Computer Security
[EN] securityvulns.ru no-pyccku


Barracuda NG Firewall / phion netfence code execution
Published:15.06.2011
Source:
SecurityVulns ID:11737
Type:remote
Threat Level:
7/10
Description:Unescaped shell characters vulnerability during authentication.
Affected:BARRACUDANETWORK : Barracuda NG Firewall 5.0
 BARRACUDANETWORK : phion netfence 4.2
Original documentdocumentml_(at)_monkey-cert.at, phion netfence / Barracuda NG Firewall: Remote Command Execution with root Privileges (15.06.2011)

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
updated since 15.06.2011
Published:15.06.2011
Source:
SecurityVulns ID:11738
Type:remote
Threat Level:
5/10
Description:PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.
Affected:WEBMIN : Webmin 1.540
 MICROSOFT : Lync Server 2010
CVE:CVE-2011-1937 (Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.)
 CVE-2011-1409 (Frams's Fast File EXchange (F*EX, aka fex) 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID.)
Original documentdocumentDEBIAN, [SECURITY] [DSA 2259-1] fex security update (15.06.2011)
 documentbede_(at)_foofus.net, Javascript Injection in Microsoft Lync 4.0.7577.0 (15.06.2011)

Microsoft .Net Framework multiple security vulnerabilities
Published:15.06.2011
Source:
SecurityVulns ID:11731
Type:library
Threat Level:
8/10
Description:Array index overflow, JIT compiler code execution.
Affected:MICROSOFT : Windows XP
 MICROSOFT : Windows 2003 Server
 MICROSOFT : Windows Vista
 MICROSOFT : Windows 2008 Server
 MICROSOFT : Windows 7
CVE:CVE-2011-1271 (The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability.")
 CVE-2011-0664 (Microsoft .NET Framework 2.0 SP1 and SP2, 3.5 Gold and SP1, 3.5.1, and 4.0, and Silverlight 4 before 4.0.60531.0, does not properly validate arguments to unspecified networking API functions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Array Offset Vulnerability.")
Files:Microsoft Security Bulletin MS11-039 - Critical Vulnerability in .NET Framework and Microsoft Silverlight Could Allow Remote Code Execution (2514842)
 Microsoft Security Bulletin MS11-044 - Critical Vulnerability in .NET Framework Could Allow Remote Code Execution (2538814)

Microsoft Forefront Threat Management Gateway Firewall Client memory corruption
Published:15.06.2011
Source:
SecurityVulns ID:11732
Type:client
Threat Level:
7/10
Description:Buffer overflow in NSPLookupServiceNext.
Affected:MICROSOFT : Forefront Threat Management Gateway 2010 Client
CVE:CVE-2011-1889 (The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability.")
Files:Microsoft Security Bulletin MS11-040 - Critical Vulnerability in Threat Management Gateway Firewall Client Could Allow Remote Code Execution (2520426)

Microsoft Excel multiple security vulnerabilities
Published:15.06.2011
Source:
SecurityVulns ID:11733
Type:client
Threat Level:
6/10
Description:Multiple vulnerabilities on different record types parsing.
Affected:MICROSOFT : Office XP
 MICROSOFT : Office 2003
 MICROSOFT : Office 2004 for Mac
 MICROSOFT : Office 2007
 MICROSOFT : Office 2008 for Mac
 MICROSOFT : Office 2010
CVE:CVE-2011-1279 (Microsoft Excel 2002 SP3 and 2003 SP3; Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record information during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel Out of Bounds WriteAV Vulnerability.")
 CVE-2011-1278 (Microsoft Excel 2002 SP3 and Office 2004 for Mac do not properly validate record information during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel WriteAV Vulnerability.")
 CVE-2011-1277 (Microsoft Excel 2002 SP3, Office 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record information during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel Memory Corruption Vulnerability.")
 CVE-2011-1276 (Buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Excel spreadsheet, related to improper validation of record information, aka "Excel Buffer Overrun Vulnerability.")
 CVE-2011-1275 (Microsoft Excel 2002 SP3; Office 2004, 2008, and 2011 for Mac; and Open XML File Format Converter for Mac do not properly validate record information during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel Memory Heap Overwrite Vulnerability.")
 CVE-2011-1274 (Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly validate record information during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel Out of Bounds Array Access Vulnerability.")
 CVE-2011-1273 (Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly validate record information during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel Improper Record Parsing Vulnerability.")
 CVE-2011-1272 (Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly validate record structures during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Insufficient Record Validation Vulnerability.")
Files:Microsoft Security Bulletin MS11-045 - Important Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2537146)

Microsoft XML Editor information leakage
Published:15.06.2011
Source:
SecurityVulns ID:11735
Type:local
Threat Level:
4/10
Description:Information leakage via .disco files.
Affected:MICROSOFT : Visual Studio 2005
 MICROSOFT : SQL Server 2005
 MICROSOFT : InfoPath 2007
 MICROSOFT : InfoPath 2010
 MICROSOFT : SQL Server 2008
 MICROSOFT : Visual Studio 2008
 MICROSOFT : Visual Studio 2010
CVE:CVE-2011-1280 (The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio 2005 SP1, 2008 SP1, and 2010 does not properly handle external entities, which allows remote attackers to read arbitrary files via a crafted .disco (Web Service Discovery) file, aka "XML External Entities Resolution Vulnerability.")
Files:Microsoft Security Bulletin MS11-049 - Important Vulnerability in the Microsoft XML Editor Could Allow Information Disclosure (2543893)

Microsoft Certificate Services crossite scripting
Published:15.06.2011
Source:
SecurityVulns ID:11736
Type:remote
Threat Level:
5/10
Description:Crossite scripting in Active Directory Certificate Services Web Enrollment.
Affected:MICROSOFT : Windows 2003 Server
 MICROSOFT : Windows 2008 Server
CVE:CVE-2011-1264 (Cross-site scripting (XSS) vulnerability in Active Directory Certificate Services Web Enrollment in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Active Directory Certificate Services Vulnerability.")
Files:Microsoft Security Bulletin MS11-051 - Important Vulnerability in Active Directory Certificate Services Web Enrollment Could Allow Elevation of Privilege (2518295)

Microsoft Hyper-V DoS
updated since 15.06.2011
Published:19.06.2011
Source:
SecurityVulns ID:11734
Type:local
Threat Level:
5/10
Description:Hang on VMBus commands processing.
Affected:MICROSOFT : Windows 2008 Server
CVE:CVE-2011-1872 (Hyper-V in Microsoft Windows Server 2008 Gold, SP2, R2, and R2 SP1 allows guest OS users to cause a denial of service (host OS infinite loop) via malformed machine instructions in a VMBus packet, aka "VMBus Persistent DoS Vulnerability.")
Original documentdocumentCORE SECURITY TECHNOLOGIES ADVISORIES, CORE-2011-0203 - MS HyperV Persistent DoS Vulnerability (19.06.2011)
Files:Microsoft Security Bulletin MS11-047 - Important Vulnerability in Hyper-V Could Allow Denial of Service (2525835)

Microsoft Windows multiple security vulnerabilities
updated since 15.06.2011
Published:19.06.2011
Source:
SecurityVulns ID:11730
Type:client
Threat Level:
8/10
Description:Buffer overflow on WMF files parsing. Uninitialized pointers on OTF parsing. DFS memory corruptions. SMB client and server memory corruptions. afd.sys privilege escalation.
Affected:MICROSOFT : Windows XP
 MICROSOFT : Windows 2003 Server
 MICROSOFT : Windows Vista
 MICROSOFT : Windows 2008 Server
 MICROSOFT : Windows 7
CVE:CVE-2011-1873 (win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 on 64-bit platforms does not properly validate pointers during the parsing of OpenType (aka OTF) fonts, which allows remote attackers to execute arbitrary code via a crafted font file, aka "Win32k OTF Validation Vulnerability.")
 CVE-2011-1869 (The Distributed File System (DFS) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote DFS servers to cause a denial of service (system hang) via a crafted referral response, aka "DFS Referral Response Vulnerability.")
 CVE-2011-1868 (The Distributed File System (DFS) implementation in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate fields in DFS responses, which allows remote DFS servers to execute arbitrary code via a crafted response, aka "DFS Memory Corruption Vulnerability.")
 CVE-2011-1268 (The SMB client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote SMB servers to execute arbitrary code via a crafted (1) SMBv1 or (2) SMBv2 response, aka "SMB Response Parsing Vulnerability.")
 CVE-2011-1267 (The SMB server in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (system hang) via a crafted (1) SMBv1 or (2) SMBv2 request, aka "SMB Request Parsing Vulnerability.")
 CVE-2011-1249 (The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability.")
 CVE-2011-0658 (Integer underflow in the OLE Automation protocol implementation in VBScript.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted WMF file, aka "OLE Automation Underflow Vulnerability.")
Original documentdocumentVUPEN Security Research, VUPEN Security Research - Microsoft Windows OLE Automation Integer Underflow Vulnerability (MS11-038) (19.06.2011)
Files:Microsoft Security Bulletin MS11-038 - Critical Vulnerability in OLE Automation Could Allow Remote Code Execution (2476490)
 Microsoft Security Bulletin MS11-041 - Critical Vulnerability in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2525694)
 Microsoft Security Bulletin MS11-042 - Critical Vulnerabilities in Distributed File System Could Allow Remote Code Execution (2535512)
 Microsoft Security Bulletin MS11-043 - Critical Vulnerability in SMB Client Could Allow Remote Code Execution (2536276)
 Microsoft Security Bulletin MS11-046 - Important Vulnerability in Ancillary Function Driver Could Allow Elevation of Privilege (2503665)
 Microsoft Security Bulletin MS11-048 - Important Vulnerability in SMB Server Could Allow Denial of Service (2536275)

Microsoft Internet Explorer multiple security vulnerabilities
updated since 15.06.2011
Published:22.07.2011
Source:
SecurityVulns ID:11729
Type:client
Threat Level:
9/10
Description:mhtml handler cross application scripting, VML processor memory corruption, multiple internet explorer memory corruptions, information leakage.
Affected:MICROSOFT : Windows XP
 MICROSOFT : Windows 2003 Server
 MICROSOFT : Windows Vista
 MICROSOFT : Windows 2008 Server
 MICROSOFT : Windows 7
CVE:CVE-2011-1894 (The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for embedded content in an HTML document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted EMBED element in a web page that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability.")
 CVE-2011-1266 (The Vector Markup Language (VML) implementation in vgx.dll in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "VML Memory Corruption Vulnerability.")
 CVE-2011-1262 (Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "HTTP Redirect Memory Corruption Vulnerability.")
 CVE-2011-1261 (Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Selection Object Memory Corruption Vulnerability.")
 CVE-2011-1260 (Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Layout Memory Corruption Vulnerability.")
 CVE-2011-1258 (Microsoft Internet Explorer 6 through 8 does not properly restrict web script, which allows user-assisted remote attackers to obtain sensitive information from a different (1) domain or (2) zone via vectors involving a drag-and-drop operation, aka "Drag and Drop Information Disclosure Vulnerability.")
 CVE-2011-1256 (Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "DOM Modification Memory Corruption Vulnerability.")
 CVE-2011-1255 (The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Time Element Memory Corruption Vulnerability.")
 CVE-2011-1254 (Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Drag and Drop Memory Corruption Vulnerability.")
 CVE-2011-1252 (Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability.")
 CVE-2011-1251 (Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "DOM Manipulation Memory Corruption Vulnerability.")
 CVE-2011-1250 (Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Link Properties Handling Memory Corruption Vulnerability.")
 CVE-2011-1246 (Microsoft Internet Explorer 8 does not properly handle content settings in HTTP responses, which allows remote web servers to obtain sensitive information from a different (1) domain or (2) zone via a crafted response, aka "MIME Sniffing Information Disclosure Vulnerability.")
Original documentdocumentIBM, Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure (22.07.2011)
 documentNsfocus Security Team, NSFOCUS SA2011-01 : Microsoft Internet Explorer Link Property Processing Memory Corruption Vulnerability (19.06.2011)
 documentZDI, ZDI-11-197: Microsoft Internet Explorer vgx.dll imagedata Remote Code Execution Vulnerability (19.06.2011)
 documentZDI, ZDI-11-198: (Pwn2Own) Microsoft Internet Explorer Uninitialized Variable Information Leak Vulnerability (19.06.2011)
 documentZDI, ZDI-11-194: Microsoft Internet Explorer layout-grid-char style Remote Code Execution Vulnerability (19.06.2011)
 documentZDI, ZDI-11-195: Microsoft Internet Explorer selection.empty Remote Code Execution Vulnerability (19.06.2011)
 documentZDI, ZDI-11-193: Microsoft Internet Explorer DOM Modification Race Remote Code Execution Vulnerability (19.06.2011)
 documentZDI, ZDI-11-196: Microsoft Internet Explorer HTTP 302 Redirect Remote Code Execution Vulnerability (19.06.2011)
Files:Microsoft Security Bulletin MS11-037 - Important Vulnerability in MHTML Could Allow Information Disclosure (2544893)
 Microsoft Security Bulletin MS11-052 - Important Vulnerability in MHTML Could Allow Information Disclosure (2544893)
 Microsoft Security Bulletin MS11-050 - Critical Cumulative Security Update for Internet Explorer (2530548)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod