SecurityFocus Newsletter #432
[email protected] 20 Dec 2007 21:19:49 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #432
----------------------------------------
This issue is Sponsored by: The Computer Forensics Show
Imangine the ability to view anything that ever appeared on almost any co=
mputer. The Computer Forensics Show is the "DON"T MISS" event of the year=
for IT professionals
The Computer Forensics Show
February 4-6, 2008
Washington Convention Center
Washington D.C.
www.computerforensicshow.com
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1.Copyrights and Wrongs
2.The Man in the Machine
II. BUGTRAQ SUMMARY
1. Microsoft DirectX WAV and AVI File Parsing Remote Code Executio=
n Vulnerability
2. Microsoft DirectX SAMI File Parsing Stack Buffer Overflow Vulne=
rability
3. Microsoft Internet Explorer Element Tags Remote Memory Corrupti=
on Vulnerability
4. Microsoft Internet Explorer DHTML Object Memory Corruption Vuln=
erability
5. Microsoft Windows Vista Kernel ALPC Local Privilege Escalation =
Vulnerability
6. SineCms Multiple Input Validation Vulnerabilities
7. MySQL Server RENAME TABLE System Table Overwrite Vulnerability
8. Mozilla Firefox URLBar Null Byte File Remote Code Execution Vul=
nerability
9. Adobe Flash Player On Opera Browser For Mac OSX Unspecified Vul=
nerability
10. Mozilla Firefox/Thunderbird/SeaMonkey Chrome-Loaded About:Blan=
k Script Execution Vulnerability
11. IBM Hardware Management Console Unspecified Privilege Escalati=
on Vulnerability
12. Ext2 Filesystem Utilities e2fsprogs libext2fs Multiple Unspeci=
fied Integer Overflow Vulnerabilities
13. Apple Mac OS X v10.5.1 2007-009 Multiple Security Vulnerabilit=
ies
14. Macrovision SafeDisc SecDRV.SYS Method_Neither Local Privilege=
Escalation Vulnerability
15. Microsoft Windows SMBv2 Code Signing Remote Code Execution Vul=
nerability
16. Squid Proxy Cache Update Reply Processing Remote Denial of Ser=
vice Vulnerability
17. GIMP PSD File Integer Overflow Vulnerability
18. Trend Micro ServerProtect Multiple Remote Insecure Method Expo=
sure Vulnerabilities
19. St. Bernard Open File Manager Remote Heap Based Buffer Overflo=
w Vulnerability
20. Appian Business Process Management Suite Remote Denial of Serv=
ice Vulnerability
21. ProWizard 4 PC Multiple Remote Stack Based Buffer Overflow Vul=
nerabilities
22. xeCMS 'view.php' Local File Include Vulnerability
23. HP Software Update 'RulesEngine.dll' ActiveX Control Multiple =
File Overwrite Vulnerabilities
24. Sun Management Center Insecure Default Account Unauthorized Ac=
cess Vulnerability
25. id3lib ID3 Tags Buffer Overflow Vulnerability
26. KDE PCX Image File Handling Buffer Overflow Vulnerability
27. Linux Kernel IPv6 Hop-By-Hop Header Remote Denial of Service V=
ulnerability
28. Cisco Application Inspection in Firewall Services Module Denia=
l Of Service Vulnerability
29. ClamAV 'libclamav/pe.c' MEW Packed PE File Integer Overflow Vu=
lnerability
30. ClamAV 'mspack.c' Off-By-One Buffer Overflow Vulnerability
31. Linux Kernel Bluetooth Signed Buffer Index Vulnerability
32. Adobe Flash Player Multiple Security Vulnerabilities
33. MySQL Server Unspecified Remote Arbitrary Command Execution Vu=
lnerability
34. Sun Ray Device Manager Daemon Multiple Vulnerabilities
35. Apache HTTP Server Windows Share PHP File Extension Mapping In=
formation Disclosure Vulnerability
36. OpenSSL SSLv2 Malformed Client Key Remote Buffer Overflow Vuln=
erability
37. Microsoft Message Queuing Service Stack Buffer Overflow Vulner=
ability
38. KDE KDM Unspecified Local Denial Of Service Vulnerability
39. Apple Mac OS X SMB Utilities Local Stack-Based Buffer Overflow=
Vulnerability
40. Adobe Flash Player JPG Header Remote Heap Based Buffer Overflo=
w Vulnerability
41. Ingress Database Server Multiple Remote Vulnerabilities
42. Novell GroupWise 'img' Tag Buffer Overflow Vulnerability
43. Adobe Flash Player 'asfunction' Cross Site Scripting Vulnerabi=
lity
44. Microsoft Internet Explorer and Mozilla Firefox URI Handler Co=
mmand Injection Vulnerability
45. Mozilla Firefox 2.0.0.7 Multiple Remote Vulnerabilities
46. iDevSpot iSupport 'index.php' Local File Include Vulnerability
47. Ingres Flawed In User Authentication Unauthorized Access Vulne=
rability
48. Plogger 'plog-rss.php' SQL Injection Vulnerability
49. Yahoo! Toolbar YShortcut.dl ActiveX Control Remote Buffer Over=
flow Vulnerability
50. libexif Image Tag Remote Integer Overflow Vulnerability
51. Mozilla Firefox Jar URI Cross-Site Scripting Vulnerability
52. Perl Unicode Regular Expression Buffer Overflow Vulnerability
53. Autonomy KeyView Multiple Buffer Overflow Vulnerabilities
54. Linux Kernel USB PWC Driver Local Denial Of Service Vulnerabil=
ity
55. Linux Kernel HugeTLB Local Denial Of Service Vulnerability
56. WFTPD Explorer Remote Buffer Overflow Vulnerability
57. Mozilla Firefox Multiple Remote Unspecified Memory Corruption =
Vulnerabilities
58. Linux Kernel JFFS2 Filesystem Security Bypass Vulnerability
59. FreeForum FPath Variable Remote File Include Vulnerability
60. Linux Kernel wait_task_stopped Local Denial of Service Vulnera=
bility
61. Red Hat Content Accelerator Memory Leak Local Denial Of Servic=
e Vulnerability
62. Linux Kernel TCP_Input.C Remote Denial of Service Vulnerabilit=
y
63. Mozilla Firefox and SeaMonkey Windows.Location Property HTTP R=
eferer Header Spoofing Weakness
64. Dokeos 'My production' Arbitrary File Upload Vulnerability
65. Opera Web Browser Multiple Security Vulnerabilities
66. GAMERFUN EXPLORER GF-3XPLORER Local File Include and Cross-Sit=
e Scripting Vulnerabilities
67. Linux Kernel IEEE80211 HDRLen Remote Denial Of Service Vulnera=
bility
68. RavWare RavFLIC ActiveX Control Buffer Overflow Vulnerability
69. Perforce P4Web Content-Length Header Remote Denial Of Service =
Vulnerability
70. Adobe Flash Player DNS Rebinding Vulnerability
71. phpMyRealty Multiple SQL Injection Vulnerabilities
72. PhpMyDesktop|arcade 'RR.php' Remote File Include Vulnerability
73. Citrix Web Interface On-line Help Cross-Site Scripting Vulnera=
bility
74. Asterisk Host-Based Authentication Security Bypass Vulnerabili=
ty
75. Google Toolbar Dialog Spoofing Vulnerability
76. Rosoft Media Player M3U Stack-Based Buffer Overflow Vulnerabil=
ity
77. Automatic Image Upload with Thumbnails for PunBB 'uploadimg.ph=
p' Arbitrary File Upload Vulnerability
78. Mambo Index.PHP Multiple Cross-Site Scripting Vulnerabilities
79. Adobe ActionScript SecurityErrorEvent Security Bypass Vulnerab=
ility
80. IBM Lotus Sametime Server WebRunMenuFrame Cross-Site Scripting=
Vulnerability
81. Mozilla Firefox About:Blank IFrame Cross Domain Information Di=
sclosure Vulnerability
82. CUPS SSL Negotiation Unspecified Remote Denial of Service Vuln=
erability
83. Samba Send_MailSlot Stack-Based Buffer Overflow Vulnerability
84. Novell Client for Windows NWFILTER.SYS Local Privilege Escalat=
ion Vulnerability
85. Microsoft Internet Explorer mshtml.dll Remote Memory Corruptio=
n Vulnerability
86. Google Web Toolkit Benchmark Reporting System Unspecified Cros=
s-Site Scripting Vulnerability
87. Mozilla Firefox 2.0.0.4 Multiple Remote Vulnerabilities
88. MySQL Server InnoDB CONVERT_SEARCH_MODE_TO_INNOBASE Function D=
enial Of Service Vulnerability
89. Subdreamer CMS Comments Function Security Bypass Vulnerability
90. PHP 5.2.3 and Prior Versions Multiple Vulnerabilities
91. MWOpen E-Commerce leggi_commenti.asp SQL Injection Vulnerabili=
ty
92. Linux Kernel 'hrtimers' Local Denial of Service Vulnerability
93. Microsoft Internet Explorer cloneNode() and nodeValue() Remote=
Memory Corruption Vulnerability
94. Microsoft Windows Media Format Runtime ASF File Remote Code Ex=
ecution Vulnerability
95. 3proxy HTTP Proxy Request Buffer Overflow Vulnerability
96. iMesh 'IMWebControl' ActiveX Control Code Execution Vulnerabil=
ity
97. phpMyChat Multiple Scripts and Parameters Cross-Site Scripting=
Vulnerabilities
98. IBM Lotus Domino Information Disclosure Vulnerabilities and Bu=
ffer Overflow Vulnerability
99. Mozilla Firefox WYCIWYG:// URI Cache Zone Bypass Vulnerability
100. Lighttpd Mod_FastCGI Request Headers Remote Header Overflow V=
ulnerability
III. SECURITYFOCUS NEWS
1. Senate delays vote on spy bill
2. Researchers reverse Netflix anonymization
3. Group drafts rules to nix credit-card storage=20
4. Task force aims to improve U.S. cybersecurity
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Security Engineer, New York
2. [SJ-JOB] Security Engineer, lake success
3. [SJ-JOB] Sales Representative, New York
4. [SJ-JOB] Sr. Security Engineer, Seattle
5. [SJ-JOB] Sr. Security Engineer, San Mateo
6. [SJ-JOB] Senior Software Engineer, San Mateo
7. [SJ-JOB] Security Architect, Calgary
8. [SJ-JOB] Principal Software Engineer, Pasadena
9. [SJ-JOB] VP of Regional Sales, San Mateo
10. [SJ-JOB] Security Architect, San Mateo
11. [SJ-JOB] Security Engineer, New York
12. [SJ-JOB] Security System Administrator, Cambridgeshire
13. [SJ-JOB] Security Product Manager, San Mateo
14. [SJ-JOB] Forensics Engineer, London
15. [SJ-JOB] Sales Representative, San Mateo
16. [SJ-JOB] Information Assurance Analyst, Seattle
17. [SJ-JOB] Security Product Marketing Manager, San Mateo
18. [SJ-JOB] Application Security Architect, Stamford
19. [SJ-JOB] Forensics Engineer, London
20. [SJ-JOB] Information Assurance Engineer, Crystal City/NOVA
V. INCIDENTS LIST SUMMARY
1. Port 1234 UDP traffic increase?
VI. VULN-DEV RESEARCH LIST SUMMARY
1. overwriting SEH and debugging
VII. MICROSOFT FOCUS LIST SUMMARY
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1.Copyrights and Wrongs
By Mark Rasch
On October 1, 2007, Jammie Thomas -- a single mother living in Brainerd, =
Minnesota -- was sued in civil court for copyright infringement by the Re=
cording Industry Association of America. Three days later, the jury retur=
ned the verdict; Ms. Thomas was liable for willfully infringing the copyr=
ights on 24 songs. The fine: $222,000.=20
http://www.securityfocus.com/columnists/460
2.The Man in the Machine
By Federico Biancuzzi
In April 2007, when two security researchers demonstrated a flaw in the n=
ext-generation IPv6 routing scheme that would allow attackers to signific=
antly amplify any denial-of-service attack by a factor of at least 80, ne=
tworking expert Jun-ichiro "Itojun" Hagino worked to get Internet enginee=
rs to take the threat seriously.=20
http://www.securityfocus.com/columnists/459
II. BUGTRAQ SUMMARY
--------------------
1. Microsoft DirectX WAV and AVI File Parsing Remote Code Execution Vulne=
rability
BugTraq ID: 26804
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26804
Summary:
Microsoft DirectX is prone to a remote code-execution vulnerability.=20
An attacker could exploit this issue to execute arbitrary code with the p=
rivileges of the currently logged-in user. Failed exploit attempts may cr=
ash the application.
2. Microsoft DirectX SAMI File Parsing Stack Buffer Overflow Vulnerabilit=
y
BugTraq ID: 26789
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26789
Summary:
DirectX is prone to a stack-based buffer-overflow vulnerability because t=
he application fails to perform adequate boundary checks on user-supplied=
data
An attacker could exploit this issue to execute arbitrary code within the=
privileges of the currently logged-in user. Failed exploit attempts may =
crash the application.
Note: Windows Media Player 6.4 on Windows 2000 was previously stated as n=
ot being an attack vector. The vendor has updated this information to sta=
te it is a possible attack vector.
3. Microsoft Internet Explorer Element Tags Remote Memory Corruption Vuln=
erability
BugTraq ID: 26817
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26817
Summary:
Microsoft Internet Explorer is prone to a remote memory-corruption vulner=
ability.
Attackers can exploit this issue to execute arbitrary code in the context=
of the user running the application. Successful exploits will compromise=
the application and possibly the underlying computer. Failed attacks wil=
l cause denial-of-service conditions.
4. Microsoft Internet Explorer DHTML Object Memory Corruption Vulnerabili=
ty
BugTraq ID: 26427
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26427
Summary:
Microsoft Internet Explorer is prone to a remote memory-corruption vulner=
ability because it fails to adequately handle user-supplied input to cert=
ain DHTML object methods.
Attackers can exploit this issue to execute arbitrary code in the context=
of a user running the application. Successful attacks would compromise t=
he application and possibly the underlying computer. Failed attacks will =
cause denial-of-service conditions.
5. Microsoft Windows Vista Kernel ALPC Local Privilege Escalation Vulnera=
bility
BugTraq ID: 26757
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26757
Summary:
Microsoft Windows Vista is prone to a local privilege-escalation vulnerab=
ility.=20
The vulnerability resides in the Windows Kernel. A locally logged-in user=
can exploit this issue to gain kernel-level access to the operating syst=
em.
6. SineCms Multiple Input Validation Vulnerabilities
BugTraq ID: 26738
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26738
Summary:
SineCms is prone to multiple input-validation vulnerabilities because it =
fails to sufficiently sanitize user-supplied data. The issues include fiv=
e SQL-injection vulnerabilities affecting the Calendar and Guestbook modu=
les and two HTML-injection issues affecting the Last Comments module.
Exploiting these issues could allow an attacker to steal cookie-based aut=
hentication credentials, compromise the application, access or modify dat=
a, or exploit latent vulnerabilities in the underlying database.
UPDATE (December 18, 2007): The vendor refutes the HTML-injection issues.
7. MySQL Server RENAME TABLE System Table Overwrite Vulnerability
BugTraq ID: 26765
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26765
Summary:
MySQL is prone to a local denial-of-service vulnerability because the dat=
abase server fails to properly handle unexpected symbolic links.
Exploiting this issue allows attackers with local access to affected comp=
uters to overwrite MySQL system tables. Further attacks against the MySQL=
database and potentially the underlying operating system may be possible=
.
This issue affects versions prior to MySQL 5.0.51.
8. Mozilla Firefox URLBar Null Byte File Remote Code Execution Vulnerabil=
ity
BugTraq ID: 24447
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/24447
Summary:
Mozilla Firefox is prone to a remote code-execution vulnerability because=
it fails to adequately sanitize user-supplied input.
Attackers may exploit this issue by enticing victims into visiting a mali=
cious site and followings links with improper file extensions.
Successful exploits may allow an attacker to crash the application or exe=
cute arbitrary code in the context of the affected application. Other att=
acks are also possible.
9. Adobe Flash Player On Opera Browser For Mac OSX Unspecified Vulnerabil=
ity
BugTraq ID: 26274
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26274
Summary:
Adobe Flash Player is prone to an unspecified vulnerability.
This issue occurs when Flash Player is running on Opera Browser for the M=
ac OS X operating system.
Very few technical details are currently available. We will update this B=
ID as more information emerges.
Flash Player 9.0.47.0 and prior versions are vulnerable when running on M=
ac OS X.
10. Mozilla Firefox/Thunderbird/SeaMonkey Chrome-Loaded About:Blank Scrip=
t Execution Vulnerability
BugTraq ID: 25142
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/25142
Summary:
Mozilla Firefox, Thunderbird, and SeaMonkey are prone to a vulnerability =
that allows JavaScript to execute with unintended privileges.=20
A malicious site may be able to cause the execution of a script with Chro=
me privileges. Attackers could exploit this issue to execute hostile scri=
pt code with privileges that exceed those that were intended. Certain Fir=
efox extensions may not intend 'about:blank' to execute script code with =
Chrome privileges.
NOTE: This issue was introduced by the fix for MFSA 2007-20.
11. IBM Hardware Management Console Unspecified Privilege Escalation Vuln=
erability
BugTraq ID: 26769
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26769
Summary:
IBM Hardware Management Console is prone to an unspecified privilege-esca=
lation vulnerability.
Currently, very little is known about this issue. We will update this BID=
as more information emerges.
This issue affects Hardware Management Console Version 3 Release 3.7; oth=
er versions may also be affected.
12. Ext2 Filesystem Utilities e2fsprogs libext2fs Multiple Unspecified In=
teger Overflow Vulnerabilities
BugTraq ID: 26772
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26772
Summary:
The 'e2fsprogs' package is prone to multiple unspecified integer-overflow=
vulnerabilities because the application fails to bounds-check user-suppl=
ied data before copying it into an insufficiently sized buffer.
An attacker can exploit these issues to execute arbitrary code within the=
context of the affected application. Failed exploit attempts will result=
in a denial of service.
These issues affect e2fsprogs 1.38 through 1.40.2; other versions may als=
o be affected.
13. Apple Mac OS X v10.5.1 2007-009 Multiple Security Vulnerabilities
BugTraq ID: 26910
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26910
Summary:
Apple Mac OS X is prone to multiple security vulnerabilities.
=20
These issues affect Mac OS X and various applications, including Address=
Book, CFNetwork, ColorSync, CoreFoundation, CUPS, Desktop Services, iCha=
t, IO Storage Family, Launch Services, Mail, Quick Look, Safari, Safari R=
SS, SMB, Software Update, Spin Tracer, Spotlight, tcpdump, and XQuery.
=20
Attackers may exploit these issues to execute arbitrary code, trigger de=
nial-of-service conditions, escalate privileges, and potentially compromi=
se vulnerable computers.
=20
Apple Mac OS X 10.5.1 and prior versions are vulnerable to these issues.
14. Macrovision SafeDisc SecDRV.SYS Method_Neither Local Privilege Escala=
tion Vulnerability
BugTraq ID: 26121
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26121
Summary:
Macrovision SafeDisc is prone to a local privilege-escalation vulnerabili=
ty because it fails to adequately sanitize user-supplied input.
Exploiting this vulnerability allows local attackers to execute arbitrary=
malicious code with SYSTEM-level privileges, facilitating the complete c=
ompromise of affected computers.
UPDATE: This issue affects only Microsoft Windows XP and 2003 platforms. =
Microsoft Vista is not affected.
15. Microsoft Windows SMBv2 Code Signing Remote Code Execution Vulnerabil=
ity
BugTraq ID: 26777
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26777
Summary:
Microsoft Windows is prone to a remote code-execution vulnerability becau=
se it fails to properly validate digital signatures.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary machine code in the context of logged-in users. This facilitates t=
he remote compromise of affected computers.
16. Squid Proxy Cache Update Reply Processing Remote Denial of Service Vu=
lnerability
BugTraq ID: 26687
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26687
Summary:
Squid is prone to a remote denial-of-service vulnerability because the pr=
oxy server fails to perform boundary checks before copying user-supplied =
data into process buffers.
Successfully exploiting this issue allows remote attackers to crash the a=
ffected application, denying further service to legitimate users. Attacke=
rs may also be able to execute arbitrary code, but this has not been conf=
irmed.
This issue affects Squid 2.6.STABLE16 and prior versions. All Squid-3 sna=
pshots and prereleases up to the November 28 snapshot are also vulnerable=
.
17. GIMP PSD File Integer Overflow Vulnerability
BugTraq ID: 24745
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/24745
Summary:
GIMP is prone to an integer-overflow vulnerability because it fails to pr=
operly bounds-check user-supplied input data before copying it to an insu=
fficiently sized memory buffer.
Successful exploits of this vulnerability allow remote attackers to execu=
te arbitrary machine code in the context of the affected application.
GIMP 2.2.15 is vulnerable to this issue; other versions may also be affec=
ted.
18. Trend Micro ServerProtect Multiple Remote Insecure Method Exposure Vu=
lnerabilities
BugTraq ID: 26912
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26912
Summary:
Trend Micro ServerProtect is prone to multiple vulnerabilities that let r=
emote attackers gain full access to the filesystem. The issues occur beca=
use the application fails to properly restrict access to certain DCE/RPC =
methods.
Will full access to the filesystem, attackers may be able to execute arbi=
trary code with SYSTEM-level privileges and completely compromise affecte=
d computers.=20
These issues were reported to affect ServerProtect 5.58 (Security Patch 3=
). Earlier versions may also be affected.
Reports indicate that these vulnerabilities have been fixed in Security P=
atch 4.
19. St. Bernard Open File Manager Remote Heap Based Buffer Overflow Vulne=
rability
BugTraq ID: 26914
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26914
Summary:
St. Bernard Open File Manager is prone to a remote heap-based buffer-over=
flow vulnerability because the application fails to properly bound-check =
user-supplied data before copying it to an insufficiently sized memory bu=
ffer.
=20
An attacker can exploit this issue to execute arbitrary code with SYSTEM-=
level privileges. Failed exploit attempts will likely cause denial-of-ser=
vice conditions.
This issue affects Open File Manager 9.5; other versions may also be vuln=
erable.
20. Appian Business Process Management Suite Remote Denial of Service Vul=
nerability
BugTraq ID: 26913
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26913
Summary:
Appian Business Process Management Suite (BPMS) is prone to a remote deni=
al-of-service vulnerability because it fails to handle specially crafted =
packets.
Successfully exploiting this issue allows remote attackers to crash the a=
ffected application, denying further service to legitimate users.=20
This issue affects Appian BPMS 5.6 SP1; other versions may be vulnerable =
as well.
21. ProWizard 4 PC Multiple Remote Stack Based Buffer Overflow Vulnerabil=
ities
BugTraq ID: 26953
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26953
Summary:
ProWizard 4 PC is prone to multiple stack-based buffer-overflow issues be=
cause it fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application. Failed exploit attempts =
likely result in denial-of-service conditions.
These issues affect ProWizard 4 PC versions 1.62 and prior; other version=
s may also be vulnerable.
22. xeCMS 'view.php' Local File Include Vulnerability
BugTraq ID: 26952
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26952
Summary:
xeCMS is prone to a local file-include vulnerability because it fails to =
properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
23. HP Software Update 'RulesEngine.dll' ActiveX Control Multiple File Ov=
erwrite Vulnerabilities
BugTraq ID: 26950
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26950
Summary:
HP Software Update 'RulesEngine.dll' ActiveX control is prone to multiple=
vulnerabilities that attackers can exploit to overwrite arbitrary user f=
iles and SYSTEM files. The issues stem from insecure methods used within=
'RulesEngine.dll'.=20
An attacker can exploit these issues by enticing an unsuspecting victim t=
o visit a malicious HTML page.
Successfully exploiting these issues allows remote attackers to overwrite=
arbitrary user files. Additionally, critical SYSTEM files can be overwr=
itten, causing the computer to become unbootable.
HP Software Update 3.0.8.4 with 'RulesEngine.dll' ActiveX control 1.0 is =
vulnerable; other versions may also be affected. =20
Note that multiple HP laptop models ship with this software.
24. Sun Management Center Insecure Default Account Unauthorized Access Vu=
lnerability
BugTraq ID: 26948
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26948
Summary:
Sun Management Center (MC) is prone to an insecure default account vulner=
ability in its Oracle database component.
Successfully exploiting this issue allows remote attackers to gain access=
to the database, and to execute arbitrary code with the privileges of th=
e database user. This may aid in the remote compromise of affected comput=
ers.
Sun MC versions 3.5 Update 1, 3.6, and 3.6.1 for the Solaris platform are=
vulnerable to this issue. The Solaris x86 platform is not supported by t=
he software.
25. id3lib ID3 Tags Buffer Overflow Vulnerability
BugTraq ID: 26945
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26945
Summary:
The id3lib library is prone to a buffer-overflow vulnerability.
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of the user running the affected application or crash the affecte=
d application, denying further service to legitimate users.=20
This issue affects id3lib versions committed to the CVS repository; other=
versions may also be affected.
26. KDE PCX Image File Handling Buffer Overflow Vulnerability
BugTraq ID: 13096
Remote: Yes
Last Updated: 2007-12-18
Relevant URL: http://www.securityfocus.com/bid/13096
Summary:
KDE is reported prone to a buffer-overflow vulnerability when handling PC=
X image files because the 'kimgio' image library fails to properly valida=
te PCX image data.=20
=20
This vulnerability was reported to reside in PCX image-handling routines,=
but the vendor has patched other image handlers, which may mean that oth=
er image formats may also be affected by similar problems.=20
=20
Attackers may exploit this vulnerability to crash applications using the =
affected library or possibly to execute arbitrary machine code in the con=
text of the affected application.
27. Linux Kernel IPv6 Hop-By-Hop Header Remote Denial of Service Vulnerab=
ility
BugTraq ID: 26943
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26943
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability bec=
ause it fails to adequately validate specially crafted IPv6 'Hop-By-Hop' =
headers.
Attackers can exploit this issue to cause a kernel panic, denying service=
to legitimate users.
28. Cisco Application Inspection in Firewall Services Module Denial Of Se=
rvice Vulnerability
BugTraq ID: 26941
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26941
Summary:
Cisco Firewall Services Module (FWSM) is prone to a remote denial-of-serv=
ice vulnerability because it fails to handle specially crafted network pa=
ckets.=20
An attacker can exploit this issue to cause the affected device to reload=
, denying service to legitimate users. Repeated attacks will result in a =
prolonged denial-of-service condition.
29. ClamAV 'libclamav/pe.c' MEW Packed PE File Integer Overflow Vulnerabi=
lity
BugTraq ID: 26927
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26927
Summary:
ClamAV is prone to an integer-overflow vulnerability because it fails to =
properly verify user-supplied data.=20
Successful exploits of this vulnerability can allow remote attackers to e=
xecute arbitrary machine code in the context of applications using the 'l=
ibclamav' library. Failed exploits may crash the application.
ClamAV 0.91.2 is vulnerable to this issue; other versions may also be aff=
ected.
30. ClamAV 'mspack.c' Off-By-One Buffer Overflow Vulnerability
BugTraq ID: 26946
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26946
Summary:
ClamAV is prone to a buffer-overflow vulnerability because it fails to pr=
operly bounds-check user-supplied input before copying it to insufficient=
ly sized memory buffers.
Successful exploits of this vulnerability can allow remote attackers to e=
xecute arbitrary machine code in the context of applications using the 'l=
ibclamav' library. Failed exploits may crash the application.
ClamAV 0.91.2 is vulnerable to this issue; other versions may also be aff=
ected.
31. Linux Kernel Bluetooth Signed Buffer Index Vulnerability
BugTraq ID: 12911
Remote: No
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/12911
Summary:
A local signed-buffer-index vulnerability affects the Linux kernel becaus=
e it fails to securely handle signed values when validating memory indexe=
s.=20
=20
A local attacker may leverage this issue to gain escalated privileges on =
an affected computer.
32. Adobe Flash Player Multiple Security Vulnerabilities
BugTraq ID: 26929
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26929
Summary:
Adobe Flash Player is prone to multiple security vulnerabilities, includi=
ng:
- A privilege-escalation issue
- A cross-domain security-bypass issue
- An HTTP request-splitting issue
Attackers can exploit these vulnerabilities to compromise affected comput=
ers, execute arbitrary code and misrepresent how web content is served, c=
ached, or interpreted. Other attacks are also possible.=20
These issues affect Adobe Flash Player 9.0.48.0, 8.0.35.0, and 7.0.70.0 a=
nd prior.
Notes:
- The issues described in CVE-2007-6244 have been reassigned to BID 26949=
and BID 26960.
- The issue described in CVE-2007-6242 has been reassigned to BID 26951.
33. MySQL Server Unspecified Remote Arbitrary Command Execution Vulnerabi=
lity
BugTraq ID: 26947
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26947
Summary:
MySQL is prone to an unspecified vulnerability that allows remote attacke=
rs to execute arbitrary commands on the database. =20
Exploiting this issue can allow an attacker to access database content.
Very few details are currently available regarding this issue. We will up=
date this BID as more information emerges.
This issue affects MySQL 5.0.45 and 5.0.51; other versions may also be vu=
lnerable.
34. Sun Ray Device Manager Daemon Multiple Vulnerabilities
BugTraq ID: 26944
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26944
Summary:
Sun Ray Device Manager daemon is prone to multiple vulnerabilities.
Attackers can leverage these issues to create or delete arbitrary directo=
ries on the affected server or to crash the daemon and deny service to le=
gitimate users.
35. Apache HTTP Server Windows Share PHP File Extension Mapping Informati=
on Disclosure Vulnerability
BugTraq ID: 26939
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26939
Summary:
Apache is prone to an information-disclosure vulnerability.
This issue occurs because Apache fails to properly associate file extensi=
ons with the correct engines when handling specially crafted requests for=
files on Windows SMB shares.
Attackers can leverage this issue to view arbitrary script files as plain=
text. Potentially sensitive information may be present in the script cod=
e. Information harvested could aid in further attacks.
This issue affects Apache 2.2.6 when serving PHP files from a Windows SMB=
share; other versions may also be affected.
NOTE: This issue may also occur when handling other filename extensions =
that use AddType directives to associate scripts or executables (e.g. '.c=
gi\', '.py\', '.rb\', etc.).
36. OpenSSL SSLv2 Malformed Client Key Remote Buffer Overflow Vulnerabili=
ty
BugTraq ID: 5363
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/5363
Summary:
A buffer-overflow vulnerability has been reported in some versions of Ope=
nSSL.=20
=20
The issue occurs in the handling of the client key value during the negot=
iation of the SSLv2 protocol. A malicious client may be able to exploit t=
his vulnerability to execute arbitrary code as the vulnerable server proc=
ess or possibly to create a denial-of-service condition.=20
=20
***UPDATE: A worm that likely exploits this vulnerability has been discov=
ered propagating in the wild. Additionally, this code includes peer-to-pe=
er and distributed denial-of-service capabilities. There have been numer=
ous reports of intrusions in Europe. It is not yet confirmed whether thi=
s vulnerability is in OpenSSL, mod_ssl, or another component. Administra=
tors are advised to upgrade to the most recent versions or to disable Apa=
che, if possible, until more information is available.
37. Microsoft Message Queuing Service Stack Buffer Overflow Vulnerability
BugTraq ID: 26797
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26797
Summary:
Microsoft Message Queuing (MSMQ) is prone to a stack-based buffer-overflo=
w vulnerability because the software fails to perform adequate boundary c=
hecks on user-supplied data.=20
An attacker can exploit this issue to execute arbitrary code with SYSTEM-=
level privileges, facilitating the complete compromise of affected comput=
ers. Failed exploit attempts will result in a denial-of-service condition=
.=20
This issue is remotely exploitable on all Windows 2000 systems, and local=
ly exploitable on Windows XP, provided the affected component installed.
38. KDE KDM Unspecified Local Denial Of Service Vulnerability
BugTraq ID: 26909
Remote: No
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26909
Summary:
KDE KDM is prone to a local denial-of-service vulnerability.
=20
Exploiting this issue allows local attackers to deny service to legitimat=
e users.
Very few details are currently available regarding this issue. We will u=
pdate this BID as information becomes available.
39. Apple Mac OS X SMB Utilities Local Stack-Based Buffer Overflow Vulner=
ability
BugTraq ID: 26926
Remote: No
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26926
Summary:
Mac OS X is prone to a local stack-based buffer-overflow vulnerability be=
cause it fails to properly bounds-check user-supplied data before copying=
it to an insufficiently sized memory buffer.
This issue affects certain SMB (Server Message Block protocol) applicatio=
ns.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges. Successful attacks will completely compromise affected com=
puters. Failed exploit attempts will result in a denial of service.
Mac OS X and Mac OS X Server 10.4.11 and prior versions are vulnerable.
NOTE: This issue was originally covered in BID 26910 (Apple Mac OS X v10.=
5.1 2007-009 Multiple Security Vulnerabilities).
40. Adobe Flash Player JPG Header Remote Heap Based Buffer Overflow Vulne=
rability
BugTraq ID: 26951
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26951
Summary:
Adobe Flash Player is prone to a remote heap-based buffer-overflow vulner=
ability because the application fails to use consistent signedness when h=
andling user-supplied input.
=20
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of a user running the application. Failed exploit attempts will l=
ikely cause denial-of-service conditions.
This issue affects Adobe Flash Player 9.0.48.0, 8.0.35.0, 7.0.70.0, and p=
rior versions.
NOTE: This issue was originally covered by BID 26929 (Adobe Flash Player =
Multiple Security Vulnerabilities).
41. Ingress Database Server Multiple Remote Vulnerabilities
BugTraq ID: 24585
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/24585
Summary:
Ingress Database Server included in CA eTrust Secure Content Manager is p=
rone to multiple remote vulnerabilities, including multiple stack- and he=
ap-based buffer-overflow issues, multiple pointer-overwrite issues, and a=
n arbitrary-file-overwrite issue.
Successful exploits will allow attackers to completely compromise affecte=
d computers, including executing arbitrary code with SYSTEM-level privile=
ges and truncating the 'alarkp.def' file.
42. Novell GroupWise 'img' Tag Buffer Overflow Vulnerability
BugTraq ID: 26875
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26875
Summary:
Novell GroupWise is prone to a buffer-overflow vulnerability because it f=
ails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue will allow an attacker to execute arbi=
trary code within the context of the affected application. Failed exploit=
attempts will result in a denial-of-service condition.=20
This issue affects GroupWise 6.5.6; other versions may also be affected.
43. Adobe Flash Player 'asfunction' Cross Site Scripting Vulnerability
BugTraq ID: 26949
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26949
Summary:
Adobe Flash Player is prone to a cross-site scripting vulnerability becau=
se the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
44. Microsoft Internet Explorer and Mozilla Firefox URI Handler Command I=
njection Vulnerability
BugTraq ID: 24837
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/24837
Summary:
Microsoft Internet Explorer, Mozilla Firefox and Netscape Navigator are p=
rone to a vulnerability that lets attackers inject commands through the '=
firefoxurl' and 'navigatorurl' protocol handlers.
Exploiting these issues allows remote attackers to pass and execute arbit=
rary commands and arguments through the 'firefox.exe' and 'navigator.exe'=
processes by employing the 'firefoxurl' and 'navigatorurl' handlers.
An attacker can also employ these issues to carry out cross-browser scrip=
ting attacks by using the '-chrome' argument. This can allow the attacker=
to run JavaScript code with the privileges of trusted Chrome context and=
gain full access to Firefox and Netscape Navigator's resources.
Exploiting these issues would permit remote attackers to influence comman=
d options that can be called through the 'firefoxurl' and 'navigatorurl' =
handlers and therefore execute commands and script code with the privileg=
es of a user running the applications. Successful attacks may result in a=
variety of consequences, including remote unauthorized access.
45. Mozilla Firefox 2.0.0.7 Multiple Remote Vulnerabilities
BugTraq ID: 26132
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26132
Summary:
The Mozilla Foundation has released multiple security advisories specifyi=
ng various vulnerabilities in Firefox 2.0.0.7 and prior versions.
These vulnerabilities allow attackers to:
- Execute arbitrary code due to memory corruption.
- Carry out content spoofing and phishing attacks.
- Gain unauthorized access to files on a user's computer running the Linu=
x operating system.
- Execute script code with elevated privileges.
Other attacks may also be possible.
These issues are present in Firefox 2.0.0.7 and prior versions. Mozilla T=
hunderbird 2.0.0.7 and prior versions as well as SeaMonkey 1.1.4 and prio=
r versions are also affected by many of these vulnerabilities.
46. iDevSpot iSupport 'index.php' Local File Include Vulnerability
BugTraq ID: 26961
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26961
Summary:
iSupport is prone to a local file-include vulnerability because it fails =
to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
This issue affects iSupport 1.8; other versions may also be affected.
47. Ingres Flawed In User Authentication Unauthorized Access Vulnerabilit=
y
BugTraq ID: 26959
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26959
Summary:
Ingres is prone to an unauthorized-access security vulnerability due to a=
flaw in user authentication.
Attackers can exploit this issue to gain unauthorized access to the affec=
ted database. Successful exploits can allow attackers to access, create, =
or modify data; other attacks are possible.
This issue affects Ingres 2.5 and 2.6 when running on Windows.
48. Plogger 'plog-rss.php' SQL Injection Vulnerability
BugTraq ID: 26958
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26958
Summary:
Plogger is prone to an SQL-injection vulnerability because it fails to su=
fficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects Plogger 1.0 Beta 3; other versions may also be affecte=
d.
49. Yahoo! Toolbar YShortcut.dl ActiveX Control Remote Buffer Overflow Vu=
lnerability
BugTraq ID: 26956
Remote: Yes
Last Updated: 2007-12-20
Relevant URL: http://www.securityfocus.com/bid/26956
Summary:
YShortcut is prone to a buffer-overflow vulnerability because it fails to=
perform adequate boundary checks on user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the conte=
xt of an application using the ActiveX control (typically Internet Explor=
er). Failed attacks will likely cause denial-of-service conditions.
Yahoo! Toolbar 1.4.1 is vulnerable to this issue; other versions may also=
be affected.
50. libexif Image Tag Remote Integer Overflow Vulnerability
BugTraq ID: 26942
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26942
Summary:
The libexif library is prone to an integer-overflow vulnerability because=
the software fails to ensure that integer values are not overrun.
Successful exploits of this vulnerability allow remote attackers to execu=
te arbitrary machine code in the context of an application using the vuln=
erable library. Failed attempts will likely result in denial-of-service c=
onditions.
51. Mozilla Firefox Jar URI Cross-Site Scripting Vulnerability
BugTraq ID: 26385
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26385
Summary:
Mozilla Firefox is prone to a cross-site scripting vulnerability because =
the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue to steal cookie-based authentication c=
redentials and other sensitive data that may aid in further attacks.
52. Perl Unicode Regular Expression Buffer Overflow Vulnerability
BugTraq ID: 26350
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26350
Summary:
Perl is prone to a buffer-overflow vulnerability because it fails to suff=
iciently bounds-check user-supplied input.
Successfully exploiting this issue allows attackers to execute arbitrary =
machine code in the context of Perl applications using regular expression=
s in a vulnerable manner. This facilitates the remote compromise of affec=
ted computers.
Perl 5.8 is vulnerable to this issue; other versions may also be affected=
.
53. Autonomy KeyView Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 26175
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26175
Summary:
Autonomy KeyView is prone to multiple buffer-overflow vulnerabilities.=20
Successfully exploiting these issues could allow an attacker to execute a=
rbitrary code in the context of the user running the application. =20
Multiple applications incorporate the vulnerable KeyView component, so ar=
e also considered vulnerable to these issues.
NOTE: This document was previously titled 'IBM Lotus Notes Attachment Vie=
wer Multiple Buffer Overflow Vulnerabilities'. It has been updated and re=
labeled to properly reflect the vulnerable component.
54. Linux Kernel USB PWC Driver Local Denial Of Service Vulnerability
BugTraq ID: 25504
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/25504
Summary:
The Linux Kernel is prone to a local denial-of-service vulnerability beca=
use it fails to properly free resources of USB PWC devices.
Attackers can exploit this issue to block the USB subsystem, resulting in=
denial-of-service conditions.
Versions prior to 2.6.22.6 are vulnerable.
55. Linux Kernel HugeTLB Local Denial Of Service Vulnerability
BugTraq ID: 25904
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/25904
Summary:
The Linux Kernel is prone to a local denial-of-service vulnerability caus=
ed by a design error in the 'hugetlbfs' handling procedures.
This issue affects kernel 2.6.x versions prior to 2.6.18.
56. WFTPD Explorer Remote Buffer Overflow Vulnerability
BugTraq ID: 26935
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26935
Summary:
WFTPD Explorer is prone to a remote heap-based buffer-overflow vulnerabil=
ity.=20
The issue arises when the client handles excessive string data. By exploi=
ting this issue, a remote attacker may gain unauthorized access in the co=
ntext of the user running the application.=20
WFTPD Explorer 1.0 is reported vulnerable; other versions may be affected=
as well.
57. Mozilla Firefox Multiple Remote Unspecified Memory Corruption Vulnera=
bilities
BugTraq ID: 26593
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26593
Summary:
The Mozilla Foundation has released a security advisory disclosing three =
unspecified memory-corruption vulnerabilities.
Successfully exploiting these issues may allow attackers to execute code,=
facilitating the compromise of affected computers. Failed exploit attemp=
ts will likely crash the application.
Versions prior to Mozilla Firefox 2.0.0.10 and Mozilla SeaMonkey 1.1.7 ar=
e vulnerable to these issues.
58. Linux Kernel JFFS2 Filesystem Security Bypass Vulnerability
BugTraq ID: 25838
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/25838
Summary:
The Linux kernel is prone to a security-bypass vulnerability because the =
software fails to properly store POSIX ACLs in the JFFS2 filesystem.
A local attacker may exploit this issue to bypass ACL security restrictio=
ns, which may lead to other attacks.
59. FreeForum FPath Variable Remote File Include Vulnerability
BugTraq ID: 20388
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/20388
Summary:
FreeForum is prone to a remote file-include vulnerability because it fail=
s to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
60. Linux Kernel wait_task_stopped Local Denial of Service Vulnerability
BugTraq ID: 26477
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26477
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability beca=
use it fails to properly handle certain process-exit conditions.
Attackers can exploit this issue to trigger kernel crashes, denying servi=
ce to legitimate users.
Linux kernel versions prior to 2.6.23.8 as well as 2.6.24-rc1 and 2.6.24=
-rc1 are vulnerable.
61. Red Hat Content Accelerator Memory Leak Local Denial Of Service Vulne=
rability
BugTraq ID: 26657
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26657
Summary:
Red Hat Content Accelerator is prone to a denial-of-service vulnerability=
.=20
Exploiting this vulnerability may cause the system to crash due to a memo=
ry leak.
Red Hat Enterprise Linux (v. 5 server) and Red Hat Enterprise Linux Deskt=
op (v. 5 client) are known to be affected by this issue.
62. Linux Kernel TCP_Input.C Remote Denial of Service Vulnerability
BugTraq ID: 26474
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26474
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability bec=
ause it fails to adequately sanitize specially crafted ACK responses.
Attackers can exploit this issue to cause a NULL-pointer dereference and =
crash the kernel.
Linux kernel versions prior to 2.6.23.8 as well as 2.6.24-rc1 and 2.6.24=
-rc1 are vulnerable.
63. Mozilla Firefox and SeaMonkey Windows.Location Property HTTP Referer =
Header Spoofing Weakness
BugTraq ID: 26589
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26589
Summary:
Mozilla Firefox and SeaMonkey are prone to a weakness that allows an atta=
cker to spoof HTTP Referer headers. This issue stems from a race conditio=
n in the affected application. The weakness arises because of a small tim=
ing difference when using a modal 'alert()' dialog, which allows users to=
generate fake HTTP Referer headers.
An attacker can exploit this issue to spoof HTTP referer headers. This ma=
y cause other security mechanisms that rely on this data to fail or to re=
turn misleading information.
This issue affects versions prior to Mozilla FireFox 2.0.0.10 and Mozill=
a SeaMonkey 1.1.7.
64. Dokeos 'My production' Arbitrary File Upload Vulnerability
BugTraq ID: 26940
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26940
Summary:
Dokeos is prone to a vulnerability that lets attackers upload arbitrary f=
iles because it fails to adequately sanitize user-supplied input.
NOTE: To exploit this issue, an attacker must have authenticated access t=
o the affected application.
An attacker can exploit this issue to upload arbitrary files and execute =
malicious code in the context of the webserver process. This may allow th=
e attacker to compromise the application and the underlying system; other=
attacks are also possible.
This issue affects Dokeos 1.8.4; other versions may also be affected.
65. Opera Web Browser Multiple Security Vulnerabilities
BugTraq ID: 26937
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26937
Summary:
Opera Web Browser is prone to multiple security vulnerabilities, includin=
g remote code-execution, information-disclosure, and cross-domain scripti=
ng issues.
Attackers can exploit these issues to execute remote code and obtain sens=
itive information in the context of the affected application. Attackers m=
ay be able to exploit some of the issues to carry out cross-domain script=
ing attacks.
These issues affect versions prior to Opera 9.25.
Very few technical details are currently available. We will update this B=
ID as more information emerges.
66. GAMERFUN EXPLORER GF-3XPLORER Local File Include and Cross-Site Scrip=
ting Vulnerabilities
BugTraq ID: 26936
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26936
Summary:
GAMERFUN EXPLORER GF-3XPLORER is prone to multiple local file-include vul=
nerabilities and a cross-site scripting vulnerability.
=20
An attacker could exploit these issues to execute local script code in th=
e context of the application and access sensitive data. The attacker may =
also be able to execute arbitrary script code in the browser of an unsusp=
ecting user in the context of the affected site. This may allow the attac=
ker to steal cookie-based authentication credentials and to launch other =
attacks.
=20
These issues affect GF-3XPLORER 2.4; other versions may also be vulnerabl=
e.
67. Linux Kernel IEEE80211 HDRLen Remote Denial Of Service Vulnerability
BugTraq ID: 26337
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26337
Summary:
The Linux kernel ieee80211 driver is prone to a remote denial-of-service =
vulnerability because it fails to perform adequate boundary checks on use=
r-supplied data.
An attacker can exploit this issue to crash a victim computer, effectivel=
y denying service.
Versions prior to Linux kernel 2.6.22.11 are vulnerable.
68. RavWare RavFLIC ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 26934
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26934
Summary:
RavWare Flic ActiveX control RavFLIC is prone a buffer-overflow vulnerabi=
lity because the application fails to perform adequate boundary checks on=
user-supplied data.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
This issue affects RavFLIC 1.0.0.1; other versions may also be vulnerable=
.
69. Perforce P4Web Content-Length Header Remote Denial Of Service Vulnera=
bility
BugTraq ID: 26806
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26806
Summary:
Perforce P4Web is prone to a remote denial-of-service vulnerability becau=
se it fails to handle specially crafted HTTP requests.
An attacker can exploit this issue to cause the application to consume ex=
cessive CPU and memory resources. Successful attacks will deny service to=
legitimate users.
P4Web 2006.2 and prior versions running on Windows are affected.
70. Adobe Flash Player DNS Rebinding Vulnerability
BugTraq ID: 26930
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26930
Summary:
Adobe Flash Player is prone to a DNS rebinding vulnerability that allows =
remote attackers to establish arbitrary TCP sessions.=20
=20
An attacker can exploit this issue by enticing an unsuspecting victim to =
view a malicious SWF file.=20
=20
Successfully exploiting this issue allows the attacker to bypass the appl=
ication's same-origin policy and set up connections to services on arbitr=
ary computers. This may lead to other attacks.
71. phpMyRealty Multiple SQL Injection Vulnerabilities
BugTraq ID: 26932
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26932
Summary:
phpMyRealty (PMR) is prone to two SQL-injection vulnerabilities because i=
t fails to sufficiently sanitize user-supplied data before using it in an=
SQL query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
phpMyRealty v1.0.9 and prior versions are reported vulnerable.
72. PhpMyDesktop|arcade 'RR.php' Remote File Include Vulnerability
BugTraq ID: 26931
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26931
Summary:
PhpMyDesktop|arcade is prone to a remote file-include vulnerability becau=
se it fails to sufficiently sanitize user-supplied data.
Exploiting this issue may allow an attacker to compromise the application=
and the underlying system.
PhpMyDesktop|arcade 1.0 final is vulnerable; other versions may also be a=
ffected.
73. Citrix Web Interface On-line Help Cross-Site Scripting Vulnerability
BugTraq ID: 26933
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26933
Summary:
Citrix Web Interface is prone to a cross-site scripting vulnerability bec=
ause the application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
Citrix Web Interface 2.0 and prior versions are affected. All versions of=
Citrix NFuse are also vulnerable.
74. Asterisk Host-Based Authentication Security Bypass Vulnerability
BugTraq ID: 26928
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26928
Summary:
Asterisk is prone to a security-bypass vulnerability that affects the SIP=
and IAX protocols.
An attacker can exploit this issue to bypass the host-based authenticatio=
n mechanism. Successfully exploiting this issue will allow an attacker to=
impersonate any user. This may lead to false sense of security.
This issue affects versions prior to:
=20
Asterisk Open Source 1.2.26
Asterisk Open Source 1.4.16=20
Asterisk Business Edition B.2.3.6
Asterisk Business Edition C.1.0-beta8
75. Google Toolbar Dialog Spoofing Vulnerability
BugTraq ID: 26923
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26923
Summary:
Google Toolbar is prone to a dialog-spoofing vulnerability.=20
An attacker can exploit this issue by crafting a URI that contains a ope=
n redirector.=20
Successfully exploiting this issue may allow the attacker to convince an =
unsuspecting victim to install malicious custom buttons onto the victim's=
toolbar. This may lead to a false sense of trust and may also aid in phi=
shing attacks. Other attacks are also possible.
This issue affects these versions:
Google Toolbar 5 beta for Internet Explorer
Google Toolbar 4 for Internet Explorer=20
Google Toolbar 4 for Firefox
Other versions running on different browsers may also be affected.
76. Rosoft Media Player M3U Stack-Based Buffer Overflow Vulnerability
BugTraq ID: 26920
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26920
Summary:
Rosoft Media Player is prone to a stack-based buffer-overflow vulnerabili=
ty because it fails to perform adequate boundary checks on user-supplied =
input.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the user running the application. Failed at=
tacks will cause denial-of-service conditions.
Rosoft Media Player 4.1.7 is vulnerable; other versions may also be affec=
ted.
NOTE: This BID originally covered this issue as a denial-of-service vulne=
rability; further information shows that the issue is more severe.
77. Automatic Image Upload with Thumbnails for PunBB 'uploadimg.php' Arbi=
trary File Upload Vulnerability
BugTraq ID: 26925
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26925
Summary:
The Automatic Image Upload with Thumbnails module for PunBB is prone to a=
vulnerability that lets attackers upload arbitrary files because it fail=
s to adequately sanitize user-supplied input.
NOTE: To exploit this issue, an attacker requires access to a valid user =
account that is part of a group with file-upload privileges.
An attacker can exploit this issue to execute malicious code in the conte=
xt of the webserver process. This may allow the attacker to compromise th=
e application and the underlying system; other attacks are also possible.
Automatic Image Upload with Thumbnails 1.3.2 and 1.3.3 are affected; othe=
r versions may also be vulnerable.
78. Mambo Index.PHP Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 26922
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26922
Summary:
Mambo is prone to multiple cross-site scripting vulnerabilities because i=
t fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
Mambo 4.6.2 is vulnerable; other versions may also be affected.
79. Adobe ActionScript SecurityErrorEvent Security Bypass Vulnerability
BugTraq ID: 25260
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/25260
Summary:
Adobe ActionScript is prone to a security-bypass vulnerability because th=
e application allows Flash movies compiled by ActionScript to connect to =
arbitrary TCP ports on a host running a vulnerable version of Flash.
Successfully exploiting this issue allows an attacker to bypass the appli=
cation's sandbox security model and scan other hosts that are connected t=
o the computer running the vulnerable application.
80. IBM Lotus Sametime Server WebRunMenuFrame Cross-Site Scripting Vulner=
ability
BugTraq ID: 26734
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26734
Summary:
IBM Lotus Sametime Server is prone to a cross-site scripting vulnerabilit=
y because the application fails to properly sanitize user-supplied input.=
=20
=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user. This may help the attacker steal cook=
ie-based authentication credentials and launch other attacks.
This issue affects versions prior to Sametime Server 8.0.
81. Mozilla Firefox About:Blank IFrame Cross Domain Information Disclosur=
e Vulnerability
BugTraq ID: 24286
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/24286
Summary:
Mozilla Firefox is prone to a cross-domain information-disclosure vulnera=
bility because scripts may persist across navigations.=20
A malicious site may be able to modify the iframe of a site in an arbitra=
ry external domain. Attackers could exploit this to gain access to sensit=
ive information that is associated with the external domain. Other attack=
s are also possible, such as executing script code in other browser secur=
ity zones.
This issue is being tracked by Bugzilla Bug 382686 and is reportedly rela=
ted to Bug 343168.
Firefox 2.0.0.4 and prior versions are vulnerable.
82. CUPS SSL Negotiation Unspecified Remote Denial of Service Vulnerabili=
ty
BugTraq ID: 26524
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26524
Summary:
CUPS is prone to an unspecified remote denial-of-service vulnerability wh=
en handling SSL connection requests.
Successfully exploiting this issue allows remote attackers to cause the a=
ffected service to crash, denying further service to legitimate users.
This vulnerability is related to the issue described in BID 23127 (CUPS P=
artial SSL Connection Remote Denial of Service Vulnerability).
83. Samba Send_MailSlot Stack-Based Buffer Overflow Vulnerability
BugTraq ID: 26791
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26791
Summary:
Samba is prone to a remote stack-based buffer-overflow vulnerability beca=
use it fails to properly bounds-check user-supplied data before copying i=
t to an insufficiently sized memory buffer.
NOTE: This issue occurs only when the 'domain logons' option is enabled.
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges. Successful attacks will completely compromise affected com=
puters. Failed exploit attempts will result in a denial of service.
84. Novell Client for Windows NWFILTER.SYS Local Privilege Escalation Vul=
nerability
BugTraq ID: 26420
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26420
Summary:
Novell Client for Windows is prone to a local privilege-escalation vulner=
ability because it fails to adequately handle user-supplied input.
Authenticated attackers with the privileges to invoke executables can ex=
ploit this issue to execute arbitrary code with kernel-level privileges.
Novell Client for Windows 4.91 is vulnerable; other versions may also be =
affected.
85. Microsoft Internet Explorer mshtml.dll Remote Memory Corruption Vulne=
rability
BugTraq ID: 26506
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26506
Summary:
Microsoft Internet Explorer is prone to a remote memory-corruption vulner=
ability.
Attackers can exploit this issue to execute arbitrary code in the context=
of the user running the application. Successful exploits will compromise=
the user's account and possibly the underlying computer. Failed attacks =
will cause denial-of-service conditions.
86. Google Web Toolkit Benchmark Reporting System Unspecified Cross-Site =
Scripting Vulnerability
BugTraq ID: 26915
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26915
Summary:
Google Web Toolkit is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.=20
This issue affects versions prior to Google Web Toolkit 1.4.61.
87. Mozilla Firefox 2.0.0.4 Multiple Remote Vulnerabilities
BugTraq ID: 24946
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/24946
Summary:
The Mozilla Foundation has released four security advisories specifying m=
ultiple vulnerabilities in Firefox 2.0.0.4.
These vulnerabilities allow attackers to:
- Execute arbitrary code
- Execute code with chrome privileges
- Perform cross-site scripting attacks
- Crash Firefox in a myriad of ways, with evidence of memory corruption.
Other attacks may also be possible.
88. MySQL Server InnoDB CONVERT_SEARCH_MODE_TO_INNOBASE Function Denial O=
f Service Vulnerability
BugTraq ID: 26353
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26353
Summary:
MySQL is prone to a remote denial-of-service vulnerability because the da=
tabase server fails to properly handle unexpected input.
Exploiting this issue allows remote attackers to crash affected database =
servers, denying service to legitimate users. Attackers must be able to e=
xecute arbitrary SQL statements on affected servers, which requires valid=
credentials to connect to affected servers.
This issue affects MySQL 5.1.23 and prior versions.
89. Subdreamer CMS Comments Function Security Bypass Vulnerability
BugTraq ID: 26595
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26595
Summary:
Subdreamer CMS is prone to a security-bypass vulnerability because it fai=
ls to properly validate user credentials before performing certain action=
s.
A successful attack will allow an unauthorized attacker to post arbitrary=
comments when anonymous posting is disabled.
This issue affects Subdreamer CMS 2.4.3.1 and prior versions.
90. PHP 5.2.3 and Prior Versions Multiple Vulnerabilities
BugTraq ID: 25498
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/25498
Summary:
PHP 5.2.3 and prior versions are prone to multiple security vulnerabiliti=
es. Successful exploits could allow an attacker to bypass security restri=
ctions, cause a denial-of-service condition, and potentially execute code=
.
91. MWOpen E-Commerce leggi_commenti.asp SQL Injection Vulnerability
BugTraq ID: 26746
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26746
Summary:
MWOpen E-Commerce is prone to an SQL-injection vulnerability because it f=
ails to sufficiently sanitize user-supplied data before using it in an SQ=
L query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
92. Linux Kernel 'hrtimers' Local Denial of Service Vulnerability
BugTraq ID: 26880
Remote: No
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26880
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability beca=
use it fails to properly handle certain 'hrtimers' relative timeout value=
s.
Attackers can exploit this issue to trigger kernel crashes, denying servi=
ce to legitimate users. Given the nature of this issue, attackers may als=
o be able to execute arbitrary code, but this has not been confirmed.
Versions prior to Linux kernel 2.6.23.10 are vulnerable.
93. Microsoft Internet Explorer cloneNode() and nodeValue() Remote Memory=
Corruption Vulnerability
BugTraq ID: 26816
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26816
Summary:
Microsoft Internet Explorer is prone to a remote memory-corruption vulner=
ability.
Attackers can exploit this issue to execute arbitrary code in the context=
of the user running the application. Successful exploits will compromise=
the user's account and possibly the underlying computer. Failed attacks =
will cause denial-of-service conditions.
94. Microsoft Windows Media Format Runtime ASF File Remote Code Execution=
Vulnerability
BugTraq ID: 26776
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26776
Summary:
Windows Media Player is prone to a remote code-execution vulnerability be=
cause it fails to properly handle malformed media files.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the user running the application. Failed ex=
ploit attempts likely result in denial-of-service conditions.
95. 3proxy HTTP Proxy Request Buffer Overflow Vulnerability
BugTraq ID: 23545
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/23545
Summary:
3proxy is prone to a buffer-overflow vulnerability because it fails to ad=
equately bounds-check user-supplied data before copying it to an insuffic=
iently sized buffer.
Attackers can exploit this issue to cause denial-of-service conditions an=
d possibly to execute arbitrary code with the privileges of the applicati=
on.
3proxy 0.5 to 0.5.3g and 0.6b-devel before 20070413 are vulnerable to thi=
s issue.
96. iMesh 'IMWebControl' ActiveX Control Code Execution Vulnerability
BugTraq ID: 26916
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26916
Summary:
iMesh is prone to a code-execution vulnerability because the application =
fails to sanitize user-supplied data, which can lead to memory corruption=
.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using an affected ActiveX c=
ontrol (typically Internet Explorer). Failed exploit attempts likely resu=
lt in denial-of-service conditions.
iMesh 7.1.0.37263 and prior versions are reported affected by this issue.
97. phpMyChat Multiple Scripts and Parameters Cross-Site Scripting Vulner=
abilities
BugTraq ID: 26698
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26698
Summary:
phpMyChat is prone to multiple cross-site scripting vulnerabilities becau=
se it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
phpMyChat 0.14.5 is vulnerable; other versions may also be affected.
98. IBM Lotus Domino Information Disclosure Vulnerabilities and Buffer Ov=
erflow Vulnerability
BugTraq ID: 26176
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/26176
Summary:
IBM Lotus Domino is prone to multiple information-disclosure vulnerabilit=
ies and a buffer-overflow vulnerability.=20
An attacker can exploit these issues to obtain sensitive information, exe=
cute arbitrary code with the SYSTEM-level privileges, and crash the affec=
ted application.
99. Mozilla Firefox WYCIWYG:// URI Cache Zone Bypass Vulnerability
BugTraq ID: 24831
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/24831
Summary:
Mozilla Firefox is prone to a cache-zone-bypass vulnerability because the=
application fails to properly block remote access to special internally =
generated URIs containing cached data.
Exploiting this issue allows remote attackers to access potentially sensi=
tive information and to place markers with similar functionality to cooki=
es onto targeted users' computers, regardless of cookie security settings=
. Information harvested in successful exploits may aid in further attacks=
.
Attackers may also potentially exploit this issue to perform cache-poison=
ing or URL-spoofing attacks.
This issue is being tracked by Mozilla's Bugzilla Bug 387333.
100. Lighttpd Mod_FastCGI Request Headers Remote Header Overflow Vulnerab=
ility
BugTraq ID: 25622
Remote: Yes
Last Updated: 2007-12-19
Relevant URL: http://www.securityfocus.com/bid/25622
Summary:
Lighttpd is prone to a remote header-overflow vulnerability because the a=
pplication fails to properly bounds-check user-supplied data before copyi=
ng it.
An attacker may exploit this issue to overwrite PHP headers such as 'SCRI=
PT_FILENAME'. This may allow the attacker to execute to script code, obta=
in sensitive information, and launch other attacks. Exploiting this issue=
may also aid in the remote compromise of an affected computer.
Lighttpd 1.4.17 is vulnerable; prior versions may also be affected.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Senate delays vote on spy bill
By: Robert Lemos
A bill that would modernize the United States' legal framework for eavesd=
ropping and grant telecommunications companies retroactive immunity for w=
iretapping customers will have to wait until January.
http://www.securityfocus.com/news/11498
2. Researchers reverse Netflix anonymization
By: Robert Lemos
Two computer scientists show that a large set of transactional data poses=
privacy risks by finding a way to link movie ratings from the Netflix Pr=
ize dataset to publicly available information.
http://www.securityfocus.com/news/11497
3. Group drafts rules to nix credit-card storage=20
By: Robert Lemos
The organization responsible for technical and best-practice standards in=
the payment industry plans to require the makers of merchant software to=
certify that their programs do not store sensitive data.
http://www.securityfocus.com/news/11496
4. Task force aims to improve U.S. cybersecurity
By: Robert Lemos
A blue-ribbon panel of three dozen security experts hopes to craft a stra=
tegy to improve cybersecurity by the time the next president takes office=
.
http://www.securityfocus.com/news/11494
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Security Engineer, New York
http://www.securityfocus.com/archive/77/485239
2. [SJ-JOB] Security Engineer, lake success
http://www.securityfocus.com/archive/77/485241
3. [SJ-JOB] Sales Representative, New York
http://www.securityfocus.com/archive/77/485243
4. [SJ-JOB] Sr. Security Engineer, Seattle
http://www.securityfocus.com/archive/77/485244
5. [SJ-JOB] Sr. Security Engineer, San Mateo
http://www.securityfocus.com/archive/77/485231
6. [SJ-JOB] Senior Software Engineer, San Mateo
http://www.securityfocus.com/archive/77/485242
7. [SJ-JOB] Security Architect, Calgary
http://www.securityfocus.com/archive/77/485219
8. [SJ-JOB] Principal Software Engineer, Pasadena
http://www.securityfocus.com/archive/77/485228
9. [SJ-JOB] VP of Regional Sales, San Mateo
http://www.securityfocus.com/archive/77/485230
10. [SJ-JOB] Security Architect, San Mateo
http://www.securityfocus.com/archive/77/485232
11. [SJ-JOB] Security Engineer, New York
http://www.securityfocus.com/archive/77/485216
12. [SJ-JOB] Security System Administrator, Cambridgeshire
http://www.securityfocus.com/archive/77/485218
13. [SJ-JOB] Security Product Manager, San Mateo
http://www.securityfocus.com/archive/77/485217
14. [SJ-JOB] Forensics Engineer, London
http://www.securityfocus.com/archive/77/485229
15. [SJ-JOB] Sales Representative, San Mateo
http://www.securityfocus.com/archive/77/485206
16. [SJ-JOB] Information Assurance Analyst, Seattle
http://www.securityfocus.com/archive/77/485208
17. [SJ-JOB] Security Product Marketing Manager, San Mateo
http://www.securityfocus.com/archive/77/485209
18. [SJ-JOB] Application Security Architect, Stamford
http://www.securityfocus.com/archive/77/485210
19. [SJ-JOB] Forensics Engineer, London
http://www.securityfocus.com/archive/77/485215
20. [SJ-JOB] Information Assurance Engineer, Crystal City/NOVA
http://www.securityfocus.com/archive/77/485204
V. INCIDENTS LIST SUMMARY
---------------------------
1. Port 1234 UDP traffic increase?
http://www.securityfocus.com/archive/75/485084
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. overwriting SEH and debugging
http://www.securityfocus.com/archive/82/485386
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This issue is Sponsored by: The Computer Forensics Show
Imangine the ability to view anything that ever appeared on almost any co=
mputer. The Computer Forensics Show is the "DON"T MISS" event of the year=
for IT professionals
The Computer Forensics Show
February 4-6, 2008
Washington Convention Center
Washington D.C.
www.computerforensicshow.com