Computer Security
[EN] securityvulns.ru no-pyccku


Trend Micro VirusWall for Linux buffer overflow
Published:28.01.2007
Source:
SecurityVulns ID:7113
Type:local
Threat Level:
5/10
Description:Buffer overflow in libvsapi.so library used by vscan suid root application.
Affected:TM : InterScan VirusWall 3.81
CVE:CVE-2007-0602 (Buffer overflow in libvsapi.so in the VSAPI library in Trend Micro VirusWall 3.81 for Linux, as used by IScan.BASE/vscan, allows local users to gain privileges via a long command line argument, a different vulnerability than CVE-2005-0533.)
Original documentdocumentSebastian Wolfgarten, Buffer overflow in VSAPI library of Trend Micro VirusWall 3.81 for Linux (28.01.2007)
Files:Local root exploit for vscan/VSAPI (=Trend Micro VirusWall 3.81 on Linux)

PGP Desktop code execution
Published:28.01.2007
Source:
SecurityVulns ID:7114
Type:local
Threat Level:
6/10
Description:PGPServ.exe/PGPsdkServ.exe Service doesn't validate data received through named pipe \pipe\pgpserv or \pipe\pgpsdkser.
Affected:PGP : PGP Desktop 9.5
CVE:CVE-2007-0603 (PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address.)
Original documentdocumentNGSSoftware Insight Security Research Advisory (NISR), Medium Risk Vulnerability in PGP Desktop (28.01.2007)

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:28.01.2007
Source:
SecurityVulns ID:7115
Type:remote
Threat Level:
5/10
Description:PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.
Affected:SQLLEDGER : SQL-Ledger 2.6
 LOCI : Local Calendar System 1.1
 OPENADS : Max Media Manager 0.1
 OPENADS : Max Media Manager 0.3
 MOVABLETYPES : Movable Type 3.33
 PHPMM : PHP Membership Manager 1.5
 FDSCRIPT : FdScript 1.3
 LEDGERSMB : LedgerSMB 1.1
 OPENCONFERENCE : Open Conference Systems 2.8
CVE:CVE-2007-0860 (** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in local Calendar System 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) TEMPLATE_DIR parameter to (a) showinvoices.php, (b) showmonth.php, (c) showevents.php, (d) retrieveinvoice.php, (e) modifyitem.php, and (f) lookup_userid.php; or the LIBDIR parameter to (g) editevent.php, (h) resetpassword.php, (i) signup.php, showmonth.php, (j) showday.php, showevents.php, and lookup_userid.php. NOTE: this issue has been disputed by a third party, who states that the associated variables are set in config.php before use.)
 CVE-2007-0620 (download.php in FD Script 1.3.2 and earlier allows remote attackers to read source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter, as demonstrated by downloading config.php.)
 CVE-2007-0604 (Cross-site scripting (XSS) vulnerability in Movable Type (MT) before 3.34 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the MTCommentPreviewIsStatic tag, which can open the "comment entry screen," a different vulnerability than CVE-2007-0231.)
 CVE-2007-0567 (Cross-site scripting (XSS) vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the _p parameter.)
 CVE-2006-5872 (login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program.)
Original documentdocumenttrzindan_(at)_hotmail.com, Open Conference Systems = 2.8.2 Remote File Inclusion (28.01.2007)
 documentsn0oPy.team_(at)_gmail.com, AdMentor (banners) admin SQL injection (28.01.2007)
 documenttrzindan_(at)_hotmail.fr, local Calendar System v1.1 (lcStdLib.inc) Remote File Include (28.01.2007)
 documentChris Travers, Full Disclosure: Arbitrary Code Execution in LedgerSMB CVE-2006-5872 (28.01.2007)
 documentajannhwt_(at)_hotmail.com, FdScript <= v1.3.2 Remote File Disclosure Vulnerability (28.01.2007)
 documentHackers Center Security Group, PHP Membership Manager Cross-Site Scripting Vulnerability (28.01.2007)
 documentMatteo Beccati, [OPENADS-SA-2007-002] Max Media Manager v0.1.29 and v0.3.30 vulnerability fixed (28.01.2007)

Yahoo Messanger crossaplication scripting
Published:28.01.2007
Source:
SecurityVulns ID:7116
Type:remote
Threat Level:
7/10
Description:Chat sign in / sign out messages are shown with Internet Explorer allowing scripting in local computer zone.
Affected:YAHOO : Yahoo! Messenger 8.1
CVE:CVE-2007-0868 (Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.)
 CVE-2007-0768 (Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the (1) First Name, (2) Last Name, and (3) Nickname fields. NOTE: some of these details are obtained from third party information.)
Original documentdocumenthainamluke_(at)_yahoo.com, Cross-site Scripting with Local Privilege Vulnerability in Yahoo Messenger (28.01.2007)

chmlib library memory corruption
Published:28.01.2007
Source:
SecurityVulns ID:7118
Type:library
Threat Level:
6/10
Description:Value from file is used directly in alloca() function call.
Affected:CHMLIB : CHMlib 0.38
 XCHM : xchm 1.10
CVE:CVE-2007-0619 (chmlib before 0.39 allows user-assisted remote attackers to execute arbitrary code via a crafted page block length in a CHM file, which triggers memory corruption.)
Original documentdocumentIDEFENSE, iDefense Security Advisory 01.26.07: Multiple Vendor libchm Page Block Length Memory Corruption Vulnerability (28.01.2007)

bind named DoS
Published:28.01.2007
Source:
SecurityVulns ID:7119
Type:remote
Threat Level:
5/10
Description:2 errors (use-after-free and type ANY response parsing) on response parsing of DNSSEC request.
CVE:CVE-2007-0494 (ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the "DNSSEC Validation" vulnerability.)
 CVE-2007-0493 (Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (named daemon crash) via unspecified vectors that cause named to "dereference a freed fetch context.")
Original documentdocumentRPATH, rPSA-2007-0021-1 bind bind-utils (28.01.2007)

ulogd buffer overflow
Published:28.01.2007
Source:
SecurityVulns ID:7120
Type:remote
Threat Level:
6/10
Affected:ULOGD : ulogd 1.23
CVE:CVE-2007-0460 (Multiple buffer overflows in ulogd for SUSE Linux 9.3 up to 10.1, and possibly other distributions, have unknown impact and attack vectors related to "improper string length calculations.")
Original documentdocumentMANDRIVA, [ MDKSA-2007:028 ] - Updated ulogd packaged to address buffer overflow vulnerability (28.01.2007)

IPSwitch WS_FTP unfilterd shell characters security vulnerability
Published:28.01.2007
Source:
SecurityVulns ID:7121
Type:remote
Threat Level:
6/10
Description:Shell charCters problem on SCP files parsing.
Affected:IPSWITCH : WS_FTP 2007
CVE:CVE-2007-0665 (Format string vulnerability in the SCP module in Ipswitch WS_FTP 2007 Professional might allow remote attackers to execute arbitrary commands via format string specifiers in the filename, related to the SHELL WS_FTP script command.)
Original documentdocumentMichal Bucko, WS_FTP 2007 Professional SCP handling format string vulnerability (28.01.2007)

Multiple QNX security vulnerabilites
Published:28.01.2007
Source:
SecurityVulns ID:7122
Type:local
Threat Level:
6/10
Description:Unprivileged user can debug suid applications. Clipboard is world accessible.
Affected:QNX : QNX 6.3
Original documentdocumentKnud Erik Højgaard, clipboard bug.txt (28.01.2007)
 documentKnud Erik Højgaard, ptrace suids local root.txt (28.01.2007)
Files:crappy qnx 6.3.2 stuff

PHP Safe Mod protection bypass
Published:28.01.2007
Source:
SecurityVulns ID:7123
Type:local
Threat Level:
6/10
Description:It's possible to traverse working directory protection by using writing mode (srpath://../ file prefix for fopen()).
Affected:PHP : PHP 5.2
CVE:CVE-2007-0448 (The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.)
Original documentdocumentSecurityReason, [Full-disclosure] PHP 5.2.0 safe_mode bypass (by Writing Mode) (28.01.2007)

Cisco Catalyst switches VTP DoS
updated since 28.01.2007
Published:30.01.2007
Source:
SecurityVulns ID:7117
Type:remote
Threat Level:
5/10
Description:Switch crashes on malformed VTP (VLAN Trunking Protocol) Subset-Advert message.
CVE:CVE-2006-4776 (Heap-based buffer overflow in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to execute arbitrary code via a long VLAN name in a VTP type 2 summary advertisement.)
 CVE-2006-4775 (The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) and CatOS allows remote attackers to cause a denial of service by sending a VTP update with a revision value of 0x7FFFFFFF, which is incremented to 0x80000000 and is interpreted as a negative number in a signed context.)
 CVE-2006-4774 (The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to cause a denial of service by sending a VTP version 1 summary frame with a VTP version field value of 2.)
 CVE-2005-4826 (Unspecified vulnerability in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(22)EA3 on Catalyst 2950T switches allows remote attackers to cause a denial of service (device reboot) via a crafted Subset-Advert message packet, a different issue than CVE-2006-4774, CVE-2006-4775, and CVE-2006-4776.)
Original documentdocumentCISCO, Re: [Full-disclosure] S21sec-034-en: Cisco VTP DoS vulnerability (30.01.2007)
 documentlabs_(at)_s21sec.com, S21sec-034-en: Cisco VTP DoS vulnerability (28.01.2007)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod