WINDOWS CENTER: SecurityFocus Newsletter #403

SecurityFocus Newsletter #403
----------------------------------------

This Issue is Sponsored by: ByteCrusher

def: "Crunch!"
1. noun - "The pleasing sound of malicious new security threats to your computer splattering against WindowZones protection"
The sad truth is that it takes up to 8 hours for anti-virus companies to get off their laurels and fix a new security vulnerability. WindowZones, by ByteCrusher Labs, gets there first - preventing infectious bugs from getting in the door to begin with.

http://landing.bytecrusher.com/windowzones/sflanding1.aspx?Referrer=sf-A21sfWZ-wz1&cm_mmc=Security%20Focus-_-USA-_-Newsletter-_-Newsletter%3A%20Other%3A%20A21%3A%20sfWZ%3A%20wz1

SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as conveying topics of interest for our community. We are proud to offer content from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I. FRONT AND CENTER
1. Security Analogies
2. Your Space, My Space, Everybody's Space
II. BUGTRAQ SUMMARY
1. Microsoft Internet Information Server Hit Highlighting Authentication Bypass Vulnerability
2. WrenSoft Zoom Search Engine Cross-Site Scripting Vulnerability
3. XFree86 Multiple Unspecified Integer Overflow Vulnerabilities
4. Website Generator Multiple Remote Cross Site Scripting Vulnerabilities
5. CPCommerce Manufacturer.PHP SQL Injection Vulnerability
6. Apple QuickTime for Java Unspecified Remote Heap Buffer Overflow Vulnerability
7. PHP Str_Replace() Integer Overflow Vulnerability
8. PHP Printf() Function 64bit Casting Multiple Format String Vulnerabilities.
9. Media Technology Group CDPass ActiveX Control Multiple Buffer Overflow Vulnerabilities
10. DOMJudge Receive Function Remote Buffer Overflow Vulnerability
11. British Telecommunications Consumer Webhelper Multiple Buffer Overflow Vulnerabilities
12. Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
13. Geeklog CAPTCHA Plugin _CONF[path] Remote File Include Vulnerability
14. Uebimiau Error.PHP Multiple Input Validation Vulnerabilities
15. DGNews NewsID Parameter SQL Injection Vulnerability
16. LeadTools Raster Dialog File_D Object LTRDF14E.DLL ActiveX Control Buffer Overflow Vulnerability
17. Avira Antivir Antivirus Multiple Remote Vulnerabilities
18. Fundanemt SpellCheck.PHP Remote Command Execution Vulnerability
19. Apple Mac OS X VPND Local Format String Vulnerability
20. Apple Mac OS X 2007-005 Multiple Security Vulnerabilities
21. Sun Solaris INETD(1M) Local Denial of Service Vulnerability
22. Sun Solaris IKED(1M) Denial of Service Vulnerability
23. MIT Kerberos 5 KAdminD Server Stack Buffer Overflow Vulnerability
24. XOOPS ResManager Module Edit_day.PHP SQL Injection Vulnerability
25. UltraISO Cue File Stack Buffer Overflow Vulnerability
26. InGate Firewall And SIParator Multiple Unspecified Vulnerabilities
27. Apache HTTP Server Multiple Vulnerabilities
28. Mozilla Firefox Resource Directory Traversal Vulnerability
29. Mozilla Products Multiple Remote Vulnerabilities
30. Mozilla FireFox FTP PASV Port-Scanning Vulnerability
31. APOP Protocol Insecure MD5 Hash Weakness
32. Mozilla Firefox Document.Cookie Path Argument Denial of Service Vulnerability
33. Mozilla Firefox Popup Blocker Cross Zone Security Bypass Weakness
34. Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability
35. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerability
36. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerability
37. Adobe Flash Player Plugin HTTP Header Injection Weakness
38. Net-SNMP Unspecified Remote Stream-Based Protocol Denial Of Service Vulnerability
39. HP-UX IPCS Core File Buffer Overflow Vulnerability
40. SunOS /usr/lib/lpd Arbitrary File Deletion Vulnerability
41. Vizayn Urun Tanitim Sistemi Default.ASP SQL Injection Vulnerability
42. RPC Portmapper Denial of Sevice Vulnerability
43. Sun Java System Messenger Express Cross-Site Scripting Vulnerability
44. Xine DirectShow Loader Remote Buffer Overflow Vulnerability
45. MPlayer DMO File Parsing Buffer Overflow Vulnerability
46. F-Secure Multiple Products Real-time Scanning Component Local Privilege Escalation Vulnerability
47. Particle Gallery Search.PHP Cross-Site Scripting Vulnerability
48. Multiple Vendor e-commerce Shopping Cart Information Disclosure Vulnerability
49. Netopia R9100 Router Denial of Service Vulnerability
50. F-Secure Anti-Virus LHA Processing Buffer Overflow Vulnerability
51. Multiple F-Secure Products Packed Executables and Archives Denial of Service Vulnerability
52. F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vulnerability
53. Sun Java Web Proxy Server Multiple Buffer Overflow Vulnerabilities
54. Particle Blogger Archives.PHP SQL Injection Vulnerability
55. British Telecommunications Webhelper Multiple Buffer Overflow Vulnerabilities
56. LeadTools Raster ISIS Object LTRIS14e.DLL ActiveX Control Buffer Overflow Vulnerability
57. LeadTools Raster Document Object Library LTRDC14E.DLL ActiveX Control Buffer Overflow Vulnerability
58. SCO OpenServer Auditsh HOME Environment Variable Buffer Overflow Vulnerability
59. Ademco ATNBaseLoader100 ActiveX Control Buffer Overflow Vulnerability
60. Dart Zip Compression DartZip.DLL ActiveX Control Buffer Overflow Vulnerability
61. 3com Switches Backdoor Vulnerability
62. Dart Communications PowerTCP Service DartService.DLL ActiveX Control Buffer Overflow Vulnerabilities
63. LeadTools Raster Dialog File Object LTRDF14E.DLL ActiveX Control Buffer Overflow Vulnerability
64. Microsoft Office 2000 UA OUACTRL.OCX ActiveX Control Buffer Overflow Vulnerability
65. AdminBot-MX Live_Status.Lib.PHP Remote File Include Vulnerability
66. Sky Software Shell MegaPack ActiveX ShComboBox ActiveX Control Buffer Overflow Vulnerability
67. Dart ZipLite Compression DartZipLite.DLL ActiveX Control Buffer Overflow Vulnerability
68. LeadTools ISIS Control Ltisi14E.OCX ActiveX Control Buffer Overflow Vulnerability
69. EDraw Office Viewer Component ActiveX Control Arbitrary File Delete Vulnerability
70. CesarFTP Remote CWD Denial of Service Vulnerability
71. KSign KSignSWAT ActiveX Control Multiple Buffer Overflow Vulnerabilities
72. Pegasus ImagN ActiveX Control IMW32O40.OCX Buffer Overflow Vulnerability
73. Alt-N MDaemon Mail Relaying Vulnerability
74. LeadTools Raster Object Library LTRTM14e.DLL ActiveX WriteDataToFile File Overwrite Vulnerability
75. LeadTools Raster Object Library LTRTM14e.DLL ActiveX Control Buffer Overflow Vulnerability
76. DotClear Unspecified Trackback Vulnerability
77. LeadTools Thumbnail Browser ActiveX Control LTTMB14E.OCX Buffer Overflow Vulnerability
78. LeadTools JPEG2000 ActiveX Control Buffer Overflow Vulnerability
79. PHPWCMS Multiple Remote File Include Vulnerabilities
80. PrecisionID Barcode PrecisionID_Barcode.DLL ActiveX Control Buffer Overflow Vulnerability
81. Windy Road Vistered Little Theme Skin Parameter Directory Traversal Vulnerability
82. EDraw Office Viewer Component EDrawOfficeViewer.OCX ActiveX Control Buffer Overflow Vulnerability
83. Zenturi ProgramChecker SASATL.DLL ActiveX Control Multiple Buffer Overflow Vulnerabilities
84. Apple Quicktime For Java Variant Information Disclosure Vulnerability
85. File Multiple Denial of Service Vulnerabilities
86. Trolltech QT UTF-8 Sequences Input Validation Vulnerability
87. FileCloset Unspecified Arbitrary File Upload Vulnerability
88. XFSDump XFS_FSR Insecure Temporary File Creation Vulnerability
89. Quagga BGPD UPDATE Message Remote Denial Of Service Vulnerability
90. PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
91. PHP PHP_Binary Heap Information Leak Vulnerability
92. PHP Hash Table Overwrite Arbitrary Code Execution Vulnerability
93. PHP Session Data Deserialization Arbitrary Code Execution Vulnerability
94. PHP ZVAL Reference Counter Integer Overflow Vulnerability
95. Pheap Config.PHP Pheap_Login Authentication Bypass Vulnerability
96. PHP Ini_Restore() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
97. Algorithmic Research PrivateWire Online Registration Remote Buffer Overflow Vulnerability
98. Multiple Vendor TCP Packet Fragmentation Handling Denial Of Service Vulnerability
99. SalesCart Shopping Cart Reorder2.ASP Multiple SQL Injection Vulnerabilities
100. Apple Mac OS X 10.3.5 Released - Multiple Vulnerabilities Fixed
III. SECURITYFOCUS NEWS
1. Insecure plug-ins pose danger to Firefox users
2. Peer-to-peer networks co-opted for DOS attacks
3. "Data storm" blamed for nuclear-plant shutdown
4. Experts scramble to quash IPv6 flaw
IV. SECURITY JOBS LIST SUMMARY
V. INCIDENTS LIST SUMMARY
1. Survey on Supercomputer Cluster Security
VI. VULN-DEV RESEARCH LIST SUMMARY
1. Help developing exploit
VII. MICROSOFT FOCUS LIST SUMMARY
1. Reconstruction of MS terminal services sessions
2. SecurityFocus Microsoft Newsletter #343
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
1. Survey on Supercomputer Cluster Security
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Security Analogies
By Scott Granneman
Scott Granneman discusses security analogies and their function in educating the masses on security concepts.
http://www.securityfocus.com/columnists/445

2. Your Space, My Space, Everybody's Space
By Mark Rasch
Privacy is about protecting data when somebody wants it for some purpose. It is easy to protect data that nobody wants.
http://www.securityfocus.com/columnists/444

II. BUGTRAQ SUMMARY
--------------------
1. Microsoft Internet Information Server Hit Highlighting Authentication Bypass Vulnerability
BugTraq ID: 24105
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24105
Summary:
Microsoft IIS is prone to an authentication-bypass vulnerability due to its implementation of 'Hit-highlighting' functionality.

Attackers can exploit this issue to access private files hosted on an IIS website. Successful exploits may allow attackers to gain access to potentially sensitive information. Other attacks are possible.

NOTE: Presumably, accessing a Trusted Zone may allow attackers to execute commands; this has not been confirmed.

2. WrenSoft Zoom Search Engine Cross-Site Scripting Vulnerability
BugTraq ID: 8823
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/8823
Summary:
WrenSoft Zoom Search Engine is prone to a cross-site scripting issue in the software's search module. A remote attacker may be able to execute HTML or script code in a user's browser.

The problem occurs because the software fails to properly sanitize user-supplied input. An attacker may be able to a construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the vulnerable site.

3. XFree86 Multiple Unspecified Integer Overflow Vulnerabilities
BugTraq ID: 8514
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/8514
Summary:
Multiple integer-overflow vulnerabilities have been discovered in the XFree86 font libraries. The problem occurs because of insufficient sanity checks on integers passed to clients from an X font server. As a result, an unexpected buffer overrun may occur within the stack or heap space of process memory. An attacker could potentially exploit this to execute arbitrary code within a target X client.

Precise technical details regarding these vulnerabilities are currently unavailable; as further information is released, this BID will be updated accordingly.

4. Website Generator Multiple Remote Cross Site Scripting Vulnerabilities
BugTraq ID: 14338
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/14338
Summary:
Website Generator is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage any of these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

5. CPCommerce Manufacturer.PHP SQL Injection Vulnerability
BugTraq ID: 24223
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24223
Summary:
cpCommerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

cpCommerce 1.1.0 is reported vulnerable; other versions may also be affected.

6. Apple QuickTime for Java Unspecified Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 24221
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24221
Summary:
Apple QuickTime for Java is prone to a remote heap-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input prior to copying it to an insufficiently sized buffer.

Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the affected application, facilitating the remote compromise of affected computers. Failed exploit attempts will result in a denial of service.

7. PHP Str_Replace() Integer Overflow Vulnerability
BugTraq ID: 23233
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23233
Summary:
PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. Attackers may exploit this issue to cause a buffer-overflow and corrupt process memory.

Exploiting this issue may allow attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in a denial-of-service condition.

This issue affects PHP versions prior to 4.4.5 and 5.2.1.

8. PHP Printf() Function 64bit Casting Multiple Format String Vulnerabilities.
BugTraq ID: 23219
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23219
Summary:
PHP is prone to multiple format-string vulnerabilities due to a design error when casting 64-bit variables to 32 bits.

Attackers may be able to exploit these issues to execute arbitrary code in the context of the webserver process or to cause denial-of-service conditions.

These issues affect PHP versions prior to 4.4.5 and 5.2.1 running on 64-bit computers.

9. Media Technology Group CDPass ActiveX Control Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 24220
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24220
Summary:
CDPass ActiveX control is prone to multiple stack-based buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

10. DOMJudge Receive Function Remote Buffer Overflow Vulnerability
BugTraq ID: 24218
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24218
Summary:
DOMjudge is prone to a buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker may exploit this issue by enticing victims into opening a malicious email link.

Successful exploits may allow attackers to execute arbitrary code in the context of the application. Failed attempts may cause denial-of-service conditions.

This issue affects versions of DOMjudge prior to 2.0.0 RC1.

11. British Telecommunications Consumer Webhelper Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 24219
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24219
Summary:
The British Telecommunications Consumer Webhelper ActiveX control is prone to multiple buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Versions of British Telecommunications Consumer Webhelper ActiveX Control prior to 2.0.0.8 are vulnerable to these issues.

12. Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
BugTraq ID: 24215
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24215
Summary:
Apache is prone to multiple denial-of-service vulnerabilities.

An attacker with the ability to execute arbitrary server-side script-code can exploit these issues to stop arbitrary services on the affected computer in the context of the master webserver process; other attacks may also be possible.

13. Geeklog CAPTCHA Plugin _CONF[path] Remote File Include Vulnerability
BugTraq ID: 24214
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24214
Summary:
The Geeklog CAPTCHA plugin is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Geeklog CAPTCHA 2.1.1; prior versions may also be affected.

14. Uebimiau Error.PHP Multiple Input Validation Vulnerabilities
BugTraq ID: 24210
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24210
Summary:
Uebimiau is prone to multiple input-validation vulnerabilities, including cross-site scripting issues and an information-disclosure issue, because the application fails to properly sanitize user-supplied input.

Attackers can exploit these issues to steal cookie-based authentication credentials, to control how the site is rendered to the user, or to gain access to information that could aid in further attacks.

Uebimiau 2.7.2 and 2.7.10 are vulnerable; other versions may also be affected.

15. DGNews NewsID Parameter SQL Injection Vulnerability
BugTraq ID: 24212
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24212
Summary:
DGNews is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

Successful exploits could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

DGNews 2.1 is reported vulnerable; other versions may also be affected.

16. LeadTools Raster Dialog File_D Object LTRDF14E.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24153
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24153
Summary:
LEADTOOLS Raster Dialog File_D Object Library ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Raster Dialog File_D Object 14.5.0.44 is vulnerable to this issue; other versions may also be affected.

17. Avira Antivir Antivirus Multiple Remote Vulnerabilities
BugTraq ID: 24187
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24187
Summary:
Avira Antivir Antivirus is prone to multiple remote vulnerabilities.

Successfully exploiting these issues allows remote attackers to execute arbitrary machine code with elevated privileges, facilitating the complete compromise of affected computers. Attackers may also trigger denial-of-service conditions by crashing the application or causing infinite loops.

These issues affect:

Avira Antivir AVPack versions prior to 7.03.00.09
Engine versions prior to 7.04.00.24

18. Fundanemt SpellCheck.PHP Remote Command Execution Vulnerability
BugTraq ID: 24185
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24185
Summary:
Fundanemt is prone to a remote command-execution vulnerability because it fails to sufficiently sanitize user-supplied input.

An Attacker can exploit this issue to execute arbitrary system commands with the privileges of the webserver process.

This issue affects Fundanemt 2.2.0 and prior versions.

19. Apple Mac OS X VPND Local Format String Vulnerability
BugTraq ID: 24208
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24208
Summary:
Apple Mac OS X's VPN service daemon is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Attackers may exploit this issue to crash the application or execute arbitrary code with superuser privileges. Successful exploits can result in a complete compromise of vulnerable computers.

Apple Mac OS X Server 10.4.9 and prior versions are vulnerable to this issue.

This issue was originally included in BID 24144 (Apple Mac OS X 2007-005 Multiple Security Vulnerabilities), but has been given its own record.

20. Apple Mac OS X 2007-005 Multiple Security Vulnerabilities
BugTraq ID: 24144
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24144
Summary:
Apple Mac OS X is prone to multiple security vulnerabilities.

These issues affect Mac OS X and various applications, including Alias Manager, CoreGraphics, crontabs, iChat, and PPP.

Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. Both local and remote vulnerabilities are present.

Apple Mac OS X 10.4.9 and prior versions are vulnerable to these issues.

21. Sun Solaris INETD(1M) Local Denial of Service Vulnerability
BugTraq ID: 24213
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24213
Summary:
Sun Solaris inetd(1M) is prone to a local denial-of-service vulnerability.

An attacker can exploit this issue to disable the inetd daemon, resulting in denial-of-service conditions.

22. Sun Solaris IKED(1M) Denial of Service Vulnerability
BugTraq ID: 24209
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24209
Summary:
The 'in.iked' service for Sun Solaris is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected service, denying service to legitimate users.

23. MIT Kerberos 5 KAdminD Server Stack Buffer Overflow Vulnerability
BugTraq ID: 23285
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23285
Summary:
Kerberos 5 kadmind (Kerberos Administration Daemon) server is prone to a stack-based buffer-overflow vulnerability because the software fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code with administrative privileges. A successful attack can result in the complete compromise of the application. Failed attempts will likely result in denial-of-service conditions.

All kadmind servers run on the master Kerberos server. Since the master server holds the KDC principal and policy database, an attack may not only compromise the affected computer, but could also compromise multiple hosts that use the server for authentication.

Kerberos 5 kadmind 1.6 and prior versions are vulnerable.

24. XOOPS ResManager Module Edit_day.PHP SQL Injection Vulnerability
BugTraq ID: 23997
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23997
Summary:
XOOPS 'resmanager' module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects 'resmanager' 1.21; other versions may also be affected.

25. UltraISO Cue File Stack Buffer Overflow Vulnerability
BugTraq ID: 24140
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24140
Summary:
UltraISO is prone to a remote stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

UltraISO 8.6.2.2011 is vulnerable; other versions may also be affected.

26. InGate Firewall And SIParator Multiple Unspecified Vulnerabilities
BugTraq ID: 24207
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24207
Summary:
Ingate Firewall and SIParator are prone to multiple unspecified vulnerabilities.

An attacker may gain access to sensitive information and bypass SIP authentication requirements.

Very few details are available at this time. We will update this BID as more information emerges.

Versions prior to 4.5.2 are vulnerable.

27. Apache HTTP Server Multiple Vulnerabilities
BugTraq ID: 8226
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/8226
Summary:
Apache is vulnerable to multiple vulnerabilities, including denial-of-service issues, file-descriptor leakage, and logging failures.

Apache HTTP Server 1.3.28 has been released in response to these issues.

28. Mozilla Firefox Resource Directory Traversal Vulnerability
BugTraq ID: 24191
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24191
Summary:
Mozilla Firefox is prone to a directory-traversal vulnerability because it fails to adequately sanitize user-supplied data.

An attacker can exploit this issue to access arbitrary files on an unsuspecting user's computer. Successful exploits can expose potentially sensitive information that could aid in further attacks.

Firefox 2.0.0.3 and prior versions are vulnerable.

29. Mozilla Products Multiple Remote Vulnerabilities
BugTraq ID: 24242
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24242
Summary:
The Mozilla Foundation has released six security advisories specifying vulnerabilities in Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- Execute arbitrary code
- Cause denial-of-service conditions
- Perform cross-site scripting attacks
- Obtain potentially sensitive information
- Spoof legitimate content

Other attacks may also be possible.

30. Mozilla FireFox FTP PASV Port-Scanning Vulnerability
BugTraq ID: 23082
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/23082
Summary:
Mozilla Firefox is prone to vulnerability that may allow attackers to obtain potentially sensitive information.

A successful exploit of this issue would cause the affected application to connect to arbitrary TCP ports and potentially reveal sensitive information about services that are running on the affected computer. Information obtained may aid attackers in further attacks.

31. APOP Protocol Insecure MD5 Hash Weakness
BugTraq ID: 23257
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/23257
Summary:
Applications that implement the APOP protocol may be vulnerable to a password-hash weakness. This issue occurs because the MD5 hash algorithm fails to properly prevent collisions.

Attackers may exploit this issue in man-in-the-middle attacks to potentially gain access to the first three characters of passwords. This will increase the likelihood of successful brute-force attacks against APOP authentication.

To limit the possibility of successful exploits, applications that implement the APOP protocol should set up safeguards to ensure that message IDs are RFC-compliant.

Mozilla Thunderbird, Evolution, mutt, and fetchmail are reportedly affected by this issue.

32. Mozilla Firefox Document.Cookie Path Argument Denial of Service Vulnerability
BugTraq ID: 22879
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22879
Summary:
Mozilla Firefox is prone to a remote denial-of-service vulnerability.

An attacker may exploit this vulnerability to cause Mozilla Firefox to crash, resulting in denial-of-service conditions.

Little is known regarding this vulnerability; this BID will be updated when more information is disclosed.

Mozilla Firefox 2.0.0.2 is prone to this issue; other versions may also be affected.

Attackers may be able to bypass cookie domain and path restrictions, but this has not been confirmed.

33. Mozilla Firefox Popup Blocker Cross Zone Security Bypass Weakness
BugTraq ID: 22396
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22396
Summary:
Mozilla Firefox is prone to a cross-zone security-bypass weakness. This issue allows attackers to open 'file://' URIs from remote websites.

By exploiting this issue in conjunction with other weaknesses or vulnerabilities, attackers may be able to execute arbitrary script code with the elevated privileges that are granted to scripts when they are executed from local sources.

Mozilla Firefox 1.5.0.9 is affected by this issue; other versions may be affected as well.

34. Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability
BugTraq ID: 24147
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24147
Summary:
Apache HTTP server running with the Tomcat JK Web Server Connector is prone to a security-bypass vulnerability because it decodes request URLs multiple times.

Exploiting this issue allows attackers to access restricted files in the Tomcat web directory. This can expose sensitive information that could help attackers launch further attacks.

This issue is present in versions of Apache Tomcat JK Connector prior to 1.2.23.

35. Freetype TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerability
BugTraq ID: 24074
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24074
Summary:
FreeType is prone to an integer-overflow vulnerability because it fails to properly validate TTF files.

An attacker may exploit this issue by enticing victims into opening maliciously crafted TTF Files.

Successful exploits will allow attackers to execute arbitrary code in the context in the context of applications that use the affected library. Failed exploit attempts will likely result in denial-of-service conditions.

This issue affects FreeType 2.3.4 and prior versions.

36. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerability
BugTraq ID: 22231
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22231
Summary:
ISC BIND is prone to a remote denial-of-service vulnerability because the application fails to properly handle malformed DNSSEC validation requests.

Successfully exploiting this issue allows remote attackers to crash affected DNS servers, denying further service to legitimate users.

37. Adobe Flash Player Plugin HTTP Header Injection Weakness
BugTraq ID: 20592
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/20592
Summary:
Adobe Flash Player Plugin is prone to a weakness that permits the injection of arbitrary HTTP headers because it fails to sanitize user-supplied input.

A successful attack may allow attackers to perform arbitrary HTTP requests facilitating cross-site request forgery, cross-site scripting, HTTP request smuggling, and other attacks.

Since this weakness would typically be used as one component in a larger attack scenario, the consequences of an attack will depend on the vulnerabilities exploited along with this weakness.

Version 9.0.16 for Windows and 7.0.63 for Linux are affected by this issue.

38. Net-SNMP Unspecified Remote Stream-Based Protocol Denial Of Service Vulnerability
BugTraq ID: 14168
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/14168
Summary:
Net-SNMP is prone to a remote denial-of-service vulnerability. The issue is exposed when Net-SNMP is configured to have an open stream-based protocol port, such as TCP.

The exact details describing this issue are not available. This BID will be updated when more information emerges.

39. HP-UX IPCS Core File Buffer Overflow Vulnerability
BugTraq ID: 7216
Remote: No
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/7216
Summary:
The HP-UX 'ipcs' utility is prone to a locally exploitable buffer-overflow condition because the software fails to properly bounds-check core filenames. This utility may be installed setgid 'sys' on vulnerable systems; attackers may exploit this issue to gain these privileges.

This issue was reported with 'ipcs' on HP-UX 11.00; other versions are also likely affected.

40. SunOS /usr/lib/lpd Arbitrary File Deletion Vulnerability
BugTraq ID: 25
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/25
Summary:
SunOS LPD is prone to a vulnerability that can can allow attackers to delete arbitrary system files.

These issues are Sun Bug IDs 1040453 and 1057834.

41. Vizayn Urun Tanitim Sistemi Default.ASP SQL Injection Vulnerability
BugTraq ID: 24238
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24238
Summary:
Vizayn Urun Tanitim Sistemi is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

This issue affects Vizayn Urun Tanitim Sistemi 0.2; other versions may also be affected.

42. RPC Portmapper Denial of Sevice Vulnerability
BugTraq ID: 1892
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/1892
Summary:
A remote root vulnerability exists in certain versions of rpcbind portmapper.

RPC (Remote Procedure Call) allows a program to request a service from a program located in another computer in a network without requiring detailed information on the network configuration.

An attacker capable of forging a pmap_set/pmap_unset udp packet can cause the remote host to register or unregister arbitrary RPC programs.

This can permit an attacker to carry out a denial of services by disabling key services on the target host, including mountd, nfsd and ypserv.

Because it allows a malicious local user to register rpc programs on the server, depending on the program the attacker chooses to register, this vulnerability can allow a compromise of root privilege, potentially extending to other systems on the local network.

In addition to the affected platforms listed, other versions have yet to be tested, and may be vulnerable as well.

43. Sun Java System Messenger Express Cross-Site Scripting Vulnerability
BugTraq ID: 20832
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/20832
Summary:
Sun Java System Messenger Express is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Specific information regarding affected versions of Sun Java System Messenger Express is not currently available; this BID will be updated as more information is disclosed.

44. Xine DirectShow Loader Remote Buffer Overflow Vulnerability
BugTraq ID: 22933
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22933
Summary:
Xine is prone to a remote buffer-overflow vulnerability because the application fails to perform boundary checks before copying user-supplied input into finite-sized buffers.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application and to compromise affected computers.

45. MPlayer DMO File Parsing Buffer Overflow Vulnerability
BugTraq ID: 22771
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/22771
Summary:
MPlayer is prone to a buffer-overflow vulnerability when it attempts to process malformed video files. This issue occurs because the application fails to perform proper bounds-checking on user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

MPlayer 1.0rc1 is vulnerable to this issue; previous versions may also be affected.

46. F-Secure Multiple Products Real-time Scanning Component Local Privilege Escalation Vulnerability
BugTraq ID: 24237
Remote: No
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24237
Summary:
Multiple F-Secure workstation and file-server products are prone to a local privilege-escalation vulnerability.

Exploiting this vulnerability allows local attackers to gain superuser or SYSTEM-level privileges, leading to a complete compromise of the affected computer.

47. Particle Gallery Search.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 24236
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/24236
Summary:
Particle Gallery is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Particle Gallery 1.0.1 and prior versions.

48. Multiple Vendor e-commerce Shopping Cart Information Disclosure Vulnerability
BugTraq ID: 2299
Remote: Yes
Last Updated: 2007-05-31
Relevant URL: http://www.securityfocus.com/bid/2299
Summary:
The affected packages may not have been properly configured and maintained. As a result, an attacker exploiting this vulnerability will be able to obtain detailed private customer information, including credit card numbers, order details, addresses, telephone numbers, etc.

49. Netopia R9100 Router Denial of Service Vulnerability
BugTraq ID: 2287
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/2287
Summary:
The Netopia R9100 Router, running firmware version 4.6, is vulnerable to a denial of service attack. Subsequent (and current) versions of the product are not vulnerable.

Under very specific circumstances, it is possible to cause the affected router to halt. By attempting to make a looped connection from the router's IP address back to the same address, the unit will crash.

This prevents user disconnect logging and may assist the attacker in carrying out further attacks on the affected host or other systems on its network.

50. F-Secure Anti-Virus LHA Processing Buffer Overflow Vulnerability
BugTraq ID: 24235
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24235
Summary:
Multiple F-Secure Anti-Virus applications are prone to a buffer-overflow vulnerability when they process certain files. This issue occurs because the applications fail to properly check boundaries on user-supplied data before copying it to an insufficiently sized memory buffer.

Successful exploits can allow attackers to execute arbitrary code with the privileges of the vulnerable application. Failed exploit attempts will likely result in denial-of-service conditions.

51. Multiple F-Secure Products Packed Executables and Archives Denial of Service Vulnerability
BugTraq ID: 24234
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24234
Summary:
Multiple F-Secure products are prone to a denial-of-service vulnerability because the software fails to handle exceptional conditions.

An attacker can exploit this issue to cause a denial-of-service conditon.

52. F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vulnerability
BugTraq ID: 24233
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24233
Summary:
F-Secure Policy Manager is prone to a remote denial-of-service vulnerability because the application fails to propelry handle unexpected conditions.

Exploiting this issue allows remote attackers to crash affected applications, denying further service to legitimate users. The vendor states that this application is typically available only to internal networks, making remote exploits over the Internet less likely.

Versions of F-Secure Policy Manager prior to 7.01 are vulnerable.

53. Sun Java Web Proxy Server Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 24165
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24165
Summary:
Sun Java System Web Proxy Server is prone to multiple buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit these issues to execute arbitrary code with superuser privileges, leading to the complete compromise of affected computers. Failed exploit attempts will result in a denial of service.

These issues affect Web Proxy Server 4.0.3; prior versions may also be affected.

54. Particle Blogger Archives.PHP SQL Injection Vulnerability
BugTraq ID: 24232
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24232
Summary:
Particle Blogger is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

55. British Telecommunications Webhelper Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 24216
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24216
Summary:
The British Telecommunications Webhelper ActiveX control is prone to multiple buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Versions of British Telecommunications Webhelper ActiveX Control prior to 1.0.0.7 are vulnerable to these issues.

56. LeadTools Raster ISIS Object LTRIS14e.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24193
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24193
Summary:
LEADTOOLS Raster ISIS ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

LEADTOOLS ISIS ActiveX control 14.5.0.44 is vulnerable to this issue; other versions may also be affected.

57. LeadTools Raster Document Object Library LTRDC14E.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24179
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24179
Summary:
LEADTOOLS Raster OCR Document Object Library ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

LEADTOOLS Raster OCR Document Object Library ActiveX control 14.5.0.44 is vulnerable to this issue; other versions may also be affected.

58. SCO OpenServer Auditsh HOME Environment Variable Buffer Overflow Vulnerability
BugTraq ID: 13062
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/13062
Summary:
The SCO OpenServer auditsh application is affected by a local buffer overflow vulnerability.

This issue presents itself when the affected application handles the HOME environment variable.

59. Ademco ATNBaseLoader100 ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24172
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24172
Summary:
Ademco ATNBaseLoader100 ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Ademco ATNBaseLoader100 ActiveX control 5.4.0.6 is vulnerable to this issue; other versions may also be affected.

60. Dart Zip Compression DartZip.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24163
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24163
Summary:
Dart Zip Compression for ActiveX is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Dart Zip Compression for ActiveX 1.8.5.3 is vulnerable to this issue; other versions may also be affected.

NOTE: Due to code reuse, this issue is similar or possibly identical to the one described in BID 24099 (Dart ZipLite Compression DartZipLite.DLL ActiveX Control Buffer Overflow Vulnerability). This has not been confirmed.

61. 3com Switches Backdoor Vulnerability
BugTraq ID: 88
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/88
Summary:
There exists an undocumented access level in current (and possibly previous) versions of 3Com's "intelligent" and "extended" switching software for LanPlex/Corebuilder switches. In addition to the "admin", "read", and "write" accounts, there is a "debug" account with a password of "synnet" on shipped images (including those available for download from infodeli.3com.com). The versions of firmware this was tested under include 7.0.1 and 8.1.1.

The debug account has all the privileges of the admin account plus some debugging commands not available to any other ID. They can change all the other access password without knowing the old password. In addition, they can get to the "underlying OS shell".

If you allow "remote administration" (telnet access), an attacker can obtain full control of your switches.

Yes:
LanPlex/Corebuilder 2500s (SW 7.x and 8.x)
Corebuilder 3500 (ver 1.0.0)
3Com LANplex 2500 (rev 7.15) with Version 7.0.1-19 - Built 01/17/97 02:41:17 PM
LinkSwitch

No:
Superstack II
LinkSwitch
FMS-II Superstack Hub P/N 3c16630a

62. Dart Communications PowerTCP Service DartService.DLL ActiveX Control Buffer Overflow Vulnerabilities
BugTraq ID: 24142
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24142
Summary:
Dart Communications PowerTCP Service control is prone to multiple buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting these issues allow remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

These issues affect PowerTCP Service 3.1.3.3; other versions may also be affected.

63. LeadTools Raster Dialog File Object LTRDF14E.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24133
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24133
Summary:
LEADTOOLS Raster Thumbnail Object Library ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remBrowser ote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Thumbnail Object Library ActiveX control 14.5.0.44 is vulnerable to this issue; other versions may also be affected.

64. Microsoft Office 2000 UA OUACTRL.OCX ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24118
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24118
Summary:
Microsoft Office 2000 UA ActiveX Control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

65. AdminBot-MX Live_Status.Lib.PHP Remote File Include Vulnerability
BugTraq ID: 24231
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24231
Summary:
AdminBot-MX is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects AdminBot-MX 9.0.5; other versions may also be vulnerable.

66. Sky Software Shell MegaPack ActiveX ShComboBox ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24113
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24113
Summary:
Sky Software Shell MegaPack ActiveX ShComboBox ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Shell MegaPack ActiveX 8.0 is vulnerable to this issue; other versions may also be affected.

67. Dart ZipLite Compression DartZipLite.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24099
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24099
Summary:
The Dart ZipLite Compression ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Dart ZipLite Compression ActiveX control 1.8.5.3 is vulnerable to this issue; other versions may also be affected.

68. LeadTools ISIS Control Ltisi14E.OCX ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24093
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24093
Summary:
LEADTOOLS ISIS ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

LEADTOOLS ISIS ActiveX control 14.5.0.44 is vulnerable to this issue; other versions may also be affected.

69. EDraw Office Viewer Component ActiveX Control Arbitrary File Delete Vulnerability
BugTraq ID: 24230
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24230
Summary:
The EDraw Office Viewer Component ActiveX Control is prone to an arbitrary-file-delete vulnerability.

An attacker can exploit this issue to delete arbitrary files on the affected computer. Successful attacks can result in denial-of-service conditions.

70. CesarFTP Remote CWD Denial of Service Vulnerability
BugTraq ID: 7949
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/7949
Summary:
A vulnerability has been reported for CesarFTP. Reportedly, an attacker may crash a target server by supplying excessive data as the argument to the 'CWD' command. This may result in the server hanging, effectively denying service to other legitimate FTP users.

71. KSign KSignSWAT ActiveX Control Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 24088
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24088
Summary:
KSign KSignSWAT ActiveX control is prone to multiple buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

KSign KSignSWAT ActiveX control 2.0.3.3 is vulnerable; other versions may also be affected.

72. Pegasus ImagN ActiveX Control IMW32O40.OCX Buffer Overflow Vulnerability
BugTraq ID: 24086
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24086
Summary:
Pegasus ImagN ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Pegasus ImagN ActiveX control 4.0 is vulnerable; other versions may also be affected.

73. Alt-N MDaemon Mail Relaying Vulnerability
BugTraq ID: 3200
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/3200
Summary:
MDaemon is an email server which supports most common internet mail protocols offered by Alt-N Technologies.

A vulnerability has been discovered in MDaemon which could allow a user to specify the address in the 'From' field prior to sending an email message. Thus, upon the recipient receiving the mail message, the point of origination will be false. This issue could be manipulated to carry out unauthorized email relaying.

74. LeadTools Raster Object Library LTRTM14e.DLL ActiveX WriteDataToFile File Overwrite Vulnerability
BugTraq ID: 24075
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24075
Summary:
LEADTOOLS Raster Thumbnail Object Library ActiveX control is prone to a vulnerability that lets attackers overwrite arbitrary files on the victim computer in the context of the application using the ActiveX control (typically Internet Explorer). This issue occurs because the application fails to properly sanitize user-supplied input.

Thumbnail Object Library ActiveX control 14.5.0.44 is vulnerable to this issue; other versions may also be affected.

75. LeadTools Raster Object Library LTRTM14e.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24057
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24057
Summary:
LEADTOOLS Raster Thumbnail Object Library ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Thumbnail Object Library ActiveX control 14.5.0.44 is vulnerable to this issue; other versions may also be affected.

76. DotClear Unspecified Trackback Vulnerability
BugTraq ID: 15624
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/15624
Summary:
DotClear is prone to an unspecified vulnerability relating to trackbacks.

No further details have been provided; this BID will be updated when further information is available.

DotClear version 1.2.1 is reported to be affected by this vulnerability; the vendor has released version 1.2.2 to address this issue.

77. LeadTools Thumbnail Browser ActiveX Control LTTMB14E.OCX Buffer Overflow Vulnerability
BugTraq ID: 24053
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24053
Summary:
LEADTOOLS Thumbnail Browser ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

LEADTOOLS Thumbnail Browser ActiveX control 14.5.0.44 is vulnerable; other versions may also be affected.

78. LeadTools JPEG2000 ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24040
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24040
Summary:
LEADTOOLS JPEG2000 ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

LEADTOOLS JPEG2000 ActiveX control 14.5.0.35 is vulnerable; other versions may also be affected.

79. PHPWCMS Multiple Remote File Include Vulnerabilities
BugTraq ID: 15436
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/15436
Summary:
phpwcms is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to disclose sensitive information. This may help with further attacks on the affected computer.

80. PrecisionID Barcode PrecisionID_Barcode.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24010
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24010
Summary:
PrecisionID Barcode ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

PrecisionID Barcode ActiveX control 1.9 is vulnerable; other versions may also be affected.

81. Windy Road Vistered Little Theme Skin Parameter Directory Traversal Vulnerability
BugTraq ID: 24178
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24178
Summary:
Vistered Little is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

This issue affects Vistered Little 1.6a; other versions may also be affected.

82. EDraw Office Viewer Component EDrawOfficeViewer.OCX ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 24229
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24229
Summary:
EDraw Office Viewer Component ActiveX control is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to cause a denial-of-service condition. Arbitrary code execution may be possible, but has not been confirmed.

This issue affects EDraw Office Viewer Component 4.0.5.20; other versions may also be affected.

83. Zenturi ProgramChecker SASATL.DLL ActiveX Control Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 24217
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24217
Summary:
Several Zenturi ProgramChecker ActiveX controls are prone to multiple buffer-overflow vulnerabilities because they fail to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

84. Apple Quicktime For Java Variant Information Disclosure Vulnerability
BugTraq ID: 24222
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24222
Summary:
Apple QuickTime for Java is prone to an information-disclosure vulnerability.

Attackers may exploit this issue by convincing victims into visiting a malicious website.

Exploiting this issue may allow remote attackers to view memory that may contain sensitive information.

85. File Multiple Denial of Service Vulnerabilities
BugTraq ID: 24146
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24146
Summary:
The 'file' utility is prone to multiple denial-of-service vulnerabilities because it fails to handle exceptional conditions.

An attacker could exploit this issue by enticing a victim to open a specially crafted file. A denial-of-service condition can occur. Arbitrary code execution may be possible, but Symantec has not confirmed this.

86. Trolltech QT UTF-8 Sequences Input Validation Vulnerability
BugTraq ID: 23269
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23269
Summary:
Trolltech QT is prone to an input-validation vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to exploit other issues in applications that employ the affected library. A successful attack may allow the attacker to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Qt 3.3.8 and 4.2.3 are known to be vulnerable to this issue; other versions may be affected as well.

87. FileCloset Unspecified Arbitrary File Upload Vulnerability
BugTraq ID: 24228
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24228
Summary:
FileCloset is prone to an arbitrary-file-upload vulnerability.

An attacker can exploit this vulnerability to upload PHP script code and execute it in the context of the webserver process.

88. XFSDump XFS_FSR Insecure Temporary File Creation Vulnerability
BugTraq ID: 23922
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23922
Summary:
The xfsdump 'xfs_fsr' utility creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symlink attacks, overwriting arbitrary files in the context of the affected application.

Successfully exploiting a symlink attack may allow the attacker to overwrite or corrupt sensitive files. This may result in a denial of service; other attacks may also be possible.

This issue affects xfsdump 2.2.38; other versions may be affected as well.

89. Quagga BGPD UPDATE Message Remote Denial Of Service Vulnerability
BugTraq ID: 23417
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23417
Summary:
Quagga is prone to a remote denial-of-service vulnerability because it fails to handle a malformed multi-protocol message.

A remote attacker can exploit this issue by submitting a maliciously crafted message to the application.

Successful exploits will cause the Quagga 'bgpd' daemon to abort, denying further service to legitimate users.

Quagga 0.99.6 and prior versions (0.99 branch) as well as 0.98.6 and prior versions (0.98 branch) are vulnerable.

90. PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
BugTraq ID: 23183
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23183
Summary:
PHP is prone to a 'open_basedir' restriction-bypass vulnerability due to a design error.

Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

The following versions are vulnerable:

PHP 4 up to and including 4.4.6
PHP 5 up to and including 5.2.1

91. PHP PHP_Binary Heap Information Leak Vulnerability
BugTraq ID: 22805
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/22805
Summary:
PHP 'php_binary' serialization handler is prone to a heap-information leak.

The vulnerability arises because of a missing boundary check in the extraction of variable names. A local attacker can exploit this issue to obtain sensitive information (such as heap offsets and canaries) that may aid in other attacks.

These versions are affected:

PHP4 versions prior to 4.4.5
PHP5 versions prior to 5.2.1

Updates are available.

92. PHP Hash Table Overwrite Arbitrary Code Execution Vulnerability
BugTraq ID: 23119
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23119
Summary:
PHP is prone to an arbitrary-code-execution vulnerability.

An attacker may exploit this issue to execute arbitrary code within the context of the affected webserver.

This issue affects PHP 4 (prior to 4.4.5) and PHP 5 (prior to 5.2.1).

93. PHP Session Data Deserialization Arbitrary Code Execution Vulnerability
BugTraq ID: 23120
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/23120
Summary:
PHP is prone to an arbitrary-code-execution vulnerability.

An attacker may exploit this issue to execute arbitrary code within the context of the affected webserver.

This issue affects PHP 4 versions prior to 4.4.5 and PHP 5 versions prior to 5.2.1.

94. PHP ZVAL Reference Counter Integer Overflow Vulnerability
BugTraq ID: 22765
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/22765
Summary:
PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values are not overrun.

A local attacker can exploit this vulnerability to execute arbitrary PHP scripts within the context of the affected application. Failed exploit attempts will likely cause denial-of-service conditions.

Note: According to 'MOPB-04-2007:PHP 4 unserialize() ZVAL Reference Counter Overflow', this issue may be remotely triggered in PHP 4.4.4 environments because many legacy PHP applications still use 'unserialize()' on user-supplied data. 'Unserialize()' uses the '__wakeup()' method of deserialized objects in an unsafe manner that may lead to remote arbitrary code execution. This BID has been changed to reflect the possibility of remote exploitation in PHP 4.4.4 environments.

95. Pheap Config.PHP Pheap_Login Authentication Bypass Vulnerability
BugTraq ID: 24227
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24227
Summary:
Pheap is prone to an authentication-bypass vulnerability due to a design error.

An attacker can exploit this vulnerability to bypass authentication and execute arbitrary commands in the context of the site administrator.

96. PHP Ini_Restore() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
BugTraq ID: 19933
Remote: No
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/19933
Summary:
PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

These issues are reported to affect PHP versions 5.1.6, 4.4.4, and earlier.

Reports indicate that fixes may be available to address this issue, but this has not been confirmed.

97. Algorithmic Research PrivateWire Online Registration Remote Buffer Overflow Vulnerability
BugTraq ID: 18647
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/18647
Summary:
PrivateWire online registration is prone to a remote buffer-overflow vulnerability.

The application fails to properly check boundary conditions when handling GET requests.

This issue allows attackers to execute arbitrary machine code in the context of the affected application software.

PrivateWire 3.7 is vulnerable to this issue; previous versions may also be affected.

98. Multiple Vendor TCP Packet Fragmentation Handling Denial Of Service Vulnerability
BugTraq ID: 11258
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/11258
Summary:
Multiple vendor implementations of the TCP stack are reported prone to a remote denial-of-service vulnerability.

The issue is reported to present itself due to inefficiencies present when handling fragmented TCP packets.

The discoverer of this issue has dubbed the attack style the "New Dawn attack"; it is a variation of a previously reported attack that was named the "Rose Attack".

A remote attacker may exploit this vulnerability to deny service to an affected computer.

Microsoft Windows 2000/XP, Linux kernel 2.4 tree, and undisclosed Cisco systems are reported prone to this vulnerability; other products may also be affected.

99. SalesCart Shopping Cart Reorder2.ASP Multiple SQL Injection Vulnerabilities
BugTraq ID: 24226
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/24226
Summary:
SalesCart Shopping Cart is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

100. Apple Mac OS X 10.3.5 Released - Multiple Vulnerabilities Fixed
BugTraq ID: 10904
Remote: Yes
Last Updated: 2007-05-30
Relevant URL: http://www.securityfocus.com/bid/10904
Summary:
Apple has released Mac OS X 10.3.5. This release addresses a number of security vulnerabilities.

The following new issues were reported:

A remote vulnerability in the Apple Safari Web browser may allow a remote attacker to steal potentially sensitive form data.

A denial-of-service vulnerability in the operating system may allow a remote attacker to disable network traffic.

These issues have been addressed in Mac OS X 10.3.5. Individual BIDs will be created upon further analysis.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Insecure plug-ins pose danger to Firefox users
By: Robert Lemos
A security researcher warns that an insecure update mechanism for some of the open-source browser's third-party add-ons could allow an attacker the ability to install malicious code.
http://www.securityfocus.com/news/11467

2. Peer-to-peer networks co-opted for DOS attacks
By: Robert Lemos
Attackers compromise the hub servers of the DC++ peer-to-peer network, turning hundreds of thousands of clients into hard-to-stop distributed denial-of-service attacks.
http://www.securityfocus.com/news/11466

3. "Data storm" blamed for nuclear-plant shutdown
By: Robert Lemos
A Congressional committee calls for the Nuclear Regulatory Commission to further investigate the cause of excessive network traffic that shut down an Alabama nuclear plant.
http://www.securityfocus.com/news/11465

4. Experts scramble to quash IPv6 flaw
By: Robert Lemos
Only a few weeks after researchers raised the design issue in the next-generation Internet protocol, two drafts to the Internet Engineering Task Force propose different fixes.
http://www.securityfocus.com/news/11463

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
V. INCIDENTS LIST SUMMARY
---------------------------
1. Survey on Supercomputer Cluster Security
http://www.securityfocus.com/archive/75/469615

VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Help developing exploit
http://www.securityfocus.com/archive/82/469719

VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Reconstruction of MS terminal services sessions
http://www.securityfocus.com/archive/88/469865

2. SecurityFocus Microsoft Newsletter #343
http://www.securityfocus.com/archive/88/469513

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
1. Survey on Supercomputer Cluster Security
http://www.securityfocus.com/archive/91/469540

X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: ByteCrusher

http://landing.bytecrusher.com/windowzones/sflanding1.aspx?Referrer=sf-A21sfWZ-wz1&cm_mmc=Security%20Focus-_-USA-_-Newsletter-_-Newsletter%3A%20Other%3A%20A21%3A%20sfWZ%3A%20wz1

News

Thursday, May 31, 2007

SecurityFocus Newsletter #403

No comments:

WINDOWS CENTER

Blog Archive