for further information.
89. SyndeoCMS MAIN.INC.PHP Remote File Include Vulnerability
BugTraq ID: 26321
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26321
Summary:
SyndeoCMS is prone to a remote file-include vulnerability because it fail=
s to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
SyndeoCMS 2.5.01 is vulnerable; other versions may also be affected.
90. Joomla! Index.PHP Multiple SQL Injection Vulnerabilities
BugTraq ID: 26707
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26707
Summary:
Joomla! is prone to multiple SQL-injection vulnerabilities because it fai=
ls to sufficiently sanitize user-supplied data before using it in an SQL =
query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
Joomla! 1.5 RC3 is vulnerable; other versions may also be affected.
UPDATE (Dec. 10, 2007): The validity of the issues is being disputed on =
the Joomla! Bug Tracker. Please see the references for information. Repor=
ts indicate that the related message was posted by a Joomla! developer bu=
t this has not been confirmed.
91. Apache::AuthCAS Cookie SQL Injection Vulnerability
BugTraq ID: 26762
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26762
Summary:
Apache::AuthCAS is prone to an SQL-injection vulnerability because it fai=
ls to sufficiently sanitize user-supplied data before using it in an SQL =
query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects Apache::AuthCAS 0.4; other versions may also be affect=
ed.
92. WebDoc Multiple SQL Injection Vulnerabilities
BugTraq ID: 26761
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26761
Summary:
WebDoc is prone to multiple SQL-injection vulnerabilities because it fail=
s to sufficiently sanitize user-supplied data before using it in an SQL q=
uery.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
WebDoc 3.0 is vulnerable; other versions may also be affected.
93. Firefly Media Server Multiple Information Disclosure and Denial of Se=
rvice Vulnerabilities
BugTraq ID: 26770
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26770
Summary:
Firefly Media Server is prone to multiple information-disclosure and deni=
al-of-service vulnerabilities because it fails to handle specially crafte=
d HTTP GET requests.
Attackers can exploit these issues to access potentially sensitive inform=
ation, crash the server, or consume excessive resources. Successful explo=
its could aid in further attacks or deny service to legitimate users.
Firefly Media Server 2.4.1 is vulnerable; other versions may also be affe=
cted.
94. SHTTPD Multiple File Access And Directory Traversal Vulnerabilities
BugTraq ID: 26768
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26768
Summary:
SHTTPD is prone to multiple file-access vulnerabilities and a directory-t=
raversal vulnerability.
An attacker can exploit these issues to obtain sensitive information and =
to read arbitrary files on the affected computer with the privileges of t=
he user running the application.
Note that these issues apply only to the Windows implementation of SHTTPD=
.
95. NFSv4 ID Mapper nfsidmap Username Lookup Local Privilege Escalation V=
ulnerability
BugTraq ID: 26767
Remote: No
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26767
Summary:
The 'nfsidmap' utility is prone to a local privilege-escalation vulnerabi=
lity because it fails to adequately handle files that have unknown owners=
.
Attackers can leverage this issue to gain superuser privileges. Successfu=
l exploits will completely compromise affected computers.
Versions prior to 'nfsidmap' 0.17 are vulnerable.
96. Monalbum Multiple Remote Vulnerabilities
BugTraq ID: 26811
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26811
Summary:
Monalbum is prone to multiple remote vulnerabilities including security-b=
ypass and file-include issues.
Exploiting these issues may allow an attacker to compromise the applicati=
on and a webserver hosting the vulnerable software; other attacks are als=
o possible.=20
These issues affect Monalbum 0.8.7; other versions may also be affected.
97. Thomson Speedtouch 716 URL Parameter Cross-Site Scripting Vulnerabili=
ty
BugTraq ID: 26808
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26808
Summary:
Thomson Speedtouch 716 is prone to a cross-site scripting vulnerability b=
ecause the application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
This issue affects Thomson Speedtouch 716 firmwares 6.2.17.50 and 5.4.0.1=
4; other versions may also be affected.
98. PHP-Nuke autohtml.php Local File Include Vulnerability
BugTraq ID: 26807
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26807
Summary:
Dance Music is prone to a local file-include vulnerability because it fai=
ls to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized remote user to view files=
and execute local scripts in the context of the webserver process.
99. BarracudaDrive Web Server Denial of Service and Multiple Input Valida=
tion Vulnerabilities
BugTraq ID: 26805
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26805
Summary:
BarracudaDrive Web Server is prone to a denial-of-service vulnerability a=
nd multiple input-validation vulnerabilities because it fails to sufficie=
ntly sanitize user-supplied input.
Exploiting these issues can allow an attacker to retrieve, view or delete=
arbitrary files, inject hostile HTML or script code in the context of t=
he application running the vulnerable software, or crash the webserver, =
denying service to legitimate users.
100. BadBlue Directory Traversal and Buffer Overflow Vulnerability
BugTraq ID: 26803
Remote: Yes
Last Updated: 2007-12-10
Relevant URL: http://www.securityfocus.com/bid/26803
Summary:
BadBlue is prone to a directory-traversal vulnerability and a buffer-over=
flow vulnerability.=20
An attacker can exploit these issues to upload arbitrary files outside th=
e destination folder (potentially overwrite existing files), execute arbi=
trary code within the context of the affected application or crash the af=
fected application.
BadBlue 2.72b is vulnerable; prior versions may also be affected.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Researchers reverse Netflix anonymization
By: Robert Lemos
Two computer scientists show that a large set of transactional data poses=
privacy risks by finding a way to link movie ratings from the Netflix Pr=
ize dataset to publicly available information.
http://www.securityfocus.com/news/11497
2. Group drafts rules to nix credit-card storage=20
By: Robert Lemos
The organization responsible for technical and best-practice standards in=
the payment industry plans to require the makers of merchant software to=
certify that their programs do not store sensitive data.
http://www.securityfocus.com/news/11496
3. Task force aims to improve U.S. cybersecurity
By: Robert Lemos
A blue-ribbon panel of three dozen security experts hopes to craft a stra=
tegy to improve cybersecurity by the time the next president takes office=
.
http://www.securityfocus.com/news/11494
4. Court filings double estimate of TJX breach
By: Robert Lemos
Online attackers stole information on more than 94 million credit- and de=
bit-card accounts, more than double the original estimates, according to =
court documents.
http://www.securityfocus.com/news/11493
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
V. INCIDENTS LIST SUMMARY
---------------------------
1. FW: Anyone have a reason for 2x the email flow today?
http://www.securityfocus.com/archive/75/484668
2. HITBSecConf2007 Malaysia Videos Now Available
http://www.securityfocus.com/archive/75/484666
3. Anyone have a reason for 2x the email flow today?
http://www.securityfocus.com/archive/75/484505
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. HITBSecConf2007 Malaysia Videos Now Available
http://www.securityfocus.com/archive/82/484673
2. SEH and overwrite EIP
http://www.securityfocus.com/archive/82/484427
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #371
http://www.securityfocus.com/archive/88/484683
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This issue is Sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Cross-Site Scripting Attack"- White Paper=
=20
Cross-site scripting vulnerabilities in web apps allow hackers to comprom=
ise confidential information, steal cookies and create requests that can =
be mistaken for those of a valid user!! Download this *FREE* white paper =
from SPI Dynamics for a complete guide to protection!=20
https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=3D70160000000D8=
v9