ProFTPD xontrols module buffer overflow
Published:		19.02.2007
Source:
SecurityVulns ID:		7261
Type:		local
Level:		5/10
Description:		Buffer overflows in controls module.

Affected:		PROFTPD : ProFTPD 1.3
CVE:		CVE-2006-6563 (Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.)

Original document

CORE SECURITY TECHNOLOGIES ADVISORIES, CORE-2006-1127: ProFTPD Controls Buffer Overflow (19.02.2007)

Files:		Exploits ProFTPD 1.3.0/1.3.0a Controls Buffer Overflow (2.6 kernel exploitation against gcc 4.x with canary)
		Exploits ProFTPD 1.3.0/1.3.0a Controls Buffer Overflow (2.4 kernel)
		ProFTPD 1.3.0/1.3.0a Controls Buffer Overflow
Discuss:		Read or add your comments to this news (0 comments)

Apple iTunes DoS
Published:		19.02.2007
Source:		BUGTRAQ
SecurityVulns ID:		7263
Type:		client
Level:		4/10
Description:		NULL pointer crash on xml parsing.

Affected:		APPLE : iTunes 7.0
CVE:		CVE-2007-1008 (Apple iTunes 7.0.2 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted XML list of radio stations, which results in memory corruption. NOTE: iTunes retrieves the XML document from a static URL, which requires an attacker to perform DNS spoofing or man-in-the-middle attacks for exploitation.)

Original document

poplix_(at)_papuasia.org, iTunes remote memory corruption vulnerability (19.02.2007)

Discuss:

Read or add your comments to this news (0 comments)

VicFTPS FTP server buffer overflow
Published:		19.02.2007
Source:		MILW0RM
SecurityVulns ID:		7265
Type:		remote
Level:		5/10
Description:		Buffer overflow in CWD command.

Affected:		VICFTPS : VicFTPS 5.0
CVE:		CVE-2007-1014 (Stack-based buffer overflow in VicFTPS before 5.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long CWD command.)

Files:		VicFTPs Server CWD Remote Buffer Overflow Vulnerability DoS Proof of concept
Discuss:		Read or add your comments to this news (0 comments)

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) updated since 19.02.2007
Published:		19.02.2007
Source:
SecurityVulns ID:		7262
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Affected:		MEDIAWIKI : MediaWiki 1.9
		POWERSCHOOL : Powerschool 4.3
		PHPNUKE : Php-Nuke Module Emporium 2.3
		SGASTEBUCH : S-Gastebuch 1.5
		VSNEWSSYSTEM : VS-News-System 1.2
		VSLINKPARTNER : VS-Link-Partner 2.1
		XNEWS : Xpression News 1.0
		XLATUNES : XLAtunes 0.1
CVE:		CVE-2007-1044 (Pearson Education PowerSchool 4.3.6 allows remote attackers to list the contents of the admin folder via a URI composed of the admin/ directory name and an arbitrary filename ending in ".js.")
		CVE-2007-1042 (Directory traversal vulnerability in news.php in Xpression News (X-News) 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.)
		CVE-2007-1040 (Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter.)
		CVE-2007-1034 (SQL injection vulnerability in the category file in modules.php in the Emporium 2.3.0 and earlier module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the category_id parameter.)
		CVE-2007-1026 (SQL injection vulnerability in view.php in XLAtunes 0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in view mode. NOTE: some of these details are obtained from third party information.)
		CVE-2007-1025 (PHP remote file inclusion vulnerability in inc/functions_inc.php in VS-Link-Partner 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad, or possibly script_pfad, parameter.)
		CVE-2007-1018 (PHP remote file inclusion vulnerability in tpl/header.php in VirtualSystem VS-News-System 1.2.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.)
		CVE-2007-1017 (PHP remote file inclusion vulnerability in show_news_inc.php in VirtualSystem VS-News-System 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter.)
		CVE-2007-1011 (PHP remote file inclusion vulnerability in functions_inc.php in VS-Gastebuch 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad parameter.)

Original document		x0rax, XLAtunes 0.1 (album) Remote SQL Injection Vulnerability (20.02.2007)
		gheetotank_(at)_hotmail.com, Powerschool 404 Admin Exposure (19.02.2007)
		BUGSEC, MediaWiki Cross-site Scripting (19.02.2007)

Files:		Php-Nuke Module Emporium <= 2.3.0 Remote Blind SQL Injection Exploit
		VS-News-System <= V1.2.1 (newsordner) Remote File Include Exploit
		VS-Link-Partner <= 2.1 (script_pfad) Remote File Include Exploit
		Xpression News File Disclosure Exploit
		S-Gastebuch <= V.1.5.3 (gb_pfad) Remote File Include Exploit
Discuss:		Read or add your comments to this news (0 comments)

libevent library DoS
Published:		19.02.2007
Source:		BUGTRAQ
SecurityVulns ID:		7264
Type:		library
Level:		5/10
Description:		Endless loop on DNS reply parsing.

Affected:		LIBEVENT : libevent 1.2
CVE:		CVE-2007-1030 (Niels Provos libevent 1.2 and 1.2a allows remote attackers to cause a denial of service (infinite loop) via a DNS response containing a label pointer that references its own offset.)

Original document

Jon Oberheide, Remote DoS in libevent DNS parsing <= 1.2a (19.02.2007)

Discuss:

Read or add your comments to this news (0 comments)