WINDOWS CENTER: SecurityFocus Newsletter #454

SecurityFocus Newsletter #454
----------------------------------------

This issue is sponsored by Industry Brains

See how EASY REMOTE SUPPORT can be. Try WebEx FREE!
DELIVER SUPPORT MORE EFFICIENTLY. Remotely Control Applications. Leap Securely through Firewalls!
http://newsletter.industrybrains.com/c?fe;1;78f53;21456;4d3;0;da4

SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as conveying topics of interest for our community. We are proud to offer content from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I. FRONT AND CENTER
1.Thinking Beyond the Ivory Towers
2.Click Crime
II. BUGTRAQ SUMMARY
1. vBulletin 'faq.php' SQL Injection Vulnerability
2. FireFTP 'MLSD' And 'LIST' Commands Directory Traversal Vulnerability
3. OpenSSL SSL_Get_Shared_Ciphers Buffer Overflow Vulnerability
4. Linux Kernel x86_64 ptrace Denial Of Service Vulnerability
5. Linux Kernel 'hrtimer_forward()' Local Denial of Service Vulnerability
6. Linux Kernel IPSec Fragmented ESP Packet Remote Denial of Service Vulnerability
7. Python PyLocale_strxfrm Function Remote Information Leak Vulnerability
8. Python ImageOP Module Multiple Integer Overflow Vulnerabilities
9. Python Repr() Function Remote Code Execution Vulnerability
10. microSSys CMS 'PAGES[$P]' Remote File Include Vulnerability
11. cPanel 'wwwact' Remote Privilege Escalation Vulnerability
12. bcoos 'file' Parameter Local File Include Vulnerability
13. testMaker Data Export Remote Information Disclosure Vulnerability
14. Red Hat Apache Directory Index Default Configuration Error
15. MeltingIce File System 'admin/adduser.php' Security Bypass Vulnerability
16. GNU/Gallery 'admin.php' Local File Include Vulnerability
17. LulieBlog Multiple Remote Vulnerabilities
18. Smeego Cookie Parameter Local File Include Vulnerability
19. OpenSSL Public Key Processing Denial of Service Vulnerability
20. OpenSSL SSLv2 Null Pointer Dereference Client Denial of Service Vulnerability
21. OpenSSL ASN.1 Structures Denial of Service Vulnerability
22. Mypicgallery 'admin/addUser.php' Security Bypass Vulnerability
23. PHP 5.2.4 and Prior Versions Multiple Vulnerabilities
24. PHP .Htaccess Safe_Mode and Open_Basedir Restriction-Bypass Vulnerability
25. PHP 5.2.3 and Prior Versions Multiple Vulnerabilities
26. eCMS Cookie Multiple Security Vulnerabilities
27. dotCMS 'search-results.dot' Cross Site Scripting Vulnerability
28. HP-UX 'useradd' Security Bypass Vulnerability
29. Stunnel Windows Unspecified Local Privilege Escalation Vulnerability
30. EntertainmentScript 'play.php' SQL Injection Vulnerability
31. GnuTLS Prior to 2.2.5 Multiple Remote Vulnerabilities
32. PeerCast 'getAuthUserPass' Multiple Buffer Overflow Vulnerabilities
33. MercuryBoard 'login.php' SQL Injection Vulnerability
34. AlkalinePHP 'thread.php' SQL Injection Vulnerability
35. Linux Kernel IEEE80211 HDRLen Remote Denial Of Service Vulnerability
36. Linux Kernel 'fcntl_setlk()' SMP Ordering Local Denial of Service Vulnerability
37. Linux Kernel Ptrace Local Privilege Escalation Vulnerability
38. Linux Kernel 'dnotify.c' Local Race Condition Vulnerability
39. Linux Kernel USB PWC Driver Local Denial Of Service Vulnerability
40. Linux Kernel CIFS Local Privilege Escalation Vulnerability
41. Linux Kernel HugeTLB Local Denial Of Service Vulnerability
42. Linux Kernel i965 Chipsets Insecure Batchbuffer Local Privilege Escalation Vulnerability
43. Django Login Form Cross-Site Scripting Vulnerability
44. DBMail Authentication Bypass Vulnerability
45. IBM Lotus Domino Web Server 'Accept Language' HTTP Header Buffer Overflow Vulnerability
46. Sun JDK JPG/BMP Parser Multiple Vulnerabilities
47. ClamAV 'libclamav/pe.c' UPACK File Heap Based Buffer Overflow Vulnerability
48. ClamAV 'libclamav/pe.c' WWPACK File Heap Based Buffer Overflow Vulnerability
49. ClamAV 0.92.1 Multiple Vulnerabilities
50. Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.12 Multiple Remote Vulnerabilities
51. Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.11 Multiple Remote Vulnerabilities
52. Mozilla Firefox/SeaMonkey JavaScript Garbage Collector Memory Corruption Vulnerability
53. Mozilla Firefox chrome:// URI JavaScript File Request Information Disclosure Vulnerability
54. Mozilla Firefox Action Prompt Delay Security Mechanism Bypass Vulnerability
55. Mozilla Thunderbird External-Body MIME Remote Heap Buffer Overflow Vulnerability
56. Apache Tomcat Cross-Site Scripting Vulnerability
57. Apache HTTP Server Tomcat Directory Traversal Vulnerability
58. Apache Tomcat Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
59. Apache Tomcat Cal2.JSP Cross-Site Scripting Vulnerability
60. Apache Tomcat AJP Connector Information Disclosure Vulnerability
61. Apache Tomcat Information Disclosure Vulnerability
62. PhpGedView Unspecified Remote Vulnerability
63. PeerCast HandshakeHTTP Multiple Buffer Overflow Vulnerabilities
64. libxslt XSL File Processing Buffer Overflow Vulnerability
65. Lincoln D. Stein Crypt::CBC Perl Module Weak Ciphertext Vulnerability
66. Open Motif libUil Diag_issue_diagnostic Buffer Overflow Vulnerability
67. Computer Associates ARCserve Backup 'caloggerd' and 'xdr' Functions Multiple Remote Vulnerabilities
68. JFreeChart Multiple HTML Injection Vulnerabilities
69. Oracle January 2007 Security Update Multiple Vulnerabilities
70. Jabber Studio JabberD Remote Denial Of Service Vulnerability
71. Multiple Web Browser BMP Partial Palette Information Disclosure and Denial Of Service Vulnerability
72. VMware Server 1.0.5 and Workstation 6.0.3 Multiple Vulnerabilities
73. Zlib Compression Library Buffer Overflow Vulnerability
74. Microsoft Jet DataBase Engine MDB File Parsing Remote Buffer Overflow Vulnerability
75. PhotoStockPlus Uploader Tool ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
76. Sun Java RunTime Environment GIF Images Buffer Overflow Vulnerability
77. Subdreamer CMS Comments Function Security Bypass Vulnerability
78. Apache Tomcat Accept-Language Cross Site Scripting Vulnerability
79. Apache Tomcat Simultaneous Directory Listing Denial Of Service Vulnerability
80. Apache HTTP Server Mod_Status Cross-Site Scripting Vulnerability
81. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
82. Apache mod_ssl SSLCipherSuite Restriction Bypass Vulnerability
83. Apache Tomcat SingleSignOn Remote Information Disclosure Vulnerability
84. Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerability
85. Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability
86. Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scripting Vulnerability
87. Apache Geronimo Multiple Input Validation Vulnerabilities
88. Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability
89. Perl Unicode '\Q...\E' Quoting Construct Regular Expression Buffer Overflow Vulnerability
90. Sun Solaris TCP SYN Flooding Remote Denial of Service Vulnerability
91. Debian OpenSSL Package Random Number Generator Weakness
92. Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
93. Apache Tomcat WebDav Remote Information Disclosure Vulnerability
94. Apache Mod_AutoIndex.C Undefined Charset Cross-Site Scripting Vulnerability
95. Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability
96. Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities
97. Sun Java Web Start Unauthorized Access Vulnerability
98. OpenSSL PKCS Padding RSA Signature Forgery Vulnerability
99. OpenSSL Insecure Protocol Negotiation Weakness
100. libvorbis Multiple Remote Vulnerabilities
III. SECURITYFOCUS NEWS
1. Legal experts wary of MySpace hacking charges
2. Admins warned of brute-force SSH attacks
3. Groups warn travelers to limit laptop data
4. Patches pose significant risk, researchers say
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Incident Handler, Wilmington
2. [SJ-JOB] Application Security Architect, New York
3. [SJ-JOB] Security Consultant, Open Location
4. [SJ-JOB] Director, Information Security, South Florida
5. [SJ-JOB] Sales Engineer, New York
6. [SJ-JOB] Application Security Engineer, Ottawa
7. [SJ-JOB] Senior Software Engineer, Alpharetta
8. [SJ-JOB] Security Engineer, Torrance
9. [SJ-JOB] Security Engineer, Reston
10. [SJ-JOB] Security Auditor, New York
11. [SJ-JOB] Security Auditor, Washington
12. [SJ-JOB] Security Auditor, chicago
13. [SJ-JOB] Sales Engineer, Philadelphia
14. [SJ-JOB] Security Auditor, San Francisco
15. [SJ-JOB] Application Security Engineer, Dallas
16. [SJ-JOB] Security Consultant, Long Island
17. [SJ-JOB] Application Security Engineer, Washington
18. [SJ-JOB] Security Consultant, New York
19. [SJ-JOB] Application Security Engineer, Los Angeles
20. [SJ-JOB] Security Consultant, chicago
21. [SJ-JOB] Security System Administrator, San Jose
22. [SJ-JOB] Application Security Engineer, San Jose
23. [SJ-JOB] Sr. Security Engineer, Arlington
24. [SJ-JOB] Security Architect, Schaumburg
25. [SJ-JOB] Information Assurance Analyst, London
26. [SJ-JOB] Forensics Engineer, Chicago
27. [SJ-JOB] Manager, Information Security, Chicago
28. [SJ-JOB] Incident Handler, Amsterdam
29. [SJ-JOB] Threat Analyst, Columbia
30. [SJ-JOB] Security Consultant, Toronto
31. [SJ-JOB] Application Security Engineer, Denver
32. [SJ-JOB] CISO, Central Europe
V. INCIDENTS LIST SUMMARY
1. Weird SSH attack last night and this morning (still ongoing)
VI. VULN-DEV RESEARCH LIST SUMMARY
VII. MICROSOFT FOCUS LIST SUMMARY
1. Binding Windows Services to Specific Addresses Only
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
1. CfP hack.lu 2008
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1.Thinking Beyond the Ivory Towers
By Dave Aitel
In the information-security industry, there are clear and vast gaps in the way academia interacts with professional researchers. While these gaps will be filled in due time, their existence means that security professionals outside the hallowed halls of colleges and universities need to be aware of the differences in how researchers and professionals think.

http://www.securityfocus.com/columnists/472

2. Click Crime
By Mark Rasch
It has long been a crime not only to commit an illegal act, but also to attempt -- or conspire with others -- to commit one.

http://www.securityfocus.com/columnists/471

II. BUGTRAQ SUMMARY
--------------------
1. vBulletin 'faq.php' SQL Injection Vulnerability
BugTraq ID: 29293
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29293
Summary:
vBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

vBulletin 3.7.0 Gold is vulnerable; other versions may also be affected.

2. FireFTP 'MLSD' And 'LIST' Commands Directory Traversal Vulnerability
BugTraq ID: 29289
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29289
Summary:
FireFTP is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to write arbitrary files to locations outside of the FTP client's current directory. This could help the attacker launch further attacks.

FireFTP 0.97.1 is vulnerable; other versions may also be affected.

3. OpenSSL SSL_Get_Shared_Ciphers Buffer Overflow Vulnerability
BugTraq ID: 20249
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/20249
Summary:
OpenSSL is prone to a buffer-overflow vulnerability because the library fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Successfully exploiting this issue may result in the execution of arbitrary machine code in the context of applications that use the affected library. Failed exploit attempts may crash applications, denying service to legitimate users.

4. Linux Kernel x86_64 ptrace Denial Of Service Vulnerability
BugTraq ID: 29086
Remote: No
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29086
Summary:
The Linux kernel is prone to a denial-of-service vulnerability when process traces are performed on 64-bit computers.

Local attackers can leverage the issue to crash the kernel and deny service to legitimate users.

5. Linux Kernel 'hrtimer_forward()' Local Denial of Service Vulnerability
BugTraq ID: 29294
Remote: No
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29294
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability because it fails to properly handle certain large timer expiry values.

Attackers can exploit this issue to cause the application to enter an infinite loop, denying service to legitimate users.

This issue affects the Linux kernel 2.6.21-rc4 and prior version srunning on 64-bit architectures.

6. Linux Kernel IPSec Fragmented ESP Packet Remote Denial of Service Vulnerability
BugTraq ID: 29081
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29081
Summary:
The Linux Kernel is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected computer, denying service to legitimate users.

NOTE: This issue occurs on computers that have NetScreen firewalls or Cisco PIX installed.

7. Python PyLocale_strxfrm Function Remote Information Leak Vulnerability
BugTraq ID: 23887
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/23887
Summary:
Python applications that use the 'PyLocale_strxfrm' function are prone to an information leak.

Exploiting this issue allows remote attackers to read portions of memory.

Python 2.4.4-2 and 2.5 are confirmed vulnerable.

8. Python ImageOP Module Multiple Integer Overflow Vulnerabilities
BugTraq ID: 25696
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/25696
Summary:
Python's imageop module is prone to multiple integer-overflow vulnerabilities because it fails to properly bounds-check user-supplied input to ensure that integer operations do not overflow.

To successfully exploit these issues, an attacker must be able to control the arguments to imageop functions. Remote attackers may be able to do this, depending on the nature of applications that use the vulnerable functions.

Attackers would likely submit invalid or specially crafted images to applications that perform imageop operations on the data.

A successful exploit may allow attacker-supplied machine code to run in the context of affected applications, facilitating the remote compromise of computers.

9. Python Repr() Function Remote Code Execution Vulnerability
BugTraq ID: 20376
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/20376
Summary:
Python is prone to a remote code-execution vulnerability because the application fails to properly handle UTF-32/UCS-4 strings.

Exploiting this issue allows remote attackers to execute arbitrary machine code with the privileges of the Python application.

10. microSSys CMS 'PAGES[$P]' Remote File Include Vulnerability
BugTraq ID: 29278
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29278
Summary:
MicroSSys CMS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

MicroSSys CMS 1.5 is vulnerable; other versions may also be affected.

11. cPanel 'wwwact' Remote Privilege Escalation Vulnerability
BugTraq ID: 29277
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29277
Summary:
cPanel is prone to a remote privilege-escalation vulnerability because of an unspecified error.

Successfully exploiting this issue allows remote attackers to gain administrative privileges to the affected application and execute malicious PHP code in the context of the webserver process. This may facilitate a compromise of the webserver and the underlying system; other attacks are also possible.

12. bcoos 'file' Parameter Local File Include Vulnerability
BugTraq ID: 29275
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29275
Summary:
The 'bcoos' program is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to include local scripts in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks.

This issue affects bcoos 1.0.13; other versions may also be affected.

13. testMaker Data Export Remote Information Disclosure Vulnerability
BugTraq ID: 29273
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29273
Summary:
testMaker is prone to a remote information-disclosure vulnerability because of an unspecified error in the data export functionality.

Exploiting this issue will allow attackers to obtain potentially sensitive information that may aid in further attacks.

The issue affects versions prior to testMaker 3.0p10.

14. Red Hat Apache Directory Index Default Configuration Error
BugTraq ID: 8898
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/8898
Summary:
The Red Hat Apache configuration may allow an attacker to view directory listings. The problem is reported to present itself when an attacker issues an HTTP GET request to a vulnerable server containing '//' characters, evading the rule desgined to prevent Apache from displaying directory listings with a request for '/'. The server is reported to disclose directory listings even when autoindex for the root directory has been disabled and a default welcome page is supposed to be displayed.

Successful exploits will disclose sensitive information that may be useful in further attacks against the system.

This problem has been reported to exist in Apache 2.0.40 shipped with Red Hat Linux 9.0. Other versions may be affected as well.

15. MeltingIce File System 'admin/adduser.php' Security Bypass Vulnerability
BugTraq ID: 29271
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29271
Summary:
MeltingIce File System is prone to a security-bypass vulnerability because it fails to properly validate user credentials before performing certain actions.

Exploiting this issue may allow an attacker to bypass certain security restrictions and add arbitrary users to the application. This may allow attackers to gain unauthorized access to the application and may aid in further attacks.

The issue affects MeltingIce File System 1.0 and prior versions.

16. GNU/Gallery 'admin.php' Local File Include Vulnerability
BugTraq ID: 29270
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29270
Summary:
GNU/Gallery is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.

The issue affects GNU/Gallery 1.1.1.0 and prior versions.

17. LulieBlog Multiple Remote Vulnerabilities
BugTraq ID: 29269
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29269
Summary:
LulieBlog is prone to multiple remote vulnerabilities, including an SQL-injection issue and multilple authentication-bypass issues.

Exploiting these issues could allow an attacker to compromise the application, upload arbitrary files, execute arbitrary server-side script code, access or modify data, or exploit latent vulnerabilities in the underlying database.

LulieBlog 1.0.2 is vulnerable; other versions may also be affected.

18. Smeego Cookie Parameter Local File Include Vulnerability
BugTraq ID: 29264
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29264
Summary:
Smeego is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.

The issue affects Smeego 1.0; other versions may also be vulnerable.

19. OpenSSL Public Key Processing Denial of Service Vulnerability
BugTraq ID: 20247
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/20247
Summary:
OpenSSL is prone to a denial-of-service vulnerability because it fails to validate the lengths of public keys being used.

An attacker can exploit this issue to crash an affected server using OpenSSL.

20. OpenSSL SSLv2 Null Pointer Dereference Client Denial of Service Vulnerability
BugTraq ID: 20246
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/20246
Summary:
OpenSSL is prone to a denial-of-service vulnerability.

A malicious server could cause a vulnerable client application to crash, effectively denying service.

21. OpenSSL ASN.1 Structures Denial of Service Vulnerability
BugTraq ID: 20248
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/20248
Summary:
OpenSSL is prone to a denial-of-service vulnerability.

An attacker may exploit this issue to cause applications that use the vulnerable library to consume excessive CPU and memory resources and crash, denying further service to legitimate users.

22. Mypicgallery 'admin/addUser.php' Security Bypass Vulnerability
BugTraq ID: 29272
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29272
Summary:
Mypicgallery is prone to a security-bypass vulnerability because it fails to properly validate user credentials before performing certain actions.

Exploiting this issue may allow an attacker to bypass certain security restrictions and gain administrative access to the application. This will compromise the application and may aid in further attacks.

The issue affects Mypicgallery 1.0; other versions may also be vulnerable.

23. PHP 5.2.4 and Prior Versions Multiple Vulnerabilities
BugTraq ID: 26403
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/26403
Summary:
PHP 5.2.4 and prior versions are prone to multiple security vulnerabilities. Successful exploits could allow an attacker to bypass security restrictions, cause a denial-of-service condition, and potentially execute code.

24. PHP .Htaccess Safe_Mode and Open_Basedir Restriction-Bypass Vulnerability
BugTraq ID: 24661
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/24661
Summary:
PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to write files in unauthorized locations.

These vulnerabilities would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code, with the 'safe_mode' and 'open_basedir' restrictions assumed to isolate the users from each other.

This issue is reported to affect PHP 5.2.3 and 4.4.7; previous versions may also be vulnerable.

25. PHP 5.2.3 and Prior Versions Multiple Vulnerabilities
BugTraq ID: 25498
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/25498
Summary:
PHP 5.2.3 and prior versions are prone to multiple security vulnerabilities. Successful exploits could allow an attacker to bypass security restrictions, cause a denial-of-service condition, and potentially execute code.

26. eCMS Cookie Multiple Security Vulnerabilities
BugTraq ID: 29268
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29268
Summary:
eCMS is prone to multiple security vulnerabilities, including a security-bypass issue and an SQL-injection issue.

Exploiting these issues may allow an attacker to bypass certain security restrictions and gain administrative access to the application. The attacker can also exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This will compromise the application and may aid in further attacks.

These issues affect eCMS 0.4.2 and prior versions.

27. dotCMS 'search-results.dot' Cross Site Scripting Vulnerability
BugTraq ID: 29287
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29287
Summary:
dotCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

28. HP-UX 'useradd' Security Bypass Vulnerability
BugTraq ID: 29286
Remote: No
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29286
Summary:
HP-UX is prone to a security-bypass vulnerability because the software fails to properly restrict access to certain functionality.

Local attackers can exploit this issue to bypass certain security restrictions and carry out some unauthorized tasks. This may lead to various attacks.

This issue affects the following versions of HP-UX:

HP-UX B.11.11
HP-UX B.11.23
HP-UX B.11.31

29. Stunnel Windows Unspecified Local Privilege Escalation Vulnerability
BugTraq ID: 29285
Remote: No
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29285
Summary:
Stunnel is prone to a local privilege-escalation vulnerability caused by an unspecified error when the application runs as a Windows service.

An attacker can exploit this issue to execute arbitrary code with LocalSystem privileges. Successfully exploiting this issue may result in the complete compromise of affected computers.

The issue affects versions prior to Stunnel 4.23.

30. EntertainmentScript 'play.php' SQL Injection Vulnerability
BugTraq ID: 29284
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29284
Summary:
EntertainmentScript is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

EntertainmentScript 1.4.0 is vulnerable; other versions may also be affected.

31. GnuTLS Prior to 2.2.5 Multiple Remote Vulnerabilities
BugTraq ID: 29292
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29292
Summary:
GnuTLS is prone to multiple remote vulnerabilities, including:

- A buffer-overflow vulnerability
- Multiple denial-of-service vulnerabilities

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the affected application, denying service to legitimate users.

GnuTLS versions prior to 2.2.5 are vulnerable.

32. PeerCast 'getAuthUserPass' Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 28986
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28986
Summary:
PeerCast is prone to multiple buffer-overflow vulnerabilities because it fails to adequately bounds-check user-supplied input before copying it to an insufficiently sized buffer.

Successfully exploiting these issues will allow an attacker to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely crash the application.

These issues affect PeerCast 0.1218; other versions may also be affected.

33. MercuryBoard 'login.php' SQL Injection Vulnerability
BugTraq ID: 29280
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29280
Summary:
MercuryBoard is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MercuryBoard 1.1.5 is vulnerable; other versions may also be affected.

34. AlkalinePHP 'thread.php' SQL Injection Vulnerability
BugTraq ID: 29281
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29281
Summary:
AlkalinePHP is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AlkalinePHP 00.80.00 beta is vulnerable; other versions may also be affected.

35. Linux Kernel IEEE80211 HDRLen Remote Denial Of Service Vulnerability
BugTraq ID: 26337
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/26337
Summary:
The Linux kernel ieee80211 driver is prone to a remote denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to crash a victim computer, effectively denying service.

Versions prior to Linux kernel 2.6.22.11 are vulnerable.

36. Linux Kernel 'fcntl_setlk()' SMP Ordering Local Denial of Service Vulnerability
BugTraq ID: 29076
Remote: No
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29076
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to trigger kernel crashes, denying service to legitimate users.

Versions prior to Linux kernel 2.6.25.2 and 2.4.36.4 are vulnerable.

37. Linux Kernel Ptrace Local Privilege Escalation Vulnerability
BugTraq ID: 25774
Remote: No
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/25774
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability.

Exploiting this issue may allow local attackers to gain elevated privileges, facilitating the complete compromise of affected computers.

Versions of Linux kernel prior to 2.4.35.3 and 2.6.22.7 are vulnerable to this issue.

38. Linux Kernel 'dnotify.c' Local Race Condition Vulnerability
BugTraq ID: 29003
Remote: No
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29003
Summary:
The Linux kernel is prone to a local race-condition vulnerability.

A local attacker may exploit this issue to crash the computer or to gain elevated privileges on the affected computer.

39. Linux Kernel USB PWC Driver Local Denial Of Service Vulnerability
BugTraq ID: 25504
Remote: No
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/25504
Summary:
The Linux Kernel is prone to a local denial-of-service vulnerability because it fails to properly free resources of USB PWC devices.

Attackers can exploit this issue to block the USB subsystem, resulting in denial-of-service conditions.

Versions prior to 2.6.22.6 are vulnerable.

40. Linux Kernel CIFS Local Privilege Escalation Vulnerability
BugTraq ID: 25672
Remote: No
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/25672
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability.

An attacker could exploit this issue to execute arbitrary code with the privileges of the victim.

41. Linux Kernel HugeTLB Local Denial Of Service Vulnerability
BugTraq ID: 25904
Remote: No
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/25904
Summary:
The Linux Kernel is prone to a local denial-of-service vulnerability caused by a design error in the 'hugetlbfs' handling procedures.

This issue affects kernel 2.6.x versions prior to 2.6.18.

42. Linux Kernel i965 Chipsets Insecure Batchbuffer Local Privilege Escalation Vulnerability
BugTraq ID: 25263
Remote: No
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/25263
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability.

Exploiting this issue may allow local attackers to gain elevated privileges, facilitating the complete compromise of affected computers.

Versions of Linux kernel prior to 2.6.22.2 are vulnerable to this issue.

43. Django Login Form Cross-Site Scripting Vulnerability
BugTraq ID: 29209
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29209
Summary:
Django is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Django 0.91, 0.95, and 0.96.

44. DBMail Authentication Bypass Vulnerability
BugTraq ID: 28849
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28849
Summary:
DBMail is prone to a vulnerability that may let attackers authenticate without a valid password in some configurations. This could let an attacker gain unauthorized access to emails stored by the application.

45. IBM Lotus Domino Web Server 'Accept Language' HTTP Header Buffer Overflow Vulnerability
BugTraq ID: 29310
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29310
Summary:
IBM Lotus Domino Server Web server is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application which usually runs with LocalSystem privileges. Failed exploit attempts will result in a denial of service.

The issue affects versions 6.0, 6.5, 7.0, 8.0.

46. Sun JDK JPG/BMP Parser Multiple Vulnerabilities
BugTraq ID: 24004
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/24004
Summary:
Sun JDK is prone to a multiple vulnerabilities.

An attacker can exploit these issues to crash the affected application, effectively denying service. The attacker may also be able to execute arbitrary code, which may facilitate a compromise of the underlying system.

Sun JDK 1.5.0_07-b03 is vulnerable to these issues; other versions may also be affected.

47. ClamAV 'libclamav/pe.c' UPACK File Heap Based Buffer Overflow Vulnerability
BugTraq ID: 28756
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28756
Summary:
ClamAV is prone to a heap-based buffer-overflow vulnerability because it fails to properly verify user-supplied data.

Successful exploits of this vulnerability can allow remote attackers to execute arbitrary machine code in the context of applications using the vulnerable 'libclamav' library. Failed exploit attempts will likely cause denial-of-service conditions.

ClamAV 0.92 and 0.92.1 are vulnerable to this issue; other versions may also be affected.

48. ClamAV 'libclamav/pe.c' WWPACK File Heap Based Buffer Overflow Vulnerability
BugTraq ID: 28798
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28798
Summary:
ClamAV is prone to a heap-based buffer-overflow vulnerability because it fails to properly verify user-supplied data.

ClamAV 0.92.1 is vulnerable to this issue; other versions may also be affected.

49. ClamAV 0.92.1 Multiple Vulnerabilities
BugTraq ID: 28784
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28784
Summary:
ClamAV is prone to multiple vulnerabilities, including buffer-overflow and denial-of-service issues.

Successful exploits allow remote attackers to cause denial-of-service conditions or potentially to execute arbitrary machine code in the context of applications that use the vulnerable library.

Versions prior to ClamAV 0.93 are vulnerable.

50. Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.12 Multiple Remote Vulnerabilities
BugTraq ID: 28448
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28448
Summary:
The Mozilla Foundation has released multiple security advisories specifying various vulnerabilities in Firefox 2.0.0.12 and prior versions.

Exploiting these issues can allow attackers to:

- steal authentication credentials
- obtain potentially sensitive information
- violate the same-origin policy
- execute scripts with elevated privileges
- cause denial-of-service conditions
- potentially execute arbitrary code
- perform cross-site request-forgery attacks

Other attacks are possible.

These issues are present in Firefox 2.0.0.12 and prior versions. Many of these issues are present in Mozilla Thunderbird 2.0.0.12 and prior versions as well as SeaMonkey 1.1.8 and prior versions.

UPDATE: Versions of Mozilla Thunderbird prior to 2.0.0.14 are affected by issues described in MFSA 2008-14 and MFSA 2008-15.

51. Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.11 Multiple Remote Vulnerabilities
BugTraq ID: 27683
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/27683
Summary:
The Mozilla Foundation has released multiple security advisories specifying various vulnerabilities in Firefox 2.0.0.11 and prior versions.

Exploiting these issues can allow attackers to:

- remotely execute arbitrary code
- cause denial-of-service conditions
- hide contents of security warnings
- access sensitive information
- escape sandbox and execute scripts with chrome privileges
- inject script code into other sites and violate the same-origin policy

Other attacks are possible.

These issues are present in Firefox 2.0.0.11 and prior versions. Mozilla Thunderbird 2.0.0.9 and prior versions as well as SeaMonkey 1.1.7 and prior versions are also affected by many of these vulnerabilities.

52. Mozilla Firefox/SeaMonkey JavaScript Garbage Collector Memory Corruption Vulnerability
BugTraq ID: 28818
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28818
Summary:
The Mozilla Foundation has released a security advisory disclosing a memory-corruption vulnerability that affects Mozilla Firefox, SeaMonkey, and potentially Thunderbird.

The vulnerability stems from an unspecified error in the JavaScript garbage collector.

Attackers may exploit this issue to crash a vulnerable application or potentially execute arbitrary code in the context of the application.

The issue affects Mozilla Firefox 2.0.0.13 and Mozilla SeaMonkey 1.1.9. Note that Mozilla Thunderbird shares the browser engine with Firefox and may also be vulnerable when JavaScript is enabled in emails.

53. Mozilla Firefox chrome:// URI JavaScript File Request Information Disclosure Vulnerability
BugTraq ID: 27406
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/27406
Summary:
Mozilla Firefox is prone to an information-disclosure vulnerability because it fails to restrict access to local JavaScript, images and stylesheets files.

Attackers can exploit this issue to gain access to potentially sensitive information that could aid in further attacks.

Firefox 2.0.0.11 is vulnerable; other versions may also be affected.

NOTE: For an exploit to succeed, a user must have an addon installed that does not store its contents in a '.jar' file. The attacker would have to target a specific addon that uses "flat" packaging.

54. Mozilla Firefox Action Prompt Delay Security Mechanism Bypass Vulnerability
BugTraq ID: 24293
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/24293
Summary:
Mozilla Firefox is prone to a security-mechanism-bypass vulnerability because it fails to adequately prevent action prompt options from being selected before a delay timer has finished counting down.

Attackers can exploit this issue to initiate downloads or run files on a user's computer without their knowledge or consent. Successful attacks can allow arbitrary code to run with the privileges of the user running the application.

This issue is reportedly being tracked by Bugzilla Bug 376473.

Firefox 2.0.0.11 and prior versions are vulnerable.

55. Mozilla Thunderbird External-Body MIME Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 28012
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28012
Summary:
Mozilla Thunderbird is prone to a remote heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data.

Successfully exploiting this issue may allow remote attackers to execute arbitrary machine code in the context of the vulnerable application; failed exploit attempts will likely crash the application. This may facilitate the remote compromise of affected computers.

The issue affects versions prior to Mozilla Thunderbird 2.0.0.12.

56. Apache Tomcat Cross-Site Scripting Vulnerability
BugTraq ID: 28481
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28481
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

57. Apache HTTP Server Tomcat Directory Traversal Vulnerability
BugTraq ID: 22960
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/22960
Summary:
Apache HTTP servers running with the Tomcat servlet container are prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows attackers to access arbitrary files in the Tomcat webroot. This can expose sensitive information that could help the attacker launch further attacks.

Versions in the 5.0 series prior to 5.5.22 and in the 6.0 series prior to 6.0.10 are vulnerable.

58. Apache Tomcat Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 24058
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/24058
Summary:
Apache Tomcat's documentation web application includes a sample application that is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following Tomcat versions are affected:

4.0.0 to 4.0.6
4.1.0 to 4.1.36
5.0.0 to 5.0.30
5.5.0 to 5.5.23
6.0.0 to 6.0.10

59. Apache Tomcat Cal2.JSP Cross-Site Scripting Vulnerability
BugTraq ID: 25531
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/25531
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

This issue affects Apache Tomcat 4.1.31; other versions may also be affected.

60. Apache Tomcat AJP Connector Information Disclosure Vulnerability
BugTraq ID: 28477
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28477
Summary:
Apache Tomcat is prone to an information-disclosure vulnerability because of an error in the AJP connector that causes inaccurate chunk lengths to be delivered by 'send_body_chunks' AJP messages.

Attackers can leverage this issue to obtain potentially sensitive data that could aid in other attacks.

Tomcat 5.5.15 is vulnerable; other versions may also be affected.

61. Apache Tomcat Information Disclosure Vulnerability
BugTraq ID: 19106
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/19106
Summary:
Apache Tomcat is prone to an information-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to reveal a complete directory listing from any directory. Information obtained may aid in further attacks. Reports indicate that this issue may also allow attackers to obtain the source code of script files.

Apache Tomcat 5.028, 5.5.23, 5.5.9, and 5.5.7 are vulnerable to this issue; other versions may also be affected.

Novell GroupWise Mobile Server 1.0 or other versions bundled with Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2 ship with an affected version of Tomcat and are vulnerable as well.

62. PhpGedView Unspecified Remote Vulnerability
BugTraq ID: 28978
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/28978
Summary:
PhpGedView is prone to an unspecified vulnerability.

Successful exploits allow remote attackers to execute arbitrary script code with the privileges of the webserver user. This may facilitate the remote compromise of the underlying operating system.

Versions prior to PhpGedView 4.1.5 are vulnerable to this issue.

63. PeerCast HandshakeHTTP Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 26899
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/26899
Summary:
PeerCast is prone to multiple buffer-overflow vulnerabilities because it fails to adequately bounds-check user-supplied input before copying it to an insufficiently sized buffer.

These issues affect PeerCast 0.12.17, SVN 334 and prior versions.

64. libxslt XSL File Processing Buffer Overflow Vulnerability
BugTraq ID: 29312
Remote: Yes
Last Updated: 2008-05-21
Relevant URL: http://www.securityfocus.com/bid/29312
Summary:
The 'libxslt' library is prone to a buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user running an application that relies on the affected library. Failed exploit attempts will likely result in denial-of-service conditions.

This issue affects libxslt versions 1.1.23 and prior.

65. Lincoln D. Stein Crypt::CBC Perl Module Weak Ciphertext Vulnerability
BugTraq ID: 16802
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/16802
Summary:
Crypt::CBC is prone to a weak-ciphertext vulnerability. This issue is due to a flaw in its creation of IVs (Initialization Vectors) for ciphers with a blocksize larger than 8.

This issue results in the creation of ciphertext that contains bytes encrypted with a constant null IV. This ciphertext is prone to differential cryptanalysis, aiding attackers in compromising the plaintext of encrypted data.

The level of difficulty attackers may face trying to exploit this flaw is currently unknown, but data encrypted with vulnerable versions of Crypt::CBC should be considered insecure.

Versions prior to Crypt::CBC 2.17 are vulnerable to this issue if they use the 'RandomIV' header style.

66. Open Motif libUil Diag_issue_diagnostic Buffer Overflow Vulnerability
BugTraq ID: 15684
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/15684
Summary:
A buffer-overflow vulnerability affects libUil (User Interface Language); applications that link to the library are vulnerable.

Successful exploits may result in a remote compromise or local privilege escalation, depending on the affected application linked to the library.

Open Motif is derived from the original Motif code maintained by the Open Group. Motif is likely also vulnerable.

This issue was originally reported in BID 15678 (Open Motif libUil Buffer Overflow Vulnerabilities); it is now being assigned a new record.

67. Computer Associates ARCserve Backup 'caloggerd' and 'xdr' Functions Multiple Remote Vulnerabilities
BugTraq ID: 29283
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29283
Summary:
Computer Associates ARCserve Backup is prone to multiple remote vulnerabilities:

- An arbitrary-file-overwrite vulnerability
- A stack-based buffer-overflow vulnerability.

An attacker can exploit these issues to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting these issues will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.

68. JFreeChart Multiple HTML Injection Vulnerabilities
BugTraq ID: 26752
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/26752
Summary:
JFreeChart is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code could execute in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

These issues affect JFreeChart 1.0.8; other versions may be affected as well.

69. Oracle January 2007 Security Update Multiple Vulnerabilities
BugTraq ID: 22083
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/22083
Summary:
Oracle has released a Critical Patch Update advisory for January 2007 to address these vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by these issues as well.

The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. Various levels of authorization are needed to leverage some of the issues, but other issues do not require any authorization. The most severe of the vulnerabilities could possibly expose affected computers to complete compromise.

70. Jabber Studio JabberD Remote Denial Of Service Vulnerability
BugTraq ID: 17155
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/17155
Summary:
Jabber Studio 'jabberd' is affected by a remote denial-of-service vulnerability. This issue is due to the application's failure to properly handle malformed network messages.

An attacker may leverage this issue by causing the affected server to crash, denying service to legitimate users.

71. Multiple Web Browser BMP Partial Palette Information Disclosure and Denial Of Service Vulnerability
BugTraq ID: 27826
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/27826
Summary:
Firefox and Opera browsers are prone to a vulnerability that can result in information disclosure or a denial of service.

An attacker can exploit this issue to harvest sensitive information that may be used to launch further attacks or to crash the affected application, denying service to legitimate users.

Mozilla Firefox 2.0.0.11 and Opera 9.50 Beta are affected.

72. VMware Server 1.0.5 and Workstation 6.0.3 Multiple Vulnerabilities
BugTraq ID: 28276
Remote: No
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/28276
Summary:
VMware Server and Workstation are prone to an unauthorized-access vulnerability and multiple privilege-escalation and denial-of-service vulnerabilities.

Successful attacks will compromise the guest operating system, the host application, and possibly the underlying computer.

The following are vulnerable:

VMware Server 1.0.4 and earlier
VMware Workstation 6.0.2 and earlier

73. Zlib Compression Library Buffer Overflow Vulnerability
BugTraq ID: 14162
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/14162
Summary:
Zlib is prone to a buffer-overflow vulnerability because the application fails to properly validate input data before using it in a memory copy operation.

In certain circumstances, malformed input data during decompression may cause a memory buffer to overflow. This may result in denial-of-service conditions or may allow remote code to execute in the context of applications that use the affected library.

74. Microsoft Jet DataBase Engine MDB File Parsing Remote Buffer Overflow Vulnerability
BugTraq ID: 26468
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/26468
Summary:
Microsoft Jet DataBase Engine is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data.

Remote attackers can exploit this issue to execute arbitrary machine code in the context of a user running the application. Successful exploits will compromise the affected application and possibly the underlying computer. Failed attacks will likely cause denial-of-service conditions.

NOTE: Further details report that attackers are using malicious Word files to load specially crafted MDB files. Microsoft has released a knowledge base article (950627) documenting this attack vector.

This issue does not affect Windows Server 2003 Service Pack 2, Windows XP Service Pack 3, Windows XP x64 edition Server Pack 2, Windows Vista, Windows Vista Service Pack 1 and Windows Server 2008 because they run a version of the Jet Database Engine that isn't vulnerable.

This issue does affect the Jet Database Engine, Microsoft Word 2000 Service Pack 3, Microsoft Word 2002 Service Pack 3, Microsoft Word 2003 Service Pack 2, Microsoft Word 2003 Service Pack 3, Microsoft Word 2007, and Microsoft Word 2007 Service Pack 1 on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1.

75. PhotoStockPlus Uploader Tool ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
BugTraq ID: 29279
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29279
Summary:
An ActiveX control in the image uploader tool of StockPhotoPlus is prone to multiple stack-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

These issues occur in 'PSPUploader.ocx'.

76. Sun Java RunTime Environment GIF Images Buffer Overflow Vulnerability
BugTraq ID: 22085
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/22085
Summary:
The Java Runtime Environment is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker may exploit this issue by enticing a victim into opening a maliciously crafted Java applet.

The attacker can exploit these issues to execute arbitrary code with the privileges of the victim. Failed exploit attempts will likely result in denial-of-service conditions.

This issue is being tracked by BugID: 6445518

77. Subdreamer CMS Comments Function Security Bypass Vulnerability
BugTraq ID: 26595
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/26595
Summary:
Subdreamer CMS is prone to a security-bypass vulnerability because it fails to properly validate user credentials before performing certain actions.

A successful attack will allow an unauthorized attacker to post arbitrary comments when anonymous posting is disabled.

This issue affects Subdreamer CMS 2.4.3.1 and prior versions.

78. Apache Tomcat Accept-Language Cross Site Scripting Vulnerability
BugTraq ID: 24524
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/24524
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to inject HTML and script code into the browser of an unsuspecting victim. The attacker may then steal cookie-based authentication credentials and launch other attacks.

This issue may have been reported as part of the vulnerabilities described in BID 24058 (Apache Tomcat Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities). Symantec has not been able to confirm this information. We will update this BID when more information emerges.

79. Apache Tomcat Simultaneous Directory Listing Denial Of Service Vulnerability
BugTraq ID: 15325
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/15325
Summary:
A remote denial-of-service vulnerability affects Apache Tomcat because the application fails to efficiently handle multiple requests for directory listings.

When this issue is triggered, the application fails to serve further requests to legitimate users until the Tomcat processes have been restarted.

80. Apache HTTP Server Mod_Status Cross-Site Scripting Vulnerability
BugTraq ID: 24645
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/24645
Summary:
The Apache HTTP Server mod_status module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

81. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
BugTraq ID: 23192
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/23192
Summary:
The 'mod_perl' module is prone to a remote denial-of-service vulnerability.

Successful exploits may allow remote attackers to cause denial-of-service conditions on the webserver running the mod_perl module.

82. Apache mod_ssl SSLCipherSuite Restriction Bypass Vulnerability
BugTraq ID: 11360
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/11360
Summary:
Apache 2.x mod_ssl is reported prone to a restriction-bypass vulnerability. This issue presents itself when mod_ssl is configured to be used with the 'SSLCipherSuite' directive in a 'Directory' or 'Location' context. Reportedly, this vulnerability allows a client to use any cipher suite allowed by the virtual host configuration regardless of cipher suites specified for a specific directory. This can allow an attacker to bypass security policies and use potentially weaker encryption types than allowed.

Apache 2.0.35 to 2.0.52 are reported vulnerable to this issue.

83. Apache Tomcat SingleSignOn Remote Information Disclosure Vulnerability
BugTraq ID: 27365
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/27365
Summary:
Apache Tomcat is prone to a remote information-disclosure vulnerability because the application fails to properly restrict access to sensitive information.

Remote attackers can exploit this issue to obtain confidential user-authentication credentials.

The issue affects Tomcat 5.5.20; prior versions may also be vulnerable.

84. Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerability
BugTraq ID: 26838
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/26838
Summary:
Apache is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

This issue affects the following:

- The 'mod_imagemap' module in Apache 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, and 2.2.0

- The 'mod_imap' module in Apache 1.3.39, 1.3.37, 1.3.36, 1.3.35, 1.3.34, 1.3.33, 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, and 1.3.0.

85. Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability
BugTraq ID: 24476
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/24476
Summary:
Apache Tomcat is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

86. Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scripting Vulnerability
BugTraq ID: 24475
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/24475
Summary:
Apache Tomcat Manager and Host Manager are prone to a cross-site scripting vulnerability because the applications fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

87. Apache Geronimo Multiple Input Validation Vulnerabilities
BugTraq ID: 16260
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/16260
Summary:
Apache Geronimo is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.

A successful exploit could allow an attacker to compromise the application, access or modify data, or steal cookie-based authentication credentials. The attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

88. Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability
BugTraq ID: 24147
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/24147
Summary:
Apache HTTP server running with the Tomcat JK Web Server Connector is prone to a security-bypass vulnerability because it decodes request URLs multiple times.

Exploiting this issue allows attackers to access restricted files in the Tomcat web directory. This can expose sensitive information that could help attackers launch further attacks.

This issue is present in versions prior to Apache Tomcat JK Connector 1.2.23.

89. Perl Unicode '\Q...\E' Quoting Construct Regular Expression Buffer Overflow Vulnerability
BugTraq ID: 28928
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/28928
Summary:
Perl is prone to a buffer-overflow vulnerability because it fails to sufficiently bounds-check user-supplied input.

Successfully exploiting this issue may allow attackers to execute arbitrary machine code in the context of Perl applications using regular expressions in a vulnerable manner. This facilitates the remote compromise of affected computers. Failed exploits can cause denial-of-service conditions.

Perl 5.8.8 is vulnerable to this issue; other versions may also be affected.

NOTE: This issue may be related to BID 26350 ('Perl Unicode Regular Expression Buffer Overflow Vulnerability').

90. Sun Solaris TCP SYN Flooding Remote Denial of Service Vulnerability
BugTraq ID: 29089
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29089
Summary:
Sun Solaris is prone to a remote denial-of-service vulnerability that occurs because of its TCP implementation.

A remote attacker can exploit this issue to cause the system to hang or to degrade its performance, denying service to legitimate users.

91. Debian OpenSSL Package Random Number Generator Weakness
BugTraq ID: 29179
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29179
Summary:
The Debian OpenSSL package is prone to a random-number-generator weakness.

Attackers can exploit this issue to predict random data used to generate encryption keys by certain applications. This may help attackers compromise encryption keys and gain access to sensitive data.

This issue affects only a modified OpenSSL package for Debian prior to version 0.9.8c-4etch3.

92. Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
BugTraq ID: 24215
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/24215
Summary:
Apache is prone to multiple denial-of-service vulnerabilities.

An attacker with the ability to execute arbitrary server-side script-code can exploit these issues to stop arbitrary services on the affected computer in the context of the master webserver process; other attacks may also be possible.

93. Apache Tomcat WebDav Remote Information Disclosure Vulnerability
BugTraq ID: 26070
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/26070
Summary:
Apache Tomcat is prone to a remote information-disclosure vulnerability

Remote attackers can exploit this issue to obtain the contents of sensitive files stored on the server.

94. Apache Mod_AutoIndex.C Undefined Charset Cross-Site Scripting Vulnerability
BugTraq ID: 25653
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/25653
Summary:
Apache is affected by a vulnerability that may cause certain web pages to be prone to a cross-site scripting attack. This issue stems from a lack of a defined charset on certain generated pages.

Web pages generated by the affected source code may be prone to a cross-site scripting issue.

Versions prior to Apache 2.2.6 are affected.

NOTE: Reports indicate that this issue does not occur when the application is running on Windows operating systems.

95. Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability
BugTraq ID: 27237
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/27237
Summary:
The Apache HTTP Server 'mod_status' module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Reportedly, attackers can also use this issue to redirect users' browsers to arbitrary locations, which may aid in phishing attacks.

The issue affects versions prior to Apache 2.2.7-dev, 2.0.62-dev, and 1.3.40-dev.

96. Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities
BugTraq ID: 25316
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/25316
Summary:
Apache Tomcat is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data.

Attackers can exploit these issues to access potentially sensitive data that may aid in further attacks.

Versions prior to Apache Tomcat 6.0.14 are vulnerable.

97. Sun Java Web Start Unauthorized Access Vulnerability
BugTraq ID: 23728
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/23728
Summary:
Sun Java Web Start is prone to a vulnerability that may allow remote attackers to gain unauthorized access to a vulnerable computer.

The vendor has reported that this vulnerability allows untrusted applications to gain read/write privileges to local files on a vulnerable computer.

The following versions for Windows, Solaris, and Linux platforms are vulnerable:

Java Web Start in JDK and JRE 5.0 Update 10 and earlier
Java Web Start in SDK and JRE 1.4.2_13 and earlier

98. OpenSSL PKCS Padding RSA Signature Forgery Vulnerability
BugTraq ID: 19849
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/19849
Summary:
OpenSSL is prone to a vulnerability that may allow an attacker to forge an RSA signature. The attacker may be able to forge a PKCS #1 v1.5 signature when an RSA key with exponent 3 is used.

An attacker may exploit this issue to sign digital certificates or RSA keys and take advantage of trust relationships that depend on these credentials, possibly posing as a trusted party and signing a certificate or key.

All versions prior to and including OpenSSL 0.9.7j and 0.9.8b are affected by this vulnerability. Updates are available.

99. OpenSSL Insecure Protocol Negotiation Weakness
BugTraq ID: 15071
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/15071
Summary:
OpenSSL is prone to a remote protocol-negotiation weakness. This issue occurs because of the implementation of the 'SSL_OP_MSIE_SSLV2_RSA_PADDING' option to maintain compatibility with third-party software.

This issue presents itself when two peers try to negotiate the protocol they wish to communicate with. Attackers who can intercept and modify the SSL communications may exploit this weakness to force SSL version 2 to be chosen.

The attacker may then exploit various insecurities in SSL version 2 to gain access to or tamper with the cleartext communications between the targeted client and server.

Note that the 'SSL_OP_MSIE_SSLV2_RSA_PADDING' option is enabled with the frequently used 'SSL_OP_ALL' option.

SSL peers that are configured to disallow SSL version 2 are not affected by this issue.

100. libvorbis Multiple Remote Vulnerabilities
BugTraq ID: 29206
Remote: Yes
Last Updated: 2008-05-20
Relevant URL: http://www.securityfocus.com/bid/29206
Summary:
Applications that use the libvorbis library are prone to multiple remote vulnerabilities, including a heap-overflow issue and multiple integer-overflow issues.

An attacker can exploit these issues to execute arbitrary code within the context of an affected application or cause the application to crash.

These issues affect libvorbis 1.2.0; other versions of the library may also be affected.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Legal experts wary of MySpace hacking charges
By: Robert Lemos
Federal prosecutors charge the parent who allegedly badgered a girl to suicide with three counts of computer crime, but law experts worry about a dangerous precedent.
http://www.securityfocus.com/news/11519

2. Admins warned of brute-force SSH attacks
By: Robert Lemos
Normally considered a low-level threat on the Internet, scans for default-configured secure shell servers spiked this week.
http://www.securityfocus.com/news/11518

3. Groups warn travelers to limit laptop data
By: Robert Lemos
In a letter to Congress, nearly three dozen organizations protest the seizures of electronic devices by U.S. customs officials, an act upheld by a federal appeals court in a recent ruling.
http://www.securityfocus.com/news/11516

4. Patches pose significant risk, researchers say
By: Robert Lemos
A group of four computer scientists say Windows Update -- and other patch services -- should be redesigned, after they create a technique to quickly produce attack code from a distributed patch.
http://www.securityfocus.com/news/11514

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Incident Handler, Wilmington
http://www.securityfocus.com/archive/77/492351

2. [SJ-JOB] Application Security Architect, New York
http://www.securityfocus.com/archive/77/492352

3. [SJ-JOB] Security Consultant, Open Location
http://www.securityfocus.com/archive/77/492353

4. [SJ-JOB] Director, Information Security, South Florida
http://www.securityfocus.com/archive/77/492354

5. [SJ-JOB] Sales Engineer, New York
http://www.securityfocus.com/archive/77/492355

6. [SJ-JOB] Application Security Engineer, Ottawa
http://www.securityfocus.com/archive/77/492345

7. [SJ-JOB] Senior Software Engineer, Alpharetta
http://www.securityfocus.com/archive/77/492348

8. [SJ-JOB] Security Engineer, Torrance
http://www.securityfocus.com/archive/77/492349

9. [SJ-JOB] Security Engineer, Reston
http://www.securityfocus.com/archive/77/492350

10. [SJ-JOB] Security Auditor, New York
http://www.securityfocus.com/archive/77/492342

11. [SJ-JOB] Security Auditor, Washington
http://www.securityfocus.com/archive/77/492347

12. [SJ-JOB] Security Auditor, chicago
http://www.securityfocus.com/archive/77/492356

13. [SJ-JOB] Sales Engineer, Philadelphia
http://www.securityfocus.com/archive/77/492357

14. [SJ-JOB] Security Auditor, San Francisco
http://www.securityfocus.com/archive/77/492358

15. [SJ-JOB] Application Security Engineer, Dallas
http://www.securityfocus.com/archive/77/492336

16. [SJ-JOB] Security Consultant, Long Island
http://www.securityfocus.com/archive/77/492340

17. [SJ-JOB] Application Security Engineer, Washington
http://www.securityfocus.com/archive/77/492343

18. [SJ-JOB] Security Consultant, New York
http://www.securityfocus.com/archive/77/492344

19. [SJ-JOB] Application Security Engineer, Los Angeles
http://www.securityfocus.com/archive/77/492339

20. [SJ-JOB] Security Consultant, chicago
http://www.securityfocus.com/archive/77/492341

21. [SJ-JOB] Security System Administrator, San Jose
http://www.securityfocus.com/archive/77/492337

22. [SJ-JOB] Application Security Engineer, San Jose
http://www.securityfocus.com/archive/77/492338

23. [SJ-JOB] Sr. Security Engineer, Arlington
http://www.securityfocus.com/archive/77/492156

24. [SJ-JOB] Security Architect, Schaumburg
http://www.securityfocus.com/archive/77/492165

25. [SJ-JOB] Information Assurance Analyst, London
http://www.securityfocus.com/archive/77/492166

26. [SJ-JOB] Forensics Engineer, Chicago
http://www.securityfocus.com/archive/77/492168

27. [SJ-JOB] Manager, Information Security, Chicago
http://www.securityfocus.com/archive/77/492169

28. [SJ-JOB] Incident Handler, Amsterdam
http://www.securityfocus.com/archive/77/492154

29. [SJ-JOB] Threat Analyst, Columbia
http://www.securityfocus.com/archive/77/492155

30. [SJ-JOB] Security Consultant, Toronto
http://www.securityfocus.com/archive/77/492167

31. [SJ-JOB] Application Security Engineer, Denver
http://www.securityfocus.com/archive/77/492152

32. [SJ-JOB] CISO, Central Europe
http://www.securityfocus.com/archive/77/492153

V. INCIDENTS LIST SUMMARY
---------------------------
1. Weird SSH attack last night and this morning (still ongoing)
http://www.securityfocus.com/archive/75/491739

VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Binding Windows Services to Specific Addresses Only
http://www.securityfocus.com/archive/88/491595

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
1. CfP hack.lu 2008
http://www.securityfocus.com/archive/91/492320

X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This issue is sponsored by Industry Brains

News

Wednesday, May 21, 2008

SecurityFocus Newsletter #454

No comments:

WINDOWS CENTER

Blog Archive