Computer Security
[EN] securityvulns.ru no-pyccku


Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:03.01.2007
Source:
SecurityVulns ID:6986
Type:remote
Threat Level:
5/10
Description:PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.
Affected:WWWBOARD : WWWboard 2.0
 NUKEDKLAN : Nuked-Klan 1.7
 SPOOKYLOGIN : Spooky Login 2.7
 PHPIRCBOT : PHPIrc_bot 0.2
 FORMBANKSERVER : Formbankserver 1.9
 AUTODEALER : autoDealer 2.0
 GECKOVICH : TaskTracker 1.5
CVE:CVE-2007-0138 (formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with (1) AbfrageForm or (2) EingabeForm, allows remote attackers to cause a denial of service (daemon crash) via multiple requests containing many /../ sequences in the Name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.)
 CVE-2007-0083 (Cross-site scripting (XSS) vulnerability in Nuked Klan 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a getURL statement in a .swf file, as demonstrated by "Remote Cookie Disclosure." NOTE: it could be argued that this is an issue in Shockwave instead of Nuked Klan.)
 CVE-2007-0079 (rblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) data/admin.mdb or (2) data/rblog.mdb.)
 CVE-2007-0078 (BattleBlog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/blankmaster.mdb.)
 CVE-2007-0077 (lblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a certain file in admin/db/newFolder/.)
 CVE-2007-0076 (Openforum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for openforum.mdb.)
 CVE-2007-0075 (AspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for db/aspbb.mdb.)
 CVE-2007-0056 (Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) ashop/catalogue.php and (b) ashop/basket.php, the (2) exp parameter to ashop/catalogue.php, the (3) searchstring parameter to (c) ashop/search.php, the (4) checkout and (5) action parameters to (d) ashop/shipping.php, the cat parameter to (f) cart-path/admin/editcatalogue.php, and the (7) resultpage parameter to (g) cart-path/admin/salesadmin.php.)
 CVE-2007-0055 (Directory traversal vulnerability in formbankcgi.exe/AbfrageForm in Formbankserver 1.9 allows remote attackers to read arbitrary files via directory traversal sequences in the Name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.)
 CVE-2007-0054 (Cross-site scripting (XSS) vulnerability in gbrowse.php in Belchior Foundry vCard PRO allows remote attackers to inject arbitrary web script or HTML via the sortby parameter.)
 CVE-2007-0053 (SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the iPro parameter.)
 CVE-2007-0052 (SQL injection vulnerability in haberdetay.asp in Vizayn Haber allows remote attackers to execute arbitrary SQL commands via the id parameter.)
 CVE-2007-0049 (Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add action with a modified GroupID in a direct request to Customize.asp.)
Original documentdocumentKabusTR.coM , newsCMSlite (newsCMS.mdb) Remote Password Disclosure Vulnerablity (03.01.2007)
 documentbd0rk_(at)_hackermail.com, WWWBoard 2.0 Alpha 2 (passwd.txt) Password Disclosure Vulnerability (03.01.2007)
 documentajannhwt_(at)_hotmail.com, TaskTracker All Version Remote Add Admin Exploit (03.01.2007)
 documentajannhwt_(at)_hotmail.com, autoDealer <= 2.0 (iPro) Remote SQL Injection Vulnerability (03.01.2007)
 documentchernobiLe, Vizayn Haber (tr) == (tr) SQL Injection Vulnerability (03.01.2007)
 documentzooz_998_(at)_hotmail.com, PHPIrc_bot <= Remote File Include (03.01.2007)
 documentexexp_(at)_hotmail.com, vBulletin vCard PRO XSS (03.01.2007)
 documentAdvisory_(at)_Aria-Security.net, BattleBlog Database Download Vulnerability (03.01.2007)
 documentsn0oPy.team_(at)_gmail.com, golden book XSS (03.01.2007)
 documentAdvisory_(at)_Aria-Security.net, rblog Database Download Vulnerability (03.01.2007)
 documentHackers Center Security Group, AShop Shopping Cart Multiple XSS Vulnerabilities (03.01.2007)
 documentAdvisory_(at)_Aria-Security.net, lblog Remote Password Disclosure (03.01.2007)
 documentAdvisory_(at)_Aria-Security.net, Openforum Remote password Disclosure (03.01.2007)
 documentkadaj-diabolik_(at)_hotmail.fr, Nuked Klan <= 1.7 Remote Cookie Disclosure Exploit (03.01.2007)
 documentAdvisory_(at)_Aria-Security.net, AspBB Remote Password Disclosure (03.01.2007)
 documentHackers Center Security Group, Spooky Login Multiple HTML Injection Vulnerability (03.01.2007)
Files:Exploits formbankserver directory traversal

Linux ATMEL wireless drivers buffer overflow
Published:03.01.2007
Source:
SecurityVulns ID:6987
Type:local
Threat Level:
5/10
Description:Buffer overflow in Get_Wep() function.
Affected:ATMEL : ATMEL WLAN drivers 3.4
Original documentdocumentsapheal_(at)_hack.pl, ATMEL Linux PCI PCMCIA USB Drivers arbitrary code execution (03.01.2007)

MoviePlay buffer overflow
Published:03.01.2007
Source:
SecurityVulns ID:6989
Type:client
Threat Level:
5/10
Description:Buffer overflow on .lst files parsing.
Affected:MOVIEPLAY : MoviePlay 4.76
CVE:CVE-2007-0016 (Stack-based buffer overflow in MoviePlay 4.76 allows remote attackers to execute arbitrary code via a long filename in a LST file.)
Original documentdocumentSECUNIA, [SA22959] MoviePlay LST Playlist Parsing Buffer Overflow Vulnerability (03.01.2007)

QK SMTP server buffer overflow
Published:03.01.2007
Source:
SecurityVulns ID:6991
Type:remote
Threat Level:
5/10
Description:Buffer overflow on oversized RCPT TO: SMTP command argument.
Affected:QK : QK SMTP 3.01
Files:Exploitsw QK SMTP RCPT TO buffer overflow

Miredo authentication bypass
Published:03.01.2007
Source:
SecurityVulns ID:6992
Type:remote
Threat Level:
5/10
Description:HMAC-MD5-64 authentication can be bypassed.
Affected:MIREDO : Miredo 1.0
 MIREDO : Miredo 0.9
Original documentdocumentMIREDO, Security Advisory 0604 (03.01.2007)

ICONICS Dialog Wrapper Module ActiveX control buffer overflow
Published:03.01.2007
Source:
SecurityVulns ID:6993
Type:client
Threat Level:
5/10
Description:Buffer overflow in DoModal() method.
Original documentdocumentSECUNIA, [SA23583] ICONICS Dialog Wrapper Module ActiveX Control Buffer Overflow (03.01.2007)

Adobe reader plugin PDF files universal crossite scripting
updated since 03.01.2007
Published:04.01.2007
Source:
SecurityVulns ID:6994
Type:client
Threat Level:
7/10
Description:1. By using URIs like http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here it's possible to execute code in context of any Web site where at least one PDF is stored. 2. By using "trigger action" in PDF document it's possible to execute code in context of the web page where document is stored. There are also more bugs exploitable thorugh a web page.
Affected:ADOBE : Acrobat Reader 6.0
 ADOBE : Acrobat Reader 7.0
CVE:CVE-2007-1199 (Adobe Reader and Acrobat Trial allow remote attackers to read arbitrary files via a file:// URI in a PDF document, as demonstrated with <</URI(file:///C:/)/S/URI>>, a different issue than CVE-2007-0045.)
 CVE-2007-0048 (Adobe Acrobat Reader Plugin before 8.0.0, when used with Internet Explorer, allows remote attackers to cause a denial of service (memory consumption) via a long sequence of # (hash) characters appended to a PDF URL.)
 CVE-2007-0047 (CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.)
 CVE-2007-0046 (Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.)
 CVE-2007-0045 (Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0 for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS).")
 CVE-2007-0044 (Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding.")
Original documentdocumentStefano Di Paola, Adobe Acrobat Reader Plugin - Multiple Vulnerabilities (04.01.2007)
 documentMaximize Designs, Re: Unpatchable Quicktime XSS (03.01.2007)
 documentpdp (architect), [Full-disclosure] Universal XSS with PDF files: highly dangerous (03.01.2007)

Apple QuickTime buffer overflow
updated since 03.01.2007
Published:07.01.2007
Source:
SecurityVulns ID:6988
Type:client
Threat Level:
8/10
Description:Buffer overflow on oversized rtsp:// URLs.
Affected:APPLE : QuickTime 7.1
CVE:CVE-2007-0015 (Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI.)
Original documentdocumentCERT, US-CERT Technical Cyber Security Alert TA07-334A -- Apple QuickTime RTSP Buffer Overflow (02.12.2007)
 documentMOAB, MOAB-01-01-2007: Apple Quicktime rtsp URL Handler Stack-based Buffer Overflow (21.01.2007)
 documentCERT, US-CERT Technical Cyber Security Alert TA07-005A -- Apple QuickTime RTSP Buffer Overflow (06.01.2007)
 documentSECUNIA, [SA23540] Apple Quicktime RTSP URL Handling Buffer Overflow Vulnerability (03.01.2007)
Files:Exploits Apple Quicktime rtsp URL Handler Stack-based Buffer Overflow

VLC Media Player buffer overflow
updated since 03.01.2007
Published:21.01.2007
Source:
SecurityVulns ID:6990
Type:client
Threat Level:
5/10
Description:Buffer overflow on oversized udp:// URI during M3U file parsing.
Affected:XINE : xine 0.99
 VLC : VLC Media Player 0.8
CVE:CVE-2007-0256 (VideoLAN VLC 0.8.6a allows remote attackers to cause a denial of service (application crash) via a crafted .wmv file.)
 CVE-2007-0255 (XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of CVE-2007-0017.)
 CVE-2007-0017 (Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.)
Original documentdocumentMOAB, MOAB-02-01-2007: VLC Media Player udp:// Format String Vulnerability (21.01.2007)
Files:Exploits VLC Player for OSX to execute arbitrary code
 Exploits VLC Player for OSX to execute arbitrary code (PPC)
 VLC media player 0.8.6a Denial of Service

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod