SecurityFocus Newsletter #444
[email protected] 13 Mar 2008 07:33:39 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #444
----------------------------------------
This issue is sponsored by bMighty
How Much Will A Security Breech Cost Your Company? =20
Many smaller businesses have lax security policies, leaving their custome=
rs' confidential data vulnerable to identity thieves. Learn the steps to =
protect sensitive data.
www.bMighty.com
http://www.bmighty.com/security/showArticle.jhtml?articleID=3D206901276&c=
id=3DLSM-sfS
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1.Integrating More Intelligence into Your IDS, Part 1
2.Let's Go Crazy
II. BUGTRAQ SUMMARY
1. Project Alumni Index.PHP Act Parameter Local File Include Vulne=
rability
2. RealPlayer/HelixPlayer ParseWallClockValue Function Buffer Over=
flow Vulnerability
3. ASG-Sentry 7.0.0 Multiple Remote Vulnerabilities
4. IBM WebSphere Application Server WebContainer HTTP Request Head=
er Security Weakness
5. DeluxeBB CP.PHP Security Bypass Vulnerability
6. Fcron Convert-FCronTab Directory Traversal Vulnerability
7. Motorola Timbuktu Pro Multiple Denial of Service Vulnerabilitie=
s
8. ZephyrSoft Toolbox Address Book Continued Multiple SQL Injectio=
n Vulnerabilities
9. Adobe Flash Player On Opera Browser For Mac OSX Unspecified Vul=
nerability
10. ZyXEL ZyWALL Quagga And Zebra Processes Default Account Passwo=
rd Vulnerability
11. RealPlayer/HelixPlayer AU Divide-By-Zero Denial of Service Vul=
nerability
12. SAP MaxDB 'vserver' Component Remote Heap Memory Corruption Vu=
lnerability
13. XWork AltSyntax OGNL Input Validation Vulnerability
14. Symantec Ghost Solution Suite ARP Spoofing Authentication Bypa=
ss Vulnerability
15. PacketTrap pt360 Tool Suite PRO TFTP Server Remote Denial of S=
ervice Vulnerability
16. CourseMill Enterprise Learning Management System 'userlogin.js=
p' SQL Injection Vulnerability
17. Asterisk Host-Based Authentication Security Bypass Vulnerabili=
ty
18. PhpBBGarage Garage.PHP SQL Injection Vulnerability
19. Acronis Snap Deploy PXE Server TFTP Directory Traversal and De=
nial of Service Vulnerabilities
20. RemotelyAnywhere 'Accept-Charset' Parameter NULL Pointer Denia=
l Of Service Vulnerability
21. EncapsGallery 'file' Parameter Multiple Cross-Site Scripting V=
ulnerabilities
22. PHP-Nuke Hadith Module 'cat' Parameter SQL Injection Vulnerabi=
lity
23. QuickTicket 'qti_usr.php' SQL Injection Vulnerability
24. Kingsoft Antivirus Online Update Module ActiveX Control Remote=
Buffer Overflow Vulnerability
25. Argon Technology Client Management Services TFTP Server Direct=
ory Traversal Vulnerability
26. Acronis True Image Echo Enterprise Server Multiple Remote Deni=
al of Service Vulnerabilities
27. MySQL Rename Table Function Access Validation Vulnerability
28. Apple QuickTime MOV File STSD Heap Buffer Overflow Vulnerabili=
ty
29. OpenSSH Duplicated Block Remote Denial of Service Vulnerabilit=
y
30. Dovecot 'Tab' Character Password Check Security Bypass Vulnera=
bility
31. Project Alumni View and News Multiple SQL Injection Vulnerabil=
ities
32. Microsoft Office Web Components ActiveX Control URL Parsing Re=
mote Code Execution Vulnerability
33. OpenSSH X11 Cookie Local Authentication Bypass Vulnerability
34. ELinks HTTPS POST Request Information Disclosure Weakness
35. Gallery Multiple Unauthorized Access Vulnerability
36. Perforce P4Web Content-Length Header Remote Denial Of Service =
Vulnerability
37. Vim HelpTags Command Remote Format String Vulnerability
38. tcpdump Print-bgp.C Remote Integer Underflow Vulnerability
39. SurgeMail IMAP SEARCH Command Remote Buffer Overflow Vulnerabi=
lity
40. Yahoo! Toolbar Helper Class ActiveX Control Remote Buffer Over=
flow Denial of Service Vulnerability
41. CHCounter Stats/Index.PHP HTML Injection Vulnerability
42. Novell GroupWise Man In The Middle Vulnerability
43. MySQL Alter Table Function Information Disclosure Vulnerabilit=
y
44. Apache HTTPD suEXEC Local Multiple Privilege Escalation Weakne=
sses
45. File(1) Command File_PrintF Integer Underflow Vulnerability
46. Project Alumni Multiple Cross-Site Scripting Vulnerabilities
47. I Hear U Multiple Remote Denial Of Service Vulnerabilities
48. FatWire Content Server Multiple Cross-Site Scripting Vulnerabi=
lities
49. Novell Client for Windows NWFILTER.SYS Local Privilege Escalat=
ion Vulnerability
50. Mozilla Thunderbird External-Body MIME Remote Heap Buffer Over=
flow Vulnerability
51. VMware Products Shared Folders 'MultiByteToWideChar()' Variant=
Directory Traversal Vulnerability
52. ngIRCd PART Command Parsing Denial Of Service Vulnerability
53. Xen mov_to_rr RID Local Security Bypass Vulnerability
54. IceBB HTTP_X_FORWARDED_FOR SQL Injection Vulnerability
55. Tellmatic tm_includepath Parameter Multiple Remote File Includ=
e Vulnerabilities
56. APC Switched Rack PDU Authentication Bypass Vulnerability
57. Dora Emlak Script Multiple SQL Injection Vulnerabilities
58. ISC BIND Query_AddSOA Denial Of Service Vulnerability
59. Einfacher Passworschutz Index.PHP Cross-Site Scripting Vulnera=
bility
60. Microsoft Internet Explorer DHTML Object Memory Corruption Vul=
nerability
61. TRAMP Extension For Emacs Multiple Insecure Temporary File Cre=
ation Vulnerabilities
62. X.Org X Server Composite Extension Local Buffer Overflow Vulne=
rability
63. The SWORD Project Diatheke Unspecified Remote Command Executio=
n Vulnerability
64. Sylpheed and Sylpheed-Claws POP3 Format String Vulnerability
65. QEMU Translation Block Local Denial of Service Vulnerability
66. scponly Local Arbitrary Command Execution Weakness
67. Mozilla Firefox and SeaMonkey Windows.Location Property HTTP R=
eferer Header Spoofing Weakness
68. Microsoft Windows Media Player AIFF Parsing Divide-By-Zero Den=
ial of Service Vulnerability
69. MySQL Security Invoker Privilege Escalation Vulnerability
70. Symantec System Center Reporting Server Remote Privilege Escal=
ation Vulnerability
71. Adobe Bridge Update Installer Local Privilege Escalation Vulne=
rability
72. X-Kryptor Secure Client Privilege Escalation Vulnerability
73. PHP Hash Table Overwrite Arbitrary Code Execution Vulnerabilit=
y
74. Microsoft HTML Help ActiveX Control Remote Code Execution Vuln=
erability
75. Microsoft Outlook Mailto URI Remote Code Execution Vulnerabili=
ty
76. Horde IMP and Groupware Webmail Edition Multiple Input Validat=
ion Vulnerabilities
77. RealNetworks RealPlayer 'rmoc3260.dll' ActiveX Control Memory =
Corruption Vulnerability
78. SARG User-Agent Processing HTML Injection and Stack Buffer Ove=
rflow Vulnerabilities
79. Sun Java SE Multiple Security Vulnerabilities
80. Microsoft Excel Data Validation Record Heap Memory Corruption =
Vulnerability
81. VideoLAN VLC Media Player MP4 Demuxer Remote Code Execution Vu=
lnerability
82. Wireshark 0.99.7 Multiple Denial of Service Vulnerabilities
83. onlinetools.org EasyImageCatalogue Multiple Cross-Site Scripti=
ng Vulnerabilities
84. Adobe LiveCycle Workflow Management Login Page Cross-Site Scri=
pting Vulnerability
85. Adobe ColdFusion Administration Interface Failed Login Audit V=
ulnerability
86. Red Hat Directory Server 7.1 Local Insecure Permissions Vulner=
ability
87. PHP-Nuke zClassifieds Module 'cat' Parameter SQL Injection Vul=
nerability
88. Adobe ColdFusion Multiple Cross Site Scripting Vulnerabilities
89. Bloo 'index.php' Multiple SQL Injection Vulnerabilities
90. Savvy Content Manager 'searchterms' Parameter Multiple Cross S=
ite Scripting Vulnerabilities
91. RemotelyAnywhere HTTP Service Cross-Site Scripting Vulnerabili=
ty
92. PHP-Nuke NukeC30 Module 'id_catg' Parameter SQL Injection Vuln=
erability
93. Mapbender 'factor' Parameter Remote Code Injection Vulnerabili=
ty
94. Mapbender 'mod_gazetteer_edit.php' SQL Injection Vulnerability
95. ManageEngine ServiceDesk Plus 'SolutionSearch.do' Cross-Site S=
cripting Vulnerability
96. Lighttpd 'mod_cgi' Information Disclosure Vulnerability
97. phpBB Filebase Module 'filebase.php' SQL Injection Vulnerabili=
ty
98. phpMyNewsLetter 'archives.php' SQL Injection Vulnerability
99. SAP MaxDB sdbstarter Environment Variable Local Privilege Esca=
lation Vulnerability
100. Amber Script Show_Content.PHP Local File Include Vulnerabilit=
y
III. SECURITYFOCUS NEWS
1. Browser makers focus on beating malware
2. Law makers voice concerns over cybersecurity plan
3. Worries over "good worms" rise again
4. Federal agencies miss deadline on secure configs
IV. SECURITY JOBS LIST SUMMARY
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
VII. MICROSOFT FOCUS LIST SUMMARY
1. Temp directory is odd
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1.Integrating More Intelligence into Your IDS, Part 1
By Don Parker and Ryan Wegner=20
The more an intrusion detection system (IDS) knows about the network it i=
s trying to protect, the better it will be able to protect the network. T=
his is the fundamental principle behind target-based intrusion detection,=
where an IDS knows about the hosts on the network.
http://www.securityfocus.com/infocus/1898
2.Let's Go Crazy
By Mark Rasch
On February 7, 2007 Stephanie Lenz of Gallatzin, Pennsylvania posted an i=
nnocuous video of her 18-month-old son Holden pushing a baby toy while da=
ncing to a barely recognizable song in the background.=20
http://www.securityfocus.com/columnists/467
II. BUGTRAQ SUMMARY
--------------------
1. Project Alumni Index.PHP Act Parameter Local File Include Vulnerabilit=
y
BugTraq ID: 26612
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26612
Summary:
Project Alumni is prone to a local file-include vulnerability because it =
fails to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
Project Alumni 1.0.9 is vulnerable to this issue; other versions may also=
be affected.
2. RealPlayer/HelixPlayer ParseWallClockValue Function Buffer Overflow Vu=
lnerability
BugTraq ID: 24658
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/24658
Summary:
RealPlayer and HelixPlayer are prone to a buffer-overflow vulnerability =
because the applications fail to bounds-check user-supplied data before c=
opying it into an insufficiently sized buffer.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
3. ASG-Sentry 7.0.0 Multiple Remote Vulnerabilities
BugTraq ID: 28188
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28188
Summary:
ASG-Sentry is prone to multiple remote vulnerabilities:
- A heap-based buffer-overflow vulnerability=20
- A stack-based buffer-overflow vulnerability=20
- A denial-of-service vulnerability=20
- An arbitrary-file-deletion vulnerability
An attacker can exploit these issues to execute arbitrary code within the=
context of the affected application, crash the affected application, con=
sume all CPU resources, and delete data contained in arbitrary files. Oth=
er attacks are possible.=20
These issues affect ASG-Sentry 7.0.0; other versions may also be affected=
.
4. IBM WebSphere Application Server WebContainer HTTP Request Header Secu=
rity Weakness
BugTraq ID: 26457
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/26457
Summary:
IBM WebSphere Application Server is prone to a security weakness regardin=
g an HTTP request header. The software fails to sanitize a certain HTTP h=
eader when the data is redirected to an error message.=20
An attacker may exploit this issue to steal cookie-based authentication =
credentials and launch other attacks.
5. DeluxeBB CP.PHP Security Bypass Vulnerability
BugTraq ID: 26572
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/26572
Summary:
DeluxeBB is prone to a security-bypass vulnerability because it fails to =
properly validate user credentials before performing certain actions.
A successful exploit will allow the attacker to change other users' detai=
ls, including email details and passwords. This in turn may lead to a com=
promise of the affected application.
This issue affects DeluxeBB 1.09 and prior versions.
6. Fcron Convert-FCronTab Directory Traversal Vulnerability
BugTraq ID: 25693
Remote: No
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/25693
Summary:
Fcron is prone to a directory-traversal vulnerability because it fails to=
adequately sanitize user-supplied data to 'convert-fcrontab'.
Attackers can exploit this issue via symbolic-link attacks to create or o=
verwrite arbitrary files with superuser privileges.
Fcron 2.9.5 is vulnerable; other versions may also be affected.
7. Motorola Timbuktu Pro Multiple Denial of Service Vulnerabilities
BugTraq ID: 28186
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28186
Summary:
Motorola Timbuktu Pro is prone to multiple denial-of-service vulnerabili=
ties.=20
Exploiting these issues will allow attackers to crash the affected applic=
ation, denying further service to legitimate users.
8. ZephyrSoft Toolbox Address Book Continued Multiple SQL Injection Vulne=
rabilities
BugTraq ID: 22685
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/22685
Summary:
ZephyrSoft Toolbox Address Book Continued is prone to multiple SQL-inject=
ion vulnerabilities because the application fails to properly sanitize us=
er-supplied input before using it in SQL queries.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase implementation.
ZephyrSoft Toolbox Address Book Continued versions 1.00 and 1.01 are conf=
irmed vulnerable to these issues.
9. Adobe Flash Player On Opera Browser For Mac OSX Unspecified Vulnerabil=
ity
BugTraq ID: 26274
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/26274
Summary:
Adobe Flash Player is prone to an unspecified vulnerability.
This issue occurs when Flash Player is running on Opera Browser for the M=
ac OS X operating system.
Very few technical details are currently available. We will update this B=
ID as more information emerges.
Flash Player 9.0.47.0 and prior versions are vulnerable when running on M=
ac OS X.
10. ZyXEL ZyWALL Quagga And Zebra Processes Default Account Password Vuln=
erability
BugTraq ID: 28184
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28184
Summary:
ZyXEL ZyWALL 1050 devices contain a default password for their Quagga and=
Zebra daemon processes. The device fails to change the default password=
when a legitimate user sets a new password.
=20
Attackers can use this default password to gain unauthorized access to t=
he device. By gaining administrative access to Quagga or Zebra, an attack=
er can modify network routes on the device, possibly redirecting traffic =
or denying network service to legitimate users. The attacker may also be =
able to exploit latent vulnerabilities in the daemon itself.=20
=20
ZyWALL 1050 is vulnerable; other devices may also be affected.
11. RealPlayer/HelixPlayer AU Divide-By-Zero Denial of Service Vulnerabil=
ity
BugTraq ID: 25627
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/25627
Summary:
RealPlayer and Helix Player are prone to a denial-of-service vulnerabili=
ty when handling malformed AU media files.
Successfully exploiting this issue allows remote attackers to deny servic=
e to legitimate users.
12. SAP MaxDB 'vserver' Component Remote Heap Memory Corruption Vulnerabi=
lity
BugTraq ID: 28183
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28183
Summary:
SAP MaxDB is prone to a heap-based memory-corruption vulnerability.=20
An attacker can exploit this issue to execute arbitrary code within the c=
ontext of the affected application. Successfully exploiting this issue wi=
ll compromise the affected application and possibly the underlying comput=
er.=20
This issue affects MaxDB 7.6.0.37 running on the Linux operating system.=
Other versions running on different platforms may also be affected.
13. XWork AltSyntax OGNL Input Validation Vulnerability
BugTraq ID: 25524
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/25524
Summary:
XWork is prone to an input-validation vulnerability because it fails to a=
dequately handle user-supplied input.
NOTE: This issue will occur only when the 'altSyntax' feature is enabled.
Attackers can exploit this issue to execute arbitrary OGNL expressions wi=
th the privileges of the user running the application. Successful exploit=
s can compromise the application and possibly the underlying computer.
Versions prior to XWork 2.0.4 are vulnerable.
14. Symantec Ghost Solution Suite ARP Spoofing Authentication Bypass Vuln=
erability
BugTraq ID: 27644
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/27644
Summary:
Symantec Ghost Solution Suite is prone to an authentication-bypass vulner=
ability.=20
Attackers can exploit this issue by sending a spoofed ARP packet to the a=
ffected client.
Successfully exploiting this issue will allow attackers to impersonate th=
e Symantec Ghost Solution Suite server and execute arbitrary commands on =
the client with SYSTEM-level privileges, facilitating the complete compro=
mise of affected computers.
=20
This issue affects Symantec Ghost Solution Suite 1.1, 2.0.0, and 2.0.1.
NOTE: Users who do not use the Ghost Console or the Ghost Management Agen=
t are not affected.
15. PacketTrap pt360 Tool Suite PRO TFTP Server Remote Denial of Service =
Vulnerability
BugTraq ID: 28187
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28187
Summary:
PacketTrap pt360 Tool Suite PRO TFTP server is prone to a remote denial-o=
f-service vulnerability because it fails to handle user-supplied input.
=20
Successfully exploiting this issue allows remote attackers to crash the a=
ffected application, denying service to legitimate users.
PacketTrap pt360 Tool Suite PRO TFTP server 2.0.3901.0 is affected; other=
versions may also be vulnerable.
16. CourseMill Enterprise Learning Management System 'userlogin.jsp' SQL =
Injection Vulnerability
BugTraq ID: 26865
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/26865
Summary:
CourseMill Enterprise Learning Management System is prone to an SQL-injec=
tion vulnerability because it fails to sufficiently sanitize user-supplie=
d data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
CourseMill Enterprise Learning Management 4.1 SP4 is vulnerable; other v=
ersions may also be affected.
17. Asterisk Host-Based Authentication Security Bypass Vulnerability
BugTraq ID: 26928
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/26928
Summary:
Asterisk is prone to a security-bypass vulnerability that affects the SIP=
and IAX protocols.
An attacker can exploit this issue to bypass the host-based authenticatio=
n mechanism. Successfully exploiting this issue will allow an attacker to=
impersonate any user. This may lead to false sense of security.
This issue affects versions prior to:
=20
Asterisk Open Source 1.2.26
Asterisk Open Source 1.4.16=20
Asterisk Business Edition B.2.3.6
Asterisk Business Edition C.1.0-beta8
18. PhpBBGarage Garage.PHP SQL Injection Vulnerability
BugTraq ID: 26683
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/26683
Summary:
PhpBBGarage is prone to an SQL-injection vulnerability because it fails t=
o sufficiently sanitize user-supplied data before using it in an SQL quer=
y.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects PhpBBGarage 1.2.0 Beta 3; other versions may also be a=
ffected.
19. Acronis Snap Deploy PXE Server TFTP Directory Traversal and Denial of=
Service Vulnerabilities
BugTraq ID: 28182
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28182
Summary:
Acronis Snap Deploy is prone to a directory-traversal vulnerability and a=
denial-of-service vulnerability.=20
Exploiting these issues will allow attackers to obtain sensitive informat=
ion or crash the affected application, denying further service to legitim=
ate users.
20. RemotelyAnywhere 'Accept-Charset' Parameter NULL Pointer Denial Of Se=
rvice Vulnerability
BugTraq ID: 28175
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28175
Summary:
RemotelyAnywhere is prone to a remote denial-of-service vulnerability bec=
ause it fails to adequately sanitize user-supplied input.
Exploiting this issue will cause the server to copy data to a NULL pointe=
r, which will crash the server, denying access to legitimate users.
This issue affects RemotelyAnywhere Server and Workstation 8.0.688; other=
versions may also be affected.
21. EncapsGallery 'file' Parameter Multiple Cross-Site Scripting Vulnerab=
ilities
BugTraq ID: 28178
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28178
Summary:
EncapsGallery is prone to multiple cross-site scripting vulnerabilities b=
ecause it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
EncapsGallery 1.11.2 is vulnerable to these issues; other versions may al=
so be affected.
22. PHP-Nuke Hadith Module 'cat' Parameter SQL Injection Vulnerability
BugTraq ID: 28171
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28171
Summary:
The Hadith module for PHP-Nuke is prone to an SQL-injection vulnerability=
because it fails to sufficiently sanitize user-supplied data before usin=
g it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
23. QuickTicket 'qti_usr.php' SQL Injection Vulnerability
BugTraq ID: 28176
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28176
Summary:
QuickTicket is prone to an SQL-injection vulnerability because it fails t=
o sufficiently sanitize user-supplied data before using it in an SQL quer=
y.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
QuickTicket 1.4 and 1.5.0.3 are vulnerable; other versions may also be af=
fected.
24. Kingsoft Antivirus Online Update Module ActiveX Control Remote Buffer=
Overflow Vulnerability
BugTraq ID: 28172
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28172
Summary:
Kingsoft Antivirus Online Update Module ActiveX control is prone to a buf=
fer-overflow vulnerability because it fails to bounds-check user-supplied=
data before copying it into an insufficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code in the conte=
xt of an application running the control (typically Internet Explorer). F=
ailed attacks will cause denial-of-service conditions.
25. Argon Technology Client Management Services TFTP Server Directory Tra=
versal Vulnerability
BugTraq ID: 28160
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28160
Summary:
Argon Technology Client Management Services TFTP server is prone to a dir=
ectory-traversal vulnerability because it fails to sufficiently sanitize =
user-supplied input data.
Exploiting this issue allows an attacker to access arbitrary files outsid=
e of the TFTP server root directory. This can expose sensitive informatio=
n that could help the attacker launch further attacks.
Client Management Services 1.31 and prior versions are vulnerable.
26. Acronis True Image Echo Enterprise Server Multiple Remote Denial of S=
ervice Vulnerabilities
BugTraq ID: 28169
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28169
Summary:
Acronis True Image Echo Enterprise Server is prone to multiple remote den=
ial-of-service vulnerabilities.=20
An attacker can exploit these issues to crash the affected application, =
denying service to legitimate users.
27. MySQL Rename Table Function Access Validation Vulnerability
BugTraq ID: 24016
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/24016
Summary:
MySQL is prone to an access-validation vulnerability because it fails to =
perform adequate access control.
Attackers can exploit this issue to rename arbitrary tables. This could r=
esult in denial-of-service conditions and may aid in other attacks.
Versions prior to MySQL 4.1.23, 5.0.42, and 5.1.18 are vulnerable.
28. Apple QuickTime MOV File STSD Heap Buffer Overflow Vulnerability
BugTraq ID: 23923
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/23923
Summary:
Apple QuickTime is prone to a heap-based buffer-overflow issue because it=
fails to properly check boundaries on user-supplied data before copying=
it into an insuficiently sized memory buffer.
An attacker may exploit this issue by enticing victims into opening a ma=
liciously crafted 'MOV' QuickTime movie file.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the user running the application. Failed ex=
ploit attempts likely result in denial-of-service conditions.
Versions of QuickTime 7 prior to 7.1.3 are vulnerable.
29. OpenSSH Duplicated Block Remote Denial of Service Vulnerability
BugTraq ID: 20216
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/20216
Summary:
OpenSSH is prone to a remote denial-of-service vulnerability because it f=
ails to properly handle incoming duplicate blocks.
Remote attackers may exploit this issue to consume excessive CPU resource=
s, potentially denying service to legitimate users.
This issue occurs only when OpenSSH is configured to accept SSH Version O=
ne traffic.
30. Dovecot 'Tab' Character Password Check Security Bypass Vulnerability
BugTraq ID: 28181
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/28181
Summary:
Dovecot is prone to a security-bypass vulnerability because the applicati=
on fails to adequately sanitize user-supplied input.=20
An attacker may exploit this issue to gain unauthorized access the affect=
ed application. Successful exploits will compromise the application.
Versions prior to Dovecot 1.0.13 and 1.1.rc3 are vulnerable. The vendor s=
tates that this issue affects only password databases that have blocking =
enabled.
NOTE: Reports indicate that this issue can be exploited only on versions =
after Dovecot 1.0.10, which introduced the 'skip_password_check' field.
31. Project Alumni View and News Multiple SQL Injection Vulnerabilities
BugTraq ID: 26564
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26564
Summary:
Project Alumni is prone to multiple SQL-injection vulnerabilities because=
it fails to sufficiently sanitize user-supplied data before using it in =
an SQL query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
32. Microsoft Office Web Components ActiveX Control URL Parsing Remote Co=
de Execution Vulnerability
BugTraq ID: 28135
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/28135
Summary:
Microsoft Office Web Components is prone to a remote code-execution vulne=
rability.
An attacker may exploit this issue by enticing victims into opening a mal=
iciously crafted HTML document.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts will likely result =
in denial-of-service conditions.
33. OpenSSH X11 Cookie Local Authentication Bypass Vulnerability
BugTraq ID: 25628
Remote: No
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/25628
Summary:
OpenSSH is prone to a local authentication-bypass vulnerability because t=
he software fails to properly manage trusted and untrusted X11 cookies.
Successfully exploiting this issue allows local attackers to potentially =
launch a forwarded X11 session through SSH in an unauthorized manner. Fur=
ther details are currently unavailable. We will update this BID as more i=
nformation emerges.
This issue affects OpenSSH 4.6; previous versions may be affected as wel=
l.
34. ELinks HTTPS POST Request Information Disclosure Weakness
BugTraq ID: 25799
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/25799
Summary:
ELinks is prone to an information disclosure weakness.
In certain circumstances, the application may not encrypt HTTP POST data =
sent to servers using SSL.
This issue creates a false sense of security for a user because they may =
assume that sensitive data is being encrypted before it is sent to the re=
mote server.
=20
Versions prior to ELinks 0.11.3 are vulnerable to this issue.
35. Gallery Multiple Unauthorized Access Vulnerability
BugTraq ID: 25580
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/25580
Summary:
Gallery is prone to multiple unauthorized-access vulnerabilities in the W=
ebDAC and Reupload modules.
An attacker can exploit these issues to rename items, modify items, retri=
eve item properties, locate items, replace items, and edit item data.=20
These issues affect versions prior to Gallery 2.2.3.
36. Perforce P4Web Content-Length Header Remote Denial Of Service Vulnera=
bility
BugTraq ID: 26806
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26806
Summary:
Perforce P4Web is prone to a remote denial-of-service vulnerability becau=
se it fails to handle specially crafted HTTP requests.
An attacker can exploit this issue to cause the application to consume ex=
cessive CPU and memory resources. Successful attacks will deny service to=
legitimate users.
P4Web 2006.2 and prior versions running on Windows are affected.
37. Vim HelpTags Command Remote Format String Vulnerability
BugTraq ID: 25095
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/25095
Summary:
Vim is prone to a remote format-string vulnerability because the applicat=
ion fails to properly sanitize user-supplied input before including it in=
the format-specifier argument of a formatted-printing function.
A remote attacker may execute arbitrary code with the privileges of the u=
ser running the affected application. Failed exploit attempts may cause d=
enial-of-service conditions.
=20
Vim 6.4 and 7.1 are vulnerable; other versions may also be affected.
38. tcpdump Print-bgp.C Remote Integer Underflow Vulnerability
BugTraq ID: 24965
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/24965
Summary:
The 'tcpdump' utility is prone to an integer-underflow vulnerability beca=
use it fails to bounds-check user-supplied input before copying it into a=
n insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary malicious code i=
n the context of the user running the affected application. Failed exploi=
t attempts will likely crash the affected application.
=20
This issue affects tcpdump 3.9.6 and prior versions.
39. SurgeMail IMAP SEARCH Command Remote Buffer Overflow Vulnerability
BugTraq ID: 25318
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/25318
Summary:
SurgeMail is prone to a remote buffer-overflow vulnerability because it f=
ails to properly bounds-check user-supplied input.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary machine code in the context of the affected service. Failed exploi=
t attempts likely result in denial-of-service conditions.
SurgeMail 38k is vulnerable; other versions may also be affected.
40. Yahoo! Toolbar Helper Class ActiveX Control Remote Buffer Overflow De=
nial of Service Vulnerability
BugTraq ID: 26656
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26656
Summary:
Yahoo! Toolbar ActiveX Control is prone to a buffer-overflow vulnerabilit=
y.
An attacker can exploit this issue to trigger denial-of-service condition=
s in Internet Explorer or other applications that use the vulnerable Acti=
veX control. Reports indicate that code execution is not possible, but th=
is has not been confirmed.
Yahoo! Toolbar 1.4.1 is vulnerable to this issue; other versions may also=
be affected.
41. CHCounter Stats/Index.PHP HTML Injection Vulnerability
BugTraq ID: 23462
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/23462
Summary:
chCounter is prone to an HTML-injection vulnerability because it fails to=
sufficiently sanitize user-supplied input data.
Exploiting this issue may allow an attacker to execute HTML and script co=
de in the context of the affected site, to steal cookie-based authenticat=
ion credentials, or to control how the site is rendered to the user; othe=
r attacks are also possible.
=20
chCounter 3.1.3 is vulnerable; other versions may also be affected.
42. Novell GroupWise Man In The Middle Vulnerability
BugTraq ID: 24258
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/24258
Summary:
Novell GroupWise is prone to a man-in-the-middle vulnerability. This issu=
e stems from a design error in the affected application.
An attacker may exploit this issue to access sensitive contents of encryp=
ted network traffic, such as authentication credentials. This may lead to=
other attacks.
Versions of Novell GroupWise prior to 6.5 post-SP6 and 7 SP2 are vulnerab=
le to this issue.
43. MySQL Alter Table Function Information Disclosure Vulnerability
BugTraq ID: 24008
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/24008
Summary:
MySQL is prone to an information-disclosure vulnerability because it fail=
s to perform adequate access control.
Exploiting this issue can allow an attacker to obtain potentially sensiti=
ve information from partitioned tables. Information gained could aid in f=
urther attacks.
Versions prior to 5.1.18 are vulnerable.
44. Apache HTTPD suEXEC Local Multiple Privilege Escalation Weaknesses
BugTraq ID: 23438
Remote: No
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/23438
Summary:
Apache suEXEC is prone to multiple local privilege-escalation weaknesses.
To exploit these issues, attackers must have permission to execute the ap=
plication. Permission is granted only to the same user as the webserver, =
typically 'httpd', 'apache', or 'nobody'. Attackers may gain such permiss=
ions by exploiting other applications running on the webserver such as CG=
I and PHP scripts.
A local attacker can exploit these issues to execute arbitrary code with =
the privileges of another user. Successful exploits may facilitate a comp=
romise of vulnerable computers.
Apache suEXEC 2.2.3 is vulnerable to these issues; other versions may als=
o be affected.
45. File(1) Command File_PrintF Integer Underflow Vulnerability
BugTraq ID: 23021
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/23021
Summary:
The file(1) command is prone to an integer-underflow vulnerability becaus=
e the command fails to adequately handle user-supplied data.
An attacker can leverage this issue to corrupt heap memory and execute ar=
bitrary code with the privileges of a user running the command. A success=
ful attack may result in the compromise of affected computers. Failed att=
empts will likely cause denial-of-service conditions.
Versions prior to 4.20 are vulnerable.
46. Project Alumni Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 26565
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26565
Summary:
Project Alumni is prone to multiple cross-site scripting vulnerabilities =
because it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
47. I Hear U Multiple Remote Denial Of Service Vulnerabilities
BugTraq ID: 26516
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26516
Summary:
Multiple denial-of-service vulnerabilities affect I Hear U because the ap=
plication fails to handle specially crafted packets.=20
=20
An attacker may leverage these issues to cause a remote denial-of-service=
condition in affected applications.
These issues affect versions prior to I Hear U 0.5.7.
48. FatWire Content Server Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 26472
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26472
Summary:
FatWire Content Server is prone to multiple cross-site scripting vulnerab=
ilities because it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
FatWire Content Server 6.3 is vulnerable; other versions may also be affe=
cted.
49. Novell Client for Windows NWFILTER.SYS Local Privilege Escalation Vul=
nerability
BugTraq ID: 26420
Remote: No
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26420
Summary:
Novell Client for Windows is prone to a local privilege-escalation vulner=
ability because it fails to adequately handle user-supplied input.
Authenticated attackers with the privileges to invoke executables can ex=
ploit this issue to execute arbitrary code with kernel-level privileges.
Novell Client for Windows 4.91 is vulnerable; other versions may also be =
affected.
50. Mozilla Thunderbird External-Body MIME Remote Heap Buffer Overflow Vu=
lnerability
BugTraq ID: 28012
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/28012
Summary:
Mozilla Thunderbird is prone to a remote heap-based buffer-overflow vulne=
rability because it fails to properly bounds-check user-supplied data.
Successfully exploiting this issue may allow remote attackers to execute =
arbitrary machine code in the context of the vulnerable application; fail=
ed exploit attempts will likely crash the application. This may facilitat=
e the remote compromise of affected computers.
The issue affects versions prior to Mozilla Thunderbird 2.0.0.12.
51. VMware Products Shared Folders 'MultiByteToWideChar()' Variant Direct=
ory Traversal Vulnerability
BugTraq ID: 27944
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/27944
Summary:
Multiple VMware products are prone to a directory-traversal vulnerability=
that affects shared folders.
Attackers who can access a guest operating system can exploit this issue =
to gain full read and write access to the filesystem of the host operatin=
g system. Successful attacks could compromise the affected host OS. Other=
attacks are possible.
NOTE: This vulnerability occurs only on Windows hosts when 'Shared Folder=
s' is enabled and when a shared folder exists.
The issue affects the following:
VMware Workstation 6.0.2, 5.5.4, and earlier
VMware Player 2.0.2, 1.0.4, and earlier
VMware ACE 2.0.2, 1.0.2, and earlier.
NOTE: This issue occurs because of a fix that was introduced to address a=
similar issue (CVE-2007-1744) that is documented in BID 23721 (VMware Wo=
rkstation Shared Folders Directory Traversal Vulnerability).
52. ngIRCd PART Command Parsing Denial Of Service Vulnerability
BugTraq ID: 27318
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/27318
Summary:
ngIRCd is prone to a denial-of-service vulnerability.
Attackers can exploit this issue to deny service to legitimate users.
Versions prior to ngIRCd 0.10.4 and 0.11.0-pre2 are vulnerable.
53. Xen mov_to_rr RID Local Security Bypass Vulnerability
BugTraq ID: 26716
Remote: No
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26716
Summary:
Xen is prone to a local security-bypass vulnerability because it fails to=
validate user-supplied input.
Local attackers can leverage this issue to read memory from VT-i domains =
other than the one they have access to. This could allow attackers to obt=
ain potentially sensitive information that could aid in further attacks.
Versions prior to Xen 3.1.2 on IA64 platforms are vulnerable.
54. IceBB HTTP_X_FORWARDED_FOR SQL Injection Vulnerability
BugTraq ID: 26483
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26483
Summary:
IceBB is prone to an SQL-injection vulnerability because it fails to suff=
iciently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
IceBB 1.0-rc6 and prior versions are vulnerable.
55. Tellmatic tm_includepath Parameter Multiple Remote File Include Vulne=
rabilities
BugTraq ID: 26678
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26678
Summary:
Tellmatic is prone to multiple remote file-include vulnerabilities becaus=
e it fails to sufficiently sanitize user-supplied data.
Exploiting these issues may allow an attacker to compromise the applicati=
on and the underlying system; other attacks are also possible.
Tellmatic 1.0.7 and 1.0.7.1 are vulnerable; other versions may also be =
affected.
56. APC Switched Rack PDU Authentication Bypass Vulnerability
BugTraq ID: 26636
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26636
Summary:
APC Switched Rack PDUs (Power Distribution Units) are prone to an authent=
ication-bypass vulnerability.
Attackers can exploit this issue to gain unauthorized access to affected =
devices. Successful exploits will allow attackers to control the power di=
stribution to rack-mounted computer equipment. Attackers could leverage t=
his to cause denial-of-service conditions and possibly physical damage.
The following firmware versions running on PDU part number AP9732 are vul=
nerable:
rpdu 3.5.5
aos 3.5.6
Other versions and devices may also be affected.
57. Dora Emlak Script Multiple SQL Injection Vulnerabilities
BugTraq ID: 26574
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26574
Summary:
Dora Emlak Script is prone to multiple SQL-injection vulnerabilities beca=
use it fails to sufficiently sanitize user-supplied data before using it =
in an SQL query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
These issues affect Dora Emlak Script 2.0; other versions may also be vul=
nerable.
58. ISC BIND Query_AddSOA Denial Of Service Vulnerability
BugTraq ID: 23738
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/23738
Summary:
ISC BIND is prone to a denial-of-service vulnerability because it fails t=
o handle certain sequences of malicious queries.
NOTE: Only applications configured with the 'recursion' directive/attribu=
te enabled are vulnerable to this issue.
An attacker can exploit this issue to cause the application to exit, deny=
ing service to legitimate users.
ISC BIND 9.40, 9.5.0a1, 9.5.0a2, and 9.5.0a3 are vulnerable.
59. Einfacher Passworschutz Index.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 23395
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/23395
Summary:
Einfacher Passworschutz is prone to a cross-site scripting vulnerability =
because the application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
60. Microsoft Internet Explorer DHTML Object Memory Corruption Vulnerabil=
ity
BugTraq ID: 26427
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26427
Summary:
Microsoft Internet Explorer is prone to a remote memory-corruption vulner=
ability because it fails to adequately handle user-supplied input to cert=
ain DHTML object methods.
Attackers can exploit this issue to execute arbitrary code in the context=
of a user running the application. Successful attacks would compromise t=
he application and possibly the underlying computer. Failed attacks will =
cause denial-of-service conditions.
61. TRAMP Extension For Emacs Multiple Insecure Temporary File Creation V=
ulnerabilities
BugTraq ID: 26072
Remote: No
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26072
Summary:
The TRAMP extension for Emacs creates temporary files in an insecure mann=
er.
An attacker with local access could potentially exploit these issues to p=
erform symlink attacks, overwriting arbitrary files in the context of the=
affected application.=20
Successfully mounting a symlink attack may allow the attacker to overwrit=
e or corrupt sensitive files, which may result in a denial of service. Ot=
her attacks may also be possible.
Versions prior to TRAMP 2.1.11 are vulnerable.
62. X.Org X Server Composite Extension Local Buffer Overflow Vulnerabilit=
y
BugTraq ID: 25606
Remote: No
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/25606
Summary:
The X.Org X Window System is prone to a local buffer-overflow vulnerabili=
ty.
A local attacker can exploit this issue to execute arbitrary code with el=
evated privileges. This may facilitate a compromise of the affected compu=
ter.
63. The SWORD Project Diatheke Unspecified Remote Command Execution Vulne=
rability
BugTraq ID: 27987
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/27987
Summary:
The SWORD Project's Diatheke front-end is prone to a vulnerability that c=
an allow arbitrary shell commands to run.
Successful exploits will compromise the application and possibly the unde=
rlying webserver.
SWORD 1.5.9 is vulnerable; other versions may also be affected.
64. Sylpheed and Sylpheed-Claws POP3 Format String Vulnerability
BugTraq ID: 25430
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/25430
Summary:
Sylpheed and Sylpheed-Claws are prone to a format-string vulnerability.=20
This issue presents itself because the applications fail to properly sani=
tize POP3 server error responses that contain format specifiers.
A successful attack may crash the application or possibly lead to arbitra=
ry code execution. This may facilitate unauthorized access or privilege e=
scalation in the context of the user running the application.
Sylpheed 2.4.4, Sylpheed-Claws 1.9.100, and Sylpheed-Claws 'Claws Mail' 2=
.10.0 are vulnerable to this issue; other versions may also be affected.
65. QEMU Translation Block Local Denial of Service Vulnerability
BugTraq ID: 26666
Remote: No
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26666
Summary:
QEMU is prone to a local denial-of-service vulnerability because it fails=
to perform adequate boundary checks when handling user-supplied input.
Attackers can exploit this issue to cause denial-of-service conditions. G=
iven the nature of the issue, attackers may also be able to execute arbit=
rary code, but this has not been confirmed.
QEMU 0.9.0 is vulnerable; other versions may also be affected.
66. scponly Local Arbitrary Command Execution Weakness
BugTraq ID: 26900
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26900
Summary:
The 'scponly' program is prone to a weakness that can allow attackers to =
execute arbitrary commands.
Attackers with scponly access can exploit this issue to bypass scponly se=
curity restrictions. Successful attacks could compromise affected compute=
rs.
This issue affects scponly 4.6; other versions may also be affected.
67. Mozilla Firefox and SeaMonkey Windows.Location Property HTTP Referer =
Header Spoofing Weakness
BugTraq ID: 26589
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26589
Summary:
Mozilla Firefox and SeaMonkey are prone to a weakness that allows an atta=
cker to spoof HTTP Referer headers. This issue stems from a race conditio=
n in the affected application. The weakness arises because of a small tim=
ing difference when using a modal 'alert()' dialog, which allows users to=
generate fake HTTP Referer headers.
An attacker can exploit this issue to spoof HTTP referer headers. This ma=
y cause other security mechanisms that rely on this data to fail or to re=
turn misleading information.
This issue affects versions prior to Mozilla FireFox 2.0.0.10 and Mozill=
a SeaMonkey 1.1.7.
68. Microsoft Windows Media Player AIFF Parsing Divide-By-Zero Denial of =
Service Vulnerability
BugTraq ID: 26648
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/26648
Summary:
Microsoft Windows Media Player is prone to a denial-of-service vulnerabil=
ity when processing a malformed AIFF file.=20
A remote attacker can exploit this issue to crash the affected applicatio=
n, denying service to legitimate users.
This issue affects Microsoft Windows Media Player 11; other versions may =
also be affected.
69. MySQL Security Invoker Privilege Escalation Vulnerability
BugTraq ID: 24011
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/24011
Summary:
MySQL is prone to a privilege-escalation vulnerability because it fails t=
o adequately restore access privileges during certain routines.
A remote authenticated attacker can exploit this issue to gain elevated p=
rivileges on an affected database.
These versions are vulnerable:
MySQL 5 prior to 5.0.40
MySQL 5.1 prior to 5.1.18
70. Symantec System Center Reporting Server Remote Privilege Escalation V=
ulnerability
BugTraq ID: 24313
Remote: Yes
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/24313
Summary:
Symantec System Center Reporting Server is prone to a remote privilege-es=
calation vulnerability.
Attackers can exploit this issue to execute malicious code on an affected=
server and gain the privileges of the user running the server. Successfu=
l attacks will compromise the application and possibly the underlying com=
puter.
Reporting Server is distributed with Symantec AntiVirus Corporate Edition=
10.1 and later and Symantec Client Security 3.1 and later.=20
Versions prior to Reporting Server 1.0.224.0, AntiVirus Corporate Edition=
10.1.6.6000, and Client Security 3.1.6.6000 are vulnerable.
71. Adobe Bridge Update Installer Local Privilege Escalation Vulnerabilit=
y
BugTraq ID: 23404
Remote: No
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/23404
Summary:
Adobe Bridge Update Installer is prone to a local privilege-escalation vu=
lnerability. This issue stems from a flaw in the update installer that al=
lows a nonadministrative user to gain administrative privileges.
Exploiting this issue allows local attackers to gain elevated privileges,=
potentially leading to a complete compromise of affected computers.
This issue affects the Bridge 1.0.3 update on the Mac OS.
72. X-Kryptor Secure Client Privilege Escalation Vulnerability
BugTraq ID: 22424
Remote: No
Last Updated: 2008-03-13
Relevant URL: http://www.securityfocus.com/bid/22424
Summary:
X-Kryptor Secure Client is is prone to a local privilege-escalation vulne=
rability.=20
A local attacker may execute arbitrary code with SYSTEM privileges to com=
pletely compromise a vulnerable computer.
73. PHP Hash Table Overwrite Arbitrary Code Execution Vulnerability
BugTraq ID: 23119
Remote: No
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/23119
Summary:
PHP is prone to an arbitrary-code-execution vulnerability.=20
An attacker may exploit this issue to execute arbitrary code within the c=
ontext of the affected webserver.
This issue affects PHP 4 (prior to 4.4.5) and PHP 5 (prior to 5.2.1).
74. Microsoft HTML Help ActiveX Control Remote Code Execution Vulnerabili=
ty
BugTraq ID: 22478
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/22478
Summary:
The Microsoft HTML Help ActiveX control is prone to a remote code-executi=
on vulnerability.=20
An attacker could exploit this issue to execute code in the context of th=
e user visiting a malicious web page.
75. Microsoft Outlook Mailto URI Remote Code Execution Vulnerability
BugTraq ID: 28147
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28147
Summary:
Microsoft Outlook is prone to a remote code-execution vulnerability becau=
se the application fails to adequately validate user-supplied data.
Successfully exploiting this issue will allow attackers to execute arbitr=
ary code with the privileges of the currently logged-in user. This will f=
acilitate the remote compromise of affected computers.
76. Horde IMP and Groupware Webmail Edition Multiple Input Validation Vul=
nerabilities
BugTraq ID: 27223
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/27223
Summary:
Horde IMP and Groupware Webmail Edition are prone to multiple input-valid=
ation vulnerabilities because the software fails to sanitize certain HTML=
and HTTP data.
Attackers can leverage these issues to have malicious HTML rendered in th=
e client, to delete arbitrary email messages, and to purge deleted email =
messages.
IMP 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail=
Edition 1.0.3 are vulnerable; other versions may also be affected.
77. RealNetworks RealPlayer 'rmoc3260.dll' ActiveX Control Memory Corrupt=
ion Vulnerability
BugTraq ID: 28157
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28157
Summary:
RealNetworks RealPlayer 'rmoc3260.dll' ActiveX control is prone to a memo=
ry-corruption vulnerability.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the affected ActiveX =
control. Failed exploit attempts will likely crash the application.
78. SARG User-Agent Processing HTML Injection and Stack Buffer Overflow V=
ulnerabilities
BugTraq ID: 28077
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28077
Summary:
SARG is prone to an HTML-injection vulnerability and a stack-based buffer=
-overflow vulnerability.=20
An attacker can exploit these issues to execute arbitrary HTML and attack=
er-supplied code in the context of the affected webserver, steal cookie-b=
ased authentication credentials, and cause a denial-of-service condition.
This issue affects SARG 2.2.3.1; prior versions may also be affected.
79. Sun Java SE Multiple Security Vulnerabilities
BugTraq ID: 28083
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28083
Summary:
Sun has released advisories addressing multiple vulnerabilities affecting=
the following software:
JDK and JRE 6 Update 5
JDK and JRE 5.0 Update 15
SDK and JRE 1.4.2_17
SDK and JRE 1.3.1_22
80. Microsoft Excel Data Validation Record Heap Memory Corruption Vulnera=
bility
BugTraq ID: 28094
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28094
Summary:
Microsoft Excel is prone to a heap memory-corruption vulnerability.
Attackers may exploit this issue by enticing victims into opening a malic=
iously crafted Excel file ('.xls').
Successful exploits may allow attackers to execute arbitrary code with th=
e privileges of the user running the application. This may facilitate a c=
ompromise of vulnerable computers.
81. VideoLAN VLC Media Player MP4 Demuxer Remote Code Execution Vulnerabi=
lity
BugTraq ID: 28007
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28007
Summary:
VideoLAN VLC media player is prone to a remote code-execution vulnerabili=
ty because it fails to adequately parse specially crafted MP4 files.
An attacker can exploit this issue to execute arbitrary code, which can r=
esult in the complete compromise of the computer. Failed exploit attempt=
s will result in a denial-of-service condition.=20
Versions prior to VideoLAN VLC media player 0.8.6e are vulnerable.
82. Wireshark 0.99.7 Multiple Denial of Service Vulnerabilities
BugTraq ID: 28025
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28025
Summary:
Wireshark is prone to multiple denial-of-service vulnerabilities.
Exploiting these issues may allow attackers to cause crashes and deny ser=
vice to legitimate users of the application. Attackers may be able to lev=
erage some of these vulnerabilities to execute arbitrary code, but this h=
as not been confirmed.
Wireshark 0.6.0 to 0.99.7 are affected.
83. onlinetools.org EasyImageCatalogue Multiple Cross-Site Scripting Vuln=
erabilities
BugTraq ID: 28164
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28164
Summary:
onlinetools.org EasyImageCatalogue is prone to multiple cross-site script=
ing vulnerabilities because it fails to properly sanitize user-supplied i=
nput.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
EasyImageCatalogue 1.31 is vulnerable; other versions may also be affecte=
d.
84. Adobe LiveCycle Workflow Management Login Page Cross-Site Scripting V=
ulnerability
BugTraq ID: 28209
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28209
Summary:
Adobe LiveCycle Workflow is prone to a cross-site scripting vulnerability=
because it fails to sufficiently sanitize user-supplied data.
An attacker could exploit this vulnerability to execute arbitrary script =
code in the context of the affected website. This may allow the attacker =
to steal cookie-based authentication credentials and to launch other atta=
cks.
85. Adobe ColdFusion Administration Interface Failed Login Audit Vulnerab=
ility
BugTraq ID: 28207
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28207
Summary:
Adobe ColdFusion is prone to a vulnerability that allows attackers to con=
ceal login attempts to the administrative interface.
Attackers can exploit this issue to hide or obfuscate actual attack trace=
s.
This issue affects ColdFusion MX 7 and ColdFusion 8.
86. Red Hat Directory Server 7.1 Local Insecure Permissions Vulnerability
BugTraq ID: 28204
Remote: No
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28204
Summary:
Red Hat Directory Server is prone to an insecure-permissions vulnerabilit=
y.
A local attacker can exploit this issue to execute arbitrary code with th=
e privileges of the user running Directory Server or its applications.
Red Hat Directory Server 7.1 prior to Service Pack 4 is vulnerable.
87. PHP-Nuke zClassifieds Module 'cat' Parameter SQL Injection Vulnerabil=
ity
BugTraq ID: 28211
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28211
Summary:
The zClassifieds module for PHP-Nuke is prone to an SQL-injection vulnera=
bility because it fails to sufficiently sanitize user-supplied data befor=
e using it in an SQL query.
=20
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
88. Adobe ColdFusion Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 28205
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28205
Summary:
Adobe ColdFusion is prone to multiple cross-site scripting vulnerabilitie=
s because the application fails to sufficiently sanitize user-supplied da=
ta.
An attacker could exploit these vulnerabilities to execute arbitrary scri=
pt code in the context of the affected website. This may allow the attack=
er to steal cookie-based authentication credentials and to launch other a=
ttacks.
These issues affect Adobe ColdFusion MX7 and 8.
89. Bloo 'index.php' Multiple SQL Injection Vulnerabilities
BugTraq ID: 28203
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28203
Summary:
Bloo is prone to multiple SQL-injection vulnerabilities because it fails =
to sufficiently sanitize user-supplied data before using it in an SQL que=
ry.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
Bloo 1.0 is vulnerable; other versions may also be affected.
90. Savvy Content Manager 'searchterms' Parameter Multiple Cross Site Scr=
ipting Vulnerabilities
BugTraq ID: 28200
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28200
Summary:
Savvy Content Manager is prone to multiple cross-site scripting vulnerabi=
lities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
91. RemotelyAnywhere HTTP Service Cross-Site Scripting Vulnerability
BugTraq ID: 28199
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28199
Summary:
RemotelyAnywhere is prone to a cross-site scripting vulnerability because=
the application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
92. PHP-Nuke NukeC30 Module 'id_catg' Parameter SQL Injection Vulnerabili=
ty
BugTraq ID: 28197
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28197
Summary:
The NukeC30 module for PHP-Nuke is prone to an SQL-injection vulnerabilit=
y because it fails to sufficiently sanitize user-supplied data before usi=
ng it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
The NukeC30 module 3.0 is affected; other versions may also be vulnerable=
.
93. Mapbender 'factor' Parameter Remote Code Injection Vulnerability
BugTraq ID: 28195
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28195
Summary:
Mapbender is prone to a remote code-injection vulnerability because the a=
pplication fails to properly sanitize user-supplied input.
Exploiting this issue allows attackers to execute arbitrary code within t=
he context of the webserver.
This issue affects Mapbender 2.4 to 2.4.4; other versions may also be aff=
ected.
94. Mapbender 'mod_gazetteer_edit.php' SQL Injection Vulnerability
BugTraq ID: 28193
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28193
Summary:
Mapbender is prone to an SQL-injection vulnerability because it fails to =
sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Versions prior to Mapbender 2.4.5 rc1 are vulnerable.
95. ManageEngine ServiceDesk Plus 'SolutionSearch.do' Cross-Site Scriptin=
g Vulnerability
BugTraq ID: 28191
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28191
Summary:
ManageEngine ServiceDesk Plus is prone to a cross-site scripting vulnerab=
ility because the application fails to properly sanitize user-supplied in=
put.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Microsoft Windows is v=
ulnerable; other versions may be affected as well.
96. Lighttpd 'mod_cgi' Information Disclosure Vulnerability
BugTraq ID: 28100
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28100
Summary:
The 'lighttpd' program is prone to a vulnerability that in certain circum=
stances may allow attackers to access source code because the application=
fails to properly handle exceptional conditions.
Attackers can exploit this vulnerability to obtain potentially sensitive =
information that may aid in further attacks.
This issue affects lighttpd 1.4.18; other versions may also be vulnerable=
.
97. phpBB Filebase Module 'filebase.php' SQL Injection Vulnerability
BugTraq ID: 28194
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28194
Summary:
phpBB Filebase module is prone to an SQL-injection vulnerability because =
it fails to sufficiently sanitize user-supplied data before using it in a=
n SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
All versions are considered vulnerable.
98. phpMyNewsLetter 'archives.php' SQL Injection Vulnerability
BugTraq ID: 28189
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28189
Summary:
phpMyNewsLetter is prone to an SQL-injection vulnerability because it fai=
ls to sufficiently sanitize user-supplied data before using it in an SQL =
query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
phpMyNewsLetter 0.8 beta 5 is vulnerable; other versions may also be affe=
cted.
99. SAP MaxDB sdbstarter Environment Variable Local Privilege Escalation =
Vulnerability
BugTraq ID: 28185
Remote: No
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/28185
Summary:
SAP MaxDB is prone to a local privilege-escalation vulnerability.
Exploiting this issue allows local attackers to execute arbitrary code wi=
th superuser privileges. This will lead to the complete compromise of an=
affected computer.
This issue affects MaxDB 7.6.0.37 on both Linux and Solaris platforms. O=
ther UNIX variants are most likely affected. Microsoft Windows versions =
are not vulnerable to this issue.
100. Amber Script Show_Content.PHP Local File Include Vulnerability
BugTraq ID: 26561
Remote: Yes
Last Updated: 2008-03-12
Relevant URL: http://www.securityfocus.com/bid/26561
Summary:
Amber Script is prone to a local file-include vulnerability because it fa=
ils to properly sanitize user-supplied input.
Exploiting this issue may allow an unauthorized user to view files and ex=
ecute local scripts.
Amber Script 1.0 is vulnerable to this issue; other versions may also be =
affected.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Browser makers focus on beating malware
By: Robert Lemos
Microsoft announces two features in Internet Explorer 8 aimed at better s=
ecuring Web surfers, and Mozilla incorporates more security into Firefox =
3.
http://www.securityfocus.com/news/11508
2. Law makers voice concerns over cybersecurity plan
By: Robert Lemos
Members of Congress seek more details of cyber attacks targeting the fede=
ral government and worry that the recently announced Cyber Initiative wil=
l undermine privacy.
http://www.securityfocus.com/news/11507
3. Worries over "good worms" rise again
By: Robert Lemos
A Microsoft researcher studies the use of self-propagation for patching, =
but for most of the security industry, any worm is a bad worm.
http://www.securityfocus.com/news/11506
4. Federal agencies miss deadline on secure configs
By: Robert Lemos
The U.S. government has made progress on moving to a standard configurati=
on for Windows XP and Windows Vista systems, but work remains.
http://www.securityfocus.com/news/11505
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Temp directory is odd
http://www.securityfocus.com/archive/88/489429
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This issue is sponsored by bMighty
How Much Will A Security Breech Cost Your Company? =20
Many smaller businesses have lax security policies, leaving their custome=
rs' confidential data vulnerable to identity thieves. Learn the steps to =
protect sensitive data.
www.bMighty.com
http://www.bmighty.com/security/showArticle.jhtml?articleID=3D206901276&c=
id=3DLSM-sfS