SecurityFocus Newsletter #492
[email protected] Thu, 26 Feb 2009 14:10:36 -0700
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #492
----------------------------------------
This issue is sponsored by Sophos Security Threat Report: 2009
Predicting the future in such a rapidly evolving environment is near impo=
ssible. One only needs to count the rate at which new malware appears tod=
ay compared to five years ago to see how quickly the threat has become mo=
re serious. Read our security threat report to read about the malware tre=
nds we predict will be at the forefront in 2009.
http://dinclinx.com/Redirect.aspx?36;4036;35;189;0;4;259;d0ddf43bf0d4abdd
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1. Free Market Filtering
2. Don't Blame the Browser
II. BUGTRAQ SUMMARY
1. Newsletter Manager Plus.Attach 'admin/index.asp' Multiple SQL I=
njection Vulnerabilities
2. OpenSSL 'EVP_VerifyFinal' Function Signature Verification Vulne=
rability
3. IBM TXSeries for Multiplatforms 'forcepurge' Unspecified Securi=
ty Vulnerability
4. Adobe RoboHelp Server Multiple Cross Site Scripting Vulnerabili=
ties
5. SquirrelMail Insecure Cookie Disclosure Weakness
6. M5zn Arbitrary File Upload Vulnerability
7. IBM WebSphere Application z/OS CSLv2 Identity Assertion Unspeci=
fied Local Vulnerability
8. CS-Partner 'gestion.php' Multiple SQL Injection Vulnerabilities
9. Moodle User Edit Form Unspecified Remote Privilege Escalation V=
ulnerability
10. Moodle HotPot Module 'report.php' SQL Injection Vulnerability
11. Smarty Template Engine 'Smarty_Compiler.class.php' Security B=
ypass Vulnerability
12. Sony Network Camera ActiveX Control Unspecified Buffer Overflo=
w Vulnerability
13. Trend Micro InterScan Web Security Suite Multiple Security Byp=
ass Vulnerabilities
14. IBM WebSphere Application Server WSPolicy Information Disclosu=
re Vulnerability
15. Microsoft Windows NoDriveTypeAutoRun Automatic File Execution =
Vulnerability
16. xGuestbook 'login.php' SQL Injection Vulnerability
17. Vim 'PySys_SetArgv' Remote Command Execution Vulnerability
18. RETIRED: University of Washington IMAP c-client Remote Format =
String Vulnerability
19. OptiPNG GIF Image Handling Memory Corruption Vulnerability
20. Magento Multiple Cross Site Scripting Vulnerabilities
21. SnippetMaster Webpage Editor Cross Site Scripting and Remote F=
ile Include Vulnerabilities
22. GNU Emacs 'python.el' Code Execution Vulnerability
23. GNU Emacs '.flc' File Processing Vulnerability
24. Git gitweb Unspecified Remote Command Execution Vulnerability
25. KTorrent PHP Code Injection And Security Bypass Vulnerabilitie=
s
26. Free Arcade Script 'play.php' Local File Include Vulnerability
27. BitDefender Internet Security 2009 File Name Cross Site Script=
ing Vulnerability
28. Coppermine Photo Gallery 'IMG' BBCode HTML Injection Vulnerabi=
lity
29. Parsi PHP CMS 'index.php' SQL Injection Vulnerability
30. HP Virtual Rooms Client Unspecified Remote Code Execution Vuln=
erability
31. Linux Kernel 'dell_rbu' Local Denial of Service Vulnerabilitie=
s
32. Linux Kernel Cloned Process 'CLONE_PARENT' Local Origin Valida=
tion Weakness
33. Linux Kernel 64 Bit ABI System Call Parameter Privilege Escala=
tion Vulnerability
34. Linux Kernel 'readlink' Local Privilege Escalation Vulnerabili=
ty
35. Linux Kernel 'keyctl_join_session_keyring()' Denial of Service=
Vulnerability
36. Linux Kernel 'ib700wdt.c' Buffer Underflow Vulnerability
37. PHP SAPI 'php_getuid()' Safe Mode Restriction-Bypass Vulnerabi=
lity
38. PHP 'mbstring' Extension Buffer Overflow Vulnerability
39. Linux Kernel 'FWD-TSN' Chunk Remote Buffer Overflow Vulnerabil=
ity
40. PHP 'error_log' Safe Mode Restriction-Bypass Vulnerability
41. Linux Kernel 'net/atm/proc.c' Local Denial of Service Vulnerab=
ility
42. PHP ZipArchive::extractTo() '.zip' Files Directory Traversal V=
ulnerability
43. OpenSSH CBC Mode Information Disclosure Vulnerability
44. Drupal Content Construction Kit Module HTML Injection Vulnerab=
ilities
45. Squid Web Proxy Cache HTTP Version Number Parsing Denial of Se=
rvice Vulnerability
46. D-Link TFTP Transporting Mode Remote Buffer Overflow Vulnerabi=
lity
47. ProFTPD Character Encoding SQL Injection Vulnerability
48. Cisco Unified MeetingPlace Web Conferencing 'E-Mail Address' F=
ield HTML Injection Vulnerability
49. ProFTPD 'mod_sql' Username SQL Injection Vulnerability
50. Apache Tomcat Host Manager Cross Site Scripting Vulnerability
51. Apache Tomcat 'RequestDispatcher' Information Disclosure Vulne=
rability
52. Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scr=
ipting Vulnerability
53. Apache Tomcat POST Data Information Disclosure Vulnerability
54. Adobe Flash Player Unspecified Information Disclosure Vulnerab=
ility
55. Adobe Flash Player Unspecified Remote Denial of Service Vulner=
ability
56. Adobe Flash Player Invalid Object Reference Remote Code Execut=
ion Vulnerability
57. Epiphany 'PySys_SetArgv' Remote Command Execution Vulnerabilit=
y
58. Net-SNMP 'snmpUDPDomain.c' Remote Information Disclosure Vulne=
rability
59. JOnAS 'select' Parameter Error Page Cross Site Scripting Vulne=
rability
60. Orooj CMS 'news.php' SQL Injection Vulnerability
61. piCal Module for XOOPS 'index.php' Cross Site Scripting Vulner=
ability
62. ZNC Webadmin Module Remote Privilege Escalation Vulnerability
63. CATIA V5 Unspecified Vulnerability
64. Steamcast Multiple Memory Corruption Vulnerabilities
65. PenPal 'admin/login.asp' Multiple SQL Injection Vulnerabilitie=
s
66. Drupal Theme System Template File Local File Include Vulnerabi=
lity
67. Multiple SkyPortal Modules Multiple Authentication Bypass Vuln=
erabilities
68. Sopcast SopCore 'SetExternalPlayer()' ActiveX Control Remote C=
ode Execution Vulnerability
69. dradis Multiple Cross Site Scripting Vulnerabilities
70. PyCrypto ARC2 Module Buffer Overflow Vulnerability
71. Microsoft Excel Invalid Object Remote Code Execution Vulnerabi=
lity
72. FreeBSD i386_get_ldt(2) Local Kernel Memory Disclosure Vulnera=
bility
73. Apple Safari Malformed 'feeds:' URI Null Pointer Dereference R=
emote Denial Of Service Vulnerability
74. Multiple Cisco ACE Products Multiple Remote Vulnerabilities
75. Cisco Application Network Manager and Application Control Engi=
ne Multiple Vulnerabilities
76. HP Quality Center Cached Workflow Scripts Security Bypass Vuln=
erability
77. SHOUTcast Server DNAS Relay Remote Buffer Overflow Vulnerabili=
ty
78. Cisco Unified MeetingPlace Web Conferencing Authentication Byp=
ass Vulnerability
79. pPIM Multiple Remote Vulnerabilities
80. ksquirrel-libs 'RGBE' File Parsing Multiple Stack Buffer Overf=
low Vulnerabilities
81. OpenSite Multiple Security Vulnerabilities
82. OpenGoo User Permissions Security Bypass Vulnerability
83. Orbit Downloader 'Connecting' Log Message Creation Remote Buff=
er Overflow Vulnerability
84. Audacity 'lib-src/allegro/strparse.cpp' Buffer Overflow Vulner=
ability
85. NETGEAR WGR614 Administration Interface Remote Denial of Servi=
ce Vulnerability
86. GStreamer QuickTime Media File Parsing Multiple Buffer Overflo=
w Vulnerabilities
87. Trickle 'LD_PRELOAD' Arbitrary Code Execution Vulnerability
88. Nagios Unspecified Cross-Site Scripting Vulnerability
89. Cambium Group Content Management System Multiple Remote Vulner=
abilities
90. Qwerty CMS 'index.php' SQL Injection Vulnerability
91. WOW Raid Manager Unspecified Cross Site Scripting Vulnerabilit=
y
92. IBM WebSphere Application Server Cluster Configuration File In=
formation Disclosure Vulnerability
93. BarnOwl Prior to 1.0.5 Multiple Buffer Overflow Vulnerabilitie=
s
94. Linux Kernel 'inotify' Local Privilege Escalation Vulnerabilit=
y
95. Linux Kernel '__scm_destroy()' Local Denial of Service Vulnera=
bility
96. Linux Kernel 'sendmsg()' Local Denial of Service Vulnerability
97. Sun Java Runtime Environment Network Access Restriction Securi=
ty Bypass Vulnerability
98. Sun JSSE SSL/TLS Handshake Processing Denial Of Service Vulner=
ability
99. Adobe Acrobat and Reader PDF File Handling Remote Code Executi=
on Vulnerability
100. Adobe RoboHelp Multiple Cross Site Scripting Vulnerabilities
III. SECURITYFOCUS NEWS
1. Advisor: U.S. needs policy to defend cyberspace
2. Cabal forms to fight Conficker, offers bounty
3. Group releases list to kill most-dangerous bugs
4. Group attacks flaw in browser crypto security
IV. SECURITY JOBS LIST SUMMARY
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
VII. MICROSOFT FOCUS LIST SUMMARY
1. SecurityFocus Microsoft Newsletter #432
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1.Free Market Filtering
By Mark Rasch
The Australian government is considering requiring that Internet service =
providers in that country install filters which would prevent citizens fr=
om accessing tens of thousands of sites that contain "objectionable" mate=
rial.=20
http://www.securityfocus.com/columnists/493
2.Don't Blame the Browser
Melih Abdulhayoglu
There was a time when most diseases were fatal for humans. Intense study =
and research helped doctors manage diseases better, and subsequently even=
prevent them altogether.=20
http://www.securityfocus.com/columnists/492
II. BUGTRAQ SUMMARY
--------------------
1. Newsletter Manager Plus.Attach 'admin/index.asp' Multiple SQL Injectio=
n Vulnerabilities
BugTraq ID: 33919
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33919
Summary:
Newsletter Manager Plus.Attach is prone to multiple SQL-injection vulnera=
bilities because it fails to sufficiently sanitize user-supplied data bef=
ore using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
Newsletter Manager Plus.Attach 5.40 is vulnerable; other versions may als=
o be affected.
2. OpenSSL 'EVP_VerifyFinal' Function Signature Verification Vulnerabilit=
y
BugTraq ID: 33150
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33150
Summary:
OpenSSL is prone to a signature-verification vulnerability.
An attacker would likely leverage this issue by first carrying out a man-=
in-the-middle attack. The attacker would most likely exploit this issue t=
o conduct phishing attacks or to impersonate legitimate sites. Other atta=
cks are likely possible.
=20
Releases prior to OpenSSL 0.9.8j are affected.
3. IBM TXSeries for Multiplatforms 'forcepurge' Unspecified Security Vuln=
erability
BugTraq ID: 33883
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33883
Summary:
IBM TXSeries for Multiplatforms is prone an unspecified vulnerability.
Very few details are available regarding this issue. We will update this =
BID as more information emerges.
IBM TXSeries for Multiplatforms 6.2 GA is vulnerable.
4. Adobe RoboHelp Server Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 33887
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33887
Summary:
Adobe RoboHelp Server is prone to multiple cross-site scripting vulnerabi=
lities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary script code in=
the browser of an unsuspecting user in the context of the affected site.=
This may allow the attacker to steal cookie-based authentication credent=
ials and to launch other attacks.
Adobe RoboHelp Server 6 and 7 are vulnerable.
5. SquirrelMail Insecure Cookie Disclosure Weakness
BugTraq ID: 31321
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/31321
Summary:
SquirrelMail is prone to a cookie-disclosure weakness.
An attacker may leverage this issue to obtain sensitive information, stea=
l cookie-based authentication credentials, and carry out session-hijackin=
g attacks; other attacks are also possible.
SquirrelMail 1.4.15 is vulnerable; other versions may also be affected.
6. M5zn Arbitrary File Upload Vulnerability
BugTraq ID: 33874
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33874
Summary:
M5zn is prone to a vulnerability that lets attackers upload arbitrary fil=
es. The issue occurs because the software fails to adequately sanitize us=
er-supplied input.=20
An attacker can exploit this vulnerability to upload arbitrary code and e=
xecute it in the context of the webserver process. This may facilitate un=
authorized access or privilege escalation; other attacks are also possibl=
e.
M5zn 1.0 is vulnerable; other versions may also be affected.
7. IBM WebSphere Application z/OS CSLv2 Identity Assertion Unspecified Lo=
cal Vulnerability
BugTraq ID: 33884
Remote: No
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33884
Summary:
IBM WebSphere Application Server (WAS) is prone to an unspecified local v=
ulnerability.
Exploiting this issue may allow a local attacker to access sensitive info=
rmation that may aid in further attacks.
=20
This issue affects WAS 6.0.2 and 5.1 installed on z/OS.
8. CS-Partner 'gestion.php' Multiple SQL Injection Vulnerabilities
BugTraq ID: 31886
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/31886
Summary:
CS-Partner is prone to multiple SQL-injection vulnerabilities because it =
fails to sufficiently sanitize user-supplied input before using it in an =
SQL query.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
CS-Partner 1.0 is vulnerable; other versions may also be affected.
9. Moodle User Edit Form Unspecified Remote Privilege Escalation Vulnerab=
ility
BugTraq ID: 33881
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33881
Summary:
Moodle is prone to a remote privilege-escalation vulnerability.
Attackers can exploit this issue to gain elevated access to the affected =
application. Successful exploits may aid in further attacks.
The following Moodle branches and corresponding versions are affected:
1.7.x (prior to 1.7.3)
1.6.x (prior to 1.6.6)
1.5.x
10. Moodle HotPot Module 'report.php' SQL Injection Vulnerability
BugTraq ID: 33878
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33878
Summary:
The Moodle HotPot module is prone to an SQL-injection vulnerability becau=
se it fails to sufficiently sanitize user-supplied data before using it i=
n an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
The following versions are affected:
Moodle 1.6.x (prior to 1.6.7)
Moodle 1.7.x (prior to 1.7.5)
Moodle 1.8.x (prior to 1.8.6)
Moodle 1.9.x (prior to 1.9.2)
11. Smarty Template Engine 'Smarty_Compiler.class.php' Security Bypass V=
ulnerability
BugTraq ID: 31862
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/31862
Summary:
Smarty Template Engine is prone to a security-bypass vulnerability that o=
ccurs when embedded variables are processed.
Attackers may exploit the issue to bypass certain security restrictions a=
nd execute arbitrary PHP code in the context of the application.
Smarty Template Engine 2.6.19 is vulnerable to the issue; other versions=
may also be affected.
12. Sony Network Camera ActiveX Control Unspecified Buffer Overflow Vulne=
rability
BugTraq ID: 33876
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33876
Summary:
Sony Network Camera ActiveX control is prone to a buffer-overflow vulnera=
bility because it fails to bounds-check user-supplied data before copying=
it into an insufficiently sized buffer.
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.
13. Trend Micro InterScan Web Security Suite Multiple Security Bypass Vul=
nerabilities
BugTraq ID: 33679
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33679
Summary:
Trend Micro InterScan Web Security Suite is prone to multiple security-by=
pass vulnerabilities.
Successful exploits may allow attackers to access sensitive areas and to =
elevate privileges to perform certain restricted actions, such as modifyi=
ng system configuration.
These issues affect InterScan Web Security Suite 3.1 for Windows. Report=
edly, Linux versions of the application are also affected.
14. IBM WebSphere Application Server WSPolicy Information Disclosure Vuln=
erability
BugTraq ID: 33879
Remote: No
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33879
Summary:
IBM WebSphere Application Server (WAS) is prone to a local information-di=
sclosure vulnerability because it fails to properly recognize a certain a=
ccess policy.
Exploiting this issue may allow a local attacker to access sensitive info=
rmation that may aid in further attacks.
=20
This issue affects WAS 7.0.
15. Microsoft Windows NoDriveTypeAutoRun Automatic File Execution Vulnera=
bility
BugTraq ID: 28360
Remote: No
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/28360
Summary:
Microsoft Windows is prone to a vulnerability that may allow a file to au=
tomatically run because the software fails to handle the 'NoDriveTypeAuto=
Run' registry value.
An attacker may exploit this issue to execute arbitrary code. The attacke=
r must entice a victim into attaching a form of removable media, such as =
a USB drive or CD-ROM.
16. xGuestbook 'login.php' SQL Injection Vulnerability
BugTraq ID: 33875
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33875
Summary:
xGuestbook is prone to an SQL-injection vulnerability because it fails to=
sufficiently sanitize user-supplied data before using it in an SQL query=
.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
xGuestbook 2.0 is vulnerable; other versions may also be affected.
17. Vim 'PySys_SetArgv' Remote Command Execution Vulnerability
BugTraq ID: 33447
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33447
Summary:
Vim is prone to a remote command-execution vulnerability.
An attacker could exploit this issue by enticing an unsuspecting victim t=
o execute the vulnerable application in a directory containing a maliciou=
s Python file. A successful exploit will allow arbitrary Python commands =
to run with the privileges of the currently logged-in user.
Versions prior to Vim 7.2.045 are vulnerable.
18. RETIRED: University of Washington IMAP c-client Remote Format String =
Vulnerability
BugTraq ID: 33795
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33795
Summary:
University of Washington IMAP 'c-client' is prone to a remote format-stri=
ng vulnerability because the software fails to adequately sanitize user-s=
upplied input before passing it as the format-specifier to a formatted-pr=
inting function.
Attackers can leverage this issue to execute arbitrary code in the contex=
t of applications built with the vulnerable library. Failed attacks will =
likely cause denial-of-service conditions.
IMAP 2007d is vulnerable; other versions may also be affected.
NOTE: This BID is being retired because the application is not vulnerable=
as described.
19. OptiPNG GIF Image Handling Memory Corruption Vulnerability
BugTraq ID: 33873
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33873
Summary:
OptiPNG is prone to a memory-corruption vulnerability.
Attackers may leverage this issue to execute arbitrary code in the contex=
t of the application. Failed attacks will cause denial-of-service conditi=
ons.
OptiPNG 0.6.2 and prior versions are vulnerable.
20. Magento Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 33872
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33872
Summary:
Magento is prone to multiple cross-site scripting vulnerabilities because=
it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would execute in the context of th=
e affected site, potentially allowing the attacker to steal cookie-based =
authentication credentials.
Magento 1.2.0 is vulnerable; other versions may also be affected.
21. SnippetMaster Webpage Editor Cross Site Scripting and Remote File Inc=
lude Vulnerabilities
BugTraq ID: 33705
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33705
Summary:
SnippetMaster Webpage Editor is prone to a cross-site scripting vulnerabi=
lity and multiple remote file-include vulnerabilities because it fails to=
sufficiently sanitize user-supplied data.
An attacker can exploit these issues to execute malicious PHP code in the=
context of the webserver process. This may allow the attacker to comprom=
ise the application and the underlying system. The attacker may also exec=
ute script code in an unsuspecting user's browser or steal cookie-based a=
uthentication credentials; other attacks are also possible.
SnippetMaster Webpage Editor 2.2.2 is vulnerable; other versions may also=
be affected.
22. GNU Emacs 'python.el' Code Execution Vulnerability
BugTraq ID: 31052
Remote: No
Last Updated: 2009-02-23
Relevant URL: http://www.securityfocus.com/bid/31052
Summary:
GNU Emacs is prone to a local code-execution vulnerability.=20
Successful exploits may allow attackers to execute arbitrary code within =
the context of the user running the affected application.=20
Versions prior to the following are affected:
GNU Emacs 23.0.60_20080624-22-6
GNU Emacs 22.1-17-17
23. GNU Emacs '.flc' File Processing Vulnerability
BugTraq ID: 29176
Remote: Yes
Last Updated: 2009-02-23
Relevant URL: http://www.securityfocus.com/bid/29176
Summary:
Emacs processes fast-lock files in an insecure manner.
An attacker could exploit this issue to execute arbitrary code with the p=
rivileges of the user running the vulnerable application.
This issue affects Emacs 21.3.1; other versions may also be vulnerable.
24. Git gitweb Unspecified Remote Command Execution Vulnerability
BugTraq ID: 33215
Remote: Yes
Last Updated: 2009-02-23
Relevant URL: http://www.securityfocus.com/bid/33215
Summary:
Git gitweb is prone to a remote command-execution vulnerability.
An attacker may exploit this issue to execute arbitrary commands within t=
he context of the affected application; this may aid in further attacks.
Git 1.5.2.4 and 1.5.6.6 are vulnerable; other versions may also be affect=
ed
25. KTorrent PHP Code Injection And Security Bypass Vulnerabilities
BugTraq ID: 31927
Remote: Yes
Last Updated: 2009-02-23
Relevant URL: http://www.securityfocus.com/bid/31927
Summary:
KTorrent is prone to a remote PHP code-injection vulnerability and a secu=
rity-bypass vulnerability. The issues affect the the application's web in=
terface.
An attacker can exploit these issues to perform certain actions without a=
uthorization and execute arbitrary malicious PHP code in the context of t=
he webserver process. This may facilitate a compromise of the application=
and the underlying system; other attacks may also be possible.
The issue affects KTorrent 3.1.3; other versions may also be vulnerable.
26. Free Arcade Script 'play.php' Local File Include Vulnerability
BugTraq ID: 33869
Remote: Yes
Last Updated: 2009-02-23
Relevant URL: http://www.securityfocus.com/bid/33869
Summary:
Free Arcade Script is prone to a local file-include vulnerability because=
it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to view and execute arbitrary =
local files in the context of the webserver process. This may aid in furt=
her attacks.
Free Arcade Script 1.0 is vulnerable; other versions may also be affected=
.
27. BitDefender Internet Security 2009 File Name Cross Site Scripting Vul=
nerability
BugTraq ID: 33921
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33921
Summary:
BitDefender Internet Security 2009 is prone to a cross-site scripting vul=
nerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.
28. Coppermine Photo Gallery 'IMG' BBCode HTML Injection Vulnerability
BugTraq ID: 33917
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33917
Summary:
Coppermine Photo Gallery is prone to an HTML-injection vulnerability beca=
use it fails to sufficiently sanitize user-supplied data.
Attacker-supplied HTML or JavaScript code could run in the context of the=
affected site, potentially allowing the attacker to steal cookie-based a=
uthentication credentials and to control how the site is rendered to the =
user; other attacks are also possible.
Coppermine Photo Gallery 1.4.2 is vulnerable; other versions may also be =
affected.
29. Parsi PHP CMS 'index.php' SQL Injection Vulnerability
BugTraq ID: 33914
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33914
Summary:
Parsi PHP CMS is prone to an SQL-injection vulnerability because it fails=
to sufficiently sanitize user-supplied data before using it in an SQL qu=
ery.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
Parsi PHP CMS 2.0.0 is vulnerable; other versions may also be affected.
30. HP Virtual Rooms Client Unspecified Remote Code Execution Vulnerabili=
ty
BugTraq ID: 33918
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33918
Summary:
HP Virtual Rooms client is prone to a remote code-execution vulnerability=
caused by an unspecified error.
Successfully exploiting this issue allows an attacker to execute arbitrar=
y code with the privileges of the user running the affected application.
This issue affects Virtual Rooms 7.0 and earlier running on Microsoft Win=
dows.
31. Linux Kernel 'dell_rbu' Local Denial of Service Vulnerabilities
BugTraq ID: 33428
Remote: No
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33428
Summary:
Linux Kernel is prone to two denial-of-service vulnerabilities.
A local unprivileged attacker can exploit these issues to cause a vulnera=
ble system to crash, resulting in denial-of-service conditions.
These issues affect versions prior to Linux Kernel 2.6.27.13 and 2.6.28.2=
.
32. Linux Kernel Cloned Process 'CLONE_PARENT' Local Origin Validation We=
akness
BugTraq ID: 33906
Remote: No
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33906
Summary:
The Linux kernel is prone to an origin-validation weakness when dealing w=
ith signal handling.
This weakness occurs when a privileged process calls attacker-supplied pr=
ocesses as children. Attackers may exploit this to send arbitrary signals=
to the privileged parent process.
A local attacker may exploit this issue to kill vulnerable processes, re=
sulting in a denial-of-service condition. In some cases, other attacks ma=
y also be possible.
Linux kernel 2.6.28 is vulnerable; other versions may also be affected.
33. Linux Kernel 64 Bit ABI System Call Parameter Privilege Escalation Vu=
lnerability
BugTraq ID: 33275
Remote: No
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33275
Summary:
The Linux Kernel is prone to a local privilege-escalation vulnerability.
A local attacker may be able to exploit this issue to read or write to un=
intended address spaces. This may result in denial-of-service conditions,=
the disclosure of sensitive information, or privilege escalation.
This issue affects versions prior to Linux 2.6.28.6 on some 64-bit archit=
ectures, including s390, PowerPC, SPARC64, and MIPS. Additional architect=
ures may also be affected.
34. Linux Kernel 'readlink' Local Privilege Escalation Vulnerability
BugTraq ID: 33412
Remote: No
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33412
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability.
A local attacker can exploit this issue to execute arbitrary code with su=
peruser privileges or crash the affected kernel, denying service to legit=
imate users.
Versions prior to Linux kernel 2.6.29.1 are vulnerable.
35. Linux Kernel 'keyctl_join_session_keyring()' Denial of Service Vulner=
ability
BugTraq ID: 33339
Remote: No
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33339
Summary:
The Linux kernel is prone to a denial-of-service vulnerability because it=
fails to manage memory in a proper manner.
Attackers can exploit this issue to cause a crash by exhausting memory re=
sources.=20
This issue affects Linux kernel 2.6.x.
36. Linux Kernel 'ib700wdt.c' Buffer Underflow Vulnerability
BugTraq ID: 33003
Remote: No
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33003
Summary:
The Linux kernel is prone to a buffer-underflow vulnerability because it =
fails to perform adequate boundary checks on user-supplied data.=20
A local attacker can exploit this issue to execute arbitrary code with ke=
rnel-level privileges or crash the affected computer, denying service to =
legitimate users.=20
Versions prior to Linux kernel 2.6.28-rc1 are vulnerable.
37. PHP SAPI 'php_getuid()' Safe Mode Restriction-Bypass Vulnerability
BugTraq ID: 32688
Remote: No
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/32688
Summary:
PHP is prone to a 'safe_mode' restriction-bypass vulnerability. Successfu=
l exploits could allow an attacker to bypass some safe-mode restrictions.
This vulnerability would be an issue in shared-hosting configurations whe=
re multiple users can create and execute arbitrary PHP script code, with =
the 'safe_mode' restrictions assumed to isolate the users from each other=
.
Versions prior to PHP 5.2.8 are vulnerable.
38. PHP 'mbstring' Extension Buffer Overflow Vulnerability
BugTraq ID: 32948
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/32948
Summary:
PHP is prone to a buffer-overflow vulnerability because it fails to perfo=
rm boundary checks before copying user-supplied data to insufficiently si=
zed memory buffers. The issue affects the 'mbstring' extension included i=
n the standard distribution.
An attacker can exploit this issue to execute arbitrary machine code in t=
he context of the affected webserver. Failed exploit attempts will likely=
crash the webserver, denying service to legitimate users.=20
PHP 4.3.0 through 5.2.6 are vulnerable.
39. Linux Kernel 'FWD-TSN' Chunk Remote Buffer Overflow Vulnerability
BugTraq ID: 33113
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33113
Summary:
The Linux Kernel is prone to a remote buffer-overflow vulnerability becau=
se the software fails to perform adequate boundary checks on user-supplie=
d data.
An attacker can exploit this issue to execute arbitrary code with kernel-=
level privileges. Successfully exploiting this issue will result in the c=
omplete compromise of affected computers. Failed exploit attempts will re=
sult in a denial-of-service condition.
The issue affects Linux Kernel 2.6.28; other versions may also be vulnera=
ble.
40. PHP 'error_log' Safe Mode Restriction-Bypass Vulnerability
BugTraq ID: 32383
Remote: No
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/32383
Summary:
PHP is prone to a 'safe_mode' restriction-bypass vulnerability. Successfu=
l exploits could allow an attacker to write files in unauthorized locatio=
ns.
This vulnerability would be an issue in shared-hosting configurations whe=
re multiple users can create and execute arbitrary PHP script code, with =
the 'safe_mode' restrictions assumed to isolate the users from each other=
.
Versions prior to PHP 5.2.8 are vulnerable.
41. Linux Kernel 'net/atm/proc.c' Local Denial of Service Vulnerability
BugTraq ID: 32676
Remote: No
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/32676
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability.
Attackers can exploit this issue to cause the Linux kernel to go into an =
infinite loop, which may cause a denial-of-service condition.
42. PHP ZipArchive::extractTo() '.zip' Files Directory Traversal Vulnerab=
ility
BugTraq ID: 32625
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/32625
Summary:
PHP is prone to a directory-traversal vulnerability because the applicati=
on fails to adequately sanitize user-supplied input.=20
=20
A successful attack may allow an attacker to create or overwrite arbitrar=
y files on the system. This may allow arbitrary script code to run in the=
context of the webserver.
PHP 5.2.6 and prior versions are vulnerable.
43. OpenSSH CBC Mode Information Disclosure Vulnerability
BugTraq ID: 32319
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/32319
Summary:
OpenSSH is prone to an information-disclosure vulnerability.
Successful exploits will allow attackers to obtain four bytes of plaintex=
t from an encrypted session.
Versions prior to OpenSSH 5.2 are vulnerable. Various versions of SSH Tec=
tia are also affected.
44. Drupal Content Construction Kit Module HTML Injection Vulnerabilities
BugTraq ID: 32136
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/32136
Summary:
The Content Construction Kit module for Drupal is prone to HTML-injection=
vulnerabilities because the application fails to properly sanitize user-=
supplied input before using it in dynamically generated content.=20
Attacker-supplied HTML and script code would run in the context of the af=
fected browser, potentially allowing the attacker to steal cookie-based a=
uthentication credentials or to control how the site is rendered to the u=
ser. Other attacks are also possible.
These issues affect versions *prior to* Content Construction Kit 5.x-1.1=
0 and 6.x-2.0.
http://drupal.org/node/207891
45. Squid Web Proxy Cache HTTP Version Number Parsing Denial of Service V=
ulnerability
BugTraq ID: 33604
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33604
Summary:
Squid is prone to a remote denial-of-service vulnerability because the pr=
oxy server fails to handle certain HTTP requests.
Successfully exploiting this issue allows remote attackers to crash the a=
ffected application, denying further service to legitimate users.
This issue affects versions prior to Squid 2.7.STABLE5, Squid 3.0.STABLE1=
2, and Squid 3.1.0.4.
46. D-Link TFTP Transporting Mode Remote Buffer Overflow Vulnerability
BugTraq ID: 22923
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/22923
Summary:
D-Link TFTP is prone to a buffer-overflow vulnerability because the appli=
cation fails to properly bounds-check user-supplied data before storing i=
t in a finite-sized buffer.=20
A remote attacker can exploit this issue to cause the application to cras=
h, denying further service to legitimate users. Given the nature of this =
issue, the attacker may presumably be able to execute code.
D-Link TFTP 1.0 is vulnerable; other versions may also be affected.
47. ProFTPD Character Encoding SQL Injection Vulnerability
BugTraq ID: 33650
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33650
Summary:
ProFTPD is prone to an SQL-injection vulnerability because it fails to su=
fficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to manipulate SQL queries, =
modify data, or exploit latent vulnerabilities in the underlying database=
. This may result in unauthorized access and a compromise of the applicat=
ion; other attacks are also possible.
The issue affects ProFTPD 1.3.1 and later versions.
48. Cisco Unified MeetingPlace Web Conferencing 'E-Mail Address' Field HT=
ML Injection Vulnerability
BugTraq ID: 33915
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33915
Summary:
Cisco Unified MeetingPlace Web Conferencing is prone to an HTML-injection=
vulnerability because it fails to sufficiently sanitize user-supplied da=
ta.
Attacker-supplied HTML or JavaScript code could run in the context of the=
affected site, potentially allowing the attacker to steal cookie-based a=
uthentication credentials and to control how the site is rendered to the =
user; other attacks are also possible.
49. ProFTPD 'mod_sql' Username SQL Injection Vulnerability
BugTraq ID: 33722
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33722
Summary:
ProFTPD is prone to an SQL-injection vulnerability because it fails to su=
fficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to manipulate SQL queries, =
modify data, or exploit latent vulnerabilities in the underlying database=
. This may result in unauthorized access and a compromise of the applicat=
ion; other attacks are also possible.
ProFTPD 1.3.1 through 1.3.2 rc 2 are vulnerable.
50. Apache Tomcat Host Manager Cross Site Scripting Vulnerability
BugTraq ID: 29502
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/29502
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because th=
e application fails to properly sanitize user-supplied input. The issue =
affects the Host Manager web application.
=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
The issue affects the following versions:
Tomcat 5.5.9 through 5.5.26
Tomcat 6.0.0 through 6.0.16
51. Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerabilit=
y
BugTraq ID: 30494
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/30494
Summary:
Apache Tomcat is prone to a remote information-disclosure vulnerability.
Remote attackers can exploit this issue to obtain the contents of sensiti=
ve files stored on the server. Information obtained may lead to further a=
ttacks.=20
The following versions are affected:=20
Tomcat 4.1.0 through 4.1.37
Tomcat 5.5.0 through 5.5.26
Tomcat 6.0.0 through 6.0.16
Tomcat 3.x, 4.0.x, and 5.0.x may also be affected.
52. Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scripting =
Vulnerability
BugTraq ID: 30496
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/30496
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because th=
e application fails to properly sanitize user-supplied input. =20
=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.
The issue affects the following versions:
Tomcat 4.1.0 through 4.1.37
Tomcat 5.5.0 through 5.5.26
Tomcat 6.0.0 through 6.0.16
53. Apache Tomcat POST Data Information Disclosure Vulnerability
BugTraq ID: 33913
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33913
Summary:
Apache Tomcat is prone to a remote information-disclosure vulnerability.
Remote attackers can exploit this issue to obtain sensitive data stored o=
n the server. Information obtained may lead to further attacks.=20
The following versions are affected:=20
Apache Tomcat 4.1.32 through 4.1.34
Apache Tomcat 5.5.10 through 5.5.20
NOTE: Apache Tomcat 6.x is not affected.
54. Adobe Flash Player Unspecified Information Disclosure Vulnerability
BugTraq ID: 33889
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33889
Summary:
Adobe Flash Player is prone to an information-disclosure vulnerability.
Successful exploits will allow an attacker to obtain potentially sensitiv=
e information that may be used to elevate privileges.
This issue affects Flash Player on Linux-based operating systems only.
55. Adobe Flash Player Unspecified Remote Denial of Service Vulnerability
BugTraq ID: 33890
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33890
Summary:
Adobe Flash Player is prone to a remote denial-of-service vulnerability b=
ecause it fails to properly validate user-supplied input.
Exploiting this issue allows remote attackers to crash the application an=
d possibly to execute code, but this has not been confirmed.
Versions prior to Flash Player 10.0.22.87 are vulnerable.
56. Adobe Flash Player Invalid Object Reference Remote Code Execution Vul=
nerability
BugTraq ID: 33880
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33880
Summary:
Adobe Flash Player is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with the pr=
ivileges of the user running the application. Failed exploit attempts wi=
ll likely crash the application, denying service to legitimate users.
Versions prior to Flash Player 10.0.12.36 are vulnerable.
57. Epiphany 'PySys_SetArgv' Remote Command Execution Vulnerability
BugTraq ID: 33441
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33441
Summary:
Epiphany is prone to a remote command-execution vulnerability.
An attacker could exploit this issue by enticing an unsuspecting victim t=
o execute the vulnerable application in a directory containing a maliciou=
s Python file. A successful exploit will allow arbitrary Python commands =
to run with the privileges of the currently logged-in user.
58. Net-SNMP 'snmpUDPDomain.c' Remote Information Disclosure Vulnerabilit=
y
BugTraq ID: 33755
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33755
Summary:
Net-SNMP is prone to a remote information-disclosure vulnerability becaus=
e it fails to properly handle TCP Wrapper authorization rules.
Exploiting this issue will allow attackers to obtain sensitive informatio=
n that can help them further attacks.
Net-SNMP 5.4.2.1 is vulnerable; other versions are also likely affected.
59. JOnAS 'select' Parameter Error Page Cross Site Scripting Vulnerabilit=
y
BugTraq ID: 33912
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33912
Summary:
JOnAS is prone to a cross-site scripting vulnerability because it fails t=
o properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.
JOnAS 4.10.3 is vulnerable; other versions may also be affected.
60. Orooj CMS 'news.php' SQL Injection Vulnerability
BugTraq ID: 33908
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33908
Summary:
Orooj CMS is prone to an SQL-injection vulnerability because it fails to =
sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
61. piCal Module for XOOPS 'index.php' Cross Site Scripting Vulnerability
BugTraq ID: 33896
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33896
Summary:
The piCal module for XOOPS is prone to a cross-site scripting vulnerabili=
ty because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.
This issue affects piCal 0.91h; other versions may be vulnerable as well.
62. ZNC Webadmin Module Remote Privilege Escalation Vulnerability
BugTraq ID: 33899
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33899
Summary:
ZNC is prone to a remote privilege-escalation vulnerability.
Attackers can exploit this issue to gain administrative access to the aff=
ected application. Successful exploits will compromise the application an=
d may lead to other attacks against the underlying computer.
Versions prior to ZNC 0.066 are affected.
63. CATIA V5 Unspecified Vulnerability
BugTraq ID: 33895
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33895
Summary:
CATIA V5 is prone to an unspecified vulnerability.
Currently, very little is known about this issue. We will update this BID=
as more information emerges.
This issue affects versions prior to CATIA V5 Release 18 Service Pack 8.
64. Steamcast Multiple Memory Corruption Vulnerabilities
BugTraq ID: 33898
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33898
Summary:
Steamcast is prone to multiple memory-corruption vulnerabilities.
Successfully exploiting these issues allows remote attackers to cause den=
ial-of-service conditions or execute arbitrary code in the context of the=
affected application.
Steamcast 0.9.75 and prior versions are vulnerable.
65. PenPal 'admin/login.asp' Multiple SQL Injection Vulnerabilities
BugTraq ID: 33907
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33907
Summary:
PenPal is prone to multiple SQL-injection vulnerabilities because it fail=
s to sufficiently sanitize user-supplied data before using it in an SQL q=
uery.
Exploiting these issues could allow an attacker to compromise the applica=
tion, access or modify data, or exploit latent vulnerabilities in the und=
erlying database.
PenPal 2.0 is vulnerable; other versions may also be affected.
66. Drupal Theme System Template File Local File Include Vulnerability
BugTraq ID: 33910
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33910
Summary:
Drupal is prone to a local file-include vulnerability because it fails to=
properly sanitize user-supplied input. This issue affects Drupal running=
under Microsoft Windows.
An attacker can exploit this vulnerability to view files and execute loca=
l scripts in the context of the webserver process. This may aid in furthe=
r attacks.
The following are vulnerable:
Drupal 5.x prior to 5.16
Drupal 6.x prior to 6.10
67. Multiple SkyPortal Modules Multiple Authentication Bypass Vulnerabili=
ties
BugTraq ID: 33911
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33911
Summary:
Multiple SkyPortal modules are prone to multiple authentication-bypass vu=
lnerabilities because the applications fails to restrict access to certai=
n administration scripts.
An attacker can exploit these issues to gain unauthorized access to the a=
ffected applications, which may lead to other attacks.=20
The following products and versions are affected:
SkyPortal Classifieds System 0.12=20
SkyPortal Picture Manager 0.11
SkyPortal WebLinks v0.12
68. Sopcast SopCore 'SetExternalPlayer()' ActiveX Control Remote Code Exe=
cution Vulnerability
BugTraq ID: 33920
Remote: Yes
Last Updated: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33920
Summary:
Sopcast SopCore is prone to a remote code-execution vulnerability.=20
Attackers can exploit this issue to execute arbitrary code within the con=
text of the application that uses the ActiveX control (typically Internet=
Explorer). Failed exploit attempts will result in a denial-of-service co=
ndition.
69. dradis Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 33892
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33892
Summary:
The 'dradis' program is prone to multiple cross-site scripting vulnerabil=
ities because it fails to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the af=
fected site, potentially allowing the attacker to steal cookie-based auth=
entication credentials.
These issues affect versions prior to dradis 2.0.
70. PyCrypto ARC2 Module Buffer Overflow Vulnerability
BugTraq ID: 33674
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33674
Summary:
PyCrypto (Python Cryptography Toolkit) is prone to a buffer-overflow vuln=
erability because it fails to adequately verify user-supplied input.
Successful exploits may allow attackers to execute arbitrary code in the =
context of applications using the vulnerable module. Failed attempts may =
lead to a denial-of-service condition.
71. Microsoft Excel Invalid Object Remote Code Execution Vulnerability
BugTraq ID: 33870
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33870
Summary:
Microsoft Excel is prone to a remote code-execution vulnerability.
Attackers may exploit this issue by enticing victims into opening a malic=
iously crafted Excel file.
Successful exploits may allow attackers to execute arbitrary code with th=
e privileges of the user running the application. Failed exploit attempts=
will result in a denial-of-service condition.
72. FreeBSD i386_get_ldt(2) Local Kernel Memory Disclosure Vulnerability
BugTraq ID: 13527
Remote: No
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/13527
Summary:
The 'i386_get_ldt(2)' system call is prone to a memory-disclosure vulnera=
bility.=20
=20
An attacker can supply a negative or excessive value as an argument to th=
e affected system call and read arbitrary portions of kernel memory.=20
=20
Information disclosed through this attack may help the attacker launch ot=
her attacks against a computer and potentially aid in a complete compromi=
se.
NOTE: Only i386 and amd64 architectures are affected by this issue.
UPDATE (February 25, 2009): Mac OS X 10.5.5 is reported vulnerable.
73. Apple Safari Malformed 'feeds:' URI Null Pointer Dereference Remote D=
enial Of Service Vulnerability
BugTraq ID: 33909
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33909
Summary:
Apple Safari is prone to a denial-of-service vulnerability that stems fro=
m a NULL-pointer dereference.
Attackers can exploit this issue to crash the affected application, denyi=
ng service to legitimate users.=20
Apple Safari 4 Beta is vulnerable; other versions may also be affected.
74. Multiple Cisco ACE Products Multiple Remote Vulnerabilities
BugTraq ID: 33900
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33900
Summary:
Cisco ACE Application Control Engine Module and Cisco ACE 4710 Applicatio=
n Control Engine are prone to multiple remote vulnerabilities:
- Multiple authentication-bypass issues
- A remote privilege-escalation issue
- Multiple denial-of-service issues
Attackers can exploit these issues to execute arbitrary commands, gain ad=
ministrative access, and cause denial-of-service conditions. Other attack=
s are also possible.
75. Cisco Application Network Manager and Application Control Engine Mult=
iple Vulnerabilities
BugTraq ID: 33903
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33903
Summary:
Cisco Application Network Manager (ANM) and Application Control Engine (A=
CE) Device Manager are prone to multiple security vulnerabilities, includ=
ing directory-traversal issues, unauthorized access via default credentia=
ls, and a privilege-escalation issue.=20
A successful exploit may allow attackers to obtain sensitive information,=
view or modify files, cause denial-of-service conditions, or gain unauth=
orized access to the affected application. This may aid in the complete =
compromise of the underlying computer.
76. HP Quality Center Cached Workflow Scripts Security Bypass Vulnerabili=
ty
BugTraq ID: 33854
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33854
Summary:
HP Quality Center is prone to a security-bypass vulnerability.
Successful exploits may allow attackers to overwrite content in the datab=
ase, corrupt data, and carry out other attacks.
HP Quality Center 9.0 and 9.2 are vulnerable; other versions may be affe=
cted as well.
NOTE: Reports indicate that an exploit may not gain privileges.
77. SHOUTcast Server DNAS Relay Remote Buffer Overflow Vulnerability
BugTraq ID: 33904
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33904
Summary:
SHOUTcast Server is prone to a remote buffer-overflow vulnerability becau=
se it fails to perform adequate boundary checks on user-supplied data.=20
Attackers may exploit this issue to overwrite the application's web admin=
istration password and possibly to execute arbitrary code within the cont=
ext of the application, but this has not been confirmed. Failed exploit a=
ttempts will cause a denial-of-service condition.
=20
SHOUTcast Server 1.9.8 for Windows is vulnerable; other versions may als=
o be affected.
78. Cisco Unified MeetingPlace Web Conferencing Authentication Bypass Vul=
nerability
BugTraq ID: 33901
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33901
Summary:
Cisco Unified MeetingPlace Web Conferencing is prone to an unspecified au=
thentication-bypass vulnerability.
=20
An attacker can exploit this issue to gain administrative access to the =
affected application. This may allow the attacker to compromise the appli=
cation and the underlying system; other attacks are also possible.
This issue is tracked by Cisco Bug ID CSCsv65815.
Unified MeetingPlace Web Conferencing 6.0 and 7.0 are vulnerable.
79. pPIM Multiple Remote Vulnerabilities
BugTraq ID: 30627
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/30627
Summary:
pPIM is prone to multiple vulnerabilities, including two security-bypass =
issues, a cross-site scripting issue, and a file-upload issue.=20
Attackers can exploit these issues to:
- execute arbitrary script code in the browser of an unsuspecting user in=
the context of the affected site
- steal cookie-based authentication credentials
- delete local files within the context of the webserver process
- upload arbitrary PHP scripts and execute them in the context of the web=
server
- change user passwords
These issues affect pPIM 1.0 and prior versions.
80. ksquirrel-libs 'RGBE' File Parsing Multiple Stack Buffer Overflow Vul=
nerabilities
BugTraq ID: 33902
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33902
Summary:
The 'ksquirrel-libs' library is prone to multiple stack-based buffer-over=
flow vulnerabilities because it fails to perform adequate boundary checks=
on user-supplied input.
Attackers may leverage these issues to execute arbitrary code in the cont=
ext of an application using the library. Failed attacks will cause denial=
-of-service conditions.
These issues affect ksquirrel-libs 0.8.0; other versions may also be affe=
cted.
81. OpenSite Multiple Security Vulnerabilities
BugTraq ID: 33893
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33893
Summary:
OpenSite is prone to multiple SQL-injection vulnerabilities and a weaknes=
s affecting the authentication routines.
Exploiting these issues could allow an attacker to gain unauthorized acce=
ss, compromise the application, access or modify data, or exploit latent =
vulnerabilities in the underlying database.
OpenSite 2.1 is vulnerable; other versions may also be affected.
82. OpenGoo User Permissions Security Bypass Vulnerability
BugTraq ID: 33897
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33897
Summary:
OpenGoo is prone to a security-bypass vulnerability.
Attackers may exploit the issue to bypass certain security restrictions a=
nd modify their own permissions.
Versions prior to OpenGoo 1.2.1 are vulnerable.
83. Orbit Downloader 'Connecting' Log Message Creation Remote Buffer Over=
flow Vulnerability
BugTraq ID: 33894
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33894
Summary:
Orbit Downloader is prone to a remote buffer-overflow vulnerability becau=
se it fails to perform adequate boundary checks on user-supplied data.=20
An attacker can exploit this issue to execute arbitrary code with the pri=
vileges of the user running the application. Failed exploit attempts wil=
l cause a denial-of-service condition.
=20
This issue affects versions prior to Orbit Downloader 2.8.5.
84. Audacity 'lib-src/allegro/strparse.cpp' Buffer Overflow Vulnerability
BugTraq ID: 33090
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33090
Summary:
Audacity is prone a buffer-overflow vulnerability because it fails to per=
form adequate boundary checks on user-supplied data.=20
Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application. Failed exploit attempts li=
kely result in denial-of-service conditions.
Audacity 1.6.2 is vulnerable; other versions may also be affected.
85. NETGEAR WGR614 Administration Interface Remote Denial of Service Vuln=
erability
BugTraq ID: 32290
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/32290
Summary:
NETGEAR WGR614 is prone to a denial-of-service vulnerability that occurs =
in the administration web interface.
Successful exploits will cause the affected web interface to crash, denyi=
ng service to legitimate users.
86. GStreamer QuickTime Media File Parsing Multiple Buffer Overflow Vulne=
rabilities
BugTraq ID: 33405
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33405
Summary:
GStreamer is prone to multiple buffer-overflow vulnerabilities because th=
e application fails to perform adequate boundary checks on user-supplied =
input.
Attackers may leverage these issues to execute arbitrary code in the cont=
ext of applications that use the affected library. Failed attacks will ca=
use denial-of-service conditions.
Versions prior to GStreamer 'gst-plugins-good' 0.10.12 are vulnerable. A=
pplications using the library, such as Songbird, Totem, and Amarok, may a=
lso be affected.
87. Trickle 'LD_PRELOAD' Arbitrary Code Execution Vulnerability
BugTraq ID: 33516
Remote: No
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33516
Summary:
Trickle is prone to a vulnerability that lets attackers execute arbitrary=
code.
An attacker may exploit this issue by enticing a legitimate user into run=
ning the affected application from a directory that contains a malicious =
library file.
88. Nagios Unspecified Cross-Site Scripting Vulnerability
BugTraq ID: 29140
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/29140
Summary:
Nagios is prone to an unspecified cross-site scripting vulnerability beca=
use it fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may allow the attacker to steal cookie-based authentication credentia=
ls and to launch other attacks.
The issue affects versions prior to Nagios 2.12.
89. Cambium Group Content Management System Multiple Remote Vulnerabiliti=
es
BugTraq ID: 33882
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33882
Summary:
Cambium Group Content Management System is prone to multiple remote vulne=
rabilities:=20
- Multiple information-disclosure issues.=20
- An SQL-injection issue.=20
- An authentication-bypass issue.=20
A successful exploit may allow an attacker to compromise the application,=
gain unauthorized access to the application, obtain sensitive informatio=
n, access or modify data, or exploit latent vulnerabilities in the underl=
ying database. Other attacks are also possible.
90. Qwerty CMS 'index.php' SQL Injection Vulnerability
BugTraq ID: 33885
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33885
Summary:
Qwerty CMS is prone to an SQL-injection vulnerability because it fails to=
sufficiently sanitize user-supplied data before using it in an SQL query=
.
Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.
91. WOW Raid Manager Unspecified Cross Site Scripting Vulnerability
BugTraq ID: 31661
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/31661
Summary:
WOW Raid Manager is prone to a cross-site scripting vulnerability because=
it fails to properly sanitize user-supplied input.=20
An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may let the attacker steal cookie-based authentication credentials an=
d launch other attacks.
Versions prior to WOW Raid Manager 3.5.1 are vulnerable.
92. IBM WebSphere Application Server Cluster Configuration File Informati=
on Disclosure Vulnerability
BugTraq ID: 33905
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33905
Summary:
IBM WebSphere Application Server (WAS) is prone to an information-disclos=
ure vulnerability because it fails to properly conceal sensitive configur=
ation data.
Exploiting this issue may allow an attacker to access sensitive informati=
on that may aid in further attacks.
This issue affects WAS 6.1.2 and 6.2.
93. BarnOwl Prior to 1.0.5 Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 33877
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33877
Summary:
BarnOwl is prone to multiple buffer-overflow vulnerabilities because it f=
ails to perform adequate boundary-checks on user-supplied data.=20
Successfully exploiting these issues will allow an attacker to execute ar=
bitrary code within the context of the affected application. Failed explo=
it attempts will likely crash the application.
Versions prior to BarnOwl 1.0.5 are vulnerable.
94. Linux Kernel 'inotify' Local Privilege Escalation Vulnerability
BugTraq ID: 33503
Remote: No
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33503
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability.
A local attacker can exploit this issue to execute arbitrary code with el=
evated privileges or crash the affected kernel, denying service to legiti=
mate users.
Versions prior to Linux kernel 2.6.28-rc5 are vulnerable.
95. Linux Kernel '__scm_destroy()' Local Denial of Service Vulnerability
BugTraq ID: 32154
Remote: No
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/32154
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability.
Attackers can exploit this issue to cause the kernel to crash, denying se=
rvice to legitimate users.=20
The Linux kernel 2.6.26 and prior versions are affected.
96. Linux Kernel 'sendmsg()' Local Denial of Service Vulnerability
BugTraq ID: 32516
Remote: No
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/32516
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability.
Attackers can exploit this issue to create a soft lockup of the vulnerabl=
e kernel or to invoke the 'oom-killer' kernel functionality, which may ha=
lt unrelated processes. This may result in a denial-of-service condition.
NOTE: This issue was either caused or revealed by the fix for BID 32154 (=
Linux Kernel '__scm_destroy()' Local Denial of Service Vulnerability).
The Linux kernel 2.6.27 and prior versions are affected.
97. Sun Java Runtime Environment Network Access Restriction Security Bypa=
ss Vulnerability
BugTraq ID: 25054
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/25054
Summary:
The Sun Java Runtime Environment is prone to a security-bypass vulnerabil=
ity.=20
Successfully exploiting this issue will allow an attacker to connect to s=
ervices on a remote user's computer without proper authorization. This ma=
y lead to other attacks.
98. Sun JSSE SSL/TLS Handshake Processing Denial Of Service Vulnerability
BugTraq ID: 24846
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/24846
Summary:
The Sun JSSE (Java Secure Socket Extension) is prone to a denial-of-servi=
ce vulnerability.
An attacker can exploit this issue to crash the computer, denying access =
to legitimate users.
99. Adobe Acrobat and Reader PDF File Handling Remote Code Execution Vuln=
erability
BugTraq ID: 33751
Remote: Yes
Last Updated: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33751
Summary:
Adobe Acrobat and Reader are prone to a remote code-execution vulnerabili=
ty.
An attacker can exploit this issue to execute arbitrary code with the pr=
ivileges of the user running the application or crash the application, de=
nying service to legitimate users.
The issue affects Reader and Acrobat 9, 8.1.3 and prior, and 7.
UPDATE (February 24, 2009): Further reports suggest that this issue affec=
ts the vulnerable applications running on Apple Mac OS X and various Linu=
x-based operating systems.
100. Adobe RoboHelp Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 33888
Remote: Yes
Last Updated: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33888
Summary:
Adobe RoboHelp is prone to multiple cross-site scripting vulnerabilities =
because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary script code i=
n the browser of an unsuspecting user in the context of a site that inclu=
des content generated by the affected application. This may allow the att=
acker to steal cookie-based authentication credentials and to launch othe=
r attacks.
Adobe RoboHelp 6 and 7 are vulnerable.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Advisor: U.S. needs policy to defend cyberspace
By: Robert Lemos
An Obama transition-team member argues that any future cyber policy needs=
to deal with the role of the intelligence community, the militarization =
of cyberspace and designating a lead disaster agency.
http://www.securityfocus.com/news/11547
2. Cabal forms to fight Conficker, offers bounty
By: Robert Lemos
Microsoft offers $250,000 for information leading to the arrest of the au=
thor and, along with security firms and Internet service providers, pledg=
es to work to prevent the prolific worm from spreading further.
http://www.securityfocus.com/news/11546
3. Group releases list to kill most-dangerous bugs
By: Robert Lemos
Software makers, security vendors, and government agencies team up to cre=
ate a list of the 25 most severe software issues, aiming to get developer=
s to stop making mistakes.
http://www.securityfocus.com/news/11542
4. Group attacks flaw in browser crypto security
By: Robert Lemos
A group of researchers warns browser makers and certificate authorities t=
o drop support for MD5 digital signatures, after successfully creating a =
fake, but valid, certificate.
http://www.securityfocus.com/news/11541
IV. SECURITY JOBS LIST SUMMARY
-------------------------------
V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #432
http://www.securityfocus.com/archive/88/501097
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocu=
s.com from the subscribed address. The contents of the subject or message=
body do not matter. You will receive a confirmation request message to w=
hich you will have to answer. Alternatively you can also visit http://www=
.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email [email protected] and a=
sk to be manually removed.
XI. SPONSOR INFORMATION
------------------------
This issue is sponsored by Sophos Security Threat Report: 2009
Predicting the future in such a rapidly evolving environment is near impo=
ssible. One only needs to count the rate at which new malware appears tod=
ay compared to five years ago to see how quickly the threat has become mo=
re serious. Read our security threat report to read about the malware tre=
nds we predict will be at the forefront in 2009.
http://dinclinx.com/Redirect.aspx?36;4036;35;189;0;4;259;d0ddf43bf0d4abdd