SecurityFocus Newsletter #227
John Boletta <[email protected]> Mon, 15 Dec 2003 10:35:21 -0700 (MST)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #227
------------------------------
This Issue is Sponsored by: SPIDynamics
FREE White Paper: "How Web Application Hackers Break In!"
Learn why 70% of today's successful hacks involve Web Application attacks
such as: SQL Injection, XSS, Cookie Manipulation, and Parameter
Manipulation. All undetectable by Firewalls and IDS!
Download *FREE* white paper from SPI Dynamics for a complete guide to
protection!
http://www.securityfocus.com/sponsor/SPIDynamics_sf-news_031215
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Worm Propagation In Protected Networks
2. RETRO-FOCUS
3. IP Spoofing: An Introduction
II. BUGTRAQ SUMMARY
1. PLD Software Ebola Buffer Overflow Vulnerability
2. Novell NFS Server Hostname Alias Access Control Bypass Vulne...
3. Yahoo! Messenger IMVironment Cross-Site Scripting Vulnerabil...
4. AppleShare IP FTP Server RMD Command Denial Of Service Vulne...
5. NetScreen ScreenOS Session Timeout Unauthorized Access Vulne...
6. FVWM fvwm-menu-directory Command Execution Vulnerability
7. Jason Maloney's Guestbook HTML Injection Vulnerability
8. Virtual Programming VP-ASP shopdisplayproducts.asp Cross-Sit...
9. Cdwrite Insecure Temporary File Vulnerability
10. Xoops Multiple Vulnerabilities
11. EZMeeting EZNet.EXE Long HTTP Request Remote Buffer Overflow...
12. Land Down Under Auth.PHP SQL Injection Vulnerability
13. Webgate WebEye Information Disclosure Vulnerability
14. CDE DTPrintInfo Home Environment Variable Buffer Overflow Vu...
15. Abyss Web Server Authentication Bypass Vulnerability
16. MyServer HTTP File Name Request Handler Remote Denial Of Ser...
17. Chris Travers Hermes Unspecified File Include Vulnerability
18. HSFTP Username Command Line Argument Buffer Overrun Vulnerab...
19. HSFTP Hostname Command Line Argument Buffer Overrun Vulnerab...
20. FuzzyMonkey My Photo Gallery Unauthorized Access Vulnerabili...
21. NeoStats For Unreal IRCD Privilege Escalation Vulnerability
22. CVS Malformed Request System Root File Creation Vulnerabilit...
23. Bitfolge Snif Index.PHP Path Cross-Site Scripting Vulnerabil...
24. @mail Webmail System Multiple Vulnerabilities
25. BNCweb BNCquery.pl File Disclosure Vulnerability
26. Multiple Browser URI Display Obfuscation Weakness
27. Ben's Guestbook HTML Injection Vulnerability
28. Mantis Multiple Unspecified Cross-Site Scripting Vulnerabili...
29. Multiple Vendor XML Parser SOAP Server Denial Of Service Vul...
30. Microsoft Roaming Profile Resource Quota Bypass Weakness
31. Cisco ACNS Authentication Library Remote Buffer Overrun Vuln...
32. Multiple VisitorBook LE Input Validation Vulnerabilities
33. Cisco Unity Default User Accounts and IP Addresses Multiple ...
34. Adaptive Server Anywhere Multiple Remote Buffer Overrun Vuln...
35. Adaptive Server Anywhere XP_SPRINTF Format String Vulnerabil...
36. FlashGet Insecure Dialup Credential Storage Vulnerability
37. Mambo Server user.php Script Unauthorized Access Vulnerabili...
38. NetGear WAB102 Wireless Access Point Password Management Vul...
39. Cyclonic Webmail Authentication Bypass Vulnerability
40. Mambo Open Source 4.0.14 Server SQL Injection Vulnerability
41. Mambo Open Source PollBooth.PHP Multiple SQL Injection Vulne...
42. SX Design sipd Remote Denial of Service Vulnerability
43. Sun Solaris Text Editor ed Temporary File Creation Vulnerabi...
44. Cyclonic Webmail Information Disclosure Vulnerability
45. IRSSI Remote Denial of Service Vulnerability
46. RemotelyAnywhere Default.HTML Logout Message Injection Weakn...
47. Mozilla Browser URI MouseOver Obfuscation Weakness
48. Multiple Vendor XML DTD Parameter Entity SOAP Server Denial ...
III. SECURITYFOCUS NEWS ARTICLES
1. Will VoIP be wiretap-ready?
2. FTC investigates PetCo.com security hole
3. Heckenkamp Challenges Computer Ban
4. Secure Online Transmissions Can Help Firms Maintain an Edge
5. DVD Jon appeal ends: verdict before Xmas
6. Appeal of DVD hacker's acquittal concludes in Norway
IV. SECURITYFOCUS TOP 6 TOOLS
1. Cryptonit v0.9.1
2. JSch v0.1.12
3. floppyfw v2.9.5
4. slst v0.2
5. Jailkit v0.3
6. Metacortex OpenBSD PF Toolbox v1.0
V. SECURITYJOBS LIST SUMMARY
1. How to unsub from this list or others (Thread)
2. Electrical Design Engineering Position in Tampa (Thread)
3. Systems Engineer (Thread)
4. Senior Product Manager/Director (Thread)
5. Software Engineer (Thread)
6. security job project (Thread)
7. Software Engineer - CE Platform Builder (Thread)
8. Electrical Design Engineer (Thread)
9. Business Development Manager (Thread)
10. Secuirty Lead with EAI experience (Thread)
11. Kansas City, St. Louis, and Omaha (Audit/Security) (Thread)
12. Training Manager - Massachusetts (Thread)
13. List Cleaning - DO NOT REPLY (Thread)
14. Seeking Electrical Engineer with INFOSEC Background ... (Thread)
15. Senior Pre Sales Security Consultant in Reading , U... (Thread)
16. XML Security / Customer Support - Bay Area, CA (Thread)
17. Vice President of Sales California (Thread)
18. PreSales Engineers (Thread)
19. Unique opportunity for cleared IT / network security... (Thread)
20. Inside Account Executives Boston (Thread)
21. Vice President Business Development (Thread)
22. Director of Technical Evangelist Opportunity in Sant... (Thread)
23. Vice President Marketing New York/New Jersey (Thread)
24. QA Engineer - Anti-spam/email infrastructure company (Thread)
25. Fw: need a Systems Analyst in N. VA: RE FM 121 (Thread)
26. Seeking security interim management work, UK, AU, NZ... (Thread)
27. Security Opportunities in New Jersey (Thread)
28. IT Security Consultant - Applications, London, UK (Thread)
29. Inside Sales Rep - Anti-spam company (Thread)
30. IT Security Consultant - Infrastructure, London, UK (Thread)
31. need a Systems Analyst in N VA: RE FM 121 (Thread)
32. Regional Pre Sales Engineer Manager (Thread)
33. Security Channel Sales Representative (Thread)
34. Windows Vulnerability Engineer Silicon Valley CA (Thread)
35. Seeking Jr. Level Application Security Analyst posit... (Thread)
36. Senior Security Enginner/Audit Specialist - HCA - Na... (Thread)
37. GINA Developer for UK IT Security Company (Thread)
38. Seeking full-time permanent infocsec position in Atl... (Thread)
39. Security Engineer with ACTIVE US SECRET CLEARANCE se... (Thread)
40. Symantec - Distinguished Engineer - Santa Monica Cal... (Thread)
41. Seeking Security or Admin Position in the Washingto... (Thread)
42. ***Looking for a Secuity Vulenrabilities Expert for ... (Thread)
VI. INCIDENTS LIST SUMMARY
1. WINS CLient Service (Thread)
2. Fw: services.exe file (Thread)
3. DS trojan opens ports fport does not detect? (Thread)
4. services.exe file (Thread)
5. Another New Worm or Worm Variant? (Thread)
6. Strange services.exe file (Thread)
7. Strange SNMP probes suddenly appearing (Thread)
8. FW: New Worm or Worm Variant? (Thread)
9. New Worm or Worm Variant? (Thread)
10. yahoo instant messenger profile (Thread)
11. [mailinglists] Strange services.exe file (Thread)
12. forcdos.exe = serv-u.... (Thread)
13. Spoof source query (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. mac duplication (Thread)
2. iis 5 %00 null weirdness (Thread)
3. locating default signal handler for SIGSEGV (Thread)
4. Internet Explorer JavaScript insecure function (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Blessed Windows Security Templates (Thread)
2. How to disable all floppy drives on the network (Thread)
3. Article Announcement: Worm Propagation In Protected ... (Thread)
4. SecurityFocus Microsoft Newsletter #166 (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Exploit or trojan (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Static ARP table in Linux (Thread)
2. Firewall Inquiry (Thread)
3. Re[2]: Firewall Inquiry (Thread)
4. Password Questions (Thread)
5. Firewall continued (Thread)
6. tripwire (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Worm Propagation In Protected Networks
By SecurityFocus
Many documents explore worm propagation methods across the global
Internet. In contrast, this analysis focuses on the impact of three
prominent worms (Blaster, Slammer, and Code Red I/II) inside protected
networks, once the security perimeter has been breached.
http://www.securityfocus.com/infocus/1752
2. Due to an increase in interest, SecurityFocus has decided to bring back
past Infocus articles still relevant to the security industry. These
articles
will be posted at the bottom of the homepage, in the middle column.
3. IP Spoofing: An Introduction
By Matthew Tanase
Published March 11, 2003
IP spoofing allows an attacker to gain unauthorized access to a computer
or a network by making it appear that a malicious message has come from a
trusted machine by "spoofing" the IP address of that machine. In this
article, we will examine the concepts of IP spoofing: why it is possible,
how it works, what it is used for and how to defend against it.
http://www.securityfocus.com/infocus/1674
II. BUGTRAQ SUMMARY
-------------------
1. PLD Software Ebola Buffer Overflow Vulnerability
BugTraq ID: 9156
Remote: Yes
Date Published: Dec 05 2003
Relevant URL: http://www.securityfocus.com/bid/9156
Summary:
Ebola is a utility for making virus-scanning on Unix-based systems more
efficient.
It has been reported that a buffer overflow condition is present in the
authentication mechanism implemented in Ebola. The condition is due to
the use of the C library function "sprintf()" to construct an error string
insecurely when authentication is not successful. The flaw exists in the
"handle_PASS()" procedure, implemented in source file "ebola.c":
char outstr[100];
...
if (passwd) {
if (PASS_authenticate(username, passwd) == _PASS_OK) {
sprintf(outstr,"PASS NOT ACCEPTED for user \"%s\",
pass \"%s\".\n",username,passwd);
If the procedure "PASS_authenticate" returns the value defined as
"_PASS_OK", presumably an error result due to an unacceptable password, an
error string is constructed using the user-supplied username and password
and stored in the buffer "outstr". The "sprintf()" function does not
check to ensure that the created string is greater in size than the space
allocated to store it (100 bytes in this case).
It is possible for an attacker to cause the string to exceed 100 bytes by
supplying a username, password, or both, of adequate length. As the error
message states that the password was not accepted, it is assumed that
valid credentials are not required by attackers before this vulnerability
can be exploited.
According to the discoverer of this flaw, the vulnerability is remotely
exploitable.
2. Novell NFS Server Hostname Alias Access Control Bypass Vulne...
BugTraq ID: 9157
Remote: Yes
Date Published: Dec 04 2003
Relevant URL: http://www.securityfocus.com/bid/9157
Summary:
Novell has reported a vulnerability in how hostname aliases (from
sys:etc\hosts) are handled for NFS Server (XNFS.NLM) in the trusted hosts
configuration. NFS Server deny rules in the trusted host configuration
file do not take precedence if the alias is allowed in the hosts file.
This may make it possible for unauthorized hosts to mount filesystems.
3. Yahoo! Messenger IMVironment Cross-Site Scripting Vulnerabil...
BugTraq ID: 9158
Remote: Yes
Date Published: Dec 05 2003
Relevant URL: http://www.securityfocus.com/bid/9158
Summary:
Yahoo! Messenger allows IMVironments to be specified from within 'ymsgr:'
URIs, essentially permitting a particular IMVironment to be loaded when
such a URI is visited. A vulnerability has been discovered in this
feature.
Yahoo! Messenger is prone to a cross-site scripting vulnerability via
IMVironment error dialogs. This may occur when a 'ymsgr:' URI specifies
an invalid IMVironment that includes hostile HTML and script code. HTML
and script code will not be sufficiently sanitized from the error dialog
produced by such a request. This could permit various attacks since the
attacker may execute hostile script code in the context of the client.
Consequences include exposure of Yahoo messenger IDs and encoded
credentials.
It should also be noted that this issue could potentially be exploited to
corrupt IMVironment data, causing the client to not function properly.
4. AppleShare IP FTP Server RMD Command Denial Of Service Vulne...
BugTraq ID: 9159
Remote: Yes
Date Published: Dec 05 2003
Relevant URL: http://www.securityfocus.com/bid/9159
Summary:
AppleShare IP is a network server suite for Mac OS. The suite provides an
FTP server component.
The AppleShare IP FTP server has been reported prone to a denial of
service vulnerability. The issue presents itself if a remote attacker
invokes the 'RMD' command passing a '/' character as the only argument
when logged into an AppleShare IP FTP server. This action will have the
reported affect of causing the system that is hosting the AppleShare
software to lock, preventing any interaction and thereby effectively deny
service to legitimate system users.
This issue has been reported to affect AppleShare IP 6.3.1 and previous
versions.
5. NetScreen ScreenOS Session Timeout Unauthorized Access Vulne...
BugTraq ID: 9160
Remote: Yes
Date Published: Dec 05 2003
Relevant URL: http://www.securityfocus.com/bid/9160
Summary:
ScreenOS is the security appliance operating system used on NetScreen
devices. It is distributed and maintained by NetScreen.
It has been reported that NetScreen ScreenOS does not properly handle
timed out sessions. Because of this, it may be possible for a user regain
access to a previous session.
Reportedly, upon crossing the threshold of the idle timeout limit, the
NetScreen web management interface attempts to close the browser window
open to the interface. However, if one chooses not to allow the interface
to close the window, and returns to the management interface login
address, the user regains access to the device management tools. This
could potentially expose sessions, especially in situations where other
vulnerabilities facilitate session hijacking.
6. FVWM fvwm-menu-directory Command Execution Vulnerability
BugTraq ID: 9161
Remote: No
Date Published: Dec 05 2003
Relevant URL: http://www.securityfocus.com/bid/9161
Summary:
FVWM is a virtual desktop window manager for the X Window system.
A vulnerability has been reported to exist in the software that may allow
an attacker to execute malicious commands on a vulnerable system. The
problem is reported to exist in fvwm-menu-directory component of the
software that allows users to browse directories from FVWM menus. It has
been reported that fvwm-menu-directory does not properly sanitize user
input and allows a user with write permissions to a directory to execute
arbitrary commands.
A local attacker could potentially exploit this issue to execute malicious
commands with the privileges of the software. A successful attack may
allow an attacker to modify FVWM configuration files that could lead to a
denial of service. Root compromise is possible if the vulnerable
application is installed with setuid root.
FVWM versions 2.14.17 and 2.5.8 have been reported to be vulnerable to
this issue, however other versions may be affected as well.
7. Jason Maloney's Guestbook HTML Injection Vulnerability
BugTraq ID: 9162
Remote: Yes
Date Published: Dec 05 2003
Relevant URL: http://www.securityfocus.com/bid/9162
Summary:
Jason Maloney's Guestbook is a CGI web guestbook application.
A vulnerability has been reported in the software that may allow a remote
attacker to execute HTML and script code in a user's browser. The issue is
reported to be present in the 'name' field of the application. Although
unconfirmed other fields may be affected as well. The problem exists due
to insufficient sanitization of user-supplied input. It may be possible
for an attacker to include malicious HTML code in one of the vulnerable
fields. The injected code could then be interpreted by the browser of a
user visiting the vulnerable site. This attack would occur in the security
context of the affected site.
Successful exploitation of this issue may allow a remote attacker to steal
cookie-based authentication credentials. Other attacks are possible as
well.
Jason Maloney's Guestbook version 3.0 has been reported to be vulnerable
to this issue, however other versions may be affected as well.
8. Virtual Programming VP-ASP shopdisplayproducts.asp Cross-Sit...
BugTraq ID: 9164
Remote: Yes
Date Published: Dec 05 2003
Relevant URL: http://www.securityfocus.com/bid/9164
Summary:
VP-ASP is a Web-based shopping cart system designed for online retailers.
A vulnerability has been reported to exist in the software that may allow
a remote user to launch cross-site scripting attacks. The problem is
reported to exist due to improper sanitizing of user-supplied data in the
'shopdisplayproducts.asp' script. A remote attacker may exploit this issue
to potentially execute HTML or script code in the security context of the
vulnerable site.
This problem could potentially be exploited to steal cookie authentication
credentials, or perform other types of attacks. VP-ASP version and 4.50
and previous have been reported to be prone to this issue, though 5.0 may
also be affected.
9. Cdwrite Insecure Temporary File Vulnerability
BugTraq ID: 9165
Remote: No
Date Published: Dec 06 2003
Relevant URL: http://www.securityfocus.com/bid/9165
Summary:
Cdwrite is a CD writing application for Unix/Linux variants.
Cdwrite creates files in the temporary directory in an insecure manner.
As a result, a local attacker may launch symlink attacks that could cause
system files to be corrupted. In particular, the program creates
'/tmp/.tempfile' when it is run. An attacker could take advantage of this
by creating a symbolic link in the same location as where the temporary
file will be created. When the program is run, any operations that are
intended to be performed on the temporary file will instead be performed
on the file pointed to by the symbolic link (provided the file is
writeable by the user invoking Cdwrite).
This will most likely result in a denial of service or loss of data. This
type of vulnerability could also result in privilege escalation if the
attacker can influence what is written during the symbolic link attack.
10. Xoops Multiple Vulnerabilities
BugTraq ID: 9166
Remote: Yes
Date Published: Dec 06 2003
Relevant URL: http://www.securityfocus.com/bid/9166
Summary:
Multiple vulnerabilities were reported in Xoops.
The following specific issues were reported:
SQL injection issues exist in the 'banners.php' script. Supplying
malicious SQL syntax to this script via URI parameters may allow for
manipulation of database queries. This could result in bulletin board
compromise or other consequences.
A vulnerability in 'banners.php' allows remote attackers to manipulate
banners to contain an arbitrary URI. At the very least an attacker could
use this to misrepresent banner information, potentially redirecting users
to attacker-specified sites. Other attacks are also possible.
The 'edituser.php' and 'imagemanager.php' scripts may allow remote
attackers to directly influence the values of local variables, allowing
for various types of attacks. In some instances these variables may be
redefined to an attacker-specified value, compromising security properties
of the software.
These issues are currently undergoing further analysis. This cumulative
BID will be separated into individual entries when analysis is complete.
11. EZMeeting EZNet.EXE Long HTTP Request Remote Buffer Overflow...
BugTraq ID: 9167
Remote: Yes
Date Published: Dec 08 2003
Relevant URL: http://www.securityfocus.com/bid/9167
Summary:
eZ is a commercially available conferencing software package distributed
and maintained by eZmeeting. It is available for the Microsoft Windows
platform.
A vulnerability has been identified in the handling of some types of
requests by the eZ package. Because of this, it may be possible for a
remote attacker to execute arbitrary code and gain unauthorized access to
a vulnerable host.
The problem is in the handling of long HTTP requests by the eZnet.exe
component. When the software is executed, this component listens on port
80 of the system network interface for incoming conferencing connections.
When a request of excessive length is passed to a parameter of a valid
component, the data is copied directly to the stack of the process. By
requesting the component with a maliciously crafted string, it is possible
to overwrite the stack with arbitrary data, forcing the process to execute
attacker-supplied instructions with the privileges of the eZnet.exe
process.
12. Land Down Under Auth.PHP SQL Injection Vulnerability
BugTraq ID: 9168
Remote: Yes
Date Published: Dec 08 2003
Relevant URL: http://www.securityfocus.com/bid/9168
Summary:
Land Down Under is a website engine that is implemented in PHP and
back-ended by MySQL.
Land Down Under is prone to SQL injection attacks. This is due to an
input validation error in 'auth.php'. In particular, various
user-supplied variables are used in an SQL query without proper
sanitization of SQL syntax. As a result, a remote attacker could include
malicious SQL syntax via form fields and influence database queries. This
could be used to bypass authentication or mount other attacks against the
software or the underlying database.
** A proof-of-concept was included in the initial vulnerability report
that does not appear to work due to the software forcing authentication
afterwards. However, this does not eliminate the risk of this issue since
it is still possible for a remote attacker to influence SQL queries on
vulnerable versions.
13. Webgate WebEye Information Disclosure Vulnerability
BugTraq ID: 9169
Remote: Yes
Date Published: Dec 08 2003
Relevant URL: http://www.securityfocus.com/bid/9169
Summary:
Webgate WebEye is a webcam server software that allows users to monitor
cameras remotely through a web browser.
A vulnerability has been reported to exist in the software that may allow
an attacker to harvest usernames and passwords. The issue presents itself
due to a flaw in the '/admin/wg_user-info.ml' script that fails to verify
user credentials before returning sensitive information. It has been
reported that if 'USER_ID' cookie value is set to 0, an attacker can gain
access to sensitive data such as usernames and passwords.
Successful exploitation of this issue may allow an attacker to harvest
sensitive information that could be used to mount further attacks against
a system.
14. CDE DTPrintInfo Home Environment Variable Buffer Overflow Vu...
BugTraq ID: 9170
Remote: No
Date Published: Dec 08 2003
Relevant URL: http://www.securityfocus.com/bid/9170
Summary:
dtprintinfo is a component of the Common Desktop Environment (CDE)
distributed with several UNIX operating systems.
A vulnerability has been identified in the handling of strings in the
environment by dtprintinfo. Because of this, it may be possible for a
local attacker to execute arbitrary code on a vulnerable host.
The problem is in the handling of data supplied via the HOME environment
variable. By default, an attacker can modify this environment variable in
a shell to contain any string.
Because dtprintinfo does not perform sufficient bounds checking on data
supplied in this variable, it is possible for a local attacker to modify
this variable to contain a malicious string with executable instructions.
By executing the dtprintinfo program while this string is in the HOME
environment variable, an attacker could potentially execute malicious
instructions with the privileges of the dtprintinfo process, which is by
default installed with set-User-ID privileges of root.
This issue is known to affect Sun Solaris. However, other platforms may
also be affected.
15. Abyss Web Server Authentication Bypass Vulnerability
BugTraq ID: 9171
Remote: Yes
Date Published: Dec 08 2003
Relevant URL: http://www.securityfocus.com/bid/9171
Summary:
Abyss Web Server is a freely available personal web server. It is
maintained by Aprelium Technologies and runs on Microsoft Windows
operating systems, as well as Linux.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to bypass authentication in order to access the
resources. It has been reported that this issue only presents itself if
the server is installed on a Linux system running FAT32. An attacker may
access the password protected directory under which the server is running
by adding a period as '.' or '%2e' at the end of a URL request. It has
also been reported that adding a space ' ' or colon ':' to a URL may have
the same affect, however it may also just cause a 404 server error.
Successful exploitation of this issue may allow an attacker to bypass
authentication and gain access to server resources in order to launch
further attacks.
Abyss Web Server versions prior to 1.2 have been reported prone to this
issue.
16. MyServer HTTP File Name Request Handler Remote Denial Of Ser...
BugTraq ID: 9172
Remote: Yes
Date Published: Dec 08 2003
Relevant URL: http://www.securityfocus.com/bid/9172
Summary:
MyServer is an application and web server for Microsoft Windows and Linux
operating systems.
MyServer has been reported prone to a remotely triggered denial of service
vulnerability. The issue presents itself when a remote attacker requests a
file that contains spaces in its name. This activity will cause an
exception in the affected server, effectively denying service to
legitimate users.
An attacker may exploit this vulnerability to deny service to legitimate
users.
17. Chris Travers Hermes Unspecified File Include Vulnerability
BugTraq ID: 9173
Remote: Yes
Date Published: Dec 08 2003
Relevant URL: http://www.securityfocus.com/bid/9173
Summary:
Hermes is a web based application that is designed to provide a rapid
application development framework for business tools including CRM.
Hermes in written in PHP.
A vulnerability has been reported to exist in the software that may allow
an attacker to include malicious files containing arbitrary code to be
executed on a vulnerable system. The issue exists due to improper
validation of user-supplied data. Remote attackers could potentially
exploit this issue via a vulnerable variable to include a remote malicious
script, which will be executed in the context of the web server hosting
the vulnerable software.
Hermes versions 0.3.0 Alpha 4 and prior may be prone to this issue.
18. HSFTP Username Command Line Argument Buffer Overrun Vulnerab...
BugTraq ID: 9174
Remote: No
Date Published: Dec 07 2003
Relevant URL: http://www.securityfocus.com/bid/9174
Summary:
hsftp is an FTP emulation program that is available for Unix/Linux
variants.
hsftp is prone to a locally exploitable buffer overrun vulnerability due
to insufficient bounds checking of username arguments supplied as command
line input. By supplying an overly long argument as a username argument
when invoking the program, it will be possible to corrupt adjacent regions
of memory with superfluous user-supplied data. In this manner, it may be
possible to corrupt sensitive variables in memory and control execution
flow, resulting in execution of arbitrary code.
This could occur in situations where hsftp is installed setuid root and
not configured to drop privileges, this could be exploited to execute
arbitrary code with elevated privileges.
19. HSFTP Hostname Command Line Argument Buffer Overrun Vulnerab...
BugTraq ID: 9175
Remote: No
Date Published: Dec 07 2003
Relevant URL: http://www.securityfocus.com/bid/9175
Summary:
hsftp is an FTP emulation program that is available for Unix/Linux
variants.
hsftp is prone to a locally exploitable buffer overrun vulnerability due
to insufficient bounds checking of hostname arguments supplied as command
line input. By supplying an overly long argument as a host argument when
invoking the program, it will be possible to corrupt adjacent regions of
memory with superfluous user-supplied data. In this manner, it may be
possible to corrupt sensitive variables in memory and control execution
flow, resulting in execution of arbitrary code.
This could occur in situations where hsftp is installed setuid root and
not configured to drop privileges, this could be exploited to execute
arbitrary code with elevated privileges.
20. FuzzyMonkey My Photo Gallery Unauthorized Access Vulnerabili...
BugTraq ID: 9176
Remote: Yes
Date Published: Dec 07 2003
Relevant URL: http://www.securityfocus.com/bid/9176
Summary:
My Photo Gallery is a web based photo gallery written in Perl.
A vulnerability has been reported to be present in the software that may
allow an attacker to gain access to any directory without proper
authentication. An attacker may view the contents of any directories
viewable by legitimate users with access credentials. Due to a lack of
details further information cannot be provided at the moment. This BID
will be updated as more information becomes available.
My Photo Gallery versions 3.7 and prior may be vulnerable to this issue.
21. NeoStats For Unreal IRCD Privilege Escalation Vulnerability
BugTraq ID: 9177
Remote: No
Date Published: Dec 08 2003
Relevant URL: http://www.securityfocus.com/bid/9177
Summary:
NeoStats is an application that is designed to provide statistical
services for IRC servers. NeoStats also provides support for loading and
unloading modules. Additionally NeoStats allows a user to create user
levels, custom modules and provides for IRC server management.
NeoStats has been reported prone to a privilege escalation vulnerability
when it is installed in conjunction with UnrealIRCD. The issue presents
itself due to an incompatibility with legacy umodes that are supported by
NeoStats and new umodes that have been introduced in the latest version of
UnrealIRCD.
Specifically, with the release of UnrealIRCD version 3.2-beta19,
UnrealIRCD announced the support of a new umode function 'umode +T' (Block
CTCP Requests). NeoStats interprets this umode as 'Network Technical
Administrator' mode. Because of this incompatibility, an unprivileged user
will be capable of executing a 'umode +T' request against the UnrealIRCD.
Attempts to request the umode will be interpreted incorrectly by NeoStats
and the attacker will gain almost unfettered access to NeoStats as the
'Network Technical Administrator'.
This vulnerability only exists when NeoStats versions 2.5.9 and prior is
installed with UnrealIRCD version 3.2-beta19.
22. CVS Malformed Request System Root File Creation Vulnerabilit...
BugTraq ID: 9178
Remote: Yes
Date Published: Dec 09 2003
Relevant URL: http://www.securityfocus.com/bid/9178
Summary:
CVS is the Concurrent Versions System, which is a freely available
open-source version management package. It is available for the Unix and
Linux operating systems.
A vulnerability has been discovered in the handling of some types of
requests by CVS. Because of this, it may be possible for an attacker to
create files in the root directory of a system hosting the vulnerable
server.
The problem involves the handling of malformed requests by modules. An
attacker supplying a maliciously crafted request to the server could,
depending upon the permissions of the CVS server, create files and/or
directories in the system root directory. However, this problem is
limited by the write permissions of the root directory, and the privileges
with which the CVS server executes.
23. Bitfolge Snif Index.PHP Path Cross-Site Scripting Vulnerabil...
BugTraq ID: 9179
Remote: Yes
Date Published: Dec 09 2003
Relevant URL: http://www.securityfocus.com/bid/9179
Summary:
Bitfolge Snif is a script designed to generate web server directory
indices.
Bitfolge Snif is prone to a cross-site scripting vulnerability. The
specific issue exists in the 'index.php' script. In particular, input
supplied via the 'path' URI parameter is not sufficiently sanitized before
being included in dynamically generated web pages. As a result, hostile
HTML and script code may be embedded in a malicious link to a site hosting
the vulnerable software. If such a link is visited by a victim user, the
attacker-supplied code may render in their web browser in the context of
the site.
Exploitation could permit a remote attacker to steal cookie-based
authentication credentials. Other attacks are also possible since the
attacker can influence how the site is rendered to the victim user.
This issue was reported in version 1.2.6. Other versions are also likely
affected.
24. @mail Webmail System Multiple Vulnerabilities
BugTraq ID: 9180
Remote: Yes
Date Published: Dec 09 2003
Relevant URL: http://www.securityfocus.com/bid/9180
Summary:
@mail Webmail System is a web based e-mail software package. It can be
installed with a SQL database or flat files.
It has been reported that @mail Webmail System may be prone to multiple
vulnerabilities that include directory traversal, SQL injection, session
hijacking, and cross-site scripting. These issues may allow an attacker
to gain access to sensitive information including user email messages and
mailboxes.
The following specific issues were reported:
A directory traversal issue has been reported in the software that may
allow an attacker to gain access to a user's mailbox. The problem is
reported to exist due to insufficient sanitization of user-supplied data
through the 'Folder' parameter of 'showmail.pl' script.
Multiple SQL injection vulnerabilities have been identified in the
software. The problems are reported to exist due to insufficient
sanitization of user-supplied data in the 'atmail.pl', 'search.pl', and
'reademail.pl' scripts. A remote attacker may exploit these issues to
influence SQL query logic to disclose sensitive information that could be
used to gain unauthorized access. It has been reported that by exploiting
these issue an attacker may also be able to gain unauthorized access to
any email message of an address registered in @Mail system.
The software is also prone to a vulnerability that may allow remote
attackers to hijack webmail sessions. It has been reported that while is
user is logged in, their session id and mailbox name are stored in a
cookie. An attacker is reportedly able to gain access to a user's mailbox
by modifying the mailbox name.
A cross-site scripting issue has been identified in the software that may
allow a remote attacker to steal valid session ids and gain access to a
user's mailbox. This issue results from insufficient sanitization of
user-supplied data leading to the theft of cookie based authentication
credentials.
These issue have reportedly been tested on @Mail 3.52 Demo for Windows
NT/2000/XP on Windows 2000 Advanced Server, however other version on
various supported platforms may be affected as well.
These issues are currently undergoing further analysis. This cumulative
BID will be separated into individual entries when analysis is complete.
25. BNCweb BNCquery.pl File Disclosure Vulnerability
BugTraq ID: 9181
Remote: Yes
Date Published: Dec 09 2003
Relevant URL: http://www.securityfocus.com/bid/9181
Summary:
BNCweb is web based CGI program for searching and retrieving lexical,
grammatical and textual data from the 100 million word collection of
English texts in British National Corpus.
BNCweb has been reported to be prone to a file disclosure vulnerability
due a flaw in the BNCquery.pl script. This could potentially permit
remote attackers to gain unauthorized access to sensitive files hosted on
the system running the software. Files that are readable to the web server
and system password files will be accessible to an attacker if this
vulnerability is successfully exploited. It has been reported that the
scripts are protected by the web server's access control mechanism;
therefore an attacker needs to have a user account to carry out a
successful attack.
26. Multiple Browser URI Display Obfuscation Weakness
BugTraq ID: 9182
Remote: Yes
Date Published: Dec 09 2003
Relevant URL: http://www.securityfocus.com/bid/9182
Summary:
A weakness has been reported in multiple browsers that may allow attackers
to obfuscate the URI for a visited page. The problem is said to occur when
a URI designed to pass access a specific location with a supplied
username, contains a non-printable hexadecimal value prior to the @
symbol.
Specifically, the malicious URI must be formatted as follows, where %00
may be any non-displayable hexadecimal value:
http://www.trusted.com%[email protected]
Upon clicking the link, the URI field would contain www.trusted.com
despite the access site actually being www.malicious.com. It should be
noted that manually placing such a URI into the location may not work, as
the hexadecimal value must not be escaped.
An attacker could exploit this issue by supplying a malicious URI pointing
to a page designed to mimic that of a trusted site. If an unsuspecting
victim were to follow the link and attempt to verify the authenticity of
the current location by checking the current URI, they may be decieved
into believing they are at the actual trusted site. This could potentially
cause a false sense of security for the victim.
The are currently conflicting reports regarding which versions of Internet
Explorer this weakness affects, including versions for Mac OSX. As more
information becomes available the necessary clarifications will be
addressed.
Symantec has confirmed however, that this issue does affect the latest
Internet Explorer with all service packs and patches applied.
Reports indicate that Microsoft Outlook Express 6 is affected by this
issue as well. As such, it is believed that all releases of Outlook
Express and possibly Outlook are affected.
Mozilla and Mozilla Firebird browsers are also vulnerable to this issue.
This has not yet been confirmed.
27. Ben's Guestbook HTML Injection Vulnerability
BugTraq ID: 9183
Remote: Yes
Date Published: Dec 09 2003
Relevant URL: http://www.securityfocus.com/bid/9183
Summary:
Ben's Guestbook is a PHP web guestbook application.
A vulnerability has been reported in the software that may allow a remote
attacker to execute HTML and script code in a user's browser. The issue is
reported to be present in the comments field of the application. Although
unconfirmed other fields may be affected as well. The problem exists due
to insufficient sanitization of user-supplied input. It may be possible
for an attacker to include malicious HTML code in one of the vulnerable
fields. The injected code could then be interpreted by the browser of a
user visiting the vulnerable site. This attack would occur in the security
context of the affected site.
Successful exploitation of this issue may allow a remote attacker to steal
cookie-based authentication credentials. Other attacks are possible as
well.
Ben's Guestbook version 1.0 has been reported to be vulnerable to this
issue.
28. Mantis Multiple Unspecified Cross-Site Scripting Vulnerabili...
BugTraq ID: 9184
Remote: Yes
Date Published: Dec 09 2003
Relevant URL: http://www.securityfocus.com/bid/9184
Summary:
Mantis is a web based software bug tracking application implmented in PHP.
Problems have been identified in the handling of some types of input by
Mantis. Because of this, an attacker may be able to execute code in the
browser of target victims.
Specific details concerning the issue are not available. Like any
cross-site scripting attack, this issue is conjectured to require the
click of a malicious link by a target victim, which in turn executes
script code in the security context of the site hosting the vulnerable
software. This Bugtraq ID will be updated if more information is made
available.
These issues were announced by the vendor and affect versions prior to
0.18.0.
29. Multiple Vendor XML Parser SOAP Server Denial Of Service Vul...
BugTraq ID: 9185
Remote: Yes
Date Published: Dec 09 2003
Relevant URL: http://www.securityfocus.com/bid/9185
Summary:
SOAP is the Simple Object Access Protocol, which is implemented in
numerous web service software packages by various vendors. SOAP servers
are available for the Unix, Linux, and Microsoft Windows platforms.
A problem has been identified in several different SOAP servers when
handling certain types of requests. Because of this, it is possible for
an attacker to force a denial of service on systems using a vulnerable
implementation.
The problem is in the handling of specially crafted SOAP requests. By
making a SOAP request with maliciously crafted XML data, it is possible to
cause the SOAP server to consume excessive amounts of system resources.
This issue can be used to make the server unavailable while it handles the
requests, and could be continuously used to create a prolonged denial of
web services.
30. Microsoft Roaming Profile Resource Quota Bypass Weakness
BugTraq ID: 9186
Remote: No
Date Published: Dec 09 2003
Relevant URL: http://www.securityfocus.com/bid/9186
Summary:
Microsoft proquota.exe is an application used to enforce limits on profile
storage space available on a server for each roaming profile.
Proquota has been reported prone to a weakness that may be exploited by a
local user to bypass profile storage limits supposedly enforced by the
proquota application. It has been reported that an attacker who has
interactive access to a system, may make the proquota application behave
in an unstable manner by having an open unsaved notepad session active
when a "Log Off" procedure is invoked from the start menu.
It has been reported that when the "End Now" dialog appears for the
unclosed notepad session, the attacker may cause the proquota.exe
application process to crash, by hovering the mouse pointer over the
proquota icon in the system systray.
Once the proquota application has failed, it has been reported that the
attacker may proceed without any resource limits being enforced on the
size of the current profile. An attacker may exploit this condition to
consume resources on the associated domain controller server, ultimately
causing the domain controller to behave in an unstable manner.
31. Cisco ACNS Authentication Library Remote Buffer Overrun Vuln...
BugTraq ID: 9187
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9187
Summary:
Cisco has reported a remotely exploitable buffer overrun in ACNS
authentication libraries, which are typically deployed on various Content
devices. In particular, there is insufficient bounds checking of
passwords. If an overly long password is supplied, it may be possible to
corrupt sensitive regions of memory in such a way as to control execution
flow and execute malicious instructions. The issue is exposed via the CE
GUI server, which uses the vulnerable authentication libraries.
The following devices running ACNS software versions prior to 4.2.11 or
5.0.5 are affected:
Content Routers 4400 series
Content Distribution Manager 4600 series
Content Engine 500 and 7300 series
Content Engine Module for Cisco Routers 2600, 3600 and 3700 series
This issue could be potentially exploited to execute arbitrary code on a
vulnerable device, resulting in full compromise. Denial of services is
another possible consequence of exploitation.
32. Multiple VisitorBook LE Input Validation Vulnerabilities
BugTraq ID: 9188
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9188
Summary:
VisitorBook LE is web based database-driven guestbook software.
VisitorBook LE has been reported prone to multiple input validation
vulnerabilities that may be exploited by a remote attacker to trigger
database corruption, launch cross-site scripting attacks and potentially
use the affected site as an email relay.
The issues present themselves due to a lack of sufficient sanitization
performed on user supplied data,for example: $do, $max_posts, $user
parameters passed to the visitorbook.pl script.
33. Cisco Unity Default User Accounts and IP Addresses Multiple ...
BugTraq ID: 9189
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9189
Summary:
Unity is a Cisco software product designed to unify voice message, fax,
and e-mail into a user's inbox.
Multiple vulnerabilities have been identified in Cisco Unity running on
IBM servers. It has been reported that vulnerable systems contain default
user accounts and default IP addresses that could be used by an attacker
to gain unauthorized access.
The following specific issues have been identified:
A local user account with 'log on locally' rights named "bubba" may be
present on the system. Remote attackers who are aware of the default
account may use it to gain unauthorized access to the vulnerable system.
It has been reported that upon installation, the RAID Management service
attempts to establish a TCP session with a RAID server address embedded in
the RaidNLst.ser file. The RaidNLst.ser file is stored in the C:\Program
Files\RaidMan directory. This specific address was used during the
testing of the application. The issue results in opening TCP port 34571
and listening for remote contact. This vulnerability may allow a remote
attacker to gain access to a vulnerable system via this open port.
The Cisco Unity Server is configured to get an IP Address from a DHCP
server upon installation. If a local DHCP server does not exist, the
vulnerable system will repeatedly send packets to a DHCP server specified
by the manufacturer during testing. This server only stops contacting the
default network once a local DHCP server is identified or a static entry
is made for a local DHCP server.
These issues are only present on Unity installation disks with specific
part numbers. Part numbers on disks containing these issues are as
follows:
80-7111-01 for the UNITY-SVRX255-1A
80-7112-01 for the UNITY-SVRX255-2A
34. Adaptive Server Anywhere Multiple Remote Buffer Overrun Vuln...
BugTraq ID: 9190
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9190
Summary:
Adaptive Server Anywhere is a relational database the backend of SQL
Anywhere Studio 8. It is a transaction-based SQL database.
It has been discovered that Adaptive Server Anywhere is prone to multiple
remote buffer overrun vulnerabilities. The problem occurs due to
insufficient bounds checking in a wide variety of procedures, stored
procedures, and statements detailed below.
Affected CREATE statements: DATABASE, COMPRESSED DATABASE, EXPANDED
DATABASE, ENCRYPTED FILE, DECRYPT FILE, DBSPACE, and WRITE FILE
Affected ALTER statements: DATABASE and WRITEFILE
Affected BACKUP statements: DATABASE DIRECTORY and DATABASE TO
Miscellaneous statements: INSTALL JAVA, DROP DATABSE, and RESTORE DATABASE
Each of the above statements is by default given the 'DBA' permissions,
possibly them inaccessible to some attackers.
The START DATABSE statement is also prone to a buffer overrun, however
this statement is accessible by all users on personal databases, and 'DBA'
only on network databases.
The following is a list of affected stored procedures and procedures with
'DBA' permissions: XP_STARTSMTP, XP_SENDMAIL, and SA_EXEC_SCRIPT
Finally, below is a list of affected stored procedures and procedures with
'NONE' permissions: SP_REMOTE_COLUMNS, SP_REMOTE_EXPORTED_KEYS,
SP_REMOTE_IMPORTED_KEYS, SP_REMOTE_PRIMARY_KEYS, SP_REMOTE_TABLES, and
SA_FORWARD_TO
As a result of these buffer overrun vulnerabilities, a malicious remote
user could access the database, possibly requiring 'DBA' access
permissions, and supply excessive, but specially formatted data to
affected statement or procedure. This could ultimately allow for the
execution of arbitrary code within the context of the user whom invoked
the database.
35. Adaptive Server Anywhere XP_SPRINTF Format String Vulnerabil...
BugTraq ID: 9191
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9191
Summary:
Adaptive Server Anywhere is a relational database the backend of SQL
Anywhere Studio 8. It is a transaction-based SQL database.
Adaptive Server Anywhere has been reported prone to a format string
vulnerability in the extended stored procedure XP_SPRINTF. It has been
reported that this vulnerability may be exploited by an authenticated user
who has sufficient privileges to pass data to the XP_SPRINTF procedure.
Although unconfirmed, it has been conjectured that format specifiers
passed as an argument to the affected procedure would be processed and
acted on literally, allowing an attacker to write to or reveal arbitrary
regions in process memory. If successful the attacker may overwrite a
saved value that is crucial in controlling Adaptive Server Anywhere
execution flow. The attacker may leverage this condition to influence
execution flow into a region of memory that contains attacker-supplied
operation codes. Ultimately this may result in the execution of the
attacker-supplied operation codes in the context of the affected server.
An attacker may exploit this vulnerability to escalate privileges to the
'dba' user within the database, or to escalate privileges to the user the
Adaptive Server Anywhere process is running as.
It should be noted that although this vulnerability has been reported to
affect Adaptive Server Anywhere version 9.0 previous versions might also
be affected.
36. FlashGet Insecure Dialup Credential Storage Vulnerability
BugTraq ID: 9192
Remote: No
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9192
Summary:
FlashGet is a download manager for Microsoft Windows platforms.
FlashGet allows users to store credentials for dialup connections. This
feature is prone to a vulnerability. In particular, FlashGet stores
dialup credentials in a user-accessible registry key. These credentials
are stored in the following registry key:
[HKEY_USERS\.DEFAULT\Software\JetCar\JetCar\DialUp
The username will be stored in plaintext and the password will be
hex-encoded. As a result, malicious local users may obtain these
credentials. This presents a security risk if dialup accounts are not
shared between users on the system.
This issue was reported in FlashGet 0.9 through 1.2. Other versions may
also be affected.
37. Mambo Server user.php Script Unauthorized Access Vulnerabili...
BugTraq ID: 9193
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9193
Summary:
Mambo Open Source Server is a web based content management system.
A vulnerability has been reported to exist in the software that may allow
a remote attacker change user and administrator information. The problem
is reported to exist in the userSave() function of
'components/com_user/user.php' script. It has been reported that by using
the id of a legitimate user and/or administrator an attacker can modify
the user's information such as password, email, name etc.
Mambo Server version 4.5 Beta 1.0.3 has been reported to be vulnerable to
this issue, however other versions could be affected as well.
38. NetGear WAB102 Wireless Access Point Password Management Vul...
BugTraq ID: 9194
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9194
Summary:
NetGear WAB102 is a dual band Wireless Access point.
A vulnerability has been reported in the software that may allow a remote
attacker to access a vulnerable unit by using a default password or any
password containing a space ' '. Furthermore, if the unit loses power and
is restarted or reset, the password is changed backed to the default
password. The access point is shipped with a default account of 'admin'
and a password of '1234'.
Successful exploitation of this issue may allow an attacker to gain access
to the access point and launch further attacks against a system.
NetGear WAB102 running firmware version 1.2.3 has been reported to be
prone to this issue.
39. Cyclonic Webmail Authentication Bypass Vulnerability
BugTraq ID: 9195
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9195
Summary:
Cyclonic webmail is web-based software that provides an interface to allow
remote users to read and send emails via a third party POP3 and SMTP
server.
Cyclonic webmail has been reported prone to an authentication bypass
vulnerability. The issue exists due to a flaw in the procedure used to
authenticate a remote user before Cyclonic webmail scripts are available
for perusal/use. It has been reported that the Cyclonic webmail
authentication software relies on a remote POP3 server that may be
specified by the attacker, to authenticate valid users. As a result of
this, an attacker may specify any remote POP3 server that is under the
attackers control and thereby gain access to the Cyclonic webmail scripts.
Post-Authentication the attacker may employ the Cyclonic webmail to spoof
email, as a spam relay. The attacker may also potentially hijack other
users sessions, by viewing session id's in the /sids/ folder, if this
folder is readable, to view arbitrary emails and disclose data that may be
potentially sensitive.
Although this vulnerability has been reported to affect Cyclonic webmail
version 4, previous version might also be affected.
40. Mambo Open Source 4.0.14 Server SQL Injection Vulnerability
BugTraq ID: 9196
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9196
Summary:
Mambo Open Source is a web based content management system.
It has bee reported that Mambo Open Source 4.0.14 Server is prone to SQL
injection attacks.
The problem is said to occur due to insufficient sanitization of data
passed to specific index.php variables. The vulnerability occurs due
insufficient variable quotes encapsulation of the artid variable,
specifically during a query carried out by the show() function.
As a result, an attacker may be capable of injecting SQL syntax into the
query, possibly manipulating it's logic. This could allow for attacks to
be carried out against the underlying database.
41. Mambo Open Source PollBooth.PHP Multiple SQL Injection Vulne...
BugTraq ID: 9197
Remote: Yes
Date Published: Dec 10 2003
Relevant URL: http://www.securityfocus.com/bid/9197
Summary:
Mambo Open Source is an open source web content management system.
Mambo Open Source is prone to SQL injection attacks. This is due to an
input validation error in 'pollBooth.php'. In particular, various
user-supplied variables are used in an SQL query without proper
sanitization of SQL syntax. As a result, a remote attacker could include
malicious SQL syntax via URI parameters and influence database queries.
This could be used to escalate privileges, reset passwords or mount other
attacks against the software or the underlying database.
It should be noted that although this vulnerability has been reported to
affect Mambo Open Source Version 4.0.14, other versions might also be
affected.
42. SX Design sipd Remote Denial of Service Vulnerability
BugTraq ID: 9198
Remote: Yes
Date Published: Dec 11 2003
Relevant URL: http://www.securityfocus.com/bid/9198
Summary:
sipd is a SIP (Session Initiation Protocol) proxy and location server.
A vulnerability has been identified in sipd that may allow a remote
attacker to cause a denial of service condition in the software. The
problem is reported to exist in the gethostbyname_r function of the
software. It has been reported that the vulnerable function returns a
value of 1 when faced with an erroneous situation, however it may be
possible to cause it return 0. This situation can arise when trying to
resolve a non-existent hostname. An attacker may be able to cause the
server to crash by sending a malformed SIP request.
Successful exploitation of this issue may allow a remote attacker to crash
an affected sipd daemon, effectively denying service to other legitimate
users.
sipd version 0.1.2 has been reported to be prone to this issue, however
other versions could be affected as well.
43. Sun Solaris Text Editor ed Temporary File Creation Vulnerabi...
BugTraq ID: 9199
Remote: No
Date Published: Dec 11 2003
Relevant URL: http://www.securityfocus.com/bid/9199
Summary:
ed is a is a line-oriented text editor.
A vulnerability has been reported to be present in Sun Solaris that may
allow an attacker to overwrite or create any file on the system. It has
been reported that if root uses the text editor ed(1), the attacker may
access the file therefore symbolic link attacks are possible. A local
user may be able to exploit this issue by creating malicious symbolic
links.
It is possible that this issue results from inadequate checks on the
existence of a predictable temporary file prior to an attempt to create
the file during program execution. By creating a symbolic link, an
attacker could potentially destroy data at the location of which the
symbolic link references, or perform other attacks such as gaining
elevated privileges. If the file pointed to by the symbolic link is
writeable by the user running ed, the file will be overwritten or deleted
if the attacker chooses the correct filenames.
44. Cyclonic Webmail Information Disclosure Vulnerability
BugTraq ID: 9200
Remote: Yes
Date Published: Dec 11 2003
Relevant URL: http://www.securityfocus.com/bid/9200
Summary:
Cyclonic webmail is web-based software that provides an interface to allow
remote users to read and send emails via a third party POP3 and SMTP
server.
Cyclonic webmail has been reported prone to an information disclosure
vulnerability. It has been reported that user data is stored in the
/users/ folder. When a user views an email with the Cyclonic webmail
interface, the content of the email and any attachments of the email is
stored in an insecure location. Specifically, /users/%username%/decode/,
where %username% is the name of the user accessing Cyclonic webmail. This
procedure may result in the contents of the insecure directory being
exposed to the public, via web requests, allowing a malicious attacker to
potentially request and view sensitive email content.
Additionally it has been reported that the users address book is also
stored in the /users/%username%/ directory.
Although this vulnerability has been reported to affect Cyclonic webmail
version 4, previous version might also be affected.
45. IRSSI Remote Denial of Service Vulnerability
BugTraq ID: 9201
Remote: Yes
Date Published: Dec 11 2003
Relevant URL: http://www.securityfocus.com/bid/9201
Summary:
irssi is a freely available, open source irc client. irssi is available
for the Linux and Unix operating systems.
A remote denial of service vulnerability has been discovered in IRSSI that
could allow a person to crash an IRSSI client process. The problem occurs
due to an erroneously formatted call to an internal function that could
allow a malicious user to trigger an unexpected condition.
Specifically, the problematic code occurs within the format_send_to_gui()
function in the src/fe-common/core/formats.c source file. The
aforementioned function calls signal_emit_id() erroneously, supplying it
an unintended string, causing the following argument to be interpreted in
an unexpected context.
A user who is running an IRSSI client which is either running on a system
architecture that enforces word alignment or that is implementing a script
which makes use of the "print gui text" signal, may be prone to denial of
service attacks.
The issue can likely be triggered by a malicious user printing some form
of content which will trigger a specific signal handler or that will cause
memory to be misaligned.
46. RemotelyAnywhere Default.HTML Logout Message Injection Weakn...
BugTraq ID: 9202
Remote: Yes
Date Published: Dec 11 2003
Relevant URL: http://www.securityfocus.com/bid/9202
Summary:
RemotelyAnywhere is a remote host administration solution that allows a
system to be accessed via a web interface from a remote location.
RemotelyAnywhere has been reported prone to a logout message injection
weakness. It has been reported that this issue presents itself due to a
lack of sufficient restrictions performed by RemotelyAnywhere on user
supplied 'reason' URI parameters.
An attacker may exploit this condition, by crafting a malicious link to
the RemotelyAnywhere service; the URL will be manufactured in a manner
that is sufficient to 'log out' the user who is targeted, if they follow
the link. The attacker may specify a message in the 'reason' URI parameter
passed to 'default.html' that will be displayed prior to the user logging
out, this message will be incorporated into dynamic content as well as
being contained in a pop up dialog. An attacker could potentially abuse
this weakness, to aid in social engineering type attacks against the
target user.
It should be noted that this issue has been reported to affect
RemotelyAnywhere Enterprise Edition; other versions might also be
affected.
47. Mozilla Browser URI MouseOver Obfuscation Weakness
BugTraq ID: 9203
Remote: Yes
Date Published: Dec 11 2003
Relevant URL: http://www.securityfocus.com/bid/9203
Summary:
It has been discovered that the Mozilla browser is prone to a URI
obfuscation weakness that may hide the true contents of a link. The
problem occurs when a user@location URI is formatted in such a way that a
NULL byte is located after the user value. It is said that, when doing a
mouseover of such a URI, it will cause it to only display the contents of
the user value, not the entire link.
This could be used in conjunction with other URI obfuscation attacks and
browser vulnerabilities to trick a user into following a malicious link.
An attacker could exploit this issue by supplying a malicious URI pointing
to a page designed to mimic that of a trusted site. If an unsuspecting
victim were to mouseover the link in an attempt to verify the authenticity
of where it references, they may be deceived into believing they are at
the actual trusted site will be accessed. This could potentially cause a
false sense of security for the victim.
This weakness allegedly affects Mozilla 1.5 for Linux, however due to the
nature of the bug it is likely that other versions, and possibly other
browsers, are also affected.
It should be noted that this method of attack is identical to that
described in 9182, however it appears that various browsers may exhibit
differing behavior depending on the supplied URI.
48. Multiple Vendor XML DTD Parameter Entity SOAP Server Denial ...
BugTraq ID: 9204
Remote: Yes
Date Published: Dec 11 2003
Relevant URL: http://www.securityfocus.com/bid/9204
Summary:
SOAP is the Simple Object Access Protocol, which is implemented in
numerous web service software packages by various vendors. SOAP servers
are available for the Unix, Linux, and Microsoft Windows platforms.
XML DTD (Document Type Definition) defines how XML markup tags should be
interpreted by the application handling the XML document.
A problem has been identified in several different SOAP servers when
handling certain types of SOAP requests. Because of this, it is possible
for an attacker to force a denial of service on systems using a vulnerable
implementation.
The problem is in the handling of SOAP requests that contain references to
DTD parameter entities. By making a SOAP request with maliciously crafted
DTD data, it is possible to cause the SOAP server to consume excessive
amounts of system resources. This issue can be used to make the server
unavailable while it handles the requests, and could be continuously used
to create a prolonged denial of web services.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Will VoIP be wiretap-ready?
By: Kevin Poulsen
Widespread consumer Internet telephony could come with an easy-to-use
government surveillance capability.
http://www.securityfocus.com/news/7650
2. FTC investigates PetCo.com security hole
By: Kevin Poulsen
A young programmer's discovery of a massive vulnerability at an e-commerce
site leads to a federal consumer privacy probe... again.
http://www.securityfocus.com/news/7581
3. Heckenkamp Challenges Computer Ban
By: Kevin Poulsen
Accused eBay hacker has been banned from the Internet for years without
being convicted of a crime.
http://www.securityfocus.com/news/7576
4. Secure Online Transmissions Can Help Firms Maintain an Edge
By: Ellen McCarthy, Washington Post
http://www.securityfocus.com/news/7652
5. DVD Jon appeal ends: verdict before Xmas
By: Andrew Orlowski, The Register
http://www.securityfocus.com/news/7640
6. Appeal of DVD hacker's acquittal concludes in Norway
By: , The Associated Press
http://www.securityfocus.com/news/7639
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Cryptonit v0.9.1
By: IDEALX <[email protected]>
Relevant URL: http://cryptonit.org/
Platforms: Linux, MacOS, Windows 2000, Windows NT, Windows XP
Summary:
Cryptonit is a client side cryptographic tool which allows you to
encrypt/decrypt and sign/verify files with PKI (Public Key Infrastructure)
certificates.
2. JSch v0.1.12
By: ymnk <[email protected]>
Relevant URL: http://www.jcraft.com/jsch/
Platforms: Os Independent
Summary:
JSch is a pure Java implementation of SSH2. It allows you to connect to an
sshd server and use port forwarding, X11 forwarding, file transfer, etc.
You can integrate its functionality into your own Java programs.
3. floppyfw v2.9.5
By: Thomas Lundquist, [email protected]
Relevant URL: http://www.zelow.no/floppyfw/
Platforms: Linux
Summary:
floppyfw is a router and simple firewall on one single floppy. It uses
Linux basic firewall capabilities and have a very simple packaging system.
It is perfect for masquerading and securing networks on ADSL and cable
lines using both static IP and DHCP. It has a simple installation, mostly
only needed to edit one file on the floppy.
4. slst v0.2
By: Folkert van Heusden
Relevant URL: http://www.vanheusden.com/slst/
Platforms: MacOS, POSIX
Summary:
slst generates statistics from the output of syslog. One can find
tendencies and unexpected changes in the behaviour of the running
processes.
5. Jailkit v0.3
By: Olivier
Relevant URL: http://olivier.sessink.nl/jailkit/
Platforms: POSIX
Summary:
Jailkit is a set of utilities to allow quick creation of limited user
accounts. It contains a safe logging daemon, shells that can restrict
users and utilities for easy setup.
6. Metacortex OpenBSD PF Toolbox v1.0
By: SecurityOffice
Relevant URL: http://www.securityoffice.net/products/metacortex/
Platforms: OpenBSD
Summary:
Metacortex consists of a PF graphical user interface. Built on the
proactively secure OpenBSD operating system, and featuring an HTML based
graphic interface for easy monitoring.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. How to unsub from this list or others (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347397
2. Electrical Design Engineering Position in Tampa (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347215
3. Systems Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347214
4. Senior Product Manager/Director (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347212
5. Software Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347211
6. security job project (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347210
7. Software Engineer - CE Platform Builder (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347209
8. Electrical Design Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347206
9. Business Development Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347204
10. Secuirty Lead with EAI experience (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347126
11. Kansas City, St. Louis, and Omaha (Audit/Security) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347125
12. Training Manager - Massachusetts (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347124
13. List Cleaning - DO NOT REPLY (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347088
14. Seeking Electrical Engineer with INFOSEC Background ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347087
15. Senior Pre Sales Security Consultant in Reading , U... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347062
16. XML Security / Customer Support - Bay Area, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347060
17. Vice President of Sales California (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347025
18. PreSales Engineers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347019
19. Unique opportunity for cleared IT / network security... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347014
20. Inside Account Executives Boston (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347010
21. Vice President Business Development (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347007
22. Director of Technical Evangelist Opportunity in Sant... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347005
23. Vice President Marketing New York/New Jersey (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346991
24. QA Engineer - Anti-spam/email infrastructure company (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346968
25. Fw: need a Systems Analyst in N. VA: RE FM 121 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346967
26. Seeking security interim management work, UK, AU, NZ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346962
27. Security Opportunities in New Jersey (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346960
28. IT Security Consultant - Applications, London, UK (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346958
29. Inside Sales Rep - Anti-spam company (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346957
30. IT Security Consultant - Infrastructure, London, UK (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346956
31. need a Systems Analyst in N VA: RE FM 121 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346892
32. Regional Pre Sales Engineer Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346891
33. Security Channel Sales Representative (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346890
34. Windows Vulnerability Engineer Silicon Valley CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346863
35. Seeking Jr. Level Application Security Analyst posit... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346846
36. Senior Security Enginner/Audit Specialist - HCA - Na... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346845
37. GINA Developer for UK IT Security Company (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346844
38. Seeking full-time permanent infocsec position in Atl... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346843
39. Security Engineer with ACTIVE US SECRET CLEARANCE se... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346840
40. Symantec - Distinguished Engineer - Santa Monica Cal... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346838
41. Seeking Security or Admin Position in the Washingto... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346837
42. ***Looking for a Secuity Vulenrabilities Expert for ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/346835
VI. INCIDENTS LIST SUMMARY
--------------------------
1. WINS CLient Service (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347412
2. Fw: services.exe file (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347411
3. DS trojan opens ports fport does not detect? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347410
4. services.exe file (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347408
5. Another New Worm or Worm Variant? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347279
6. Strange services.exe file (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347277
7. Strange SNMP probes suddenly appearing (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347275
8. FW: New Worm or Worm Variant? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347263
9. New Worm or Worm Variant? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347262
10. yahoo instant messenger profile (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347147
11. [mailinglists] Strange services.exe file (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347146
12. forcdos.exe = serv-u.... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347016
13. Spoof source query (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/346907
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. mac duplication (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/347523
2. iis 5 %00 null weirdness (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/347379
3. locating default signal handler for SIGSEGV (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/347122
4. Internet Explorer JavaScript insecure function (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/347028
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Blessed Windows Security Templates (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/347385
2. How to disable all floppy drives on the network (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/347265
3. Article Announcement: Worm Propagation In Protected ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/347120
4. SecurityFocus Microsoft Newsletter #166 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/346925
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Exploit or trojan (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/347476
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Static ARP table in Linux (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/347479
2. Firewall Inquiry (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/346855
3. Re[2]: Firewall Inquiry (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/346854
4. Password Questions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/346853
5. Firewall continued (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/346851
6. tripwire (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/346771
XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
[email protected] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer.
Alternatively you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.
If your email address has changed email [email protected] and
ask to be manually removed.
XII. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: SPIDynamics
FREE White Paper: ?How Web Application Hackers Break In!?
Learn why 70% of today's successful hacks involve Web Application attacks
such as: SQL Injection, XSS, Cookie Manipulation, and Parameter
Manipulation. All undetectable by Firewalls and IDS!
Download *FREE* white paper from SPI Dynamics for a complete guide to
protection!
http://www.securityfocus.com/sponsor/SPIDynamics_sf-news_031215
------------------------------------------------------------------------