McAfee Network Security Manager multiple security vulnerabilities
Published:		12.11.2009
Source:		BUGTRAQ
SecurityVulns ID:		10400
Type:		remote
Level:		6/10
Description:		Authentication bypass, session hijacking, crossite scripting.

Affected:		MCAFEE : McAfee Network Security Manager 5.1
CVE:		CVE-2009-3566 (McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, which allows remote attackers to hijack a session by leveraging a cross-site scripting (XSS) vulnerability.)
		CVE-2009-3565 (Multiple cross-site scripting (XSS) vulnerabilities in intruvert/jsp/module/Login.jsp in McAfee IntruShield Network Security Manager (NSM) before 5.1.11.6 allow remote attackers to inject arbitrary web script or HTML via the (1) iaction or (2) node parameter.)

Original document		ctu-no-reply_(at)_secureworks.com, [SWRX-2009-002] McAfee Network Security Manager Authentication Bypass and Session Hijacking Vulnerability (12.11.2009)
		ctu-no-reply_(at)_secureworks.com, [SWRX-2009-001] McAfee Network Security Manager Cross-Site Scripting (XSS) Vulnerability (12.11.2009)

Discuss:

Read or add your comments to this news (0 comments)

Hewlett-Packard Procurve switches crossite scripting
Published:		12.11.2009
Source:		FULL-DISCLOSURE
SecurityVulns ID:		10401
Type:		remote
Level:		5/10
Description:		Crossite scriptign in web administration interface.

Original document

Bugs NotHugs, HP curiosity and vulnerability (12.11.2009)

Discuss:

Read or add your comments to this news (0 comments)

Microsoft Excel multiple security vulnerabilities updated since 11.11.2009
Published:		12.11.2009
Source:		MICROSOFT
SecurityVulns ID:		10394
Type:		client
Level:		7/10
Description:		Multiple memory corruptions.

Affected:		MICROSOFT : Office XP
		MICROSOFT : Office 2003
		MICROSOFT : Office 2004 for Mac
		MICROSOFT : Office 2007
		MICROSOFT : Office 2008 for Mac
CVE:		CVE-2009-3134 (Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel Field Sanitization Vulnerability.")
		CVE-2009-3133 (Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed object that triggers memory corruption, related to "loading Excel records," aka "Excel Document Parsing Memory Corruption Vulnerability.")
		CVE-2009-3132 (Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed formula, related to a "pointer corruption" issue, aka "Excel Index Parsing Vulnerability.")
		CVE-2009-3131 (Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a spreadsheet with a crafted formula embedded in a cell, aka "Excel Formula Parsing Memory Corruption Vulnerability.")
		CVE-2009-3130 (Heap-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a spreadsheet containing a malformed Binary File Format (aka BIFF) record that triggers memory corruption, aka "Excel Document Parsing Heap Overflow Vulnerability.")
		CVE-2009-3129 (Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability.")
		CVE-2009-3128 (Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel SxView Memory Corruption Vulnerability.")
		CVE-2009-3127 (Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, and Office Excel Viewer 2003 SP3 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Cache Memory Corruption Vulnerability.")

Original document		VUPEN Security Research, VUPEN Security Research - Microsoft Office Excel Code Execution Vulnerabilities (12.11.2009)
		ZDI, ZDI-09-082: Microsoft Office Excel PivotTable Cache Record Parsing Memory Corruption Vulnerability (11.11.2009)
		ZDI, ZDI-09-083: Microsoft Excel Shared Feature Header Pointer Offset Memory Corruption Vulnerability (11.11.2009)
		IDEFENSE, ZDI-09-083: Microsoft Excel Shared Feature Header Pointer Offset Memory Corruption Vulnerability (11.11.2009)
		IDEFENSE, iDefense Security Advisory 11.10.09: Microsoft Excel FEATHEADER Record Memory Corruption Vulnerability (11.11.2009)
		MICROSOFT, Microsoft Security Bulletin MS09-067 - Important Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652) (11.11.2009)

Files:		Microsoft Security Bulletin MS09-067 - Important Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652)
Discuss:		Read or add your comments to this news (0 comments)