======================================================================== The Secunia Weekly Advisory Summary 2006-03-23 - 2006-03-30 This week : 89 advisories ======================================================================== Table of Contents: 1.....................................................Word From Secunia 2....................................................This Week In Brief 3...............................This Weeks Top Ten Most Read Advisories 4.......................................Vulnerabilities Summary Listing 5.......................................Vulnerabilities Content Listing ======================================================================== 1) Word From Secunia: The Secunia staff is spending hours every day to assure you the best and most reliable source for vulnerability information. Every single vulnerability report is being validated and verified before a Secunia advisory is written. Secunia validates and verifies vulnerability reports in many different ways e.g. by downloading the software and performing comprehensive tests, by reviewing source code, or by validating the credibility of the source from which the vulnerability report was issued. As a result, Secunia's database is the most correct and complete source for recent vulnerability information available on the Internet. Secunia Online Vulnerability Database: http://secunia.com/ ======================================================================== 2) This Week in Brief: The vulnerability in Microsoft Internet Explorer published last week has been upgraded to Extremely Critical since exploit code is now publicly available. All users of Microsoft Internet Explorer are strongly advised to review the referenced Secunia advisory below for a temporary workaround. Reference: http://secunia.com/SA18680 Companies have the option of requesting a Secunia account for immediate notification when a patch is released by Microsoft. Request Secunia Account: https://ca.secunia.com/?page=requestaccount&s -- Multiple vulnerabilities have been reported in Veritas Netbackup, which can be exploited by malicious people to compromise a vulnerable system. The vendor has released patches. Please see the referenced Secunia advisory. Reference: http://secunia.com/SA19417 -- Various RealNetworks products, including the popular RealOne and RealPlayer, are affected by several vulnerabilities, which can be exploited by malicious people to compromise a user's system. The complete list of vulnerable products may be found in the referenced Secunia advisory. All users of RealNetworks products are advised to check for available patches. Reference: http://secunia.com/SA19358 VIRUS ALERTS: Secunia has not issued any virus alerts during the week. ======================================================================== 3) This Weeks Top Ten Most Read Advisories: 1. [SA18680] Microsoft Internet Explorer "createTextRange()" Code Execution 2. [SA19342] Sendmail Signal Handling Memory Corruption Vulnerability 3. [SA19118] AVG Anti-Virus Updated Files Insecure File Permissions 4. [SA19358] RealNetworks Products Multiple Buffer Overflow Vulnerabilities 5. [SA19378] Internet Explorer Unspecified Automatic .HTA Application Execution 6. [SA18963] Mac OS X File Association Meta Data Shell Script Execution 7. [SA19406] Microsoft .NET Framework SDK ildasm Buffer Overflow 8. [SA19357] Linux Kernel IPv4 "sockaddr_in.sin_zero" Information Disclosure 9. [SA19360] Sun Solaris Sendmail Signal Handling Memory Corruption 10. [SA19331] Debian Network Installation Insecure Default Directory Permissions ======================================================================== 4) Vulnerabilities Summary Listing Windows: [SA19378] Internet Explorer Unspecified Automatic .HTA Application Execution [SA19441] EzASPSite "scheme" Parameter SQL Injection Vulnerability [SA19415] Absolute Live Support XE Script Insertion Vulnerability [SA19406] Microsoft .NET Framework SDK ildasm Buffer Overflow [SA19385] Metisware Instructor Task Script Insertion Vulnerability [SA19451] McAfee VirusScan DUNZIP32.dll Buffer Overflow Vulnerability [SA19430] couponZONE Cross-Site Scripting Vulnerabilities [SA19427] classifiedZONE "rtn" Cross-Site Scripting Vulnerability [SA19416] Web Quiz Pro Multiple Cross-Site Scripting Vulnerabilities [SA19401] Toast Forums Cross-Site Scripting Vulnerabilities [SA19399] ssCMS "keywords" Cross-Site Scripting Vulnerability [SA19398] dotNetBB "em" Cross-Site Scripting Vulnerability [SA19397] uniForum "wbsecadmin.aspx" Cross-Site Scripting [SA19396] Absolute FAQ Manager "question" Cross-Site Scripting [SA19386] EZHomepagePro Cross-Site Scripting Vulnerabilities [SA19381] E-School Management System "msg" Cross-Site Scripting [SA19375] Helm Web Hosting Control Panel Cross-Site Scripting Vulnerabilities UNIX/Linux: [SA19466] NetBSD Sendmail Memory Corruption Vulnerability [SA19450] F-Secure Messaging Security Gateway Sendmail Vulnerability [SA19407] OpenBSD update for sendmail [SA19404] Avaya Products Sendmail Signal Handling Memory Corruption [SA19394] HP-UX update for sendmail [SA19390] Gentoo update for realplayer [SA19380] Debian update for evolution [SA19463] NetBSD racoon IKE Message Processing Denial of Service [SA19449] PHPCollab "Forgot password" SQL Injection Vulnerability [SA19436] Debian update for netpbm-free [SA19425] Sourceworkshop newsletter "email" SQL Injection Vulnerability [SA19424] Debian update for flex [SA19418] MPlayer AVI "indx" Chunk and ASF Handling Vulnerabilities [SA19408] SUSE Updates for Multiple Packages [SA19377] SCO OpenServer update for xpdf [SA19374] Debian update for kernel-source-2.6.8 [SA19371] Trustix update for curl [SA19369] Debian update for kernel-source-2.4.27 [SA19457] UnixWare update for curl [SA19429] realestateZONE Cross-Site Scripting Vulnerabilities [SA19387] BlankOL "bol.cgi" Cross-Site Scripting Vulnerability [SA19405] SUSE update for freeradius [SA19395] Avaya PDS HP-UX swagentd Denial of Service Vulnerability [SA19373] HP-UX swagentd Denial of Service Vulnerability [SA19465] NetBSD mail Insecure Record File Creation [SA19464] NetBSD if_bridge Kernel Memory Disclosure Vulnerability [SA19444] Sun Cluster SunPlex Manager File Disclosure Vulnerability [SA19442] Gentoo bsd-games Privilege Escalation Vulnerability [SA19433] Gentoo update for openoffice / openoffice-bin [SA19426] Sun Solaris Process Environment Disclosure Security Issue [SA19376] Gentoo nethack / falconseye / slashem Privilege Escalation [SA19402] Linux Kernel IP ID Value Increment Weakness Other: Cross Platform: [SA19438] Virtual War "vwar_root" File Inclusion Vulnerability [SA19428] PHP Live Helper "abs_path" File Inclusion Vulnerability [SA19389] csDoom Format String and Buffer Overflow Vulnerabilities [SA19452] NetOffice "Forgot password" SQL Injection Vulnerability [SA19448] VBook Multiple Vulnerabilities [SA19447] Tilde CMS "id" SQL Injection Vulnerability [SA19446] OneOrZero "id" SQL Injection Vulnerability [SA19439] Cholod Mysql based message board Script Insertion and SQL Injection [SA19435] VNews Multiple Vulnerabilities [SA19422] vCounter "url" SQL Injection Vulnerability [SA19421] Pixel Motion Blog SQL Injection Vulnerabilities [SA19420] VSNS Lemon Multiple Vulnerabilities [SA19414] G-Book "g_message" Script Insertion Vulnerability [SA19413] Null news Multiple SQL Injection Vulnerabilities [SA19410] TWiki Restricted Content Access and Denial of Service [SA19403] Vihor Design Local File Disclosure Vulnerability [SA19400] WEBalbum Local File Inclusion Vulnerability [SA19392] Mambo AkoComment Module SQL Injection Vulnerabilities [SA19391] phpNewsManager Multiple SQL Injection Vulnerabilities [SA19388] Vavoom Two Denial of Service Vulnerabilities [SA19384] phpPgAds / phpAdsNew Two Vulnerabilities [SA19382] Nuked-Klan "m" SQL Injection Vulnerability [SA19417] Veritas NetBackup Multiple Buffer Overflow Vulnerabilities [SA19460] Explorer XP "chemin" Cross-Site Scripting and Directory Traversal [SA19445] Arab Portal "title" Cross-Site Scripting Vulnerability [SA19443] PHP Script Index "search" Cross-Site Scripting Vulnerability [SA19440] PHP Classifieds "searchword" Cross-Site Scripting Vulnerability [SA19434] Connect Daily Cross-Site Scripting Vulnerabilities [SA19432] CONTROLzx HMS Multiple Cross-Site Scripting Vulnerabilities [SA19431] ActiveCampaign SupportTrio "terms" Cross-Site Scripting [SA19423] Greymatter gm-upload.cgi File Upload Vulnerability [SA19419] phpCOIN "fs" Cross-Site Scripting Vulnerabilities [SA19412] PHP Ticket "frm_search_in" SQL Injection Vulnerability [SA19411] TFT Gallery "passwd" Exposure of User Credentials [SA19409] phpmyfamily "name" Cross-Site Scripting Vulnerability [SA19393] Calender Express Cross-Site Scripting Vulnerability [SA19383] PHP "html_entity_decode()" Information Disclosure Vulnerability [SA19379] CoMoblog "img.php" Cross-Site Scripting Vulnerability [SA19372] Meeting Reserve Cross-Site Scripting Vulnerability [SA19370] EasyMoblog "img.php" Cross-Site Scripting Vulnerability ======================================================================== 5) Vulnerabilities Content Listing Windows:-- [SA19378] Internet Explorer Unspecified Automatic .HTA Application Execution Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-27 Jeffrey van der Stad has reported a vulnerability in Internet Explorer, which can be exploited by malicious people to compromise a user's system. Full Advisory: http://secunia.com/advisories/19378/ -- [SA19441] EzASPSite "scheme" Parameter SQL Injection Vulnerability Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-30 Mustafa Can Bjorn has discovered a vulnerability in EzASPSite, which can be exploited by malicious people conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19441/ -- [SA19415] Absolute Live Support XE Script Insertion Vulnerability Critical: Moderately critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported a vulnerability in Absolute Live Support XE, which can be exploited by malicious people to conduct script insertion attacks. Full Advisory: http://secunia.com/advisories/19415/ -- [SA19406] Microsoft .NET Framework SDK ildasm Buffer Overflow Critical: Moderately critical Where: From remote Impact: DoS, System access Released: 2006-03-27 A vulnerability has been discovered in Microsoft .NET Framework SDK, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a user's system. Full Advisory: http://secunia.com/advisories/19406/ -- [SA19385] Metisware Instructor Task Script Insertion Vulnerability Critical: Moderately critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported a vulnerability in Metisware Instructor, which can be exploited by malicious people to conduct script insertion attacks. Full Advisory: http://secunia.com/advisories/19385/ -- [SA19451] McAfee VirusScan DUNZIP32.dll Buffer Overflow Vulnerability Critical: Less critical Where: From remote Impact: System access Released: 2006-03-30 A vulnerability has been discovered in McAfee VirusScan, which potentially can be exploited by malicious people to compromise a user's system. Full Advisory: http://secunia.com/advisories/19451/ -- [SA19430] couponZONE Cross-Site Scripting Vulnerabilities Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-28 r0t has reported some vulnerabilities in couponZONE, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19430/ -- [SA19427] classifiedZONE "rtn" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-28 r0t has reported a vulnerability in classifiedZONE, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19427/ -- [SA19416] Web Quiz Pro Multiple Cross-Site Scripting Vulnerabilities Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported some vulnerabilities in Web Quiz Pro, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19416/ -- [SA19401] Toast Forums Cross-Site Scripting Vulnerabilities Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has discovered some vulnerabilities in Toast Forums, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19401/ -- [SA19399] ssCMS "keywords" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported a vulnerability in ssCMS, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19399/ -- [SA19398] dotNetBB "em" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported a vulnerability in dotNetBB, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19398/ -- [SA19397] uniForum "wbsecadmin.aspx" Cross-Site Scripting Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported a vulnerability in uniForum, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19397/ -- [SA19396] Absolute FAQ Manager "question" Cross-Site Scripting Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported a vulnerability in Absolute FAQ Manager, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19396/ -- [SA19386] EZHomepagePro Cross-Site Scripting Vulnerabilities Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported some vulnerabilities in EZHomepagePro, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19386/ -- [SA19381] E-School Management System "msg" Cross-Site Scripting Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported a vulnerability in E-School Management System, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19381/ -- [SA19375] Helm Web Hosting Control Panel Cross-Site Scripting Vulnerabilities Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has discovered some vulnerabilities in Helm Web Hosting Control Panel, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19375/ UNIX/Linux:-- [SA19466] NetBSD Sendmail Memory Corruption Vulnerability Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-30 NetBSD has acknowledged a vulnerability in sendmail, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19466/ -- [SA19450] F-Secure Messaging Security Gateway Sendmail Vulnerability Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-29 F-Secure has acknowledged a vulnerability in F-Secure Messaging Security Gateway, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19450/ -- [SA19407] OpenBSD update for sendmail Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-27 OpenBSD has issued an update for sendmail. This fixes a vulnerability, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19407/ -- [SA19404] Avaya Products Sendmail Signal Handling Memory Corruption Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-27 Avaya has acknowledged a vulnerability in various Avaya products, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19404/ -- [SA19394] HP-UX update for sendmail Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-28 HP has issued an update for sendmail. This fixes a vulnerability, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19394/ -- [SA19390] Gentoo update for realplayer Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-27 Gentoo has issued an update for realplayer. This fixes a vulnerability, which can be exploited by malicious people to compromise a user's system. Full Advisory: http://secunia.com/advisories/19390/ -- [SA19380] Debian update for evolution Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-24 Debian has issued an update for evolution. This fixes some vulnerabilities, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19380/ -- [SA19463] NetBSD racoon IKE Message Processing Denial of Service Critical: Moderately critical Where: From remote Impact: DoS Released: 2006-03-30 NetBSD has acknowledged a vulnerability in racoon, which can be exploited by malicious people to cause a DoS (Denial of Service). Full Advisory: http://secunia.com/advisories/19463/ -- [SA19449] PHPCollab "Forgot password" SQL Injection Vulnerability Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-29 rgod has discovered a vulnerability in PHPCollab, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19449/ -- [SA19436] Debian update for netpbm-free Critical: Moderately critical Where: From remote Impact: System access Released: 2006-03-29 Debian has issued an update for netpbm-free. This fixes a vulnerability, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19436/ -- [SA19425] Sourceworkshop newsletter "email" SQL Injection Vulnerability Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-29 Aliaksandr Hartsuyeu has discovered a vulnerability in Sourceworkshop newsletter, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19425/ -- [SA19424] Debian update for flex Critical: Moderately critical Where: From remote Impact: System access Released: 2006-03-28 Debian has issued an update for flex. This fixes a vulnerability, which potentially can be exploited by malicious people to compromise a user's system. Full Advisory: http://secunia.com/advisories/19424/ -- [SA19418] MPlayer AVI "indx" Chunk and ASF Handling Vulnerabilities Critical: Moderately critical Where: From remote Impact: DoS, System access Released: 2006-03-29 xfocus has reported some vulnerabilities in MPlayer, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system. Full Advisory: http://secunia.com/advisories/19418/ -- [SA19408] SUSE Updates for Multiple Packages Critical: Moderately critical Where: From remote Impact: DoS, System access Released: 2006-03-27 SUSE has issued an update for multiple packages. This fixes some vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system. Full Advisory: http://secunia.com/advisories/19408/ -- [SA19377] SCO OpenServer update for xpdf Critical: Moderately critical Where: From remote Impact: DoS, System access Released: 2006-03-24 SCO has issued an update for xpdf. This fixes some vulnerabilities, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a user's system. Full Advisory: http://secunia.com/advisories/19377/ -- [SA19374] Debian update for kernel-source-2.6.8 Critical: Moderately critical Where: From remote Impact: Security Bypass, Exposure of sensitive information, Privilege escalation, DoS Released: 2006-03-24 Debian has issued an update for kernel-source-2.6.8. This fixes some vulnerabilities, which can be exploited by malicious, local users to disclose potentially sensitive information, cause a DoS (Denial of Service), gain escalated privileges, and bypass certain security restrictions, or by malicious people to cause a DoS, bypass certain security restrictions, and disclose certain sensitive information. Full Advisory: http://secunia.com/advisories/19374/ -- [SA19371] Trustix update for curl Critical: Moderately critical Where: From remote Impact: System access Released: 2006-03-24 Trustix has issued an update for curl. This fixes a vulnerability, which potentially can be exploited by malicious people to compromise a user's system. Full Advisory: http://secunia.com/advisories/19371/ -- [SA19369] Debian update for kernel-source-2.4.27 Critical: Moderately critical Where: From remote Impact: Security Bypass, Exposure of sensitive information, Privilege escalation, DoS Released: 2006-03-24 Debian has issued an update for kernel-source-2.4.27. This fixes some vulnerabilities, which can be exploited by malicious, local users to gain knowledge of potentially sensitive information, cause a DoS (Denial of Service), and gain escalated privileges, or by malicious people to cause a DoS and bypass certain security restrictions. Full Advisory: http://secunia.com/advisories/19369/ -- [SA19457] UnixWare update for curl Critical: Less critical Where: From remote Impact: Unknown Released: 2006-03-30 SCO has issued an update for curl. This fixes a vulnerability with an unknown impact. Full Advisory: http://secunia.com/advisories/19457/ -- [SA19429] realestateZONE Cross-Site Scripting Vulnerabilities Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-28 r0t has reported some vulnerabilities in realestateZONE, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19429/ -- [SA19387] BlankOL "bol.cgi" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 r0t has reported a vulnerability in BlankOL, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19387/ -- [SA19405] SUSE update for freeradius Critical: Less critical Where: From local network Impact: Security Bypass, DoS Released: 2006-03-28 SUSE has issued an update for freeradius. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service) and to bypass certain security restrictions. Full Advisory: http://secunia.com/advisories/19405/ -- [SA19395] Avaya PDS HP-UX swagentd Denial of Service Vulnerability Critical: Less critical Where: From local network Impact: DoS Released: 2006-03-27 Avaya has acknowledged a vulnerability in Avaya Predictive Dialing System (PDS), which can be exploited by malicious people to cause a DoS (Denial of Service). Full Advisory: http://secunia.com/advisories/19395/ -- [SA19373] HP-UX swagentd Denial of Service Vulnerability Critical: Less critical Where: From local network Impact: DoS Released: 2006-03-24 A vulnerability has been reported in HP-UX, which can be exploited by malicious people to cause a DoS (Denial of Service). Full Advisory: http://secunia.com/advisories/19373/ -- [SA19465] NetBSD mail Insecure Record File Creation Critical: Less critical Where: Local system Impact: Exposure of sensitive information Released: 2006-03-30 A security issue has been reported in NetBSD, which can be exploited by malicious, local users to gain knowledge of potentially sensitive information. Full Advisory: http://secunia.com/advisories/19465/ -- [SA19464] NetBSD if_bridge Kernel Memory Disclosure Vulnerability Critical: Less critical Where: Local system Impact: Exposure of sensitive information Released: 2006-03-30 A vulnerability has been reported in NetBSD, which can be exploited by malicious, local users to gain knowledge of potentially sensitive information. Full Advisory: http://secunia.com/advisories/19464/ -- [SA19444] Sun Cluster SunPlex Manager File Disclosure Vulnerability Critical: Less critical Where: Local system Impact: Exposure of sensitive information Released: 2006-03-30 A vulnerability has been reported in Sun Cluster, which can be exploited by malicious, local users to gain knowledge of potentially sensitive information. Full Advisory: http://secunia.com/advisories/19444/ -- [SA19442] Gentoo bsd-games Privilege Escalation Vulnerability Critical: Less critical Where: Local system Impact: Privilege escalation Released: 2006-03-30 Tavis Ormandy has reported some vulnerabilities in the bsd-games package, which potentially can be exploited by malicious, local users to gain escalated privileges. Full Advisory: http://secunia.com/advisories/19442/ -- [SA19433] Gentoo update for openoffice / openoffice-bin Critical: Less critical Where: Local system Impact: Unknown Released: 2006-03-28 Gentoo has issued updates for openoffice / openoffice-bin. These fix a vulnerability, which has an unknown impact. Full Advisory: http://secunia.com/advisories/19433/ -- [SA19426] Sun Solaris Process Environment Disclosure Security Issue Critical: Less critical Where: Local system Impact: Exposure of sensitive information Released: 2006-03-28 A security issue has been reported in Solaris, which can be exploited by malicious, local users to gain knowledge of potentially sensitive information. Full Advisory: http://secunia.com/advisories/19426/ -- [SA19376] Gentoo nethack / falconseye / slashem Privilege Escalation Critical: Less critical Where: Local system Impact: Manipulation of data, Privilege escalation Released: 2006-03-24 Gentoo has reported some vulnerabilities in the nethack / falconseye / slashem packages, which can be exploited by malicious, local users to gain escalated privileges. Full Advisory: http://secunia.com/advisories/19376/ -- [SA19402] Linux Kernel IP ID Value Increment Weakness Critical: Not critical Where: From remote Impact: Security Bypass, Exposure of system information Released: 2006-03-28 Marco Ivaldi has reported a weakness in the Linux kernel, which can be exploited by malicious people to disclose certain system information and potentially to bypass certain security restrictions. Full Advisory: http://secunia.com/advisories/19402/ Other: Cross Platform:-- [SA19438] Virtual War "vwar_root" File Inclusion Vulnerability Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-29 [Oo] has discovered a vulnerability in Virtual War, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19438/ -- [SA19428] PHP Live Helper "abs_path" File Inclusion Vulnerability Critical: Highly critical Where: From remote Impact: System access Released: 2006-03-28 rUnViRuS has reported a vulnerability in PHP Live Helper, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19428/ -- [SA19389] csDoom Format String and Buffer Overflow Vulnerabilities Critical: Highly critical Where: From remote Impact: DoS, System access Released: 2006-03-27 Luigi Auriemma has reported some vulnerabilities in csDoom, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19389/ -- [SA19452] NetOffice "Forgot password" SQL Injection Vulnerability Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-29 rgod has discovered a vulnerability in NetOffice, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19452/ -- [SA19448] VBook Multiple Vulnerabilities Critical: Moderately critical Where: From remote Impact: Cross Site Scripting, Manipulation of data, System access Released: 2006-03-30 Aliaksandr Hartsuyeu has discovered multiple vulnerabilities in VBook, which can be exploited by malicious people to conduct script insertion attacks and SQL injection attacks, and by malicious users to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19448/ -- [SA19447] Tilde CMS "id" SQL Injection Vulnerability Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-29 Preddy has reported a vulnerability in Tilde CMS, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19447/ -- [SA19446] OneOrZero "id" SQL Injection Vulnerability Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-29 Preddy has discovered a vulnerability in OneOrZero, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19446/ -- [SA19439] Cholod Mysql based message board Script Insertion and SQL Injection Critical: Moderately critical Where: From remote Impact: Cross Site Scripting, Manipulation of data Released: 2006-03-29 kspecial has discovered some vulnerabilities in Cholod Mysql based message board, which can be exploited by malicious people to conduct script insertion and SQL injection attacks. Full Advisory: http://secunia.com/advisories/19439/ -- [SA19435] VNews Multiple Vulnerabilities Critical: Moderately critical Where: From remote Impact: Cross Site Scripting, Manipulation of data, System access Released: 2006-03-30 Aliaksandr Hartsuyeu has reported some vulnerabilities in VNews, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct script insertion and SQL injection attacks. Full Advisory: http://secunia.com/advisories/19435/ -- [SA19422] vCounter "url" SQL Injection Vulnerability Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-29 Aliaksandr Hartsuyeu has discovered a vulnerability in vCounter, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19422/ -- [SA19421] Pixel Motion Blog SQL Injection Vulnerabilities Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-28 Morocco Security Team has discovered two vulnerabilities in Pixel Motion Blog, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19421/ -- [SA19420] VSNS Lemon Multiple Vulnerabilities Critical: Moderately critical Where: From remote Impact: Security Bypass, Cross Site Scripting, Manipulation of data Released: 2006-03-28 Aliaksandr Hartsuyeu has discovered multiple vulnerabilities in VSNS Lemon, which can be exploited by malicious people to conduct script insertion attacks, to bypass certain authentication, and to conduct SQL injection attack. Full Advisory: http://secunia.com/advisories/19420/ -- [SA19414] G-Book "g_message" Script Insertion Vulnerability Critical: Moderately critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 matrix_killer has discovered a vulnerability in G-Book, which can be exploited by malicious people to conduct script insertion attacks. Full Advisory: http://secunia.com/advisories/19414/ -- [SA19413] Null news Multiple SQL Injection Vulnerabilities Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-29 Aliaksandr Hartsuyeu has discovered some vulnerabilities in Null news, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19413/ -- [SA19410] TWiki Restricted Content Access and Denial of Service Critical: Moderately critical Where: From remote Impact: Security Bypass, DoS Released: 2006-03-27 A vulnerability and a security issue have been reported in TWiki, which can be exploited by malicious people to cause a DoS (Denial of Service) and bypass certain security restrictions. Full Advisory: http://secunia.com/advisories/19410/ -- [SA19403] Vihor Design Local File Disclosure Vulnerability Critical: Moderately critical Where: From remote Impact: Exposure of system information, Exposure of sensitive information Released: 2006-03-27 Patriotic Hackers has discovered a vulnerability in Vihor Design, which can be exploited by malicious people to gain knowledge of potentially sensitive information. Full Advisory: http://secunia.com/advisories/19403/ -- [SA19400] WEBalbum Local File Inclusion Vulnerability Critical: Moderately critical Where: From remote Impact: Exposure of sensitive information Released: 2006-03-27 rgod has discovered a vulnerability in WEBalbum, which can be exploited by malicious people to gain knowledge of potentially sensitive information. Full Advisory: http://secunia.com/advisories/19400/ -- [SA19392] Mambo AkoComment Module SQL Injection Vulnerabilities Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-28 Stefan Keller has reported two vulnerabilities in the AkoComment module for Mambo, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19392/ -- [SA19391] phpNewsManager Multiple SQL Injection Vulnerabilities Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-30 Aliaksandr Hartsuyeu has reported multiple vulnerabilities in phpNewsManager, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19391/ -- [SA19388] Vavoom Two Denial of Service Vulnerabilities Critical: Moderately critical Where: From remote Impact: DoS Released: 2006-03-27 Luigi Auriemma has reported two vulnerabilities in Vavoom, which can be exploited by malicious people to cause a DoS (Denial of Service). Full Advisory: http://secunia.com/advisories/19388/ -- [SA19384] phpPgAds / phpAdsNew Two Vulnerabilities Critical: Moderately critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 Two vulnerabilities have been reported in phpPgAds / phpAdsNew, which can be exploited by malicious people to conduct cross-site scripting and script insertion attacks. Full Advisory: http://secunia.com/advisories/19384/ -- [SA19382] Nuked-Klan "m" SQL Injection Vulnerability Critical: Moderately critical Where: From remote Impact: Manipulation of data Released: 2006-03-28 Moroccan Security Team has discovered a vulnerability in Nuked-Klan, which can be exploited by malicious people to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19382/ -- [SA19417] Veritas NetBackup Multiple Buffer Overflow Vulnerabilities Critical: Moderately critical Where: From local network Impact: System access Released: 2006-03-28 Multiple vulnerabilities have been reported in Veritas Netbackup, which can be exploited by malicious people to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19417/ -- [SA19460] Explorer XP "chemin" Cross-Site Scripting and Directory Traversal Critical: Less critical Where: From remote Impact: Cross Site Scripting, Exposure of system information Released: 2006-03-30 Silitix has discovered a vulnerability and a weakness in Fabien Gauharou Explorer XP, which can be exploited by malicious people to disclose system information and conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19460/ -- [SA19445] Arab Portal "title" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-29 stranger-killer has discovered a vulnerability in Arab Portal, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19445/ -- [SA19443] PHP Script Index "search" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-29 Preddy has reported a vulnerability in PHP Script Index, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19443/ -- [SA19440] PHP Classifieds "searchword" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-29 Preddy has discovered a vulnerability in PHP Classifieds, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19440/ -- [SA19434] Connect Daily Cross-Site Scripting Vulnerabilities Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-28 r0t has discovered some vulnerabilities in Connect Daily, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19434/ -- [SA19432] CONTROLzx HMS Multiple Cross-Site Scripting Vulnerabilities Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-28 r0t has reported multiple vulnerabilities in CONTROLzx HMS, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19432/ -- [SA19431] ActiveCampaign SupportTrio "terms" Cross-Site Scripting Critical: Less critical Where: From remote Impact: Cross Site Scripting, Exposure of system information Released: 2006-03-28 r0t has reported a vulnerability in ActiveCampaign SupportTrio, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19431/ -- [SA19423] Greymatter gm-upload.cgi File Upload Vulnerability Critical: Less critical Where: From remote Impact: System access Released: 2006-03-28 syst3m_f4ult has discovered a vulnerability in Greymatter, which can be exploited by malicious users to compromise a vulnerable system. Full Advisory: http://secunia.com/advisories/19423/ -- [SA19419] phpCOIN "fs" Cross-Site Scripting Vulnerabilities Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-28 r0t has discovered some vulnerabilities in phpCOIN, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19419/ -- [SA19412] PHP Ticket "frm_search_in" SQL Injection Vulnerability Critical: Less critical Where: From remote Impact: Manipulation of data Released: 2006-03-27 undefined1_ has discovered a vulnerability in PHP Ticket, which can be exploited by malicious users to conduct SQL injection attacks. Full Advisory: http://secunia.com/advisories/19412/ -- [SA19411] TFT Gallery "passwd" Exposure of User Credentials Critical: Less critical Where: From remote Impact: Exposure of sensitive information Released: 2006-03-27 undefined1_ has discovered a security issue in TFT Gallery, which can be exploited by malicious people to disclose sensitive information. Full Advisory: http://secunia.com/advisories/19411/ -- [SA19409] phpmyfamily "name" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting, Exposure of system information Released: 2006-03-28 matrix_killer has discovered a vulnerability in phpmyfamily, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19409/ -- [SA19393] Calender Express Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 Pratiksha Doshi has reported a vulnerability in Calendar Express, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19393/ -- [SA19383] PHP "html_entity_decode()" Information Disclosure Vulnerability Critical: Less critical Where: From remote Impact: Exposure of sensitive information Released: 2006-03-29 A vulnerability has been discovered in PHP, which can be exploited by malicious people to gain knowledge of potentially sensitive information. Full Advisory: http://secunia.com/advisories/19383/ -- [SA19379] CoMoblog "img.php" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-24 FarhadKey has discovered a vulnerability in CoMoblog, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19379/ -- [SA19372] Meeting Reserve Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-27 Pratiksha Doshi has reported a vulnerability in Meeting Reserve, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19372/ -- [SA19370] EasyMoblog "img.php" Cross-Site Scripting Vulnerability Critical: Less critical Where: From remote Impact: Cross Site Scripting Released: 2006-03-24 FarhadKey has discovered a vulnerability in EasyMoblog, which can be exploited by malicious people to conduct cross-site scripting attacks. Full Advisory: http://secunia.com/advisories/19370/ ======================================================================== Secunia recommends that you verify all advisories you receive, by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Subscribe: http://secunia.com/secunia_weekly_summary/ Contact details: Web : http://secunia.com/ E-mail : support@private Tel : +45 70 20 51 44 Fax : +45 70 20 51 45 _________________________________ InfoSec News v2.0 - Coming Soon! http://www.infosecnews.org
This archive was generated by hypermail 2.1.3 : Thu Mar 30 2006 - 23:01:54 PST