WINDOWS CENTER: SecurityFocus Newsletter #417

SecurityFocus Newsletter #417
----------------------------------------

This Issue is Sponsored by: WatchFire

As web applications become increasingly complex, tremendous amounts of sensitive data - including personal, medical and financial information - are exchanged, and stored. This paper examines a few vulnerability detection methods - specifically comparing and contrasting manual penetration testing with automated scanning tools. Download Watchfire's "Web Application Security: Automated Scanning or Manual Penetration Testing?" whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701700000008yka

SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as conveying topics of interest for our community. We are proud to offer content from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I. FRONT AND CENTER
1. Mod Your iPhone- For Fun or Profit?
2. Virtualized rootkits - Part 2
II. BUGTRAQ SUMMARY
1. RETIRED: Olate Download Arbitrary File Upload Vulnerability
2. eZ Publish Tipafriend Function Open Email Relay Vulnerability
3. Mozilla Thunderbird/SeaMonkey/Firefox Multiple Remote Vulnerabilities
4. Mozilla Firefox JavaScript Handler Race Condition Memory Corruption Vulnerability
5. Mozilla Firefox About:Blank IFrame Cross Domain Information Disclosure Vulnerability
6. Mozilla Firefox OnUnload Memory Corruption Vulnerability
7. Mozilla Firefox Popup Blocker Cross Zone Security Bypass Weakness
8. Mozilla Firefox XML Handler Race Condition Memory Corruption Vulnerability
9. Mozilla Multiple Products Remote Vulnerabilities
10. Mozilla Products Multiple Remote Vulnerabilities
11. Mozilla Firefox Location.Hostname Dom Property Cookie Theft Vulnerability
12. Mozilla Firefox/Thunderbird/Seamonkey Multiple Remote Vulnerabilities
13. Multiple Mozilla Products Memory Corruption/Code Injection/Access Restriction Bypass Vulnerabilities
14. Mozilla Firefox Javascript URI Remote Code Execution Vulnerability
15. GNU Tar Dot_Dot Function Remote Directory Traversal Vulnerability
16. Multiple Mozilla Products IFRAME JavaScript Execution Vulnerability
17. Mozilla Thunderbird Multiple Remote Information Disclosure Vulnerabilities
18. Linux Kernel Decode_Choices Function Remote Denial Of Service Vulnerability
19. Linux Kernel VFat Compat IOCTLS Local Denial of Service Vulnerability
20. Linux Kernel USB PWC Driver Local Denial Of Service Vulnerability
21. phpBB Advanced Links Mod links.php SQL Injection Vulnerability
22. Shopping Cart Professional Unspecified Multiple Directory Traversal Vulnerabilities
23. Norman Virus Control NVCOAFT51.SYS Driver Multiple Vulnerabilities
24. Hewlett-Packard OpenView OVTrace Multiple Remote Buffer Overflow Vulnerabilities
25. Linux Kernel Multiple Local MOXA Serial Driver Buffer Overflow Vulnerabilities
26. IPv6 Protocol Type 0 Route Header Denial of Service Vulnerability
27. eZ Publish No Policy Function Unspecified Vulnerability
28. PHPOF DB_AdoDB.Class.PHP Remote File Include Vulnerability
29. GIMP PSD File Integer Overflow Vulnerability
30. TorrentTrader Insecure File Permission Multiple Local Privilege Escalation Vulnerability
31. reprepro Update Repository Signature Verification Security Bypass Vulnerability
32. E-Smart Cart Login.ASP SQL Injection Vulnerability
33. WebOddity Web Server Directory Traversal Vulnerability
34. MIT Kerberos 5 kadmind Server Uninitialized Pointer Remote Code Execution Vulnerability
35. Move Media Player Quantum Streaming ActiveX Control Multiple Buffer Overflow Vulnerabilities
36. GD Graphics Library Multiple Vulnerabilities
37. Urchin urchin.cgi Multiple Cross-Site Scripting Vulnerabilities
38. Joomla PCLTar.PHP Remote File Include Vulnerability
39. Symantec SYMTDI.SYS Device Driver Local Denial of Service Vulnerability
40. eNetman Index.PHP Remote File Include Vulnerability
41. cwmExplorer Index.PHP Source Code Information Disclosure Vulnerability
42. 212cafe Webboard Read.PHP SQL Injection Vulnerability
43. SpeedTech STPHPLib STPHPLIB_DIR Parameter Multiple Remote File Include Vulnerabilities
44. XWork AltSyntax OGNL Input Validation Vulnerability
45. Linux Kernel Perfmon.c Local Denial of Service Vulnerability
46. Linux Kernel CapiUtil.c Buffer Overflow Vulnerability
47. Xoops XFsection Module Dir_Module Parameter Remote File Include Vulnerability
48. Arcadem Index.PHP Remote File Include Vulnerability
49. MailMarshal Tar Archive Remote Directory Traversal Vulnerability
50. Cyrus SASL Remote Digest-MD5 Denial of Service Vulnerability
51. MyBloggie Trackback.PHP Multiple SQL Injection Vulnerabilities
52. Red Hat Network Satellite Server XMLRPC Remote Code Execution Vulnerability
53. Sophos Anti-Virus UPX and BZIP Multiple Remote Vulnerabilities
54. Wireshark Multiple Protocol Denial of Service Vulnerabilities
55. Youngzsoft CCProxy Logging Function Unspecified Remote Buffer Overflow Vulnerability
56. PPStream PowerPlayer.DLL ActiveX Control Buffer Overflow Vulnerability
57. Apple QuickTime Information Disclosure and Multiple Code Execution Vulnerabilities
58. Claroline Local File Include and Cross-Site Scripting Vulnerabilities
59. Hitachi JP1/CM2/Network Node Manager Unspecified Code Execution Vulnerability
60. Hitachi Cosminexus Javadoc Command Cross-Site Scripting Vulnerability
61. Apache Tomcat Cal2.JSP Cross-Site Scripting Vulnerability
62. PHD Help Desk Unspecified SQL Injection Vulnerability
63. Joomla! 1.5 Multiple Input Validation Vulnerabilities
64. Alice Messenger ActiveX Control Registry Key Manipulation Vulnerability
65. PopTop PPTP Server GRE Packet Denial Of Service Vulnerability
66. MKPortal Admin.PHP Authentication Bypass Vulnerability
67. Ots Labs OtsTurntables M3U Local Buffer Overflow Vulnerability
68. Vim Feedkeys and Writefile Functions Remote Code Execution Vulnerabilities
69. Aztech DSL600EU Router Web Interface IP Spoofing Vulnerability
70. Virtual DJ M3U File Buffer Overflow Vulnerability
71. Virtual DJ M3U Local Buffer Overflow Vulnerability
72. Yvora CMS Error_View.PHP SQL Injection Vulnerability
73. Backup Manager FTP Server Information Disclosure Vulnerability
74. Sun JSSE SSL/TLS Handshake Processing Denial Of Service Vulnerability
75. Sun JDK JPG/BMP Parser Multiple Vulnerabilities
76. Sun JavaDoc Tool Cross-Site Scripting Vulnerability
77. Sun Java RunTime Environment GIF Images Buffer Overflow Vulnerability
78. Sun Solaris Special File System Local Denial of Service Vulnerability
79. Weblogicnet Files_Dir Multiple Remote File Include Vulnerabilities
80. Toms GÃ¤stebuch Multiple Cross-Site Scripting Vulnerabilities
81. MIT Kerberos 5 KAdminD Server SVCAuth_GSS_Validate Stack Buffer Overflow Vulnerability
82. ClamAV Multiple Remote Denial of Service Vulnerabilities
83. Sun Cluster Software Unspecified Denial Of Service Vulnerability
84. id3lib Insecure Temporary File Creation Vulnerability
85. Vim HelpTags Command Remote Format String Vulnerability
86. Linux Kernel Random Number Generator Local Denial of Service and Privilege Escalation Vulnerability
87. Linux Kernel AACRAID Driver Local Security Bypass Vulnerability
88. Mozilla Firefox 2 Password Manager Cross-Site Information Disclosure Weakness
89. Mozilla Foundation Products XPCOM Memory Corruption Vulnerability
90. Trend Micro ServerProtect RPCFN_SYNC_TASK Remote Integer Vulnerability
91. Mozilla Firefox/Thunderbird/SeaMonkey Chrome-Loaded About:Blank Script Execution Vulnerability
92. Trend Micro ServerProtect Multiple RPC Remote Buffer Overflow Vulnerabilities
93. Multiple Browser URI Handlers Command Injection Vulnerabilities
94. Mozilla Firefox URLBar Null Byte File Remote Code Execution Vulnerability
95. IBM DB2 Universal Database Multiple Unspecified Vulnerabilities
96. OpenSSL PKCS Padding RSA Signature Forgery Vulnerability
97. Mozilla Firefox, SeaMonkey, Camino, and Thunderbird Multiple Remote Vulnerabilities
98. Mozilla Firefox WYCIWYG:// URI Cache Zone Bypass Vulnerability
99. Mozilla Firefox 2.0.0.4 Multiple Remote Vulnerabilities
100. Mozilla Firefox Document.Cookie Path Argument Denial of Service Vulnerability
III. SECURITYFOCUS NEWS
1. China on hot seat over alleged hacks
2. Fraudsters focus on job sites
3. Universities warned of Storm Worm attacks
4. Retro attack gets new life, worries browser makers
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Security Engineer, Denver
2. [SJ-JOB] Certification & Accreditation Engineer, Herndon
3. [SJ-JOB] Certification & Accreditation Engineer, Herndon
4. [SJ-JOB] Security Consultant, Dulles
5. [SJ-JOB] Sr. Security Engineer, Chantilly
6. [SJ-JOB] Security Consultant, London or Reading
7. [SJ-JOB] Sr. Security Analyst, London
8. [SJ-JOB] Jr. Security Analyst, Denver
9. [SJ-JOB] Sr. Security Analyst, Chantilly
10. [SJ-JOB] Quality Assurance, Mountain View
11. [SJ-JOB] Software Engineer, Mountain View
12. [SJ-JOB] Sales Engineer, Washington
13. [SJ-JOB] Certification & Accreditation Engineer, Any
14. [SJ-JOB] Security Consultant, WASHINGTON
15. [SJ-JOB] Security Consultant, Virtual
16. [SJ-JOB] Sr. Security Engineer, Wilmington
V. INCIDENTS LIST SUMMARY
1. Source port 445,80
VI. VULN-DEV RESEARCH LIST SUMMARY
1. DeepSec IDSC 2007 Vienna Registration Now Open
2. Immunity Debugger v1.1
VII. MICROSOFT FOCUS LIST SUMMARY
1. SecurityFocus Microsoft Newsletter #357
2. Active Directory
3. Software smart-card emulation
4. NTFS default special permissions
VIII. SUN FOCUS LIST SUMMARY
1. Check Point SmartCenter in Non-Global Zone
IX. LINUX FOCUS LIST SUMMARY
1. mail antivirus
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Mod Your iPhone- For Fun or Profit?
By Mark Rasch
I admit it: I own an iPhone. Indeed, I bought one the day they came out. No, I didn't wait in line for hours; I just walked into the local Apple store, plunked down my life's savings, and voila, another AT&T customer!
http://www.securityfocus.com/columnists/453

2. Virtualized rootkits - Part 2
By Federico Biancuzzi
There has been a lot of buzz around the topic of virtualized rootkits. Joanna Rutkowska has been working on a new version of Blue-Pill, her proof of concept invisible rootkit, while a team made by three prominent security experts (Thomas Ptacek, Nate Lawson, Peter Ferrie) challenged her that there is not an "invisible" rootkit, and that they were going to present at BlackHat conference various techniques to detect Blue-Pill. Federico Biancuzzi interviewed both sides to learn more. Part 2 of 2
http://www.securityfocus.com/columnists/452

II. BUGTRAQ SUMMARY
--------------------
1. RETIRED: Olate Download Arbitrary File Upload Vulnerability
BugTraq ID: 25509
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25509
Summary:
Olate Download is prone to an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to upload and execute arbitrary script code in the context of the affected webserver process. This may help the attacker compromise the application; other attacks are possible.

Olate Download 3.4.2 is vulnerable to this issue; other versions may also be affected.

RETIRED: This BID is being retired because further information shows that the application is not vulnerable to this issue.

2. eZ Publish Tipafriend Function Open Email Relay Vulnerability
BugTraq ID: 25538
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25538
Summary:
eZ Publish is prone to an open-email-relay vulnerability because the application fails to sufficiently validate user-supplied input.

An attacker could exploit this issue by constructing a script that would send unsolicited spam to an unrestricted amount of email addresses with a forged email address.

Successfully exploiting this issue may allow the attacker to obtain sensitive information.

3. Mozilla Thunderbird/SeaMonkey/Firefox Multiple Remote Vulnerabilities
BugTraq ID: 22694
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/22694
Summary:
The Mozilla Foundation has released six security advisories specifying vulnerabilities in Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- Execute arbitrary code
- Cause denial-of-service conditions
- Perform cross-site scripting attacks
- Obtain potentially sensitive information
- Spoof legitimate content

Other attacks may also be possible.

4. Mozilla Firefox JavaScript Handler Race Condition Memory Corruption Vulnerability
BugTraq ID: 19488
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/19488
Summary:
Mozilla Firefox is prone to a remote memory-corruption vulnerability. This issue is due to a race condition that may result in double-free or other memory-corruption issues.

Attackers may likely exploit this issue to execute arbitrary machine code in the context of the vulnerable application, but this has not been confirmed. Failed exploit attempts will likely crash the application.

Mozilla Firefox is vulnerable to this issue. Due to code reuse, other Mozilla products are also likely affected.

5. Mozilla Firefox About:Blank IFrame Cross Domain Information Disclosure Vulnerability
BugTraq ID: 24286
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24286
Summary:
Mozilla Firefox is prone to a cross-domain information-disclosure vulnerability because scripts may persist across navigations.

A malicious site may be able to modify the iframe of a site in an arbitrary external domain. Attackers could exploit this to gain access to sensitive information that is associated with the external domain. Other attacks are also possible, such as executing script code in other browser security zones.

This issue is being tracked by Bugzilla Bug 382686 and is reportedly related to Bug 343168.

Firefox 2.0.0.4 and prior versions are vulnerable.

6. Mozilla Firefox OnUnload Memory Corruption Vulnerability
BugTraq ID: 22679
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/22679
Summary:
Mozilla Firefox is prone to a remote memory-corruption vulnerability.

Successfully exploiting this issue may allow remote attackers to execute arbitrary machine code in the context of the affected application. This could facilitate the remote compromise of affected computers.

Mozilla Firefox version 2.0.0.1 is vulnerable to this issue; other versions are also likely affected.

7. Mozilla Firefox Popup Blocker Cross Zone Security Bypass Weakness
BugTraq ID: 22396
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/22396
Summary:
Mozilla Firefox is prone to a cross-zone security-bypass weakness. This issue allows attackers to open 'file://' URIs from remote websites.

By exploiting this issue in conjunction with other weaknesses or vulnerabilities, attackers may be able to execute arbitrary script code with the elevated privileges that are granted to scripts when they are executed from local sources.

Mozilla Firefox 1.5.0.9 is affected by this issue; other versions may be affected as well.

8. Mozilla Firefox XML Handler Race Condition Memory Corruption Vulnerability
BugTraq ID: 19534
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/19534
Summary:
Mozilla Firefox is prone to a remote memory-corruption vulnerability because of a race condition that may result in double-free or other memory-corruption issues.

Mozilla Firefox is vulnerable to this issue. Due to code-reuse, other Mozilla products are also likely affected.

The Flock browser version 0.7.4.1 and the K-Meleon browser version 1.0.1 are also reported vulnerable.

9. Mozilla Multiple Products Remote Vulnerabilities
BugTraq ID: 19181
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/19181
Summary:
The Mozilla Foundation has released thirteen security advisories specifying vulnerabilities in Mozilla Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- execute arbitrary machine code in the context of the vulnerable application
- crash affected applications
- run arbitrary script code with elevated privileges
- gain access to potentially sensitive information
- carry out cross-domain scripting attacks.

Other attacks may also be possible.

The issues described here will be split into individual BIDs as more information becomes available.

These issues are fixed in:

- Mozilla Firefox 1.5.0.5
- Mozilla Thunderbird 1.5.0.5
- Mozilla SeaMonkey 1.0.3

10. Mozilla Products Multiple Remote Vulnerabilities
BugTraq ID: 24242
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24242
Summary:
The Mozilla Foundation has released six security advisories specifying vulnerabilities in Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- Execute arbitrary code
- Cause denial-of-service conditions
- Perform cross-site scripting attacks
- Obtain potentially sensitive information
- Spoof legitimate content

Other attacks may also be possible.

11. Mozilla Firefox Location.Hostname Dom Property Cookie Theft Vulnerability
BugTraq ID: 22566
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/22566
Summary:
Mozilla Firefox is prone to a vulnerability that allows attackers to steal cookies. This issue occurs because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to manipulate cookie-based authentication credentials for third-party web pages or to control how the site is rendered to the user. Exploiting this issue may allow the attacker to bypass the same-origin policy for cross-window/cross-frame data access; other attacks are also possible.

This issue affects version 2.0.0.1; prior versions may also be affected.

12. Mozilla Firefox/Thunderbird/Seamonkey Multiple Remote Vulnerabilities
BugTraq ID: 20042
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/20042
Summary:
The Mozilla Foundation has released six security advisories specifying vulnerabilities in Mozilla Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- execute arbitrary code
- perform cross-site scripting attacks
- supply malicious data through updates
- inject arbitrary content
- execute arbitrary JavaScript
- crash affected applications and potentially execute arbitrary code.

Other attacks may also be possible.

The issues described here will be split into individual BIDs as more information becomes available.

These issues are fixed in:

- Mozilla Firefox version 1.5.0.7
- Mozilla Thunderbird version 1.5.0.7
- Mozilla SeaMonkey version 1.0.5

13. Multiple Mozilla Products Memory Corruption/Code Injection/Access Restriction Bypass Vulnerabilities
BugTraq ID: 16476
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/16476
Summary:
Multiple Mozilla products are prone to multiple vulnerabilities. These issues include various memory-corruption, code-injection, and access-restriction-bypass vulnerabilities. Other undisclosed issues may have also been addressed in the various updated vendor applications.

Successful exploitation of these issues may permit an attacker to execute arbitrary code in the context of the affected application. This may facilitate a compromise of the affected computer; other attacks are also possible.

14. Mozilla Firefox Javascript URI Remote Code Execution Vulnerability
BugTraq ID: 22826
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/22826
Summary:
Mozilla Firefox is prone to a remote code-execution vulnerability due to a design error.

Attackers may exploit this issue by enticing victims into visiting a malicious site.

Successful exploits may allow an attacker to crash the application or execute arbitrary code in the context of the affected application.

15. GNU Tar Dot_Dot Function Remote Directory Traversal Vulnerability
BugTraq ID: 25417
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25417
Summary:
GNU Tar is prone to a directory-traversal vulnerability. This issue occurs because the application fails to validate user-supplied data.

A successful attack can allow the attacker to overwrite files on a computer in the context of the user running the affected application. Successful exploits may aid in further attacks.

16. Multiple Mozilla Products IFRAME JavaScript Execution Vulnerability
BugTraq ID: 16770
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/16770
Summary:
Multiple Mozilla products are prone to a script-execution vulnerability.

The vulnerability presents itself when an attacker supplies a specially crafted email to a user containing malicious script code in an IFRAME and the user tries to reply to the mail. Arbitrary JavaScript can be executed even if the user has disabled JavaScript execution in the client.

The following mozilla products are vulnerable to this issue:
- Mozilla Thunderbird, versions prior to 1.5.0.2, and prior to 1.0.8
- Mozilla SeaMonkey, versions prior to 1.0.1
- Mozilla Suite, versions prior to 1.7.13

17. Mozilla Thunderbird Multiple Remote Information Disclosure Vulnerabilities
BugTraq ID: 16881
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/16881
Summary:
Mozilla Thunderbird is susceptible to multiple remote information-disclosure vulnerabilities. These issues are due to the application's failure to properly enforce the restriction for downloading remote content in email messages.

These issues allow remote attackers to gain access to potentially sensitive information, aiding them in further attacks. Attackers may also exploit these issues to know whether and when users read email messages.

Mozilla Thunderbird version 1.5 is vulnerable to these issues; other versions may also be affected.

18. Linux Kernel Decode_Choices Function Remote Denial Of Service Vulnerability
BugTraq ID: 24818
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24818
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability because it fails to handle certain H.323 data.

Attackers can exploit this issue to crash the affected operating system, denying access to legitimate users.

Versions prior to 2.6.21.6, 2.6.20.15, and 2.6.22 are vulnerable.

19. Linux Kernel VFat Compat IOCTLS Local Denial of Service Vulnerability
BugTraq ID: 24134
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24134
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability.

A local attacker can exploit this issue to cause the kernel to crash, effectively denying service to legitimate users.

20. Linux Kernel USB PWC Driver Local Denial Of Service Vulnerability
BugTraq ID: 25504
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25504
Summary:
The Linux Kernel is prone to a local denial-of-service vulnerability because it fails to properly free resources of USB PWC devices.

Attackers can exploit this issue to block the USB subsystem, resulting in denial-of-service conditions.

Versions prior to 2.6.22.6 are vulnerable.

21. phpBB Advanced Links Mod links.php SQL Injection Vulnerability
BugTraq ID: 25501
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25501
Summary:
Advanced Links Mod for phpBB is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects Advanced Links Mod 1.2.2; other versions may also be vulnerable.

22. Shopping Cart Professional Unspecified Multiple Directory Traversal Vulnerabilities
BugTraq ID: 25500
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25500
Summary:
Shopping Cart Professional is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to access sensitive information that could aid in further attacks.

Versions prior to Shopping Cart Professional 7.52 are vulnerable; other versions may also be affected.

23. Norman Virus Control NVCOAFT51.SYS Driver Multiple Vulnerabilities
BugTraq ID: 25499
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25499
Summary:
Norman Virus Control is prone to multiple vulnerabilities including a heap-based kernel memory buffer-overflow issue and multiple input-validation vulnerabilities.

These issues reside in the 'nvcoaft51.sys' driver.

Attackers can exploit these issues to execute arbitrary code with SYSTEM-level privileges. Successful exploits will completely compromise affected computers. Failed attacks will likely cause denial-of-service conditions.

Norman Virus Control 5.82 is vulnerable; other versions may also be affected.

NOTE: Other Norman products may also use the affected driver.

24. Hewlett-Packard OpenView OVTrace Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 25255
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25255
Summary:
HP OpenView applications are prone to multiple remote stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on input that is supplied to opcode handlers of affected services.

These vulnerabilities affect the 'ovtrcsvc.exe' and the 'OVTrace.exe' service.

Attackers can exploit these issues to execute arbitrary code with superuser privileges.

25. Linux Kernel Multiple Local MOXA Serial Driver Buffer Overflow Vulnerabilities
BugTraq ID: 12195
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/12195
Summary:
The MOXA serial driver in the Linux kernel is reported prone to multiple buffer-overflow vulnerabilities. The driver fails to perform proper bounds checks before copying user-supplied data to fixed-size memory buffers.

These vulnerabilities reside in the 'drivers/char/moxa.c' file.

The vulnerable functions perform a 'copy_from_user()' call to copy user-supplied, user-space data to a fixed-size, static kernel memory buffer (moxaBuff) of 10240 bytes in length while using the user-supplied length argument as passed from 'MoxaDriverIoctl()'. This reportedly results in improperly bounded operations, potentially causing locally exploitable buffer overflows.

Linux kernels from 2.2 through 2.4 and 2.6 are all reported prone to these vulnerabilities.

26. IPv6 Protocol Type 0 Route Header Denial of Service Vulnerability
BugTraq ID: 23615
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/23615
Summary:
IPv6 protocol implementations are prone to a denial-of-service vulnerability due to a design error.

Exploiting this issue allows attackers to cause denial-of-service conditions.

This issue is related to the issue discussed in BID 22210 (Cisco IOS IPv6 Source Routing Remote Memory Corruption Vulnerability).

27. eZ Publish No Policy Function Unspecified Vulnerability
BugTraq ID: 25539
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25539
Summary:
eZ Publish is prone to an unspecified vulnerability.

Very few details are available regarding this issue. We will update this BID as more information emerges.

28. PHPOF DB_AdoDB.Class.PHP Remote File Include Vulnerability
BugTraq ID: 25541
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25541
Summary:
PHPOF is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

PHPOF snapshot 20040226 is vulnerable; other versions may also be affected.

29. GIMP PSD File Integer Overflow Vulnerability
BugTraq ID: 24745
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24745
Summary:
GIMP is prone to an integer-overflow vulnerability because it fails to properly bounds-check user-supplied input data before copying it to an insufficiently sized memory buffer.

Successful exploits of this vulnerability allow remote attackers to execute arbitrary machine code in the context of the affected application.

GIMP 2.2.15 is vulnerable to this issue; other versions may also be affected.

30. TorrentTrader Insecure File Permission Multiple Local Privilege Escalation Vulnerability
BugTraq ID: 25536
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25536
Summary:
TorrentTrader is prone to multiple local privilege-escalation vulnerabilities because the application fails to set proper file permissions on certain text files.

A local attacker can exploit these issues to execute arbitrary PHP code with the privileges of the webserver process.

31. reprepro Update Repository Signature Verification Security Bypass Vulnerability
BugTraq ID: 25537
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25537
Summary:
The 'reprepro' utility is prone to a security-bypass vulnerability because it fails to adequately verify signatures during repository updates.

An attacker can exploit this issue to cause the application to accept packages signed with an unknown key, effectively bypassing security restrictions. Successful exploits can cause arbitrary repository files to be overwritten with malicious data.

Versions prior to reprepro 2.2.4 are vulnerable.

32. E-Smart Cart Login.ASP SQL Injection Vulnerability
BugTraq ID: 25532
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25532
Summary:
E-Smart Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

33. WebOddity Web Server Directory Traversal Vulnerability
BugTraq ID: 25535
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25535
Summary:
WebOddity is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

A remote attacker can exploit this issue to retrieve the contents of arbitrary files in the context of the affected application.

This issue affects WebOddity 0.09b; other versions may also be vulnerable.

34. MIT Kerberos 5 kadmind Server Uninitialized Pointer Remote Code Execution Vulnerability
BugTraq ID: 25533
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25533
Summary:
Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is prone to a remote code-execution vulnerability because of an uninitialized pointer.

An authenticated attacker can exploit this issue to execute arbitrary code with superuser privileges. Successful exploits will completely compromise affected computers. Failed attacks will cause denial-of-service conditions.

All 'kadmind' servers run on the master Kerberos server. Since the master server holds the KDC principal and policy database, an attack may not only compromise the affected computer, but could also compromise multiple hosts that use the server for authentication.

Kerberos 5 'kadmind' 1.5 through 1.6.2 are vulnerable.

35. Move Media Player Quantum Streaming ActiveX Control Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 25529
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25529
Summary:
Move Media Player is prone to multiple remote buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplied data before copying it into insufficiently sized memory buffers.

Exploiting these issues allows remote attackers to execute arbitrary code in the context of applications using the affected ActiveX control (typically Internet Explorer) and to compromise affected computers. Failed attempts will likely result in denial-of-service conditions.

These issues affect Move Media Player 1.0.0.1; other versions may also be vulnerable.

36. GD Graphics Library Multiple Vulnerabilities
BugTraq ID: 24651
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24651
Summary:
The GD graphics library is prone to multiple vulnerabilities.

An attacker can exploit this issue to cause denial-of-service conditions or execute arbitrary code in the context of applications implementing the affected library.

Version prior to GD graphics library 2.0.35 are reported vulnerable.

37. Urchin urchin.cgi Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 25530
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25530
Summary:
Urchin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect Urchin 5.6.00r2; other versions may also be vulnerable.

38. Joomla PCLTar.PHP Remote File Include Vulnerability
BugTraq ID: 25528
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25528
Summary:
Joomla is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Joomla 1.5.0 Beta; other versions may also be affected.

39. Symantec SYMTDI.SYS Device Driver Local Denial of Service Vulnerability
BugTraq ID: 22977
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/22977
Summary:
Symantec 'SYMTDI.SYS' device driver is prone to a local denial-of-service vulnerability.

A local authenticated attacker may exploit this issue to crash affected computers, denying service to legitimate users.

This issue is similar to the one described in BID 22961. Symantec is currently investigating this issue; this BID will be updated as more information becomes available.

40. eNetman Index.PHP Remote File Include Vulnerability
BugTraq ID: 25527
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25527
Summary:
eNetman is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

eNetman 1 is vulnerable; other versions may also be affected.

41. cwmExplorer Index.PHP Source Code Information Disclosure Vulnerability
BugTraq ID: 21683
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/21683
Summary:
cwmExplorer is prone to an information-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to retrieve script source code. Information obtained may aid in further attacks.

cwmExplorer 1.0 is vulnerable to this issue; other versions may also be affected.

42. 212cafe Webboard Read.PHP SQL Injection Vulnerability
BugTraq ID: 25526
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25526
Summary:
212cafe Webboard is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Webboard 6.30 is vulnerable; other versions may also be affected.

43. SpeedTech STPHPLib STPHPLIB_DIR Parameter Multiple Remote File Include Vulnerabilities
BugTraq ID: 25525
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25525
Summary:
STPHPLib is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

These issues affect STPHPLib 0.8.0 (Hammer); other versions may also be affected.

44. XWork AltSyntax OGNL Input Validation Vulnerability
BugTraq ID: 25524
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25524
Summary:
XWork is prone to an input-validation vulnerability because it fails to adequately handle user-supplied input.

NOTE: This issue will occur only when the 'altSyntax' feature is enabled.

Attackers can exploit this issue to execute arbitrary OGNL expressions with the privileges of the user running the application. Successful exploits can compromise the application and possibly the underlying computer.

Versions prior to XWork 2.0.4 are vulnerable.

45. Linux Kernel Perfmon.c Local Denial of Service Vulnerability
BugTraq ID: 17482
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/17482
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue arises in 'perfmon.c' on ia64 platforms.

This vulnerability allows local users to crash the kernel, denying further service to legitimate users.

46. Linux Kernel CapiUtil.c Buffer Overflow Vulnerability
BugTraq ID: 23333
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/23333
Summary:
The Linux kernel is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code with kernel-level privileges or cause the affected kernel to crash, denying service to legitimate users.

This issue affects versions 2.6.9 to 2.6.20 and the 'isdn4k-utils' utilities.

47. Xoops XFsection Module Dir_Module Parameter Remote File Include Vulnerability
BugTraq ID: 24465
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24465
Summary:
XFsection for XOOPS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

XFsection 1.07 is vulnerable; other versions may also be affected.

48. Arcadem Index.PHP Remote File Include Vulnerability
BugTraq ID: 25432
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25432
Summary:
Arcadem is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Arcadem 2.01 is vulnerable; other versions may also be affected.

49. MailMarshal Tar Archive Remote Directory Traversal Vulnerability
BugTraq ID: 25523
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25523
Summary:
MailMarshal is prone to a directory-traversal vulnerability because the application fails to validate user-supplied data.

Remote attackers an overwrite files in arbitrary locations on a vulnerable computer in the context of the user running the affected application.

50. Cyrus SASL Remote Digest-MD5 Denial of Service Vulnerability
BugTraq ID: 17446
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/17446
Summary:
Cyrus SASL is affected by a remote denial-of-service vulnerability. This issue occurs before successful authentication, allowing anonymous remote attackers to trigger it.

This vulnerability allows remote attackers to crash services using the affected SASL library, denying service to legitimate users.

This issue reportedly affects version 2.1.18 of Cyrus SASL; other versions may also be affected.

51. MyBloggie Trackback.PHP Multiple SQL Injection Vulnerabilities
BugTraq ID: 19362
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/19362
Summary:
MyBloggie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks.

A successful attack could allow an attacker to compromise the software, access or modify data, or exploit vulnerabilities in the underlying database implementation.

MyBloggie versions 2.1.6 and prior are vulnerable.

52. Red Hat Network Satellite Server XMLRPC Remote Code Execution Vulnerability
BugTraq ID: 25490
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25490
Summary:
Red Hat Network Satellite Server is prone to a remote code-execution vulnerability. Successful authentication to the Satellite Server is required to exploit this issue.

A remote attacker can exploit this issue to execute arbitrary code with 'apache' user privileges, resulting in the compromise of affected computers.

Red Hat Network Satellite Server 5.0.0 is vulnerable.

53. Sophos Anti-Virus UPX and BZIP Multiple Remote Vulnerabilities
BugTraq ID: 25428
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25428
Summary:
Sophos Anti-Virus is prone to multiple remote vulnerabilities, including a remote code-execution issue and a denial-of-service issue.

A remote attacker can exploit these issues to execute arbitrary code within the context of the affected application or to crash the application, denying service to legitimate users. Successful exploits may also crash the antivirus engine or exhaust disk space on affected computers.

This issue affects Sophos applications using versions of the antivirus engine prior to 2.48.0.

54. Wireshark Multiple Protocol Denial of Service Vulnerabilities
BugTraq ID: 24662
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24662
Summary:
Wireshark is prone to multiple denial-of-service vulnerabilities.

Exploiting these issues may permit attackers to cause crashes and deny service to legitimate users of the application.

Versions prior to Wireshark 0.99.6 are affected.

55. Youngzsoft CCProxy Logging Function Unspecified Remote Buffer Overflow Vulnerability
BugTraq ID: 11666
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/11666
Summary:
CCProxy is reported prone to an unspecified remote buffer-overflow vulnerability. Exploiting this issue may allow remote attackers to execute arbitrary code on a vulnerable computer and gain unauthorized access.

All versions of CCProxy are considered vulnerable at this time.

56. PPStream PowerPlayer.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 25502
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25502
Summary:
PPStream PowerPlayer ActiveX control is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

PPStream PowerPlayer ActiveX control 2.0.1.3829 is vulnerable to this issue; other versions may also be affected.

57. Apple QuickTime Information Disclosure and Multiple Code Execution Vulnerabilities
BugTraq ID: 24873
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24873
Summary:
Apple QuickTime is prone to an information-disclosure and multiple remote code-execution vulnerabilities.

Remote attackers may exploit these issues by enticing victims into opening maliciously crafted files or visiting maliciously crafted websites.

Successful exploits may allow attackers to execute arbitrary code in the context of a user running the vulnerable application or to obtain sensitive information. Failed exploit attempts of remote code-execution issues may result in denial-of-service conditions. Successful exploits of the information-disclosure issue may lead to further attacks.

58. Claroline Local File Include and Cross-Site Scripting Vulnerabilities
BugTraq ID: 25521
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25521
Summary:
Claroline is prone to a local file-include vulnerability and multiple cross-site scripting vulnerabilities.

An attacker could exploit these issues to execute local script code in the context of the application and access sensitive data, which may aid in further attacks.The attacker may also be able to execute arbitray code in the context of the webserver. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Claroline 1.8.6 are vulnerable.

59. Hitachi JP1/CM2/Network Node Manager Unspecified Code Execution Vulnerability
BugTraq ID: 25520
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25520
Summary:
Hitachi JP1/CM2/Network Node Manager is prone to a code-execution vulnerability.

Successful exploits allow remote attackers to execute arbitrary machine code in the context of the vulnerable application.

Hitachi JP1/CM2/Network Node Manager 07-10 through 07-10-5, 08-00 through 08-00-03, and 08-10 are vulnerable.

60. Hitachi Cosminexus Javadoc Command Cross-Site Scripting Vulnerability
BugTraq ID: 25518
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25518
Summary:
Hitachi Cosminexus is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

61. Apache Tomcat Cal2.JSP Cross-Site Scripting Vulnerability
BugTraq ID: 25531
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25531
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

This issue affects Apache Tomcat 4.1.31; other versions may also be affected.

62. PHD Help Desk Unspecified SQL Injection Vulnerability
BugTraq ID: 25517
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25517
Summary:
PHD Help Desk is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to PHD Help Desk 1.31 are vulnerable.

63. Joomla! 1.5 Multiple Input Validation Vulnerabilities
BugTraq ID: 25508
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25508
Summary:
Joomla! is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-supplied input. These issues include a cross-site scripting vulnerability and an SQL-injection vulnerability.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, execute malicious script code in a user's browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues are present in Joomla 1.5 prior to RC2.

64. Alice Messenger ActiveX Control Registry Key Manipulation Vulnerability
BugTraq ID: 25516
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25516
Summary:
Alice Messenger ActiveX control is prone to a registry-key-manipulation vulnerability.

Successfully exploiting this issue allows remote attackers to remotely edit arbitrary registry keys of unsuspecting users.

Alice Messenger 1 is vulnerable to this issue; other versions may also be affected.

65. PopTop PPTP Server GRE Packet Denial Of Service Vulnerability
BugTraq ID: 23886
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/23886
Summary:
PoPToP PPTP Server is prone to a denial-of-service vulnerability because it fails to adequately handle certain malformed packet data.

Attackers can exploit this issue to disconnect arbitrary PPTP connections.

PoPToP PPTP Server 1.3.4 is vulnerable; other versions may also be affected.

66. MKPortal Admin.PHP Authentication Bypass Vulnerability
BugTraq ID: 25515
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25515
Summary:
MKPortal is prone to an authentication-bypass vulnerability because it fails to restrict access to certain administrative functions.

Attackers can exploit this issue to gain unauthorized access to the application.

Versions prior to MKPortal 1.1.1 are vulnerable.

67. Ots Labs OtsTurntables M3U Local Buffer Overflow Vulnerability
BugTraq ID: 25514
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25514
Summary:
Ots Labs OtsTurntables is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input.

Attackers may be able to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

OtsTurntables 1.00 is vulnerable; other versions may also be affected.

68. Vim Feedkeys and Writefile Functions Remote Code Execution Vulnerabilities
BugTraq ID: 23725
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/23725
Summary:
Vim is prone to multiple vulnerabilities that permit a remote attacker to execute arbitrary code.

The attacker could exploit these issues by enticing a victim to load a malicious file. A successful exploit could allow arbitrary code to run within the context of the affected application.

69. Aztech DSL600EU Router Web Interface IP Spoofing Vulnerability
BugTraq ID: 25505
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25505
Summary:
The Aztech DSL600EU router is prone to an IP-spoofing vulnerability.

Attackers can leverage this issue to gain unauthorized access to the device's web interface. Successful attacks will compromise the device.

70. Virtual DJ M3U File Buffer Overflow Vulnerability
BugTraq ID: 25513
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25513
Summary:
Virtual DJ is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data.

Attackers may attempt to exploit this issue by coercing users to access malicious M3U playlist files.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the user running the affected application. This facilitates the remote compromise of affected computers.

Virtual DJ 5.0 is vulnerable; other versions may also be affected.

71. Virtual DJ M3U Local Buffer Overflow Vulnerability
BugTraq ID: 25512
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25512
Summary:
Virtual DJ is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input.

Attackers may be able to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Virtual DJ 5.0 is vulnerable; other versions may also be affected.

72. Yvora CMS Error_View.PHP SQL Injection Vulnerability
BugTraq ID: 25511
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25511
Summary:
Yvora is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Yvora 1.0 is vulnerable; other versions may also be affected.

73. Backup Manager FTP Server Information Disclosure Vulnerability
BugTraq ID: 25503
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25503
Summary:
Backup Manger is prone to an information-disclosure vulnerability affecting FTP access to the backup server.

Local attackers can exploit this issue to gain authentication credentials for the backup server. Successful attacks can compromise the backup server.

Versions prior to Backup Manager 0.6.3 are vulnerable.

74. Sun JSSE SSL/TLS Handshake Processing Denial Of Service Vulnerability
BugTraq ID: 24846
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24846
Summary:
The Sun JSSE (Java Secure Socket Extension) is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the computer, denying access to legitimate users.

75. Sun JDK JPG/BMP Parser Multiple Vulnerabilities
BugTraq ID: 24004
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24004
Summary:
Sun JDK is prone to a multiple vulnerabilities.

An attacker can exploit these issues to crash the affected application, effectively denying service. The attacker may also be able to execute arbitrary code, which may facilitate a compromise of the underlying system.

Sun JDK 1.5.0_07-b03 is vulnerable to these issues; other versions may also be affected.

76. Sun JavaDoc Tool Cross-Site Scripting Vulnerability
BugTraq ID: 24690
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24690
Summary:
Sun JavaDoc Tool is prone to a cross-site scripting vulnerability.

77. Sun Java RunTime Environment GIF Images Buffer Overflow Vulnerability
BugTraq ID: 22085
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/22085
Summary:
The Java Runtime Environment is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker may exploit this issue by enticing a victim into opening a maliciously crafted Java applet.

The attacker can exploit these issues to execute arbitrary code with the privileges of the victim. Failed exploit attempts will likely result in denial-of-service conditions.

This issue is being tracked by BugID: 6445518

78. Sun Solaris Special File System Local Denial of Service Vulnerability
BugTraq ID: 25510
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25510
Summary:
Sun Solaris is prone to a local denial-of-service vulnerability.

This issue stems from a NULL-pointer error caused by a function of the Special File System (SPECFS). Local attackers may exploit this issue to trigger kernel panics or system hangs, denying service to legitimate users.

Solaris 8, 9, and 10 SPARC and x86 are affected by this issue.

79. Weblogicnet Files_Dir Multiple Remote File Include Vulnerabilities
BugTraq ID: 25506
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25506
Summary:
Weblogicnet is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

80. Toms GÃ¤stebuch Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 25507
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25507
Summary:
Toms GÃ¤stebuch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Toms GÃ¤stebuch 1.00 is prone to these issues; other versions may also be affected.

81. MIT Kerberos 5 KAdminD Server SVCAuth_GSS_Validate Stack Buffer Overflow Vulnerability
BugTraq ID: 25534
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25534
Summary:
Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is prone to a stack-based buffer-overflow vulnerability because the software fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code with superuser privileges. A successful attack can result in the complete compromise of the application. Failed attempts will likely result in denial-of-service conditions.

Kerberos 5 'kadmind' 1.4 through 1.6.2 are vulnerable; third party applications using the affected RPC library are also affected.

82. ClamAV Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 25398
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25398
Summary:
ClamAV is prone to multiple denial-of-service vulnerabilities.

A successful attack may allow an attacker to crash the application and deny service to users.

Versions prior to ClamAV 0.91.2 are vulnerable to these issues.

83. Sun Cluster Software Unspecified Denial Of Service Vulnerability
BugTraq ID: 23638
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/23638
Summary:
Sun Cluster Software is prone to an unspecified denial-of-service vulnerability.

An attacker can exploit this issue on an affected computer to cause a denial-of-service condition.

These versions are vulnerable:

Sun Cluster Software 3.1 for Solaris 8,9, and 10
Sun Cluster 3.2 for Solaris 9 and 10 for SPARC and x86 platforms

84. id3lib Insecure Temporary File Creation Vulnerability
BugTraq ID: 25372
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25372
Summary:
The id3lib library creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symlink attacks, overwriting arbitrary files in the context of applications using the affected library.

Successfully mounting a symbolic-link attack may allow the attacker to overwrite or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

85. Vim HelpTags Command Remote Format String Vulnerability
BugTraq ID: 25095
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25095
Summary:
Vim is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.

A remote attacker may execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts may cause denial-of-service conditions.

Vim 6.4 and 7.1 are vulnerable; other versions may also be affected.

86. Linux Kernel Random Number Generator Local Denial of Service and Privilege Escalation Vulnerability
BugTraq ID: 25348
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25348
Summary:
The Linux kernel is prone to a local vulnerability that may result in a denial of service or privilege escalation. This issue stems from a stack-based overflow in kernel memory.

Successfully exploiting this issue allows local attackers to trigger kernel crashes, denying service to legitimate users. In certain circumstances, attackers may also gain elevated privileges. The attacker may require partial administrative access via granular assignments of superuser privileges.

Linux kernel versions prior to 2.6.22.3 are affected by this issue.

87. Linux Kernel AACRAID Driver Local Security Bypass Vulnerability
BugTraq ID: 25216
Remote: No
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25216
Summary:
The Linux kernel is prone to a security-bypass vulnerability.

A local attacker may exploit this vulnerability to issue IOCTL commands to AACRAID devices. This may lead to denial-of-service conditions, including data loss and computer crashes.

Versions prior to 2.6.23-rc2 are vulnerable.

88. Mozilla Firefox 2 Password Manager Cross-Site Information Disclosure Weakness
BugTraq ID: 21240
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/21240
Summary:
Mozilla Firefox is reportedly prone to an information-disclosure weakness because it fails to properly notify users of the automatic population of form fields in disparate URLs deriving from the same domain.

Exploiting this issue may allow attackers to obtain user credentials that have been saved in forms deriving from the same website where attack code resides. The most common manifestation of this condition would typically be in blogs or forums. This may allow attackers to access potentially sensitive information that would facilitate the success of phishing attacks.

Initial reports and preliminary testing indicate that this issue affects only Firefox 2.

89. Mozilla Foundation Products XPCOM Memory Corruption Vulnerability
BugTraq ID: 19197
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/19197
Summary:
Various Mozilla Foundation products are prone to a memory-corruption vulnerability.

This issue occurs because the applications fail to handle simultaneous XPCOM events that would cause the deletion of the timer object.

An attacker can exploit this issue to execute arbitrary code.

This issue was previously discussed in BID 19181 (Mozilla Multiple Products Remote Vulnerabilities). It has been assigned a separate BID because new information has become available.

90. Trend Micro ServerProtect RPCFN_SYNC_TASK Remote Integer Vulnerability
BugTraq ID: 25396
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25396
Summary:
Trend Micro ServerProtect is prone to an interger-overflow vulnerability that is exploitable over RPC.

Exploiting this issue allows attackers to execute arbitrary machine code with SYSTEM-level privileges and to completely compromise affected computers. Failed exploit attempts will result in a denial of service.

This issue was reported to affect ServerProtect 5.58 Build 1176 (Security Patch 3). Earlier versions may also be affected.

91. Mozilla Firefox/Thunderbird/SeaMonkey Chrome-Loaded About:Blank Script Execution Vulnerability
BugTraq ID: 25142
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25142
Summary:
Mozilla Firefox, Thunderbird, and SeaMonkey are prone to a vulnerability that allows JavaScript to execute with unintended privileges.

A malicious site may be able to cause the execution of a script with Chrome privileges. Attackers could exploit this issue to execute hostile script code with privileges that exceed those that were intended. Certain Firefox extensions may not intend 'about:blank' to execute script code with Chrome privileges.

NOTE: This issue was introduced by the fix for MFSA 2007-20.

92. Trend Micro ServerProtect Multiple RPC Remote Buffer Overflow Vulnerabilities
BugTraq ID: 25395
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25395
Summary:
Trend Micro ServerProtect is prone to multiple remote buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Nine buffer-overflow vulnerabilities affect the 'SpntSvc.exe' and agent services that listen on TCP ports 5168 and 3628. Attackers may exploit these vulnerabilities over RPC interfaces that are exposed by the vulnerable application.

Exploiting these issues allows attackers to execute arbitrary machine code with SYSTEM-level privileges and to completely compromise affected computers. Failed exploit attempts will result in a denial of service.

These issues were reported to affect ServerProtect 5.58 Build 1176 (Security Patch 3). Earlier versions may also be affected.

93. Multiple Browser URI Handlers Command Injection Vulnerabilities
BugTraq ID: 25053
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25053
Summary:
Multiple browsers are prone to vulnerabilities that let attackers inject commands through various protocol handlers.

Exploiting these issues allows remote attackers to pass and execute arbitrary commands and arguments through processes such as 'cmd.exe' by employing various URI handlers.

An attacker can exploit these issues to carry out various attacks by executing arbitrary commands on a vulnerable computer.

Exploiting these issues would permit remote attackers to influence command options that can be called through protocol handlers and to execute commands with the privileges of a user running the application. Successful attacks may result in a variety of consequences, including remote unauthorized access.

Mozilla Firefox 2.0.0.5, 3.0a6 and Netscape Navigator 9 are reported vulnerable to these issues. Other versions of these browsers and other vendors' browsers may also be affected.

94. Mozilla Firefox URLBar Null Byte File Remote Code Execution Vulnerability
BugTraq ID: 24447
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24447
Summary:
Mozilla Firefox is prone to a remote code-execution vulnerability because it fails to adequately sanitize user-supplied input.

Attackers may exploit this issue by enticing victims into visiting a malicious site and followings links with improper file extensions.

Successful exploits may allow an attacker to crash the application or execute arbitrary code in the context of the affected application. Other attacks are also possible.

95. IBM DB2 Universal Database Multiple Unspecified Vulnerabilities
BugTraq ID: 25339
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25339
Summary:
IBM DB2 is prone to multiple vulnerabilities that may allow an attacker to carry out various attacks.
Some of these issues may permit the attacker to completely compromise a vulnerable computer.

These issues affect DB2 9.1 and 8 running on all supported platforms.

96. OpenSSL PKCS Padding RSA Signature Forgery Vulnerability
BugTraq ID: 19849
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/19849
Summary:
OpenSSL is prone to a vulnerability that may allow an attacker to forge an RSA signature. The attacker may be able to forge a PKCS #1 v1.5 signature when an RSA key with exponent 3 is used.

An attacker may exploit this issue to sign digital certificates or RSA keys and take advantage of trust relationships that depend on these credentials, possibly posing as a trusted party and signing a certificate or key.

All versions of OpenSSL prior to and including 0.9.7j and 0.9.8b are affected by this vulnerability. Updates are available.

97. Mozilla Firefox, SeaMonkey, Camino, and Thunderbird Multiple Remote Vulnerabilities
BugTraq ID: 18228
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/18228
Summary:
The Mozilla Foundation has released thirteen security advisories specifying security vulnerabilities in Mozilla Firefox, SeaMonkey, Camino, and Thunderbird.

These vulnerabilities allow attackers to:

- execute arbitrary machine code in the context of the vulnerable application
- crash affected applications
- run JavaScript code with elevated privileges, potentially allowing the remote execution of machine code
- gain access to potentially sensitive information.

Other attacks may also be possible.

The issues described here will be split into individual BIDs as further information becomes available.

These issues are fixed in:
- Mozilla Firefox version 1.5.0.4
- Mozilla Thunderbird version 1.5.0.4
- Mozilla SeaMonkey version 1.0.2
- Mozilla Camino 1.0.2

98. Mozilla Firefox WYCIWYG:// URI Cache Zone Bypass Vulnerability
BugTraq ID: 24831
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24831
Summary:
Mozilla Firefox is prone to a cache-zone-bypass vulnerability because the application fails to properly block remote access to special internally generated URIs containing cached data.

Exploiting this issue allows remote attackers to access potentially sensitive information and to place markers with similar functionality to cookies onto targeted users' computers, regardless of cookie security settings. Information harvested in successful exploits may aid in further attacks.

Attackers may also potentially exploit this issue to perform cache-poisoning or URL-spoofing attacks.

This issue is being tracked by Mozilla's Bugzilla Bug 387333.

99. Mozilla Firefox 2.0.0.4 Multiple Remote Vulnerabilities
BugTraq ID: 24946
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/24946
Summary:
The Mozilla Foundation has released four security advisories specifying multiple vulnerabilities in Firefox 2.0.0.4.

These vulnerabilities allow attackers to:

- Execute arbitrary code
- Execute code with chrome privileges
- Perform cross-site scripting attacks
- Crash Firefox in a myriad of ways, with evidence of memory corruption.

Other attacks may also be possible.

100. Mozilla Firefox Document.Cookie Path Argument Denial of Service Vulnerability
BugTraq ID: 22879
Remote: Yes
Last Updated: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/22879
Summary:
Mozilla Firefox is prone to a remote denial-of-service vulnerability.

An attacker may exploit this vulnerability to cause Mozilla Firefox to crash, resulting in denial-of-service conditions.

Little is known regarding this vulnerability; this BID will be updated when more information is disclosed.

Mozilla Firefox 2.0.0.2 is prone to this issue; other versions may also be affected.

Attackers may be able to bypass cookie domain and path restrictions, but this has not been confirmed.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. China on hot seat over alleged hacks
By: Robert Lemos
Twice in two weeks, the nation has been taken to task for breaching other nations' systems, but officials continue to deny the accusations.
http://www.securityfocus.com/news/11485

2. Fraudsters focus on job sites
By: Robert Lemos
A Trojan horse mines Monster.com for personal details that could make fraudulent e-mail schemes more convincing, while evidence mounts that other job sites are also being attacked.
http://www.securityfocus.com/news/11484

3. Universities warned of Storm Worm attacks
By: Robert Lemos
Scanning a computer infected with the bot software could bring swift retribution, warns the response center for academic networks.
http://www.securityfocus.com/news/11482

4. Retro attack gets new life, worries browser makers
By: Robert Lemos
Researchers find that browsers and plug-ins could be exploited to turn a victim's computer into a door to the internal network. One study finds an attack could claim 100,000 IP addresses in three days.
http://www.securityfocus.com/news/11481

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Security Engineer, Denver
http://www.securityfocus.com/archive/77/478305

2. [SJ-JOB] Certification & Accreditation Engineer, Herndon
http://www.securityfocus.com/archive/77/478297

3. [SJ-JOB] Certification & Accreditation Engineer, Herndon
http://www.securityfocus.com/archive/77/478299

4. [SJ-JOB] Security Consultant, Dulles
http://www.securityfocus.com/archive/77/478292

5. [SJ-JOB] Sr. Security Engineer, Chantilly
http://www.securityfocus.com/archive/77/478295

6. [SJ-JOB] Security Consultant, London or Reading
http://www.securityfocus.com/archive/77/478296

7. [SJ-JOB] Sr. Security Analyst, London
http://www.securityfocus.com/archive/77/478300

8. [SJ-JOB] Jr. Security Analyst, Denver
http://www.securityfocus.com/archive/77/478287

9. [SJ-JOB] Sr. Security Analyst, Chantilly
http://www.securityfocus.com/archive/77/478288

10. [SJ-JOB] Quality Assurance, Mountain View
http://www.securityfocus.com/archive/77/478289

11. [SJ-JOB] Software Engineer, Mountain View
http://www.securityfocus.com/archive/77/478290

12. [SJ-JOB] Sales Engineer, Washington
http://www.securityfocus.com/archive/77/478092

13. [SJ-JOB] Certification & Accreditation Engineer, Any
http://www.securityfocus.com/archive/77/478090

14. [SJ-JOB] Security Consultant, WASHINGTON
http://www.securityfocus.com/archive/77/478091

15. [SJ-JOB] Security Consultant, Virtual
http://www.securityfocus.com/archive/77/478089

16. [SJ-JOB] Sr. Security Engineer, Wilmington
http://www.securityfocus.com/archive/77/478093

V. INCIDENTS LIST SUMMARY
---------------------------
1. Source port 445,80
http://www.securityfocus.com/archive/75/478641

VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. DeepSec IDSC 2007 Vienna Registration Now Open
http://www.securityfocus.com/archive/82/478546

2. Immunity Debugger v1.1
http://www.securityfocus.com/archive/82/478547

VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #357
http://www.securityfocus.com/archive/88/478141

2. Active Directory
http://www.securityfocus.com/archive/88/478140

3. Software smart-card emulation
http://www.securityfocus.com/archive/88/478049

4. NTFS default special permissions
http://www.securityfocus.com/archive/88/477517

VIII. SUN FOCUS LIST SUMMARY
----------------------------
1. Check Point SmartCenter in Non-Global Zone
http://www.securityfocus.com/archive/92/478322

IX. LINUX FOCUS LIST SUMMARY
----------------------------
1. mail antivirus
http://www.securityfocus.com/archive/91/477433

X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: WatchFire

https://www.watchfire.com/securearea/whitepapers.aspx?id=701700000008yka

News

Wednesday, September 05, 2007

SecurityFocus Newsletter #417

No comments:

WINDOWS CENTER

Blog Archive