WINDOWS CENTER: SecurityFocus Newsletter #440

SecurityFocus Newsletter #440
----------------------------------------

This issue is Sponsored by: HP

PCI Compliance Deadline Approaching - Are Your Web Applications Secure Enough?
In June 2008, the major credit card vendors will require compliance with requirement 6 of the PCI DSS, "Ensure that all web facing applications are protected against known attacks." Join HP Software and the former SPI Dynamics for this free webinar to learn how you can easily satisfy this requirement and build a powerful web application security program at the same time. During this event, you will receive the tools and knowledge to ensure your web applications comply with PCI requirements and block hackers.
https://h30406.www3.hp.com/campaigns/2008/events/sw-02-26-08/index.php?mcc=DAYA

SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as conveying topics of interest for our community. We are proud to offer content from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I. FRONT AND CENTER
1. Skills for the Future
2. Mother, May I?

II. BUGTRAQ SUMMARY
1. Joomla! and Mambo com_iomezun Component 'id' Parameter SQL Injection Vulnerability
2. OpenLDAP Multiple Remote Denial of Service Vulnerabilities
3. X.Org X Server 'TOG-CUP' Extension Local Privilege Escalation Vulnerability
4. X.Org X Server 'Xinput' Extension Local Privilege Escalation Vulnerability
5. Python ImageOP Module Multiple Integer Overflow Vulnerabilities
6. X.Org X 'Server X:1 -sp' Command Information Disclosure Vulnerability
7. X.Org X Server 'PassMessage' Request Local Privilege Escalation Vulnerability
8. libxml2 'xmlCurrentChar()' UTF-8 Parsing Remote Denial of Service Vulnerability
9. Rsync Use Chroot Insecure File Creation Vulnerability
10. PADL Nss_ldap Race Condition Security Vulnerability
11. Mozilla Firefox Jar URI Cross-Site Scripting Vulnerability
12. Rsync Daemon Excludes Multiple File Access Vulnerabilities
13. Libpng Library Remote Denial of Service Vulnerability
14. Mozilla Firefox and SeaMonkey Windows.Location Property HTTP Referer Header Spoofing Weakness
15. Mozilla Firefox Multiple Remote Unspecified Memory Corruption Vulnerabilities
16. Novell Client 'nwspool.dll' EnumPrinters RPC Request Buffer Overflow Vulnerability
17. AliBOARD Arbitrary File Upload Vulnerability
18. Opium OPI Server and CyanPrintIP Format String and Denial of Service Vulnerabilities
19. Larson Software Technology Network Print Server Format String And Buffer Overflow Vulnerability
20. Joomla! and Mambo com_comments Component 'id' Parameter SQL Injection Vulnerability
21. MercuryBoard Message Board 'message text' Preview Cross-Site Scripting Vulnerability
22. Loris Hotel Reservation System 'search.cgi' Cross-Site Scripting Vulnerability
23. cyan soft Multiple Applications Format String Vulnerability and Denial of Service Vulnerability
24. Simple Machine SMF Shoutbox Module 'sboxDB.php' HTML Injection Vulnerability
25. osCommerce Multiple Cross-Site Scripting Vulnerabilities
26. Rapid-Source Rapid-Recipe Component Multiple SQL Injection Vulnerabilities
27. Linux Kernel Multiple Prior to 2.6.24.1 Multiple Memory Access Vulnerabilities
28. Apple QuickTime 'QTPlugin.ocx' ActiveX Control Multiple Buffer Overflow Vulnerabilities
29. Linux Kernel Mmap_min_addr Local Security Bypass Vulnerability
30. Linux Kernel DO_COREDUMP Local Information Disclosure Vulnerability
31. Linux Kernel 2.6.22.16 Multiple Memory Corruption Vulnerabilities
32. Linux Kernel wait_task_stopped Local Denial of Service Vulnerability
33. Counter Strike Portals 'download' SQL Injection Vulnerability
34. Microsoft Object Linking and Embedding (OLE) Automation Heap Based Buffer Overflow Vulnerability
35. Linux Kernel Driver Fault Handler 'mmap.c' Local Denial of Service Vulnerability
36. HP-UX Get_System_Info Local Security Vulnerability
37. Microsoft Windows WebDAV Mini-Redirector Heap Overflow Vulnerability
38. HP System Management Homepage (SMH) for Linux, Windows, and HP-UX Cross Site Scripting Vulnerability
39. Microsoft Internet Explorer Property Method Remote Memory Corruption Vulnerability
40. RMSOFT Gallery System For XOOPS 'images.php' SQL Injection Vulnerability
41. ITN News Gadget 'short_title' Parameter Remote Code Execution Vulnerability
42. Microsoft Word Unspecified Memory Corruption Remote Code Execution Vulnerability
43. obedit Save Function HTML Injection Vulnerability
44. Joomla Pony Gallery Component Index.PHP SQL Injection Vulnerability
45. Apache mod_jk2 Host Header Multiple Stack Based Buffer Overflow Vulnerabilities
46. Microsoft Works File Converter Field Length Remote Code Execution Vulnerability
47. Microsoft Works File Converter Section Length Header Remote Heap Overflow Vulnerability
48. Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.11 Multiple Remote Vulnerabilities
49. SDL_image Invalid GIF File LWZ Minimum Code Size Remote Buffer Overflow Vulnerability
50. Apache Tomcat Parameter Processing Remote Information Disclosure Vulnerability
51. Mozilla Firefox chrome:// URI JavaScript File Request Information Disclosure Vulnerability
52. Microsoft IIS File Change Notification Local Privilege Escalation Vulnerability
53. Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
54. TCL/TK Tk Toolkit 'ReadImage()' GIF File Buffer Overflow Vulnerability
55. Microsoft Windows Active Directory LDAP Request Validation Remote Denial Of Service Vulnerability
56. Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability
57. Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
58. MPlayer 'demux_audio.c' Remote Stack Based Buffer Overflow Vulnerability
59. Mailman 'list templates' and 'list info' Multiple HTML Injection Vulnerabilities
60. WordPress 'xmlrpc.php' Post Edit Unauthorized Access Vulnerability
61. ClamAV Heap Corruption and Integer Overflow Vulnerabilities
62. Facebook Photo Uploader 'ImageUploader4.1.ocx' FileMask Method ActiveX Buffer Overflow Vulnerability
63. Adobe Flash Media Server and Connect Enterprise Server Multiple Unspecified Security Vulnerabilities
64. artmedic webdesign weblog Multiple Cross-Site Scripting Vulnerabilities
65. Beyond! Job Board 'FKeywords' Parameter Cross-Site Scripting Vulnerability
66. RPM Remote Print Manager Service Remote Buffer Overflow Vulnerability
67. MPlayer 'stream_cddb.c' Remote Buffer Overflow Vulnerability
68. MPlayer 'url.c' Remote Stack Based Buffer Overflow Vulnerability
69. Citrix Presentation Server Client WFICA.OCX ActiveX Component Heap Buffer Overflow Vulnerability
70. scponly Local Arbitrary Command Execution Weakness
71. MPlayer 'demux_mov.c' Remote Code Execution Vulnerability
72. Sentinel Protection Server/Keys Server Backslash Directory Traversal Vulnerability
73. Nagios Plugins SNMP GET Reply Remote Buffer Overflow Vulnerability
74. Nagios Plugins Location Header Remote Buffer Overflow Vulnerability
75. Apple Mac OS X v10.5.2 2008-001 Multiple Security Vulnerabilities
76. Gnumeric XLS HLINK Opcode Handling Remote Arbitrary Code Execution Vulnerability
77. VWar 'war.php' Multiple SQL Injection Vulnerabilities
78. duplicity 'ftpBackend' FTP Password Disclosure Vulnerability
79. Graphviz GIF File Remote Buffer Overflow Vulnerability
80. Microsoft Publisher Memory Index Code Execution Vulnerability
81. Microsoft Internet Information Services ASP Remote Code Execution Vulnerability
82. Microsoft Visual FoxPro FPOLE.OCX ActiveX Control Arbitrary Command Execution Vulnerability
83. Microsoft Internet Explorer HTML Rendering Remote Memory Corruption Vulnerability
84. Adobe Acrobat and Reader Multiple Arbitrary Code Execution and Security Vulnerabilities
85. Microsoft Publisher Invalid Memory Reference Remote Code Execution Vulnerability
86. Microsoft Office Execution Jump Memory Corruption Vulnerability
87. Microsoft Visual FoxPro FPOLE.OCX ActiveX Control Buffer Overflow Vulnerability
88. Microsoft Internet Explorer Argument Handling Memory Corruption Vulnerability
89. Microsoft Works File Converter Section Header Index Table Remote Code Execution Vulnerability
90. Microsoft Windows Vista DHCP Remote Denial Of Service Vulnerability
91. Cacti Multiple Input Validation Vulnerabilities
92. Sun Java RunTime Environment Read and Write Permission Multiple Privilege Escalation Vulnerabilities
93. teTeX DVI File Parsing Multiple Vulnerabilities
94. PHP Multiple Input Validation Vulnerabilities
95. T1lib intT1_Env_GetCompletePath Buffer Overflow Vulnerability
96. Linux Kernel 'isdn_common.c' Local Buffer Overflow Vulnerability
97. Linux Kernel TCP_Input.C Remote Denial of Service Vulnerability
98. Linux Kernel VFS Unauthorized File Access Vulnerability
99. X.Org X Server PCF Font Parser Buffer Overflow Vulnerability
100. X.Org X Server 'MIT-SHM' Local Privilege Escalation Vulnerability
III. SECURITYFOCUS NEWS
1. Federal agencies miss deadline on secure configs
2. Universities fend off phishing attacks
3. Antivirus firms, test labs to form standards group
4. Legitimate sites serving up stealthy attacks
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Penetration Engineer, Chambersburg
2. [SJ-JOB] Sr. Security Engineer, St. Louis
3. [SJ-JOB] Sr. Security Analyst, Pasadena
4. [SJ-JOB] Senior Software Engineer, Raleigh
5. [SJ-JOB] Information Assurance Engineer, Montgomery
6. [SJ-JOB] Application Security Engineer, Sydney
7. [SJ-JOB] Jr. Security Analyst, Arlington
8. [SJ-JOB] Security Consultant, Farmington
9. [SJ-JOB] Senior Software Engineer, Raleigh
10. [SJ-JOB] Security Consultant, San Francisco
11. [SJ-JOB] Technology Risk Consultant, Farmington
12. [SJ-JOB] Penetration Engineer, Wahiawa
13. [SJ-JOB] Technical Support Engineer, London
14. [SJ-JOB] Security Researcher, Cairo
15. [SJ-JOB] Principal Software Engineer, Raleigh
16. [SJ-JOB] Software Engineer, Alpharetta
17. [SJ-JOB] Disaster Recovery Coordinator, Lake Mary
18. [SJ-JOB] Security Product Marketing Manager, Santa Clara
19. [SJ-JOB] Penetration Engineer, St. Louis
20. [SJ-JOB] Security Researcher, Washington
21. [SJ-JOB] Technical Support Engineer, Singaopore
22. [SJ-JOB] Application Security Engineer, St. Louis
23. [SJ-JOB] Technical Support Engineer, Cupertino
24. [SJ-JOB] Sr. Security Analyst, Cleveland
V. INCIDENTS LIST SUMMARY
1. Possible Mail server compromise ?
VI. VULN-DEV RESEARCH LIST SUMMARY
VII. MICROSOFT FOCUS LIST SUMMARY
1. ExtraOutook 1.2 Released
2. SecurityFocus Microsoft Newsletter #380
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Skills for the Future
By Don Parker
A lot of the emails sent to me ask a basic question: Just how does one break into computer security or what skills should you learn to get that first security job. Lately though, I have been receiving many more queries on specifically how one can leverage an existing skill set to become an information-technology security analyst.
http://www.securityfocus.com/columnists/464

2. Mother May I?
By Mark Rasch
"Sure, you can have a cookie, but you may not."We all have had that discussion before -- either with our parents or our kids. A recent case from North Dakota reveals that the difference between those two concepts may lead not only to civil liability, but could land you in jail.
http://www.securityfocus.com/columnists/463

II. BUGTRAQ SUMMARY
--------------------
1. Joomla! and Mambo com_iomezun Component 'id' Parameter SQL Injection Vulnerability
BugTraq ID: 27748
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27748
Summary:
The Joomla! and Mambo 'com_iomezun' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

2. OpenLDAP Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 26245
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/26245
Summary:
OpenLDAP is prone to multiple remote denial-of-service vulnerabilities because of an incorrect NULL-termination issue and a double-free issue.

Attackers can exploit these issues to deny service to legitimate users.

Versions prior to OpenLDAP 2.3.39 are vulnerable.

3. X.Org X Server 'TOG-CUP' Extension Local Privilege Escalation Vulnerability
BugTraq ID: 27355
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27355
Summary:
X.Org X Server is prone to a local privilege-escalation vulnerability.

Attackers can exploit this issue to execute arbitrary code with superuser privileges or to crash the affected computer.

NOTE: This vulnerability was previously covered in BID 27336 (X.Org X Server Multiple Local Privilege Escalation and Information Disclosure Vulnerabilities), but has been given its own record to better document the issue.

4. X.Org X Server 'Xinput' Extension Local Privilege Escalation Vulnerability
BugTraq ID: 27351
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27351
Summary:
X.Org X Server is prone to a local privilege-escalation vulnerability.

Attackers can exploit this issue to execute arbitrary code with superuser privileges or to crash the affected computer.

5. Python ImageOP Module Multiple Integer Overflow Vulnerabilities
BugTraq ID: 25696
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/25696
Summary:
Python's imageop module is prone to multiple integer-overflow vulnerabilities because it fails to properly bounds-check user-supplied input to ensure that integer operations do not overflow.

To successfully exploit these issues, an attacker must be able to control the arguments to imageop functions. Remote attackers may be able to do this, depending on the nature of applications that use the vulnerable functions.

Attackers would likely submit invalid or specially crafted images to applications that perform imageop operations on the data.

A successful exploit may allow attacker-supplied machine code to run in the context of affected applications, facilitating the remote compromise of computers.

6. X.Org X 'Server X:1 -sp' Command Information Disclosure Vulnerability
BugTraq ID: 27356
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27356
Summary:
X.Org X Server is prone to a local information-disclosure vulnerability.

Attackers can exploit this issue to gain access to sensitive information that may lead to further attacks.

7. X.Org X Server 'PassMessage' Request Local Privilege Escalation Vulnerability
BugTraq ID: 27354
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27354
Summary:
X.Org X Server is prone to a local privilege-escalation vulnerability.

Attackers can exploit this issue to execute arbitrary code with superuser privileges. Successfully exploiting this issue will result in the complete compromise of an affected computer. Failed exploit attempts will likely crash the computer.

8. libxml2 'xmlCurrentChar()' UTF-8 Parsing Remote Denial of Service Vulnerability
BugTraq ID: 27248
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27248
Summary:
The libxml2 library is prone to a denial-of-service vulnerability because of an infinite-loop flaw.

Exploiting this issue allows remote attackers to cause denial-of-service conditions in the context of an application using the vulnerable library.

Versions prior to libxml2 2.6.31 are affected by this issue.

9. Rsync Use Chroot Insecure File Creation Vulnerability
BugTraq ID: 26638
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/26638
Summary:
The 'rsync' utility is prone to a security vulnerability because it creates files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. This may result in denial-of-service conditions; other attacks are also possible.

This issue affects versions prior to rsync 3.0.0pre6.

10. PADL Nss_ldap Race Condition Security Vulnerability
BugTraq ID: 26452
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/26452
Summary:
PADL 'nss_ldap' is prone to a race-condition security vulnerability; fixes are available.

An attacker may exploit this condition to obtain potentially sensitive data or to launch other attacks against an application that employs the vulnerable function.

The issue affects versions prior to PADL 'nss_ldap' Build 259.

11. Mozilla Firefox Jar URI Cross-Site Scripting Vulnerability
BugTraq ID: 26385
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/26385
Summary:
Mozilla Firefox is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks.

12. Rsync Daemon Excludes Multiple File Access Vulnerabilities
BugTraq ID: 26639
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/26639
Summary:
The 'rsync' daemon is prone to multiple file-access vulnerabilities because it fails to properly validate 'exclude'-type options set in the daemon's configuration file 'rsyncd.conf'.

Attackers can exploit these issues to read sensitive information or overwrite files with writable permissions.

13. Libpng Library Remote Denial of Service Vulnerability
BugTraq ID: 24000
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/24000
Summary:
The 'libpng' library is prone to a remote denial-of-service vulnerability because the library fails to handle malicious PNG files.

Successful exploits may allow remote attackers to cause denial-of-service conditions on computers running the affected library.

This issue affects 'libpng' 1.2.16 and prior versions.

14. Mozilla Firefox and SeaMonkey Windows.Location Property HTTP Referer Header Spoofing Weakness
BugTraq ID: 26589
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/26589
Summary:
Mozilla Firefox and SeaMonkey are prone to a weakness that allows an attacker to spoof HTTP Referer headers. This issue stems from a race condition in the affected application. The weakness arises because of a small timing difference when using a modal 'alert()' dialog, which allows users to generate fake HTTP Referer headers.

An attacker can exploit this issue to spoof HTTP referer headers. This may cause other security mechanisms that rely on this data to fail or to return misleading information.

This issue affects versions prior to Mozilla FireFox 2.0.0.10 and Mozilla SeaMonkey 1.1.7.

15. Mozilla Firefox Multiple Remote Unspecified Memory Corruption Vulnerabilities
BugTraq ID: 26593
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/26593
Summary:
The Mozilla Foundation has released a security advisory disclosing three unspecified memory-corruption vulnerabilities.

Successfully exploiting these issues may allow attackers to execute code, facilitating the compromise of affected computers. Failed exploit attempts will likely crash the application.

Versions prior to Mozilla Firefox 2.0.0.10 and Mozilla SeaMonkey 1.1.7 are vulnerable to these issues.

16. Novell Client 'nwspool.dll' EnumPrinters RPC Request Buffer Overflow Vulnerability
BugTraq ID: 27741
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27741
Summary:
Novell Client is prone to a buffer-overflow vulnerability.

A remote attacker may exploit this issue to execute arbitrary code with SYSTEM-level privileges, facilitating the compromise of affected computers. Failed exploit attempts will likely crash the application, denying service to legitimate users.

NOTE: This issue may have been caused by an incomplete patch for the vulnerability documented in BID 25092 ('Novell Client NWSPOOL.DLL Unspecified Buffer Overflow Vulnerability').

Novell Client 4.91 SP2 through SP4 are vulnerable; other versions may also be affected.

17. AliBOARD Arbitrary File Upload Vulnerability
BugTraq ID: 27737
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27737
Summary:
AliBOARD is prone to a vulnerability that lets an attacker upload and execute arbitrary script code in the context of the affected webserver process. The issue occurs because the application fails to sufficiently sanitize user-supplied input.

This issue affects the beta version of AliBOARD; other versions may also be vulnerable.

18. Opium OPI Server and CyanPrintIP Format String and Denial of Service Vulnerabilities
BugTraq ID: 27734
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27734
Summary:
Opium OPI Server and CyanPrintIP are prone to a denial-of-service vulnerability and a format-string vulnerability.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

These issues affect the following products:

Opium OPI Server 4.10.1028 and prior
cyanPrintIP Easy OPI 4.10.1028 and prior
cyanPrintIP Professional 4.10.1030 and prior
cyanPrintIP Workstation 4.10.936 and prior
cyanPrintIP Standard 4.10.940 and prior
cyanPrintIP Basic 4.10.1030 and prior

19. Larson Software Technology Network Print Server Format String And Buffer Overflow Vulnerability
BugTraq ID: 27732
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27732
Summary:
Larson Software Technology Network Print Server is prone to a format-string vulnerability and a buffer-overflow vulnerability.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

Network Print Server 9.4.2 build 105 and prior versions are affected.

20. Joomla! and Mambo com_comments Component 'id' Parameter SQL Injection Vulnerability
BugTraq ID: 27731
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27731
Summary:
The Joomla! and Mambo 'com_comments' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

21. MercuryBoard Message Board 'message text' Preview Cross-Site Scripting Vulnerability
BugTraq ID: 27730
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27730
Summary:
MercuryBoard Message Board is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

MercuryBoard Message Board 1.1.5 is vulnerable; other versions may also be affected.

22. Loris Hotel Reservation System 'search.cgi' Cross-Site Scripting Vulnerability
BugTraq ID: 27729
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27729
Summary:
Loris Hotel Reservation System is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Loris Hotel Reservation System 3.01 is vulnerable; other versions may also be affected.

23. cyan soft Multiple Applications Format String Vulnerability and Denial of Service Vulnerability
BugTraq ID: 27728
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27728
Summary:
Multiple cyan soft products are affected by a format-string vulnerability because they fail to adequately sanitize user-supplied input before passing it as the format-specifier to a formatted-printing function.

These applications are also affected by a denial-of-service vulnerability because they fail to adequately handle certain commands during the start of a connection.

Attackers can leverage these issues to execute arbitrary code in the context of the application or to terminate the application. Successful attacks will compromise the applications or deny access to legitimate users.

The following applications are affected:

Opium4 OPI Server 4.10.1028 and prior
cyanPrintIP Easy OPI 4.10.1030 and prior
cyanPrintIP Professional 4.10.1030 and prior
cyanPrintIP Workstation 4.10.836 and prior
cyanPrintIP Standard 4.10.940 and prior
cyanPrintIP Basic 4.10.1030 and prior

24. Simple Machine SMF Shoutbox Module 'sboxDB.php' HTML Injection Vulnerability
BugTraq ID: 27727
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27727
Summary:
SMF Shoutbox is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

SMF Shoutbox 1.16b is vulnerable; other versions may also be affected.

25. osCommerce Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 27726
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27726
Summary:
osCommerce is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Initial reports do not specify which versions of the application are vulnerable; we will update this BID as more information emerges.

26. Rapid-Source Rapid-Recipe Component Multiple SQL Injection Vulnerabilities
BugTraq ID: 27724
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27724
Summary:
Rapid-Recipe is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

27. Linux Kernel Multiple Prior to 2.6.24.1 Multiple Memory Access Vulnerabilities
BugTraq ID: 27704
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27704
Summary:
The Linux kernel is prone to multiple memory access vulnerabilities, including:

- A vulnerability that allows unauthorized users to read arbitrary memory locations.
- A vulnerability that allows unauthorized users to write to arbitrary memory locations.
- A vulnerability that allows local attackers to access resources in certain vservers.

An attacker can exploit these issues to read and write to arbitrary memory locations on the affected computer.

This issue affects versions prior to Linux Kernel 2.6.24.1.

28. Apple QuickTime 'QTPlugin.ocx' ActiveX Control Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 27769
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27769
Summary:
Apple QuickTime 'QTPlugin.ocx' ActiveX control is prone to multiple buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker may exploit these issues to execute arbitrary code within the context of application that invoked the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

These issues affect QuickTime 7.4.1 and prior versions.

29. Linux Kernel Mmap_min_addr Local Security Bypass Vulnerability
BugTraq ID: 26831
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/26831
Summary:
The Linux kernel is prone to a security-bypass vulnerability.

A local attacker may exploit this issue to bypass certain security restrictions, which may lead to other attacks.

Versions prior to Linux kernel 2.6.24-rc5 are vulnerable.

30. Linux Kernel DO_COREDUMP Local Information Disclosure Vulnerability
BugTraq ID: 26701
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/26701
Summary:
The Linux kernel is prone to an information-disclosure vulnerability.

Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks.

Versions of the Linux kernel prior to 2.6.24-rc4 are vulnerable.

31. Linux Kernel 2.6.22.16 Multiple Memory Corruption Vulnerabilities
BugTraq ID: 27686
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27686
Summary:
The Linux kernel is prone to multiple memory-corruption vulnerabilities due to insufficient range checking in certain fault handlers.

Local attackers could exploit these issues to cause denial-of-service conditions, bypass certain security restrictions, and potentially access sensitive information or gain elevated privileges.

These issues affect versions prior to 2.6.22.17.

32. Linux Kernel wait_task_stopped Local Denial of Service Vulnerability
BugTraq ID: 26477
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/26477
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability because it fails to properly handle certain process-exit conditions.

Attackers can exploit this issue to trigger kernel crashes, denying service to legitimate users.

Linux kernel versions prior to 2.6.23.8 as well as 2.6.24-rc1 and 2.6.24-rc1 are vulnerable.

33. Counter Strike Portals 'download' SQL Injection Vulnerability
BugTraq ID: 27747
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27747
Summary:
Counter Strike Portals is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

34. Microsoft Object Linking and Embedding (OLE) Automation Heap Based Buffer Overflow Vulnerability
BugTraq ID: 27661
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27661
Summary:
Microsoft Object Linking and Embedding (OLE) Automation is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized buffer.

An attacker could exploit this issue by enticing a victim to open a malicious web document.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

35. Linux Kernel Driver Fault Handler 'mmap.c' Local Denial of Service Vulnerability
BugTraq ID: 27705
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27705
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability because it fails to properly bounds-check certain fault handlers for device drivers.

Attackers can exploit this issue to trigger kernel crashes, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

Versions prior to Linux kernel 2.6.24.1 are vulnerable.

36. HP-UX Get_System_Info Local Security Vulnerability
BugTraq ID: 25469
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/25469
Summary:
HP-UX is prone to a local vulnerability that may result in a change of network parameters.

This issue affects HP-UX running the Ignite-UX or the DynRootDisk (DRD) 'get_system_info' command.

A local attacker can exploit this issue to change certain network parameters without notification. For this to be a security issue, the 'get_system_info' command may be required to run setuid; the command's default permissions are currently not known.

A successful exploit of this issue may result in denial-of-service conditions; other attacks may also be possible.

37. Microsoft Windows WebDAV Mini-Redirector Heap Overflow Vulnerability
BugTraq ID: 27670
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27670
Summary:
Microsoft Windows is prone to a heap-overflow vulnerability in the WebDAV Mini-Redirector component (also known as the Web Client service). This vulnerability may be triggered by a malicious WebDAV response. A successful exploit could let a remote attacker execute arbitrary code with SYSTEM privileges, completely compromising an affected computer.

To be affected, the Web Client service must be enabled on the computer. The Web Client service is disabled by default on Microsoft Windows Server 2003.

38. HP System Management Homepage (SMH) for Linux, Windows, and HP-UX Cross Site Scripting Vulnerability
BugTraq ID: 25953
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/25953
Summary:
HP System Management Homepage is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

These versions are affected:

HP System Management Homepage (SMH) prior to 2.1.10 for Linux and Windows
HP-UX B.11.11
HP-UX B.11.23
HP-UX B.11.31

39. Microsoft Internet Explorer Property Method Remote Memory Corruption Vulnerability
BugTraq ID: 27666
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27666
Summary:
Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability.

Remote attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

40. RMSOFT Gallery System For XOOPS 'images.php' SQL Injection Vulnerability
BugTraq ID: 27623
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27623
Summary:
RMSOFT Gallery System for XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects RMSOFT Gallery System 2.0; other versions may also be vulnerable.

41. ITN News Gadget 'short_title' Parameter Remote Code Execution Vulnerability
BugTraq ID: 27725
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27725
Summary:
ITN News Gadget is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

ITN News Gadget 1.06 is vulnerable; other versions may also be affected.

42. Microsoft Word Unspecified Memory Corruption Remote Code Execution Vulnerability
BugTraq ID: 27656
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27656
Summary:
Microsoft Word is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to open a malicious Word file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

43. obedit Save Function HTML Injection Vulnerability
BugTraq ID: 25703
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/25703
Summary:
The 'obedit' application is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

This issue affects obedit 3.03; other versions may also be affected.

44. Joomla Pony Gallery Component Index.PHP SQL Injection Vulnerability
BugTraq ID: 24972
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/24972
Summary:
The Joomla Pony Gallery component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Pony Gallery 1.5 is vulnerable to this issue; prior versions may also be affected.

45. Apache mod_jk2 Host Header Multiple Stack Based Buffer Overflow Vulnerabilities
BugTraq ID: 27752
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27752
Summary:
Apache mod_jk2 is prone to multiple stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers.

Successful exploits may allow attackers to execute arbitrary code in the context of a vulnerable application; failed attempts will likely cause denial-of-service conditions.

Versions prior to mod_jk2 2.0.4 are vulnerable.

NOTE: mod_jk2 is a legacy branch of mod_jk that is now deprecated; mod_jk is a currently supported module and is reportedly unaffected by these issues.

46. Microsoft Works File Converter Field Length Remote Code Execution Vulnerability
BugTraq ID: 27659
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27659
Summary:
Microsoft Works File Converter is prone to a remote code-execution vulnerability because it fails to adequately validate user-supplied input.

An attacker could exploit this issue by enticing a victim to open a malicious '.wps' file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

47. Microsoft Works File Converter Section Length Header Remote Heap Overflow Vulnerability
BugTraq ID: 27657
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27657
Summary:
Microsoft Works File Converter is prone to a remote heap-overflow vulnerability because it fails to adequately validate user-supplied input.

An attacker could exploit this issue by enticing a victim to open a malicious '.wps' file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

48. Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.11 Multiple Remote Vulnerabilities
BugTraq ID: 27683
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27683
Summary:
The Mozilla Foundation has released multiple security advisories specifying various vulnerabilities in Firefox 2.0.0.11 and prior versions.

Exploiting these issues can allow attackers to:

- remotely execute arbitrary code
- cause denial-of-service conditions
- hide contents of security warnings
- access sensitive information
- escape sandbox and execute scripts with chrome privileges
- inject script code into other sites and violate the same-origin policy

Other attacks are possible.

These issues are present in Firefox 2.0.0.11 and prior versions. Mozilla Thunderbird 2.0.0.9 and prior versions as well as SeaMonkey 1.1.7 and prior versions are also affected by many of these vulnerabilities.

49. SDL_image Invalid GIF File LWZ Minimum Code Size Remote Buffer Overflow Vulnerability
BugTraq ID: 27417
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27417
Summary:
The SDL_image library is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. The issue occurs when handling malformed GIF images.

Attackers can leverage this issue to execute arbitrary code in the context of an application using the library. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

Versions prior to SDL_image 1.2.7 are vulnerable.

50. Apache Tomcat Parameter Processing Remote Information Disclosure Vulnerability
BugTraq ID: 27703
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27703
Summary:
Apache Tomcat is prone to a remote information-disclosure vulnerability because the application fails to properly handle exceptions.

Remote attackers can exploit this issue to obtain potentially sensitive information.

The issue affects Tomcat 6.0.5 to 6.0.15.

51. Mozilla Firefox chrome:// URI JavaScript File Request Information Disclosure Vulnerability
BugTraq ID: 27406
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27406
Summary:
Mozilla Firefox is prone to an information-disclosure vulnerability because it fails to restrict access to local JavaScript, images and stylesheets files.

Attackers can exploit this issue to gain access to potentially sensitive information that could aid in further attacks.

Firefox 2.0.0.11 is vulnerable; other versions may also be affected.

NOTE: For an exploit to succeed, a user must have an addon installed that does not store its contents in a '.jar' file. The attacker would have to target a specific addon that uses "flat" packaging.

52. Microsoft IIS File Change Notification Local Privilege Escalation Vulnerability
BugTraq ID: 27101
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27101
Summary:
Microsoft Internet Information Service (IIS) is prone to a local privilege-escalation vulnerability that occurs when handling file change notifications.

A local attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.

53. Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
BugTraq ID: 27006
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27006
Summary:
Apache Tomcat is prone to a vulnerability that can allow third-party web applications to write files to arbitrary locations with the privileges of Tomcat.

This issue stems from an inadequate default security policy.

Attackers can leverage this issue to write or overwrite arbitrary log file data in unauthorized locations.

Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 are vulnerable.

54. TCL/TK Tk Toolkit 'ReadImage()' GIF File Buffer Overflow Vulnerability
BugTraq ID: 27655
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27655
Summary:
TCL/TK Tk Toolkit is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied GIF image data before copying it to an insufficiently sized buffer.

Successful exploits may allow attackers to execute arbitrary code in the context of applications that use the affected toolkit. Failed exploit attempts likely result in denial-of-service conditions.

Versions prior to TCL/TK 8.5.1 are vulnerable to this issue.

55. Microsoft Windows Active Directory LDAP Request Validation Remote Denial Of Service Vulnerability
BugTraq ID: 27638
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27638
Summary:
Microsoft Windows is prone to a remote denial-of-service vulnerability because Microsoft Active Directory and ADAM (Active Directory Application Mode) fail to handle specially crafted Lightweight Directory Access Protocol (LDAP) requests.

An attacker can exploit this issue to cause the affected application to stop responding, denying further service to legitimate users.

Note that an attacker requires valid logon credentials to exploit this issue on Windows Server 2003 and Windows XP.

This issue affects Active Directory on Microsoft Windows 2000 and Windows Server 2003. The issue affects ADAM when installed on Windows XP and Windows Server 2003.

56. Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability
BugTraq ID: 27237
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27237
Summary:
The Apache HTTP Server 'mod_status' module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Reportedly, attackers can also use this issue to redirect users' browsers to arbitrary locations, which may aid in phishing attacks.

The issue affects versions prior to Apache 2.2.7-dev, 2.0.62-dev, and 1.3.40-dev.

57. Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
BugTraq ID: 27706
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27706
Summary:
Apache Tomcat is prone to an information-disclosure vulnerability because it fails to adequately sanitize user-supplied data.

Attackers can exploit this issue to access potentially sensitive data that may aid in further attacks.

Versions prior to Apache Tomcat 6.0.16 and 5.5.26 are vulnerable.

NOTE: This vulnerability is caused by an incomplete fix for BID 25316 - Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities (CVE-2007-3385).

58. MPlayer 'demux_audio.c' Remote Stack Based Buffer Overflow Vulnerability
BugTraq ID: 27441
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27441
Summary:
MPlayer is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized buffer.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

MPlayer 1.0 rc2 is vulnerable; other versions may also be affected.

59. Mailman 'list templates' and 'list info' Multiple HTML Injection Vulnerabilities
BugTraq ID: 27630
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27630
Summary:
Mailman is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code could execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

These issues affect Mailman 2.1.9; prior versions may also be affected.

60. WordPress 'xmlrpc.php' Post Edit Unauthorized Access Vulnerability
BugTraq ID: 27669
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27669
Summary:
WordPress is prone to an unauthorized access vulnerability.

Attackers can exploit this issue to edit other users' posts. Successfully exploiting this issue may lead to other attacks.

This issue affects versions prior to WordPress 2.3.3.

61. ClamAV Heap Corruption and Integer Overflow Vulnerabilities
BugTraq ID: 27751
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27751
Summary:
ClamAV is prone to a heap-corruption vulnerability and an integer-overflow vulnerability.

Successfully exploiting these issues allows remote attackers to execute arbitrary machine code in the context of the affected application. This facilitates the remote compromise of affected computers. Failed exploit attempts likely result in application crashes.

ClamAV versions prior to 0.92.1 are affected by these issues.

62. Facebook Photo Uploader 'ImageUploader4.1.ocx' FileMask Method ActiveX Buffer Overflow Vulnerability
BugTraq ID: 27756
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27756
Summary:
Facebook Photo Uploader ActiveX control is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in denial-of-service conditions.

Image Uploader 5.0.14.0 is vulnerable; other versions may also be affected.

63. Adobe Flash Media Server and Connect Enterprise Server Multiple Unspecified Security Vulnerabilities
BugTraq ID: 27762
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27762
Summary:
Adobe Flash Media Server and Connect Enterprise Server are prone to multiple unspecified remote security vulnerabilities.

Very few details are known about these issues. We will update this BID as soon as more information becomes available.

Remote attackers can exploit these issues to gain SYSTEM-level privileges on affected computers. Successfully exploiting these issues will facilitate in the complete compromise of affected computers.

These issues affect the following:

Adobe Connect Enterprise Server 6 prior to SP3
Flash Media Server prior to 2.0.5.

64. artmedic webdesign weblog Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 27745
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27745
Summary:
artmedic webdesign weblog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

65. Beyond! Job Board 'FKeywords' Parameter Cross-Site Scripting Vulnerability
BugTraq ID: 27743
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27743
Summary:
Beyond! Job Board is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

66. RPM Remote Print Manager Service Remote Buffer Overflow Vulnerability
BugTraq ID: 27742
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27742
Summary:
RPM Remote Print Manager is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it into an insufficiently sized buffer.

An attacker may exploit this issue to execute arbitrary code or cause denial-of-service conditions.

The issue affects RPM Elite and Select 4.5.1.11 and prior versions.

67. MPlayer 'stream_cddb.c' Remote Buffer Overflow Vulnerability
BugTraq ID: 27765
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27765
Summary:
MPlayer is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized buffer.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

MPlayer 1.0 rc2 is vulnerable; other versions may also be affected.

68. MPlayer 'url.c' Remote Stack Based Buffer Overflow Vulnerability
BugTraq ID: 27766
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27766
Summary:
MPlayer is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized buffer.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

MPlayer 1.0 rc2 is vulnerable; other versions may also be affected.

69. Citrix Presentation Server Client WFICA.OCX ActiveX Component Heap Buffer Overflow Vulnerability
BugTraq ID: 21458
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/21458
Summary:
Citrix Presentation Server Client is prone to a heap buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

Presentation Server Client 9.200 is vulnerable; other versions may also be affected.

70. scponly Local Arbitrary Command Execution Weakness
BugTraq ID: 26900
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/26900
Summary:
The 'scponly' program is prone to a weakness that can allow attackers to execute arbitrary commands.

Attackers with scponly access can exploit this issue to bypass scponly security restrictions. Successful attacks could compromise affected computers.

This issue affects scponly 4.6; other versions may also be affected.

71. MPlayer 'demux_mov.c' Remote Code Execution Vulnerability
BugTraq ID: 27499
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27499
Summary:
MPlayer is prone to a remote code-execution vulnerability because it fails to sanitize certain 'MOV' file tags before using them to index heap memory.

An attacker can exploit this issue to execute arbitrary code, which can result in the complete compromise of the computer. Failed exploit attempts will result in a denial-of-service condition.

This issue affects MPlayer 1.0rc2; other versions may also be affected.

72. Sentinel Protection Server/Keys Server Backslash Directory Traversal Vulnerability
BugTraq ID: 27735
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27735
Summary:
Sentinel Protection Server and Keys Server are prone to a directory-traversal vulnerability because the software fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to access sensitive information that could aid in further attacks.

This issue affects Protection Server 7.4.1.0 and Keys Server 1.0.4; earlier versions may also be vulnerable.

NOTE: This issue may be caused by an incomplete security patch released in November 2007 that was documented in BID 26583 ('Sentinel Protection Server/Keys Server Directory Traversal Vulnerability').

73. Nagios Plugins SNMP GET Reply Remote Buffer Overflow Vulnerability
BugTraq ID: 26215
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/26215
Summary:
Nagios Plugins are prone to a remote buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of users running the affected software.

This issue affects Nagios Plugins 1.4.10; other versions may also be vulnerable.

74. Nagios Plugins Location Header Remote Buffer Overflow Vulnerability
BugTraq ID: 25952
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/25952
Summary:
Nagios Plugins are prone to a remote buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of users running the affected software.

This issue affects Nagios Plugins 1.4.9; other versions may also be vulnerable.

75. Apple Mac OS X v10.5.2 2008-001 Multiple Security Vulnerabilities
BugTraq ID: 27736
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27736
Summary:
Apple Mac OS X is prone to multiple security vulnerabilities.

These issues affect Mac OS X and various applications, including Launch Services, Mail, NFS, Parental Controls, and Terminal.

Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers.

Apple Mac OS X 10.5.1 and prior versions are vulnerable to these issues.

76. Gnumeric XLS HLINK Opcode Handling Remote Arbitrary Code Execution Vulnerability
BugTraq ID: 27536
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27536
Summary:
Gnumeric is prone to a vulnerability that lets remote attakers execute arbitrary code.

Attackers may exploit this issue to corrupt memory and execute machine code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

The issue affects Gnumeric 1.6.3; other versions may also be vulnerable.

77. VWar 'war.php' Multiple SQL Injection Vulnerabilities
BugTraq ID: 27772
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27772
Summary:
VWar is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

VWar 1.5.0 is vulnerable; other versions may also be affected.

78. duplicity 'ftpBackend' FTP Password Disclosure Vulnerability
BugTraq ID: 27771
Remote: No
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27771
Summary:
duplicity is prone to a password-disclosure vulnerability due to the 'ftpBackend' passing connection parameters to the ftp client in an insecure manner.

Attackers can exploit this issue to disclose passwords used for ftp connections.

This issue affects duplicity versions prior to 0.4.4;

79. Graphviz GIF File Remote Buffer Overflow Vulnerability
BugTraq ID: 27768
Remote: Yes
Last Updated: 2008-02-13
Relevant URL: http://www.securityfocus.com/bid/27768
Summary:
Graphviz is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. The issue occurs when handling malformed GIF images.

Attackers can leverage this issue to execute arbitrary code in the context of an application. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

This issue affects Graphviz 2.12; other versions may also be vulnerable.

80. Microsoft Publisher Memory Index Code Execution Vulnerability
BugTraq ID: 27740
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27740
Summary:
Microsoft Publisher is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to open a malicious Publisher file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

81. Microsoft Internet Information Services ASP Remote Code Execution Vulnerability
BugTraq ID: 27676
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27676
Summary:
Microsoft Internet Information Services (IIS) is prone to a remote code-execution vulnerability that can be exploited through malicious input to vulnerable ASP pages.

A successful exploit of this vulnerability could let remote attackers execute arbitrary code in the context of the Worker Process Identity, which by default has Network Service privileges.

82. Microsoft Visual FoxPro FPOLE.OCX ActiveX Control Arbitrary Command Execution Vulnerability
BugTraq ID: 25977
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/25977
Summary:
Microsoft Visual FoxPro ActiveX control is prone to a vulnerability that lets attackers execute arbitrary commands.

Successfully exploiting this issue allows remote attackers to execute arbitrary commands in the context of the application using the ActiveX control (typically Internet Explorer).

Microsoft Visual FoxPro 6.0 is vulnerable to this issue; other versions may also be affected.

83. Microsoft Internet Explorer HTML Rendering Remote Memory Corruption Vulnerability
BugTraq ID: 27668
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27668
Summary:
Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

84. Adobe Acrobat and Reader Multiple Arbitrary Code Execution and Security Vulnerabilities
BugTraq ID: 27641
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27641
Summary:
Adobe Acrobat and Reader are prone to multiple arbitrary remote code-execution and security vulnerabilities.

Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application. Other attacks are also possible.

Versions prior to Adobe Acrobat and Adobe Reader 8.1.2 are vulnerable to these issues.

85. Microsoft Publisher Invalid Memory Reference Remote Code Execution Vulnerability
BugTraq ID: 27739
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27739
Summary:
Microsoft Publisher is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to open a malicious Publisher file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

86. Microsoft Office Execution Jump Memory Corruption Vulnerability
BugTraq ID: 27738
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27738
Summary:
Microsoft Office is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to open a malicious Office file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

87. Microsoft Visual FoxPro FPOLE.OCX ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 25571
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/25571
Summary:
Microsoft Visual FoxPro ActiveX control is prone to a stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Microsoft Visual FoxPro 6.0 is vulnerable to this issue; other versions may also be affected.

88. Microsoft Internet Explorer Argument Handling Memory Corruption Vulnerability
BugTraq ID: 27689
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27689
Summary:
Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability.

89. Microsoft Works File Converter Section Header Index Table Remote Code Execution Vulnerability
BugTraq ID: 27658
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27658
Summary:
Microsoft Works File Converter is prone to a remote code-execution vulnerability because it fails to adequately validate user-supplied input.

An attacker could exploit this issue by enticing a victim to open a malicious '.wps' file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

90. Microsoft Windows Vista DHCP Remote Denial Of Service Vulnerability
BugTraq ID: 27634
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27634
Summary:
Microsoft Windows Vista is prone to a remote denial-of-service vulnerability because it fails to adequately handle specially crafted TCP/IP traffic.

Attackers can exploit this issue to cause affected computers to stop responding and to automatically restart. Successful attacks will deny service to legitimate users.

91. Cacti Multiple Input Validation Vulnerabilities
BugTraq ID: 27749
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27749
Summary:
Cacti is prone to multiple unspecified input-validation vulnerabilities, including:

- Multiple cross-site scripting vulnerabilities
- Multiple SQL-injection vulnerabilities
- An HTTP response splitting vulnerability.

Attackers may exploit these vulnerabilities to influence or misrepresent how web content is served, cached, or interpret, compromise the application, access or modify data, exploit vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user.

These issues affect Cacti 0.8.7a and prior.

92. Sun Java RunTime Environment Read and Write Permission Multiple Privilege Escalation Vulnerabilities
BugTraq ID: 27650
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27650
Summary:
Sun Java Runtime Environment is prone to multiple privilege-escalation vulnerabilities when running untrusted applications or applets.

Successful exploits will compromise arbitrary data and possibly the underlying computer.

These issues affect the following versions:

JDK and JRE 6 Update 1 and earlier
JDK and JRE 5.0 Update 13 and earlier.

93. teTeX DVI File Parsing Multiple Vulnerabilities
BugTraq ID: 26469
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/26469
Summary:
teTeX is prone to multiple vulnerabilities that include buffer-overflow errors and race-condition issues.

Attackers can exploit these issues to execute arbitrary code in the context of the affected application, cause denial-of-service conditions, or obtain potentially sensitive information.

94. PHP Multiple Input Validation Vulnerabilities
BugTraq ID: 19582
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/19582
Summary:
PHP is prone to multiple input-validation vulnerabilities. Successful exploits could allow an attacker to write files in unauthorized locations, cause a denial-of-service condition, and potentially execute code.

These issues are reported to affect PHP 4.4.3 and 5.1.4; other versions may also be vulnerable.

95. T1lib intT1_Env_GetCompletePath Buffer Overflow Vulnerability
BugTraq ID: 25079
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/25079
Summary:
T1lib is prone to a buffer-overflow vulnerability because the library fails to perform boundary checks before copying user-supplied data to insufficiently sized memory buffers.

An attacker can exploit this issue to execute arbitrary machine code in the context of applications that use the affected library. Failed exploit attempts will likely trigger crashes, denying service to legitimate users.

We do not know which versions of T1lib are affected.

96. Linux Kernel 'isdn_common.c' Local Buffer Overflow Vulnerability
BugTraq ID: 27497
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27497
Summary:
The Linux kernel is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to cause denial-of-service conditions. Given the nature of this issue, the attacker may also be able to execute arbitrary code, but this has not been confirmed.

This issue affects versions prior to Linux kernel 2.6.25.

97. Linux Kernel TCP_Input.C Remote Denial of Service Vulnerability
BugTraq ID: 26474
Remote: Yes
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/26474
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability because it fails to adequately sanitize specially crafted ACK responses.

Attackers can exploit this issue to cause a NULL-pointer dereference and crash the kernel.

Linux kernel versions prior to 2.6.23.8 as well as 2.6.24-rc1 and 2.6.24-rc1 are vulnerable.

98. Linux Kernel VFS Unauthorized File Access Vulnerability
BugTraq ID: 27280
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27280
Summary:
The Linux kernel is prone to an unauthorized file-access vulnerability affecting the VFS (Virtual Filesystem) module.

A local attacker can exploit this issue to access arbitrary files on the affected computer. Successfully exploiting this issue may grant the attacker elevated privileges on affected computers. Other attacks are also possible.

This issue affects kernel versions prior to 2.6.23.14.

99. X.Org X Server PCF Font Parser Buffer Overflow Vulnerability
BugTraq ID: 27352
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27352
Summary:
X.Org X Server is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Attackers can exploit this issue to execute arbitrary code with the privileges of the server. Failed attacks will cause denial-of-service conditions.

100. X.Org X Server 'MIT-SHM' Local Privilege Escalation Vulnerability
BugTraq ID: 27350
Remote: No
Last Updated: 2008-02-12
Relevant URL: http://www.securityfocus.com/bid/27350
Summary:
X.Org X Server is prone to a local privilege-escalation vulnerability.

Attackers can exploit this issue to execute arbitrary code with superuser privileges or to crash the affected computer.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Federal agencies miss deadline on secure configs
By: Robert Lemos
The U.S. government has made progress on moving to a standard configuration for Windows XP and Windows Vista systems, but work remains.
http://www.securityfocus.com/news/11505

2. Universities fend off phishing attacks
By: Robert Lemos
Online fraudsters send e-mail messages that masquerade as help-desk requests for usernames and passwords.
http://www.securityfocus.com/news/11504

3. Antivirus firms, test labs to form standards group
By: Robert Lemos
The makers of antivirus software as well as independent and media-sponsored testing labs have agreed to create an industry group to standardize on methods of evaluating anti-malware programs.
http://www.securityfocus.com/news/11502

4. Legitimate sites serving up stealthy attacks
By: Robert Lemos
The Random JS infection kit serves up malicious code that hides itself by attempting to compromise each visitor only once and using a different file name each time.
http://www.securityfocus.com/news/11501

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Penetration Engineer, Chambersburg
http://www.securityfocus.com/archive/77/487847

2. [SJ-JOB] Sr. Security Engineer, St. Louis
http://www.securityfocus.com/archive/77/487848

3. [SJ-JOB] Sr. Security Analyst, Pasadena
http://www.securityfocus.com/archive/77/487837

4. [SJ-JOB] Senior Software Engineer, Raleigh
http://www.securityfocus.com/archive/77/487839

5. [SJ-JOB] Information Assurance Engineer, Montgomery
http://www.securityfocus.com/archive/77/487841

6. [SJ-JOB] Application Security Engineer, Sydney
http://www.securityfocus.com/archive/77/487843

7. [SJ-JOB] Jr. Security Analyst, Arlington
http://www.securityfocus.com/archive/77/487844

8. [SJ-JOB] Security Consultant, Farmington
http://www.securityfocus.com/archive/77/487838

9. [SJ-JOB] Senior Software Engineer, Raleigh
http://www.securityfocus.com/archive/77/487845

10. [SJ-JOB] Security Consultant, San Francisco
http://www.securityfocus.com/archive/77/487846

11. [SJ-JOB] Technology Risk Consultant, Farmington
http://www.securityfocus.com/archive/77/487849

12. [SJ-JOB] Penetration Engineer, Wahiawa
http://www.securityfocus.com/archive/77/487831

13. [SJ-JOB] Technical Support Engineer, London
http://www.securityfocus.com/archive/77/487832

14. [SJ-JOB] Security Researcher, Cairo
http://www.securityfocus.com/archive/77/487836

15. [SJ-JOB] Principal Software Engineer, Raleigh
http://www.securityfocus.com/archive/77/487840

16. [SJ-JOB] Software Engineer, Alpharetta
http://www.securityfocus.com/archive/77/487842

17. [SJ-JOB] Disaster Recovery Coordinator, Lake Mary
http://www.securityfocus.com/archive/77/487818

18. [SJ-JOB] Security Product Marketing Manager, Santa Clara
http://www.securityfocus.com/archive/77/487820

19. [SJ-JOB] Penetration Engineer, St. Louis
http://www.securityfocus.com/archive/77/487821

20. [SJ-JOB] Security Researcher, Washington
http://www.securityfocus.com/archive/77/487833

21. [SJ-JOB] Technical Support Engineer, Singaopore
http://www.securityfocus.com/archive/77/487834

22. [SJ-JOB] Application Security Engineer, St. Louis
http://www.securityfocus.com/archive/77/487817

23. [SJ-JOB] Technical Support Engineer, Cupertino
http://www.securityfocus.com/archive/77/487819

24. [SJ-JOB] Sr. Security Analyst, Cleveland
http://www.securityfocus.com/archive/77/487835

V. INCIDENTS LIST SUMMARY
---------------------------
1. Possible Mail server compromise ?
http://www.securityfocus.com/archive/75/487488

VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. ExtraOutook 1.2 Released
http://www.securityfocus.com/archive/88/487947

2. SecurityFocus Microsoft Newsletter #380
http://www.securityfocus.com/archive/88/487816

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This issue is Sponsored by: HP

News

Wednesday, February 13, 2008

SecurityFocus Newsletter #440

No comments:

WINDOWS CENTER

Blog Archive