SecurityFocus Newsletter #445
[email protected] 19 Mar 2008 18:41:03 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #445
----------------------------------------
This issue is sponsored by GlobalSCAPE
Learn how GlobalSCAPE's Enhanced File Transfer (EFT) Server helped Aon's =
Human Capital division increase productivity and security by streamlining=
data transfers and data automation processes while making savings of alm=
ost $300,000. By using EFT Server they ensured the security and integrity=
of their file transfers and made it possible not only for Aon to control=
their own customizations but also to provide secure automatic data trans=
lation in real time which benefited employees and customers.
Download the AON case study - http://www.globalscape.com/files/case_AON.p=
df
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1.Catch Them if You can
2.Integrating More Intelligence into Your IDS, Part 2
II. BUGTRAQ SUMMARY
1. Easy-Clanpage 'id' Parameter SQL Injection Vulnerability
2. KAPhotoservice 'album.asp' SQL Injection Vulnerability
3. Multiple Vendor Web Browser JavaScript Key Filtering Vulnerabil=
ity
4. Adobe Acrobat Reader 'acroread' Insecure Temporary File Creatio=
n Vulnerability
5. Sun Java SE Multiple Security Vulnerabilities
6. Multiple Web Browsers Digest Authentication HTTP Response Split=
ting Vulnerability
7. Multiple Browser URI Handlers Command Injection Vulnerabilities
8. Registry Pro 'epRegPro.ocx' ActiveX Control Insecure Method And=
Buffer Overflow Vulnerabilities
9. Libpng Library Multiple Remote Denial of Service Vulnerabilitie=
s
10. PHPauction 'include_path' Parameter Multiple Remote File Inclu=
de Vulnerabilities
11. Home FTP Server Remote Denial of Service Vulnerability
12. bzip2 Unspecified File Handling Vulnerability
13. Microsoft Internet Explorer CreateTextRange.text Denial of Ser=
vice Vulnerability
14. 7-Zip Unspecified Archive Handling Vulnerability
15. Apple Mac OS X v10.4.11 2007-008 Multiple Security Vulnerabili=
ties
16. WEBalbum 'photo_add.php' Security Bypass Vulnerability
17. Apple Safari Prior to 3.1 Multiple Security Vulnerabilities
18. Mozilla Firefox URLBar Null Byte File Remote Code Execution Vu=
lnerability
19. Mozilla Firefox About:Blank IFrame Cross Domain Information Di=
sclosure Vulnerability
20. Mozilla Firefox WYCIWYG:// URI Cache Zone Bypass Vulnerability
21. Mozilla Firefox OnUnload Javascript Browser Entrapment Vulnera=
bility
22. Mozilla Firefox/Thunderbird/SeaMonkey Chrome-Loaded About:Blan=
k Script Execution Vulnerability
23. Mozilla Firefox 2.0.0.4 Multiple Remote Vulnerabilities
24. Mozilla Firefox 2.0.0.7 Multiple Remote Vulnerabilities
25. Mozilla Firefox OnKeyDown Event File Upload Vulnerability
26. VLC Media Player 'Subtitle' Buffer Overflow Vulnerability
27. Nagios Plugins SNMP GET Reply Remote Buffer Overflow Vulnerabi=
lity
28. Nagios Unspecified Cross-Site Scripting Vulnerability
29. Nagios Plugins Location Header Remote Buffer Overflow Vulnerab=
ility
30. X.Org X Server PCF Font Parser Buffer Overflow Vulnerability
31. Imperva SecureSphere Cross-Site Scripting Vulnerability
32. Info-ZIP UnZip 'inflate_dynamic()' Remote Code Execution Vulne=
rability
33. Nagios Prior to 2.11 Unspecified Cross-Site Scripting Vulnerab=
ility
34. Joomla! and Mambo Acajoom Component 'mailingid' Parameter SQL =
Injection Vulnerability
35. cPanel List Directories and Folders Information Disclosure Vul=
nerability
36. Check Point VPN-1 IP Address Collision Denial of Service Vulne=
rability
37. S9Y Serendipity Trackbacks HTML Injection Vulnerability
38. Travelsized CMS 'frontpage.php' and 'index.php' Multiple Input=
Validation Vulnerabilities
39. eForum 'busca.php' Multiple Cross Site Scripting Vulnerabiliti=
es
40. webSPELL 'index.php' Cross-Site Scripting Vulnerability
41. CUPS CGI Interface Remote Buffer Overflow Vulnerability
42. phpstats 'phpstats.php' Cross-Site Scripting Vulnerability
43. MIT Kerberos 5 KDC Multiple Memory Corruption Based Informatio=
n Disclosure Vulnerabilities
44. BusinessObjects 'RptViewerAX' ActiveX Control Stack Based Buff=
er Overflow Vulnerability
45. MoinMoin Macro Code Information Disclosure Vulnerability
46. MoinMoin MOIN_ID Cookie Remote Input Validation Vulnerability
47. MoinMoin GUI Editor Multiple Cross Site Scripting Vulnerabilit=
ies
48. HTTP File Upload ActiveX Control Arbitrary File and Directory =
Deletion Vulnerability
49. Libpng Library ICC Profile Chunk Off-By-One Denial of Service =
Vulnerability
50. Libpng Library Remote Denial of Service Vulnerability
51. libpng Graphics Library Chunk Error Processing Buffer Overflow=
Vulnerability
52. PHP .Htaccess Safe_Mode and Open_Basedir Restriction-Bypass Vu=
lnerability
53. PHP 5.2.4 and Prior Versions Multiple Vulnerabilities
54. File Multiple Denial of Service Vulnerabilities
55. Apple Mac OS X Security Update 2006-003 Multiple Vulnerabiliti=
es
56. cURL / libcURL URL Parser Buffer Overflow Vulnerability
57. MoinMoin Multiple Cross Site Scripting Vulnerabilities
58. MIT Kerberos5 kadmind Excessive File Descriptors Multiple Remo=
te Code Execution Vulnerabilities
59. Apple Mac OS X Server Wiki Server Directory Traversal Vulnerab=
ility
60. The 'libpng' Graphics Library PNG_SET_SPLT Remote Denial of Se=
rvice Vulnerability
61. PHP EXT/Session HTTP Response Header Injection Vulnerability
62. PHP 5.2.3 and Prior Versions Multiple Vulnerabilities
63. GNU Emacs Local Variable Handling Code Execution Vulnerability
64. CUPS 'process_browse_data()' Remote Double Free Denial of Serv=
ice Vulnerability
65. CUPS Multiple Remote Denial of Service Vulnerabilities
66. OpenSSH X11 Cookie Local Authentication Bypass Vulnerability
67. MIT Kerberos Multiple Memory Corruption Vulnerabilities
68. X.Org X Server 'MIT-SHM' Local Privilege Escalation Vulnerabil=
ity
69. X.Org X Server 'TOG-CUP' Extension Local Privilege Escalation =
Vulnerability
70. X.Org X Server 'Xinput' Extension Local Privilege Escalation V=
ulnerability
71. X.Org X Font Server Multiple Memory Corruption Vulnerabilities
72. ClamAV Attachment Wrapping Denial Of Service Vulnerability
73. X.Org X Server 'EVI' Extension Local Privilege Escalation Vuln=
erability
74. X.Org X 'Server X:1 -sp' Command Information Disclosure Vulner=
ability
75. ClamAV CAB File Remote Denial of Service Vulnerability
76. ClamAV Multiple Remote Vulnerabilities
77. ClamAV MIME Header ID Parameter String Directory Traversal Vul=
nerability
78. ClamAV BZ_GET_FAST Bzip2 Decompression Vulnerability
79. ClamAV Popen Function Remote Code Execution Vulnerability
80. ClamAV Heap Corruption and Integer Overflow Vulnerabilities
81. ClamAV Multiple Remote Denial of Service Vulnerabilities
82. ClamAV 'libclamav/pe.c' MEW Packed PE File Integer Overflow Vu=
lnerability
83. ClamAV 'mspack.c' Off-By-One Buffer Overflow Vulnerability
84. Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerab=
ility
85. Apache 'mod_proxy_balancer' Multiple Vulnerabilities
86. Apache 'mod_proxy_ftp' Undefined Charset UTF-7 Cross-Site Scri=
pting Vulnerability
87. Joomla! and Mambo joovideo Component 'id' Parameter SQL Inject=
ion Vulnerability
88. Belkin F5D7230-4 Wireless G Router IP-Based Authentication Sta=
te Authentication Bypass Vulnerability
89. Iatek PortalApp 'links.asp' SQL Injection Vulnerability
90. HP StorageWorks Library and Tape Tools Unspecified Local Secur=
ity Bypass Vulnerability
91. MyBlog SQL Injection and Remote File Include Vulnerabilities
92. xine-lib 'sdpplin_parse()' Remote Buffer Overflow Vulnerabilit=
y
93. Apache HTTP Server Mod_Proxy Denial of Service Vulnerability
94. PCRE Regular Expression Library Multiple Security Vulnerabilit=
ies
95. Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
96. Apple Mac OS X 2008-002 Multiple Security Vulnerabilities
97. Apache Mod_IMAP Referer Cross-Site Scripting Vulnerability
98. Apache HTTP Server 413 Error HTTP Request Method Cross-Site Sc=
ripting Weakness
99. Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross=
-Site Scripting Vulnerability
100. Trend Micro OfficeScan Buffer Overflow Vulnerability and Deni=
al of Service Vulnerability
III. SECURITYFOCUS NEWS
1. House aims to scrutinize warrantless taps
2. Browser makers focus on beating malware
3. Law makers voice concerns over cybersecurity plan
4. Worries over "good worms" rise again
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Security Consultant, London, Bristol or Birmingham
2. [SJ-JOB] Penetration Engineer, West Sussex
3. [SJ-JOB] Application Security Architect, London
4. [SJ-JOB] Account Manager, London
5. [SJ-JOB] Sr. Security Engineer, Brook Park
6. [SJ-JOB] Director, Information Security, Costa Mesa
7. [SJ-JOB] Penetration Engineer, Bristol
8. [SJ-JOB] Jr. Security Analyst, Melville
9. [SJ-JOB] Application Security Architect, Princeton
10. [SJ-JOB] Management, Kansas City
11. [SJ-JOB] Security Consultant, Minneapolis
12. [SJ-JOB] Security Consultant, Minneapolis
13. [SJ-JOB] Database Security Architect, New York
14. [SJ-JOB] Developer, Alpharetta
15. [SJ-JOB] Remediation Security Analyst, New York
16. [SJ-JOB] Sales Representative, Kansas City
17. [SJ-JOB] Sales Engineer, New York City
18. [SJ-JOB] Security Consultant, Minneapolis
19. [SJ-JOB] Sales Engineer, Nashville
20. [SJ-JOB] Security Consultant, Minneapolis
21. [SJ-JOB] Security System Administrator, San Antonio
22. [SJ-JOB] Developer, Calgary
23. [SJ-JOB] Developer, Ciudad de Buenos Aires - Palermo
24. [SJ-JOB] Developer, Ciudad de Buenos Aires - Palermo
25. [SJ-JOB] Senior Software Engineer, Alpharetta
26. [SJ-JOB] Technical Writer, Ciudad de Buenos Aires - Palermo
27. [SJ-JOB] Penetration Engineer, UK WIDE
28. [SJ-JOB] Information Assurance Analyst, Boulder
29. [SJ-JOB] Security Engineer, Austin
30. [SJ-JOB] Software Engineer, Cupertino
31. [SJ-JOB] Security Auditor, Arlington
32. [SJ-JOB] Disaster Recovery Coordinator, Saint Charles
33. [SJ-JOB] Security System Administrator, London
34. [SJ-JOB] Sales Engineer, Dallas
35. [SJ-JOB] Security System Administrator, Jersey City
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
VII. MICROSOFT FOCUS LIST SUMMARY
1. More along the lines of malware disinfection
2. Compromised WinXP box prob
3. SecurityFocus Microsoft Newsletter #385
4. Temp directory is odd
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1.Catch Them if You Can
By Don Parker
High-profile network security breaches have proliferated over the past fe=
w years. While many "breaches" consist of lost data or a stolen laptop, t=
rue breaches -- where a online attacker compromises a network and removes=
data -- have become very common
http://www.securityfocus.com/columnists/468
2.Integrating More Intelligence into Your IDS, Part 2
By Don Parker and Ryan Wegner=20
The more an intrusion detection system (IDS) knows about the network it i=
s trying to protect, the better it will be able to protect the network. T=
his is the fundamental principle behind target-based intrusion detection,=
where an IDS knows about the hosts on the network.
http://www.securityfocus.com/infocus/1899
II. BUGTRAQ SUMMARY
--------------------
1. Easy-Clanpage 'id' Parameter SQL Injection Vulnerability
BugTraq ID: 28309
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28309
Summary:
Easy-Clanpage is prone to an SQL-injection vulnerability because it fails=
to sufficiently sanitize user-supplied data before using it in an SQL qu=
ery.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Easy-Clanpage 2.2 is vulnerable; other versions may be affected as well.
2. KAPhotoservice 'album.asp' SQL Injection Vulnerability
BugTraq ID: 28306
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28306
Summary:
KAPhotoservice is prone to an SQL-injection vulnerability because it fail=
s to sufficiently sanitize user-supplied data before using it in an SQL q=
uery.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
3. Multiple Vendor Web Browser JavaScript Key Filtering Vulnerability
BugTraq ID: 18308
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/18308
Summary:
Multiple web browsers are prone to a JavaScript key-filtering vulnerabili=
ty because the browsers fail to securely handle keystroke input from user=
s.
This issue is demonstrated to allow attackers to divert keystrokes from o=
ne input form in a webpage to a hidden file-upload dialog in the same pag=
e. This may allow remote attackers to initiate file uploads from unsuspec=
ting users. Other attacks may also be possible.
Exploiting this issue requires that users manually type the full path of =
files that attackers wish to download. This may require substantial typin=
g from targeted users, so attackers will likely use keyboard-based games,=
blogs, or other similar pages to entice users to enter the required keyb=
oard input to exploit this issue.
Reportedly, Mozilla Suite, Mozilla Firefox, Mozilla SeaMonkey, Netscape N=
avigator, and Microsoft Internet Explorer are all vulnerable to this issu=
e.
4. Adobe Acrobat Reader 'acroread' Insecure Temporary File Creation Vulne=
rability
BugTraq ID: 28091
Remote: No
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28091
Summary:
The 'acroread' script of the Adobe Acrobat Reader package creates tempora=
ry files in an insecure manner.
An attacker with local access could potentially exploit this issue to per=
form symbolic-link attacks, overwriting arbitrary files in the context of=
the affected application.=20
Successfully mounting a symlink attack may allow the attacker to delete o=
r corrupt sensitive files, which may result in a denial of service. Other=
attacks may also be possible.
This issue affects Adobe Reader 8.1.2 for Unix; other versions may also b=
e vulnerable.
5. Sun Java SE Multiple Security Vulnerabilities
BugTraq ID: 28083
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28083
Summary:
Sun has released advisories addressing multiple vulnerabilities affecting=
the following software:
JDK and JRE 6 Update 5
JDK and JRE 5.0 Update 15
SDK and JRE 1.4.2_17
SDK and JRE 1.3.1_22
6. Multiple Web Browsers Digest Authentication HTTP Response Splitting Vu=
lnerability
BugTraq ID: 23668
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/23668
Summary:
Multiple browsers are prone to an HTTP-response-splitting vulnerability b=
ecause the software fails to properly sanitize user-supplied input.=20
A remote attacker may exploit this vulnerability to influence or misrepre=
sent how web content is served, cached, or interpreted. This could aid in=
various attacks that try to entice client users into a false sense of tr=
ust.=20
This issue affects Microsoft Internet Explorer 7.0.5730.11 and Mozilla Fi=
refox 2.0.0.3; other versions and browsers may also be affected.
7. Multiple Browser URI Handlers Command Injection Vulnerabilities
BugTraq ID: 25053
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/25053
Summary:
Multiple browsers are prone to vulnerabilities that let attackers inject =
commands through various protocol handlers.
Exploiting these issues allows remote attackers to pass and execute arbit=
rary commands and arguments through processes such as 'cmd.exe' by employ=
ing various URI handlers.
An attacker can exploit these issues to carry out various attacks by exec=
uting arbitrary commands on a vulnerable computer.
Exploiting these issues would permit remote attackers to influence comman=
d options that can be called through protocol handlers and to execute com=
mands with the privileges of a user running the application. Successful a=
ttacks may result in a variety of consequences, including remote unauthor=
ized access.
Mozilla Firefox 2.0.0.5, 3.0a6 and Netscape Navigator 9 are reported vuln=
erable to these issues. Other versions of these browsers and other vendo=
rs' browsers may also be affected.
8. Registry Pro 'epRegPro.ocx' ActiveX Control Insecure Method And Buffer=
Overflow Vulnerabilities
BugTraq ID: 28287
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28287
Summary:
Registry Pro 'epRegPro.ocx' ActiveX control is prone to multiple vulnerab=
ilities, including an insecure-method issue and a buffer-overflow issue.
An attacker can exploit these issues to delete arbitrary registry keys an=
d to execute arbitrary code in the context of an application running the =
control (typically Internet Explorer). Failed attacks will cause denial-o=
f-service conditions.
NOTE: Further analysis indicates that the trial version of Registry Pro 2=
.2.7 is not marked 'safe for scripting', which makes it not vulnerable; v=
ersions installed with other installers may be marked safe. We will updat=
e this BID as more information emerges.
9. Libpng Library Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 25956
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/25956
Summary:
The 'libpng' library is prone to multiple remote denial-of-service vulner=
abilities because the library fails to handle malicious PNG files.=20
Successful exploits may allow remote attackers to cause denial-of-service=
conditions on computers running the affected library.
These issues affect 'libpng' 1.2.20 and prior versions.
10. PHPauction 'include_path' Parameter Multiple Remote File Include Vuln=
erabilities
BugTraq ID: 28284
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28284
Summary:
PHPauction is prone to multiple remote file-include vulnerabilities becau=
se it fails to sufficiently sanitize user-supplied data.
Exploiting these issues may allow an attacker to compromise the applicati=
on and the underlying system; other attacks are also possible.
PHPauction 2.51 is vulnerable; other versions may also be affected.
11. Home FTP Server Remote Denial of Service Vulnerability
BugTraq ID: 28283
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28283
Summary:
Home FTP Server is prone to a remote denial-of-service vulnerability beca=
use it fails to handle user-supplied input.
=20
Successfully exploiting this issue allows remote attackers to crash the a=
ffected application, denying service to legitimate users.
12. bzip2 Unspecified File Handling Vulnerability
BugTraq ID: 28286
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28286
Summary:
The 'bzip2' application is prone to a remote file-handling vulnerability =
because the application fails to properly handle malformed files.
Successfully exploiting this issue may potentially allow remote code-exec=
ution, but this has not been confirmed. Exploit attempts likely result in=
application crashes.
Version 1.0.4 is vulnerable to this issue; prior versions may also be aff=
ected.
13. Microsoft Internet Explorer CreateTextRange.text Denial of Service Vu=
lnerability
BugTraq ID: 28295
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28295
Summary:
Microsoft Internet Explorer is prone to a denial-of-service vulnerability=
because the application fails to handle certain JavaScript code.
This issue is triggered when a remote attacker entices a victim to visit =
a malicious site.
Attackers may exploit this issue to crash Internet Explorer, effectively =
denying service to legitimate users.
14. 7-Zip Unspecified Archive Handling Vulnerability
BugTraq ID: 28285
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28285
Summary:
7-Zip prone to a remote archive-handling vulnerability because the applic=
ation fails to properly handle malformed archive files.
Successfully exploiting this issue may allow remote attackers to execute =
code, but this has not been confirmed. Exploit attempts will likely crash=
the application.
Versions prior to 7-Zip 4.57 are affected.
15. Apple Mac OS X v10.4.11 2007-008 Multiple Security Vulnerabilities
BugTraq ID: 26444
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/26444
Summary:
Apple Mac OS X is prone to multiple security vulnerabilities.
These issues affect Mac OS X and various applications, including AppleRAI=
D, CFFTP, CFNetwork, CoreFoundation, CoreText, kernel, remote_cmds, netwo=
rking, NFS, NSURL, SecurityAgent, WebCore, and WebKit.
Attackers may exploit these issues to execute arbitrary code, trigger den=
ial-of-service conditions, escalate privileges, and potentially compromis=
e vulnerable computers.
Apple Mac OS X 10.4.10 and prior versions are vulnerable to these issues.
16. WEBalbum 'photo_add.php' Security Bypass Vulnerability
BugTraq ID: 28280
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28280
Summary:
WEBalbum is prone to a security-bypass vulnerability because the applicat=
ion fails to restrict access to certain webpages.=20
An attacker can exploit this issue to bypass certain security restriction=
s and upload arbitrary images to the affected webserver.
WEBalbum 2.0 is vulnerable; other versions may also be affected.
17. Apple Safari Prior to 3.1 Multiple Security Vulnerabilities
BugTraq ID: 28290
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28290
Summary:
Apple Safari is prone to 12 security vulnerabilities.=20
Attackers may exploit these issues to execute arbitrary code, steal cooki=
e-based authentication credentials, spoof secure websites, obtain sensiti=
ve information, and crash the affected application. Other attacks are als=
o possible.
=20
These issues affect versions prior to Apple Safari 3.1 running on Apple M=
ac OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista.
18. Mozilla Firefox URLBar Null Byte File Remote Code Execution Vulnerabi=
lity
BugTraq ID: 24447
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/24447
Summary:
Mozilla Firefox is prone to a remote code-execution vulnerability because=
it fails to adequately sanitize user-supplied input.
Attackers may exploit this issue by enticing victims into visiting a mali=
cious site and followings links with improper file extensions.
Successful exploits may allow an attacker to crash the application or exe=
cute arbitrary code in the context of the affected application. Other att=
acks are also possible.
19. Mozilla Firefox About:Blank IFrame Cross Domain Information Disclosur=
e Vulnerability
BugTraq ID: 24286
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/24286
Summary:
Mozilla Firefox is prone to a cross-domain information-disclosure vulnera=
bility because scripts may persist across navigations.=20
A malicious site may be able to modify the iframe of a site in an arbitra=
ry external domain. Attackers could exploit this to gain access to sensit=
ive information that is associated with the external domain. Other attack=
s are also possible, such as executing script code in other browser secur=
ity zones.
This issue is being tracked by Bugzilla Bug 382686 and is reportedly rela=
ted to Bug 343168.
Firefox 2.0.0.4 and prior versions are vulnerable.
20. Mozilla Firefox WYCIWYG:// URI Cache Zone Bypass Vulnerability
BugTraq ID: 24831
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/24831
Summary:
Mozilla Firefox is prone to a cache-zone-bypass vulnerability because the=
application fails to properly block remote access to special internally =
generated URIs containing cached data.
Exploiting this issue allows remote attackers to access potentially sensi=
tive information and to place markers with similar functionality to cooki=
es onto targeted users' computers, regardless of cookie security settings=
. Information harvested in successful exploits may aid in further attacks=
.
Attackers may also potentially exploit this issue to perform cache-poison=
ing or URL-spoofing attacks.
This issue is being tracked by Mozilla's Bugzilla Bug 387333.
21. Mozilla Firefox OnUnload Javascript Browser Entrapment Vulnerability
BugTraq ID: 22688
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/22688
Summary:
Mozilla Firefox is prone to a vulnerability that allows attackers to trap=
users at a particular webpage and spoof page transitions.=20
Attackers may exploit this via a malicious page to spoof the contents and=
origin of a page that the victim may trust. This vulnerability may be us=
eful in phishing or other attacks that rely on content spoofing.
22. Mozilla Firefox/Thunderbird/SeaMonkey Chrome-Loaded About:Blank Scrip=
t Execution Vulnerability
BugTraq ID: 25142
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/25142
Summary:
Mozilla Firefox, Thunderbird, and SeaMonkey are prone to a vulnerability =
that allows JavaScript to execute with unintended privileges.=20
A malicious site may be able to cause the execution of a script with Chro=
me privileges. Attackers could exploit this issue to execute hostile scri=
pt code with privileges that exceed those that were intended. Certain Fir=
efox extensions may not intend 'about:blank' to execute script code with =
Chrome privileges.
NOTE: This issue was introduced by the fix for MFSA 2007-20.
23. Mozilla Firefox 2.0.0.4 Multiple Remote Vulnerabilities
BugTraq ID: 24946
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/24946
Summary:
The Mozilla Foundation has released four security advisories specifying m=
ultiple vulnerabilities in Firefox 2.0.0.4.
These vulnerabilities allow attackers to:
- Execute arbitrary code
- Execute code with chrome privileges
- Perform cross-site scripting attacks
- Crash Firefox in a myriad of ways, with evidence of memory corruption.
Other attacks may also be possible.
24. Mozilla Firefox 2.0.0.7 Multiple Remote Vulnerabilities
BugTraq ID: 26132
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/26132
Summary:
The Mozilla Foundation has released multiple security advisories specifyi=
ng various vulnerabilities in Firefox 2.0.0.7 and prior versions.
These vulnerabilities allow attackers to:
- Execute arbitrary code due to memory corruption.
- Carry out content spoofing and phishing attacks.
- Gain unauthorized access to files on a user's computer running the Linu=
x operating system.
- Execute script code with elevated privileges.
Other attacks may also be possible.
These issues are present in Firefox 2.0.0.7 and prior versions. Mozilla T=
hunderbird 2.0.0.7 and prior versions as well as SeaMonkey 1.1.4 and prio=
r versions are also affected by many of these vulnerabilities.
25. Mozilla Firefox OnKeyDown Event File Upload Vulnerability
BugTraq ID: 24725
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/24725
Summary:
Mozilla Firefox is prone to an information-disclosure vulnerability that =
can allow an attacker to access sensitive files.
This issue stems from a design error resulting from the improper handling=
of form fields.=20
All versions of Firefox are considered vulnerable.
26. VLC Media Player 'Subtitle' Buffer Overflow Vulnerability
BugTraq ID: 28274
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28274
Summary:
VLC media player is prone to a buffer-overflow vulnerability because it f=
ails to perform adequate boundary checks on user-supplied input.
Attackers can leverage this issue to execute arbitrary code in the contex=
t of the application. Failed attacks will cause denial-of-service conditi=
ons.
VLC media player 0.8.6e is vulnerable; other versions may also be affecte=
d.
27. Nagios Plugins SNMP GET Reply Remote Buffer Overflow Vulnerability
BugTraq ID: 26215
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/26215
Summary:
Nagios Plugins are prone to a remote buffer-overflow vulnerability becaus=
e the software fails to properly bounds-check user-supplied data before c=
opying it to an insufficiently sized buffer.
Exploiting this issue allows attackers to execute arbitrary machine code =
in the context of users running the affected software.
This issue affects Nagios Plugins 1.4.10; other versions may also be vuln=
erable.
28. Nagios Unspecified Cross-Site Scripting Vulnerability
BugTraq ID: 26152
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/26152
Summary:
Nagios is prone to an unspecified cross-site scripting vulnerability beca=
use it fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.
Versions prior to Nagios 2.10 are vulnerable.
29. Nagios Plugins Location Header Remote Buffer Overflow Vulnerability
BugTraq ID: 25952
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/25952
Summary:
Nagios Plugins are prone to a remote buffer-overflow vulnerability becaus=
e the software fails to properly bounds-check user-supplied data before c=
opying it to an insufficiently sized buffer.
Exploiting this issue allows attackers to execute arbitrary machine code =
in the context of users running the affected software.
This issue affects Nagios Plugins 1.4.9; other versions may also be vulne=
rable.
30. X.Org X Server PCF Font Parser Buffer Overflow Vulnerability
BugTraq ID: 27352
Remote: No
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27352
Summary:
X.Org X Server is prone to a buffer-overflow vulnerability because it fai=
ls to perform adequate boundary checks on user-supplied input.
Attackers can exploit this issue to execute arbitrary code with the privi=
leges of the server. Failed attacks will cause denial-of-service conditio=
ns.
NOTE: This vulnerability was previously covered in BID 27336 (X.Org X Ser=
ver Multiple Local Privilege Escalation and Information Disclosure Vuln=
erabilities), but has been given its own record to better document the i=
ssue.
31. Imperva SecureSphere Cross-Site Scripting Vulnerability
BugTraq ID: 28279
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28279
Summary:
Imperva SecureSphere is prone to a cross-site scripting vulnerability bec=
ause the application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
Imperva SecureSphere 5.0 MX Management Server is vulnerable.
32. Info-ZIP UnZip 'inflate_dynamic()' Remote Code Execution Vulnerabilit=
y
BugTraq ID: 28288
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28288
Summary:
UnZip is prone to a remote code-execution vulnerability.
Attackers may exploit this issue by enticing victims into opening a malic=
iously crafted ZIP file ('.zip').
Successful exploits may allow attackers to execute arbitrary code with th=
e privileges of the user running the application. This may facilitate a c=
ompromise of vulnerable computers.
UnZip 5.52 is vulnerable; other versions may be affected as well.
33. Nagios Prior to 2.11 Unspecified Cross-Site Scripting Vulnerability
BugTraq ID: 28250
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28250
Summary:
Nagios is prone to an unspecified cross-site scripting vulnerability beca=
use it fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.
Versions prior to Nagios 2.11 are vulnerable.
34. Joomla! and Mambo Acajoom Component 'mailingid' Parameter SQL Injecti=
on Vulnerability
BugTraq ID: 28305
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28305
Summary:
The Acajoom component for Joomla! and Mambo is prone to an SQL-injection =
vulnerability because it fails to sufficiently sanitize user-supplied dat=
a before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects Acajoom 1.1.5; other versions may also be affected.
35. cPanel List Directories and Folders Information Disclosure Vulnerabil=
ity
BugTraq ID: 28300
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28300
Summary:
cPanel is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to determine programs that are running=
on the affected server and to view folders on other sites that are prote=
cted by a firewall. Information obtained may lead to further attacks.
36. Check Point VPN-1 IP Address Collision Denial of Service Vulnerabilit=
y
BugTraq ID: 28299
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28299
Summary:
Check Point VPN-1 is prone to a denial-of-service vulnerability that can =
allow attackers to obtain sensitive information. The issue occurs because=
the application fails to adequately handle IP address collisions.
Attackers can exploit this issue to break site-to-site VPN connectivity b=
etween a VPN-1 gateway and a third party, denying access to legitimate us=
ers. If SecuRemote back-connections are enabled, the attacker can leverag=
e this issue to re-route site-to-site VPN traffic from the VPN gateway to=
their SecuRemote client. Under certain conditions, this will cause data =
that was destined for the third party to be sent to the attacker's client=
instead. This could contain sensitive information that would aid in furt=
her attacks.
37. S9Y Serendipity Trackbacks HTML Injection Vulnerability
BugTraq ID: 28298
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28298
Summary:
Serendipity is prone to an HTML-injection vulnerability because it fails =
to sufficiently sanitize user-supplied input data.
Exploiting this issue may allow an attacker to execute HTML and script co=
de in the context of the affected site, to steal cookie-based authenticat=
ion credentials, or to control how the site is rendered to the user; othe=
r attacks are also possible.
Versions prior to Serendipity 1.3 are vulnerable.
38. Travelsized CMS 'frontpage.php' and 'index.php' Multiple Input Valida=
tion Vulnerabilities
BugTraq ID: 28297
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28297
Summary:
Travelsized CMS is prone to multiple input-validation vulnerabilities bec=
ause it fails to adequately sanitize user-supplied input. These issues in=
clude a remote file-include vulnerability, a local file-include vulnerabi=
lity, and three cross-site scripting vulnerabilities.
An attacker can exploit these vulnerabilities to execute arbitrary local =
or remote script code in the context of the affected site. This may allow=
the attacker to steal cookie-based authentication credentials, obtain po=
tentially sensitive information, or compromise the affected application a=
nd possibly the underlying system.
Travelsized CMS 0.4.1 is vulnerable; other versions may also be affected.
39. eForum 'busca.php' Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 28293
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28293
Summary:
eForum is prone to multiple cross-site scripting vulnerabilities because =
the application fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities may allow an attacker to perform cross-s=
ite scripting attacks on unsuspecting users in the context of the affecte=
d website. As a result, the attacker may be able to steal cookie-based au=
thentication credentials and to launch other attacks.
These issues affect eForum 0.4; other versions may also be affected.
40. webSPELL 'index.php' Cross-Site Scripting Vulnerability
BugTraq ID: 28294
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28294
Summary:
webSPELL is prone to a cross-site scripting vulnerability because the app=
lication fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
webSPELL 4.01.02 is vulnerable; other versions may also be affected.
41. CUPS CGI Interface Remote Buffer Overflow Vulnerability
BugTraq ID: 28307
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28307
Summary:
CUPS is prone to a remote buffer-overflow vulnerability because it fails =
to properly bounds-check user-supplied data before copying it to an insuf=
ficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code within the c=
ontext of the affected application. Failed exploit attempts will result i=
n a denial of service.
CUPS 1.3.5 is reported vulnerable; other versions may be affected as well=
.
This issue was originally disclosed in BID 28304 (Apple Mac OS X 2008-002=
Multiple Security Vulnerabilities). It is being separated into its own r=
ecord due to further information.
42. phpstats 'phpstats.php' Cross-Site Scripting Vulnerability
BugTraq ID: 28291
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28291
Summary:
The 'phpstats' program is prone to a cross-site scripting vulnerability b=
ecause it fails to properly sanitize user-supplied input before using it =
in dynamically generated content.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
This issue affects phpstats 0.1_alpha.
43. MIT Kerberos 5 KDC Multiple Memory Corruption Based Information Discl=
osure Vulnerabilities
BugTraq ID: 28303
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28303
Summary:
MIT Kerberos 5 KDC is prone to multiple information-disclosure vulnerabil=
ities resulting from memory-corruption.
These issues occur when KDC is configured to support Kerberos 4 and proce=
sses malformed krb4 messages.
An attacker can exploit these issues to gain access to potentially sensit=
ive information that will aid in further attacks. Failed exploit attempts=
will likely result in a denial-of-service conditions. Due to the nature =
of these vulnerabilities, the issues could be leveraged to execute arbitr=
ary code however this has not been confirmed.
MIT Kerberos 5 version 1.6.3 KDC is vulnerable; other versions may also b=
e affected.
44. BusinessObjects 'RptViewerAX' ActiveX Control Stack Based Buffer Over=
flow Vulnerability
BugTraq ID: 28292
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28292
Summary:
BusinessObjects 'RptViewerAX' is prone to a stack-based buffer-overflow v=
ulnerability because it fails to perform adequate boundary checks on user=
-supplied data.
Attackers can exploit this issue to execute arbitrary code in the context=
of an application using the affected control (typically Internet Explore=
r). Successful attacks can compromise the application and possibly the un=
derlying computer. Failed attacks will likely cause denial-of-service con=
ditions.
45. MoinMoin Macro Code Information Disclosure Vulnerability
BugTraq ID: 28177
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28177
Summary:
MoinMoin is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain potentially sensitive informat=
ion that may aid in further attacks.
46. MoinMoin MOIN_ID Cookie Remote Input Validation Vulnerability
BugTraq ID: 27404
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27404
Summary:
MoinMoin is prone to an input-validation vulnerability because it fails t=
o properly sanitize user-supplied cookie data.
An attacker can exploit this issue to gain unauthorized access to the aff=
ected application, which may lead to further attacks.
Versions in the MoinMoin 1.5 series are vulnerable.
UPDATE: The 'quicklinks' parameter may be used to insert PHP code into wr=
itable files in conjunction with this issue. Attackers could potentially =
inject executable script code into writable PHP files located outside of =
the MoinMoin installation.
47. MoinMoin GUI Editor Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 28173
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28173
Summary:
MoinMoin is prone to multiple cross-site scripting vulnerabilities becaus=
e it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based aut=
hentication credentials and to launch other attacks.
48. HTTP File Upload ActiveX Control Arbitrary File and Directory Deletio=
n Vulnerability
BugTraq ID: 28301
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28301
Summary:
HTTP File Upload ActiveX Control is prone to a vulnerability that lets at=
tackers delete arbitrary files or directories on affected computers. Succ=
essful attacks can result in denial-of-service conditions.
HTTP File Upload ActiveX Control 6.0.0.35 is vulnerable to this issue; ot=
her versions may also be affected.
NOTE: Further analysis indicates that the trial version of the ActiveX co=
ntrol ('UUploaderSvrD.dll' version 6.0.0.35) is not marked 'safe for scri=
pting', which makes it not vulnerable; versions installed with other inst=
allers may be marked as safe. This BID will be updated when more informat=
ion is available.
49. Libpng Library ICC Profile Chunk Off-By-One Denial of Service Vulnera=
bility
BugTraq ID: 25957
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/25957
Summary:
The 'libpng' library is prone to a remote denial-of-service vulnerability=
because the library fails to handle malicious PNG files.=20
Successful exploits may allow remote attackers to cause denial-of-service=
conditions on computers running the affected library.
This issue affects 'libpng' 1.2.21 and prior versions.
50. Libpng Library Remote Denial of Service Vulnerability
BugTraq ID: 24000
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/24000
Summary:
The 'libpng' library is prone to a remote denial-of-service vulnerability=
because the library fails to handle malicious PNG files.=20
Successful exploits may allow remote attackers to cause denial-of-service=
conditions on computers running the affected library.
This issue affects 'libpng' 1.2.16 and prior versions.
51. libpng Graphics Library Chunk Error Processing Buffer Overflow Vulner=
ability
BugTraq ID: 18698
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/18698
Summary:
The 'libpng' graphics library is reported prone to a buffer-overflow vuln=
erability. The library fails to perform proper bounds checking of user-su=
pplied input before copying it to an insufficiently sized memory buffer.
This vulnerability may be exploited to execute attacker-supplied code in =
the context of an application that relies on the affected library.
52. PHP .Htaccess Safe_Mode and Open_Basedir Restriction-Bypass Vulnerabi=
lity
BugTraq ID: 24661
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/24661
Summary:
PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulne=
rability. Successful exploits could allow an attacker to write files in u=
nauthorized locations.
These vulnerabilities would be an issue in shared-hosting configurations =
where multiple users can create and execute arbitrary PHP script code, wi=
th the 'safe_mode' and 'open_basedir' restrictions assumed to isolate the=
users from each other.
This issue is reported to affect PHP 5.2.3 and 4.4.7; previous versions m=
ay also be vulnerable.
53. PHP 5.2.4 and Prior Versions Multiple Vulnerabilities
BugTraq ID: 26403
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/26403
Summary:
PHP 5.2.4 and prior versions are prone to multiple security vulnerabiliti=
es. Successful exploits could allow an attacker to bypass security restri=
ctions, cause a denial-of-service condition, and potentially execute code=
.
54. File Multiple Denial of Service Vulnerabilities
BugTraq ID: 24146
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/24146
Summary:
The 'file' utility is prone to multiple denial-of-service vulnerabilities=
because it fails to handle exceptional conditions.=20
An attacker could exploit this issue by enticing a victim to open a speci=
ally crafted file. A denial-of-service condition can occur. Arbitrary cod=
e execution may be possible, but Symantec has not confirmed this.
55. Apple Mac OS X Security Update 2006-003 Multiple Vulnerabilities
BugTraq ID: 17951
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/17951
Summary:
Apple Mac OS X is reported prone to multiple security vulnerabilities.
These issue affect Mac OS X in the following applications or modules:
- AppKit
- ImageIO
- BOM
- CFNetwork
- ClamAV
- CoreFoundation
- CoreGraphics
- Finder
- FTPServer
- Flash Player
- ImageIO
- Keychain
- LaunchServices
- libcurl
- Mail
- MySQL Manager
- Preview
- QuickDraw
- QuickTime Streaming Server
- Ruby
- Safari
A remote attacker may exploit these issues to execute arbitrary code, tri=
gger a denial-of-service condition, gain access to potentially sensitive =
information, or overwrite files. Other attacks may also be possible.
Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues.
56. cURL / libcURL URL Parser Buffer Overflow Vulnerability
BugTraq ID: 15756
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/15756
Summary:
cURL and libcURL are prone to a buffer-overflow vulnerability. This issue=
is due to a failure in the library to perform proper bounds checks on us=
er-supplied data before using it in a finite-sized buffer.=20
The issues occur when the URL parser function handles an excessively long=
URL string.=20
An attacker can exploit this issue to crash the affected library, effecti=
vely denying service. Arbitrary code execution may also be possible, whic=
h may facilitate a compromise of the underlying system.
57. MoinMoin Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 27904
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27904
Summary:
MoinMoin is prone to multiple cross-site scripting vulnerabilities becaus=
e it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based aut=
hentication credentials and to launch other attacks.
=20
These issues affect the following versions:
MoinMoin 1.5.8 and prior versions
MoinMoin 1.6.x prior to 1.6.1.
58. MIT Kerberos5 kadmind Excessive File Descriptors Multiple Remote Code=
Execution Vulnerabilities
BugTraq ID: 28302
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28302
Summary:
kadmind is prone to multiple vulnerabilities that can allow remote code-e=
xecution due to array over-runs in the RPC library code.
Exploiting these issues may allow attackers to execute arbitrary code wit=
h superuser privileges, facilitating in the complete compromise of affect=
ed computers. Failed attempts will cause crashes and deny service to leg=
itimate users of the application. Note that a compromise of a Master KDC =
(Key Distribution Center) principal and policy server will affect multipl=
e hosts that use the server for authentication, potentially contributing =
to their compromise as well.
These issues affect:
- krb5-1.4 through krb5-1.63, where configurations allow large numbers of=
open file descriptors.
- krb5-1.2.2 through krb5-1.3, where '<unistd.h>' does not define F=
D_SETSIZE. Note that this is likely the case in many GNU/Linux distribu=
tions; Solaris 10 and Mac OS X 10.4 may be unaffected.
59. Apple Mac OS X Server Wiki Server Directory Traversal Vulnerability
BugTraq ID: 28278
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28278
Summary:
Apple Mac OS X Server Wiki Server is prone to a directory-traversal vulne=
rability because it fails to sufficiently sanitize user-supplied input da=
ta.
Exploiting this issue allows an attacker to access arbitrary files outsid=
e of the application's document root directory. This can expose sensitive=
information that could help the attacker launch further attacks.
Note that attackers must be registered wiki users to exploit this issue.
Wiki Server from Mac OS X Server 10.5 is vulnerable.
60. The 'libpng' Graphics Library PNG_SET_SPLT Remote Denial of Service V=
ulnerability
BugTraq ID: 21078
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/21078
Summary:
The 'libpng' graphics library is reported prone to a denial-of-service vu=
lnerability. The library fails to perform proper bounds-checking of user-=
supplied input, which leads to an out-of-bounds read error.
Attackers may exploit this vulnerability to crash an application that rel=
ies on the affected library.
61. PHP EXT/Session HTTP Response Header Injection Vulnerability
BugTraq ID: 24268
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/24268
Summary:
PHP is prone to an HTTP-response-header-injection vulnerability because i=
t fails to sanitize user-supplied input.
An attacker can exploit this issue to inject additional cookie attributes=
into session cookies. This may lead to other attacks.=20
This issue affects PHP 5.2.3 (and prior versions) and PHP 4.4.7 (and prio=
r versions).
62. PHP 5.2.3 and Prior Versions Multiple Vulnerabilities
BugTraq ID: 25498
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/25498
Summary:
PHP 5.2.3 and prior versions are prone to multiple security vulnerabiliti=
es. Successful exploits could allow an attacker to bypass security restri=
ctions, cause a denial-of-service condition, and potentially execute code=
.
63. GNU Emacs Local Variable Handling Code Execution Vulnerability
BugTraq ID: 26327
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/26327
Summary:
Emacs is prone to a vulnerability that lets attackers execute arbitrary c=
ode.
Due to a design error, the application ignores certain security settings =
and modifies local variables.
=20
By supplying a malicious file, an attacker can exploit this issue to carr=
y out various attacks, including executing arbitrary code in the context =
of the application. This may facilitate remote unauthorized access.
=20
This issue affects Emacs 22.1; other versions may be vulnerable as well.
64. CUPS 'process_browse_data()' Remote Double Free Denial of Service Vul=
nerability
BugTraq ID: 27906
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27906
Summary:
CUPS is prone to a remote denial-of-service vulnerability because it fail=
s to protect against a double-free condition.
Attackers may exploit this issue to crash the application, denying servic=
e to legitimate users. Remote code execution may also be possible, but th=
is has not been confirmed.
CUPS 1.3.5 is vulnerable to this issue; other versions may also be affect=
ed.
65. CUPS Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 27988
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27988
Summary:
CUPS is prone to two remote denial-of-service vulnerabilities.
Attackers may exploit these issues to crash the application, denying serv=
ice to legitimate users. Remote code execution may also be possible, but =
this has not been confirmed.
CUPS 1.1.17 and 1.1.22 are vulnerable to these issues; other versions may=
also be affected.
66. OpenSSH X11 Cookie Local Authentication Bypass Vulnerability
BugTraq ID: 25628
Remote: No
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/25628
Summary:
OpenSSH is prone to a local authentication-bypass vulnerability because t=
he software fails to properly manage trusted and untrusted X11 cookies.
Successfully exploiting this issue allows local attackers to potentially =
launch a forwarded X11 session through SSH in an unauthorized manner. Fur=
ther details are currently unavailable. We will update this BID as more i=
nformation emerges.
This issue affects OpenSSH 4.6; previous versions may be affected as wel=
l.
67. MIT Kerberos Multiple Memory Corruption Vulnerabilities
BugTraq ID: 26750
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/26750
Summary:
Multiple memory-corruption vulnerabilities with unknown impacts affect MI=
T Kerberos 5. These issues include a use-after-free vulnerability, an int=
eger-overflow vulnerability, and two double-free vulnerabilities.
68. X.Org X Server 'MIT-SHM' Local Privilege Escalation Vulnerability
BugTraq ID: 27350
Remote: No
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27350
Summary:
X.Org X Server is prone to a local privilege-escalation vulnerability.
Attackers can exploit this issue to execute arbitrary code with superuser=
privileges or to crash the affected computer.
NOTE: This vulnerability was previously covered in BID 27336 (X.Org X Ser=
ver Multiple Local Privilege Escalation and Information Disclosure Vulner=
abilities), but has been given its own record to better document the issu=
e.
69. X.Org X Server 'TOG-CUP' Extension Local Privilege Escalation Vulnera=
bility
BugTraq ID: 27355
Remote: No
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27355
Summary:
X.Org X Server is prone to a local privilege-escalation vulnerability.
Attackers can exploit this issue to execute arbitrary code with superuser=
privileges or to crash the affected computer.
NOTE: This vulnerability was previously covered in BID 27336 (X.Org X Ser=
ver Multiple Local Privilege Escalation and Information Disclosure Vulner=
abilities), but has been given its own record to better document the issu=
e.
70. X.Org X Server 'Xinput' Extension Local Privilege Escalation Vulnerab=
ility
BugTraq ID: 27351
Remote: No
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27351
Summary:
X.Org X Server is prone to a local privilege-escalation vulnerability.
Attackers can exploit this issue to execute arbitrary code with superuser=
privileges or to crash the affected computer.
NOTE: This vulnerability was previously covered in BID 27336 (X.Org X Ser=
ver Multiple Local Privilege Escalation and Information Disclosure Vulner=
abilities), but has been given its own record to better document the issu=
e.
71. X.Org X Font Server Multiple Memory Corruption Vulnerabilities
BugTraq ID: 25898
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/25898
Summary:
X.Org X Font Server (XFS) is prone to multiple memory-corruption vulnerab=
ilities, including an integer-overflow issue and a heap-based memory-corr=
uption issue.=20
An attacker could exploit this issue to execute arbitrary code with the p=
rivileges of the X Font Server. Failed exploit attempts will likely resul=
t in a denial-of-service condition.=20
NOTE: These issues are exploitable remotely only on Solaris operating sys=
tems; by default the server is listening on TCP port 7100. For other UNIX=
-like operating systems, an attacker can exploit these issues only locall=
y.
These issues affect X Font Server 1.0.4; prior versions may also be affec=
ted.
72. ClamAV Attachment Wrapping Denial Of Service Vulnerability
BugTraq ID: 21609
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/21609
Summary:
ClamAV is prone to a denial-of-service vulnerability because it fails to =
handle specific multipart attachments.
A successful exploit of this issue will cause the application to crash, r=
esulting in a denial-of-service condition.
This issue affects ClamAV 0.88.6 and earlier versions.
73. X.Org X Server 'EVI' Extension Local Privilege Escalation Vulnerabili=
ty
BugTraq ID: 27353
Remote: No
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27353
Summary:
X.Org X Server is prone to a local privilege-escalation vulnerability.
Attackers can exploit this issue to execute arbitrary code with superuser=
privileges or to crash the affected computer.
NOTE: This vulnerability was previously covered in BID 27336 (X.Org X Ser=
ver Multiple Local Privilege Escalation and Information Disclosure Vulner=
abilities), but has been given its own record to better document the issu=
e.
74. X.Org X 'Server X:1 -sp' Command Information Disclosure Vulnerability
BugTraq ID: 27356
Remote: No
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27356
Summary:
X.Org X Server is prone to a local information-disclosure vulnerability.
Attackers can exploit this issue to gain access to sensitive information =
that may lead to further attacks.
NOTE: This vulnerability was previously covered in BID 27336 (X.Org X Ser=
ver Multiple Local Privilege Escalation and Information Disclosure Vulner=
abilities), but has been given its own record to better document the issu=
e.
75. ClamAV CAB File Remote Denial of Service Vulnerability
BugTraq ID: 22580
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/22580
Summary:
ClamAV is prone to a denial-of-service vulnerability.
An attacker can exploit this vulnerability to prevent the software from s=
canning certain types of data. When it encounters the data, the applicati=
on will reject it. This can result in denial-of-service conditions.
Versions prior to ClamAV 0.90 stable are vulnerable.
76. ClamAV Multiple Remote Vulnerabilities
BugTraq ID: 23473
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/23473
Summary:
ClamAV is prone to a file-descriptor leakage vulnerability and a buffer-o=
verflow vulnerability.
A successful attack may allow an attacker to obtain sensitive information=
, cause denial-of-service conditions, and execute arbitrary code in the c=
ontext of the user running the affected application.
Versions prior to ClamAV 0.90.2 are vulnerable to these issues.
77. ClamAV MIME Header ID Parameter String Directory Traversal Vulnerabil=
ity
BugTraq ID: 22581
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/22581
Summary:
ClamAV is prone to a directory-traversal vulnerability because it fails t=
o properly sanitize user-supplied input.=20
An attacker can exploit this vulnerability to create or overwrite arbitra=
ry files on vulnerable computers in the context of the affected applicati=
on. This may aid in further attacks.=20
This issue affects ClamAV versions prior to the 0.90 stable release.
78. ClamAV BZ_GET_FAST Bzip2 Decompression Vulnerability
BugTraq ID: 27063
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27063
Summary:
ClamAV is prone to a vulnerability due to a flaw in its Bzip2 decompressi=
on support.
Successful exploits of this vulnerability may potentially allow remote at=
tackers to execute arbitrary code in the context of the vulnerable applic=
ation or to trigger denial-of-service conditions. These effects have not =
been confirmed.
No further technical details are currently available. We will update this=
BID as more information emerges.
ClamAV 0.91.2 is vulnerable to this issue; other versions may also be aff=
ected.
79. ClamAV Popen Function Remote Code Execution Vulnerability
BugTraq ID: 25439
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/25439
Summary:
ClamAV is prone to a remote code-execution vulnerability because the appl=
ication fails to properly sanitize user-supplied data.=20
An attacker can exploit this issue to execute arbitrary code with superus=
er privileges. Successfully exploiting this issue will result in the comp=
lete compromise of affected computers.=20
Versions prior to ClamAV 0.91.2 are vulnerable.
80. ClamAV Heap Corruption and Integer Overflow Vulnerabilities
BugTraq ID: 27751
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27751
Summary:
ClamAV is prone to a heap-corruption vulnerability and an integer-overflo=
w vulnerability.
Successfully exploiting these issues allows remote attackers to execute a=
rbitrary machine code in the context of the affected application. This fa=
cilitates the remote compromise of affected computers. Failed exploit att=
empts likely result in application crashes.
Versions prior to ClamAV 0.92.1 are affected by these issues.
81. ClamAV Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 25398
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/25398
Summary:
ClamAV is prone to multiple denial-of-service vulnerabilities.
A successful attack may allow an attacker to crash the application and de=
ny service to users.
Versions prior to ClamAV 0.91.2 are vulnerable to these issues.
82. ClamAV 'libclamav/pe.c' MEW Packed PE File Integer Overflow Vulnerabi=
lity
BugTraq ID: 26927
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/26927
Summary:
ClamAV is prone to an integer-overflow vulnerability because it fails to =
properly verify user-supplied data.=20
Successful exploits of this vulnerability can allow remote attackers to e=
xecute arbitrary machine code in the context of applications using the 'l=
ibclamav' library. Failed exploits may crash the application.
ClamAV 0.91.2 is vulnerable to this issue; other versions may also be aff=
ected.
83. ClamAV 'mspack.c' Off-By-One Buffer Overflow Vulnerability
BugTraq ID: 26946
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/26946
Summary:
ClamAV is prone to a buffer-overflow vulnerability because it fails to pr=
operly bounds-check user-supplied input before copying it to insufficient=
ly sized memory buffers.
Successful exploits of this vulnerability can allow remote attackers to e=
xecute arbitrary machine code in the context of applications using the 'l=
ibclamav' library. Failed exploits may crash the application.
ClamAV 0.91.2 is vulnerable to this issue; other versions may also be aff=
ected.
84. Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerability
BugTraq ID: 26838
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/26838
Summary:
Apache is prone to a cross-site scripting vulnerability because the appli=
cation fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
This issue affects the following:
- The 'mod_imagemap' module in Apache 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, =
and 2.2.0=20
- The 'mod_imap' module in Apache 1.3.39, 1.3.37, 1.3.36, 1.3.35, 1.3.34,=
1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, =
1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.=
3, 1.3.2, 1.3.1, and 1.3.0.
85. Apache 'mod_proxy_balancer' Multiple Vulnerabilities
BugTraq ID: 27236
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27236
Summary:
The Apache 'mod_proxy_balancer' module is prone to multiple vulnerabiliti=
es, including denial-of-service, memory-corruption, cross-site scripting,=
HTML-injection, and cross-site request-forgery issues.
Attackers can exploit these issues to inject arbitrary script code into v=
ulnerable sections of the application, execute this script code in the br=
owser of a user in the context of the affected site, and perform certain =
actions using the user's active session. Attackers can exploit the denial=
-of-service issue to deny further service to legitimate users. Exploiting=
the memory-corruption vulnerability is likely to cause a crash and could=
allow arbitrary code to run, but this has not been confirmed.
The issues affect Apache 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0; other =
versions may also be vulnerable.
86. Apache 'mod_proxy_ftp' Undefined Charset UTF-7 Cross-Site Scripting V=
ulnerability
BugTraq ID: 27234
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/27234
Summary:
Apache 'mod_proxy_ftp' is prone to a cross-site scripting vulnerability b=
ecause the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
This issue is reported to affect versions prior to Apache 2.2.7-dev, Apac=
he 1.3.40-dev, and Apache 2.0.62-dev.
87. Joomla! and Mambo joovideo Component 'id' Parameter SQL Injection Vul=
nerability
BugTraq ID: 28318
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28318
Summary:
The joovideo component for Joomla! and Mambo is prone to an SQL-injection=
vulnerability because it fails to sufficiently sanitize user-supplied da=
ta before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
joovideo 1.2.2 is vulnerable; other versions may also be affected.
88. Belkin F5D7230-4 Wireless G Router IP-Based Authentication State Auth=
entication Bypass Vulnerability
BugTraq ID: 28317
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28317
Summary:
The Belkin F5D7230-4 Wireless G Router is prone to an authentication-bypa=
ss vulnerability due to the way it maintains authentication states.
Attackers can exploit this issue to gain access to affected routers using=
the account of a previously authenticated user.
Belkin F5D7230-4 running firmware version 9.01.10 is vulnerable; other d=
evices and firmware versions may also be affected.
89. Iatek PortalApp 'links.asp' SQL Injection Vulnerability
BugTraq ID: 28315
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28315
Summary:
PortalApp is prone to an SQL-injection vulnerability because it fails to =
sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
90. HP StorageWorks Library and Tape Tools Unspecified Local Security Byp=
ass Vulnerability
BugTraq ID: 28314
Remote: No
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28314
Summary:
HP StorageWorks Library and Tape Tools (LTT) is prone to a local security=
-bypass vulnerability.=20
A local attacker can exploit this issue to gain unauthorized access to th=
e affected application. Successfully exploiting this issue may lead to ot=
her attacks.
91. MyBlog SQL Injection and Remote File Include Vulnerabilities
BugTraq ID: 28313
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28313
Summary:
MyBlog is prone to multiple input-validation vulnerabilities, including:=20
- Multiple SQL-injection vulnerabilities
- Multiple remote file-include vulnerabilities
- A privilege-escalation vulnerability
An attacker may exploit these issues to compromise the affected applicati=
on, execute arbitrary script code in the context of the webserver process=
or to pass malicious input to database queries, resulting in the modific=
ation of query logic or other attacks.
92. xine-lib 'sdpplin_parse()' Remote Buffer Overflow Vulnerability
BugTraq ID: 28312
Remote: Yes
Last Updated: 2008-03-19
Relevant URL: http://www.securityfocus.com/bid/28312
Summary:
The xine-lib library is prone to a remote buffer-overflow vulnerability. =
This issue occurs because the software fails to perform adequate boundary=
checks on user-supplied data.=20
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of the user running the affected application. Failed exploit atte=
mpts will result in a denial-of-service condition.
=20
This issue affects xine-lib 1.1.10.1; other versions may also be vulnera=
ble.
93. Apache HTTP Server Mod_Proxy Denial of Service Vulnerability
BugTraq ID: 25489
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/25489
Summary:
The Apache mod_proxy module is prone to a denial-of-service vulnerability=
.
A remote attacker may be able to exploit this issue to crash the child pr=
ocess. This could lead to denial-of-service conditions if the server is u=
sing a multithreaded Multi-Processing Module (MPM).
94. PCRE Regular Expression Library Multiple Security Vulnerabilities
BugTraq ID: 26346
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/26346
Summary:
PCRE regular-expression library is prone to multiple security vulnerabili=
ties.
Attackers can exploit these issues to execute arbitrary code, cause denia=
l-of-service conditions, or launch other attacks in the context of the ap=
plication using the affected library.
95. Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
BugTraq ID: 19204
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/19204
Summary:
Apache mod_rewrite is prone to an off-by-one buffer-overflow condition.=20
The vulnerability arising in the mod_rewrite module's ldap scheme handlin=
g allows for potential memory corruption when an attacker exploits certai=
n rewrite rules.=20
An attacker may exploit this issue to trigger a denial-of-service conditi=
on. Reportedly, arbitrary code execution may be possible as well.
96. Apple Mac OS X 2008-002 Multiple Security Vulnerabilities
BugTraq ID: 28304
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28304
Summary:
Apple Mac OS X is prone to multiple security vulnerabilities.
These issues affect Mac OS X and various applications, including AFP Clie=
nt, AFP Server, AppKit, Application Firewall, CoreFoundation, CoreService=
s, CUPS, Foundation, Help Viewer, Image Raw, libc, mDNSResponder, notifyd=
, pax archive utility, Podcast Producer, Preview, Printing, System Config=
uration, UDF, and Wiki Server.
Attackers may exploit these issues to execute arbitrary code, trigger den=
ial-of-service conditions, escalate privileges, and potentially compromis=
e vulnerable computers.
These issues affect Apple Mac OS X 10.4.11, 10.4.11 Server, 10.5.2, 10.5.=
2 Server and earlier.
97. Apache Mod_IMAP Referer Cross-Site Scripting Vulnerability
BugTraq ID: 15834
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/15834
Summary:
Apache's mod_imap module is prone to a cross-site scripting vulnerability=
. This issue is due to the module's failure to properly sanitize user-sup=
plied input.=20
An attacker may leverage this issue to have arbitrary script code execute=
d in the browser of an unsuspecting user in the context of the affected s=
ite. This may facilitate the theft of cookie-based authentication credent=
ials as well as other attacks.
98. Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting=
Weakness
BugTraq ID: 26663
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/26663
Summary:
Apache is prone to a cross-site scripting weakness when handling HTTP req=
uest methods that result in 413 HTTP errors.
An attacker may exploit this issue to steal cookie-based authentication =
credentials and launch other attacks.
Apache 2.0.46 through 2.2.4 are vulnerable; other versions may also be af=
fected.
99. Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site S=
cripting Vulnerability
BugTraq ID: 27237
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/27237
Summary:
The Apache HTTP Server 'mod_status' module is prone to a cross-site scrip=
ting vulnerability because the application fails to properly sanitize use=
r-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks. Reportedly, attackers can also use this i=
ssue to redirect users' browsers to arbitrary locations, which may aid i=
n phishing attacks.
The issue affects versions prior to Apache 2.2.7-dev, 2.0.62-dev, a=
nd 1.3.40-dev.
100. Trend Micro OfficeScan Buffer Overflow Vulnerability and Denial of S=
ervice Vulnerability
BugTraq ID: 28020
Remote: Yes
Last Updated: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28020
Summary:
Trend Micro OfficeScan Corporate Edition is prone to a buffer-overflow vu=
lnerability and a denial-of-service vulnerability because the application=
fails to properly bounds-check user-supplied data before copying it into=
an insufficiently sized memory buffer.
Successful exploits may allow an attacker to execute arbitrary code with =
privileges of the user running the application. This may facilitate a co=
mplete compromise of vulnerable computers. Failed exploit attempts will l=
ikely result in denial-of-service conditions.
These issues affect the following:
OfficeScan Corporate Edition 8.0 Patch 2 Build 1189 and earlier
OfficeScan Corporate Edition 7.0 Patch 3 Build 1314 and earlier
Other Trend Micro products may also be affected.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. House aims to scrutinize warrantless taps
By: Robert Lemos
The fight over a law to grant the U.S. government greater surveillance ca=
pabilities intensifies as House Democrats refuse to give telcos immunity =
for allowing past wiretaps without warrants.
http://www.securityfocus.com/news/11509
2. Browser makers focus on beating malware
By: Robert Lemos
Microsoft announces two features in Internet Explorer 8 aimed at better s=
ecuring Web surfers, and Mozilla incorporates more security into Firefox =
3.
http://www.securityfocus.com/news/11508
3. Law makers voice concerns over cybersecurity plan
By: Robert Lemos
Members of Congress seek more details of cyber attacks targeting the fede=
ral government and worry that the recently announced Cyber Initiative wil=
l undermine privacy.
http://www.securityfocus.com/news/11507
4. Worries over "good worms" rise again
By: Robert Lemos
A Microsoft researcher studies the use of self-propagation for patching, =
but for most of the security industry, any worm is a bad worm.
http://www.securityfocus.com/news/11506
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Security Consultant, London, Bristol or Birmingham
http://www.securityfocus.com/archive/77/489634
2. [SJ-JOB] Penetration Engineer, West Sussex
http://www.securityfocus.com/archive/77/489641
3. [SJ-JOB] Application Security Architect, London
http://www.securityfocus.com/archive/77/489639
4. [SJ-JOB] Account Manager, London
http://www.securityfocus.com/archive/77/489649
5. [SJ-JOB] Sr. Security Engineer, Brook Park
http://www.securityfocus.com/archive/77/489627
6. [SJ-JOB] Director, Information Security, Costa Mesa
http://www.securityfocus.com/archive/77/489633
7. [SJ-JOB] Penetration Engineer, Bristol
http://www.securityfocus.com/archive/77/489640
8. [SJ-JOB] Jr. Security Analyst, Melville
http://www.securityfocus.com/archive/77/489642
9. [SJ-JOB] Application Security Architect, Princeton
http://www.securityfocus.com/archive/77/489625
10. [SJ-JOB] Management, Kansas City
http://www.securityfocus.com/archive/77/489626
11. [SJ-JOB] Security Consultant, Minneapolis
http://www.securityfocus.com/archive/77/489635
12. [SJ-JOB] Security Consultant, Minneapolis
http://www.securityfocus.com/archive/77/489620
13. [SJ-JOB] Database Security Architect, New York
http://www.securityfocus.com/archive/77/489621
14. [SJ-JOB] Developer, Alpharetta
http://www.securityfocus.com/archive/77/489628
15. [SJ-JOB] Remediation Security Analyst, New York
http://www.securityfocus.com/archive/77/489648
16. [SJ-JOB] Sales Representative, Kansas City
http://www.securityfocus.com/archive/77/489619
17. [SJ-JOB] Sales Engineer, New York City
http://www.securityfocus.com/archive/77/489624
18. [SJ-JOB] Security Consultant, Minneapolis
http://www.securityfocus.com/archive/77/489618
19. [SJ-JOB] Sales Engineer, Nashville
http://www.securityfocus.com/archive/77/489644
20. [SJ-JOB] Security Consultant, Minneapolis
http://www.securityfocus.com/archive/77/489645
21. [SJ-JOB] Security System Administrator, San Antonio
http://www.securityfocus.com/archive/77/489638
22. [SJ-JOB] Developer, Calgary
http://www.securityfocus.com/archive/77/489647
23. [SJ-JOB] Developer, Ciudad de Buenos Aires - Palermo
http://www.securityfocus.com/archive/77/489617
24. [SJ-JOB] Developer, Ciudad de Buenos Aires - Palermo
http://www.securityfocus.com/archive/77/489623
25. [SJ-JOB] Senior Software Engineer, Alpharetta
http://www.securityfocus.com/archive/77/489629
26. [SJ-JOB] Technical Writer, Ciudad de Buenos Aires - Palermo
http://www.securityfocus.com/archive/77/489643
27. [SJ-JOB] Penetration Engineer, UK WIDE
http://www.securityfocus.com/archive/77/489622
28. [SJ-JOB] Information Assurance Analyst, Boulder
http://www.securityfocus.com/archive/77/489646
29. [SJ-JOB] Security Engineer, Austin
http://www.securityfocus.com/archive/77/489592
30. [SJ-JOB] Software Engineer, Cupertino
http://www.securityfocus.com/archive/77/489593
31. [SJ-JOB] Security Auditor, Arlington
http://www.securityfocus.com/archive/77/489630
32. [SJ-JOB] Disaster Recovery Coordinator, Saint Charles
http://www.securityfocus.com/archive/77/489631
33. [SJ-JOB] Security System Administrator, London
http://www.securityfocus.com/archive/77/489590
34. [SJ-JOB] Sales Engineer, Dallas
http://www.securityfocus.com/archive/77/489591
35. [SJ-JOB] Security System Administrator, Jersey City
http://www.securityfocus.com/archive/77/489594
V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. More along the lines of malware disinfection
http://www.securityfocus.com/archive/88/489751
2. Compromised WinXP box prob
http://www.securityfocus.com/archive/88/489695
3. SecurityFocus Microsoft Newsletter #385
http://www.securityfocus.com/archive/88/489513
4. Temp directory is odd
http://www.securityfocus.com/archive/88/489429
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This issue is sponsored by GlobalSCAPE
Learn how GlobalSCAPE's Enhanced File Transfer (EFT) Server helped Aon's =
Human Capital division increase productivity and security by streamlining=
data transfers and data automation processes while making savings of alm=
ost $300,000. By using EFT Server they ensured the security and integrity=
of their file transfers and made it possible not only for Aon to control=
their own customizations but also to provide secure automatic data trans=
lation in real time which benefited employees and customers.
Download the AON case study - http://www.globalscape.com/files/case_AON.p=
df