Security Bulletin from (November 25, 2003) to (December 15, 2003)

[ammar_secret]

November 25, 2003

November 22, 2003
2003-11-22: Opera Skin Zip File Buffer Overflow Vulnerability
A problem has been identified in the handling of zipped skin files by Opera.
Because of this, it may be possible for an attacker to gain unauthorized access
to a system using the vulnerable browser.
[Only registered and activated users can see links]


November 22, 2003
2003-11-22: VBPortal Friend.PHP Remote E-Mail Relaying Weakness
A problem has been identified the Friends.PHP script included in vbPortal.
Because of this, it may be possible for a remote attacker to relay unauthorized
e-mail.
[Only registered and activated users can see links]


November 22, 2003
2003-11-22: PrimeBase SQL Database Server Administrative Server Password
Storage Vulnerability
A problem has been reported in the storage of credentials in PrimeBase SQL
Database Server. Because of this, it may be possible for an attacker to gain
unauthorized access to resources.
[Only registered and activated users can see links]


November 21, 2003
O-029: Sun Security Vulnerability on Sun Systems with a PGX32 Frame Buffer
There is a security vulnerability in libraries associated with the PGX32 Frame
Buffer when a PGX32 Frame Buffer is installed. The risk is MEDIUM. A local user
would be able gain root privileges.
[Only registered and activated users can see links]


November 21, 2003
2003-11-21: Imatix Xitami Post Request Header Remote Denial Of Service
Vulnerability
A problem has been identified in the handling of certain types of requests by
Imatix Xitami. Because of this, it is possible for a remote attacker to deny
service to legitimate users of a vulnerable server.
[Only registered and activated users can see links]


November 20, 2003
2003-11-20: Sybase Adaptive Server Remote Password Array Heap Overflow
Vulnerability
The issue has been reported to present itself when invalid password and
servername buffer lengths in a remote password array are passed to the affected
server.
[Only registered and activated users can see links]


November 20, 2003
2003-11-20: EffectOffice Server Remote Service Buffer Overflow Vulnerability
A problem has been reported the service used by EffectOffice Server. Because of
this, it may be possible for a remote user to deny service to legitimate users
of the software.
[Only registered and activated users can see links]


November 20, 2003
2003-11-20: Sun Solaris PGX32 Libraries Unspecific Privilege Escalation
Vulnerability
A problem has been reported in the libraries used by PGX32 frame buffers.
Because of this, a local user may be able to gain unauthorized privileges.
[Only registered and activated users can see links]


November 20, 2003
2003-11-20: phpFriendlyAdmin Unspecified Cross-Site Scripting Vulnerability
It has been reported that phpFriendlyAdmin is prone to an unspecified cross-site
scripting vulnerability due to insufficient sanitization of user-supplied data.
[Only registered and activated users can see links]


November 20, 2003
2003-11-20: Apple Mac OS X Jaguar/Panther Multiple Vulnerabilities
Apple has released security updates to address several known vulnerabilities in
components included in Jaguar and Panther releases of Mac OS X.
[Only registered and activated users can see links]


November 19, 2003
2003-11-19: Yak! Chat Client FTP Server Default Username Credential Weakness
It has been reported that a weakness exists in the Yak! client FTP server. This
problem may increase the chances of an attacker gaining unauthorized access to
resources.
[Only registered and activated users can see links]


November 19, 2003
2003-11-19: Apple MacOS X Terminal sudo command Unauthorized Access
Vulnerability
It has been reported that certain versions of Apple MacOS X running on laptops
are vulnerable to an issue that may allow a physical attacker to gain
unauthorized access to the system.
[Only registered and activated users can see links]


November 19, 2003
2003-11-19: Valve Software Half-Life Dedicated Server Information
Disclosure/DOS Vulnerability
Half-Life dedicated server has been reported prone to an information disclosure
vulnerability. This issue may also be exploited to deny service to legitimate
users of the Half-Life dedicated server.
[Only registered and activated users can see links]


November 19, 2003
2003-11-19: International Ispell Munchlist/Findaffix Insecure Temporary File
Creation Vulnerability
International Ispell is prone to multiple instances of insecure temporary file
creation in the 'munchlist' and 'findaffix' shell scripts.
[Only registered and activated users can see links]

[ammar_secret]

-----------------------------------------------------------------------------------------------------------------------------------

December 2, 2003

November 29, 2003
2003-11-29: Apache mod_python Module Malformed Query Denial of Service
Vulnerability
Apache has reported that some versions of mod_python may be prone to denial of
service attacks when handling malformed queries.
[Only registered and activated users can see links]


November 29, 2003
2003-11-29: phpBB search.php SQL Injection Vulnerability
It has been reported that phpBB may be prone to a SQL injection vulnerability
that may allow an attacker to disclose sensitive information.
[Only registered and activated users can see links]


November 29, 2003
2003-11-29: PieterPost Unauthorized E-mail Account Access Vulnerability
PieterPost has been reported prone to a vulnerability that is said to grant
unauthorized users access as the 'virtual' user.
[Only registered and activated users can see links]


November 28, 2003
2003-11-28: Thomson SpeedTouch DSL Router Port Scan Denial Of Service
Vulnerability
A problem has been reported in SpeedTouch DSL routers when routing certain types
of traffic.
[Only registered and activated users can see links]


November 28, 2003
2003-11-28: SuSE XScreenSaver Package Multiple Vulnerabilities
SuSE have reported that xscreensaver packages shipped with SuSE Linux 9.0, are
prone to multiple vulnerabilities.
[Only registered and activated users can see links]


November 28, 2003
2003-11-28: GnuPG ElGamal Signing Key Private Key Compromise Vulnerability
GnuPG is prone to a vulnerability in the implementation of ElGamal signing keys
that could compromise private keys.
[Only registered and activated users can see links]


November 28, 2003
2003-11-28: OpenCA Signature Verification Vulnerabilities
Multiple flaws have been reported in OpenCA which cumulatively could cause a
revoked or expired certificate to be accepted.
[Only registered and activated users can see links]


November 27, 2003
2003-11-27: Bitfolge Snif Downloads Directory Traversal Vulnerability
Snif has been reported prone to a directory traversal issue.
[Only registered and activated users can see links]


November 27, 2003
2003-11-27: RemotelyAnywhere Autologon.HTML Password/Domain Cross-Site
Scripting Vulnerability
RemotelyAnywhere has been reported prone to a cross-site scripting vulnerability
that exists in the authentication interface.
[Only registered and activated users can see links]


November 27, 2003
2003-11-27: Traceroute Detection Security Tool Remote Format String
Vulnerability
A remote format string vulnerability has been discovered in the detecttr.c
traceroute detection tool, initially released in Phrack magazine.
[Only registered and activated users can see links]


November 27, 2003
2003-11-27: RNN Guestbook Multiple Vulnerabilities
Multiple vulnerabilities have been reported to exist in RNN Guestbook.
[Only registered and activated users can see links]


November 26, 2003
O-030: Hewlett Packard VirtualVault OpenSSH Vulnerabilities
Potential buffer overflow in OpenSSH versions prior to 3.7.1. The risk is
MEDIUM. Potential Denial of Service attack and remote execution of arbitrary
code.
[Only registered and activated users can see links]


November 26, 2003
2003-11-26: Macromedia JRun Administrative Interface Multiple Cross-Site
Scripting Vulnerabilities
A number of cross-site scripting vulnerabilities have been reported for
Macromedia Jrun, specifically in the administrative interface.
[Only registered and activated users can see links]


November 26, 2003
2003-11-26: Apple MacOS X DHCP Response Root Compromise Vulnerability
It has been reported that Apple MacOS X may be prone to a vulnerability that may
allow an attacker to gain root access to a vulnerable system via DHCP responses.
[Only registered and activated users can see links]


November 26, 2003
2003-11-26: Mozilla Chatzilla IRC URI Handler Memory Corruption Vulnerability
The Mozilla Chatzilla IRC URI handler is prone to a memory corruption
vulnerability when handling URIs of excessive length.
[Only registered and activated users can see links]


November 26, 2003
2003-11-26: HP ProCurve Switch Denial of Service Vulnerability
It has been reported that HP ProCurve Switches are prone to a denial of service
condition when faced with RCP worms.
[Only registered and activated users can see links]

[ammar_secret]

------------------------------------------------------------------------------------------------------------------------------------------
December 15, 2003

December 12, 2003
2003-12-12: CVS Malformed Request System Root File Creation Vulnerability
A problem has been discovered in the handling of some types of requests by CVS.
Because of this, it may be possible for an attacker to create files in the root
directory of a system hosting the vulnerable server.
[Only registered and activated users can see links]


December 11, 2003
O-038: CISCO Unity Vulnerabilities on IBM-based Servers
Recent installations of CISCO Unity running on IBM servers have been found to
contain default user accounts and IP addresses which the manufacturer did not
remove before distribution. The risk is MEDIUM.
[Only registered and activated users can see links]


December 11, 2003
O-037: Red Hat GnuPG Packages ElGamal Keys Vulnerability
ElGamal keys are used for both signing and encrypting functions. A vulnerability
has been identified in the way GnuPG packages create and use these keys. The
risk is HIGH.
[Only registered and activated users can see links]


December 11, 2003
O-036: CISCO Authentication Library in ACNS Vulnerability
A buffer overflow exists in the authentication module that can be used to
execute arbitrary code. The risk is HIGH. A remote attacker can get root access.
[Only registered and activated users can see links]


December 11, 2003
2003-12-11: Multiple Vendor XML DTD Parameter Entity SOAP Server Denial Of
Service Vulnerability
The problem is in the handling of SOAP requests that contain references to DTD
parameter entities. By making a SOAP request with maliciously crafted DTD data,
it is possible to trigger a prolonged denial of web services.
[Only registered and activated users can see links]


December 11, 2003
2003-12-11: Mozilla Browser URI MouseOver Obfuscation Weakness
It has been discovered that the Mozilla browser is prone to a URI obfuscation
weakness that may hide the true contents of a link. The problem occurs when a
user@location URI is formatted in such a way that a NULL byte is located after
the user value.
[Only registered and activated users can see links]


December 11, 2003
2003-12-11: RemotelyAnywhere Default.HTML Logout Message Injection Weakness
RemotelyAnywhere has been reported prone to a logout message injection weakness.
It has been reported that this issue presents itself due to a lack of sufficient
restrictions performed by RemotelyAnywhere on user supplied 'reason' URI
parameters.
[Only registered and activated users can see links]


December 11, 2003
2003-12-11: IRSSI Remote Denial of Service Vulnerability
A remote denial of service vulnerability has been discovered in IRSSI that could
allow a person to crash an IRSSI client process.
[Only registered and activated users can see links]


December 11, 2003
2003-12-11: Cyclonic Webmail Information Disclosure Vulnerability
Cyclonic webmail has been reported prone to an information disclosure
vulnerability. It has been reported that user data is stored in the /users/
folder.
[Only registered and activated users can see links]


December 11, 2003
2003-12-11: Sun Solaris Text Editor ed Temporary File Creation Vulnerability
It has been reported that Sun Solaris Text Editor ed may allow an attacker to
overwrite or create any file created by root on the system. A local user may be
able to exploit this issue by creating malicious symbolic links.
[Only registered and activated users can see links]


December 11, 2003
2003-12-11: SX Design sipd Remote Denial of Service Vulnerability
It has been reported that sipd may be prone to a vulnerability that may allow a
remote attacker to cause a denial of service condition in the software. The
problem is reported to exist in the gethostbyname_r function.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: Land Down Under Auth.PHP SQL Injection Vulnerability
Land Down Under is prone to SQL injection attacks. This is due to an input
validation error in the 'auth.php' script, which will permit remote attackers to
influence database queries.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: Mambo Open Source PollBooth.PHP Multiple SQL Injection
Vulnerabilities
Mambo Open Source is prone to SQL injection attacks. This is due to an input
validation error in 'pollBooth.php'. In particular, various user-supplied
variables are used in an SQL query without proper sanitization of SQL syntax.
[Only registered and activated users can see links]

[ammar_secret]

December 10, 2003
2003-12-10: Mambo Open Source 4.0.14 Server SQL Injection Vulnerability
It has bee reported that Mambo Open Source 4.0.14 Server is prone to SQL
injection attacks. The problem is said to occur due to insufficient sanitization
of data passed to specific index.php variables.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: Mambo Server user.php Script Unauthorized Access Vulnerability
It has been reported that Mambo Server may be prone to an unauthorized access
vulnerability that may allow an attacker to modify a user and/or an
administrator's information such as password, email, name etc, after supplying a
legitimate user id.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: NetGear WAB102 Wireless Access Point Password Management
Vulnerabilities
It has been reported that NetGear WAB102 Wireless Access Point may be prone to
multiple password management issues that could allow an attacker to gain access
to a vulnerable unit.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: FlashGet Insecure Dialup Credential Storage Vulnerability
FlashGet stores dialup credentials in a user-accessible registry key. The
username will be stored in plaintext and the password will be hex-encoded.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: Multiple VisitorBook LE Input Validation Vulnerabilities
VisitorBook LE has been reported prone to multiple input validation
vulnerabilities that may be exploited by a remote attacker to trigger database
corruption, launch cross-site scripting attacks and potentially use the affected
site as an email relay.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: Adaptive Server Anywhere Multiple Remote Buffer Overrun
Vulnerabilities
It has been discovered that Adaptive Server Anywhere is prone to multiple remote
buffer overrun vulnerabilities. The overruns can occur in a wide number of
procedures, stored procedures, and statements.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: Adaptive Server Anywhere XP_SPRINTF Format String Vulnerability
Adaptive Server Anywhere has been reported prone to a format string
vulnerability in the extended stored procedure XP_SPRINTF.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: Cisco Unity Default User Accounts and IP Addresses Multiple
Vulnerabilities
Multiple vulnerabilities have been identified in Cisco Unity running on IBM
servers. It has been reported that vulnerable systems contain default user
accounts and default IP addresses that could be used by an attacker to gain
unauthorized access.
[Only registered and activated users can see links]


December 10, 2003
2003-12-10: Cisco ACNS Authentication Library Remote Buffer Overrun
Vulnerability
Cisco has reported a remotely exploitable buffer overrun in ACNS authentication
libraries, which are typically deployed on various Content devices.
[Only registered and activated users can see links]


December 9, 2003
2003-12-09: Multiple Vendor XML Parser SOAP Server Denial Of Service
Vulnerability
A problem has been identified in several different SOAP servers when handling
certain types of requests. Because of this, it is possible for an attacker to
force a denial of service on systems using a vulnerable implementation.
[Only registered and activated users can see links]


December 9, 2003
2003-12-09: Mantis Multiple Unspecified Cross-Site Scripting Vulnerabilities
Problems have been identified in the handling of some types of input by Mantis.
Because of this, an attacker may be able to execute code in the browser of
target victims.
[Only registered and activated users can see links]


December 9, 2003
2003-12-09: Ben's Guestbook HTML Injection Vulnerability
A vulnerability has been reported in the software that may allow a remote
attacker to execute HTML and script code in a user's browser. The issue is
reported to be present in the comments field of the application.
[Only registered and activated users can see links]


December 9, 2003
2003-12-09: BNCweb BNCquery.pl File Disclosure Vulnerability
It has been reported that BNCweb may be prone to a file disclosure vulnerability
that allow remote attackers to gain unauthorized access to sensitive files
hosted on the system running the software. The problem exists in the BNCquery.pl
script.
[Only registered and activated users can see links]


December 9, 2003
2003-12-09: @mail Webmail System Multiple Vulnerabilities
It has been reported that @mail Webmail System may be prone to multiple
vulnerabilities that include directory traversal, SQL injection, session
hijacking, and cross-site scripting.
[Only registered and activated users can see links]

[ammar_secret]

December 9, 2003
2003-12-09: Bitfolge Snif Index.PHP Path Cross-Site Scripting Vulnerability
As a result, hostile HTML and script code may be embedded in a malicious link to
a site hosting the vulnerable software.
[Only registered and activated users can see links]


December 8, 2003
2003-12-08: NeoStats For Unreal IRCD Privilege Escalation Vulnerability
The issue presents itself due to an incompatibility with legacy umodes that are
supported by NeoStats and new umodes that have been introduced in the latest
version of UnrealIRCD.
[Only registered and activated users can see links]


December 8, 2003
2003-12-08: Chris Travers Hermes Unspecified File Include Vulnerability
It has been reported that Hermes may be prone to an unspecified file include
vulnerability that may allow an attacker to include malicious files containing
arbitrary code to be executed on a vulnerable system.
[Only registered and activated users can see links]


December 8, 2003
2003-12-08: FuzzyMonkey My Photo Gallery Unauthorized Access Vulnerability
It has been reported that My Photo Gallery is vulnerable to a vulnerability that
may allow an attacker to gain access to any directory without proper
authentication.
[Only registered and activated users can see links]


December 8, 2003
2003-12-08: HSFTP Hostname Command Line Argument Buffer Overrun Vulnerability
hsftp is prone to a locally exploitable buffer overrun vulnerability due to
insufficient bounds checking of hostname arguments supplied as command line
input.
[Only registered and activated users can see links]


December 8, 2003
2003-12-08: MyServer HTTP File Name Request Handler Remote Denial Of Service
Vulnerability
MyServer has been reported prone to a remotely triggered denial of service
vulnerability. The issue presents itself when a remote attacker requests a file
that contains spaces in its name.
[Only registered and activated users can see links]