========================================================================
The Secunia Weekly Advisory Summary
2007-02-08 - 2007-02-15
This week: 60 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
New Secunia blog entry about the "availability" of the latest Apple
QuickTime security update.
The update is ready, yet users are still only able to download the
vulnerable version from Apple.com - without any indication or guidance
about why or how to secure it:
http://secunia.com/blog/7/
Exploitation appears to be straight forward and the QuickTime player
is installed on more than 50% of all computers!
Use the Secunia Software Inspector for verification and real guidance
on how to secure your QuickTime player:
http://secunia.com/software_Inspector/
--
Should you be interesting in a career within Secunia, the current job
openings are available right now:
Security Sales Engineer:
http://corporate.secunia.com/about_secunia/54/
German Key Account Manager:
http://corporate.secunia.com/about_secunia/55/
International Account Manager - Enterprise Sales:
http://corporate.secunia.com/about_secunia/52/
International Sales Manager - IT Security Partner:
http://corporate.secunia.com/about_secunia/51/
Danish: Disassembling og Reversing
http://secunia.com/Disassembling_og_Reversing/
========================================================================
2) This Week in Brief:
Microsoft released twelve security bulletins for February; six of which
are rated by Microsoft as "Important", and six of which are rated as
"Critical".
The security updates patches vulnerabilities found in Internet
Explorer, Microsoft Office, Microsoft Word, Microsoft RichEdit,
Microsoft MFC, Microsoft OLE, Microsoft Malware Protection products,
Microsoft Data Access, HTML Help ActiveX Controls, Windows Image
Acquisition Service, Windows Shell, and Interactive Training.
The security updates for Microsoft Office and Microsoft Word are rated
by Secunia as "Extremely Critical", the highest Secunia advisory
rating, because of several zero-day attacks on these vulnerabilities
throughout December of last year into the first week of February. The
cumulative update for IE, and the advisory on the malware protection
engine of various Microsoft Malware Protection products, the HTML Help
ActiveX control, and the Interactive Training vulnerabilities are all
tagged as "Highly Critical" because, if successfully exploited, these
vulnerabilities could compromise a user's system and allow the
execution of arbitrary code.
You can use the Secunia Software Inspector to help you determine if
your system is up-to-date:
http://secunia.com/software_inspector/
For more information on this month's Microsoft Security Bulletin
releases, refer to the following Secunia advisories:
http://secunia.com/advisories/22452/ (Microsoft Data Access)
http://secunia.com/advisories/23950/ (Microsoft Word)
http://secunia.com/advisories/23205/ (Microsoft Word)
http://secunia.com/advisories/23232/ (Microsoft Word)
http://secunia.com/advisories/24008/ (Microsoft Office)
http://secunia.com/advisories/24121/ (Microsoft Interactive Training)
http://secunia.com/advisories/24126/ (Microsoft Windows Shell)
http://secunia.com/advisories/24132/ (Microsoft Windows Image
Acquisition)
http://secunia.com/advisories/24136/ (Microsoft Windows HTML Help
ActiveX Control)
http://secunia.com/advisories/24146/ (Microsoft Malware Protection
Engine)
http://secunia.com/advisories/24147/ (Microsoft Windows OLE)
http://secunia.com/advisories/24150/ (Microsoft Windows MFC)
http://secunia.com/advisories/24152/ (Microsoft RichEdit OLE)
http://secunia.com/advisories/24156/ (Internet Explorer)
--
Barely a day since the release of this month's Microsoft Security
Bulletin releases, an exploit using an unknown Microsoft Word
vulnerability was reportedly in the wild. The vulnerability, which is
caused due to an unknown error when parsing Word documents, can be
exploited to cause memory corruption and allow the execution of
arbitrary code.
Initial analysis had determined that the new vulnerability could only
cause a Denial of Service (DoS) on client systems. However, recent
analysis showed that the new vulnerability could allow system access.
Because of its heightened security impact, and because it is
currently being actively exploited, Secunia has rated this
vulnerability as "Extremely critical".
As this vulnerability is currently unpatched, users are urged not to
open untrusted Word documents to avoid falling victim to this latest
zero-day attack.
For more information, refer to the following Secunia advisory:
http://secunia.com/advisories/24122/
--
Two vulnerabilities in various Trend Micro products were released this
week.
A vulnerability in the way that various Trend Micro products handle
the processing of UPX compressed executables can be exploited to
cause a buffer overflow when scanning a specially crafted UPX file.
Successful exploitation crashes the system or may allow the execution
of arbitrary code.
Another vulnerability exists in various Trend Micro products because
of insufficient address space verification within the IOCTL handlers
of the TmComm.sys device driver and insecure permissions on the TmComm
DOS device interface. These can be exploited to access certain IOCTL
handlers and overwrite arbitrary memory and execute code with kernel
privileges.
Trend Micro has released security updates for both vulnerabilities.
For more information, refer to the following Secunia advisories:
http://secunia.com/advisories/24069/
http://secunia.com/advisories/24087/
--
VIRUS ALERTS:
During the past week Secunia collected 159 virus descriptions from the
Antivirus vendors. However, none were deemed MEDIUM risk or higher
according to the Secunia assessment scale.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA24087] Trend Micro Products UPX Processing Buffer Overflow
Vulnerability
2. [SA24008] Microsoft Office Two Code Execution Vulnerabilities
3. [SA24156] Internet Explorer Multiple Vulnerabilities
4. [SA24089] PHP Multiple Vulnerabilities
5. [SA24130] uTorrent "announce" Key Buffer Overflow
6. [SA18787] Internet Explorer Drag-and-Drop Vulnerability
7. [SA24120] Sun Solaris "in.telnetd" Authentication Bypass
8. [SA24082] Sun Solaris rm Race Condition Vulnerability
9. [SA24086] Firefox Sage Extension Feed Script Insertion
Vulnerability
10. [SA23666] Adobe Reader Unspecified Heap Corruption Vulnerability
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA24122] Microsoft Word Unspecified Memory Corruption Vulnerability
[SA24156] Internet Explorer Multiple Vulnerabilities
[SA24146] Microsoft Malware Protection Engine PDF File Parsing
Vulnerability
[SA24136] Microsoft Windows HTML Help ActiveX Control Vulnerability
[SA24130] uTorrent "announce" Key Buffer Overflow
[SA24128] CCC Cleaner UPX Processing Buffer Overflow Vulnerability
[SA24121] Microsoft Step-by-Step Interactive Training Bookmark Link
File Buffer Overflow
[SA24152] Microsoft RichEdit OLE Dialog Memory Corruption
Vulnerability
[SA24150] Microsoft MFC OLE Dialog Memory Corruption Vulnerability
[SA24147] Microsoft Windows OLE Dialog Memory Corruption Vulnerability
[SA24139] MailEnable NTLM Authentication Denial of Service
[SA24137] PollMentor "id" SQL Injection Vulnerability
[SA24103] Kiwi CatTools TFTP Server Directory Traversal Vulnerability
[SA24114] eWay "pid" Cross-Site Scripting Vulnerability
[SA24132] Microsoft Windows Image Aquisition Service Privilege
Escalation
[SA24126] Microsoft Windows Shell Privilege Escalation Vulnerability
UNIX/Linux:
[SA24133] MIMEDefang Unspecified Buffer Overflow Vulnerability
[SA24119] OPENi-CMS Seitenschutz Plugin "config[oi_dir]" File
Inclusion
[SA24108] Sun Solaris Mozilla 1.7 Vulnerabilities
[SA24167] Debian update for imagemagick
[SA24166] Sun Solaris TCP Subsystem Denial of Service
[SA24165] Gentoo update for rar and unrar
[SA24159] Amarok Magnatune Shell Command Injection
[SA24151] Trustix Update for Various Packages
[SA24145] Gentoo update for samba
[SA24169] HP-UX Single Logical Screen Daemon Arbitrary File Access
[SA24120] Sun Solaris "in.telnetd" Authentication Bypass
[SA24164] Gentoo update for snort
[SA24143] Fedora update for gd
[SA24135] Fedora Core 5 update for kernel
[SA24129] FreeBSD update for bind
[SA24123] TaskFreak "tznMessage" Cross-Site Scripting Vulnerability
[SA24117] Ubuntu update for moin and moin1.3
[SA24107] rPath update for gd
[SA24105] rPath update for kernel
[SA24174] Debian update for fetchmail
[SA24168] Sun Solaris X Font Server / X Render and DBE Extensions
Vulnerabilities
[SA24163] Gentoo update for proftpd
[SA24113] HP OpenView Storage Data Protector Unspecified Code
Execution
[SA24111] Mandriva update for smb4k
[SA24178] Fedora update for kernel
[SA24173] HP-UX ARPA Transport Denial of Service
[SA24131] rPath update for dbus, dbus-glib, dbus-qt, and dbus-x11
[SA24109] Linux Kernel "key_alloc_serial()" Denial of Service
Other:
[SA24180] Cisco Firewall Services Module SIP DoS and ACL Corruption
[SA24172] Cisco Firewall Services Module Multiple Vulnerabilities
[SA24142] Cisco IOS IPS Security Bypass and Denial of Service
[SA24118] IP3 NetAccess "getfile.cgi" Directory Traversal
Vulnerability
[SA24144] Aruba Mobility Controller Two Vulnerabilities
Cross Platform:
[SA24127] Plain Old Webserver Directory Traversal Vulnerability
[SA24125] Virtual Calendar Password Disclosure and Cross-Site
Scripting
[SA24116] OTSCMS SQL Injection and Cross-Site Scripting
[SA24112] HP Mercury Products Long "server_ip_name" Buffer Overflow
[SA24104] Novell Identity Manager JBoss Directory Traversal
Vulnerability
[SA24155] @Mail "keywords" Cross-Site Scripting Vulnerability
[SA24138] MoinMoin "hitcounts" and "general" Cross-Site Scripting
[SA24124] phpMyVisites "phpmyvisites.php" Cross-Site Scripting
[SA24115] Adobe ColdFusion MX Cross-Site Scripting Vulnerabilities
[SA24110] Qdig "Qwd" Cross-Site Scripting Vulnerability
[SA24106] cPanel "password" Cross-Site Scripting Vulnerability
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA24122] Microsoft Word Unspecified Memory Corruption Vulnerability
Critical: Extremely critical
Where: From remote
Impact: System access
Released: 2007-02-15
A vulnerability has been reported in Microsoft Word, which can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24122/
--
[SA24156] Internet Explorer Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-02-13
Some vulnerabilities have been reported in Internet Explorer, which can
be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24156/
--
[SA24146] Microsoft Malware Protection Engine PDF File Parsing
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-02-13
A vulnerability has been reported in Microsoft Malware Protection
Engine, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/24146/
--
[SA24136] Microsoft Windows HTML Help ActiveX Control Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-02-13
A vulnerability has been reported in Microsoft Windows, which can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24136/
--
[SA24130] uTorrent "announce" Key Buffer Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-02-13
defsec has discovered a vulnerability in uTorrent, which can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24130/
--
[SA24128] CCC Cleaner UPX Processing Buffer Overflow Vulnerability
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-02-12
A vulnerability has been reported in CCC Cleaner, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24128/
--
[SA24121] Microsoft Step-by-Step Interactive Training Bookmark Link
File Buffer Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-02-13
A vulnerability has been reported in Microsoft Step-by-Step Interactive
Training, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/24121/
--
[SA24152] Microsoft RichEdit OLE Dialog Memory Corruption
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-02-13
A vulnerability has been reported in Microsoft Windows and Microsoft
Office, which can be exploited by malicious people to compromise a
users system.
Full Advisory:
http://secunia.com/advisories/24152/
--
[SA24150] Microsoft MFC OLE Dialog Memory Corruption Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-02-13
A vulnerability has been reported in Microsoft Windows and Visual
Studio, which can be exploited by malicious people to compromise a
users system.
Full Advisory:
http://secunia.com/advisories/24150/
--
[SA24147] Microsoft Windows OLE Dialog Memory Corruption Vulnerability
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-02-13
A vulnerability has been reported in Microsoft Windows, which can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24147/
--
[SA24139] MailEnable NTLM Authentication Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-02-14
mu-b has discovered a vulnerability in MailEnable, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24139/
--
[SA24137] PollMentor "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-02-14
SaO has reported a vulnerability in PollMentor, which can be exploited
by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/24137/
--
[SA24103] Kiwi CatTools TFTP Server Directory Traversal Vulnerability
Critical: Moderately critical
Where: From local network
Impact: Exposure of system information, Exposure of sensitive
information, System access
Released: 2007-02-09
Nicob has discovered a vulnerability in Kiwi CatTools, which can be
exploited by malicious people to disclose sensitive information or
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24103/
--
[SA24114] eWay "pid" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-02-13
BLacK ZeRo has reported a vulnerability in eWay, which can be exploited
by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24114/
--
[SA24132] Microsoft Windows Image Aquisition Service Privilege
Escalation
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-02-13
A vulnerability has been reported in Microsoft Windows XP, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/24132/
--
[SA24126] Microsoft Windows Shell Privilege Escalation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-02-13
A vulnerability has been reported in Microsoft Windows, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/24126/
UNIX/Linux:--
[SA24133] MIMEDefang Unspecified Buffer Overflow Vulnerability
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-02-12
A vulnerability has been reported in MIMEDefang, which can be exploited
by malicious people to cause a DoS (Denial of Service) and potentially
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24133/
--
[SA24119] OPENi-CMS Seitenschutz Plugin "config[oi_dir]" File
Inclusion
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-02-12
Ahmad Muammar W.K has reported a vulnerability in the Seitenschutz
plugin for OPENi-CMS, which can be exploited by malicious people to
compromise vulnerable systems.
Full Advisory:
http://secunia.com/advisories/24119/
--
[SA24108] Sun Solaris Mozilla 1.7 Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Security Bypass, System access
Released: 2007-02-13
Sun has acknowledged some vulnerabilities in Mozilla 1.7 for Sun
Solaris, which can be exploited by malicious people to bypass certain
security restrictions or potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24108/
--
[SA24167] Debian update for imagemagick
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-02-15
Debian has issued an update for imagemagick. This fixes a
vulnerability, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/24167/
--
[SA24166] Sun Solaris TCP Subsystem Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-02-14
Sun has acknowledged a vulnerability in Sun Solaris, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24166/
--
[SA24165] Gentoo update for rar and unrar
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-02-14
Gentoo has issued an update for rar and unrar. This fixes a
vulnerability, which can be exploited by malicious people to compromise
a user's system.
Full Advisory:
http://secunia.com/advisories/24165/
--
[SA24159] Amarok Magnatune Shell Command Injection
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2007-02-15
A vulnerability has been reported in Amarok, which can potentially be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/24159/
--
[SA24151] Trustix Update for Various Packages
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information, DoS, System access
Released: 2007-02-13
Trustix has issued an update for multiple packages. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
cause a DoS (Denial of Service), by malicious users to gain knowledge
of potentially sensitive information or cause a DoS, and by malicious
people to gain knowledge of potentially sensitive knowledge, cause a
DoS, and potentially compromise a vulnerable system. This also contains
a new PHP version, which fixes unspecified security vulnerabilities.
Full Advisory:
http://secunia.com/advisories/24151/
--
[SA24145] Gentoo update for samba
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-02-14
Gentoo has issued an update for samba. This fixes some vulnerabilities,
which can be exploited by malicious users to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24145/
--
[SA24169] HP-UX Single Logical Screen Daemon Arbitrary File Access
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2007-02-14
A vulnerability has been reported in HP-UX, which can be exploited by
malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24169/
--
[SA24120] Sun Solaris "in.telnetd" Authentication Bypass
Critical: Moderately critical
Where: From local network
Impact: Security Bypass
Released: 2007-02-13
kcope has reported a vulnerability in Solaris, which can be exploited
by malicious people to bypass certain security restrictions and gain
access to a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24120/
--
[SA24164] Gentoo update for snort
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-02-14
Gentoo has issued an update for snort. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24164/
--
[SA24143] Fedora update for gd
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-02-13
Fedora has issued an update for gd. This fixes a vulnerability, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24143/
--
[SA24135] Fedora Core 5 update for kernel
Critical: Less critical
Where: From remote
Impact: Manipulation of data, DoS
Released: 2007-02-15
Fedora has issued an update for the kernel. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
cause a DoS (Denial of Service) and manipulate data, and by malicious
people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24135/
--
[SA24129] FreeBSD update for bind
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-02-12
FreeBSD has issued an update for bind. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24129/
--
[SA24123] TaskFreak "tznMessage" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-02-13
Spiked has discovered a vulnerability in TaskFreak, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24123/
--
[SA24117] Ubuntu update for moin and moin1.3
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-02-12
Ubuntu has issued an update for moin and moin1.3. This fixes some
vulnerabilities, which can be exploited by malicious users to conduct
script insertion attacks.
Full Advisory:
http://secunia.com/advisories/24117/
--
[SA24107] rPath update for gd
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-02-09
rPath has issued an update for gd. This fixes a vulnerability, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24107/
--
[SA24105] rPath update for kernel
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-02-12
rPath has issued an update for the kernel. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24105/
--
[SA24174] Debian update for fetchmail
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information
Released: 2007-02-15
Debian has issued an update for fetchmail. This fixes a security issue,
which can be exploited by malicious people to gain sensitive
information.
Full Advisory:
http://secunia.com/advisories/24174/
--
[SA24168] Sun Solaris X Font Server / X Render and DBE Extensions
Vulnerabilities
Critical: Less critical
Where: From local network
Impact: Privilege escalation, System access
Released: 2007-02-14
Sun has acknowledged some vulnerabilities in Sun Solaris, which can be
exploited by malicious, local users to gain escalated privileges or by
malicious users to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24168/
--
[SA24163] Gentoo update for proftpd
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-02-14
Gentoo has issued an update for proftpd. This fixes a vulnerability,
which can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/24163/
--
[SA24113] HP OpenView Storage Data Protector Unspecified Code
Execution
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-02-09
A vulnerability has been reported in HP OpenView Storage Data
Protector, which potentially can be exploited by malicious, local users
to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/24113/
--
[SA24111] Mandriva update for smb4k
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information, Privilege escalation,
DoS
Released: 2007-02-13
Mandriva has issued an update for smb4k. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
kill arbitrary processes, disclose potentially sensitive information,
and gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/24111/
--
[SA24178] Fedora update for kernel
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2007-02-15
Fedora has issued an update for the kernel. This fixes a vulnerability,
which can be exploited by malicious, local users to cause a DoS (Denial
of Service).
Full Advisory:
http://secunia.com/advisories/24178/
--
[SA24173] HP-UX ARPA Transport Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2007-02-15
A vulnerability has been reported in HP-UX, which can potentially be
exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24173/
--
[SA24131] rPath update for dbus, dbus-glib, dbus-qt, and dbus-x11
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2007-02-12
rPath has issued an update for dbus, dbus-glib, dbus-qt, and dbus-x11.
This fixes a weakness, which can be exploited by malicious, local users
to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24131/
--
[SA24109] Linux Kernel "key_alloc_serial()" Denial of Service
Critical: Not critical
Where: Local system
Impact: DoS
Released: 2007-02-13
A vulnerability has been reported in the Linux Kernel, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/24109/
Other:--
[SA24180] Cisco Firewall Services Module SIP DoS and ACL Corruption
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-02-15
A vulnerability and a security issue have been reported in Cisco
Firewall Services Module, which can be exploited by malicious people to
cause a DoS (Denial of Service) or bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/24180/
--
[SA24172] Cisco Firewall Services Module Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, DoS
Released: 2007-02-15
Some vulnerabilities and a security issue have been reported in Cisco
Firewall Services, which can be exploited by malicious people to cause
a DoS or bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/24172/
--
[SA24142] Cisco IOS IPS Security Bypass and Denial of Service
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, DoS
Released: 2007-02-14
Two vulnerabilities have been reported in Cisco IOS, which can be
exploited by malicious people to bypass certain security restrictions
or cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/24142/
--
[SA24118] IP3 NetAccess "getfile.cgi" Directory Traversal
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2007-02-15
Sebastian Wolfgarten has reported a vulnerability in IP3 NetAccess,
which can be exploited by malicious people to disclose sensitive
information.
Full Advisory:
http://secunia.com/advisories/24118/
--
[SA24144] Aruba Mobility Controller Two Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: Security Bypass, DoS, System access
Released: 2007-02-13
John Munther and Maxim Salomon have reported two vulnerabilities in
Aruba Mobility Controller, which can be exploited by malicious people
to bypass certain security restrictions, cause a DoS (Denial of
Service), or potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24144/
Cross Platform:--
[SA24127] Plain Old Webserver Directory Traversal Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2007-02-12
Stefano di Paola has reported a vulnerability in Plain Old Webserver
(POW), which can be exploited by malicious people to disclose sensitive
information.
Full Advisory:
http://secunia.com/advisories/24127/
--
[SA24125] Virtual Calendar Password Disclosure and Cross-Site
Scripting
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Exposure of sensitive information
Released: 2007-02-13
Some vulnerabilities and a security issue have been discovered in
Virtual Calendar, which can be exploited by malicious people to gain
knowledge of sensitive information and conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/24125/
--
[SA24116] OTSCMS SQL Injection and Cross-Site Scripting
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2007-02-09
GregStar has reported two vulnerabilities in OTSCMS, which can be
exploited by malicious people to conduct SQL injection attacks and
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24116/
--
[SA24112] HP Mercury Products Long "server_ip_name" Buffer Overflow
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2007-02-09
A vulnerability has been reported in various HP Mercury products, which
can be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24112/
--
[SA24104] Novell Identity Manager JBoss Directory Traversal
Vulnerability
Critical: Moderately critical
Where: From local network
Impact: Manipulation of data, Exposure of sensitive information,
System access
Released: 2007-02-12
Novell has acknowledged a vulnerability in Identity Manager, which can
be exploited by malicious users to disclose sensitive information,
manipulate data, or potentially to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/24104/
--
[SA24155] @Mail "keywords" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-02-14
Lostmon has reported a vulnerability in @Mail, which can be exploited
by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24155/
--
[SA24138] MoinMoin "hitcounts" and "general" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-02-12
En Douli has discovered some vulnerabilities in MoinMoin, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24138/
--
[SA24124] phpMyVisites "phpmyvisites.php" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-02-12
Nicob has discovered a vulnerability in phpMyVisites, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24124/
--
[SA24115] Adobe ColdFusion MX Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-02-14
Two vulnerabilities have been reported in Adobe ColdFusion MX, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/24115/
--
[SA24110] Qdig "Qwd" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-02-12
A vulnerability has been discovered in Qdig, which can be exploited by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24110/
--
[SA24106] cPanel "password" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-02-13
s3rv3r_hack3r has reported a vulnerability in cPanel, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/24106/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
______________________________________
Subscribe to the InfoSec News RSS Feed
http://www.infosecnews.org/isn.rss
This archive was generated by hypermail 2.1.3 : Thu Feb 15 2007 - 22:36:26 PST