SecurityFocus Newsletter #447
[email protected] 3 Apr 2008 23:23:50 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #447
----------------------------------------
This issue is sponsored by IBM=AE Rational=AE AppScan
Failure to properly secure Web applications significantly impacts your ab=
ility to protect sensitive client and corporate data. IBM Rational AppSca=
n is an automated scanner that monitors, identifies and helps remediate v=
ulnerabilities.
Download a free trial of AppScan and see how it can help prevent against =
the threat of attack.
https://www.watchfire.com/securearea/appscan.aspx?id=3D701700000009T0r
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1.On the Border
2.Catch Them if You can
II. BUGTRAQ SUMMARY
1. Parallels Virtuozzo Containers VZPP Interface Change Pass Cross=
-Site Request Forgery Vulnerability
2. Smart Classified ADS and Smart Photo ADS 'view.cgi' Multiple Cr=
oss Site Scripting Vulnerabilities
3. exiftags Multiple Unspecified Buffer Overflow And Denial Of Ser=
vice Vulnerabilities
4. EasyNews Multiple Input Validation Vulnerabilities
5. Phorum Multiple Unspecified SQL Injection Vulnerabilities
6. Microsoft Crypto API X.509 Certificate Validation Remote Inform=
ation Disclosure Vulnerability
7. Sympa 'Content-Type' Header Remote Denial Of Service Vulnerabil=
ity
8. LANDesk Management Suite TFTP service Directory Traversal Vulne=
rability
9. Xpdf PDFTOPS Multiple Integer Overflow Vulnerabilities
10. xine-lib Matroska Demuxer Remote Buffer Overflow Vulnerability
11. Sava's Place Sava's Link Manager 'category' Parameter SQL Inje=
ction Vulnerability
12. Sava's Place Sava's Link Manager 'index.php' Local File Includ=
e Vulnerability
13. Sava's Place Sava's Guestbook 'index.php' Local File Include V=
ulnerability
14. Chilkat Email 'ChilkatCert.dll' ActiveX Control Insecure Metho=
d Vulnerability
15. Xine DirectShow Loader Remote Buffer Overflow Vulnerability
16. xine-lib 'sdpplin_parse()' Remote Buffer Overflow Vulnerabilit=
y
17. Neat weblog 'articleId' Parameter SQL Injection Vulnerability
18. JGS-Treffen 'jgs_treffen.php' SQL Injection Vulnerability
19. Macrovision InstallShield InstallScript OCI Untrusted Library =
Remote Code Execution Vulnerability
20. EfesTECH Video 'catID' Parameter SQL Injection Vulnerability
21. Apache mod_jk2 Host Header Multiple Stack Based Buffer Overflo=
w Vulnerabilities
22. MPlayer 'demux_audio.c' Remote Stack Based Buffer Overflow Vul=
nerability
23. MPlayer DMO File Parsing Buffer Overflow Vulnerability
24. Cisco IOS Multiple DLSw Denial of Service Vulnerablities
25. PHP Spam Manager 'body.php' Local File Include Vulnerability
26. OpenSSH ForceCommand Command Execution Weakness
27. KwsPHP Archives Module 'id' Parameter SQL Injection Vulnerabil=
ity
28. RETIRED: Dokeos Multiple Remote Code Execution and Cross-Site =
Scripting Vulnerabilities
29. RETIRED: eGroupWare '_bad_protocol_once()' HTML Security Bypas=
s Vulnerability
30. KwsPHP Galerie Module 'id_gal' Parameter SQL Injection Vulnera=
bility
31. Parallels Virtuozzo Containers VZPP Interface File Manger Cros=
s-Site Request Forgery Vulnerability
32. PhpBlock 'basicfogfactory.class.php' Remote File Include Vulne=
rability
33. Drupal Flickr Module Multiple Unspecified Cross-Site Scripting=
Vulnerabilities
34. mcGallery 'lang' Parameter Multiple Cross Site Scripting Vulne=
rabilities
35. Gnome Desktop Screensaver NIS Authentication Local Unauthorize=
d Access Vulnerability=20
36. Microsoft April 2008 Advance Notification Multiple Vulnerabili=
ties
37. Sun Java RunTime Environment Read and Write Permission Multipl=
e Privilege Escalation Vulnerabilities
38. Sun Java SE Multiple Security Vulnerabilities
39. Sun Java Runtime Environment Image Parsing Heap Buffer Overflo=
w Vulnerability
40. RealNetworks RealPlayer 'rmoc3260.dll' ActiveX Control Memory =
Corruption Vulnerability
41. Cisco Unified Communications Disaster Recovery Framework Remot=
e Command Execution Vulnerability=20
42. Joomla! and Mambo Joomlearn LMS Component 'cat' Parameter SQL =
Injection Vulnerability
43. Microsoft Visual InterDev SLN File Buffer Overflow Vulnerabili=
ty
44. Sentinel Protection Server/Keys Server Backslash Directory Tra=
versal Vulnerability
45. Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.12 Multiple Remote=
Vulnerabilities
46. JBoss Seam 'order' Parameter SQL Injection Vulnerability
47. JFreeChart Multiple HTML Injection Vulnerabilities
48. OpenOffice HSQLDB Database Engine Unspecified Java Code Execut=
ion Vulnerability
49. Xpdf Multiple Remote Stream.CC Vulnerabilities
50. XnView FontName Buffer Overflow Vulnerability
51. Online FlashQuiz Joomla! Component 'db_config.inc.php' Remote =
File Include Vulnerability
52. DivXDB 2002 Multiple Cross-Site Scripting Vulnerabilities
53. DaZPHP 'makepost.php' Local File Include Vulnerability
54. Opera Web Browser 9.26 Multiple Security Vulnerabilities
55. LANDesk Management Suite 8.80.1.1 PXE TFTP Service Directory =
Traversal Vulnerability
56. Sun Solaris 'inetd(1M)' Daemon Insecure Temporary File Creatio=
n Vulnerability
57. OpenSSH X connections Session Hijacking Vulnerability
58. CUPS 'gif_read_lzw()' GIF File Buffer Overflow Vulnerability
59. CUPS CGI Interface Remote Buffer Overflow Vulnerability
60. CUPS Multiple Unspecified Input Validation Vulnerabilities
61. CUPS 'process_browse_data()' Remote Double Free Denial of Serv=
ice Vulnerability
62. Apple QuickTime Multiple Remote Vulnerabilities
63. Nuked-Klan HTTP Referer Header SQL Injection Vulnerability
64. suPHP Multiple Local Privilege Escalation Vulnerabilities
65. bzip2 Unspecified File Handling Vulnerability
66. MySQL Security Invoker Privilege Escalation Vulnerability
67. Secure Computing WebWasher Malformed URL Remote Denial of Serv=
ice Vulnerability
68. kses Multiple Input Validation Vulnerabilities
69. Drupal Webform Module Multiple Unspecified HTML Injection Vuln=
erabilities
70. Simple Gallery 'album' Parameter Cross-Site Scripting Vulnerab=
ility
71. Orbit Downloader 'Download Failed' Remote Buffer Overflow Vuln=
erability
72. Microsoft Internet Explorer 'ieframe.dll' Script Injection Vul=
nerability
73. Microsoft Internet Explorer XDR Prototype Hijacking Denial of =
Service Vulnerability
74. Symantec AutoFix Tool ActiveX Control Remote Share 'launchProc=
ess()' Insecure Method Vulnerability
75. Symantec AutoFix Support Tool 'SYMADATA.DLL' ActiveX Control R=
emote Buffer Overflow Vulnerability
76. EasySite 'EASYSITE_BASE' Parameter Multiple Remote File Includ=
e Vulnerabilities
77. Apache-SSL Environment Variable Information Disclosure and Pri=
vilege Escalation Vulnerability
78. HP OpenView Network Node Manager 'OVAS.EXE' Buffer Overflow Vu=
lnerability
79. Joomla! and Mambo actualite Component 'id' Parameter SQL Injec=
tion Vulnerability
80. Novell eDirectory HTTP HEAD Request Handling Denial Of Service=
Vulnerability
81. Novell NetWare iPrint Request Handling Denial Of Service Vulne=
rability
82. phpMyAdmin Local Information Disclosure Vulnerability
83. IBM DB2 Content Manager Unspecified Security Vulnerability
84. McAfee ePolicy Orchestrator 'FrameworkService.exe' Remote Deni=
al of Service Vulnerability
85. Writer's Block 'permalink.php' SQL Injection Vulnerability
86. NoticeWare Corporation NoticeWare Email Server Denial Of Servi=
ce Vulnerability
87. HP Select Identity Local Unauthorized Access Vulnerability
88. bamaGalerie 'viewcat.php' SQL Injection Vulnerability
89. CenterIM URI Hanlding Remote Arbitrary Command Execution Vulne=
rability
90. xine-lib Multiple Heap Based Remote Buffer Overflow Vulnerabil=
ities
91. PostgreSQL Multiple Privilege Escalation and Denial of Service=
Vulnerabilities
92. Cisco IOS Dual-stack Router IPv6 Denial Of Service Vulnerabili=
ty
93. Terracotta 'index.php' Local File Include Vulnerability
94. Joomla! and Mambo Ahsshop Component 'vara' Parameter SQL Injec=
tion Vulnerability
95. Comix 'filename' Remote Command Execution Vulnerability
96. Red Hat 'capp-lspp-config' Local Privilege Escalation Vulnerab=
ility
97. Chilkat HTTP 'ChilkatHttp.dll' ActiveX Control Insecure Method=
Vulnerabilities
98. FaScript Faphoto 'show.php' SQL Injection Vulnerability
99. eggBlog 'eggblogpassword' SQL Injection Vulnerability
100. Trend Micro ServerProtect Multiple Remote Insecure Method Exp=
osure Vulnerabilities
III. SECURITYFOCUS NEWS
1. Web developers, fix thy Flash
2. Hacking contest highlights value of vulnerabilities
3. House aims to scrutinize warrantless taps
4. Browser makers focus on beating malware
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Application Security Engineer, San Diego
2. [SJ-JOB] Application Security Engineer, Anywhere in Washington,=
Telecommute, Travel
3. [SJ-JOB] Application Security Engineer, Anywhere in Oregon, =
Telecommute, Travel
4. [SJ-JOB] Application Security Engineer, Anywhere in Washington,=
Telecommute, Travel
5. [SJ-JOB] Director, Information Security, San Francisco Bay Area
V. INCIDENTS LIST SUMMARY
1. SPAM drop?
VI. VULN-DEV RESEARCH LIST SUMMARY
1. Windows Vista winsat.exe Integer Overflow
2. Immunity Debugger v1.5
VII. MICROSOFT FOCUS LIST SUMMARY
1. More along the lines of malware disinfection
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1.On the Border
By Mark Rasch
Recently, I was going through an airport with my shoes, coat, jacket, and=
belt off as well as with my carry-on bag, briefcase, and laptop all sepa=
rated for easy inspection. I was heading through security at the Washingt=
on D.C., Ronald Reagan National Airport in Arlington, Virginia, or "Natio=
nal" as we locals call it. As I passed through the new magnetometer which=
gently puffed air all over my body -- which to me seems to be a cross be=
tween a glaucoma test and Marilyn Monroe in Gentlemen Prefer Blondes -- a=
TSA employee absent-mindedly asked if he could "inspect" my laptop compu=
ter. While the inspection was cursory, the situation immediately gave me =
pause: What was in my laptop anyway?
http://www.securityfocus.com/columnists/469
2.Catch Them if You Can
By Don Parker
High-profile network security breaches have proliferated over the past fe=
w years. While many "breaches" consist of lost data or a stolen laptop, t=
rue breaches -- where a online attacker compromises a network and removes=
data -- have become very common
http://www.securityfocus.com/columnists/468
II. BUGTRAQ SUMMARY
--------------------
1. Parallels Virtuozzo Containers VZPP Interface Change Pass Cross-Site R=
equest Forgery Vulnerability
BugTraq ID: 28593
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28593
Summary:
Parallels Virtuozzo Containers is prone to a cross-site request-forgery v=
ulnerability.
Exploiting the issue will allow a remote attacker to use a victim's curre=
ntly active session to change the victim's password. Successful exploits =
will compromise affected computers.
Virtuozzo Containers 3.0.0-25.4.swsoft is vulnerable; other versions are =
also affected.
2. Smart Classified ADS and Smart Photo ADS 'view.cgi' Multiple Cross Sit=
e Scripting Vulnerabilities
BugTraq ID: 28595
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28595
Summary:
Smart Classified ADS and Smart Photo ADS are prone to multiple cross-site=
scripting vulnerabilities because the application fails to sufficiently =
sanitize user-supplied input.
Exploiting these vulnerabilities may allow an attacker to perform cross-s=
ite scripting attacks on unsuspecting users in the context of the affecte=
d site. As a result, the attacker may be able to steal cookie-based authe=
ntication credentials and to launch other attacks.
3. exiftags Multiple Unspecified Buffer Overflow And Denial Of Service Vu=
lnerabilities
BugTraq ID: 26892
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/26892
Summary:
The 'exiftags' utility is prone to multiple unspecified buffer-overflow a=
nd denial-of-service vulnerabilities.
An attacker can exploit these issues to deny access to legitimate users. =
Attackers may also be able to execute arbitrary code, but this has not be=
en confirmed.
Very few technical details are currently available. We will update this B=
ID as more information emerges.
These issues affect versions prior to exiftags 1.01.
4. EasyNews Multiple Input Validation Vulnerabilities
BugTraq ID: 28542
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28542
Summary:
EasyNews is prone to multiple input-validation vulnerabilities because it=
fails to sufficiently sanitize user-supplied data. The issues include SQ=
L-injection, cross-site scripting, and local file-include vulnerabilities=
.
Exploiting these issues could allow an attacker to steal cookie-based aut=
hentication credentials, compromise the application, access or modify dat=
a, execute arbitrary local scripts, retrieve potentially sensitive infor=
mation, or exploit latent vulnerabilities in the underlying database.=20
These issues affect EasyNews 4.0tr; other versions may also be vulnerable=
.
5. Phorum Multiple Unspecified SQL Injection Vulnerabilities
BugTraq ID: 28540
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28540
Summary:
Phorum is prone to multiple SQL-injection vulnerabilities because it fail=
s to sufficiently sanitize user-supplied data before using it in SQL quer=
ies.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
Versions prior to Phorum 5.2.6 are vulnerable.
6. Microsoft Crypto API X.509 Certificate Validation Remote Information D=
isclosure Vulnerability
BugTraq ID: 28548
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28548
Summary:
Microsoft's Crypto API library is prone to an information-disclosure vuln=
erability because HTTP requests to arbitrary hosts and ports may be autom=
atically triggered when validating X.509 certificates.
Successful exploits allow attackers to trigger HTTP requests to arbitrary=
hosts and ports without confirmation or notification to unsuspecting use=
rs. Attackers may use this for determining when email and documents are r=
ead, for port scanning, or for aiding in other attacks.
The following products are known to exhibit this issue:
Microsoft Outlook 2007
Microsoft Windows Live Mail 2008
Microsoft Office 2007
Other products that use the Crypto API provided by Windows may also be af=
fected.
7. Sympa 'Content-Type' Header Remote Denial Of Service Vulnerability
BugTraq ID: 28539
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28539
Summary:
Sympa is prone to a remote denial-of-service vulnerability because it fai=
ls to handle specially crafted 'Content-Type' headers.
An attacker can exploit this issue to cause the application to crash. Suc=
cessful attacks will deny service to legitimate users.
Versions prior to Sympa 5.4 are affected.
8. LANDesk Management Suite TFTP service Directory Traversal Vulnerabilit=
y
BugTraq ID: 28535
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28535
Summary:
LANDesk Management Suite is prone to a directory-traversal vulnerability =
because it fails to sufficiently sanitize user-supplied input data.
Exploiting this issue allows an attacker to access arbitrary files outsid=
e of the TFTP application's root directory. This can expose sensitive inf=
ormation that could help the attacker launch further attacks.
LANDesk Management Suite 8.8 as well as 8.7 SP5 and prior service packs a=
re vulnerable.
9. Xpdf PDFTOPS Multiple Integer Overflow Vulnerabilities
BugTraq ID: 11501
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/11501
Summary:
The pdftops utility is reported prone to multiple integer-overflow vulner=
abilities because it fails to properly ensure that user-supplied input do=
esn't result in the overflowing of integer values. This may result in dat=
a being copied past the end of a memory buffer.=20
These overflows cause the application to allocate memory regions that are=
smaller than expected. Subsequent operations are likely to overwrite mem=
ory regions past the end of the allocated buffer, allowing attackers to o=
verwrite critical memory control structures. This may allow attackers to =
control the flow of execution and potentially execute attacker-supplied c=
ode in the context of the affected application.=20
Applications using embedded xpdf code may be vulnerable to these issues a=
s well.
10. xine-lib Matroska Demuxer Remote Buffer Overflow Vulnerability
BugTraq ID: 28543
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28543
Summary:
The 'xine-lib' library is prone to a buffer-overflow vulnerability becaus=
e it fails to perform adequate boundary checks on user-supplied input.
Attackers can exploit this issue to cause denial-of-service conditions an=
d possibly execute arbitrary code in the context of applications that use=
the library.
Versions prior to xine-lib 1.1.10.1 are vulnerable.
11. Sava's Place Sava's Link Manager 'category' Parameter SQL Injection V=
ulnerability
BugTraq ID: 28538
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28538
Summary:
Sava's Link Manager is prone to an SQL-injection vulnerability because it=
fails to sufficiently sanitize user-supplied data before using it in an =
SQL query.=20
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Sava's Link Manager 2.0 is vulnerable; other versions may also be affecte=
d.
12. Sava's Place Sava's Link Manager 'index.php' Local File Include Vulne=
rability
BugTraq ID: 28537
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28537
Summary:
Sava's Link Manager is prone to a local file-include vulnerability becaus=
e it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal stri=
ngs to view files and execute local scripts in the context of the webserv=
er process. This may aid in further attacks.
The issue affects Sava's Link Manager 2.0; other versions may be vulnerab=
le as well.
13. Sava's Place Sava's Guestbook 'index.php' Local File Include Vulnerab=
ility
BugTraq ID: 28536
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28536
Summary:
Sava's Guestbook is prone to a local file-include vulnerability because i=
t fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal stri=
ngs to view files and execute local scripts in the context of the webserv=
er process. This may aid in further attacks.
The issue affects Sava's Guestbook 2.0; other versions may be vulnerable =
as well.
14. Chilkat Email 'ChilkatCert.dll' ActiveX Control Insecure Method Vulne=
rability
BugTraq ID: 27493
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/27493
Summary:
Chilkat Email ActiveX control is prone to a vulnerability that allows att=
ackers to create or overwrite arbitrary data with the privileges of the a=
pplication using the control (typically Internet Explorer).
Successful exploits can compromise affected computers or cause denial-of-=
service conditions; other attacks are possible.
This issue affects the 'ChilkatCert.dll' library of the Chilkat Email Act=
iveX control 7.8; other versions may also be affected.
15. Xine DirectShow Loader Remote Buffer Overflow Vulnerability
BugTraq ID: 22933
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/22933
Summary:
Xine is prone to a remote buffer-overflow vulnerability because the appli=
cation fails to perform boundary checks before copying user-supplied inpu=
t into finite-sized buffers.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary machine code in the context of the application and to compromise a=
ffected computers.
16. xine-lib 'sdpplin_parse()' Remote Buffer Overflow Vulnerability
BugTraq ID: 28312
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28312
Summary:
The 'xine-lib' library is prone to a remote buffer-overflow vulnerability=
because the software fails to perform adequate boundary checks on user-s=
upplied data.=20
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of the user running an application that relies on the affected li=
brary. Failed exploit attempts will result in a denial-of-service conditi=
on.
=20
This issue affects xine-lib 1.1.10.1; other versions may also be vulnera=
ble.
17. Neat weblog 'articleId' Parameter SQL Injection Vulnerability
BugTraq ID: 28534
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28534
Summary:
Neat weblog is prone to an SQL-injection vulnerability because it fails t=
o sufficiently sanitize user-supplied data before using it in an SQL quer=
y.=20
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Neat weblog 0.2 is vulnerable; other versions may also be affected.
18. JGS-Treffen 'jgs_treffen.php' SQL Injection Vulnerability
BugTraq ID: 28530
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28530
Summary:
The JGS-Treffen addon for WoltLab Burning Board is prone to an SQL-inject=
ion vulnerability because the application fails to properly sanitize user=
-supplied input before using it in an SQL query.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
This issue affects JGS-Treffen 2.0.2 and prior versions.
19. Macrovision InstallShield InstallScript OCI Untrusted Library Remote =
Code Execution Vulnerability
BugTraq ID: 28533
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28533
Summary:
Macrovision InstallShield InstallScript OCI (One-Click Install) is prone=
to a remote code-execution vulnerability because it fails to adequately =
sanitize user-supplied data.
Successfully exploiting this issue will allow an attacker to execute arbi=
trary code with the permissions of the user running the application.
20. EfesTECH Video 'catID' Parameter SQL Injection Vulnerability
BugTraq ID: 28532
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28532
Summary:
EfesTECH Video is prone to an SQL-injection vulnerability because it fail=
s to sufficiently sanitize user-supplied data before using it in an SQL q=
uery.=20
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
EfesTECH Video 5.0 is vulnerable; other versions may also be affected.
21. Apache mod_jk2 Host Header Multiple Stack Based Buffer Overflow Vulne=
rabilities
BugTraq ID: 27752
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/27752
Summary:
Apache mod_jk2 is prone to multiple stack-based buffer-overflow vulnerabi=
lities because it fails to perform adequate boundary checks on user-suppl=
ied data before copying it to insufficiently sized buffers.
Successful exploits may allow attackers to execute arbitrary code in the=
context of a vulnerable application; failed attempts will likely cause d=
enial-of-service conditions.
Versions prior to mod_jk2 2.0.4 are vulnerable.
NOTE: mod_jk2 is a legacy branch of mod_jk that is now deprecated; mod_jk=
is a currently supported module and is reportedly unaffected by these is=
sues.
22. MPlayer 'demux_audio.c' Remote Stack Based Buffer Overflow Vulnerabil=
ity
BugTraq ID: 27441
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/27441
Summary:
MPlayer is prone to a remote stack-based buffer-overflow vulnerability be=
cause it fails to perform adequate boundary checks on user-supplied input=
before copying it to an insufficiently sized buffer.
Attackers can exploit this issue to execute arbitrary code in the context=
of the application. Failed attacks will cause denial-of-service conditio=
ns.
MPlayer 1.0 rc2 is vulnerable; other versions may also be affected.
23. MPlayer DMO File Parsing Buffer Overflow Vulnerability
BugTraq ID: 22771
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/22771
Summary:
MPlayer is prone to a buffer-overflow vulnerability when it attempts to p=
rocess malformed video files. This issue occurs because the application f=
ails to perform proper bounds-checking on user-supplied data before copyi=
ng it to an insufficiently sized memory buffer.
An attacker may exploit this issue to execute arbitrary code with the pri=
vileges of the user that activated the vulnerable application. This may f=
acilitate unauthorized access or privilege escalation.
MPlayer 1.0rc1 is vulnerable to this issue; previous versions may also be=
affected.
24. Cisco IOS Multiple DLSw Denial of Service Vulnerablities
BugTraq ID: 28465
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28465
Summary:
Cisco IOS is prone to multiple remote denial-of-service vulnerabilities b=
ecause the software fails to properly handle malformed network datagrams.
Successfully exploiting these issues allows remote attackers to trigger m=
emory leaks or crashes in targeted devices. This will lead to denial-of-s=
ervice conditions.
These issues are tracked by Cisco Bug ID CSCsk73104.
25. PHP Spam Manager 'body.php' Local File Include Vulnerability
BugTraq ID: 28529
Remote: Yes
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28529
Summary:
PHP Spam Manager is prone to a local file-include vulnerability because i=
t fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal stri=
ngs to view local files in the context of the webserver process. This may=
aid in further attacks.
PHP Spam Manager 0.53 beta is vulnerable; other versions may also be affe=
cted.
26. OpenSSH ForceCommand Command Execution Weakness
BugTraq ID: 28531
Remote: No
Last Updated: 2008-04-01
Relevant URL: http://www.securityfocus.com/bid/28531
Summary:
OpenSSH is prone to a weakness that may allow attackers to execute arbitr=
ary commands.
Successful exploits may allow attackers to execute arbitrary commands, co=
ntrary to the wishes of administrators and bypassing the intent of the 'F=
orceCommand' option.
Versions prior to OpenSSH 4.9 are vulnerable.
27. KwsPHP Archives Module 'id' Parameter SQL Injection Vulnerability
BugTraq ID: 28592
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28592
Summary:
KwsPHP is prone to an SQL-injection vulnerability because it fails to suf=
ficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
KwsPHP 1.3.456 is vulnerable; other versions may also be affected.
28. RETIRED: Dokeos Multiple Remote Code Execution and Cross-Site Scripti=
ng Vulnerabilities
BugTraq ID: 28121
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28121
Summary:
Dokeos is prone to multiple unspecified cross-site scripting vulnerabilit=
ies and multiple unspecified remote code-execution vulnerabilities becaus=
e the application fails to sufficiently sanitize user-supplied data.
Attackers can exploit these issues to execute arbitrary code in the conte=
xt of the webserver, compromise the affected application, and steal cooki=
e-based authentication credentials from legitimate users of the site. Oth=
er attacks are also possible.
These issues affect Dokeos 1.8.4 prior to SP3.
NOTE: This BID is now retired. It has been incorporated into BID 28599 (k=
ses Multiple Input Validation Vulnerabilities), because the underlying pr=
oblems are caused by the kses HTML filter.
29. RETIRED: eGroupWare '_bad_protocol_once()' HTML Security Bypass Vulne=
rability
BugTraq ID: 28424
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28424
Summary:
eGroupWare is prone to a vulnerability that allows arbitrary code to bypa=
ss HTML filtering.
An attacker can exploit this issue to execute arbitrary script code in th=
e context of the application, potentially allowing the attacker to steal =
cookie-based authentication credentials or to control how the site is ren=
dered to the user; other attacks are also possible.
Versions prior to eGroupWare 1.4.003 are vulnerable; other versions may a=
lso be affected.
NOTE: This BID is now retired. It has been incorporated into BID 28599 (k=
ses Multiple Input Validation Vulnerabilities), because the underlying pr=
oblems are caused by the kses HTML filter.
30. KwsPHP Galerie Module 'id_gal' Parameter SQL Injection Vulnerability
BugTraq ID: 28590
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28590
Summary:
KwsPHP is prone to an SQL-injection vulnerability because it fails to suf=
ficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
KwsPHP 1.3.456 is vulnerable; other versions may also be affected.
31. Parallels Virtuozzo Containers VZPP Interface File Manger Cross-Site =
Request Forgery Vulnerability
BugTraq ID: 28589
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28589
Summary:
Parallels Virtuozzo Containers is prone to a cross-site request-forgery v=
ulnerability.
Exploiting the issue will allow a remote attacker to use a victim's curre=
ntly active session to perform certain file-management actions with the p=
rivileges of the user running the application. Successful exploits will c=
ompromise affected computers.
Virtuozzo Containers 3.0.0-25.4.swsoft and 4.0.0-365.6.swsoft are vulnera=
ble; other versions are also affected.
32. PhpBlock 'basicfogfactory.class.php' Remote File Include Vulnerabilit=
y
BugTraq ID: 28588
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28588
Summary:
PhpBlock is prone to a remote file-include vulnerability because it fails=
to properly sanitize user-supplied input.
An attacker can exploit this issue to execute malicious PHP code in the c=
ontext of the webserver process. This may allow the attacker to compromis=
e the application and the underlying system; other attacks are also possi=
ble.=20
PhpBlockhttp://sourceforge.net/forum/forum.php?forum_id=3D804801 A8.4 is =
vulnerable; other versions may also be affected.
33. Drupal Flickr Module Multiple Unspecified Cross-Site Scripting Vulner=
abilities
BugTraq ID: 28594
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28594
Summary:
The Flickr module for Drupal is prone to multiple cross-site scripting vu=
lnerabilities because it fails to sufficiently sanitize user-supplied inp=
ut data.
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may help the attacker steal cookie-based authentication credentials=
and launch other attacks.
=20
These issues affect Flickr 5.x prior to 5.x-1.3 and 6.x prior to 6.x-1.0-=
alpha1.
34. mcGallery 'lang' Parameter Multiple Cross Site Scripting Vulnerabilit=
ies
BugTraq ID: 28587
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28587
Summary:
mcGallery is prone to multiple cross-site scripting vulnerabilities becau=
se it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
mcGallery 1.1 is vulnerable; other versions may also be affected.
35. Gnome Desktop Screensaver NIS Authentication Local Unauthorized Acces=
s Vulnerability=20
BugTraq ID: 28575
Remote: No
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28575
Summary:
Gnome Desktop is prone to a local unauthorized-access vulnerability.
A local attacker can exploit this issue to gain access to the affected co=
mputer. Successfully exploiting this issue may lead to other attacks.
36. Microsoft April 2008 Advance Notification Multiple Vulnerabilities
BugTraq ID: 28598
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28598
Summary:
Microsoft has released advance notification that the vendor will be relea=
sing eight security bulletins on April 8, 2008. The highest severity rati=
ng for these issues is 'Critical'.
Successfully exploiting these issues may allow remote or local attackers =
to compromise affected computers.
37. Sun Java RunTime Environment Read and Write Permission Multiple Privi=
lege Escalation Vulnerabilities
BugTraq ID: 27650
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/27650
Summary:
Sun Java Runtime Environment is prone to multiple privilege-escalation vu=
lnerabilities when running untrusted applications or applets.
Successful exploits will compromise arbitrary data and possibly the under=
lying computer.
These issues affect the following versions:
JDK and JRE 6 Update 1 and earlier
JDK and JRE 5.0 Update 13 and earlier.
38. Sun Java SE Multiple Security Vulnerabilities
BugTraq ID: 28083
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28083
Summary:
Sun has released advisories addressing multiple vulnerabilities affecting=
the following software:
JDK and JRE 6 Update 5
JDK and JRE 5.0 Update 15
SDK and JRE 1.4.2_17
SDK and JRE 1.3.1_22
39. Sun Java Runtime Environment Image Parsing Heap Buffer Overflow Vulne=
rability
BugTraq ID: 28125
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28125
Summary:
Sun Java Runtime Environment is prone to a heap-based buffer-overflow vul=
nerability because the application fails to perform adequate boundary che=
cks on user-supplied data.
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of the user running the affected application. Failed exploit atte=
mpts will likely crash the application.
This issue affects the following products and versions:
JDK and JRE 6 prior to Update 5
JDK and JRE 5.0 prior to Update 15
SDK and JRE prior to 1.4.2_17
SDK and JRE prior to 1.3.1_22
This vulnerability was previously covered in BID 28083 (Sun Java SE Multi=
ple Security Vulnerabilities), but has been given its own record to bette=
r document the issue.
40. RealNetworks RealPlayer 'rmoc3260.dll' ActiveX Control Memory Corrupt=
ion Vulnerability
BugTraq ID: 28157
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28157
Summary:
RealNetworks RealPlayer 'rmoc3260.dll' ActiveX control is prone to a memo=
ry-corruption vulnerability.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the affected ActiveX =
control. Failed exploit attempts will likely crash the application.
41. Cisco Unified Communications Disaster Recovery Framework Remote Comma=
nd Execution Vulnerability=20
BugTraq ID: 28591
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28591
Summary:
Multiple Cisco Unified Communications products are prone to a remote comm=
and-execution vulnerability. This issue occurs in the Disaster Recovery F=
ramework.=20
An attacker can exploit this issue to execute arbitrary commands with ful=
l administrative privileges.
The following products are affected:
Cisco Unified Communications Manager (CUCM) 5.x and 6.x
Cisco Unified Communications Manager Business Edition
Cisco Unified Presence 1.x and 6.x
Cisco Emergency Responder 2.x
Cisco Mobility Manager 2.x
42. Joomla! and Mambo Joomlearn LMS Component 'cat' Parameter SQL Injecti=
on Vulnerability
BugTraq ID: 28586
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28586
Summary:
The Joomlearn LMS component for Joomla! and Mambo is prone to an SQL-inj=
ection vulnerability because it fails to sufficiently sanitize user-suppl=
ied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
43. Microsoft Visual InterDev SLN File Buffer Overflow Vulnerability
BugTraq ID: 27250
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/27250
Summary:
Microsoft Visual InterDev is prone to a buffer-overflow vulnerability bec=
ause it fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue will allow an attacker to execute arbi=
trary code with the privileges of the user running the affected applicati=
on. Failed exploit attempts will result in a denial-of-service condition.
=20
This issue affects Visual InterDev 6.0; other versions may also be affect=
ed.
44. Sentinel Protection Server/Keys Server Backslash Directory Traversal =
Vulnerability
BugTraq ID: 27735
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/27735
Summary:
Sentinel Protection Server and Keys Server are prone to a directory-trave=
rsal vulnerability because the software fails to sufficiently sanitize us=
er-supplied input data.
Exploiting this issue may allow an attacker to access sensitive informati=
on that could aid in further attacks.
This issue affects Protection Server 7.4.1.0 and Keys Server 1.0.4; earli=
er versions may also be vulnerable.
NOTE: This issue may be caused by an incomplete security patch released i=
n November 2007 that was documented in BID 26583 ('Sentinel Protection Se=
rver/Keys Server Directory Traversal Vulnerability').
45. Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.12 Multiple Remote Vulner=
abilities
BugTraq ID: 28448
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28448
Summary:
The Mozilla Foundation has released multiple security advisories specifyi=
ng various vulnerabilities in Firefox 2.0.0.12 and prior versions.
Exploiting these issues can allow attackers to:
- steal authentication credentials
- obtain potentially sensitive information
- violate the same-origin policy
- execute scripts with elevated privileges
- cause denial-of-service conditions
- potentially execute arbitrary code=20
- perform cross-site request-forgery attacks
Other attacks are possible.
These issues are present in Firefox 2.0.0.12 and prior versions. Many of =
these issues are present in Mozilla Thunderbird 2.0.0.12 and prior versio=
ns as well as SeaMonkey 1.1.8 and prior versions.
46. JBoss Seam 'order' Parameter SQL Injection Vulnerability
BugTraq ID: 26850
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/26850
Summary:
JBoss Seam is prone to an SQL-injection vulnerability because it fails to=
sufficiently sanitize user-supplied data before using it in an SQL query=
.
Exploiting this issue could allow an attacker to compromise applications =
using the JBoss Seam framework, access or modify data, or exploit latent =
vulnerabilities in the underlying database.
This issue affects versions prior to JBoss Seam 2.0.0 GA.
47. JFreeChart Multiple HTML Injection Vulnerabilities
BugTraq ID: 26752
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/26752
Summary:
JFreeChart is prone to multiple HTML-injection vulnerabilities because it=
fails to properly sanitize user-supplied input.=20
Attacker-supplied HTML and script code could execute in the context of th=
e affected website, potentially allowing the attacker to steal cookie-bas=
ed authentication credentials or to control how the site is rendered to t=
he user; other attacks are also possible.
These issues affect JFreeChart 1.0.8; other versions may be affected as w=
ell.
48. OpenOffice HSQLDB Database Engine Unspecified Java Code Execution Vul=
nerability
BugTraq ID: 26703
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/26703
Summary:
OpenOffice is prone to a code-execution vulnerability.
Successful exploits allow remote attackers to execute arbitrary Java code=
in the context of the vulnerable application.
Versions prior to OpenOffice 2.3.1 are vulnerable.
49. Xpdf Multiple Remote Stream.CC Vulnerabilities
BugTraq ID: 26367
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/26367
Summary:
Xpdf is prone to multiple remote vulnerabilities because of flaws in vari=
ous functions in the 'Stream.cc' source file.
Attackers exploit these issues by coercing users to view specially crafte=
d PDF files with the affected application.
Successfully exploiting these issues allows attackers to execute arbitrar=
y machine code in the context of the vulnerable application. This facilit=
ates the remote compromise of affected computers.
Xpdf 3.02pl1 is vulnerable to these issues; other versions may also be af=
fected.
50. XnView FontName Buffer Overflow Vulnerability
BugTraq ID: 28579
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28579
Summary:
XnView is prone to a buffer-overflow vulnerability because the applicatio=
n fails to bounds-check user-supplied data before copying it into an insu=
fficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code in the conte=
xt of the user running the affected application. Failed exploit attempts =
will result in a denial of service.
This issue affects XnView 1.92.1; other versions may also be vulnerable.
51. Online FlashQuiz Joomla! Component 'db_config.inc.php' Remote File In=
clude Vulnerability
BugTraq ID: 28574
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28574
Summary:
The Elearningforce Online FlashQuiz component for Joomla! is prone to a r=
emote file-include vulnerability because it fails to sufficiently sanitiz=
e user-supplied data.
Exploiting this issue can allow an attacker to compromise the application=
and the underlying system; other attacks are also possible.
Online FlashQuiz 1.0.2 is vulnerable; other versions may also be affected=
.
52. DivXDB 2002 Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 28566
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28566
Summary:
DivXDB 2002 is prone to multiple cross-site scripting vulnerabilities bec=
ause it fails to properly sanitize user-supplied input.=20
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
DivXDB 2002 0.94b is vulnerable; other versions may also be affected.
53. DaZPHP 'makepost.php' Local File Include Vulnerability
BugTraq ID: 28582
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28582
Summary:
DaZPHP is prone to a local file-include vulnerability because it fails to=
properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal stri=
ngs to view local files in the context of the webserver process. This may=
aid in further attacks.
DaZPHP 0.1 is vulnerable; other versions may also be affected.
54. Opera Web Browser 9.26 Multiple Security Vulnerabilities
BugTraq ID: 28585
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28585
Summary:
Opera Web Browser is prone to multiple security vulnerabilities that may =
allow remote attackers to execute code.
These issues lead to memory corruption and may result in remote unauthori=
zed access and denial-of-service attacks.
Versions prior to Opera 9.27 are vulnerable.
55. LANDesk Management Suite 8.80.1.1 PXE TFTP Service Directory Travers=
al Vulnerability
BugTraq ID: 28577
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28577
Summary:
LANDesk Management Suite is prone to a directory-traversal vulnerability =
because it fails to sufficiently sanitize user-supplied input data.
Exploiting this issue allows an attacker to access arbitrary files outsid=
e of the TFTP application's root directory. This can expose sensitive inf=
ormation that could help the attacker launch further attacks.
LANDesk Management Suite 8.80.1.1 is vulnerable; other versions may also =
be affected.
56. Sun Solaris 'inetd(1M)' Daemon Insecure Temporary File Creation Vulne=
rability
BugTraq ID: 28584
Remote: No
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28584
Summary:
Sun Solaris 'inetd(1M)' creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to per=
form symbolic-link attacks, overwriting arbitrary files in the context of=
the affected application.=20
Successfully mounting a symlink attack may allow the attacker to delete o=
r corrupt sensitive files, which may result in a denial of service. Other=
attacks may also be possible.
This issue affects Sun Solaris 10 for SPARC and x86 platforms.
57. OpenSSH X connections Session Hijacking Vulnerability
BugTraq ID: 28444
Remote: No
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28444
Summary:
OpenSSH is prone to a vulnerability that allows attackers to hijack forwa=
rded X connections.
Successfully exploiting this issue may allow an attacker run arbitrary sh=
ell commands with the privileges of the user running the affected applica=
tion.
This issue affects OpenSSH 4.3p2; other versions may also be affected.=20
NOTE: This issue affects the portable version of OpenSSH and may not affe=
ct OpenSSH running on OpenBSD.
58. CUPS 'gif_read_lzw()' GIF File Buffer Overflow Vulnerability
BugTraq ID: 28544
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28544
Summary:
CUPS is prone to a buffer-overflow vulnerability because it fails to perf=
orm adequate boundary checks on user-supplied GIF image data before copyi=
ng it to an insufficiently sized buffer.
Successful exploits allow attackers to execute arbitrary code with the pr=
ivileges of a user running the utilities. Failed exploit attempts likely =
cause denial-of-service conditions.
CUPS 1.3.6 is vulnerable; other versions may also be affected.
59. CUPS CGI Interface Remote Buffer Overflow Vulnerability
BugTraq ID: 28307
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28307
Summary:
CUPS is prone to a remote buffer-overflow vulnerability because it fails =
to properly bounds-check user-supplied data before copying it to an insuf=
ficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code within the c=
ontext of the affected application. Failed exploit attempts will result i=
n a denial of service.
CUPS 1.3.5 is reported vulnerable; other versions may be affected as well=
.
NOTE: This issue was originally covered in BID 28304 (Apple Mac OS X 2008=
-002 Multiple Security Vulnerabilities), but has been given its own recor=
d because further information has emerged.
60. CUPS Multiple Unspecified Input Validation Vulnerabilities
BugTraq ID: 28334
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28334
Summary:
CUPS is prone to multiple unspecified input-validation vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with SYSTE=
M-privileges. Failed attacks will cause denial-of-service conditions.
Very few technical details are currently available. We will update this =
BID as more information is disclosed.
NOTE: This vulnerability was previously covered in BID 28304 (Apple Mac O=
S X 2008-002 Multiple Security Vulnerabilities), but has been given its o=
wn record to better document the issue.
61. CUPS 'process_browse_data()' Remote Double Free Denial of Service Vul=
nerability
BugTraq ID: 27906
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/27906
Summary:
CUPS is prone to a remote denial-of-service vulnerability because it fail=
s to protect against a double-free condition.
Attackers may exploit this issue to crash the application, denying servic=
e to legitimate users. Remote code execution may also be possible, but th=
is has not been confirmed.
CUPS 1.3.5 is vulnerable to this issue; other versions may also be affect=
ed.
62. Apple QuickTime Multiple Remote Vulnerabilities
BugTraq ID: 28583
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28583
Summary:
Apple QuickTime is prone to multiple remote vulnerabilities that may allo=
w remote attackers to obtain sensitive information, execute arbitrary cod=
e, and carry out denial-of-service attacks.
These issues arise when the application handles specially crafted Java ap=
plets, image files, and movie files. Successful exploits may allow attack=
ers to obtain sensitive information, gain remote unauthorized access in t=
he context of a vulnerable user, and trigger a denial-of-service conditio=
n.
Versions prior to QuickTime 7.4.5 are affected by these vulnerabilities.
63. Nuked-Klan HTTP Referer Header SQL Injection Vulnerability
BugTraq ID: 28578
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28578
Summary:
Nuked-Klan is prone to an SQL-injection vulnerability because it fails to=
sufficiently sanitize user-supplied data before using it in an SQL query=
.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Nuked-Klan 1.7.6 is vulnerable; other versions may also be affected.
64. suPHP Multiple Local Privilege Escalation Vulnerabilities
BugTraq ID: 28568
Remote: No
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28568
Summary:
suPHP is prone to multiple local privilege-escalation vulnerabilities, du=
e to various race conditions that occur in the affected application.
Successfully exploiting these issues will allow attackers to gain elevate=
d privileges on the affected computer.
65. bzip2 Unspecified File Handling Vulnerability
BugTraq ID: 28286
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28286
Summary:
The 'bzip2' application is prone to a remote file-handling vulnerability =
because the application fails to properly handle malformed files.
Successful exploits may allow remote code to run, but this has not been c=
onfirmed. Exploit attempts will likely crash the application.
This issue affects bzip2 1.0.4; prior versions may also be affected.
66. MySQL Security Invoker Privilege Escalation Vulnerability
BugTraq ID: 24011
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/24011
Summary:
MySQL is prone to a privilege-escalation vulnerability because it fails t=
o adequately restore access privileges during certain routines.
A remote authenticated attacker can exploit this issue to gain elevated p=
rivileges on an affected database.
These versions are vulnerable:
MySQL 5 prior to 5.0.40
MySQL 5.1 prior to 5.1.18
67. Secure Computing WebWasher Malformed URL Remote Denial of Service Vul=
nerability
BugTraq ID: 28600
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28600
Summary:
WebWasher is prone to a remote denial-of-service vulnerability.
Exploiting this issue allows remote attackers to crash the application, d=
enying further service to legitimate users.=20
These issues affect the following versions:
- WebWasher 6.3.0 prior to build 3150
- WebWasher 5.3.0 prior to build 3159
68. kses Multiple Input Validation Vulnerabilities
BugTraq ID: 28599
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28599
Summary:
The kses HTML filter is prone to multiple input-validation vulnerabilitie=
s that can lead to client-side script execution.
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks. PHP code-execution is also reportedly p=
ossible, but may only be exploitable in limited, unknown circumstances.
The issues affect multiple projects that have incorporated kses. The foll=
owing are known to be affected:
- Dokeos in versions prior to 1.8.4 SP3
- eGroupWare in version prior to 1.4.003
- WordPress in versions prior to 2.5
- Moodle in versions prior to 1.9.
Other applications may also be affected.
These issues were previously documented in the following BIDs:
- 28424 eGroupWare '_bad_protocol_once()' HTML Security Bypass Vulnerabil=
ity
- 28121 Dokeos Multiple Remote Code Execution and Cross-Site Scripting Vu=
lnerabilities
Since these issues were determined to originate in the same kses-based so=
urce code, this BID has been created to cover all the affected packages.
69. Drupal Webform Module Multiple Unspecified HTML Injection Vulnerabili=
ties
BugTraq ID: 28597
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28597
Summary:
The Webform module for Drupal is prone to multiple HTML-injection vulnera=
bilities because it fails to sufficiently sanitize user-supplied input da=
ta.
Exploiting these issues may allow an attacker to execute HTML and script =
code in the context of the affected site, to steal cookie-based authentic=
ation credentials, or to control how the site is rendered to the user; ot=
her attacks are also possible.
These issues affected Webform 5.x versions prior to 5.x-1.10 and 5.x-2.0-=
beta3, as well as, 6.x versions prior to 6.x-1.0-beta3.
70. Simple Gallery 'album' Parameter Cross-Site Scripting Vulnerability
BugTraq ID: 28596
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28596
Summary:
Simple Gallery is prone to a cross-site scripting vulnerability because t=
he application fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
Simple Gallery 2.2 is vulnerable; other versions may also be affected.
71. Orbit Downloader 'Download Failed' Remote Buffer Overflow Vulnerabili=
ty
BugTraq ID: 28541
Remote: Yes
Last Updated: 2008-04-03
Relevant URL: http://www.securityfocus.com/bid/28541
Summary:
Orbit Downloader is prone to a remote buffer-overflow vulnerability becau=
se it fails to perform adequate boundary checks on user-supplied data.=20
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of the user running the application. Failed exploit attempts wil=
l result in a denial-of-service condition.
=20
This issue affects Orbit Downloader prior to version 2.6.5.
72. Microsoft Internet Explorer 'ieframe.dll' Script Injection Vulnerabil=
ity
BugTraq ID: 28581
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28581
Summary:
Microsoft Internet Explorer is prone to a script-injection vulnerability =
when handling specially crafted requests to 'acr_error.htm' via the 'res:=
//' protocol. The file resides in the 'ieframe.dll' dynamic-link library.
An attacker may leverage this issue to execute arbitrary code in the cont=
ext of a user's browser. Successful exploits can allow the attacker to st=
eal cookie-based authentication credentials, obtain potentially sensitive=
information stored on the victim's computer, and launch other attacks.
Internet Explorer 8 is vulnerable. Internet Explorer 7 is likely vulnerab=
le as well, but this has not been confirmed.
73. Microsoft Internet Explorer XDR Prototype Hijacking Denial of Service=
Vulnerability
BugTraq ID: 28580
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28580
Summary:
Microsoft Internet Explorer is prone to a denial-of-service vulnerability=
.=20
An attacker may exploit this issue by enticing victims into opening a mal=
iciously crafted webpage.
Successfully exploiting this issue will allow attackers to crash the app=
lication, denying service to legitimate users.=20
This issue affects Microsoft Internet Explorer 8 Beta 1.
74. Symantec AutoFix Tool ActiveX Control Remote Share 'launchProcess()' =
Insecure Method Vulnerability
BugTraq ID: 28509
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28509
Summary:
An ActiveX control in the Symantec AutoFix Tool is prone to a vulnerabili=
ty due to an insecure method.=20
Attackers can leverage this issue to load an arbitrary file onto a victim=
's computer and then execute it with the privileges of the application ru=
nning the control (typically Internet Explorer). This issue is exploitabl=
e only when a victim's computer is configured to allow remote connections=
to WebDav or SMB shares.
Successful exploits will compromise affected computers.
This issue affects the 'SYMADATA.DLL' 2.7.0.1 ActiveX control, which is p=
art of the following Symantec products:
=20
Norton 360 1.0
Norton AntiVirus 2006-2008
Norton Internet Security 2006-2008
Norton System Works 2006-2008
75. Symantec AutoFix Support Tool 'SYMADATA.DLL' ActiveX Control Remote B=
uffer Overflow Vulnerability
BugTraq ID: 28507
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28507
Summary:
Symantec AutoFix Support Tool ActiveX control is prone to a buffer-overfl=
ow vulnerability because it fails to perform adequate boundary checks on =
user-supplied input.
An attacker can exploit this issue to execute arbitrary code in the conte=
xt of an application using the ActiveX control (typically Internet Explor=
er). Failed attacks will likely cause denial-of-service conditions.
NOTE: To exploit this issue, an attacker must entice an unsuspecting vict=
im to to visit a malicious website masquerading as a trusted Symantec sit=
e.
This issue affects 'SYMADATA.DLL' 2.7.0.1 ActiveX control, which is part =
of the following Symantec products:
Norton 360 1.0
Norton AntiVirus 2006-2008
Norton Internet Security 2006-2008
Norton System Works 2006-2008
76. EasySite 'EASYSITE_BASE' Parameter Multiple Remote File Include Vulne=
rabilities
BugTraq ID: 28563
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28563
Summary:
EasySite is prone to multiple remote file-include vulnerabilities because=
it fails to sufficiently sanitize user-supplied data.
Exploiting these issues may allow an attacker to compromise the applicati=
on and the underlying system; other attacks are also possible.
EasySite 2.0 is vulnerable; other versions may also be affected.
77. Apache-SSL Environment Variable Information Disclosure and Privilege =
Escalation Vulnerability
BugTraq ID: 28576
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28576
Summary:
Apache-SSL is prone to a remote information-disclosure and privilege-esca=
lation vulnerability because it fails to adequately validate user-supplie=
d input.
An attacker can exploit this issue to obtain sensitive information or gai=
n control of applications that use environment variables provided by Apac=
he-SSL; this may lead to further attacks.
This issue affects Apache-SSL apache_1.3.34+ssl_1.57; other versions may =
also be vulnerable.
78. HP OpenView Network Node Manager 'OVAS.EXE' Buffer Overflow Vulnerabi=
lity
BugTraq ID: 28569
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28569
Summary:
HP OpenView Network Node Manager is prone to a buffer-overflow vulnerabil=
ity.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the Network Node Manager process. This faci=
litates the remote compromise of affected computers.
Network Node Manager 7.51 running on Microsoft Windows is affected by thi=
s issue; other versions and platforms may also be vulnerable.
79. Joomla! and Mambo actualite Component 'id' Parameter SQL Injection Vu=
lnerability
BugTraq ID: 28565
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28565
Summary:
The 'actualite' component for Joomla! and Mambo is prone to an SQL-inject=
ion vulnerability because it fails to sufficiently sanitize user-supplied=
data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
80. Novell eDirectory HTTP HEAD Request Handling Denial Of Service Vulner=
ability
BugTraq ID: 28572
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28572
Summary:
Novell eDirectory is prone to a denial-of-service vulnerability when hand=
ling specially crafted HTTP HEAD requests.
Remote attackers can exploit this issue to deny service to legitimate use=
rs.
eDirectory 8.8.2 is vulnerable; other versions may also be affected.
81. Novell NetWare iPrint Request Handling Denial Of Service Vulnerabilit=
y
BugTraq ID: 28561
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28561
Summary:
Novell NetWare is prone to a denial-of-service vulnerability due to an un=
specified error.
Remote attackers can exploit this issue to deny service to legitimate use=
rs.
The issue affects Novell NetWare 6.5; other versions may also be vulnerab=
le.
82. phpMyAdmin Local Information Disclosure Vulnerability
BugTraq ID: 28560
Remote: No
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28560
Summary:
phpMyAdmin is prone to a local information-disclosure vulnerability becau=
se it fails to securely protect login credentials and secret keys.
Local attackers can exploit this issue to harvest sensitive information t=
hat may lead to further attacks.
Versions prior to phpMyAdmin 2.11.5.1 are affected.
83. IBM DB2 Content Manager Unspecified Security Vulnerability
BugTraq ID: 28567
Remote: No
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28567
Summary:
IBM DB2 Content Manager is prone to an unspecified security vulnerability=
.
Very few technical details are currently available. We will update this B=
ID as more information emerges.
Versions prior to 8.3 Fix Pack 8 are vulnerable.
84. McAfee ePolicy Orchestrator 'FrameworkService.exe' Remote Denial of S=
ervice Vulnerability
BugTraq ID: 28573
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28573
Summary:
McAfee ePolicy Orchestrator is prone to a remote denial-of-service vulner=
ability.
Successfully exploiting this issue allows remote attackers to crash the a=
ffected application, denying further service to legitimate users.
=20
McAfee ePolicy Orchestrator 4.0 is vulnerable; other versions may also b=
e affected.
85. Writer's Block 'permalink.php' SQL Injection Vulnerability
BugTraq ID: 28564
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28564
Summary:
Writer's Block is prone to an SQL-injection vulnerability because it fail=
s to sufficiently sanitize user-supplied data before using it in an SQL q=
uery.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Writer's Block 3.8 is vulnerable; other versions may also be affected.
86. NoticeWare Corporation NoticeWare Email Server Denial Of Service Vuln=
erability
BugTraq ID: 28559
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28559
Summary:
NoticeWare Email Server is prone to a denial-of-service vulnerability due=
to an unspecified error.
Remote attackers can exploit this issue to deny service to legitimate use=
rs.
The issue affects NoticeWare Email Server 4.6.1.0; other versions may als=
o be vulnerable.
87. HP Select Identity Local Unauthorized Access Vulnerability
BugTraq ID: 28558
Remote: No
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28558
Summary:
HP Select Identity is prone to a local unauthorized-access vulnerability.
Successfully exploiting this issue may lead to privilege escalation, but =
this has not been confirmed.
88. bamaGalerie 'viewcat.php' SQL Injection Vulnerability
BugTraq ID: 28229
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28229
Summary:
bamaGalerie is prone to an SQL-injection vulnerability because it fails t=
o sufficiently sanitize user-supplied data before using it in an SQL quer=
y.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
89. CenterIM URI Hanlding Remote Arbitrary Command Execution Vulnerabilit=
y
BugTraq ID: 28362
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28362
Summary:
CenterIM is prone to a remote command-execution vulnerability.=20
Successful exploits can allow arbitrary commands to run in the context of=
the affected application.
CenterIM 4.22.3 is vulnerable; other versions may be affected as well.
90. xine-lib Multiple Heap Based Remote Buffer Overflow Vulnerabilities
BugTraq ID: 28370
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28370
Summary:
The 'xine-lib' library is prone to multiple heap-based buffer-overflow vu=
lnerabilities because it fails to perform adequate boundary checks on use=
r-supplied input.
Attackers can exploit these issues to execute arbitrary code in the conte=
xt of applications that use the library. Failed attacks will cause denial=
-of-service conditions.
These issues affect xine-lib 1.1.11; other versions may also be affected.
91. PostgreSQL Multiple Privilege Escalation and Denial of Service Vulner=
abilities
BugTraq ID: 27163
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/27163
Summary:
PostgreSQL is prone to multiple remote vulnerabilities, including:=20
- Three privilege-escalation vulnerabilities=20
- Three denial-of-service vulnerabilities
An attacker can exploit these issues to gain complete control of the affe=
cted application or to cause a denial-of-service condition.
These issues affect PostgreSQL 8.2, 8.1, 8.0, 7.4, and 7.3; other version=
s may also be affected.
92. Cisco IOS Dual-stack Router IPv6 Denial Of Service Vulnerability
BugTraq ID: 28461
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28461
Summary:
Cisco IOS-based dual-stack routers are prone to a denial-of-service vulne=
rability. This issue can occur when a specially crafted IPv6 packet is se=
nt to the device. However, for an exploit to succeed, the device must hav=
e certain IPv4 UDP services enabled.
A successful exploit may cause the affected interface to stop responding,=
or in some scenarios, may crash the device.
Cisco has assigned Bug ID CSCse56501 to this vulnerability.
93. Terracotta 'index.php' Local File Include Vulnerability
BugTraq ID: 28550
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28550
Summary:
Terracotta is prone to a local file-include vulnerability because it fail=
s to properly sanitize user-supplied input.
An attacker can exploit this vulnerability using directory-traversal stri=
ngs to view local files in the context of the webserver process. This may=
aid in further attacks.
94. Joomla! and Mambo Ahsshop Component 'vara' Parameter SQL Injection Vu=
lnerability
BugTraq ID: 28549
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28549
Summary:
The Ahsshop component for Joomla! and Mambo is prone to an SQL-injection =
vulnerability because it fails to sufficiently sanitize user-supplied dat=
a before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
95. Comix 'filename' Remote Command Execution Vulnerability
BugTraq ID: 28547
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28547
Summary:
Comix is prone to a remote shell command-execution vulnerability because =
the application fails to sufficiently sanitize user-supplied data.=20
Successfully exploiting this issue will allow an attacker to execute arbi=
trary commands with the privileges of the user running the affected appli=
cation.=20
Comix 3.6.4 is vulnerable; other versions may also be affected.
96. Red Hat 'capp-lspp-config' Local Privilege Escalation Vulnerability
BugTraq ID: 28557
Remote: No
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28557
Summary:
The 'capp-lspp-config' script is prone to a local privilege-escalation vu=
lnerability because it creates insecure permissions on the '/etc/pam.d/sy=
stem-auth-ac' file.=20
Local attackers can exploit this issue to escalate their privileges. This=
may lead to the complete compromise of affected computers.
This issue affects the 'lspp-eal4-config-ibm' and 'capp-lspp-eal4-config-=
hp' packages.
97. Chilkat HTTP 'ChilkatHttp.dll' ActiveX Control Insecure Method Vulner=
abilities
BugTraq ID: 28546
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28546
Summary:
Chilkat HTTP ActiveX Control is prone to multiple vulnerabilities that al=
low attackers to overwrite arbitrary files. These issues affect multiple =
CLSIDs associated with the control.
An attacker can exploit these issues by enticing an unsuspecting victim t=
o view a malicious HTML page.=20
Successfully exploiting these issues will allow the attacker to corrupt a=
nd overwrite arbitrary files on the victim's computer in the context of t=
he vulnerable application using the ActiveX control (typically Internet E=
xplorer).
Chilkat HTTP ActiveX control 2.3 is vulnerable; other versions may also b=
e affected.
98. FaScript Faphoto 'show.php' SQL Injection Vulnerability
BugTraq ID: 28545
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/28545
Summary:
FaScript Faphoto is prone to an SQL-injection vulnerability because it fa=
ils to sufficiently sanitize user-supplied data before using it in an SQL=
query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
This issue affects Faphoto 1; other versions may also be affected.
99. eggBlog 'eggblogpassword' SQL Injection Vulnerability
BugTraq ID: 27168
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/27168
Summary:
eggBlog is prone to an SQL-injection vulnerability because the applicatio=
n fails to properly sanitize user-supplied input before using it in an SQ=
L query.=20
A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase.
This issue affects eggBlog 3.10; other versions may also be affected.
100. Trend Micro ServerProtect Multiple Remote Insecure Method Exposure V=
ulnerabilities
BugTraq ID: 26912
Remote: Yes
Last Updated: 2008-04-02
Relevant URL: http://www.securityfocus.com/bid/26912
Summary:
Trend Micro ServerProtect is prone to multiple vulnerabilities that let r=
emote attackers gain full access to the filesystem. The issues occur beca=
use the application fails to properly restrict access to certain DCE/RPC =
methods.
Will full access to the filesystem, attackers may be able to execute arbi=
trary code with SYSTEM-level privileges and completely compromise affecte=
d computers.=20
These issues were reported to affect ServerProtect 5.58 (Security Patch 3=
). Earlier versions may also be affected.
Reports indicate that these vulnerabilities have been fixed in Security P=
atch 4.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Web developers, fix thy Flash
By: Robert Lemos
Flaws that allow cross-site scripting attacks through Adobe Flash files c=
ould let attackers compromise online accounts and local networks. Yet, We=
b publishers have been slow to fix their sites, a security researcher say=
s.
http://www.securityfocus.com/news/11511
2. Hacking contest highlights value of vulnerabilities
By: Robert Lemos
After a handful of critics slammed the modest cash prizes, larger bountie=
s will be offered to the security pros that successfully compromise any o=
f three laptops at a coming conference.
http://www.securityfocus.com/news/11510
3. House aims to scrutinize warrantless taps
By: Robert Lemos
The fight over a law to grant the U.S. government greater surveillance ca=
pabilities intensifies as House Democrats refuse to give telcos immunity =
for allowing past wiretaps without warrants.
http://www.securityfocus.com/news/11509
4. Browser makers focus on beating malware
By: Robert Lemos
Microsoft announces two features in Internet Explorer 8 aimed at better s=
ecuring Web surfers, and Mozilla incorporates more security into Firefox =
3.
http://www.securityfocus.com/news/11508
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Application Security Engineer, San Diego
http://www.securityfocus.com/archive/77/490423
2. [SJ-JOB] Application Security Engineer, Anywhere in Washington, Tel=
ecommute, Travel
http://www.securityfocus.com/archive/77/490424
3. [SJ-JOB] Application Security Engineer, Anywhere in Oregon, Telecom=
mute, Travel
http://www.securityfocus.com/archive/77/490425
4. [SJ-JOB] Application Security Engineer, Anywhere in Washington, Tel=
ecommute, Travel
http://www.securityfocus.com/archive/77/490426
5. [SJ-JOB] Director, Information Security, San Francisco Bay Area
http://www.securityfocus.com/archive/77/490422
V. INCIDENTS LIST SUMMARY
---------------------------
1. SPAM drop?
http://www.securityfocus.com/archive/75/490318
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Windows Vista winsat.exe Integer Overflow
http://www.securityfocus.com/archive/82/490297
2. Immunity Debugger v1.5
http://www.securityfocus.com/archive/82/490284
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. More along the lines of malware disinfection
http://www.securityfocus.com/archive/88/489751
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This issue is sponsored by IBM=AE Rational=AE AppScan
Failure to properly secure Web applications significantly impacts your ab=
ility to protect sensitive client and corporate data. IBM Rational AppSca=
n is an automated scanner that monitors, identifies and helps remediate v=
ulnerabilities.
Download a free trial of AppScan and see how it can help prevent against =
the threat of attack.
https://www.watchfire.com/securearea/appscan.aspx?id=3D701700000009T0r