----------------------------------------
This issue is sponsored by Qualys
Choosing a solution for Vulnerability Management (VM) is a critical step toward protecting your organization's network and data. Without proven, automated technology for precise detection and remediation, no network can withstand the daily onslaught of new vulnerabilities that threaten security.
http://dinclinx.com/Redirect.aspx?36;4164;35;189;0;6;259;456696438e431ea1
SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as conveying topics of interest for our community. We are proud to offer content from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs
------------------------------------------------------------------
I. FRONT AND CENTER
1. Free Market Filtering
2. Don't Blame the Browser
II. MICROSOFT VULNERABILITY SUMMARY
1. Easy File Sharing Web Server 'thumbnail.php' File Disclosure Vulnerability
2. EFS Software Easy Chat Server 'registresult.htm' Authentication Bypass Vulnerability
3. VUPlayer '.CUE' File Buffer Overflow Vulnerability
4. Media Commands Multiple Media File Multiple Heap Buffer Overflow Vulnerabilities
5. Internet Download Manager Language File Parsing Buffer Overflow Vulnerability
6. BreakPoint Software Hex Workshop '.hex' File Handling Buffer Overflow Vulnerability
7. POP Peeper UIDL Remote Buffer Overflow Vulnerability
8. BitDefender Internet Security 2009 File Name Cross Site Scripting Vulnerability
9. HP Virtual Rooms Client ActiveX Control Insecure Method Remote Code Execution Vulnerability
10. Drupal Theme System Template File Local File Include Vulnerability
11. SHOUTcast Server DNAS Relay Remote Buffer Overflow Vulnerability
12. Adobe Flash Player Unspecified Remote Denial of Service Vulnerability
13. Adobe Flash Player Unspecified Information Disclosure Vulnerability
14. Adobe Flash Player Invalid Object Reference Remote Code Execution Vulnerability
15. Microsoft Excel Invalid Object Remote Code Execution Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
1. SecurityFocus Microsoft Newsletter #433
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1.Free Market Filtering
By Mark Rasch
The Australian government is considering requiring that Internet service providers in that country install filters which would prevent citizens from accessing tens of thousands of sites that contain "objectionable" material.
http://www.securityfocus.com/columnists/493
2.Don't Blame the Browser
Melih Abdulhayoglu
There was a time when most diseases were fatal for humans. Intense study and research helped doctors manage diseases better, and subsequently even prevent them altogether.
http://www.securityfocus.com/columnists/492
II. MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. Easy File Sharing Web Server 'thumbnail.php' File Disclosure Vulnerability
BugTraq ID: 33973
Remote: Yes
Date Published: 2009-03-04
Relevant URL: http://www.securityfocus.com/bid/33973
Summary:
Easy File Sharing Web Server is prone to a vulnerability that lets attackers obtain potentially sensitive information because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to download arbitrary files with the privileges of the webserver process. Information obtained may aid in further attacks.
Easy File Sharing Web Server 4.8 is vulnerable; other versions may also be affected.
2. EFS Software Easy Chat Server 'registresult.htm' Authentication Bypass Vulnerability
BugTraq ID: 33967
Remote: Yes
Date Published: 2009-03-03
Relevant URL: http://www.securityfocus.com/bid/33967
Summary:
EFS Software Easy Chat Server is prone to an authentication-bypass vulnerability because it fails to perform adequate authentication checks.
Attackers can exploit this vulnerability to gain unauthorized access to the affected application, which may aid in further attacks.
Easy Chat Server 2.2 is vulnerable; other versions may also be affected.
3. VUPlayer '.CUE' File Buffer Overflow Vulnerability
BugTraq ID: 33960
Remote: Yes
Date Published: 2009-03-02
Relevant URL: http://www.securityfocus.com/bid/33960
Summary:
VUPlayer is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.
Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
VUPlayer 2.49 is vulnerable; other versions may also be affected.
4. Media Commands Multiple Media File Multiple Heap Buffer Overflow Vulnerabilities
BugTraq ID: 33958
Remote: Yes
Date Published: 2009-03-02
Relevant URL: http://www.securityfocus.com/bid/33958
Summary:
Media Commands is prone to multiple heap-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.
Successfully exploiting these issues may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.
Media Commands 1.0 is vulnerable; other versions may also be affected.
5. Internet Download Manager Language File Parsing Buffer Overflow Vulnerability
BugTraq ID: 33934
Remote: Yes
Date Published: 2009-02-27
Relevant URL: http://www.securityfocus.com/bid/33934
Summary:
Internet Download Manager (IDM) is prone to a remote buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
This issue affects IDM 5.15 Build 3; other versions may also be vulnerable.
6. BreakPoint Software Hex Workshop '.hex' File Handling Buffer Overflow Vulnerability
BugTraq ID: 33932
Remote: Yes
Date Published: 2009-02-27
Relevant URL: http://www.securityfocus.com/bid/33932
Summary:
Hex Workshop is prone to a buffer-overflow vulnerability because it fails to adequately validate user-supplied data before copying it into an insufficiently sized buffer.
Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
Hex Workshop 6 is vulnerable; other versions may also be affected.
7. POP Peeper UIDL Remote Buffer Overflow Vulnerability
BugTraq ID: 33926
Remote: Yes
Date Published: 2009-02-27
Relevant URL: http://www.securityfocus.com/bid/33926
Summary:
POP Peeper is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.
POP Peeper 3.4.0.0 is vulnerable; other versions may also be affected.
8. BitDefender Internet Security 2009 File Name Cross Site Scripting Vulnerability
BugTraq ID: 33921
Remote: Yes
Date Published: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33921
Summary:
BitDefender Internet Security 2009 is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
9. HP Virtual Rooms Client ActiveX Control Insecure Method Remote Code Execution Vulnerability
BugTraq ID: 33918
Remote: Yes
Date Published: 2009-02-26
Relevant URL: http://www.securityfocus.com/bid/33918
Summary:
HP Virtual Rooms client ActiveX control is prone to a remote code-execution vulnerability.
Successfully exploiting this issue allows an attacker to execute arbitrary code in the context of the application running the affected control (typically Internet Explorer).
This issue affects Virtual Rooms 7.0 and earlier running on Microsoft Windows.
10. Drupal Theme System Template File Local File Include Vulnerability
BugTraq ID: 33910
Remote: Yes
Date Published: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33910
Summary:
Drupal is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. This issue affects Drupal running under Microsoft Windows.
An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.
The following are vulnerable:
Drupal 5.x prior to 5.16
Drupal 6.x prior to 6.10
11. SHOUTcast Server DNAS Relay Remote Buffer Overflow Vulnerability
BugTraq ID: 33904
Remote: Yes
Date Published: 2009-02-25
Relevant URL: http://www.securityfocus.com/bid/33904
Summary:
SHOUTcast Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
Attackers may exploit this issue to overwrite the application's web administration password and possibly to execute arbitrary code within the context of the application, but this has not been confirmed. Failed exploit attempts will cause a denial-of-service condition.
SHOUTcast Server 1.9.8 for Windows is vulnerable; other versions may also be affected.
12. Adobe Flash Player Unspecified Remote Denial of Service Vulnerability
BugTraq ID: 33890
Remote: Yes
Date Published: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33890
Summary:
Adobe Flash Player is prone to a remote denial-of-service vulnerability because it fails to properly validate user-supplied input.
Exploiting this issue allows remote attackers to crash the application and possibly to execute code, but this has not been confirmed.
Versions prior to Flash Player 10.0.22.87 are vulnerable.
13. Adobe Flash Player Unspecified Information Disclosure Vulnerability
BugTraq ID: 33889
Remote: Yes
Date Published: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33889
Summary:
Adobe Flash Player is prone to an information-disclosure vulnerability.
Successful exploits will allow an attacker to obtain potentially sensitive information that may be used to elevate privileges.
This issue affects Flash Player on Linux-based operating systems only.
14. Adobe Flash Player Invalid Object Reference Remote Code Execution Vulnerability
BugTraq ID: 33880
Remote: Yes
Date Published: 2009-02-24
Relevant URL: http://www.securityfocus.com/bid/33880
Summary:
Adobe Flash Player is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.
Versions prior to Flash Player 10.0.12.36 are vulnerable.
15. Microsoft Excel Invalid Object Remote Code Execution Vulnerability
BugTraq ID: 33870
Remote: Yes
Date Published: 2009-02-23
Relevant URL: http://www.securityfocus.com/bid/33870
Summary:
Microsoft Excel is prone to a remote code-execution vulnerability.
Attackers may exploit this issue by enticing victims into opening a maliciously crafted Excel file.
Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will result in a denial-of-service condition.
III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #433
http://www.securityfocus.com/archive/88/501284
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.
V. SPONSOR INFORMATION
------------------------
This issue is sponsored by Qualys
Choosing a solution for Vulnerability Management (VM) is a critical step toward protecting your organization's network and data. Without proven, automated technology for precise detection and remediation, no network can withstand the daily onslaught of new vulnerabilities that threaten security.
http://dinclinx.com/Redirect.aspx?36;4164;35;189;0;6;259;456696438e431ea1
No comments:
Post a Comment