========================================================================
The Secunia Weekly Advisory Summary
2007-10-25 - 2007-11-01
This week: 62 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
2003: 2,700 advisories published
2004: 3,100 advisories published
2005: 4,600 advisories published
2006: 5,300 advisories published
How do you know which Secunia advisories are important to you?
The Secunia Vulnerability Intelligence Solutions allows you to filter
and structure all the information you need, so you can address issues
effectively.
Get a free trial of the Secunia Vulnerability Intelligence Solutions:
http://corporate.secunia.com/how_to_buy/38/vi/?ref=summary_sm
========================================================================
2) This Week in Brief:
The vulnerabilities disclosed last week in IBM Lotus Domino due to
"third-party file viewers" was also discovered to affect several
Symantec products.
The affected files are originally included in the Verity Keyview SDK,
and are used in Symantec Mail Security for Exchange, Symantec Mail
Security for SMTP, and Symantec Mail Security for Domino, aside from
IBM Lotus Domino.
The highly critical vulnerabilities are caused by various errors
within the file viewers, and can be exploited by tricking a user into
viewing a specially crafted file.
The affected files are:
* mifsr.dll
* awsr.dll
* kpagrdr.dll
* exesr.dll
* rtfsr.dll
* mwsr.dll
* exesr.dll
* wp6sr.dll
* lasr.dll
Verity has released SDK version 9.2.0.12 to solve the vulnerabilities.
For more information, refer to:
http://secunia.com/advisories/27304/
Symantec has fixed the affected Symantec Mail Security for SMTP
versions, while Secunia is not aware of fixes for both Mail
Security for Domino and Mail Security for Exchange. For more
information, refer to the following:
Symantec Mail Security for SMTP:
http://secunia.com/advisories/27367/
Symantec Mail Security for Exchange:
http://secunia.com/advisories/27429/
Symantec Mail Security for Domino:
http://secunia.com/advisories/27388/
Corporate users are encouraged to request for a trial of the Secunia
Network Software Inspector, which you can use to check which systems
in your network are vulnerable:
http://secunia.com/network_software_inspector/
--
Secunia Research has discovered a moderately critical vulnerability
in the McAfee E-Business Server, which can be exploited by malicious
people to compromise a vulnerable system.
The vulnerability is caused due to an integer overflow within the
e-Business administration utility service when parsing authentication
packets. This can be exploited to cause a heap-based buffer overflow
via a specially crafted authentication packet with an overly large
length value, and allow an attacker to execute arbitrary code on the
system.
This vulnerability only affects E-Business Server 8.5.3 for Solaris
and E-Business Server 8.1.2 for Linux/HP-UX/AIX.Linux/HP-UX/AIX.
For more information, including patches released by the vendor, refer
to:
http://secunia.com/advisories/26372/
--
Secunia Research has discovered a moderately critical vulnerability
in CUPS, which can be exploited by malicious people to compromise a
vulnerable system.
The vulnerability is caused due to a boundary error within the
"ippReadIO()" function in cups/ipp.c when processing IPP (Internet
Printing Protocol) tags. This can be exploited to overwrite one byte
on the stack with a zero by sending an IPP request containing
specially crafted "textWithLanguage" or "nameWithLanguage" tags,
which allows an attacker to execute arbitrary code on the system.
The vulnerability is fixed in version 1.3.4. Affected users are urged
to update immediately. For more information, refer to:
http://secunia.com/advisories/27233/
--
Apple has acknowledged the presence of two year-old vulnerabilities
in Apple Xcode, which can be exploited by malicious, local users to
gain escalated privileges and by malicious people to cause a DoS
(Denial of Service) and potentially compromise a vulnerable system.
The vulnerabilities are caused due to the inclusion of vulnerable
versions of Binutils and OpenBase SQL. The Binutils vulnerability has
been known since May 2006, while the OpenBase SQL vulnerability has
been known since October 2006.
Apple has released version 2.5, which fixes the vulnerabilities.
Users are urged to download and install the latest version. For more
information, refer to:
http://secunia.com/advisories/27441/
--
VIRUS ALERTS:
During the past week Secunia collected 132 virus descriptions from the
Antivirus vendors. However, none were deemed MEDIUM risk or higher
according to the Secunia assessment scale.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA27367] Symantec Mail Security for SMTP File Parsing
Vulnerabilities
2. [SA27361] RealPlayer/RealOne/HelixPlayer Multiple Buffer Overflows
3. [SA27388] Symantec Mail Security for Domino File Parsing
Vulnerabilities
4. [SA27398] Apache Tomcat WebDAV Arbitrary File Content Disclosure
5. [SA27419] Nagios Plugins "check_snmp" Buffer Overflow Vulnerability
6. [SA27406] Multi-Forums Multiple SQL Injection Vulnerabilities
7. [SA27393] JustSystems Ichitaro Document Processing Multiple Buffer
Overflows
8. [SA27414] SUSE update for MozillaFirefox, mozilla, and seamonkey
9. [SA27411] AMX Mod X "geoip_code2()" and "geoip_code3()" Off-By-One
Vulnerabilities
10. [SA27376] activePDF DocConverter File Parsing Buffer Overflows
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA27475] Macrovision Products Update Service ActiveX Control Insecure
Methods
[SA27468] Novell BorderManager Client Trust Buffer Overflow
Vulnerability
[SA27429] Symantec Mail Security for Exchange File Parsing
Vulnerabilities
[SA27418] GOM Player GOM Manager ActiveX Control Buffer Overflow
[SA27417] World in Conflict Denial of Service Vulnerability
[SA27412] Symantec Altiris Deployment Solution Directory Traversal and
Privilege Escalation
UNIX/Linux:
[SA27458] Perdition IMAP Server Format String Vulnerability
[SA27454] yarssr GUI.pm URL Handling Command Injection Vulnerability
[SA27439] SUSE Update for Multiple Packages
[SA27434] Gentoo update for openssl
[SA27431] Gentoo update for opera
[SA27427] Sun Solaris Mozilla JavaScript Engine Multiple
Vulnerabilities
[SA27425] Debian update for iceweasel
[SA27423] Sun Mozilla Layout Engine Multiple Vulnerabilities
[SA27414] SUSE update for MozillaFirefox, mozilla, and seamonkey
[SA27403] rPath update for firefox and thunderbird
[SA27470] ISPworker Two Directory Traversal Vulnerabilities
[SA27465] IBM AIX BIND 8 Predictable DNS Query IDs Vulnerability
[SA27459] Avaya CMS / IR BIND Predictable DNS Query IDs Vulnerability
[SA27441] Apple Xcode Multiple Vulnerabilities
[SA27409] HP Oracle for OpenView Multiple Vulnerabilities
[SA27445] SUSE update for cups
[SA27419] Nagios Plugins "check_snmp" Buffer Overflow Vulnerability
[SA27410] Red Hat update for cups
[SA27461] AirKiosk URL Cross-Site Scripting Vulnerability
[SA27460] Fedora update for python
[SA27453] Fedora update for tar
[SA27444] Saxon "config[news_url]" Cross-Site Scripting
[SA27442] NuFW "samp_send()" Buffer Overflow Vulnerability
[SA27432] Fedora update for ruby
[SA27428] Sun Solaris 10 SCTP INIT Denial of Service Vulnerability
[SA27424] OpenLDAP Denial of Service Vulnerabilities
[SA27405] Ubuntu update for libpng
[SA27474] rPath update for cups
[SA27436] Red Hat update for kernel
[SA27438] Liferea "feedlist.opml" Backup Insecure File Permissions
[SA27437] IBM AIX Multiple Privilege Escalation Vulnerabilities
[SA27408] Debian update for xen-utils
[SA27420] vobcopy "/tmp/vobcopy.bla" Insecure Temporary File
Other:
[SA27433] Nortel Business Communications Manager BIND 8 Predictable DNS
Query IDs
[SA27416] Sun Fire X2100/X2200 Embedded Lights Out Manager Command
Execution
[SA27452] Blue Coat ProxySG SGOS Cross-Site Scripting Vulnerability
[SA27451] Hitachi Products Information Disclosure Vulnerability
Cross Platform:
[SA27413] Sige "SYS_PATH" File Inclusion Vulnerability
[SA27448] IBM WebSphere "uddigui/navigateTree.do" Cross-Site Scripting
and Request Forgery
[SA27443] JobSite Professional "id" SQL Injection Vulnerability
[SA27430] PHP-AGTC membership system adduser.php Security Bypass
[SA27422] Micro Login System userpwd.txt Information Disclosure
[SA27411] AMX Mod X "geoip_code2()" and "geoip_code3()" Off-By-One
Vulnerabilities
[SA27406] Multi-Forums Multiple SQL Injection Vulnerabilities
[SA27482] Apache Geronimo SQLLoginModule Non-existing User
Authentication Security Bypass
[SA27481] Apache Geronimo WebDAV Arbitrary File Content Disclosure
[SA27478] IBM WebSphere Application Server Community Edition
SQLLoginModule Security Bypass
[SA27464] IBM WebSphere Application Server Community Edition MEJB
Security Bypass
[SA27457] ILIAS Mail and Forum Message URL Script Insertion
[SA27449] Omnistar Live "category_id" Cross-Site Scripting
[SA27446] WebSphere Application Server Community Edition WebDAV Content
Disclosure
[SA27435] Django "i18n" Denial of Service Vulnerability
[SA27415] OneOrZero Helpdesk "description" Script Insertion
[SA27407] WordPress "posts_columns" Cross-Site Scripting
[SA27404] rNote Two Cross-Site Scripting Vulnerabilities
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA27475] Macrovision Products Update Service ActiveX Control Insecure
Methods
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-11-01
Some vulnerabilities have been reported in Macrovision products, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27475/
--
[SA27468] Novell BorderManager Client Trust Buffer Overflow
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-11-01
A vulnerability has been reported in Novell BorderManager, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27468/
--
[SA27429] Symantec Mail Security for Exchange File Parsing
Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-29
Multiple vulnerabilities have been discovered in Symantec Mail Security
for Exchange, which can be exploited by malicious people to cause a DoS
(Denial of Service) and compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27429/
--
[SA27418] GOM Player GOM Manager ActiveX Control Buffer Overflow
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-10-29
rgod has discovered a vulnerability in GOM Player, which can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27418/
--
[SA27417] World in Conflict Denial of Service Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2007-10-29
Luigi Auriemma has reported a vulnerability in World in Conflict, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/27417/
--
[SA27412] Symantec Altiris Deployment Solution Directory Traversal and
Privilege Escalation
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information, Privilege escalation
Released: 2007-10-31
Two vulnerabilities have been reported in Symantec Altiris Deployment
Solution, which can be exploited by malicious people to disclose
potentially sensitive information and by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/27412/
UNIX/Linux:--
[SA27458] Perdition IMAP Server Format String Vulnerability
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-31
Bernhard Mueller has reported a vulnerability in Perdition, which can
be exploited by malicious people to cause a DoS (Denial of Service) or
potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27458/
--
[SA27454] yarssr GUI.pm URL Handling Command Injection Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2007-10-31
Duncan Gilmore has discovered a vulnerability in yarssr, which can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27454/
--
[SA27439] SUSE Update for Multiple Packages
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-11-01
SUSE has issued updates for multiple packages. These fix some
vulnerabilities, which can be exploited by malicious users and
malicious people to cause a DoS (Denial of Service) or compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/27439/
--
[SA27434] Gentoo update for openssl
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-31
Gentoo has issued an update for openssl. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27434/
--
[SA27431] Gentoo update for opera
Critical: Highly critical
Where: From remote
Impact: Cross Site Scripting, System access
Released: 2007-10-31
Gentoo has issued an update for opera. This fixes some vulnerabilities,
which can be exploited by malicious people to conduct cross-site
scripting attacks and to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27431/
--
[SA27427] Sun Solaris Mozilla JavaScript Engine Multiple
Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-29
Sun has acknowledged some vulnerabilities in Mozilla 1.7 for Sun
Solaris, which potentially can be exploited by malicious people to
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27427/
--
[SA27425] Debian update for iceweasel
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-29
Debian has issued an update for iceweasel. This fixes some
vulnerabilities, which can be exploited by malicious people to disclose
potentially sensitive information, conduct phishing attacks, manipulate
certain data, and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27425/
--
[SA27423] Sun Mozilla Layout Engine Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-31
Sun has acknowledged some vulnerabilities in Mozilla 1.7 for Sun
Solaris, which potentially can be exploited by malicious people to
compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27423/
--
[SA27414] SUSE update for MozillaFirefox, mozilla, and seamonkey
Critical: Highly critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Spoofing,
Manipulation of data, Exposure of sensitive information, DoS, System
access
Released: 2007-10-26
SUSE has issued an update for MozillaFirefox, mozilla, and seamonkey.
This fixes a weakness and some vulnerabilities, which can be exploited
by malicious people to disclose sensitive information, conduct phishing
attacks, bypass certain security restrictions, manipulate certain data,
and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27414/
--
[SA27403] rPath update for firefox and thunderbird
Critical: Highly critical
Where: From remote
Impact: Spoofing, Manipulation of data, Exposure of sensitive
information, DoS, System access
Released: 2007-10-29
rPath has issued an update for firefox and thunderbird. This fixes some
vulnerabilities, which can be exploited by malicious people to disclose
potentially sensitive information, conduct phishing attacks, manipulate
certain data, and compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27403/
--
[SA27470] ISPworker Two Directory Traversal Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2007-11-01
GoLd_M has discovered two vulnerabilities in ISPworker, which can be
exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/27470/
--
[SA27465] IBM AIX BIND 8 Predictable DNS Query IDs Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Spoofing
Released: 2007-10-31
IBM has acknowledged a vulnerability in AIX, which can be exploited by
malicious people to poison the DNS cache.
Full Advisory:
http://secunia.com/advisories/27465/
--
[SA27459] Avaya CMS / IR BIND Predictable DNS Query IDs Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Spoofing
Released: 2007-10-31
Avaya has acknowledged a vulnerability in Avaya CMS and IR, which can
be exploited by malicious people to poison the DNS cache.
Full Advisory:
http://secunia.com/advisories/27459/
--
[SA27441] Apple Xcode Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Privilege escalation, DoS, System access
Released: 2007-10-31
Apple has acknowledged some vulnerabilities in Apple Xcode, which can
be exploited by malicious, local users to gain escalated privileges and
by malicious people to cause a DoS (Denial of Service) and potentially
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27441/
--
[SA27409] HP Oracle for OpenView Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Unknown, Manipulation of data, Exposure of sensitive
information, DoS
Released: 2007-10-26
HP has acknowledged some vulnerabilities in HP OfO (Oracle for
Openview). Some of these vulnerabilities have unknown impacts, others
can be exploited to disclose sensitive information, conduct SQL
injection attacks, or to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27409/
--
[SA27445] SUSE update for cups
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2007-11-01
SUSE has issued an update for cups. This fixes a vulnerability, which
can be exploited by malicious people to cause a DoS (Denial of Service)
or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27445/
--
[SA27419] Nagios Plugins "check_snmp" Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From local network
Impact: DoS, System access
Released: 2007-10-26
fabiodds has reported a vulnerability in Nagios Plugins, which can be
exploited by malicious people to cause a DoS (Denial of Service) and
potentially to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27419/
--
[SA27410] Red Hat update for cups
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2007-10-31
Red Hat has issued an update for cups. This fixes a vulnerability,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/27410/
--
[SA27461] AirKiosk URL Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-31
Skien has reported a vulnerability in AirKiosk, which can be exploited
by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27461/
--
[SA27460] Fedora update for python
Critical: Less critical
Where: From remote
Impact: System access, DoS
Released: 2007-10-30
Fedora has issued an update for python. This fixes a security issue,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27460/
--
[SA27453] Fedora update for tar
Critical: Less critical
Where: From remote
Impact: System access
Released: 2007-10-30
Fedora has issued an update for tar. This fixes a vulnerability, which
can be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/27453/
--
[SA27444] Saxon "config[news_url]" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-30
Jesper Jurcenoks has reported a vulnerability in Saxon (Simple
Accessible XHTML Online News), which can be exploited by malicious
people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27444/
--
[SA27442] NuFW "samp_send()" Buffer Overflow Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-10-30
A vulnerability has been reported in NuFW, which can potentially be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27442/
--
[SA27432] Fedora update for ruby
Critical: Less critical
Where: From remote
Impact: Spoofing
Released: 2007-10-30
Fedora has issued an update for ruby. This fixes a security issue,
which can be exploited by malicious people to conduct spoofing
attacks.
Full Advisory:
http://secunia.com/advisories/27432/
--
[SA27428] Sun Solaris 10 SCTP INIT Denial of Service Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-10-29
Sun has acknowledged a vulnerability in Solaris, which can be exploited
by malicious users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27428/
--
[SA27424] OpenLDAP Denial of Service Vulnerabilities
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-10-29
Some vulnerabilities have been reported in OpenLDAP, which can be
exploited by malicious users to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27424/
--
[SA27405] Ubuntu update for libpng
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-10-26
Ubuntu has issued an update for libpng. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27405/
--
[SA27474] rPath update for cups
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2007-11-01
rPath has issued an update for cups. This fixes a vulnerability, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/27474/
--
[SA27436] Red Hat update for kernel
Critical: Less critical
Where: From local network
Impact: Security Bypass, Exposure of sensitive information, DoS
Released: 2007-11-01
Red Hat has issued an update for the kernel. This fixes a weakness,
some security issues and vulnerabilities, which can be exploited by
malicious, local users to cause a DoS (Denial of Service), disclose
potentially sensitive information, and malicious users and malicious
people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/27436/
--
[SA27438] Liferea "feedlist.opml" Backup Insecure File Permissions
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2007-10-30
A security issue has been reported in Liferea, which can be exploited
by malicious, local users to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/27438/
--
[SA27437] IBM AIX Multiple Privilege Escalation Vulnerabilities
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2007-10-31
Multiple vulnerabilities have been reported in IBM AIX, which can be
exploited by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/27437/
--
[SA27408] Debian update for xen-utils
Critical: Less critical
Where: Local system
Impact: Manipulation of data
Released: 2007-10-26
Debian has issued an update for xen-utils. This fixes a security issue,
which can be exploited by malicious, local users to truncate arbitrary
files.
Full Advisory:
http://secunia.com/advisories/27408/
--
[SA27420] vobcopy "/tmp/vobcopy.bla" Insecure Temporary File
Critical: Not critical
Where: Local system
Impact: Privilege escalation
Released: 2007-10-29
Joey Hess has reported a security issue in vobcopy, which can be
exploited by malicious, local users to perform certain actions with
escalated privileges.
Full Advisory:
http://secunia.com/advisories/27420/
Other:--
[SA27433] Nortel Business Communications Manager BIND 8 Predictable DNS
Query IDs
Critical: Moderately critical
Where: From remote
Impact: Spoofing
Released: 2007-10-29
Nortel has acknowledged a vulnerability in Business Communications
Manager, which potentially can be exploited by malicious people to
poison the DNS cache.
Full Advisory:
http://secunia.com/advisories/27433/
--
[SA27416] Sun Fire X2100/X2200 Embedded Lights Out Manager Command
Execution
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2007-10-30
A vulnerability has been reported in Sun Fire X2100 M2 and X2200 M2,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/27416/
--
[SA27452] Blue Coat ProxySG SGOS Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-11-01
A vulnerability has been reported in the Blue Coat ProxySG SGOS, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/27452/
--
[SA27451] Hitachi Products Information Disclosure Vulnerability
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-10-31
A vulnerability has been reported in multiple Hitachi products, which
can be exploited by malicious people to disclose potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/27451/
Cross Platform:--
[SA27413] Sige "SYS_PATH" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information, System access
Released: 2007-10-29
GoLd_M has discovered a vulnerability in Sige, which can be exploited
by malicious people to disclose sensitive information or to compromise
a vulnerable system.
Full Advisory:
http://secunia.com/advisories/27413/
--
[SA27448] IBM WebSphere "uddigui/navigateTree.do" Cross-Site Scripting
and Request Forgery
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-31
IBM has acknowledged some vulnerabilities in IBM WebSphere, which can
be exploited by malicious people to conduct cross-site scripting and
request forgery attacks.
Full Advisory:
http://secunia.com/advisories/27448/
--
[SA27443] JobSite Professional "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information
Released: 2007-10-29
ZynbER has reported a vulnerability in JobSite Professional, which can
be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/27443/
--
[SA27430] PHP-AGTC membership system adduser.php Security Bypass
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Manipulation of data
Released: 2007-10-30
0x90 has reported a vulnerability in PHP-AGTC membership system, which
can be exploited by malicious people to bypass certain security
restrictions.
Full Advisory:
http://secunia.com/advisories/27430/
--
[SA27422] Micro Login System userpwd.txt Information Disclosure
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-10-29
0x90 has discovered a security issue in Micro Login System, which can
be exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/27422/
--
[SA27411] AMX Mod X "geoip_code2()" and "geoip_code3()" Off-By-One
Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2007-10-26
Simon Logic has reported some vulnerabilities in AMX Mod X, which can
potentially be exploited by malicious people to cause a DoS (Denial of
Service) or compromise an application using the plugin.
Full Advisory:
http://secunia.com/advisories/27411/
--
[SA27406] Multi-Forums Multiple SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2007-10-26
KiNgOfThEwOrLd has reported some vulnerabilities in the Multi-Forums
module for phpBB, which can be exploited by malicious people to conduct
SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/27406/
--
[SA27482] Apache Geronimo SQLLoginModule Non-existing User
Authentication Security Bypass
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2007-11-01
A security issue has been reported in Apache Geronimo, which can be
exploited by malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/27482/
--
[SA27481] Apache Geronimo WebDAV Arbitrary File Content Disclosure
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-11-01
A vulnerability has been acknowledged in Apache Geronimo, which can be
exploited by malicious users to disclose potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/27481/
--
[SA27478] IBM WebSphere Application Server Community Edition
SQLLoginModule Security Bypass
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2007-11-01
IBM has acknowledged a security issue in WebSphere Application Server
Community Edition, which can be exploited by malicious people to bypass
certain security restrictions.
Full Advisory:
http://secunia.com/advisories/27478/
--
[SA27464] IBM WebSphere Application Server Community Edition MEJB
Security Bypass
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2007-10-31
IBM has acknowledged a vulnerability in WebSphere Application Server
Community Edition, which can be exploited by malicious people to bypass
certain security restrictions.
Full Advisory:
http://secunia.com/advisories/27464/
--
[SA27457] ILIAS Mail and Forum Message URL Script Insertion
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-31
L4teral has discovered some vulnerabilities in ILIAS, which can be
exploited by malicious users to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/27457/
--
[SA27449] Omnistar Live "category_id" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-30
Doz has reported a vulnerability in Omnistar Live, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27449/
--
[SA27446] WebSphere Application Server Community Edition WebDAV Content
Disclosure
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2007-11-01
IBM has acknowledged a vulnerability in WebSphere Application Server
Community Edition, which can be exploited by malicious users to
disclose potentially sensitive information.
Full Advisory:
http://secunia.com/advisories/27446/
--
[SA27435] Django "i18n" Denial of Service Vulnerability
Critical: Less critical
Where: From remote
Impact: DoS
Released: 2007-10-29
A vulnerability has been reported in Django, which potentially can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/27435/
--
[SA27415] OneOrZero Helpdesk "description" Script Insertion
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-26
Joseph.Giron13 has discovered a vulnerability in OneOrZero Helpdesk,
which can be exploited by malicious users to conduct script insertion
attacks.
Full Advisory:
http://secunia.com/advisories/27415/
--
[SA27407] WordPress "posts_columns" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-29
Janek Vind has discovered a vulnerability in WordPress, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/27407/
--
[SA27404] rNote Two Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2007-10-26
RoMaNcYxHaCkEr has discovered two vulnerabilities in rNote, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/27404/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support@private
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
__________________________________________________________________
CSI 2007 is the only conference that delivers a business-focused
overview of enterprise security. It will convene 1,500+ delegates,
80 exhibitors and features 100+ sessions/seminars providing a
roadmap for integrating policies and procedures with new tools
and techniques. Register now for savings on conference fees
and/or free exhibits admission. - www.csiannual.com
This archive was generated by hypermail 2.1.3 : Fri Nov 02 2007 - 00:33:19 PST