----------------------------------------
This Issue is Sponsored by: Watchfire
Privilege Escalation vulnerabilities in web applications have existed since the earliest days of web applications, yet since testing for them is such a complicated and tedious manual task, they are often overlooked in web application assessments. This paper will examine Privilege Escalation issues in web applications, including highlighting horizontal and vertical examples, and how to automate the challenging process of testing for them. Download it today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008fGg
------------------------------------------------------------------
I. FRONT AND CENTER
1. Wireless Forensics: Part One - Tapping the Air
II. MICROSOFT VULNERABILITY SUMMARY
1. MoviePlay LST File Handling Buffer Overflow Vulnerability
2. Kerio Personal Firewall IPHLPAPI.DLL Local Privilege Escalation Vulnerability
3. Total Commands ISO_WinCmd Plugin Multiple Remote Buffer Overflow Vulnerabilities
4. AIDeX Mini-Webserver HTTP Request Remote Denial of Service Vulnerability
5. ACFTP Server Multiple Remote Denial of Service Vulnerabilities
III. MICROSOFT FOCUS LIST SUMMARY
1. Secure Remote access - windows 2003
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. Wireless Forensics: Part One - Tapping the Air
By Raul Siles, GSE
This two-part series looks at the issues associated with collecting and analyzing network traffic from wireless networks in an accurate and comprehensive way; a discipline known as wireless forensics. Part one of this article focuses on the technical details and challenges for traffic acquisition, and provides design requirements and best practices for wireless forensics tools.
http://www.securityfocus.com/infocus/1884
II. MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. MoviePlay LST File Handling Buffer Overflow Vulnerability
BugTraq ID: 21840
Remote: Yes
Date Published: 2007-01-02
Relevant URL: http://www.securityfocus.com/bid/21840
Summary:
MoviePlay is susceptible to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
This vulnerability allows attackers to execute arbitrary machine code in the context of the affected application.
MoviePlay 4.76 is reported to be vulnerable. Other versions may be affected to this issue as well.
2. Kerio Personal Firewall IPHLPAPI.DLL Local Privilege Escalation Vulnerability
BugTraq ID: 21828
Remote: No
Date Published: 2007-01-01
Relevant URL: http://www.securityfocus.com/bid/21828
Summary:
Kerio Personal Firewall is prone to a local privilege-escalation vulnerability.
A local attacker could exploit this issue to execute arbitrary machine code with SYSTEM-level privileges. A successful exploit could result in the complete compromise of the affected computer.
Versions 4.3.246 and 4.3.268 are vulnerable to this issue; other versions may also be affected.
3. Total Commands ISO_WinCmd Plugin Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 21820
Remote: Yes
Date Published: 2006-12-30
Relevant URL: http://www.securityfocus.com/bid/21820
Summary:
The iso_wincmd plugin for Total Commander is prone to multiple remote buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied data prior to using it in a finite sized buffer.
An attacker can exploit this issue to execute arbitrary code within the context of the application utilizing the affected plugin.
These issues affect version 1.7.3 beta 3 of the plugin; other versions may also be vulnerable. These issues are reported to affect Total Commander when using the plugin module; other applications utilizing the module may also be affected.
4. AIDeX Mini-Webserver HTTP Request Remote Denial of Service Vulnerability
BugTraq ID: 21816
Remote: Yes
Date Published: 2006-12-29
Relevant URL: http://www.securityfocus.com/bid/21816
Summary:
AIDeX Mini-Webserver is prone to a remote denial-of-service vulnerability.
Exploiting this issue allows remote attackers to crash the server application, denying further service to legitimate users.
This issue affects version 1.1; other versions may also be vulnerable.
5. ACFTP Server Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 21767
Remote: Yes
Date Published: 2006-12-26
Relevant URL: http://www.securityfocus.com/bid/21767
Summary:
acFTP is prone to multiple remote denial-of-service vulnerabilities because the application fails to properly handle user-supplied input.
Exploiting these issues allows remote attackers to crash the application, denying further service to legitimate users.
These issues affect version 1.5; other versions may also be vulnerable.
III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Secure Remote access - windows 2003
http://www.securityfocus.com/archive/88/455670
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.
V. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: Watchfire
Privilege Escalation vulnerabilities in web applications have existed since the earliest days of web applications, yet since testing for them is such a complicated and tedious manual task, they are often overlooked in web application assessments. This paper will examine Privilege Escalation issues in web applications, including highlighting horizontal and vertical examples, and how to automate the challenging process of testing for them. Download it today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008fGg
No comments:
Post a Comment