lighttpd -- multiple vulnerabilities 1.4.15_1

Secunia Advisory reports:

Some vulnerabilities have been reported in lighttpd, which can be exploited by malicious people to bypass certain security restrictions or cause a DoS (Denial of Service).

http://trac.lighttpd.net/trac/ticket/1216 http://trac.lighttpd.net/trac/ticket/1232 http://trac.lighttpd.net/trac/ticket/1230 http://trac.lighttpd.net/trac/ticket/1263 2007-07-20 2007-07-21
opera -- multiple vulnerabilities opera opera-devel linux-opera 9.22

Opera Software ASA reports of multiple security fixes in Opera, including an arbitrary code execute vulnerability:

Opera for Linux, FreeBSD, and Solaris has a flaw in the createPattern function that leaves old data that was in the memory before Opera allocated it in the new pattern. The pattern can be read and analyzed by JavaScript, so an attacker can get random samples of the user's memory, which may contain data.

Removing a specially crafted torrent from the download manager can crash Opera. The crash is caused by an erroneous memory access.

An attacker needs to entice the user to accept the malicious BitTorrent download, and later remove it from Opera's download manager. To inject code, additional means will have to be employed.

Users clicking a BitTorrent link and rejecting the download are not affected.

data: URLs embed data inside them, instead of linking to an external resource. Opera can mistakenly display the end of a data URL instead of the beginning. This allows an attacker to spoof the URL of a trusted site.

Opera's HTTP authentication dialog is displayed when the user enters a Web page that requires a login name and a password. To inform the user which server it was that asked for login credentials, the dialog displays the server name.

The user has to see the entire server name. A truncated name can be misleading. Opera's authentication dialog cuts off the long server names at the right hand side, adding an ellipsis (...) to indicate that it has been cut off.

The dialog has a predictable size, allowing an attacker to create a server name which will look almost like a trusted site, because the real domain name has been cut off. The three dots at the end will not be obvious to all users.

This flaw can be exploited by phishers who can set up custom sub-domains, for example by hosting their own public DNS.

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=564 http://www.opera.com/support/search/view/861/ http://www.opera.com/support/search/view/862/ http://www.opera.com/support/search/view/863/ http://www.opera.com/support/search/view/864/ http://www.opera.com/docs/changelogs/freebsd/922/ 2007-07-19 2007-07-19
mozilla -- multiple vulnerabilities firefox 2.0.0.5,1 3.*,1 linux-firefox linux-thunderbird mozilla-thunderbird thunderbird 2.0.0.5 seamonkey linux-seamonkey 0 linux-firefox-devel 0 linux-seamonkey-devel 0 firefox-ja linux-mozilla-devel linux-mozilla mozilla 0

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2007-25 XPCNativeWrapper pollution
  • MFSA 2007-24 Unauthorized access to wyciwyg:// documents
  • MFSA 2007-21 Privilege escalation using an event handler attached to an element not in the document
  • MFSA 2007-20 Frame spoofing while window is loading
  • MFSA 2007-19 XSS using addEventListener and setTimeout
  • MFSA 2007-18 Crashes with evidence of memory corruption
CVE-2007-3089 CVE-2007-3734 CVE-2007-3735 CVE-2007-3737 CVE-2007-3738 http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5 http://www.mozilla.org/security/announce/2007/mfsa2007-18.html http://www.mozilla.org/security/announce/2007/mfsa2007-19.html http://www.mozilla.org/security/announce/2007/mfsa2007-20.html http://www.mozilla.org/security/announce/2007/mfsa2007-21.html http://www.mozilla.org/security/announce/2007/mfsa2007-24.html http://www.mozilla.org/security/announce/2007/mfsa2007-25.html TA07-199A 2007-07-17 2007-07-19
linux-flashplugin -- critical vulnerabilities linux-flashplugin 9.09.0r45 8.08.0r34 7.0r69

Adobe reports:

Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities.

CVE-2007-2022 CVE-2007-3456 CVE-2007-3457 2007-07-10 2007-07-18
wireshark -- Multiple problems wireshark wireshark-lite ethereal ethereal-lite tethereal tethereal-lite 0.8.200.99.6

wireshark Team reports:

It may be possible to make Wireshark or Ethereal crash or use up available memory by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

http://secunia.com/advisories/25833/ http://www.wireshark.org/security/wnpa-sec-2007-02.html 2007-06-29 2007-07-06 2007-07-07
typespeed -- arbitrary code execution typespeed 0.4.1

Debian reports:

Ulf Härnhammar from the Debian Security Audit Project discovered a problem in typespeed, a touch-typist trainer disguised as game. This could lead to a local attacker executing arbitrary code.

CVE-2005-0105 http://www.debian.org/security/2005/dsa-684 2005-02-16 2007-07-03 2007-07-09
vlc -- format string vulnerability and integer overflow vlc 0.8.6c

isecpartners reports:

VLC is vulnerable to a format string attack in the parsing of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA data or SAP/SDP service discovery messages. Additionally, there are two errors in the handling of wav files, one a denial of service due to an uninitialized variable, and one integer overflow in sampling frequency calculations.

http://www.isecpartners.com/advisories/2007-001-vlc.txt 2007-06-05 2007-06-18
flac123 -- stack overflow in comment parsing flac123 0.9.10

isecpartners reports:

flac123, also known as flac-tools, is vulnerable to a buffer overflow in vorbis comment parsing. This allows for the execution of arbitrary code.

http://www.isecpartners.com/advisories/2007-002-flactools.txt 2007-06-05 2007-06-28
gd -- multiple vulnerabilities gd 2.0.35,1

gd had been reported vulnerable to several vulnerabilities:

  • CVE-2007-3472: Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers has unspecified attack vectors and impact.
  • CVE-2007-3473: The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.
  • CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.
  • CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map.
  • CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
  • CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.
  • CVE-2007-3478: Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
CVE-2007-3472 CVE-2007-3473 CVE-2007-3474 CVE-2007-3475 CVE-2007-3476 CVE-2007-3477 CVE-2007-3478 http://www.libgd.org/ReleaseNote020035 http://www.frsirt.com/english/advisories/2007/2336 http://bugs.libgd.org/?do=details&task_id=89 http://bugs.libgd.org/?do=details&task_id=94 http://bugs.libgd.org/?do=details&task_id=70 http://bugs.libgd.org/?do=details&task_id=87 http://bugs.libgd.org/?do=details&task_id=92 http://bugs.libgd.org/?do=details&task_id=74 http://bugs.libgd.org/?do=details&task_id=48 http://bugs.php.net/bug.php?id=40578 2007-06-21 2007-06-29
evolution-data-server -- remote execution of arbitrary code vulnerability evolution-data-server 1.10.2_1 1.11.*1.11.4

Debian project reports:

It was discovered that the IMAP code in the Evolution Data Server performs insufficient sanitising of a value later used an array index, which can lead to the execution of arbitrary code.

CVE-2007-3257 http://secunia.com/advisories/25766/ http://bugzilla.gnome.org/show_bug.cgi?id=447414 2007-06-23 2007-06-25 2007-06-28
xpcd -- buffer overflow xpcd 0

Debian Project reports:

Erik Sjolund discovered a buffer overflow in pcdsvgaview, an SVGA PhotoCD viewer. xpcd-svga is part of xpcd and uses svgalib to display graphics on the Linux console for which root permissions are required. A malicious user could overflow a fixed-size buffer and may cause the program to execute arbitrary code with elevated privileges.

12523 CVE-2005-0074 http://www.debian.org/security/2005/dsa-676 2005-02-11 2007-06-21
clamav -- multiple vulnerabilities clamav 0.90.3

Clamav had been found vulnerable to multiple vulnerabilities:

  • Improper checking for the end of an buffer causing an unspecified attack vector.
  • Insecure temporary file handling, which could be exploited to read sensitive information.
  • A flaw in the parser engine which could allow a remote attacker to bypass the scanning of RAR files.
  • A flaw in libclamav/unrar.c which could cause a remote Denial of Service (DoS) by sending a specially crafted RAR file with a modified vm_codesize.
  • A flaw in the OLE2 parser which could cause a remote Denial of Service (DoS).
CVE-2007-2650 CVE-2007-3023 CVE-2007-3024 CVE-2007-3122 CVE-2007-3123 http://news.gmane.org/gmane.comp.security.virus.clamav.devel/cutoff=2853 2007-04-18 2007-06-19
p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability p5-Mail-SpamAssassin 3.2.1

SpamAssassin website reports:

A local user symlink-attack DoS vulnerability in SpamAssassin has been found, affecting versions 3.1.x, 3.2.0, and SVN trunk.

http://spamassassin.apache.org/advisories/cve-2007-2873.txt CVE-2007-2873 2007-06-11 2007-06-18
cups -- Incomplete SSL Negotiation Denial of Service cups-base 1.2.11

Secunia reports:

CUPS is not using multiple workers to handle connections. This can be exploited to stop CUPS from accepting new connections by starting but never completing an SSL negotiation.

http://secunia.com/advisories/24517/ http://security.gentoo.org/glsa/glsa-200703-28.xml CVE-2007-0720 2007-05-05 2007-06-12
c-ares -- DNS Cache Poisoning Vulnerability c-ares 1.4.0

secunia reports:

The vulnerability is caused due to predictable DNS "Transaction ID" field in DNS queries and can be exploited to poison the DNS cache of an application using the library if a valid ID is guessed.

http://secunia.com/advisories/25579/ http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup 2007-06-08 2007-06-09
wordpress -- XMLRPC SQL Injection wordpress de-wordpress zh-wordpress 2.2.1

Secunia reports:

Slappter has discovered a vulnerability in WordPress, which can be exploited by malicious users to conduct SQL injection attacks.

Input passed to the "wp.suggestCategories" method in xmlrpc.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation allows e.g. retrieving usernames and password hashes, but requires valid user credentials and knowledge of the database table prefix.

24344 http://secunia.com/advisories/25552/ 2007-06-06 2007-06-09 2007-06-24
wordpress -- unmoderated comments disclosure wordpress de-wordpress zh-wordpress 0

Blogsecurity reports:

An attacker can read comments on posts that have not been moderated. This can be a real security risk if blog admins are using unmoderated comments (comments that have not been made public) to hide sensitive notes regarding posts, future work, passwords etc. So please be careful if you are one of these blog admins.

http://blogsecurity.net/news/news-310507/ 2007-06-01 2007-06-09
webmin -- cross site scripting vulnerability webmin 1.350

Secunia reports:

Input passed to unspecified parameters in pam_login.cgi is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

24381 http://secunia.com/advisories/25580/ http://www.webmin.com/changes-1.350.html 2007-06-01 2007-06-09
mplayer -- cddb stack overflow mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.10_10

Mplayer Team reports:

A stack overflow was found in the code used to handle cddb queries. When copying the album title and category, no checking was performed on the size of the strings before storing them in a fixed-size array. A malicious entry in the database could trigger a stack overflow in the program, leading to arbitrary code execution with the uid of the user running MPlayer.

24302 CVE-2007-2948 2007-06-06 2007-06-07
mod_jk -- information disclosure mod_jk mod_jk-ap2 1.2.23

Kazu Nambo reports:

URL decoding the the Apache webserver prior to decoding in the Tomcat server could pypass access control rules and give access to pages on a different AJP by sending a crafted URL.

CVE-2007-1860 http://secunia.com/advisories/25383/ http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1 http://tomcat.apache.org/security-jk.html 2007-05-18 2007-06-05
typo3 -- email header injection typo3 3.04.0.5 4.14.1.1

Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:

An unspecified error in the internal form engine can be used for sending arbitrary mail headers, using it for purposes which it is not meant for, e.g. sending spam messages.

CVE-2007-1081 http://secunia.com/advisories/24207/ http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/ 2007-02-21 2007-06-04
phppgadmin -- cross site scripting vulnerability phppgadmin 4.1.1

SecurityFocus reports about phppgadmin:

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

24115 http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063617.html http://secunia.com/advisories/25446/ 2007-05-27 2007-06-04
findutils -- GNU locate heap buffer overrun findutils 4.2.31

James Youngman reports:

When GNU locate reads filenames from an old-format locate database, they are read into a fixed-length buffer allocated on the heap. Filenames longer than the 1026-byte buffer can cause a buffer overrun. The overrunning data can be chosen by any person able to control the names of filenames created on the local system. This will normally include all local users, but in many cases also remote users (for example in the case of FTP servers allowing uploads).

CVE-2007-2452 http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html 2007-05-30 2007-06-01
FreeType 2 -- Heap overflow vulnerability freetype2 2.2.1_2

Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.

CVE-2007-2754 http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240200 ports/112769 2007-04-27 2007-05-24
FreeBSD -- heap overflow in file(1) file 4.21 FreeBSD 6.26.2_5 6.16.1_17 5.55.5_13

Problem Description:

When writing data into a buffer in the file_printf function, the length of the unused portion of the buffer is not correctly tracked, resulting in a buffer overflow when processing certain files.

Impact:

An attacker who can cause file(1) to be run on a maliciously constructed input can cause file(1) to crash. It may be possible for such an attacker to execute arbitrary code with the privileges of the user running file(1).

The above also applies to any other applications using the libmagic(3) library.

Workaround:

No workaround is available, but systems where file(1) and other libmagic(3)-using applications are never run on untrusted input are not vulnerable.

CVE-2007-1536 FreeBSD-SA-07:04.file 2007-05-23 2007-05-23 2007-05-31
squirrelmail -- Cross site scripting in HTML filter squirrelmail 1.4.01.4.9a

The SquirrelMail developers report:

Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.

CVE-2007-1262 http://www.squirrelmail.org/security/issue/2007-05-09 2007-05-09 2007-05-21
png -- DoS crash vulnerability png 1.2.17

A Libpng Security Advisory reports:

A grayscale PNG image with a malformed (bad CRC) tRNS chunk will crash some libpng applications.

This vulnerability could be used to crash a browser when a user tries to view such a malformed PNG file. It is not known whether the vulnerability could be exploited otherwise.

CVE-2007-2445 684664 http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt 2007-05-15 2007-05-16
samba -- multiple vulnerabilities samba ja-samba 3.*3.0.25,1

The Samba Team reports:

A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB/CIFS protocol operations as root.

When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish additional means of gaining root access to the server.

Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data.

Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.

This bug was originally reported against the anonymous calls to the SamrChangePassword() MS-RPC function in combination with the "username map script" smb.conf option (which is not enabled by default).

After further investigation by Samba developers, it was determined that the problem was much broader and impacts remote printer and file share management as well. The root cause is passing unfiltered user input provided via MS-RPC calls to /bin/sh when invoking externals scripts defined in smb.conf. However, unlike the "username map script" vulnerability, the remote file and printer management scripts require an authenticated user session.

CVE-2007-2444 CVE-2007-2446 CVE-2007-2447 http://de5.samba.org/samba/security/CVE-2007-2444.html http://de5.samba.org/samba/security/CVE-2007-2446.html http://de5.samba.org/samba/security/CVE-2007-2447.html 2007-05-14 2007-05-16
php -- multiple vulnerabilities php5-imap php5-odbc php5-session php5-shmop php5-sqlite php5-wddx php5 5.2.2 php4-odbc php4-session php4-shmop php4-wddx php4 4.4.7 mod_php4-twig mod_php4 mod_php5 mod_php php4-cgi php4-cli php4-dtc php4-horde php4-nms php5-cgi php5-cli php5-dtc php5-horde php5-nms 0

The PHP development team reports:

Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:

  • Fixed CVE-2007-1001, GD wbmp used with invalid image size
  • Fixed asciiz byte truncation inside mail()
  • Fixed a bug in mb_parse_str() that can be used to activate register_globals
  • Fixed unallocated memory access/double free in in array_user_key_compare()
  • Fixed a double free inside session_regenerate_id()
  • Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers.
  • Limit nesting level of input variables with max_input_nesting_level as fix for.
  • Fixed CRLF injection inside ftp_putcmd().
  • Fixed a possible super-global overwrite inside import_request_variables().
  • Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library.

Security Enhancements and Fixes in PHP 5.2.2 only:

  • Fixed a header injection via Subject and To parameters to the mail() function
  • Fixed wrong length calculation in unserialize S type.
  • Fixed substr_compare and substr_count information leak.
  • Fixed a remotely trigger-able buffer overflow inside make_http_soap_request().
  • Fixed a buffer overflow inside user_filter_factory_create().

Security Enhancements and Fixes in PHP 4.4.7 only:

  • XSS in phpinfo()
CVE-2007-1001 http://www.php.net/releases/4_4_7.php http://www.php.net/releases/5_2_2.php 2007-05-03 2007-05-07 2007-05-10
qemu - several vulnerabilities qemu qemu-devel 0.9.0_1 0.9.0s.20070101*0.9.0s.20070405_3

The Debian Security Team reports:

Several vulnerabilities have been discovered in the QEMU processor emulator, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2007-1320
Tavis Ormandy discovered that a memory management routine of the Cirrus video driver performs insufficient bounds checking, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1321
Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1322
Tavis Ormandy discovered that the "icebp" instruction can be abused to terminate the emulation, resulting in denial of service.

CVE-2007-1323
Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1366
Tavis Ormandy discovered that the "aam" instruction can be abused to crash qemu through a division by zero, resulting in denial of service.

CVE-2007-1320 CVE-2007-1321 CVE-2007-1322 CVE-2007-1323 CVE-2007-1366 http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html 2007-05-01 2007-05-01 2007-05-02
p5-Imager - possibly exploitable buffer overflow p5-Imager 0.57

Imager 0.56 and all earlier versions with BMP support have a security issue when reading compressed 8-bit per pixel BMP files where either a compressed run of data or a literal run of data overflows the scan-line.

Such an overflow causes a buffer overflow in a malloc() allocated memory buffer, possibly corrupting the memory arena headers.

The effect depends on your system memory allocator, with glibc this typically results in an abort, but with other memory allocators it may be possible to cause local code execution.

https://rt.cpan.org/Public/Bug/Display.html?id=26811 http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html 2007-04-04 2007-04-30 2007-05-02
FreeBSD -- IPv6 Routing Header 0 is dangerous FreeBSD 6.26.2_4 6.16.1_16 5.55.5_12

Problem Description

There is no mechanism for preventing IPv6 routing headers from being used to route packets over the same link(s) many times.

Impact

An attacker can "amplify" a denial of service attack against a link between two vulnerable hosts; that is, by sending a small volume of traffic the attacker can consume a much larger amount of bandwidth between the two vulnerable hosts.

An attacker can use vulnerable hosts to "concentrate" a denial of service attack against a victim host or network; that is, a set of packets sent over a period of 30 seconds or more could be constructed such that they all arrive at the victim within a period of 1 second or less over a period of 30 seconds or more could be constructed such that they all arrive at the victim within a period of 1 second or less.

Other attacks may also be possible.

Workaround

No workaround is available.

CVE-2007-2242 SA-07:03.ipv6 2007-04-26 2007-04-28
mod_perl -- remote DoS in PATH_INFO parsing mod_perl 1.30 mod_perl2 2.0.3_2,3

Mandriva reports:

PerlRun.pm in Apache mod_perl 1.29 and earlier, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

CVE-2007-1349 http://www.mandriva.com/security/advisories?name=MDKSA-2007:083 http://secunia.com/advisories/24839 2007-03-29 2007-04-24 2007-06-27
claws-mail -- APOP vulnerability claws-mail 2.9.0

CVE reports:

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions.

CVE-2007-1558 http://www.claws-mail.org/news.php 2007-04-02 2007-04-19
lighttpd -- DOS when access files with mtime 0 lighttpd 1.4.15

Lighttpd SA:

Lighttpd caches the rendered string for mtime. The cache key has as a default value 0. At that point the pointer to the string are still NULL. If a file with an mtime of 0 is requested it tries to access the pointer and crashes.

The bug requires that a malicious user can either upload files or manipulate the mtime of the files.

The bug was reported by cubiq and fixed by Marcus Rueckert.

CVE-2007-1870 http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt 2007-01-14 2007-04-14
lighttpd -- Remote DOS in CRLF parsing lighttpd 1.4.111.4.13_2

Lighttpd SA:

If the connection aborts during parsing "\r\n\r\n" the server might get into a infinite loop and use 100% of the CPU time. lighttpd still responses to other requests. This can be repeated until either the server limit for concurrent connections or file descriptors is reached.

The bug was reported and fixed by Robert Jakabosky.

CVE-2007-1869 http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt 2006-12-15 2007-04-14
freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability freeradius freeradius-mysql 1.1.5

The freeradius development team reports:

A malicous 802.1x supplicant could send malformed Diameter format attributes inside of an EAP-TTLS tunnel. The server would reject the authentication request, but would leak one VALUE_PAIR data structure, of approximately 300 bytes. If an attacker performed the attack many times (e.g. thousands or more over a period of minutes to hours), the server could leak megabytes of memory, potentially leading to an "out of memory" condition, and early process exit.

23466 http://www.freeradius.org/security.html 2007-04-10 2007-04-13
fetchmail -- insecure APOP authentication fetchmail 6.3.8

Matthias Andree reports:

The POP3 standard, currently RFC-1939, has specified an optional, MD5-based authentication scheme called "APOP" which no longer should be considered secure.

Additionally, fetchmail's POP3 client implementation has been validating the APOP challenge too lightly and accepted random garbage as a POP3 server's APOP challenge. This made it easier than necessary for man-in-the-middle attackers to retrieve by several probing and guessing the first three characters of the APOP secret, bringing brute forcing the remaining characters well within reach.

CVE-2007-1558 http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt 2007-04-06 2007-04-09
mcweject -- exploitable buffer overflow mcweject 0.9

CVE reports:

Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on FreeBSD, and possibly other versions, allows local users to execute arbitrary code via a long command line argument, possibly involving the device name.

CVE-2007-1719 ports/111365 http://www.milw0rm.com/exploits/3578 2007-03-27 2007-04-08
webcalendar -- "noSet" variable overwrite vulnerability WebCalendar 1.0.5

Secunia reports:

A vulnerability has been discovered in WebCalendar, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to unspecified parameters is not properly verified before being used with the "noSet" parameter set. This can be exploited to overwrite certain variables, and allows e.g. the inclusion of arbitrary PHP files from internal or external resources.

CVE-2007-1343 22834 http://sourceforge.net/project/shownotes.php?release_id=491130 http://xforce.iss.net/xforce/xfdb/32832 2007-03-04 2007-04-08
zope -- cross-site scripting vulnerability zope 2.8.* 2.8.02.8.8 2.9.02.9.6 2.10.02.10.2 plone 2.5.3

The Zope Team reports:

A vulnerability has been discovered in Zope, where by certain types of misuse of HTTP GET, an attacker could gain elevated privileges. All Zope versions up to and including 2.10.2 are affected.

23084 CVE-2007-0240 ports/111119 http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view http://plone.org/products/plone/releases/2.5.3 2007-01-16 2007-04-05 2007-06-06
Squid -- TRACE method handling denial of service squid 2.6.*2.6.12

Squid advisory 2007:1 notes:

Due to an internal error Squid-2.6 is vulnerable to a denial of service attack when processing the TRACE request method.

Workarounds:

To work around the problem deny access to using the TRACE method by inserting the following two lines before your first http_access rule.

acl TRACE method TRACE

http_access deny TRACE

http://www.squid-cache.org/Advisories/SQUID-2007_1.txt 2007-03-20 2007-03-21 2007-03-21
sql-ledger -- security bypass vulnerability sql-ledger 2.6.26

Chris Travers reports:

George Theall of Tenable Security notified the LedgerSMB core team today of an authentication bypass vulnerability allowing full access to the administrator interface of LedgerSMB 1.1 and SQL-Ledger 2.x. The problem is caused by the password checking routine failing to enforce a password check under certain circumstances. The user can then create accounts or effect denial of service attacks.

This is not related to any previous CVE.

We have coordinated with the SQL-Ledger vendor and today both of us released security patches correcting the problem. SQL-Ledger users who can upgrade to 2.6.26 should do so, and LedgerSMB 1.1 or 1.0 users should upgrade to 1.1.9. Users who cannot upgrade should configure their web servers to use http authentication for the admin.pl script in the main root directory.

ports/110350 http://www.securityfocus.com/archive/1/462375 2007-03-09 2007-03-16
samba -- potential Denial of Service bug in smbd samba ja-samba 3.0.6,13.0.24,1

The Samba Team reports:

Internally Samba's file server daemon, smbd, implements support for deferred file open calls in an attempt to serve client requests that would otherwise fail due to a share mode violation. When renaming a file under certain circumstances it is possible that the request is never removed from the deferred open queue. smbd will then become stuck is a loop trying to service the open request.

This bug may allow an authenticated user to exhaust resources such as memory and CPU on the server by opening multiple CIFS sessions, each of which will normally spawn a new smbd process, and sending each connection into an infinite loop.

CVE-2007-0452 http://www.samba.org/samba/security/CVE-2007-0452.html 2007-02-05 2007-03-16
samba -- format string bug in afsacl.so VFS plugin samba ja-samba 3.0.6,13.0.24,1

The Samba Team reports:

NOTE: This security advisory only impacts Samba servers that share AFS file systems to CIFS clients and which have been explicitly instructed in smb.conf to load the afsacl.so VFS module.

The source defect results in the name of a file stored on disk being used as the format string in a call to snprintf(). This bug becomes exploitable only when a user is able to write to a share which utilizes Samba's afsacl.so library for setting Windows NT access control lists on files residing on an AFS file system.

CVE-2007-0454 http://www.samba.org/samba/security/CVE-2007-0454.html 2007-02-05 2007-03-16
ktorrent -- multiple vulnerabilities ktorrent 2.1.2 ktorrent-devel 20070311

Two problems have been found in KTorrent:

  • KTorrent does not properly sanitize file names to filter out ".." components, so it's possible for an attacker to create a malicious torrent in order to overwrite arbitrary files within the filesystem.
  • Messages with invalid chunk indexes aren't rejected.
CVE-2007-1384 CVE-2007-1385 http://ktorrent.org/forum/viewtopic.php?t=1401 2007-03-09 2007-03-11 2007-03-14
mplayer -- DMO File Parsing Buffer Overflow Vulnerability mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.10_5

"Moritz Jodeit reports:

There's an exploitable buffer overflow in the current version of MPlayer (v1.0rc1) which can be exploited with a maliciously crafted video file. It's hidden in the function DMO_VideoDecoder() in the file loader/dmo/DMO_VideoDecoder.c.

22771 CVE-2007-1246 2007-02-11 2007-03-09
trac -- cross site scripting vulnerability trac 0.10.3 ja-trac 0.10.3_1

Secunia reports:

The vulnerability is caused due to an error within the "download wiki page as text" function, which can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation may require that the victim uses IE.

http://secunia.com/advisories/24470 http://trac.edgewall.org/wiki/ChangeLog#a0.10.3.1 2007-03-09 2007-03-09
mod_jk -- long URL stack overflow vulnerability mod_jk-ap2 mod_jk 1.2.191.2.21

TippingPoint and The Zero Day Initiative reports:

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Tomcat JK Web Server Connector. Authentication is not required to exploit this vulnerability.

The specific flaw exists in the URI handler for the mod_jk.so library, map_uri_to_worker(), defined in native/common/jk_uri_worker_map.c. When parsing a long URL request, the URI worker map routine performs an unsafe memory copy. This results in a stack overflow condition which can be leveraged to execute arbitrary code.

CVE-2007-0774 http://tomcat.apache.org/security-jk.html http://www.zerodayinitiative.com/advisories/ZDI-07-008.html 2007-03-02 2007-03-05 2007-03-06
bind -- Multiple Denial of Service vulnerabilities named 9.3.4 FreeBSD 6.26.2_1 6.16.1_13 5.55.5_11

Problem Description:

A type * (ANY) query response containing multiple RRsets can trigger an assertion failure.

Certain recursive queries can cause the nameserver to crash by using memory which has already been freed.

Impact:

A remote attacker sending a type * (ANY) query to an authoritative DNS server for a DNSSEC signed zone can cause the named(8) daemon to exit, resulting in a Denial of Service.

A remote attacker sending recursive queries can cause the nameserver to crash, resulting in a Denial of Service.

Workaround:

There is no workaround available, but systems which are not authoritative servers for DNSSEC signed zones are not affected by the first issue; and systems which do not permit untrusted users to perform recursive DNS resolution are not affected by the second issue. Note that the default configuration for named(8) in FreeBSD allows local access only (which on many systems is equivalent to refusing access to untrusted users).

CVE-2007-0493 CVE-2007-0494 SA-07:02.bind 2007-02-09 2007-02-27
FreeBSD -- Jail rc.d script privilege escalation FreeBSD 6.16.1_12 6.06.0_17 5.55.5_10

Problem Description:

In multiple situations the host's jail rc.d(8) script does not check if a path inside the jail file system structure is a symbolic link before using the path. In particular this is the case when writing the output from the jail start-up to /var/log/console.log and when mounting and unmounting file systems inside the jail directory structure.

Impact:

Due to the lack of handling of potential symbolic links the host's jail rc.d(8) script is vulnerable to "symlink attacks". By replacing /var/log/console.log inside the jail with a symbolic link it is possible for the superuser (root) inside the jail to overwrite files on the host system outside the jail with arbitrary content. This in turn can be used to execute arbitrary commands with non-jailed superuser privileges.

Similarly, by changing directory mount points inside the jail file system structure into symbolic links, it may be possible for a jailed attacker to mount file systems which were meant to be mounted inside the jail at arbitrary points in the host file system structure, or to unmount arbitrary file systems on the host system.

NOTE WELL: The above vulnerabilities occur only when a jail is being started or stopped using the host's jail rc.d(8) script; once started (and until stopped), running jails cannot exploit this.

Workaround:

If the sysctl(8) variable security.jail.chflags_allowed is set to 0 (the default), setting the "sunlnk" system flag on /var, /var/log, /var/log/console.log, and all file system mount points and their parent directories inside the jail(s) will ensure that the console log file and mount points are not replaced by symbolic links. If this is done while jails are running, the administrator must check that an attacker has not replaced any directories with symlinks after setting the "sunlnk" flag.

CVE-2007-0166 SA-07:01.jail 2007-01-11 2007-02-27
gtar -- name mangling symlink vulnerability FreeBSD 5.55.5_9 4.114.11_26

Problem Description:

Symlinks created using the "GNUTYPE_NAMES" tar extension can be absolute due to lack of proper sanity checks.

Impact:

If an attacker can get a user to extract a specially crafted tar archive the attacker can overwrite arbitrary files with the permissions of the user running gtar. If file system permissions allow it, this may allow the attacker to overwrite important system file (if gtar is being run as root), or important user configuration files such as .tcshrc or .bashrc, which would allow the attacker to run arbitrary commands.

Workaround:

Use "bsdtar", which is the default tar implementation in FreeBSD 5.3 and higher. For FreeBSD 4.x, bsdtar is available in the FreeBSD Ports Collection as ports/archivers/libarchive.

CVE-2006-6097 SA-06:26.gtar 2006-12-06 2007-02-27
FreeBSD -- Kernel memory disclosure in firewire(4) FreeBSD 6.16.1_11 6.06.2_16 5.55.5_9 4.114.11_26

Problem Description:

In the FW_GCROM ioctl, a signed integer comparison is used instead of an unsigned integer comparison when computing the length of a buffer to be copied from the kernel into the calling application.

Impact:

A user in the "operator" group can read the contents of kernel memory. Such memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way; for example, a terminal buffer might include a user-entered password.

Workaround:

No workaround is available, but systems without IEEE 1394 ("FireWire") interfaces are not vulnerable. (Note that systems with IEEE 1394 interfaces are affected regardless of whether any devices are attached.)

Note also that FreeBSD does not have any non-root users in the "operator" group by default; systems on which no users have been added to this group are therefore also not vulnerable.

CVE-2006-6013 SA-06:25.kmem 2006-12-06 2007-02-27
libarchive -- Infinite loop in corrupt archives handling in libarchive libarchive 1.3.1

Problem Description:

If the end of an archive is reached while attempting to "skip" past a region of an archive, libarchive will enter an infinite loop wherein it repeatedly attempts (and fails) to read further data.

Impact:

An attacker able to cause a system to extract (via "tar -x" or another application which uses libarchive) or list the contents (via "tar -t" or another libarchive-using application) of an archive provided by the attacker can cause libarchive to enter an infinite loop and use all available CPU time.

Workaround:

No workaround is available.

CVE-2006-5680 SA-06:24.libarchive 2006-11-08 2007-02-26
OpenSSL -- Multiple problems in crypto(3) openssl 0.9.7l_0 0.9.80.9.8d_0 FreeBSD 6.16.1_9 6.06.0_14 5.55.5_7 5.45.4_21 5.35.3_36 4.114.11_24

Problem Description:

Several problems have been found in OpenSSL:

  • During the parsing of certain invalid ASN1 structures an error condition is mishandled, possibly resulting in an infinite loop.
  • A buffer overflow exists in the SSL_get_shared_ciphers function.
  • A NULL pointer may be dereferenced in the SSL version 2 client code.

In addition, many applications using OpenSSL do not perform any validation of the lengths of public keys being used.

Impact:

Servers which parse ASN1 data from untrusted sources may be vulnerable to a denial of service attack.

An attacker accessing a server which uses SSL version 2 may be able to execute arbitrary code with the privileges of that server.

A malicious SSL server can cause clients connecting using SSL version 2 to crash.

Applications which perform public key operations using untrusted keys may be vulnerable to a denial of service attack.

Workaround:

No workaround is available, but not all of the vulnerabilities mentioned affect all applications.

CVE-2006-2937 CVE-2006-2938 CVE-2006-2940 CVE-2006-3738 CVE-2006-4343 SA-06:23.openssl 2006-09-28 2007-02-26
mozilla -- multiple vulnerabilities firefox 1.5.0.10,1 2.*,12.0.0.2,1 linux-firefox 1.5.0.10 lightning 0.3.1 seamonkey linux-seamonkey 1.0.8 1.11.1.1 thunderbird linux-thunderbird mozilla-thunderbird 1.5.0.10 linux-firefox-devel 3.0.a2007.04.18 linux-seamonkey-devel 1.5.a2007.04.18 firefox-ja linux-mozilla-devel linux-mozilla mozilla 0

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2007-08 onUnload + document.write() memory corruption
  • MFSA 2007-07 Embedded nulls in location.hostname confuse same-domain checks
  • MFSA 2007-06 Mozilla Network Security Services (NSS) SSLv2 buffer overflow
  • MFSA 2007-05 XSS and local file access by opening blocked popups
  • MFSA 2007-04 Spoofing using custom cursor and CSS3 hotspot
  • MFSA 2007-03 Information disclosure through cache collisions
  • MFSA 2007-02 Improvements to help protect against Cross-Site Scripting attacks
  • MFSA 2007-01 Crashes with evidence of memory corruption (rv:1.8.0.10/1.8.1.2)
CVE-2006-6077 CVE-2007-0008 CVE-2007-0009 CVE-2007-0775 CVE-2007-0776 CVE-2007-0777 CVE-2007-0778 CVE-2007-0779 CVE-2007-0780 CVE-2007-0800 CVE-2007-0981 CVE-2007-0995 CVE-2007-1092 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483 http://www.mozilla.org/security/announce/2007/mfsa2007-01.html http://www.mozilla.org/security/announce/2007/mfsa2007-02.html http://www.mozilla.org/security/announce/2007/mfsa2007-03.html http://www.mozilla.org/security/announce/2007/mfsa2007-04.html http://www.mozilla.org/security/announce/2007/mfsa2007-05.html http://www.mozilla.org/security/announce/2007/mfsa2007-06.html http://www.mozilla.org/security/announce/2007/mfsa2007-07.html http://www.mozilla.org/security/announce/2007/mfsa2007-08.html 2007-02-23 2007-02-24 2007-04-19
snort -- DCE/RPC preprocessor vulnerability snort 2.6.12.6.1.3

A IBM Internet Security Systems Protection Advisory reports:

Snort is vulnerable to a stack-based buffer overflow as a result of DCE/RPC reassembly. This vulnerability is in a dynamic-preprocessor enabled in the default configuration, and the configuration for this preprocessor allows for auto-recognition of SMB traffic to perform reassembly on. No checks are performed to see if the traffic is part of a valid TCP session, and multiple Write AndX requests can be chained in the same TCP segment. As a result, an attacker can exploit this overflow with a single TCP PDU sent across a network monitored by Snort or Sourcefire.

Snort users who cannot upgrade immediately are advised to disable the DCE/RPC preprocessor by removing the DCE/RPC preprocessor directives from snort.conf and restarting Snort. However, be advised that disabling the DCE/RPC preprocessor reduces detection capabilities for attacks in DCE/RPC traffic. After upgrading, customers should re-enable the DCE/RPC preprocessor.

196240 CVE-2006-5276 http://xforce.iss.net/xforce/xfdb/31275 http://www.snort.org/docs/advisory-2007-02-19.html 2007-02-19 2007-02-21
rar -- password prompt buffer overflow vulnerability rar 3.70.b1,1 unrar zh-unrar 3.70.b1,4

iDefense reports:

Remote exploitation of a stack based buffer overflow vulnerability in RARLabs Unrar may allow an attacker to execute arbitrary code with the privileges of the user opening the archive.

Unrar is prone to a stack based buffer overflow when processing specially crafted password protected archives.

If users are using the vulnerable command line based unrar, they still need to interact with the program in order to trigger the vulnerability. They must respond to the prompt asking for the password, after which the vulnerability will be triggered. They do not need to enter a correct password, but they must at least push the enter key.

22447 CVE-2007-0855 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472 http://www.rarsoft.com/rarnew.htm 2007-02-07 2007-02-17
php -- multiple vulnerabilities php5-imap php5-odbc php5-session php5-shmop php5-sqlite php5-wddx php5 5.2.1_2 php4-odbc php4-session php4-shmop php4-wddx php4 4.4.5 mod_php4-twig mod_php4 mod_php5 mod_php php4-cgi php4-cli php4-dtc php4-horde php4-nms php5-cgi php5-cli php5-dtc php5-horde php5-nms 0

Multiple vulnerabilities have been found in PHP, including: buffer overflows, stack overflows, format string, and information disclosure vulnerabilities.

The session extension contained safe_mode and open_basedir bypasses, but the FreeBSD Security Officer does not consider these real security vulnerabilities, since safe_mode and open_basedir are insecure by design and should not be relied upon.

CVE-2007-0905 CVE-2007-0906 CVE-2007-0907 CVE-2007-0908 CVE-2007-0909 CVE-2007-0910 CVE-2007-0988 http://secunia.com/advisories/24089/ http://www.php.net/releases/4_4_5.php http://www.php.net/releases/5_2_1.php 2007-02-09 2007-02-17 2007-03-12
joomla -- multiple remote vulnerabilities joomla 1.0.12

Secunia reports:

Some vulnerabilities have been reported in Joomla!, where some have unknown impacts and one can be exploited by malicious people to conduct cross-site scripting attacks.

  1. Input passed to an unspecified parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
  2. The vulnerabilities are caused due to unspecified errors in Joomla!. The vendor describes them as "several low level security issues". No further information is currently available.
21810 CVE-2006-6832 CVE-2006-6833 CVE-2006-6834 http://secunia.com/advisories/23563/ 2006-12-29 2007-01-17
sircd -- remote reverse DNS buffer overflow sircd 0.4.0

Secunia reports:

A vulnerability in sircd can be exploited by a malicious person to compromise a vulnerable system. The vulnerability is caused by a boundary error in the code handling reverse DNS lookups, when a user connects to the service. If the FQDN (Fully Qualified Domain Name) returned is excessively long, the allocated buffer is overflowed making it possible to execute arbitrary code on the system with the privileges of the sircd daemon.

6924 http://secunia.com/advisories/8153 2003-02-24 2007-01-15
sircd -- remote operator privilege escalation vulnerability sircd 0

Secunia reports:

A vulnerability has been reported in sircd, which can be exploited by malicious users to gain operator privileges. The problem is that any user reportedly can set their usermode to operator. The vulnerability has been reported in versions 0.5.2 and 0.5.3. Other versions may also be affected.

9097 http://secunia.com/advisories/10274/ 2003-11-20 2007-01-15
cacti -- Multiple vulnerabilities cacti 0.8.6i.4

Secunia reports:

rgod has discovered four vulnerabilities in Cacti, which can be exploited by malicious people to bypass certain security restrictions, manipulate data and compromise vulnerable systems.

http://secunia.com/advisories/23528/ http://forums.cacti.net/about18846-0-asc-0.html 2006-12-28 2007-01-12
mplayer -- buffer overflow in the code for RealMedia RTSP streams. mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.10_1

A potential buffer overflow was found in the code used to handle RealMedia RTSP streams. When checking for matching asm rules, the code stores the results in a fixed-size array, but no boundary checks are performed. This may lead to a buffer overflow if the user is tricked into connecting to a malicious server. Since the attacker can not write arbitrary data into the buffer, creating an exploit is very hard; but a DoS attack is easily made. A fix for this problem was committed to SVN on Sun Dec 31 13:27:53 2006 UTC as r21799. The fix involves three files: stream/realrtsp/asmrp.c, stream/realrtsp/asmrp.h and stream/realrtsp/real.c.

ports/107217 CVE-2006-6172 http://www.mplayerhq.hu/design7/news.html 2006-12-31 2007-01-08
fetchmail -- crashes when refusing a message bound for an MDA fetchmail 6.3.56.3.6

Matthias Andree reports:

When delivering messages to a message delivery agent by means of the "mda" option, fetchmail can crash (by passing a NULL pointer to ferror() and fflush()) when refusing a message. SMTP and LMTP delivery modes aren't affected.

CVE-2006-5974 http://fetchmail.berlios.de/fetchmail-SA-2006-03.txt 2007-01-04 2007-01-06
fetchmail -- TLS enforcement problem/MITM attack/password exposure fetchmail 6.3.6

Matthias Andree reports:

Fetchmail has had several longstanding password disclosure vulnerabilities.

  • sslcertck/sslfingerprint options should have implied "sslproto tls1" in order to enforce TLS negotiation, but did not.
  • Even with "sslproto tls1" in the config, fetches would go ahead in plain text if STLS/STARTTLS wasn't available (not advertised, or advertised but rejected).
  • POP3 fetches could completely ignore all TLS options whether available or not because it didn't reliably issue CAPA before checking for STLS support - but CAPA is a requisite for STLS. Whether or not CAPAbilities were probed, depended on the "auth" option. (Fetchmail only tried CAPA if the auth option was not set at all, was set to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)
  • POP3 could fall back to using plain text passwords, even if strong authentication had been configured.
  • POP2 would not complain if strong authentication or TLS had been requested.
CVE-2006-5867 http://fetchmail.berlios.de/fetchmail-SA-2006-02.txt 2007-01-04 2007-01-06
opera -- multiple vulnerabilities opera opera-devel linux-opera 9.10

iDefense reports:

The vulnerability specifically exists due to Opera improperly processing a JPEG DHT marker. The DHT marker is used to define a Huffman Table which is used for decoding the image data. An invalid number of index bytes in the DHT marker will trigger a heap overflow with partially user controlled data.

Exploitation of this vulnerability would allow an attacker to execute arbitrary code on the affected host. The attacker would first need to construct a website containing the malicious image and trick the vulnerable user into visiting the site. This would trigger the vulnerability and allow the code to execute with the privileges of the local user.

A flaw exists within Opera's Javascript SVG implementation. When processing a createSVGTransformFromMatrix request Opera does not properly validate the type of object passed to the function. Passing an incorrect object to this function can result in it using a pointer that is user controlled when it attempts to make the virtual function call.

Exploitation of this vulnerability would allow an attacker to execute arbitrary code on the affected host. The attacker would first need to construct a website containing the malicious JavaScript and trick the vulnerable user into visiting the site. This would trigger the vulnerability and allow the code to execute with the privileges of the local user.

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458 http://www.opera.com/support/search/supsearch.dml?index=851 http://www.opera.com/support/search/supsearch.dml?index=852 2007-01-05 2007-01-05
drupal -- multiple vulnerabilities drupal 4.74.7.5 4.6.11

The Drupal security team reports:

A few arguments passed via URLs are not properly sanitized before display. When an attacker is able to entice an administrator to follow a specially crafted link, arbitrary HTML and script code can be injected and executed in the victim's session. Such an attack may lead to administrator access if certain conditions are met.

The way page caching was implemented allows a denial of service attack. An attacker has to have the ability to post content on the site. He or she would then be able to poison the page cache, so that it returns cached 404 page not found errors for existing pages.

If the page cache is not enabled, your site is not vulnerable. The vulnerability only affects sites running on top of MySQL.

http://drupal.org/files/sa-2007-001/advisory.txt http://drupal.org/files/sa-2007-002/advisory.txt 2007-01-05 2007-01-05
w3m -- format string vulnerability w3m w3m-img w3m-m17n w3m-m17n-img ja-w3m ja-w3m-img 0.5.1_6

An anonymous person reports:

w3m-0.5.1 crashes when using the -dump or -backend options to open a HTTPS URL with a SSL certificate where the CN contains "%n%n%n%n%n%n".

21735 CVE-2006-6772 http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439 http://secunia.com/advisories/23492/ 2006-12-10 2007-01-03
plone -- user can masquerade as a group plone 2.52.5.1_1

Plone.org reports:

PlonePAS-using Plone releases (Plone 2.5 and Plone 2.5.1) has a potential vulnerability that allows a user to masquerade as a group. Please update your sites.

21460 CVE-2006-4249 http://plone.org/products/plone-hotfix/releases/20061031 2006-11-02 2006-12-27
proftpd -- remote code execution vulnerabilities proftpd proftpd-mysql 1.3.0_5

The proftpd development team reports that several remote buffer overflows had been found in the proftpd server.

CVE-2006-5815 CVE-2006-6170 2006-11-10 2006-12-21
gzip -- multiple vulnerabilities FreeBSD 6.16.1_7 6.06.0_12 5.55.5_5 5.45.4_19 5.35.3_34 4.11_22 gzip 1.3.12

Problem Description

Multiple programming errors have been found in gzip which can be triggered when gzip is decompressing files. These errors include insufficient bounds checks in buffer use, a NULL pointer dereference, and a potential infinite loop.

Impact

The insufficient bounds checks in buffer use can cause gzip to crash, and may permit the execution of arbitrary code. The NULL pointer deference can cause gzip to crash. The infinite loop can cause a Denial-of-Service situation where gzip uses all available CPU time.

Workaround

No workaround is available.

CVE-2006-4334 CVE-2006-4335 CVE-2006-4336 CVE-2006-4337 CVE-2006-4338 SA-06:21.gzip 2006-09-19 2006-12-19 2007-06-05
bind9 -- Denial of Service in named(8) FreeBSD 6.16.1_6 6.06.0_11 5.55.5_4 5.45.4_18 5.05.3_33 bind9 9.09.3.2.1

Problem Description

For a recursive DNS server, a remote attacker sending enough recursive queries for the replies to arrive after all the interested clients have left the recursion queue will trigger an INSIST failure in the named(8) daemon. Also for a recursive DNS server, an assertion failure can occur when processing a query whose reply will contain more than one SIG(covered) RRset.

For an authoritative DNS server serving a RFC 2535 DNSSEC zone which is queried for the SIG records where there are multiple SIG(covered) RRsets (e.g. a zone apex), named(8) will trigger an assertion failure when it tries to construct the response.

Impact

An attacker who can perform recursive lookups on a DNS server and is able to send a sufficiently large number of recursive queries, or is able to get the DNS server to return more than one SIG(covered) RRsets can stop the functionality of the DNS service.

An attacker querying an authoritative DNS server serving a RFC 2535 DNSSEC zone may be able to crash the DNS server.

Workaround

A possible workaround is to only allow trusted clients to perform recursive queries.

CVE-2006-4095 CVE-2006-4096 SA-06:20.bind 2006-09-06 2006-12-19
openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3) FreeBSD 6.16.1_6 6.06.0_11 5.55.5_4 5.45.4_18 5.35.3_33 4.11_21 openssl 0.9.80.9.8c_9 0.9.7k_0

Problem Description

When verifying a PKCS#1 v1.5 signature, OpenSSL ignores any bytes which follow the cryptographic hash being signed. In a valid signature there will be no such bytes.

Impact

OpenSSL will incorrectly report some invalid signatures as valid. When an RSA public exponent of 3 is used, or more generally when a small public exponent is used with a relatively large modulus (e.g., a public exponent of 17 with a 4096-bit modulus), an attacker can construct a signature which OpenSSL will accept as a valid PKCS#1 v1.5 signature.

Workaround

No workaround is available.

CVE-2006-4339 SA-06:19.openssl 2006-09-06 2006-12-19
sql-ledger -- multiple vulnerabilities sql-ledger 2.6.22

The Debian security Team reports:

Several remote vulnerabilities have been discovered in SQL Ledger, a web based double-entry accounting program, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems:

Chris Travers discovered that the session management can be tricked into hijacking existing sessions.

Chris Travers discovered that directory traversal vulnerabilities can be exploited to execute arbitrary Perl code.

It was discovered that missing input sanitising allows execution of arbitrary Perl code.

CVE-2006-4244 CVE-2006-4731 CVE-2006-5872 http://www.us.debian.org/security/2006/dsa-1239 2006-12-17 2006-12-18
dbus -- match_rule_equal() Weakness dbus 1.0.2

Secunia reports:

D-Bus have a weakness, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

An error within the "match_rule_equal()" function can be exploited to disable the ability of other processes to receive messages by removing their matches from D-Bus.

CVE-2006-6107 http://www.freedesktop.org/wiki/Software/dbus https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218055 http://secunia.com/advisories/23373/ 2006-12-12 2006-12-14
evince -- Buffer Overflow Vulnerability evince 0.6.1_1

Secunia reports:

A vulnerability has been discovered in Evince, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error within the "get_next_text()" function in ps/ps.c. This can be exploited to cause a buffer overflow by e.g. tricking a user into opening a specially crafted PostScript file.

CVE-2006-5864 http://secunia.com/advisories/23111/ 2006-11-27 2006-12-14
tdiary -- injection vulnerability ja-tdiary tdiary 2.0.3 ja-tdiary-devel tdiary-devel 2.12.1.4_2

An undisclosed eRuby injection vulnerability had been discovered in tDiary.

http://sourceforge.net/forum/forum.php?forum_id=642685 2006-12-10 2006-12-13 2007-03-16
wv -- Multiple Integer Overflow Vulnerabilities wv 1.2.3

Secunia reports:

Some vulnerabilities have been reported in wvWare, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

The vulnerabilities are caused due to integer overflows within the "wvGetLFO_records()" and "wvGetLFO_PLF()" functions. These can be exploited to cause heap-based buffer overflows by e.g. tricking a user to open a specially crafted Microsoft Word document with an application using the library.

CVE-2006-4513 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=433 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=434 http://secunia.com/advisories/22595/ 2006-10-26 2006-12-13
wv2 -- Integer Overflow Vulnerability wv2 0.2.3

Secunia reports:

A vulnerability has been reported in wvWare wv2 Library, which potentially can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to an integer overflow error in "word_helper.h" when handling a Word document. This can be exploited to cause a buffer overflow and may allow arbitrary code execution via a specially crafted Word document.

CVE-2006-2197 http://secunia.com/advisories/20665/ 2006-06-12 2006-12-13
tnftpd -- Remote root Exploit tnftpd 20040810

The tnftpd port suffer from a remote stack overrun, which can lead to a root compromise.

http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051009.html 2006-12-1 2006-12-11
clamav -- Multipart Nestings Denial of Service clamav 0.88.7 clamav-devel 20061029

Secunia reports:

Clam AntiVirus have a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a stack overflow when scanning messages with deeply nested multipart content. This can be exploited to crash the service by sending specially crafted emails to a vulnerable system.

http://secunia.com/advisories/23347/ http://www.quantenblog.net/security/virus-scanner-bypass 2006-12-06 2006-10-12
libxine -- multiple buffer overflow vulnerabilities libxine 1.1.3

The libxine development team reports that several vulnerabilities had been found in the libxine library. The first vulnerability is caused by improper checking of the src/input/libreal/real.c "real_parse_sdp()" function. A remote attacker could exploit this by tricking an user to connect to a preparated server potentially causing a buffer overflow. Another buffer overflow had been found in the libmms library, potentially allowing a remote attacker to cause a denial of service vulnerability, and possible remote code execution through the following functions: send_command, string_utf16, get_data and get_media_packets. Other functions might be affected as well.

18608 21435 CVE-2006-2200 CVE-2006-6172 http://sourceforge.net/project/shownotes.php?release_id=468432 2006-05-04 2006-12-07 2006-12-09
gnupg -- remotely controllable function pointer gnupg 1.4.6

Werner Koch reports:

GnuPG uses data structures called filters to process OpenPGP messages. These filters are used in a similar way as a pipelines in the shell. For communication between these filters context structures are used. These are usually allocated on the stack and passed to the filter functions. At most places the OpenPGP data stream fed into these filters is closed before the context structure gets deallocated. While decrypting encrypted packets, this may not happen in all cases and the filter may use a void contest structure filled with garbage. An attacker may control this garbage. The filter context includes another context used by the low-level decryption to access the decryption algorithm. This is done using a function pointer. By carefully crafting an OpenPGP message, an attacker may control this function pointer and call an arbitrary function of the process. Obviously an exploit needs to prepared for a specific version, compiler, libc, etc to be successful - but it is definitely doable.

Fixing this is obvious: We need to allocate the context on the heap and use a reference count to keep it valid as long as either the controlling code or the filter code needs it.

We have checked all other usages of such a stack based filter contexts but fortunately found no other vulnerable places. This allows to release a relatively small patch. However, for reasons of code cleanness and easier audits we will soon start to change all these stack based filter contexts to heap based ones.

CVE-2006-6235 http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html http://secunia.com/advisories/23245/ 2006-12-04 2006-12-07 2006-12-15
ruby -- cgi.rb library Denial of Service ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.5_5,1 ruby_static 1.8.*,1

The official ruby site reports:

Another vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS).

A specific HTTP request for any web application using cgi.rb causes CPU consumption on the machine on which the web application is running. Many such requests result in a denial of service.

http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/ 2006-12-04 2006-12-04 2006-12-15
libmusicbrainz -- multiple buffer overflow vulnerabilities libmusicbrainz 2.1.3

SecurityFocus reports about libmusicbrainz:

The libmusicbrainz library is prone to multiple buffer-overflow vulnerabilities because the application fails to check the size of the data before copying it into a finite-sized internal memory buffer.

An attacker can exploit these issues to execute arbitrary code within the context of the application or to cause a denial-of-service condition.

19508 CVE-2006-4197 http://www.securityfocus.com/bid/21185/discuss 2006-08-17 2006-12-02
tdiary -- cross site scripting vulnerability ja-tdiary tdiary 2.0.2 ja-tdiary-devel tdiary-devel 2.12.1.4_1

tDiary was vulnerable to an unspecified Cross-Site Scripting vulnerability

http://sourceforge.net/forum/forum.php?forum_id=638868 2006-11-26 2006-12-02 2007-03-16
ImageMagick -- SGI Image File heap overflow vulnerability ImageMagick 6.0.06.2.9

SecurityFocus reports about ImageMagick:

ImageMagick is prone to a remote heap-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of applications that use the ImageMagick library.

21185 CVE-2006-5868 http://www.securityfocus.com/bid/21185/discuss 2006-11-14 2006-12-02
gtar -- GNUTYPE_NAMES directory traversal vulnerability gtar 1.16_2

Teemu Salmela reports:

There is a tar record type, called GNUTYPE_NAMES (an obsolete GNU extension), that allows the creation of symbolic links pointing to arbitrary locations in the filesystem, which makes it possible to create/overwrite arbitrary files.

21235 CVE-2006-6097 http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html 2006-11-21 2006-11-30
kronolith -- arbitrary local file inclusion vulnerability kronolith 2.1.4

iDefense Labs reports:

Remote exploitation of a design error in Horde's Kronolith could allow an authenticated web mail user to execute arbitrary PHP code under the security context of the running web server.

The vulnerability specifically exists due to a design error in the way it includes certain files. Specifically, the 'lib/FBView.php' file contains a function 'Kronolith_FreeBusy_View::factory' which will include local files that are supplied via the 'view' HTTP GET request parameter.

http://lists.horde.org/archives/announce/2006/000307.html 2006-11-29 2006-11-30
gnupg -- buffer overflow gnupg 1.4.5_1

Werner Koch reports:

When running GnuPG interactively, special crafted messages may be used to crash gpg or gpg2. Running gpg in batch mode, as done by all software using gpg as a backend (e.g. mailers), is not affected by this bug.

Exploiting this overflow seems to be possible.

gpg-agent, gpgsm, gpgv or other tools from the GnuPG suite are not affected.

http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html 2006-11-27 2006-11-27
proftpd -- Remote Code Execution Vulnerability proftpd proftpd-mysql 1.3.0_2

FrSIRT reports:

A vulnerability has been identified in ProFTPD, which could be exploited by attackers to cause a denial of service or execute arbitrary commands. This flaw is due to a buffer overflow error in the "main.c" file where the "cmd_buf_size" size of the buffer used to handle FTP commands sent by clients is not properly set to the size configured via the "CommandBufferSize" directive, which could be exploited by attackers to compromise a vulnerable server via a specially crafted FTP command.

http://www.frsirt.com/english/advisories/2006/4451 2006-11-10 2006-11-14 2006-11-15
unzoo -- Directory Traversal Vulnerability unzoo 4.4_1

Secunia reports:

Doubles has discovered a vulnerability in Unzoo, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error when unpacking archives. This can be exploited via a directory traversal attack to overwrite files outside the directory, where the files are extracted to, if a user is tricked into extracting a malicious archive using Unzoo.

11417 http://secunia.com/advisories/12857/ http://securitytracker.com/alerts/2004/Oct/1011673.html 2004-10-18 2006-11-14 2006-12-15
bugzilla -- multiple vulnerabilities bugzilla ja-bugzilla 2.*2.22.1

A Bugzilla Security Advisory reports:

  • Sometimes the information put into the <h1> and <h2> tags in Bugzilla was not properly escaped, leading to a possible XSS vulnerability.
  • Bugzilla administrators were allowed to put raw, unfiltered HTML into many fields in Bugzilla, leading to a possible XSS vulnerability. Now, the HTML allowed in those fields is limited.
  • attachment.cgi could leak the names of private attachments
  • The "deadline" field was visible in the XML format of a bug, even to users who were not a member of the "timetrackinggroup."
  • A malicious user could pass a URL to an admin, and make the admin delete or change something that he had not intended to delete or change.
  • It is possible to inject arbitrary HTML into the showdependencygraph.cgi page, allowing for a cross-site scripting attack.
CVE-2006-5453 CVE-2006-5454 CVE-2006-5455 http://www.bugzilla.org/security/2.18.5/ 2006-10-15 2006-11-11
Imlib2 -- multiple image file processing vulnerabilities imlib2 20060926_1,1

Secunia reports:

Some vulnerabilities have been reported in imlib2, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library.

The vulnerabilities are caused due to unspecified errors within the processing of JPG, ARGB, PNG, LBM, PNM, TIFF, and TGA images. This may be exploited to execute arbitrary code by e.g. tricking a user into opening a specially crafted image file with an application using imlib2.

20903 CVE-2006-4806 CVE-2006-4807 CVE-2006-4808 CVE-2006-4809 2006-11-03 2006-11-08
ruby -- cgi.rb library Denial of Service ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.5_4,1 ruby_static 1.8.*,1

Official ruby site reports:

A vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS). The problem is triggered by sending the library an HTTP request that uses multipart MIME encoding and as an invalid boundary specifier that begins with "-" instead of "--". Once triggered it will exhaust all available memory resources effectively creating a DoS condition.

20777 CVE-2006-5467 http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html 2006-10-25 2006-11-04 2006-12-15
screen -- combined UTF-8 characters vulnerability screen 4.0.3

A vulnerability in the handling handling of combined UTF-8 characters in screen may allow an user-assisted attacker to crash screen or potentially allow code execution as the user running screen. To exploit this issue the user running scren must in some way interact with the attacker.

20727 CVE-2006-4573 http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212056 2006-10-23 2006-10-29
mysql -- database suid privilege escalation mysql-server 5.15.1.12 5.05.0.25

Dmitri Lenev reports a privilege escalation in MySQL. MySQL evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote and local authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

CVE-2006-4227 http://bugs.mysql.com/bug.php?id=18630 2006-03-29 2006-10-29 2006-10-30
mysql -- database "case-sensitive" privilege escalation mysql-server 5.15.1.12 5.05.0.25 4.1.21

Michal Prokopiuk reports a privilege escalation in MySQL. The vulnerability causes MySQL, when run on case-sensitive filesystems, to allow remote and local authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.

19559 CVE-2006-4226 http://bugs.mysql.com/bug.php?id=17647 2006-08-09 2006-10-29
Serendipity -- XSS Vulnerabilities serendipity 1.0.1

The Serendipity Team reports:

Serendipity failed to correctly sanitize user input on the media manager administration page. The content of GET variables were written into JavaScript strings. By using standard string evasion techniques it was possible to execute arbitrary JavaScript.

Additionally Serendipity dynamically created a HTML form on the media manager administration page that contained all variables found in the URL as hidden fields. While the variable values were correctly escaped it was possible to break out by specifying strange variable names.

http://www.hardened-php.net/advisory_112006.136.htmlSerendipity http://secunia.com/advisories/22501/ 2006-10-19 2006-10-21
kdelibs -- integer overflow in khtml kdelibs kdelibs-nocups 3.5.4_4 qt qt-copy 3.3.6_3

Red Hat reports:

An integer overflow flaw was found in the way Qt handled pixmap images. The KDE khtml library uses Qt in such a way that untrusted parameters could be passed to Qt, triggering the overflow. An attacker could for example create a malicious web page that when viewed by a victim in the Konqueror browser would cause Konqueror to crash or possibly execute arbitrary code with the privileges of the victim.

CVE-2006-4811 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210742 http://rhn.redhat.com/errata/RHSA-2006-0720.html 2006-10-14 2006-10-22
opera -- URL parsing heap overflow vulnerability opera opera-devel linux-opera 9.*9.02

iDefense Labs reports:

Remote exploitation of a heap overflow vulnerability within version 9 of Opera Software's Opera Web browser could allow an attacker to execute arbitrary code on the affected host.

A flaw exists within Opera when parsing a tag that contains a URL. A heap buffer with a constant size of 256 bytes is allocated to store the URL, and the tag's URL is copied into this buffer without sufficient bounds checking of its length.

CVE-2006-4819 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424 http://secunia.com/advisories/22218/ http://www.opera.com/support/search/supsearch.dml?index=848 2006-10-17 2006-10-20
asterisk -- remote heap overwrite vulnerability asterisk asterisk-bristuff 1.2.13

Adam Boileau of Security-Assessment.com reports:

The Asterisk Skinny channel driver for Cisco SCCP phones (chan_skinny.so) incorrectly validates a length value in the packet header. An integer wrap-around leads to heap overwrite, and arbitrary remote code execution as root.

http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf http://marc.theaimsgroup.com/?l=bugtraq&m=116121567530170 2006-10-17 2006-10-20
plone -- unprotected MembershipTool methods plone 2.1.2

The Plone Team reports:

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the:

  • changeMemberPortrait
  • deletePersonalPortrait
  • testCurrentPassword

methods, which allows remote attackers to modify portraits.

CVE-2006-1711 http://plone.org/products/plone/releases/2.1.4 https://svn.plone.org/svn/plone/PloneHotfix20060410/trunk/README.txt 2006-10-19 2006-10-19 2006-10-20
drupal -- HTML attribute injection drupal 4.6.10

The Drupal Team reports:

A malicious user may entice users to visit a specially crafted URL that may result in the redirection of Drupal form submission to a third-party site. A user visiting the user registration page via such a url, for example, will submit all data, such as his/her e-mail address, but also possible private profile data, to a third-party site.

http://drupal.org/files/sa-2006-026/advisory.txt http://drupal.org/drupal-4.7.4 2006-10-18 2006-10-18
drupal -- cross site request forgeries drupal 4.6.10

The Drupal Team reports:

Visiting a specially crafted page, anywhere on the web, may allow that page to post forms to a Drupal site in the context of the visitor's session. To illustrate; suppose one has an active user 1 session, the most powerful administrator account for a site, to a Drupal site while visiting a website created by an attacker. This website will now be able to submit any form to the Drupal site with the privileges of user 1, either by enticing the user to submit a form or by automated means.

An attacker can exploit this vulnerability by changing passwords, posting PHP code or creating new users, for example. The attack is only limited by the privileges of the session it executes in.

http://drupal.org/files/sa-2006-025/advisory.txt http://drupal.org/drupal-4.7.4 2006-10-18 2006-10-18
drupal -- multiple XSS vulnerabilities drupal 4.6.10

The Drupal Team reports:

A bug in input validation and lack of output validation allows HTML and script insertion on several pages.

Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS attack via a specially crafted RSS feed. This vulnerability exists on systems that do not use PHP's mb_string extension (to check if mb_string is being used, navigate to admin/settings and look under "String handling"). Disabling the aggregator module provides an immediate workaround.

The aggregator module, profile module, and forum module do not properly escape output of certain fields.

Note: XSS attacks may lead to administrator access if certain conditions are met.

http://drupal.org/files/sa-2006-024/advisory.txt http://drupal.org/drupal-4.7.4 2006-10-18 2006-10-18
ingo -- local arbitrary shell command execution ingo 1.1.2

The Horde team reports a vulnerability within Ingo, the filter management suite. The vulnerability is caused due to inadequete escaping, possibly allowing a local user to execute arbitrary shell commands via procmail.

http://bugs.horde.org/ticket/?id=4513 http://cvs.horde.org/diff.php/ingo/docs/CHANGES?r1=1.55.2.49&r2=1.55.2.59&ty=h http://lists.horde.org/archives/announce/2006/000296.html 2006-10-18 2006-10-18
nvidia-driver -- arbitrary root code execution vulnerability nvidia-driver 1.0.87621.0.8776

Rapid7 reports:

The NVIDIA Binary Graphics Driver for Linux is vulnerable to a buffer overflow that allows an attacker to run arbitrary code as root. This bug can be exploited both locally or remotely (via a remote X client or an X client which visits a malicious web page). A working proof-of-concept root exploit is included with this advisory.

The NVIDIA drivers for Solaris and FreeBSD are also likely to be vulnerable.

Disabling Render acceleration in the "nvidia" driver, via the "RenderAccel" X configuration option, can be used as a workaround for this issue.

147252 CVE-2006-5379 http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=1971 http://secunia.com/advisories/22419/ http://www.rapid7.com/advisories/R7-0025.jsp 2006-10-16 2006-10-16 2006-10-21
clamav -- CHM unpacker and PE rebuilding vulnerabilities clamav 0.88.5 clamav-devel 20060922

Secunia reports:

Two vulnerabilities have been reported in Clam AntiVirus, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

1) An unspecified error in the CHM unpacker in chmunpack.c can be exploited to cause a DoS.

2) An unspecified error in rebuildpe.c when rebuilding PE files after unpacking can be exploited to cause a heap-based buffer overflow.

http://secunia.com/advisories/22370/ http://lurker.clamav.net/message/20061016.015114.dc6a8930.en.html http://sourceforge.net/project/shownotes.php?release_id=455799 2006-10-15 2006-10-16
tkdiff -- temporary file symlink privilege escalation tkdiff 4.1.1

Javier Fernández-Sanguino Peña reports a vulnerability in tkdiff which allows local users to gain priveleges of the user running tkdiff due to insecure temporary file creation.

http://www.debian.org/security/2005/dsa-927 CVE-2005-3343 16064 http://secunia.com/advisories/18083 2005-12-20 2006-10-15
vtiger -- multiple remote file inclusion vulnerabilities vtiger 5.0

Dedi Dwianto a.k.a the_day reports:

Input passed to the "$calpath" parameter in update.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources.

CVE-2006-5289 20435 http://marc.theaimsgroup.com/?l=bugtraq&m=116049557032343 http://advisories.echo.or.id/adv/adv54-theday-2006.txt 2006-10-09 2006-10-15
google-earth -- heap overflow in the KML engine google-earth 4.0.2414

JAAScois reports:

While processing KML/KMZ data Google Earth fails to verify its size prior to copying it into a fixed-sized buffer. This can be exploited as a buffer-overflow vulnerability to cause the application to crash and/or to execute arbitrary code.

20464 http://www.jaascois.com/exploits/18602024/ 2006-10-10 2006-10-14 2007-04-13
torrentflux -- User-Agent XSS Vulnerability torrentflux 0

Steven Roddis reports that User-Agent string is not properly escaped when handled by torrentflux. This allows for arbitrary code insertion.

20371 CVE-2006-5227 http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/ http://secunia.com/advisories/22293/ 2006-09-30 2006-10-07 2006-10-15
python -- buffer overrun in repr() for unicode strings python+ipv6 0 python 2.4.3_1 2.5.*2.5.c2

Benjamin C. Wiley Sittler reports:

I discovered a [buffer overrun in repr() for unicode strings]. This causes an unpatched non-debug wide (UTF-32/UCS-4) build of python to abort.

Ubuntu security team reports:

If an application uses repr() on arbitrary untrusted data, this [bug] could be exploited to execute arbitrary code with the privileges of the python application.

CVE-2006-4980 https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633 http://www.ubuntu.com/usn/usn-359-1 http://secunia.com/advisories/22276/ 2006-08-15 2006-10-07 2006-10-08
php -- _ecalloc Integer Overflow Vulnerability php5 5.1.6_1 php5-cli php5-cgi php5-dtc php5-horde php5-nms mod_php5 0

Stefan Esser reports:

The PHP 5 branch of the PHP source code lacks the protection against possible integer overflows inside ecalloc() that is present in the PHP 4 branch and also for several years part of our Hardening-Patch and our new Suhosin-Patch.

It was discovered that such an integer overflow can be triggered when user input is passed to the unserialize() function. Earlier vulnerabilities in PHP's unserialize() that were also discovered by one of our audits in December 2004 are unrelated to the newly discovered flaw, but they have shown, that the unserialize() function is exposed to user-input in many popular PHP applications. Examples for applications that use the content of COOKIE variables with unserialize() are phpBB and Serendipity.

The successful exploitation of this integer overflow will result in arbitrary code execution.

CVE-2006-4812 http://www.hardened-php.net/advisory_092006.133.html http://secunia.com/advisories/22280/ 2006-09-30 2006-10-06 2006-10-17
mambo -- multiple SQL injection vulnerabilities mambo 0

James Bercegay reports:

Mambo is vulnerable to an Authentication Bypass issue that is due to an SQL Injection in the login function. The SQL Injection is possible because the $passwd variable is only sanitized when it is not passed as an argument to the function.

Omid reports:

There are several sql injections in Mambo 4.6 RC2 & Joomla 1.0.10 (and maybe other versions):

  • When a user edits a content, the "id" parameter is not checked properly in /components/com_content/content.php, which can cause 2 sql injections.
  • The "limit" parameter in the administration section is not checked. This affects many pages of administration section
  • In the administration section, while editing/creating a user, the "gid" parameter is not checked properly.
19719 19734 http://www.gulftech.org/?node=research&article_id=00116-10042006 http://seclists.org/bugtraq/2006/Aug/0491.html http://www.frsirt.com/english/advisories/2006/3918 http://mamboxchange.com/forum/forum.php?forum_id=7704 http://secunia.com/advisories/21644/ http://secunia.com/advisories/22221/ 2006-08-26 2006-10-05
tin -- buffer overflow vulnerabilities tin zh-tin 1.8.2

Urs Janssen and Aleksey Salow report possible buffer overflows in tin versions 1.8.0 and 1.8.1.

OpenPKG project elaborates there is an allocation off-by-one bug in version 1.8.0 which can lead to a buffer overflow.

ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html 2006-02-15 2006-10-05
openldap -- slapd acl selfwrite Security Issue openldap-server openldap-sasl-server 2.3.25

Howard Chu reports:

An ACL of the form 'access to dn.subtree="ou=groups, dc=example,dc=com" attr=member by * selfwrite' is intended to only allow users to add/delete their own DN to the target attribute. Currently it allows any DNs to be modified.

19832 CVE-2006-4600 http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587 http://www.openldap.org/lists/openldap-announce/200608/msg00000.html http://secunia.com/advisories/21721 http://securitytracker.com/alerts/2006/Sep/1016783.html 2006-06-14 2006-10-05
mono -- "System.CodeDom.Compiler" Insecure Temporary Creation mono 1.1.13.8.1

Sebastian Krahmer reports:

Sebastian Krahmer of the SuSE security team discovered that the System.CodeDom.Compiler classes used temporary files in an insecure way. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Under some circumstances, a local attacker could also exploit this to inject arbitrary code into running Mono processes.

CVE-2006-5072 http://www.ubuntu.com/usn/usn-357-1 http://secunia.com/advisories/22237/ 2006-10-04 2006-10-05
php -- open_basedir Race Condition Vulnerability php4 php5 4.4.4_1 5.*5.1.6_2 php-suhosin 0.9.6 php4-cli php5-cli php4-cgi php5-cgi php4-dtc php5-dtc php4-horde php5-horde php4-nms php5-nms mod_php4 mod_php5 0

Stefan Esser reports:

PHP's open_basedir feature is meant to disallow scripts to access files outside a set of configured base directories. The checks for this are placed within PHP functions dealing with files before the actual open call is performed.

Obviously there is a little span of time between the check and the actual open call. During this time span the checked path could have been altered and point to a file that is forbidden to be accessed due to open_basedir restrictions.

Because the open_basedir restrictions often not call PHP functions but 3rd party library functions to actually open the file it is impossible to close this time span in a general way. It would only be possible to close it when PHP handles the actual opening on it's own.

While it seems hard to change the path during this little time span it is very simple with the use of the symlink() function combined with a little trick. PHP's symlink() function ensures that source and target of the symlink operation are allowed by open_basedir restrictions (and safe_mode). However it is possible to point a symlink to any file by the use of mkdir(), unlink() and at least two symlinks.

20326 CVE-2006-5178 http://www.hardened-php.net/advisory_082006.132.html http://secunia.com/advisories/22235/ 2006-10-02 2006-10-05 2006-10-16
phpbb -- NULL byte injection vulnerability phpbb zh-phpbb-tw 2.0.22

Secunia reports:

ShAnKaR has discovered a vulnerability in phpBB, which can be exploited by malicious users to compromise a vulnerable system.

Input passed to the "avatar_path" parameter in admin/admin_board.php is not properly sanitised before being used as a configuration variable to store avatar images. This can be exploited to upload and execute arbitrary PHP code by changing "avatar_path" to a file with a trailing NULL byte.

Successful exploitation requires privileges to the administration section.

20347 CVE-2006-4758 http://secunia.com/advisories/22188/ http://xforce.iss.net/xforce/xfdb/28884 http://www.security.nnov.ru/Odocument221.html 2006-09-12 2006-10-04 2006-12-24
postnuke -- admin section SQL injection postnuke 0.800

ISS X-Force reports:

PostNuke is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the admin section using the hits parameter, which could allow the attacker to view, add, modify or delete information in the back-end database.

20317 CVE-2006-5121 http://xforce.iss.net/xforce/xfdb/29271 http://www.securityfocus.com/archive/1/archive/1/447361/100/0/threaded http://secunia.com/advisories/22197/ 2006-09-29 2006-10-03 2006-10-15
freetype -- LWFN Files Buffer Overflow Vulnerability freetype2 2.1.10_5

SecurityTracker reports:

A vulnerability was reported in FreeType. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted font file that, when loaded by the target user's system, will trigger an integer underflow or integer overflow and crash the application or execute arbitrary code on the target system.

Chris Evans reported these vulnerabilities.

Impact: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.

18034 CVE-2006-0747 CVE-2006-1861 CVE-2006-3467 http://securitytracker.com/alerts/2006/Jul/1016522.html 2006-07-10 2006-10-02
cscope -- Buffer Overflow Vulnerabilities cscope 15.6

Secunia reports:

Will Drewry has reported some vulnerabilities in Cscope, which potentially can be exploited by malicious people to compromise a vulnerable system.

Various boundary errors within the parsing of file lists or the expansion of environment variables can be exploited to cause stack-based buffer overflows when parsing specially crafted "cscope.lists" files or directories.

A boundary error within the parsing of command line arguments can be exploited to cause a stack-based buffer overflow when supplying an overly long "reffile" argument.

Successful exploitation may allow execution of arbitrary code.

19686 19687 CVE-2006-4262 http://secunia.com/advisories/21601 http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&forum_id=33500 http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&forum_id=33500 2006-08-20 2006-10-02 2006-10-11
gnutls -- RSA Signature Forgery Vulnerability gnutls gnutls-devel 1.4.4

Secunia reports:

A vulnerability has been reported in GnuTLS, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error in the verification of certain signatures. If a RSA key with exponent 3 is used, it may be possible to forge PKCS #1 v1.5 signatures signed with that key.

20027 CVE-2006-4790 http://secunia.com/advisories/21937 http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html 2006-09-08 2006-10-02
MT -- Search Unspecified XSS MT 3.33.33

Secunia reports:

Arai has reported a vulnerability in Movable Type and Movable Type Enterprise, which can be exploited by malicious people to conduct cross-site scripting attacks.

Some unspecified input passed via the search functionality isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

20228 CVE-2006-5080 http://secunia.com/advisories/22109 http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html 2006-09-26 2006-10-02 2006-10-15
phpmyadmin -- XSRF vulnerabilities phpMyAdmin 2.9.0.1

phpMyAdmin team reports:

We received a security advisory from Stefan Esser (sesser@hardened-php.net) and we wish to thank him for his work.

It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link.

CVE-2006-5116 CVE-2006-5117 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5 http://secunia.com/advisories/22126/ 20253 2006-09-28 2006-10-02 2006-10-03
openssh -- multiple vulnerabilities FreeBSD 6.16.1_10 6.06.0_15 5.55.5_8 5.45.4_22 5.05.3_37 4.11_25 openssh 4.4,1 openssh-portable 4.4.p1,1

Problem Description

The CRC compensation attack detector in the sshd(8) daemon, upon receipt of duplicate blocks, uses CPU time cubic in the number of duplicate blocks received. [CVE-2006-4924]

A race condition exists in a signal handler used by the sshd(8) daemon to handle the LoginGraceTime option, which can potentially cause some cleanup routines to be executed multiple times. [CVE-2006-5051]

Impact

An attacker sending specially crafted packets to sshd(8) can cause a Denial of Service by using 100% of CPU time until a connection timeout occurs. Since this attack can be performed over multiple connections simultaneously, it is possible to cause up to MaxStartups (10 by default) sshd processes to use all the CPU time they can obtain. [CVE-2006-4924]

The OpenSSH project believe that the race condition can lead to a Denial of Service or potentially remote code execution, but the FreeBSD Security Team has been unable to verify the exact impact. [CVE-2006-5051]

Workaround

The attack against the CRC compensation attack detector can be avoided by disabling SSH Protocol version 1 support in sshd_config(5).

There is no workaround for the second issue.

20216 CVE-2006-4924 CVE-2006-5051 SA-06:22.openssh http://www.openssh.com/txt/release-4.4 2006-09-25 2006-09-30
dokuwiki -- multiple vulnerabilities dokuwiki 20060309c dokuwiki-devel 20060909

Secunia reports:

rgod has discovered a vulnerability in DokuWiki, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "TARGET_FN" parameter in bin/dwpage.php is not properly sanitised before being used to copy files. This can be exploited via directory traversal attacks in combination with DokuWiki's file upload feature to execute arbitrary PHP code.

CVE Mitre reports:

Direct static code injection vulnerability in doku.php in DokuWiki before 2006-03-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php.

Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors.

DokuWiki before 2006-03-09c enables the debug feature by default, which allows remote attackers to obtain sensitive information by calling doku.php with the X-DOKUWIKI-DO HTTP header set to "debug".

19911 CVE-2006-4674 CVE-2006-4675 CVE-2006-4679 http://secunia.com/advisories/21819/ http://bugs.splitbrain.org/index.php?do=details&id=906 2006-09-08 2006-09-30 2006-10-02
dokuwiki -- multiple vulnerabilities dokuwiki 20060309_5 dokuwiki-devel 20060609_2

Secunia reports:

Some vulnerabilities have been reported in DokuWiki, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

Input passed to the "w" and "h" parameters in lib/exec/fetch.php is not properly sanitised before being passed as resize parameters to the "convert" application. This can be exploited to cause a DoS due to excessive CPU and memory consumption by passing very large numbers, or to inject arbitrary shell commands by passing specially crafted strings to the "w" and "h" parameter.

Successful exploitation requires that the "$conf[imconvert]" option is set.

CVE-2006-5098 CVE-2006-5099 http://secunia.com/advisories/22192/ http://secunia.com/advisories/22199/ http://bugs.splitbrain.org/?do=details&id=924 http://bugs.splitbrain.org/?do=details&id=926 2006-09-26 2006-09-30 2006-10-02
tikiwiki -- multiple vulnerabilities tikiwiki 1.9.5

Secunia reports:

Thomas Pollet has discovered a vulnerability in TikiWiki, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "highlight" parameter in tiki-searchindex.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

rgod has discovered a vulnerability in TikiWiki, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the "jhot.php" script not correctly verifying uploaded files. This can e.g. be exploited to execute arbitrary PHP code by uploading a malicious PHP script to the "img/wiki" directory.

19654 19819 CVE-2006-4299 CVE-2006-4602 http://secunia.com/advisories/21536/ http://secunia.com/advisories/21733/ 2006-08-21 2006-09-30
punbb -- NULL byte injection vulnerability punbb 1.2.13

CVE Mitre reports:

PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary files and execute code, as demonstrated by a query to admin_options.php with an avatars_dir parameter ending in %00. NOTE: this issue was originally disputed by the vendor, but the dispute was withdrawn on 20060926.

CVE-2006-4759 http://forums.punbb.org/viewtopic.php?id=13255 2006-09-13 2006-09-30
freeciv -- Denial of Service Vulnerabilities freeciv freeciv-gtk freeciv-gtk2 freeciv-nox11 2.0.8_2

Secunia reports:

Luigi Auriemma has reported a vulnerability in Freeciv, which can be exploited by malicious people to cause a DoS (Denial of Service).

An error in the "generic_handle_player_attribute_chunk()" function in common/packets.c can be exploited to crash the service via a specially crafted PACKET_PLAYER_ATTRIBUTE_CHUNK packet sent to the server.

An error in the "handle_unit_orders()" function in server/unithand.c can be exploited to crash the service via a specially crafted packet.

CVE-2006-3913 19117 http://secunia.com/advisories/21171/ http://aluigi.altervista.org/adv/freecivx-adv.txt 2006-07-23 2006-09-26
freeciv -- Packet Parsing Denial of Service Vulnerability freeciv freeciv-gtk freeciv-gtk2 freeciv-nox11 2.0.8

Secunia reports:

Luigi Auriemma has reported a vulnerability in Freeciv, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the handling of the packet length in "common/packets.c". This can be exploited to crash the Freeciv server via a specially- crafted packet with the size set to "0xffff".

CVE-2006-0047 16975 http://secunia.com/advisories/19120/ http://aluigi.altervista.org/adv/freecivdos-adv.txt 2006-03-06 2006-09-26
plans -- multiple vulnerabilities plans 6.7.2

Secunia reports:

A vulnerability has been reported in Plans, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "evt_id" parameter in "plans.cgi" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that SQL database support has been enabled in "plans_config.pl" (the default setting is flat files).

Some vulnerabilities have been reported in Plans, which can be exploited by malicious people to conduct cross-site scripting attacks or gain knowledge of sensitive information.

Input passed to various unspecified parameters is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

An unspecified error can be exploited to gain knowledge of the MySQL password.

14069 http://secunia.com/advisories/15167/ http://secunia.com/advisories/15854/ http://planscalendar.com/forum/viewtopic.php?t=660 2005-04-28 2006-09-26 2006-10-15
eyeOS -- multiple XSS security bugs eyeOS 0.9.1

eyeOS team reports:

[EyeOS 0.9.1] release fixes two XSS security bugs, so we recommend all users to upgrade to this new version in order to have the best security. These two bugs were discovered by Jose Carlos Norte, who is a new eyeOS developer.

20213 CVE-2006-5071 http://eyeos.blogspot.com/2006/09/eyeos-091-released.html 2006-09-25 2006-09-25 2006-10-15
zope -- restructuredText "csv_table" Information Disclosure zope 2.7.02.7.9_1 2.8.02.8.8_1

Secunia reports:

A vulnerability has been reported in Zope, which can be exploited by malicious people to disclose potentially sensitive information.

The vulnerability is caused due to an error in the use of the docutils module to parse and render "restructured" text. This can be exploited to disclose certain information via the "csv_table" reStructuredText directive.

20022 CVE-2006-4684 http://secunia.com/advisories/21947/ http://www.zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt 2006-08-21 2006-09-22 2006-12-27
libmms -- stack-based buffer overflow libmms 0.3 libxine 1.1.1

Mitre CVE reports:

Stack-based buffer overflow in libmms, as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions.

CVE-2006-2200 18608 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577 2006-05-04 2006-09-22
opera -- RSA Signature Forgery opera opera-devel linux-opera 9.02

Opera reports:

A specially crafted digital certificate can bypass Opera's certificate signature verification. Forged certificates can contain any false information the forger chooses, and Opera will still present it as valid. Opera will not present any warning dialogs in this case, and the security status will be the highest possible (3). This defeats the protection against "man in the middle", the attacks that SSL was designed to prevent.

There is a flaw in OpenSSL's RSA signature verification that affects digital certificates using 3 as the public exponent. Some of the certificate issuers that are on Opera's list of trusted signers have root certificates with 3 as the public exponent. The forged certificate can appear to be signed by one of these.

CVE-2006-4339 http://secunia.com/advisories/21982/ http://secunia.com/advisories/21709/ http://www.cdc.informatik.tu-darmstadt.de/securebrowser/ http://www.openssl.org/news/secadv_20060905.txt http://www.mozilla.org/security/announce/2006/mfsa2006-60.html 2006-09-18 2006-09-22
mozilla -- multiple vulnerabilities firefox 1.5.0.7,1 2.*,12.0_1,1 linux-firefox 1.5.0.7 seamonkey linux-seamonkey 1.0.5 thunderbird linux-thunderbird mozilla-thunderbird 1.5.0.7 linux-firefox-devel 3.0.a2006.09.21 linux-seamonkey-devel 1.5.a2006.09.21 linux-mozilla-devel linux-mozilla mozilla 0

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2006-64 Crashes with evidence of memory corruption (rv:1.8.0.7)
  • MFSA 2006-63 JavaScript execution in mail via XBL
  • MFSA 2006-62 Popup-blocker cross-site scripting (XSS)
  • MFSA 2006-61 Frame spoofing using document.open()
  • MFSA 2006-60 RSA Signature Forgery
  • MFSA 2006-59 Concurrency-related vulnerability
  • MFSA 2006-58 Auto-Update compromise through DNS and SSL spoofing
  • MFSA 2006-57 JavaScript Regular Expression Heap Corruption
20042 CVE-2006-4253 CVE-2006-4340 CVE-2006-4565 CVE-2006-4566 CVE-2006-4567 CVE-2006-4568 CVE-2006-4569 CVE-2006-4570 CVE-2006-4571 http://www.mozilla.org/security/announce/2006/mfsa2006-57.html http://www.mozilla.org/security/announce/2006/mfsa2006-58.html http://www.mozilla.org/security/announce/2006/mfsa2006-59.html http://www.mozilla.org/security/announce/2006/mfsa2006-60.html http://www.mozilla.org/security/announce/2006/mfsa2006-61.html http://www.mozilla.org/security/announce/2006/mfsa2006-62.html http://www.mozilla.org/security/announce/2006/mfsa2006-63.html http://www.mozilla.org/security/announce/2006/mfsa2006-64.html 2006-09-14 2006-09-15 2006-11-02
win32-codecs -- multiple vulnerabilities win32-codecs 3.1.0.p8_1,1

The Apple Security Team reports that there are multiple vulnerabilities within QuickTime (one of the plugins for win32-codecs). A remote attacker capable of creating a malicious SGI image, FlashPix, FLC movie, or a QuickTime movie can possibly lead to execution of arbitrary code or cause a Denial of Service (application crash).

Users who have QuickTime (/win32-codecs) as a browser plugin may be vulnerable to remote code execution by visiting a website containing a malicious SGI image, FlashPix, FLC movie or a QuickTime movie.

20138 CVE-2006-4381 CVE-2006-4382 CVE-2006-4384 CVE-2006-4385 CVE-2006-4386 CVE-2006-4388 CVE-2006-4389 http://docs.info.apple.com/article.html?artnum=304357 2006-09-08 2006-09-14 2006-10-17
php -- multiple vulnerabilities php4 php5 4.4.4 55.1.5 php4-cli php5-cli php4-cgi php5-cgi php4-dtc php5-dtc php4-horde php5-horde php4-nms php5-nms mod_php4 mod_php5 0

The PHP development team reports:

  • Added missing safe_mode/open_basedir checks inside the error_log(), file_exists(), imap_open() and imap_reopen() functions.
  • Fixed overflows inside str_repeat() and wordwrap() functions on 64bit systems.
  • Fixed possible open_basedir/safe_mode bypass in cURL extension and with realpath cache.
  • Fixed overflow in GD extension on invalid GIF images.
  • Fixed a buffer overflow inside sscanf() function.
  • Fixed an out of bounds read inside stripos() function.
  • Fixed memory_limit restriction on 64 bit system.
CVE-2006-4481 CVE-2006-4482 CVE-2006-4483 CVE-2006-4484 CVE-2006-4485 CVE-2006-4486 http://www.php.net/release_4_4_4.php http://www.php.net/release_5_1_5.php 2006-08-18 2006-09-13 2006-09-14
drupal-pubcookie -- authentication may be bypassed drupal-pubcookie 4.6.0_20060210

The Drupal Project reports:

It is possible for a malicious user to spoof a user's identity by bypassing the login redirection mechanism in the pubcookie module. The malicious user may gain the privileges of the user they are spoofing, including the administrative user.

http://drupal.org/node/83064 2006-09-08 2006-09-13
linux-flashplugin7 -- arbitrary code execution vulnerabilities linux-flashplugin 7.0r68

Adobe reports:

Multiple input validation errors have been identified in Flash Player 8.0.24.0 and earlier versions that could lead to the potential execution of arbitrary code. These vulnerabilities could be accessed through content delivered from a remote location via the user?s web browser, email client, or other applications that include or reference the Flash Player. (CVE-2006-3311, CVE-2006-3587, CVE-2006-3588)

These updates include changes to prevent circumvention of the "allowScriptAccess" option. (CVE-2006-4640)

CVE-2006-3311 CVE-2006-3587 CVE-2006-3588 CVE-2006-4640 http://www.adobe.com/support/security/bulletins/apsb06-11.html 2006-09-12 2006-09-12
mailman -- Multiple Vulnerabilities mailman ja-mailman mailman-with-htdig 2.1.9.r1

Secunia reports:

Mailman can be exploited by malicious people to conduct cross-site scripting and phishing attacks, and cause a DoS (Denial of Service).

1) An error in the logging functionality can be exploited to inject a spoofed log message into the error log via a specially crafted URL.

Successful exploitation may trick an administrator into visiting a malicious web site.

2) An error in the processing of malformed headers which does not follow the RFC 2231 standard can be exploited to cause a DoS (Denial of Service).

3) Some unspecified input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

19831 CVE-2006-2191 CVE-2006-2941 CVE-2006-3636 CVE-2006-4624 http://secunia.com/advisories/21732/ http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295 2006-06-09 2006-09-04 2006-10-04
hlstats -- multiple cross site scripting vulnerabilities hlstats 0

Kefka reports multiple cross site scripting vulnerabilities within hlstats. The vulnerabilities are caused due to improper checking of variables, allowing an attacker to perform cross site scripting.

19745 CVE-2006-4454 2006-08-29 2006-09-02
gtetrinet -- remote code execution gtetrinet 0.7.10

The Debian Security Team reports:

Michael Gehring discovered several potential out-of-bounds index accesses in gtetrinet, a multiplayer Tetris-like game, which may allow a remote server to execute arbitrary code

19766 CVE-2006-3125 http://www.debian.org/security/2006/dsa-1163 2006-08-30 2006-09-02 2006-10-01
joomla -- multiple vulnerabilities joomla 1.0.11

The Joomla development team reports multiple vulnerabilities within the joomla application. Joomla is vulnerable to the following vulnerabilities:

  • Improper validation of the mosMail function
  • Improper validation of the JosIsValidEmail function.
  • Remote code execution in PEAR.php
  • Zend Hash del key or index vulnerability
http://www.joomla.org/content/view/1841/78/ 2006-08-28 2006-08-30
sppp -- buffer overflow vulnerability FreeBSD 4.11_20 5.35.3_32 5.45.4_17 5.55.5_3 6.06.0_10 6.16.1_4

Problem Description

While processing Link Control Protocol (LCP) configuration options received from the remote host, sppp(4) fails to correctly validate option lengths. This may result in data being read or written beyond the allocated kernel memory buffer.

Impact

An attacker able to send LCP packets, including the remote end of a sppp(4) connection, can cause the FreeBSD kernel to panic. Such an attacker may also be able to obtain sensitive information or gain elevated privileges.

Workaround

No workaround is available, but systems which do not use sppp(4) are not vulnerable.

CVE-2006-4304 SA-06:18.ppp 2006-08-23 2006-08-23 2006-08-30
horde -- Phishing and Cross-Site Scripting Vulnerabilities horde 3.1.2 imp 4.1.2

Secunia reports:

Some vulnerabilities have been reported in Horde, which can be exploited by malicious people to conduct phishing and cross-site scripting attacks.

  1. Input passed to the "url" parameter in index.php isn't properly verified before it is being used to include an arbitrary web site in a frameset. This can e.g. be exploited to trick a user into believing certain malicious content is served from a trusted web site.
  2. Some unspecified input passed in index.php isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
19557 19544 http://secunia.com/advisories/21500/ http://lists.horde.org/archives/announce/2006/000292.html 2006-08-17 2006-08-17
globus -- Multiple tmpfile races globus 4.0.2_20060706

The Globus Alliance reports:

The proxy generation tool (grid-proxy-init) creates the file, secures the file to provide access only to owner and writes proxy to the file. A race condition exists between the opening of the proxy credentials file, and making sure it is safe file to write to. The checks to ensure this file is accessible only to the owner take place using the filename after the file is opened for writing, but before any data is written.

Various components of the toolkit use files in shared directories to store information, some being sensitive information. For example, the tool to create proxy certificates, stores the generated proxy certificate by default in /tmp. Specific vulnerabilities in handling such files were reported in myproxy-admin-adduser, grid-ca-sign and grid-security-config.

http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html 2006-08-08 2006-08-15
x11vnc -- authentication bypass vulnerability x11vnc 0.8.2

Ludwig Nussel reports that x11vnc is vulnerable to an authentication bypass vulnerability. The vulnerability is caused by an error in auth.c. This could allow a remote attacker to gain unauthorized and unauthenticated access to the system.

18977 CVE-2006-2450 http://bugs.debian.org/376824 2006-08-08 2006-08-13
alsaplayer -- multiple vulnerabilities alsaplayer 0

Luigi Auriemma reports three vulnerabilities within alsaplayer:

  • The function which handles the HTTP connections is vulnerable to a buffer-overflow that happens when it uses sscanf for copying the URL in the Location's field received from the server into the redirect buffer of only 1024 bytes declared in http_open.
  • A buffer-overflow exists in the functions which add items to the playlist when the GTK interface is used (so the other interfaces are not affected by this problem): new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp.
  • AlsaPlayer automatically queries the CDDB server specified in its configuration (by default freedb.freedb.org) when the user choices the CDDA function for playing audio CDs. The function which queries the server uses a buffer of 20 bytes and one of 9 for storing the category and ID strings received from the server while the buffer which contains this server's response is 32768 bytes long. Naturally for exploiting this bug the attacker must have control of the freedb server specified in the AlsaPlayer's configuration.

These vulnerabilities could allow a remote attacker to execute arbitrary code, possibly gaining access to the system.

19450 http://aluigi.altervista.org/adv/alsapbof-adv.txt 2006-08-09 2006-08-13
postgresql -- encoding based SQL injection postgresql postgresql-server ja-postgresql 7.37.3.15 7.47.4.13 8.0.08.0.8 8.1.08.1.4

The PostgreSQL development team reports:

An attacker able to submit crafted strings to an application that will embed those strings in SQL commands can use invalidly-encoded multibyte characters to bypass standard string-escaping methods, resulting in possible injection of hostile SQL commands into the database. The attacks covered here work in any multibyte encoding.

The widely-used practice of escaping ASCII single quote "'" by turning it into "\'" is unsafe when operating in multibyte encodings that allow 0x5c (ASCII code for backslash) as the trailing byte of a multibyte character; this includes at least SJIS, BIG5, GBK, GB18030, and UHC. An application that uses this conversion while embedding untrusted strings in SQL commands is vulnerable to SQL-injection attacks if it communicates with the server in one of these encodings. While the standard client libraries used with PostgreSQL have escaped "'" in the safe, SQL-standard way of "''" for some time, the older practice remains common.

18092 CVE-2006-2313 CVE-2006-2314 http://www.postgresql.org/docs/techdocs.50 2006-05-11 2006-08-13
postgresql -- multiple vulnerabilities postgresql postgresql-server ja-postgresql 7.27.2.7 7.37.3.9 7.47.4.7 8.0.08.0.1

Multiple vulnerabilities had been reported in various versions of PostgreSQL:

  • The EXECUTE restrictions can be bypassed by using the AGGREGATE function, which is missing a permissions check.
  • A buffer overflow exists in gram.y which could allow an attacker to execute arbitrary code by sending a large number of arguments to a refcursor function, found in gram.y
  • The intagg contributed module allows an attacker to crash the server (Denial of Service) by constructing a malicious crafted array.
CVE-2005-0244 CVE-2005-0245 CVE-2005-0246 http://secunia.com/advisories/12948 2005-02-01 2006-08-13
mysql -- format string vulnerability mysql-server 5.15.1.6 5.05.0.19 4.14.1.18

Jean-David Maillefer reports a Denial of Service vulnerability within MySQL. The vulnerability is caused by improper checking of the data_format routine, which cause the MySQL server to crash. The crash is triggered by the following code:
"SELECT date_format('%d%s', 1);

19032 CVE-2006-3469 http://bugs.mysql.com/bug.php?id=20729 2006-06-27 2006-08-13
squirrelmail -- random variable overwrite vulnerability ja-squirrelmail 1.4.01.4.8,2 squirrelmail 1.4.01.4.8

The SquirrelMail developers report:

A logged in user could overwrite random variables in compose.php, which might make it possible to read/write other users' preferences or attachments.

CVE-2006-4019 http://www.squirrelmail.org/security/issue/2006-08-11 2006-08-11 2006-08-12
rubygem-rails -- evaluation of ruby code rubygem-rails 1.1.01.1.3 1.1.41.1.6

The Ruby on Rails blog reports:

With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3), you can trigger the evaluation of Ruby code through the URL because of a bug in the routing code of Rails. This means that you can essentially take down a Rails process by starting something like /script/profiler, as the code will run for a long time and that process will be hung while it happens. Other URLs can even cause data loss.

http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure 2006-08-09 2006-08-10
clamav -- heap overflow vulnerability clamav 0.88.10.88.4 clamav-devel 20060808

Clamav team reports:

A heap overflow vulnerability was discovered in libclamav which could cause a denial of service or allow the execution of arbitrary code.

The problem is specifically located in the PE file rebuild function used by the UPX unpacker.

Relevant code from libclamav/upx.c:

memcpy(dst, newbuf, foffset); *dsize = foffset; free(newbuf); cli_dbgmsg("UPX: PE structure rebuilt from compressed file\n"); return 1;

Due to improper validation it is possible to overflow the above memcpy() beyond the allocated memory block.

CVE-2006-4018 http://www.clamav.net/security/0.88.4.html 2006-08-07 2006-08-08
drupal -- XSS vulnerability drupal 4.6.9

The Drupal project reports:

A malicious user can execute a cross site scripting attack by enticing someone to visit a Drupal site via a specially crafted link.

http://drupal.org/files/sa-2006-011/advisory.txt 2006-08-02 2006-08-02 2006-08-08
gnupg -- 2 more possible memory allocation attacks gnupg 1.4.5

Author reports:

Fixed 2 more possible memory allocation attacks. They are similar to the problem we fixed with 1.4.4. This bug can easily be be exploted for a DoS; remote code execution is not entirely impossible.

http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html 2006-08-01 2006-08-02
ruby - multiple vulnerabilities ruby ruby_static 1.6.*1.8.* 1.8.*1.8.4_9,1

Secunia reports:

Two vulnerabilities have been reported in Ruby, which can be exploited by malicious people to bypass certain security restrictions.

  1. An error in the handling of the "alias" functionality can be exploited to bypass the safe level protection and replace methods called in the trusted level.
  2. An error caused due to directory operations not being properly checked can be exploited to bypass the safe level protection and close untainted directory streams.
18944 CVE-2006-3694 http://secunia.com/advisories/21009/ http://jvn.jp/jp/JVN%2383768862/index.html http://jvn.jp/jp/JVN%2313947696/index.html 2006-07-12 2006-07-29 2006-07-30
apache -- mod_rewrite buffer overflow vulnerability apache 1.3.281.3.36_1 2.0.462.0.58_2 2.2.02.2.2_1 apache+mod_perl 1.3.281.3.36_1 apache+ipv6 1.3.281.3.37 apache_fp 0 ru-apache 1.3.281.3.37+30.23 ru-apache+mod_ssl 1.3.281.3.34.1.57_2 apache+ssl 1.3.281.3.34.1.57_2 apache+mod_ssl apache+mod_ssl+ipv6 apache+mod_ssl+mod_accel apache+mod_ssl+mod_accel+ipv6 apache+mod_ssl+mod_accel+mod_deflate apache+mod_ssl+mod_accel+mod_deflate+ipv6 apache+mod_ssl+mod_deflate apache+mod_ssl+mod_deflate+ipv6 apache+mod_ssl+mod_snmp apache+mod_ssl+mod_snmp+mod_accel apache+mod_ssl+mod_snmp+mod_accel+ipv6 apache+mod_ssl+mod_snmp+mod_deflate apache+mod_ssl+mod_snmp+mod_deflate+ipv6 apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 1.3.281.3.36+2.8.27_1

The Apache Software Foundation and The Apache HTTP Server Project reports:

An off-by-one flaw exists in the Rewrite module, mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0 since 2.0.46, and 2.2 since 2.2.0.

Depending on the manner in which Apache HTTP Server was compiled, this software defect may result in a vulnerability which, in combination with certain types of Rewrite rules in the web server configuration files, could be triggered remotely. For vulnerable builds, the nature of the vulnerability can be denial of service (crashing of web server processes) or potentially allow arbitrary code execution. This issue has been rated as having important security impact by the Apache HTTP Server Security Team.

This flaw does not affect a default installation of Apache HTTP Server. Users who do not use, or have not enabled, the Rewrite module mod_rewrite are not affected by this issue. This issue only affects installations using a Rewrite rule with the following characteristics:

  • The RewriteRule allows the attacker to control the initial part of the rewritten URL (for example if the substitution URL starts with $1)
  • The RewriteRule flags do NOT include any of the following flags: Forbidden (F), Gone (G), or NoEscape (NE).

Please note that ability to exploit this issue is dependent on the stack layout for a particular compiled version of mod_rewrite. If the compiler used to compile Apache HTTP Server has added padding to the stack immediately after the buffer being overwritten, it will not be possible to exploit this issue, and Apache HTTP Server will continue operating normally.

The Apache HTTP Server project thanks Mark Dowd of McAfee Avert Labs for the responsible reporting of this vulnerability.

395412 CVE-2006-3747 http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=115409818602955 2006-07-27 2006-07-28 2006-11-01
mozilla -- multiple vulnerabilities firefox 1.5.0.5,1 2.*,12.0_1,1 linux-firefox 1.5.0.5 linux-firefox-devel 3.0.a2006.07.26 seamonkey linux-seamonkey 1.0.3 thunderbird linux-thunderbird mozilla-thunderbird 1.5.0.5 mozilla linux-mozilla linux-mozilla-devel 0

A Mozilla Foundation Security Advisory reports of multiple issues. Several of which can be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2006-56 chrome: scheme loading remote content
  • MFSA 2006-55 Crashes with evidence of memory corruption (rv:1.8.0.5)
  • MFSA 2006-54 XSS with XPCNativeWrapper(window).Function(...)
  • MFSA 2006-53 UniversalBrowserRead privilege escalation
  • MFSA 2006-52 PAC privilege escalation using Function.prototype.call
  • MFSA 2006-51 Privilege escalation using named-functions and redefined "new Object()"
  • MFSA 2006-50 JavaScript engine vulnerabilities
  • MFSA 2006-49 Heap buffer overwrite on malformed VCard
  • MFSA 2006-48 JavaScript new Function race condition
  • MFSA 2006-47 Native DOM methods can be hijacked across domains
  • MFSA 2006-46 Memory corruption with simultaneous events
  • MFSA 2006-45 Javascript navigator Object Vulnerability
  • MFSA 2006-44 Code execution through deleted frame reference
CVE-2006-3113 CVE-2006-3677 CVE-2006-3801 CVE-2006-3802 CVE-2006-3803 CVE-2006-3804 CVE-2006-3805 CVE-2006-3806 CVE-2006-3807 CVE-2006-3808 CVE-2006-3809 CVE-2006-3810 CVE-2006-3811 CVE-2006-3812 http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3 http://www.mozilla.org/security/announce/2006/mfsa2006-44.html http://www.mozilla.org/security/announce/2006/mfsa2006-45.html http://www.mozilla.org/security/announce/2006/mfsa2006-46.html http://www.mozilla.org/security/announce/2006/mfsa2006-47.html http://www.mozilla.org/security/announce/2006/mfsa2006-48.html http://www.mozilla.org/security/announce/2006/mfsa2006-49.html http://www.mozilla.org/security/announce/2006/mfsa2006-50.html http://www.mozilla.org/security/announce/2006/mfsa2006-51.html http://www.mozilla.org/security/announce/2006/mfsa2006-52.html http://www.mozilla.org/security/announce/2006/mfsa2006-53.html http://www.mozilla.org/security/announce/2006/mfsa2006-54.html http://www.mozilla.org/security/announce/2006/mfsa2006-55.html http://www.mozilla.org/security/announce/2006/mfsa2006-56.html 2006-07-25 2006-07-27 2006-11-02
zope -- information disclosure vulnerability zope 2.7.02.7.9 2.8.02.8.7 2.9.02.9.3

Zope team reports:

Unspecified vulnerability in (Zope2) allows local users to obtain sensitive information via unknown attack vectors related to the docutils module and "restructured text".

CVE-2006-3458 http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view 2006-07-05 2006-07-14
drupal -- multiple vulnerabilities drupal 4.6.8

The Drupal team reports:

Vulnerability: XSS Vulnerability in taxonomy module

It is possible for a malicious user to insert and execute XSS into terms, due to lack of validation on output of the page title. The fix wraps the display of terms in check_plain().

CVE-2006-2833 http://drupal.org/node/66767 2006-05-18 2006-07-13 2006-07-14
shoutcast -- cross-site scripting, information exposure shoutcast linux-shoutcast 1.9.7

Goober's advisory reports reports that shoutcast is vulnerable to an arbitrary file reading vulnerability:

Impact of the vulnerability depends on the way the product was installed. In general, the vulnerability allows the attacker to read any file which can be read by the Shoutcast server process.

CVE-2006-3007 http://secunia.com/advisories/20524/ http://people.ksp.sk/~goober/advisory/001-shoutcast.html 2006-06-09 2006-07-11
samba -- memory exhaustion DoS in smbd samba ja-samba 3.0.1,13.0.23,1

The Samba Team reports:

The smbd daemon maintains internal data structures used track active connections to file and printer shares. In certain circumstances an attacker may be able to continually increase the memory usage of an smbd process by issuing a large number of share connection requests. This defect affects all Samba configurations.

CVE-2006-3403 http://www.samba.org/samba/security/CAN-2006-3403.html 2006-07-10 2006-07-10
twiki -- multiple file extensions file upload vulnerability twiki 4.0.4,1

A TWiki Security Alert reports:

The TWiki upload filter already prevents executable scripts such as .php, .php1, .phps, .pl from potentially getting executed by appending a .txt suffix to the uploaded filename. However, PHP and some other types allows additional file suffixes, such as .php.en, .php.1, and .php.2. TWiki does not check for these suffixes, e.g. it is possible to upload php scripts with such suffixes without the .txt filename padding.

This issue can also be worked around with a restrictive web server configuration. See the TWiki Security Alert for more information about how to do this.

18854 CVE-2006-3336 http://secunia.com/advisories/20992/ http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads 2006-07-05 2006-07-10
trac -- reStructuredText breach of privacy and denial of service vulnerability trac ja-trac 0.9.6

The Trac 0.9.6 Release Notes reports:

Fixed reStructuredText breach of privacy and denial of service vulnerability found by Felix Wiemann.

The discovered vulnerability requires docutils to be installed and enabled. Systems that do not have docutils installed or enabled are not vulnerable. As of this version version 0.3.9 or greater of docutils is required for using reStructuredText markup in Trac.

http://projects.edgewall.com/trac/wiki/ChangeLog http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html 2006-07-06 2006-07-07 2006-06-10
horde -- various problems in dereferrer horde horde-php5 3.1.2

Horde 3.1.2 release announcement:

Security Fixes:

  • Closed XSS problems in dereferrer (IE only), help viewer and problem reporting screen.
  • Removed unused image proxy code from dereferrer.
http://lists.horde.org/archives/announce/2006/000288.html 2006-06-28 2006-07-05
mambo -- SQL injection vulnerabilities mambo 4.5.4

The Team Mambo reports that two SQL injection vulnerabilities have been found in Mambo. The vulnerabilities exists due to missing sanitation of the title and catid parameters in the weblinks.php page and can lead to execution of arbitrary SQL code.

16775 CVE-2006-0871 CVE-2006-1794 CVE-2006-3262 CVE-2006-3263 http://marc.theaimsgroup.com/?l=bugtraq&m=115056811230529 http://secunia.com/advisories/18935/ http://secunia.com/advisories/20745/ http://www.mamboserver.com/?option=com_content&task=view&id=207 http://www.gulftech.org/?node=research&article_id=00104-02242006 2006-06-19 2006-07-05 2006-10-05
phpmyadmin -- cross site scripting vulnerability phpmyadmin 2.8.2

phpmyadmin Site reports:

It was possible to craft a request that contains XSS by attacking the "table" parameter.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4 http://securitynews.ir/advisories/phpmyadmin281.txt 2006-06-30 2006-07-03
webmin, usermin -- arbitrary file disclosure vulnerability webmin 1.290 usermin 1.220

The webmin development team reports:

An attacker without a login to Webmin can read the contents of any file on the server using a specially crafted URL. All users should upgrade to version 1.290 as soon as possible, or setup IP access control in Webmin.

18744 http://www.webmin.com/security.html 2006-06-30 2006-07-02
mutt -- Remote Buffer Overflow Vulnerability mutt mutt-lite 1.4.2.1_2 mutt-devel mutt-devel-lite 1.5.11_2 ja-mutt 1.4.2.1.j1 zh-mutt-devel 1.5.11_20040617 ja-mutt-devel 1.5.6.j1_2 mutt-ng 20060501

SecurityFocus reports:

Mutt is prone to a remote buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer. This issue may allow remote attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely crash the application, denying further service to legitimate users.

18642 http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git;a=commit;h=dc0272b749f0e2b102973b7ac43dbd3908507540 2006-06-26 2006-06-30
Joomla -- multiple vulnerabilities joomla 1.0.10

Joomla Site reports:

  • Secured "Remember Me" functionality against SQL injection attacks
  • Secured "Related Items" module against SQL injection attacks
  • Secured "Weblinks" submission against SQL injection attacks
  • Secured SEF from XSS vulnerability
  • Hardened frontend submission forms against spoofing
  • Secured mosmsg from misuse
  • Hardened mosgetparam by setting variable type to integer if default value is detected as numeric
  • Secured com_messages from XSS vulnerability
  • Secured getUserStateFromRequest() from XSS vulnerability
http://secunia.com/advisories/20746/ http://www.joomla.org/content/view/1510/74/ 2006-06-26 2006-06-30
hashcash -- heap overflow vulnerability hashcash 1.22

Andreas Seltenreich reports that hashcash is prone to a heap overflow vulnerability. This vulnerability is caused by improper checking of memory allocations within the "array_push()" function. An attacker could trigger this vulnerability by passing a lot of "-r" or "-j" flags from the command line, this only applies when the application is configured to allow command line options, or by passing a lot of resource names when the application was started with the "-m" flag set. This could lead to a Denial or Service or could allow remote access to the targeted system.

http://secunia.com/advisories/20800/ http://www.hashcash.org/source/CHANGELOG 2006-06-27 2006-06-27
gnupg -- user id integer overflow vulnerability gnupg 1.4.4

If GnuPG processes a userid with a very long packet length, GnuPG can crash due to insufficient bounds check. This can result in a denial-of-service condition or potentially execution of arbitrary code with the privileges of the user running GnuPG.

18554 CVE-2006-3082 http://marc.theaimsgroup.com/?l=gnupg-users&m=115124706210430 http://marc.theaimsgroup.com/?l=full-disclosure&m=114907659313360 http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157 2006-05-31 2006-06-25
horde -- multiple parameter cross site scripting vulnerabilities horde horde-php5 3.1.1

FrSIRT advisory ADV-2006-2356 reports:

Multiple vulnerabilities have been identified in Horde Application Framework, which may be exploited by attackers to execute arbitrary scripting code. These flaws are due to input validation errors in the "test.php" and "templates/problem/problem.inc" scripts that do not validate the "url", "name", "email", "subject" and "message" parameters, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site.

CVE-2006-2195 http://www.frsirt.com/english/advisories/2006/2356 http://cvs.horde.org/diff.php?f=horde%2Ftest.php&r1=1.145&r2=1.146 http://cvs.horde.org/diff.php?f=horde%2Ftemplates%2Fproblem%2Fproblem.inc&r1=2.25&r2=2.26 2006-06-10 2006-06-17
webcalendar -- information disclosure vulnerability WebCalendar 1.0.4

Secunia reports:

socsam has discovered a vulnerability in WebCalendar, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information.

Input passed to the "includedir" parameter isn't properly verified, before it is used in an "fopen()" call. This can be exploited to load an arbitrary setting file from an external web site.

This can further be exploited to disclose the content of arbitrary files by defining the "user_inc" variable in a malicious setting file.

Successful exploitation requires that "register_globals" is enabled.

18175 CVE-2006-2762 http://www.securityfocus.com/archive/1/435379 http://www.securityfocus.com/archive/1/436263 2006-05-30 2006-06-16 2006-06-17
sendmail -- Incorrect multipart message handling FreeBSD 4.114.11_19 5.35.3_31 5.45.4_16 5.55.5_2 6.06.0_9 6.16.1_2

Problem Description

A suitably malformed multipart MIME message can cause sendmail to exceed predefined limits on its stack usage.

Impact

An attacker able to send mail to, or via, a server can cause queued messages on the system to not be delivered, by causing the sendmail process which handles queued messages to crash. Note that this will not stop new messages from entering the queue (either from local processes, or incoming via SMTP).

Workaround

No workaround is available, but systems which do not receive email from untrusted sources are not vulnerable.

CVE-2006-1173 SA-06:17.sendmail 2006-06-14 2006-06-14
dokuwiki -- multiple vulnerabilities dokuwiki 20060309_2

Multiple vulnerabilities have been reported within dokuwiki. dokuwiki is proven vulnerable to:

  • arbitrary PHP code insertion via spellcheck module,
  • XSS attack via "Update your account profile,"
  • bypassing of ACL controls when enabled.
http://bugs.splitbrain.org/index.php?do=details&id=820 http://bugs.splitbrain.org/index.php?do=details&id=823 http://bugs.splitbrain.org/index.php?do=details&id=825 2006-05-31 2006-06-11 2006-06-12
libxine -- buffer overflow vulnerability libxine 1.1.1_6

A Secunia Advisory reports:

Federico L. Bossi Bonin has discovered a weakness in xine-lib, which can be exploited by malicious people to crash certain applications on a user's system.

The weakness is cause due to a heap corruption within the "xineplug_inp_http.so" plugin when handling an overly large reply from the HTTP server. This can be exploited to crash an application that uses the plugin (e.g. gxine).

http://secunia.com/advisories/20369 CVE-2006-2802 18187 2006-05-31 2006-06-11
smbfs -- chroot escape FreeBSD 4.104.10_24 4.114.11_18 5.35.3_30 5.45.4_15 5.55.5_1 6.06.0_8 6.16.1_1

Problem Description

smbfs does not properly sanitize paths containing a backslash character; in particular the directory name '..\' is interpreted as the parent directory by the SMB/CIFS server, but smbfs handles it in the same manner as any other directory.

Impact

When inside a chroot environment which resides on a smbfs mounted file-system it is possible for an attacker to escape out of this chroot to any other directory on the smbfs mounted file-system.

Workaround

Mount the smbfs file-systems which need to be used with chroot on top, in a way so the chroot directory is exactly on the mount point and not a sub directory

CVE-2006-2654 SA-06:16.smbfs 2006-05-31 2006-06-09
ypserv -- Inoperative access controls in ypserv FreeBSD 5.35.3_30 5.45.4_15 5.55.5_1 6.06.0_8 6.16.1_1

Problem Description

There are two documented methods of restricting access to NIS maps through ypserv(8): through the use of the /var/yp/securenets file, and through the /etc/hosts.allow file. While both mechanisms are implemented in the server, a change in the build process caused the "securenets" access restrictions to be inadvertantly disabled.

Impact

ypserv(8) will not load or process any of the networks or hosts specified in the /var/yp/securenets file, rendering those access controls ineffective.

Workaround

One possible workaround is to use /etc/hosts.allow for access control, as shown by examples in that file.

Another workaround is to use a firewall (e.g., ipfw(4), ipf(4), or pf(4)) to limit access to RPC functions from untrusted systems or networks, but due to the complexities of RPC, it might be difficult to create a set of firewall rules which accomplish this without blocking all access to the machine in question.

CVE-2006-2655 SA-06:15.ypserv 2006-05-31 2006-06-09
freeradius -- multiple vulnerabilities freeradius 1.0.01.0.4

The freeradious development team reports:

Multiple issues exist with version 1.0.4, and all prior versions of the server. Externally exploitable vulnerabilities exist only for sites that use the rlm_sqlcounter module. Those sites may be vulnerable to SQL injection attacks, similar to the issues noted below. All sites that have not deployed the rlm_sqlcounter module are not vulnerable to external exploits.

The issues are:
SQL Injection attack in the rlm_sqlcounter module.
Buffer overflow in the rlm_sqlcounter module, that may cause a server crash.
Buffer overflow while expanding %t, that may cause a server crash.

17171 CVE-2005-4744 2005-09-09 2006-06-08
freeradius -- authentication bypass vulnerability freeradius 1.0.01.1.0

The freeradius development team reports:

A validation issue exists with the EAP-MSCHAPv2 module in all versions from 1.0.0 (where the module first appeared) to 1.1.0. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result in the server crashing

17293 CVE-2006-1354 2006-06-03 2006-06-08
squirrelmail -- plugin.php local file inclusion vulnerability squirrelmail 1.4.6_1

The SquirrelMail Project Team reports:

A security issue has been uncovered in functions/plugin.php that could allow a remote user to access local files on the server without requiring login. This issue manifests itself if register_globals is enabled, and magic_quotes_gpc is disabled.

http://www.squirrelmail.org/security/issue/2006-06-01 http://secunia.com/advisories/20406/ 2006-06-01 2006-06-05 2006-06-06
dokuwiki -- spellchecker remote PHP code execution dokuwiki 20060309_1

Stefan Esser reports:

During the evaluation of DokuWiki for a german/korean wiki of mine a flaw in DokuWiki's spellchecker was discovered, that allows injecting arbitrary PHP commands, by requesting a spellcheck on PHP commands in 'complex curly syntax'.

Because the spellchecker is written as part of the AJAX functionality of DokuWiki, it can be directly called by any website visitor, without the need for a wiki account.

http://www.hardened-php.net/advisory_042006.119.html http://bugs.splitbrain.org/index.php?do=details&id=823 http://secunia.com/advisories/20429/ 2006-06-05 2006-06-05
drupal -- multiple vulnerabilities drupal 4.6.7

The Drupal team reports:

Vulnerability: SQL injection

A security vulnerability in the database layer allowed certain queries to be submitted to the database without going through Drupal's query sanitizer.

Vulnerability: Execution of arbitrary files

Certain -- alas, typical -- configurations of Apache allows execution of carefully named arbitrary scripts in the files directory. Drupal now will attempt to automatically create a .htaccess file in your "files" directory to protect you.

CVE-2006-2742 CVE-2006-2743 http://drupal.org/node/65357 http://drupal.org/node/65409 2006-05-18 2006-06-05
MySQL -- SQL-injection security vulnerability mysql-server 5.15.1.9 5.05.0.22 4.14.1.20

MySQL reports:

An SQL-injection security hole has been found in multibyte encoding processing. An SQL-injection security hole can include a situation whereby when inserting user supplied data into a database, the user might inject his own SQL statements that the server will execute. With regards to this vulnerability discovered, when character set unaware escaping is used (e.g., addslashes() in PHP), it is possible to bypass it in some multibyte character sets (e.g., SJIS, BIG5 and GBK). As a result, a function like addslashes() is not able to prevent SQL injection attacks. It is impossible to fix this on the server side. The best solution is for applications to use character set aware escaping offered in a function like mysql_real_escape().

Workarounds:

One can use NO_BACKSLASH_ESCAPES mode as a workaround for a bug in mysql_real_escape_string(), if you cannot upgrade your server for some reason. It will enable SQL standard compatibility mode, where backslash is not considered a special character.

http://lists.mysql.com/announce/364 http://lists.mysql.com/announce/365 2006-05-31 2006-06-01
MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities mysql-server 4.04.0.27 4.14.1.19 5.15.1.9

Secunia reports:

MySQL have some vulnerabilities, which can be exploited by malicious users to disclose potentially sensitive information and compromise a vulnerable system.

1) An error within the code that generates an error response to an invalid COM_TABLE_DUMP packet can be exploited by an authenticated client to disclosure certain memory content of the server process.

2) A boundary error within the handling of specially crafted invalid COM_TABLE_DUMP packets can be exploited by an authenticated client to cause a buffer overflow and allows arbitrary code execution.

3) An error within the handling of malformed login packets can be exploited to disclosure certain memory content of the server process in the error messages.

CVE-2006-1516 CVE-2006-1517 CVE-2006-1518 602457 http://www.wisec.it/vulns.php?page=7 http://www.wisec.it/vulns.php?page=8 http://dev.mysql.com/doc/refman/4.1/en/news-4-0-27.html http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html http://dev.mysql.com/doc/refman/5.1/en/news-5-1-10.html http://secunia.com/advisories/19929/ http://www.vuxml.org/freebsd/a8d8713e-dc83-11da-a22b-000c6ec775d9.html 2006-05-02 2006-06-01
frontpage -- cross site scripting vulnerability frontpage mod_frontpage13 mod_frontpage20 mod_frontpage21 mod_frontpage22 5.0.2.4803

Esteban Martinez Fayo reports:

The FrontPage Server Extensions 2002 (included in Windows Sever 2003 IIS 6.0 and available as a separate download for Windows 2000 and XP) has a web page /_vti_bin/_vti_adm/fpadmdll.dll that is used for administrative purposes. This web page is vulnerable to cross site scripting attacks allowing an attacker to run client-side script on behalf of an FPSE user. If the victim is an administrator, the attacker could take complete control of a Front Page Server Extensions 2002 server.

To exploit the vulnerability an attacker can send a specially crafted e-mail message to a FPSE user and then persuade the user to click a link in the e-mail message.

In addition, this vulnerability can be exploited if an attacker hosts a malicious website and persuade the user to visit it.

CVE-2006-0015 http://marc.theaimsgroup.com/?l=bugtraq&m=114487846329000 http://www.microsoft.com/technet/security/bulletin/MS06-017.mspx http://www.rtr.com/fpsupport/fpse_release_may_2_2006.htm 2006-04-12 2006-05-23
cscope -- buffer overflow vulnerabilities cscope 15.5_2

Jason Duell reports:

Cscope contains an alarming number of buffer overflow vulnerabilities. By a rough count, there are at least 48 places where we blindly sprintf() a file name into a fixed-length buffer of size PATHLEN without checking to see if the file's name is <= PATHLEN. We do similar things with environment variable values.

CVE-2004-2541 http://sourceforge.net/tracker/index.php?func=detail&aid=1064875&group_id=4664&atid=104664 http://secunia.com/advisories/13237 2004-11-11 2006-05-23
coppermine -- Multiple File Extensions Vulnerability coppermine 1.4.6

Secunia reports:

Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to an error in the handling of file uploads where a filename has multiple file extensions. This can be exploited to upload malicious script files inside the web root (e.g. a PHP script).

Successful exploitation may allow execution of script code depending on the HTTP server configuration (it requires e.g. an Apache server with the "mod_mime" module installed).

http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=418266 http://secunia.com/advisories/20211/ 2006-05-22 2006-05-22
coppermine -- "file" Local File Inclusion Vulnerability coppermine 1.4.5

Secunia reports:

Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "file" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

Example: http://[host]/index.php?file=.//././/././/././/./[file]%00

Successful exploitation requires that "magic_quotes_gpc" is disabled.

CVE-2006-1909 http://coppermine-gallery.net/forum/index.php?topic=30655.0 http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html http://secunia.com/advisories/19665/ 2006-04-19 2006-05-22
coppermine -- File Inclusion Vulnerabilities coppermine 1.4.4

Secunia reports:

Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious people and by malicious users to compromise a vulnerable system.

1) Input passed to the "lang" parameter in include/init.inc.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources. The vulnerability can be further exploited by users who are allowed to upload image files to execute arbitrary PHP code.

2) Input passed to the "f" parameter in docs/showdoc.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources on the Windows platform, and remote files from Windows shared folders.

CVE-2006-0872 CVE-2006-0873 http://retrogod.altervista.org/cpg_143_adv.html http://secunia.com/advisories/18941/ 2006-02-20 2006-05-22
phpmyadmin -- XSRF vulnerabilities phpMyAdmin 2.8.1

phpMyAdmin security team reports:

It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link.

Such issue is quite common in many PHP applications and users should take care what links they follow. We consider these vulnerabilities to be quite dangerous.

CVE-2006-1804 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3 http://secunia.com/advisories/19659 2006-05-20 2006-05-21
vnc - authentication bypass vulnerability vnc 4.1.1

RealVNC is susceptible to an authentication-bypass vulnerability. A malicious VNC client can cause a VNC server to allow it to connect without any authentication regardless of the authentication settings configured in the server. Exploiting this issue allows attackers to gain unauthenticated, remote access to the VNC servers.

17978 http://www.securityfocus.com/archive/1/433994/30/0/threaded 2006-05-15 2006-05-18
phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities phpldapadmin098 0.9.8.3

Secunia reports:

phpLDAPadmin have some vulnerabilities, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks.

1) Some input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed to the "Container DN", "Machine Name", and "UID Number" parameters in "template_engine.php" isn't properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious user data is viewed.

CVE-2006-2016 http://pridels.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html http://www.frsirt.com/english/advisories/2006/1450 http://secunia.com/advisories/19747/ 2006-04-21 2006-05-14
fswiki -- XSS vulnerability fswiki 3.5.11

JVN reports:

FreeStyleWiki has XSS vulnerability.

http://jvn.jp/jp/JVN%2335274905/ 2006-04-18 2006-05-06
mysql50-server -- COM_TABLE_DUMP arbitrary code execution mysql-server 5.05.0.21

Stefano Di Paola reports:

An authenticated user could remotely execute arbitrary commands by taking advantage of a stack overflow.

To take advantage of these flaws an attacker should have direct access to MySQL server communication layer (port 3306 or unix socket). But if used in conjuction with some web application flaws (i.e. php code injection) an attacker could use socket programming (i.e. php sockets) to gain access to that layer.

CVE-2006-1518 http://www.wisec.it/vulns.php?page=8 http://marc.theaimsgroup.com/?l=bugtraq&m=114659633220473 http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html 2006-05-02 2006-05-06
awstats -- arbitrary command execution vulnerability awstats 6.5_2,1

OS Reviews reports:

If the update of the stats via web front-end is allowed, a remote attacker can execute arbitrary code on the server using a specially crafted request involving the migrate parameter. Input starting with a pipe character ("|") leads to an insecure call to Perl's open function and the rest of the input being executed in a shell. The code is run in the context of the process running the AWStats CGI.

Arbitrary code can be executed by uploading a specially crafted configuration file if an attacker can put a file on the server with chosen file name and content (e.g. by using an FTP account on a shared hosting server). In this configuration file, the LogFile directive can be used to execute shell code following a pipe character. As above, an open call on unsanitized input is the source of this vulnerability.

http://awstats.sourceforge.net/awstats_security_news.php http://secunia.com/advisories/19969/ http://www.osreviews.net/reviews/comm/awstats 2006-05-03 2006-05-05 2006-11-15
phpwebftp -- "language" Local File Inclusion phpwebftp 3.3

Secunia reports:

phpWebFTP have a vulnerability, which can be exploited by malicious people to disclose sensitive information.

Input passed to to the "language" parameter in index.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

CVE-2006-1812 CVE-2006-1813 https://sourceforge.net/forum/forum.php?forum_id=566199 http://secunia.com/advisories/19706/ 2006-04-18 2006-05-03
firefox -- denial of service vulnerability firefox 1.5.*,11.5.0.3,1 linux-firefox 1.5.0.3

A Mozilla Foundation Security Advisory reports for deleted object reference when designMode="on"

Martijn Wargers and Nick Mott each described crashes that were discovered to ultimately stem from the same root cause: attempting to use a deleted controller context when designMode was turned on. This generally results in crashing the browser, but in theory references to deleted objects can be abused to run malicious code.

"splices" reported the same crash at the fan site MozillaZine and on Bugtraq, incorrectly describing it as a buffer overflow.

CVE-2006-1993 http://www.mozilla.org/security/announce/2006/mfsa2006-30.html 2006-05-02 2006-05-03 2006-05-05
trac -- Wiki Macro Script Insertion Vulnerability trac ja-trac 0.9.5

Secunia reports:

A vulnerability has been reported, which can be exploited by malicious people to conduct script insertion attacks.

Input passed using the wiki macro isn't properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious user data is viewed.

http://projects.edgewall.com/trac/wiki/ChangeLog http://jvn.jp/jp/JVN%2384091359/index.html http://secunia.com/advisories/19870/ 2006-04-28 2006-05-02
clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability clamav 0.800.88.2 clamav-devel 2004082620060502

Secunia reports:

A vulnerability has been reported in ClamAV, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the HTTP client in the Freshclam command line utility. This can be exploited to cause a stack-based buffer overflow when the HTTP headers received from a web server exceeds 8KB.

Successful exploitation requires that Freshclam is used to download virus signature updates from a malicious mirror web server e.g. via DNS poisoning.

CVE-2006-1989 http://www.clamav.net/security/0.88.2.html http://secunia.com/advisories/19880/ 2006-05-01 2006-05-03
jabberd -- SASL Negotiation Denial of Service Vulnerability jabberd 2.0.11

Secunia reports:

A vulnerability has been reported in jabberd, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the handling of SASL negotiation. This can be exploited to cause a crash by sending a "response" stanza before an "auth" stanza.

CVE-2006-1329 http://article.gmane.org/gmane.network.jabber.admin/27372 http://jabberstudio.org/projects/jabberd2/releases/view.php?id=826 http://secunia.com/advisories/19281/ 2006-03-20 2006-05-01
cacti -- ADOdb "server.php" Insecure Test Script Security Issue cacti 0.8.6h

Secunia reports:

Cacti have a security issue, which can be exploited by malicious people to execute arbitrary SQL code and potentially compromise a vulnerable system.

The problem is caused due to the presence of the insecure "server.php" test script.

http://secunia.com/advisories/18276/ http://secunia.com/advisories/17418/ 2006-01-09 2006-04-27
amaya -- Attribute Value Buffer Overflow Vulnerabilities amaya 9.5

Secunia reports:

Amaya have two vulnerabilities, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors within the parsing of various attribute values. This can be exploited to cause stack-based buffer overflows when a user opens a specially crafted HTML document containing certain tags with overly long attribute values.

Successful exploitation allows execution of arbitrary code.

CVE-2006-1900 http://morph3us.org/advisories/20060412-amaya-94.txt http://morph3us.org/advisories/20060412-amaya-94-2.txt http://secunia.com/advisories/19670/ 2006-04-14 2006-04-27
lifetype -- ADOdb "server.php" Insecure Test Script Security Issue lifetype 1.0.3

Secunia reports:

A security issue has been discovered in LifeType, which can be exploited by malicious people to execute arbitrary SQL code and potentially compromise a vulnerable system.

The problem is caused due to the presence of the insecure "server.php" test script.

CVE-2006-0146 http://secunia.com/advisories/19699/ http://secunia.com/advisories/17418/ 2006-04-19 2006-04-27
ethereal -- Multiple Protocol Dissector Vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.8.50.99.0

Secunia reports:

Multiple vulnerabilities have been reported in Ethereal, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

The vulnerabilities are caused due to various types of errors including boundary errors, an off-by-one error, an infinite loop error, and several unspecified errors in a multitude of protocol dissectors.

Successful exploitation causes Ethereal to stop responding, consume a large amount of system resources, crash, or execute arbitrary code.

CVE-2006-1932 CVE-2006-1933 CVE-2006-1934 CVE-2006-1935 CVE-2006-1936 CVE-2006-1937 CVE-2006-1938 CVE-2006-1939 CVE-2006-1940 http://www.ethereal.com/appnotes/enpa-sa-00023.html http://secunia.com/advisories/19769/ 2006-04-25 2006-04-27
asterisk -- denial of service vulnerability, local system access asterisk 1.2.7

Emmanouel Kellenis reports a denial of service vulnerability within asterisk. The vulnerability is caused by a buffer overflow in "format_jpeg.c". A large JPEG image could trigger this bug, potentially allowing a local attacker to execute arbitrary code.

17561 CVE-2006-1827 http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory 2006-04-07 2006-04-25
zgv, xzgv -- heap overflow vulnerability zgv 5.9_1 xzgv 0

Gentoo reports:

Andrea Barisani of Gentoo Linux discovered xzgv and zgv allocate insufficient memory when rendering images with more than 3 output components, such as images using the YCCK or CMYK colour space. When xzgv or zgv attempt to render the image, data from the image overruns a heap allocated buffer.

An attacker may be able to construct a malicious image that executes arbitrary code with the permissions of the xzgv or zgv user when attempting to render the image.

17409 CVE-2006-1060 http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml 2006-04-21 2006-04-23 2006-10-09
crossfire-server -- denial of service and remote code execution vulnerability crossfire-server 1.9.0

FRSIRT reports:

A vulnerability has been identified in CrossFire, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service. This flaw is due to a buffer overflow error in the "oldsocketmode" module that fails to properly handle overly large requests, which could be exploited by a malicious client to crash or compromise a vulnerable system.

16883 CVE-2006-1010 http://www.frsirt.com/english/advisories/2006/0760 2006-02-28 2006-04-23
p5-DBI -- insecure temporary file creation vulnerability p5-DBI-137 0 p5-DBI 1.37_1 1.381.48

Javier Fernández-Sanguino Peña reports:

The DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library.

12360 CAN-2005-0077 http://www.debian.org/security/2005/dsa-658 2005-01-25 2006-04-23 2006-05-11
wordpress -- full path disclosure wordpress 1.5.2

Dedi Dwianto reports:

A remote user can access the file directly to cause the system to display an error message that indicates the installation path. The resulting error message will disclose potentially sensitive installation path information to the remote attacker.

CVE-2005-4463 http://echo.or.id/adv/adv24-theday-2005.txt 2005-12-20 2006-04-23
xine -- multiple remote string vulnerabilities xine 0.99.4_4

c0ntexb reports:

There are 2 format string bugs in the latest version of Xine that could be exploited by a malicious person to execute code on the system of a remote user running the media player against a malicious playlist file. By passing a format specifier in the path of a file that is embedded in a remote playlist, it is possible to trigger this bug.

17579 CVE-2006-1905 http://www.open-security.org/advisories/16 2006-04-18 2006-04-23
cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service cyrus-sasl 2.*2.1.21

Unspecified vulnerability in the CMU Cyrus Simple Authentication and Security Layer (SASL) library, has unknown impact and remote unauthenticated attack vectors, related to DIGEST-MD5 negotiation.

CVE-2006-1721 2006-04-11 2006-04-22
FreeBSD -- FPU information disclosure FreeBSD 6.06.0_7 5.45.4_14 5.35.3_29 55.3 4.114.11_17 4.104.10_23 4.10

Problem Description

On "7th generation" and "8th generation" processors manufactured by AMD, including the AMD Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, and Sempron, the fxsave and fxrstor instructions do not save and restore the FOP, FIP, and FDP registers unless the exception summary bit (ES) in the x87 status word is set to 1, indicating that an unmasked x87 exception has occurred.

This behaviour is consistent with documentation provided by AMD, but is different from processors from other vendors, which save and restore the FOP, FIP, and FDP registers regardless of the value of the ES bit. As a result of this discrepancy remaining unnoticed until now, the FreeBSD kernel does not restore the contents of the FOP, FIP, and FDP registers between context switches.

Impact

On affected processors, a local attacker can monitor the execution path of a process which uses floating-point operations. This may allow an attacker to steal cryptographic keys or other sensitive information.

Workaround

No workaround is available, but systems which do not use AMD Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, or Sempron processors are not vulnerable.

CVE-2006-1056 SA-06:14.fpu 2006-04-19 2006-04-19 2006-06-09
plone -- "member_id" Parameter Portrait Manipulation Vulnerability plone 2.1.2_1

Secunia reports:

The vulnerability is caused due to missing security declarations in "changeMemberPortrait" and "deletePersonalPortrait". This can be exploited to manipulate or delete another user's portrait via the "member_id" parameter.

CVE-2006-1711 http://dev.plone.org/plone/ticket/5432 http://www.debian.org/security/2006/dsa-1032 http://secunia.com/advisories/19633/ 2006-04-13 2006-04-18
mozilla -- multiple vulnerabilities firefox 1.0.8,1 1.5.*,11.5.0.2,1 linux-firefox 1.5.0.2 mozilla 1.7.13,2 1.8.*,2 linux-mozilla 1.7.13 linux-mozilla-devel 0 seamonkey linux-seamonkey 1.0.1 thunderbird mozilla-thunderbird 1.5.0.2

A Mozilla Foundation Security Advisory reports of multiple issues. Several of which can be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2006-29 Spoofing with translucent windows
  • MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented
  • MFSA 2006-26 Mail Multiple Information Disclosure
  • MFSA 2006-25 Privilege escalation through Print Preview
  • MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest
  • MFSA 2006-23 File stealing by changing input type
  • MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability
  • MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)
  • MFSA 2006-19 Cross-site scripting using .valueOf.call()
  • MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability
  • MFSA 2006-17 cross-site scripting through window.controllers
  • MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()
  • MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent
  • MFSA 2006-14 Privilege escalation via XBL.method.eval
  • MFSA 2006-13 Downloading executables with "Save Image As..."
  • MFSA 2006-12 Secure-site spoof (requires security warning dialog)
  • MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)
  • MFSA 2006-10 JavaScript garbage-collection hazard audit
  • MFSA 2006-09 Cross-site JavaScript injection using event handlers
179014 252324 329500 350262 488774 736934 813230 842094 932734 935556 968814 CVE-2006-0749 CVE-2006-1045 CVE-2006-1529 CVE-2006-1530 CVE-2006-1531 CVE-2006-1723 CVE-2006-1724 CVE-2006-1725 CVE-2006-1726 CVE-2006-1727 CVE-2006-1728 CVE-2006-1729 CVE-2006-1730 CVE-2006-1731 CVE-2006-1732 CVE-2006-1733 CVE-2006-1734 CVE-2006-1735 CVE-2006-1736 CVE-2006-1737 CVE-2006-1738 CVE-2006-1739 CVE-2006-1740 CVE-2006-1741 CVE-2006-1742 CVE-2006-1790 http://www.mozilla.org/security/announce/2006/mfsa2006-09.html http://www.mozilla.org/security/announce/2006/mfsa2006-10.html http://www.mozilla.org/security/announce/2006/mfsa2006-11.html http://www.mozilla.org/security/announce/2006/mfsa2006-12.html http://www.mozilla.org/security/announce/2006/mfsa2006-13.html http://www.mozilla.org/security/announce/2006/mfsa2006-14.html http://www.mozilla.org/security/announce/2006/mfsa2006-15.html http://www.mozilla.org/security/announce/2006/mfsa2006-16.html http://www.mozilla.org/security/announce/2006/mfsa2006-17.html http://www.mozilla.org/security/announce/2006/mfsa2006-18.html http://www.mozilla.org/security/announce/2006/mfsa2006-19.html http://www.mozilla.org/security/announce/2006/mfsa2006-20.html http://www.mozilla.org/security/announce/2006/mfsa2006-22.html http://www.mozilla.org/security/announce/2006/mfsa2006-23.html http://www.mozilla.org/security/announce/2006/mfsa2006-25.html http://www.mozilla.org/security/announce/2006/mfsa2006-26.html http://www.mozilla.org/security/announce/2006/mfsa2006-28.html http://www.mozilla.org/security/announce/2006/mfsa2006-29.html http://www.zerodayinitiative.com/advisories/ZDI-06-010.html TA06-107A 2006-04-13 2006-04-16 2006-04-27
mailman -- Private Archive Script Cross-Site Scripting mailman ja-mailman mailman-with-htdig 2.1.8

Secunia reports:

A vulnerability has been reported in Mailman, which can be exploited by malicious people to conduct cross-site scripting attacks.

Unspecified input passed to the private archive script is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

CVE-2006-1712 http://mail.python.org/pipermail/mailman-announce/2006-April/000084.html http://secunia.com/advisories/19558/ 2006-04-07 2006-04-16
f2c -- insecure temporary files f2c 20060506

Javier Fernández-Sanguino Peña reports two temporary file vulnerability within f2c. The vulnerabilities are caused due to weak temporary file handling. An attacker could create an symbolic link, causing a local user running f2c to overwrite the symlinked file. This could give the attacker elevated privileges.

1280 CAN-2005-0017 2005-01-27 2006-04-10 2006-08-15
mplayer -- Multiple integer overflows mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.7_12

Secunia reports:

The vulnerabilities are caused due to integer overflow errors in "libmpdemux/asfheader.c" within the handling of an ASF file, and in "libmpdemux/aviheader.c" when parsing the "indx" chunk in an AVI file. This can be exploited to cause heap-based buffer overflows via a malicious ASF file, or via a AVI file with specially-crafted "wLongsPerEntry" and "nEntriesInUse" values in the "indx" chunk.

CVE-2006-1502 http://www.xfocus.org/advisories/200603/11.html http://secunia.com/advisories/19418/ 2006-03-29 2006-04-07
kaffeine -- buffer overflow vulnerability kaffeine 0.4.20.8.0

The KDE team reports:

Kaffeine can produce a buffer overflow in http_peek() while creating HTTP request headers for fetching remote playlists, which under certain circumstances could be used to crash the application and/or execute arbitrary code.

17372 CVE-2006-0051 http://www.kde.org/info/security/advisory-20060404-1.txt 2006-04-04 2006-04-07
thunderbird -- javascript execution thunderbird mozilla-thunderbird 1.0.7

Renaud Lifchitz reports a vulnerability within thunderbird. The vulnerability is caused by improper checking of javascript scripts. This could lead to javascript code execution which can lead to information disclosure or a denial of service (application crash). This vulnerability is present even if javascript had been disabled in the preferences.

16770 CAN-2006-0884 2006-02-22 2006-04-07
phpmyadmin -- XSS vulnerabilities phpMyAdmin 2.8.0.3

phpMyAdmin security announcement:

It was possible to conduct an XSS attack with a direct call to some scripts under the themes directory.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1 http://secunia.com/advisories/19556/ 2006-04-06 2006-04-06 2006-04-07
phpmyadmin -- 'set_theme' Cross-Site Scripting phpMyAdmin 2.8.0.2

Secunia reports:

A vulnerability has been reported in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "set_theme" parameter isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

CVE-2006-1258 http://secunia.com/advisories/19277 2006-03-17 2006-04-06
clamav -- Multiple Vulnerabilities clamav 0.88.1 clamav-devel 20051104_1

Secunia reports:

Some vulnerabilities have been reported in ClamAV, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.

An unspecified integer overflow error exists in the PE header parser in "libclamav/pe.c". Successful exploitation requires that the ArchiveMaxFileSize option is disabled.

Some format string errors in the logging handling in "shared/output.c" may be exploited to execute arbitrary code.

An out-of-bounds memory access error in the "cli_bitset_test()" function in "ibclamav/others.c" may be exploited to cause a crash.

CVE-2006-1614 CVE-2006-1615 CVE-2006-1630 http://secunia.com/advisories/19534/ http://www.us.debian.org/security/2006/dsa-1024 2006-04-06 2006-04-06
mediawiki -- hardcoded placeholder string security bypass vulnerability mediawiki 1.5.4

The mediawiki development team reports a vulnerability within the mediawiki application. The vulnerability is caused by improper checking of inline style attributes. This could result in the execution of arbitrary javascript code in Microsoft Internet Explorer. It appears that other browsers are not affected by this vulnerability.

16032 CAN-2005-4501 http://sourceforge.net/project/shownotes.php?release_id=379951 2005-12-22 2006-04-05
netpbm -- buffer overflow in pnmtopng netpbm 10.26

Ubuntu reports:

A buffer overflow was found in the "pnmtopng" conversion program. By tricking an user (or automated system) to process a specially crafted PNM image with pnmtopng, this could be exploited to execute arbitrary code with the privileges of the user running pnmtopng.

15128 CAN-2005-2978 http://www.ubuntulinux.org/support/documentation/usn/usn-210-1 2005-10-18 2006-04-05
zoo -- stack based buffer overflow zoo 2.10.1_2

Jean-Sébastien Guay-Leroux report a vulnerability within the zoo archiver. The vulnerability which is present in the fullpath() function (from the misc.c file) is caused by improper checking of user supplied data. The data returned to the buffer can be up to 512 bytes, while the buffer is created to hold 256 bytes. This could result in a buffer overflow which could allow remote code execution.

16790 CVE-2006-0855 http://www.guay-leroux.com/projects/zoo-advisory.txt 2006-02-22 2006-04-05 2006-04-06
mediawiki -- cross site scripting vulnerability mediawiki 1.41.4.14 1.51.5.7

The mediawiki development team reports that there is an site scripting vulnerability within mediawiki. The vulnerability is caused by improper checking of encoded links which could allow the injection of html in the output generated by mediawiki. This could lead to cross site scripting attacks against mediawiki installations.

17269 CVE-2006-1498 http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-March/000040.html 2006-03-27 2006-04-05
dia -- XFig Import Plugin Buffer Overflow dia dia-gnome 0.86_10.94_6,1

Secunia reports:

Some vulnerabilities have been reported in Dia, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors within the XFig import plugin. This can be exploited to cause buffer overflows and may allow arbitrary code execution when a specially-crafted FIG file is imported.

CVE-2006-1550 http://secunia.com/advisories/19469/ http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html 2006-03-31 2006-04-05
openvpn -- LD_PRELOAD code execution on client through malicious or compromised server openvpn 2.02.0.6

Hendrik Weimer reports:

OpenVPN clients are a bit too generous when accepting configuration options from a server. It is possible to transmit environment variables to client-side shell scripts. There are some filters in place to prevent obvious nonsense, however they don't catch the good old LD_PRELOAD trick. All we need is to put a file onto the client under a known location (e.g. by returning a specially crafted document upon web access) and we have a remote root exploit. But since the attack may only come from authenticated servers, this threat is greatly reduced.

CVE-2006-1629 http://www.osreviews.net/reviews/security/openvpn-print http://openvpn.net/changelog.html http://sourceforge.net/mailarchive/message.php?msg_id=15298074 2006-04-03 2006-04-05 2006-04-06
samba -- Exposure of machine account credentials in winbind log files samba 3.0.21a,13.0.22,1 ja-samba 3.0.21a,13.0.22,1

Samba Security Advisory:

The machine trust account password is the secret shared between a domain controller and a specific member server. Access to the member server machine credentials allows an attacker to impersonate the server in the domain and gain access to additional information regarding domain users and groups.

The winbindd daemon writes the clear text of server's machine credentials to its log file at level 5. The winbindd log files are world readable by default and often log files are requested on open mailing lists as tools used to debug server misconfigurations.

This affects servers configured to use domain or ads security and possibly Samba domain controllers as well (if configured to use winbindd).

CVE-2006-1059 http://us1.samba.org/samba/security/CAN-2006-1059.html http://secunia.com/advisories/19455/ 2006-03-30 2006-04-05
mod_pubcookie -- cross site scripting vulnerability mod_pubcookie 3.3.0

Nathan Dors of the Pubcookie Project reports:

Non-persistent XSS vulnerabilities were found in the Pubcookie Apache module (mod_pubcookie) and ISAPI filter. These components mishandle untrusted data when printing responses to the browser. This makes them vulnerable to carefully crafted requests containing script or HTML. If an attacker can lure an unsuspecting user to visit carefully staged content, the attacker can use it to redirect the user to a vulnerable Pubcookie application server and attempt to exploit the XSS vulnerabilities.

These vulnerabilities are classified as *high* due to the nature and purpose of Pubcookie application servers for user authentication and Web Single Sign-on (SSO). An attacker who injects malicious script through the vulnerabilities might steal private Pubcookie data including a user's authentication assertion ("granting") cookies and application session cookies.

314540 2006-03-06 2006-04-05
pubcookie-login-server -- cross site scripting vulnerability pubcookie-login-server 3.3.0

Nathan Dors of the Pubcookie Project reports:

Multiple non-persistent XSS vulnerabilities were found in the Pubcookie login server's compiled binary "index.cgi" CGI program. The CGI program mishandles untrusted data when printing responses to the browser. This makes the program vulnerable to carefully crafted requests containing script or HTML. If an attacker can lure an unsuspecting user to visit carefully staged content, the attacker can use it to redirect the user to his or her local Pubcookie login page and attempt to exploit the XSS vulnerabilities.

These vulnerabilities are classified as *critical* due to the nature and purpose of the Pubcookie login server for user authentication and Web Single Sign-on (SSO). Specific threats include:

  • An attacker who injects malicious script through the vulnerabilities might steal senstive user data including a user's authentication credentials (usernames and passwords);
  • An attacker who injects malicious script through the vulnerabilities might steal private Pubcookie data including a user's authentication assertion ("granting") cookies and SSO ("login") session cookies;
  • An attacker who injects HTML tags through the vulnerabilities might deface a site's Pubcookie login page for a single visit by a single user (i.e. a non-persistent defacement).

At the heart of these threats lies a violation of the user's trust in the Pubcookie login server.

337585 2006-03-06 2006-04-05
freeradius -- EAP-MSCHAPv2 Authentication Bypass freeradius 1.0.01.1.1

Freeradius Security Contact reports:

Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result in the server crashing.

CVE-2006-1354 http://www.freeradius.org/security.html#1.1.0 http://secunia.com/advisories/19300/ 2006-03-21 2006-03-29
horde -- remote code execution vulnerability in the help viewer horde horde-php5 3.1.1

Horde 3.1.1 release announcement:

Major changes compared to Horde 3.1 are:

  • Fix for remote code execution vulnerability in the help viewer, discovered by Jan Schneider from the Horde team.
17292 CVE-2006-1491 http://lists.horde.org/archives/announce/2006/000271.html 2006-03-28 2006-03-28 2006-03-30
linux-realplayer -- buffer overrun linux-realplayer 10.0.110.0.7.785.20060201

Secunia Advisories Reports:

A boundary error when processing SWF files can be exploited to cause a buffer overflow. This may allow execution of arbitrary code on the user's system.

CVE-2006-0323 http://service.real.com/realplayer/security/03162006_player/en/ http://secunia.com/advisories/19358/ 2006-03-23 2006-03-27
linux-realplayer -- heap overflow linux-realplayer 10.0.110.0.6

iDefense Reports:

Remote exploitation of a heap-based buffer overflow in RealNetwork Inc's RealPlayer could allow the execution of arbitrary code in the context of the currently logged in user.

In order to exploit this vulnerability, an attacker would need to entice a user to follow a link to a malicious server. Once the user visits a website under the control of an attacker, it is possible in a default install of RealPlayer to force a web-browser to use RealPlayer to connect to an arbitrary server, even when it is not the default application for handling those types, by the use of embedded object tags in a webpage. This may allow automated exploitation when the page is viewed.

CVE-2005-2922 http://service.real.com/realplayer/security/03162006_player/en/ http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404 http://secunia.com/advisories/19358/ 2006-03-23 2006-03-27
sendmail -- race condition vulnerability sendmail 8.138.13.6 FreeBSD 6.06.0_6 5.45.4_13 5.35.3_28 4.114.11_16 4.104.10_22

Problem Description

A race condition has been reported to exist in the handling by sendmail of asynchronous signals.

Impact

A remote attacker may be able to execute arbitrary code with the privileges of the user running sendmail, typically root.

Workaround

There is no known workaround other than disabling sendmail.

CVE-2006-0058 SA-06:13.sendmail 2006-03-22 2006-03-24 2006-06-09
OPIE -- arbitrary password change FreeBSD 6.06.0_6 5.45.4_13 5.35.3_28 4.114.11_16 4.104.10_22

Problem Description

The opiepasswd(1) program uses getlogin(2) to identify the user calling opiepasswd(1). In some circumstances getlogin(2) will return "root" even when running as an unprivileged user. This causes opiepasswd(1) to allow an unpriviled user to configure OPIE authentication for the root user.

Impact

In certain cases an attacker able to run commands as a non privileged users which have not explicitly logged in, for example CGI scripts run by a web server, is able to configure OPIE access for the root user. If the attacker is able to authenticate as root using OPIE authentication, for example if "PermitRootLogin" is set to "yes" in sshd_config or the attacker has access to a local user in the "wheel" group, the attacker can gain root privileges.

Workaround

Disable OPIE authentication in PAM:

# sed -i "" -e /opie/s/^/#/ /etc/pam.d/*

or

Remove the setuid bit from opiepasswd:

# chflags noschg /usr/bin/opiepasswd
# chmod 555 /usr/bin/opiepasswd
# chflags schg /usr/bin/opiepasswd
CVE-2006-1283 SA-06:12.opie 2006-03-22 2006-03-24 2006-06-09
ipsec -- reply attack vulnerability FreeBSD 6.06.0_6 5.45.4_13 5.35.3_28 4.114.11_16 4.104.10_22

Problem Description

IPsec provides an anti-replay service which when enabled prevents an attacker from successfully executing a replay attack. This is done through the verification of sequence numbers. A programming error in the fast_ipsec(4) implementation results in the sequence number associated with a Security Association not being updated, allowing packets to unconditionally pass sequence number verification checks.

Impact

An attacker able to to intercept IPSec packets can replay them. If higher level protocols which do not provide any protection against packet replays (e.g., UDP) are used, this may have a variety of effects.

Workaround

No workaround is available.

CVE-2006-0905 SA-06:11.ipsec 2006-03-22 2006-03-24 2006-06-09
xorg-server -- privilege escalation xorg-server 6.9.0

Daniel Stone of X.Org reports:

During the analysis of results from the Coverity code review of X.Org, we discovered a flaw in the server that allows local users to execute arbitrary code with root privileges, or cause a denial of service by overwriting files on the system, again with root privileges.

CVE-2006-0745 https://bugs.freedesktop.org/show_bug.cgi?id=6213 2006-03-20 2006-03-21
heimdal -- Multiple vulnerabilities heimdal 0.6.6

A Project heimdal Security Advisory reports:

The telnet client program in Heimdal has buffer overflows in the functions slc_add_reply() and env_opt_add(), which may lead to remote code execution.

The telnetd server program in Heimdal has buffer overflows in the function getterminaltype, which may lead to remote code execution.

The rshd server in Heimdal has a privilege escalation bug when storing forwarded credentials. The code allowes a user to overwrite a file with its credential cache, and get ownership of the file.

CVE-2005-0469 CVE-2005-2040 CVE-2006-0582 CVE-2006-0677 http://www.pdc.kth.se/heimdal/advisory/2005-04-20 http://www.pdc.kth.se/heimdal/advisory/2005-06-20 http://www.pdc.kth.se/heimdal/advisory/2006-02-06 2006-02-06 2006-03-20
curl -- TFTP packet buffer overflow vulnerability curl linux-curl 7.14.17.15.3

A Project cURL Security Advisory reports:

libcurl uses the given file part of a TFTP URL in a manner that allows a malicious user to overflow a heap-based memory buffer due to the lack of boundary check.

This overflow happens if you pass in a URL with a TFTP protocol prefix ("tftp://"), using a valid host and a path part that is longer than 512 bytes.

The affected flaw can be triggered by a redirect, if curl/libcurl is told to follow redirects and an HTTP server points the client to a tftp URL with the characteristics described above.

CVE-2006-1061 http://curl.haxx.se/docs/adv_20060320.html 2006-03-20 2006-03-20 2006-10-05
drupal -- multiple vulnerabilities drupal 3.6.6

Drupal reports:

Mail header injection vulnerability.

Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email.

This could lead to Drupal sites being used to send unwanted email.

Session fixation vulnerability.

If someone creates a clever enough URL and convinces you to click on it, and you later log in but you do not log off then the attacker may be able to impersonate you.

XSS vulnerabilities.

Some user input sanity checking was missing. This could lead to possible cross-site scripting (XSS) attacks.

XSS can lead to user tracking and theft of accounts and services.

Security bypass in menu.module.

If you use menu.module to create a menu item, the page you point to will be accessible to all, even if it is an admin page.

http://drupal.org/node/53806 http://drupal.org/node/53805 http://drupal.org/node/53803 http://drupal.org/node/53796 2006-03-13 2006-03-17
horde -- "url" disclosure of sensitive information vulnerability horde horde-php5 3.1

Secunia advisory SA19246:

Paul Craig has discovered a vulnerability in Horde, which can be exploited by malicious people to disclose sensitive information. Input passed to the "url" parameter in "services/go.php" isn't properly verified, before it is used in a "readfile()" call. This can be exploited to disclose the content of arbitrary files via e.g. the "php://" protocol wrapper.

The vulnerability has been confirmed in version 3.0.9 and has also been reported in prior versions.

Provided and/or discovered by: Paul Craig, Security-Assessment.com.

http://secunia.com/advisories/19246/ 2006-03-15 2006-03-15
linux-flashplugin -- arbitrary code execution vulnerability linux-flashplugin 7.0r63

Adobe reports:

Critical vulnerabilities have been identified in Flash Player that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these vulnerabilities.

Flash Player 8 update (8.0.24.0), and Flash Player 7 update (7.0.63.0) address security vulnerabilities in previous versions of Flash Player, which could lead to the potential execution of arbitrary code. These vulnerabilities could be accessed through content delivered from a remote location via the users web browser, email client, or other applications that include or reference the Flash Player.

CVE-2006-0024 http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html 2006-03-14 2006-03-15
nfs -- remote denial of service FreeBSD 6.06.0_5 5.45.4_12 5.35.3_27 4.114.11_15 4.104.10_21

Problem description:

A part of the NFS server code charged with handling incoming RPC messages via TCP had an error which, when the server received a message with a zero-length payload, would cause a NULL pointer dereference which results in a kernel panic. The kernel will only process the RPC messages if a userland nfsd daemon is running.

Impact:

The NULL pointer deference allows a remote attacker capable of sending RPC messages to an affected FreeBSD system to crash the FreeBSD system.

Workaround:

  1. Disable the NFS server: set the nfs_server_enable variable to "NO" in /etc/rc.conf, and reboot.

    Alternatively, if there are no active NFS clients (as listed by the showmount(8) utility), simply killing the mountd and nfsd processes should suffice.

  2. Add firewall rules to block RPC traffic to the NFS server from untrusted hosts.

CVE-2006-0900 SA-06:10.nfs 2006-03-01 2006-03-12 2006-06-09
openssh -- remote denial of service FreeBSD 5.45.4_12 5.35.3_27

Problem description:

Because OpenSSH and OpenPAM have conflicting designs (one is event- driven while the other is callback-driven), it is necessary for OpenSSH to fork a child process to handle calls to the PAM framework. However, if the unprivileged child terminates while PAM authentication is under way, the parent process incorrectly believes that the PAM child also terminated. The parent process then terminates, and the PAM child is left behind.

Due to the way OpenSSH performs internal accounting, these orphaned PAM children are counted as pending connections by the master OpenSSH server process. Once a certain number of orphans has accumulated, the master decides that it is overloaded and stops accepting client connections.

Impact:

By repeatedly connecting to a vulnerable server, waiting for a password prompt, and closing the connection, an attacker can cause OpenSSH to stop accepting client connections until the system restarts or an administrator manually kills the orphaned PAM processes.

Workaround:

The following command will show a list of orphaned PAM processes:

# pgrep -lf 'sshd.*\[pam\]'

The following command will kill orphaned PAM processes:

# pkill -f 'sshd.*\[pam\]'

To prevent OpenSSH from leaving orphaned PAM processes behind, perform one of the following:

  1. Disable PAM authentication in OpenSSH. Users will still be able to log in using their Unix password, OPIE or SSH keys.

    To do this, execute the following commands as root:

    # echo 'UsePAM no' >>/etc/ssh/sshd_config
    # echo 'PasswordAuthentication yes' >>/etc/ssh/sshd_config
    # /etc/rc.d/sshd restart
  2. If disabling PAM is not an option - if, for instance, you use RADIUS authentication, or store user passwords in an SQL database - you may instead disable privilege separation. However, this may leave OpenSSH vulnerable to hitherto unknown bugs, and should be considered a last resort.

    To do this, execute the following commands as root:

    # echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config
    # /etc/rc.d/sshd restart
CVE-2006-0883 SA-06:09.openssh 2006-03-01 2006-03-12 2006-06-09
GnuPG does not detect injection of unsigned data gnupg 1.4.2.2

Werner Koch reports:

In the aftermath of the false positive signature verfication bug (announced 2006-02-15) more thorough testing of the fix has been done and another vulnerability has been detected. This new problem affects the use of *gpg* for verification of signatures which are _not_ detached signatures. The problem also affects verification of signatures embedded in encrypted messages; i.e. standard use of gpg for mails.

CVE-2006-0049 http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html 2006-03-09 2006-03-10 2006-03-11
mplayer -- heap overflow in the ASF demuxer mplayer mplayer-gtk mplayer-esound mplayer-gtk-esound 0.99.7_11

The Mplayer team reports:

A potential buffer overflow was found in the ASF demuxer. Arbitrary remote code execution is possible (under the user ID running the player) when streaming an ASF file from a malicious server or local code execution (under the user ID running the player) if a malicious ASF file is played locally.

CVE-2006-0579 http://www.mplayerhq.hu/design7/news.html#vuln13 http://secunia.com/advisories/18718 http://bugs.gentoo.org/show_bug.cgi?id=122029 2006-02-15 2006-03-09
SSH.COM SFTP server -- format string vulnerability ssh2 ssh2-nox11 3.2.9.1_5

SSH Communications Security Corp reports a format string vulnerability in their SFTP server. This vulnerability could cause a user with SCP/SFTP access only to get permission to execute also other commands. It could also allow user A to create a special file that when accessed by user B allows user A to execute commands as user B.

CVE-2006-0705 16640 http://www.ssh.com/company/newsroom/article/715/ http://www.frsirt.com/english/advisories/2006/0554 http://securitytracker.com/id?1015619 http://secunia.com/advisories/18828 http://xforce.iss.net/xforce/xfdb/24651 2006-02-13 2006-03-04 2006-03-06
gtar -- invalid headers buffer overflow gtar 1.15.1_2

GNU tar is vulnerable to a buffer overflow, caused by improper bounds checking of the PAX extended headers. By tricking an user into processing a specially crafted tar archive, this could be exploited to execute arbitrary code with the privileges of the user.

16764 CVE-2006-0300 2006-02-22 2006-03-03
bugzilla -- multiple vulnerabilities bugzilla ja-bugzilla 2.17.12.20.1

Some vulnerabilities have been reported in Bugzilla, which can be exploited by malicious users to conduct SQL injection attacks, and by malicious people to disclose sensitive information and conduct script insertion attacks.

CVE-2006-2420 CVE-2006-0916 CVE-2006-0915 CVE-2006-0914 CVE-2006-0913 http://www.bugzilla.org/security/2.18.4/ 2006-02-20 2006-02-27 2006-11-11
squirrelmail -- multiple vulnerabilities squirrelmail 1.4.6

Multiple vulnerabilities has been discovered since 1.4.5, including IMAP injection as well as some XSS issues.

CVE-2006-0377 CVE-2006-0195 CVE-2006-0188 2006-02-23 2006-02-24
gedit -- format string vulnerability gedit 2.10.3

Yan Feng reports a format string vulnerability in gedit. This vulnerability could cause a denial of service with a binary file that contains format string characters within the filename. It had been reported that web browsers and email clients can be configured to provide a filename as an argument to gedit.:

CAN-2005-1686 :http://marc.theaimsgroup.com/?l=bugtraq&m=111661117701398 2005-05-20 2006-02-20
WebCalendar -- unauthorized access vulnerability WebCalendar 1.0.0

SecurityFocus reports that WebCalendar is affected by an unauthorized access vulnerability. The vulnerability is caused by improper checking of the authentication mechanism before access is being permitted to the "assistant_edit.php" file.

14072 CAN-2005-2320 2005-06-27 2006-02-20
abiword, koffice -- stack based buffer overflow vulnerabilities koffice 1.2.01.4.1_1,1 abiword 2.2.11

Chris Evans reports that AbiWord is vulnerable to multiple stack-based buffer overflow vulnerabilities. This is caused by improper checking of the user-supplied data before it is being copied to an too small buffer. The vulnerability is triggered when someone is importing RTF files.

15096 CAN-2005-2972 http://scary.beasts.org/security/CESA-2005-006.txt http://www.abisource.com/changelogs/2.2.11.phtml http://www.kde.org/info/security/advisory-20051011-1.txt 2005-10-14 2006-02-20 2006-02-20
postgresql81-server -- SET ROLE privilege escalation postgresql-server 8.1.08.1.3

The PostgreSQL team reports:

Due to inadequate validity checking, a user could exploit the special case that SET ROLE normally uses to restore the previous role setting after an error. This allowed ordinary users to acquire superuser status, for example.

CVE-2006-0553 http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3 2006-02-14 2006-02-18 2006-08-13
gnupg -- false positive signature verification gnupg 1.4.2.1

Werner Koch reports:

The Gentoo project identified a security related bug in GnuPG. When using any current version of GnuPG for unattended signature verification (e.g. by scripts and mail programs), false positive signature verification of detached signatures may occur.

This problem affects the tool *gpgv*, as well as using "gpg --verify" to imitate gpgv, if only the exit code of the process is used to decide whether a detached signature is valid. This is a plausible mode of operation for gpgv.

If, as suggested, the --status-fd generated output is used to decide whether a signature is valid, no problem exists. In particular applications making use of the GPGME library[2] are not affected.

CVE-2006-0455 http://marc.theaimsgroup.com/?l=gnupg-devel&m=113999098729114 2006-02-15 2006-02-17
rssh -- privilege escalation vulnerability rssh 2.3.0

Pizzashack reports:

Max Vozeler has reported a problem whereby rssh can allow users who have shell access to systems where rssh is installed (and rssh_chroot_helper is installed SUID) to gain root access to the system, due to the ability to chroot to arbitrary locations. There are a lot of potentially mitigating factors, but to be safe you should upgrade immediately.

16050 CVE-2005-3345 http://www.pizzashack.org/rssh/security.shtml 2005-12-18 2006-02-16
tor -- malicious tor server can locate a hidden service tor 0.1.0.12

Roger Dingledine reports:

If you offer a Tor hidden service, an adversary who can run a fast Tor server and who knows some basic statistics can find the location of your hidden service in a matter of minutes to hours.

CVE-2006-0414 http://archives.seul.org/or/announce/Jan-2006/msg00001.html 2006-01-12 2006-02-16
sudo -- arbitrary command execution sudo 1.6.8.10

Tavis Ormandy reports:

The bash shell uses the value of the PS4 environment variable (after expansion) as a prefix for commands run in execution trace mode. Execution trace mode (xtrace) is normally set via bash's -x command line option or interactively by running "set -o xtrace". However, it may also be enabled by placing the string "xtrace" in the SHELLOPTS environment variable before bash is started.

A malicious user with sudo access to a shell script that uses bash can use this feature to run arbitrary commands for each line of the script.

15191 CVE-2005-2959 http://www.courtesan.com/sudo/alerts/bash_env.html 2005-10-25 2006-02-16
libtomcrypt -- weak signature scheme with ECC keys libtomcrypt 1.02

The Secure Science Corporation reports that libtomcrypt is vulnerable to a weak signature scheme. This allows an attacker to create a valid random signature and use that to sign arbitrary messages without requiring the private key.

http://marc.theaimsgroup.com/?l=bugtraq&m=111540819703204 2005-05-01 2006-02-16
mantis -- "view_filters_page.php" cross site scripting vulnerability mantis 1.0.0a4

r0t reports:

Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because input passed to "target_field" parameter in "view_filters_page.php" is not properly sanitised before being returned to the user. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

CAN-2005-4238 http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html 2005-12-13 2006-02-16
phpbb -- multiple vulnerabilities phpbb zh-phpbb-tw 2.0.18

Multiple vulnerabilities have been reported within phpbb. phpbb is proven vulnerable to:

  • script insertion,
  • bypassing of protetion mechanisms,
  • multiple cross site scripting vulnerabilities,
  • SQL injection,
  • arbitrary code execution
15170 15243 CVE-2005-3310 CVE-2005-3415 CVE-2005-3416 CVE-2005-3417 CVE-2005-3418 CVE-2005-3419 CVE-2005-3420 CVE-2005-3536 CVE-2005-3537 http://marc.theaimsgroup.com/?l=bugtraq&m=113017003617987 http://www.hardened-php.net/advisory_172005.75.html 2005-10-24 2006-02-16
postgresql -- character conversion and tsearch2 vulnerabilities postgresql 7.2.07.2.8 7.3.07.3.10 7.4.07.4.8 8.0.08.0.3

The postgresql development team reports:

The more severe of the two errors is that the functions that support client-to-server character set conversion can be called from SQL commands by unprivileged users, but these functions are not designed to be safe against malicious choices of argument values. This problem exists in PostgreSQL 7.3.* through 8.0.*. The recommended fix is to disable public EXECUTE access for these functions. This does not affect normal usage of the functions for character set conversion, but it will prevent misuse.

The other error is that the contrib/tsearch2 module misdeclares several functions as returning type "internal" when they do not have any "internal" argument. This breaks the type safety of "internal" by allowing users to construct SQL commands that invoke other functions accepting "internal" arguments. The consequences of this have not been investigated in detail, but it is certainly at least possible to crash the backend.

CAN-2005-1409 CAN-2005-1410 http://www.postgresql.org/about/news.315 2005-05-02 2006-02-16
heartbeat -- insecure temporary file creation vulnerability heartbeat 1.2.4

Eric Romang reports a temporary file creation vulnerability within heartbeat. The vulnerability is caused by hardcoded temporary file usage. This can cause an attacker to create an arbitrary symlink causing the application to overwrite the symlinked file with the permissions of the user executing the application.

CAN-2005-2231 http://www.zataz.net/adviso/heartbeat-06272005.txt 2005-07-12 2006-02-16 2006-04-16
kpdf -- heap based buffer overflow kdegraphics 3.5.1_1

The KDE team reports:

kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains a heap based buffer overflow in the splash rasterizer engine that can crash kpdf or even execute arbitrary code.

CVE-2006-0301 http://www.kde.org/info/security/advisory-20060202-1.txt 2006-02-02 2006-02-15
perl, webmin, usermin -- perl format string integer wrap vulnerability perl 5.6.05.6.2 5.8.05.8.7_1 webmin 1.250 usermin 1.180

The Perl Development page reports:

Dyad Security recently released a security advisory explaining how in certain cases, a carefully crafted format string passed to sprintf can cause a buffer overflow. This buffer overflow can then be used by an attacker to execute code on the machine. This was discovered in the context of a design problem with the Webmin administration package that allowed a malicious user to pass unchecked data into sprintf.

15629 CVE-2005-3912 CVE-2005-3962 http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html http://www.dyadsecurity.com/perl-0002.html http://www.dyadsecurity.com/webmin-0001.html http://www.webmin.com/security.html 2005-09-23 2006-02-15
phpicalendar -- cross site scripting vulnerability phpicalendar 2.1

Francesco Ongaro reports that phpicalendar is vulnerable for a cross site scripting attack. The vulnerability is caused by improper validation of the index.php file allowing attackers to include an arbitrary file with the .php extension

15193 CVE-2005-3366 http://www.ush.it/2005/10/25/php-icalendar-css/ 2005-10-25 2006-02-15
phpicalendar -- file disclosure vulnerability phpicalendar 2.21

The phpicalendar team reports that there is an unspecified vulnerability within phpicalendar. This seems to be a file disclosure vulnerability caused by improper checking of the template parsing function. This would allow an attacker to disclose any file readable by the user under which the webserver runs.

http://phpicalendar.net/forums/viewtopic.php?t=396 2006-02-08 2006-02-15
FreeBSD -- Infinite loop in SACK handling FreeBSD 5.45.4_11 5.35.3_26

Problem description:

When insufficient memory is available to handle an incoming selective acknowledgement, the TCP/IP stack may enter an infinite loop.

Impact:

By opening a TCP connection and sending a carefully crafted series of packets, an attacker may be able to cause a denial of service.

Workaround:

On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to disable the use of SACK:

# sysctl net.inet.tcp.sack.enable=0

No workaround is available for FreeBSD 5.3.

CVE-2006-0433 SA-06:08.sack 2006-02-01 2006-02-14 2006-06-09
pf -- IP fragment handling panic FreeBSD 6.06.0_4 5.45.4_10 5.35.3_25

Problem description:

A logic bug in pf's IP fragment cache may result in a packet fragment being inserted twice, violating a kernel invariant.

Impact:

By sending carefully crafted sequence of IP packet fragments, a remote attacker can cause a system running pf with a ruleset containing a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule to crash.

Workaround:

Do not use 'scrub fragment crop' or 'scrub fragment drop-ovl' rules on systems running pf. In most cases, such rules can be replaced by 'scrub fragment reassemble' rules; see the pf.conf(5) manual page for more details.

Systems which do not use pf, or use pf but do not use the aforementioned rules, are not affected by this issue.

CVE-2006-0381 SA-06:07.pf 2006-01-25 2006-02-14 2006-06-09
FreeBSD -- Local kernel memory disclosure FreeBSD 6.06.0_4

Problem description:

A buffer allocated from the kernel stack may not be completely initialized before being copied to userland. [CVE-2006-0379]

A logic error in computing a buffer length may allow too much data to be copied into userland. [CVE-2006-0380]

Impact:

Portions of kernel memory may be disclosed to local users. Such memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way. For example, a terminal buffer might include a user-entered password.

Workaround:

No workaround is available.

CVE-2006-0379 CVE-2006-0380 SA-06:06.kmem 2006-01-25 2006-02-14 2006-06-09
IEEE 802.11 -- buffer overflow FreeBSD 6.06.0_3

Problem description:

An integer overflow in the handling of corrupt IEEE 802.11 beacon or probe response frames when scanning for existing wireless networks can result in the frame overflowing a buffer.

Impact:

An attacker able broadcast a carefully crafted beacon or probe response frame may be able to execute arbitrary code within the context of the FreeBSD kernel on any system scanning for wireless networks.

Workaround:

No workaround is available, but systems without IEEE 802.11 hardware or drivers loaded are not vulnerable.

CVE-2006-0226 SA-06:05.80211 2006-01-18 2006-02-14 2006-06-09
ipfw -- IP fragment denial of service FreeBSD 6.06.0_2

Problem description:

The firewall maintains a pointer to layer 4 header information in the event that it needs to send a TCP reset or ICMP error message to discard packets. Due to incorrect handling of IP fragments, this pointer fails to get initialized.

Impact:

An attacker can cause the firewall to crash by sending ICMP IP fragments to or through firewalls which match any reset, reject or unreach actions.

Workaround:

Change any reset, reject or unreach actions to deny. It should be noted that this will result in packets being silently discarded.

CVE-2006-0054 SA-06:04.ipfw 2006-01-11 2006-02-14 2006-06-09
kpopup -- local root exploit and local denial of service kpopup 0.9.10.9.5

Mitre CVE reports:

Format string vulnerability in main.cpp in kpopup 0.9.1-0.9.5pre2 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via format string specifiers in command line arguments.

misc.cpp in KPopup 0.9.1 trusts the PATH variable when executing killall, which allows local users to elevate their privileges by modifying the PATH variable to reference a malicious killall program.

SecurityFocus credits "b0f" b0fnet@yahoo.com

CVE-2003-1170 8918 CVE-2003-1167 8915 http://www.securityfocus.com/archive/1/342736 http://www.henschelsoft.de/kpopup_en.html 2003-10-28 2006-02-07
cpio -- multiple vulnerabilities FreeBSD 6.06.0_2 5.45.4_9 5.35.3_24 4.114.11_14 4.104.10_20

Problem description:

A number of issues has been discovered in cpio:

When creating a new file, cpio closes the file before setting its permissions. (CVE-2005-1111)

When extracting files cpio does not properly sanitize file names to filter out ".." components, even if the --no-absolute-filenames option is used. (CVE-2005-1229)

When adding large files (larger than 4 GB) to a cpio archive on 64-bit platforms an internal buffer might overflow. (CVE-2005-4268)

Impact

The first problem can allow a local attacker to change the permissions of files owned by the user executing cpio providing that they have write access to the directory in which the file is being extracted. (CVE-2005-1111)

The lack of proper file name sanitation can allow an attacker to overwrite arbitrary local files when extracting files from a cpio archive. (CVE-2005-1229)

The buffer-overflow on 64-bit platforms could lead cpio to a Denial-of-Service situation (crash) or possibly execute arbitrary code with the permissions of the user running cpio. (CVE-2005-4268)

Workaround

Use a different utility to create and extract cpio archives, for example pax(1) or (on FreeBSD 5.3 or later) tar(1). If this is not possible, do not extract untrusted archives and when running on 64-bit platforms do not add untrusted files to cpio archives.

CVE-2005-1111 CVE-2005-1229 CVE-2005-4268 SA-06:03.cpio 2006-01-11 2006-01-27 2006-01-11
ee -- temporary file privilege escalation FreeBSD 6.06.0_2 5.45.4_9 5.35.3_24 4.114.11_14 4.104.10_20

Problem description

The ispell_op function used by ee(1) while executing spell check operations employs an insecure method of temporary file generation. This method produces predictable file names based on the process ID and fails to confirm which path will be over written with the user.
It should be noted that ispell does not have to be installed in order for this to be exploited. The option simply needs to be selected.

Impact

These predictable temporary file names are problematic because they allow an attacker to take advantage of a race condition in order to execute a symlink attack, which could allow them to overwrite files on the system in the context of the user running the ee(1) editor.

Workaround

Instead of invoking ispell through ee(1), invoke it directly.

16207 CVE-2006-0055 SA-06:02.ee 2006-01-11 2006-01-27
texindex -- temporary file privilege escalation FreeBSD 6.06.0_2 5.45.4_9 5.35.3_24 4.114.11_14 4.104.10_20

Problem description

The "sort_offline" function used by texindex(1) employs the "maketempname" function, which produces predictable file names and fails to validate that the paths do not exist.

Impact

These predictable temporary file names are problematic because they allow an attacker to take advantage of a race condition in order to execute a symlink attack, which could enable them to overwrite files on the system in the context of the user running the texindex(1) utility.

Workaround

No workaround is available, but the problematic code is only executed if the input file being processed is 500kB or more in length; as a result, users working with documents of less than several hundred pages are very unlikely to be affected.

14854 CAN-2005-3011 SA-06:01.texindex 2006-01-11 2006-01-27
cvsbug -- race condition FreeBSD 5.45.4_7 5.35.3_22 4.114.11_12 4.104.10_18 cvs+ipv6 1.11.17_1

Problem description

A temporary file is created, used, deleted, and then re-created with the same name. This creates a window during which an attacker could replace the file with a link to another file. While cvsbug(1) is based on the send-pr(1) utility, this problem does not exist in the version of send-pr(1) distributed with FreeBSD.
In FreeBSD 4.10 and 5.3, some additional problems exist concerning temporary file usage in both cvsbug(1) and send-pr(1).

Impact

A local attacker could cause data to be written to any file to which the user running cvsbug(1) (or send-pr(1) in FreeBSD 4.10 and 5.3) has write access. This may cause damage in itself (e.g., by destroying important system files or documents) or may be used to obtain elevated privileges.

Workaround

Do not use the cvsbug(1) utility on any system with untrusted users.
Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3 system with untrusted users.

CAN-2005-2693 SA-05:20.cvsbug 2005-09-07 2006-01-27 2006-11-08
sge -- local root exploit in bundled rsh executable sge sgeee 5.3.6.20040330_1 6.*6.0.7.1

Sun Microsystems reports:

The SGE 6.0u7_1 release fixes a security bug which can allow malicious users to gain root access.

http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html 2005-12-23 2006-01-23
fetchmail -- crash when bouncing a message fetchmail 6.3.06.3.2

Matthias Andree reports:

Fetchmail contains a bug that causes itself to crash when bouncing a message to the originator or to the local postmaster. The crash happens after the bounce message has been sent, when fetchmail tries to free the dynamic array of failed addresses, and calls the free() function with an invalid pointer.

CVE-2006-0321 http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt http://bugs.debian.org/348747 2006-01-22 2006-01-23
clamav -- possible heap overflow in the UPX code clamav 0.88 clamav-devel 20060110

The Zero Day Initiative reports:

This vulnerability allows remote attackers to execute arbitrary code on vulnerable Clam AntiVirus installations. Authentication is not required to exploit this vulnerability.

This specific flaw exists within libclamav/upx.c during the unpacking of executable files compressed with UPX. Due to an invalid size calculation during a data copy from the user-controlled file to heap allocated memory, an exploitable memory corruption condition is created.

16191 CVE-2006-0162 http://lurker.clamav.net/message/20060109.213247.a16ae8db.en.html http://www.zerodayinitiative.com/advisories/ZDI-06-001.html http://secunia.com/advisories/18379/ 2006-01-09 2006-01-10 2006-01-15
milter-bogom -- headerless message crash milter-bogom 1.8.2

Juan J. Marítnez reports:

The milter crashes while processing a headerless message

Impact: bogom crashes and sendmail moves it to error state

http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt http://alf.dyndns.ws/pipermail/milter/2006-January/000076.html 2006-01-05 2006-01-09
bogofilter -- heap corruption through excessively long words bogofilter 0.96.20.96.3

Matthias Andree reports:

Bogofilter's/bogolexer's input handling in version 0.96.2 was not keeping track of its output buffers properly and could overrun a heap buffer if the input contained words whose length exceeded 16,384 bytes, the size of flex's input buffer. A "word" here refers to a contiguous run of input octets that was not '_' and did not match at least one of ispunct(), iscntrl() or isspace().

CVE-2005-4592 http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02 2005-10-23 2006-01-07
bogofilter -- heap corruption through malformed input bogofilter 0.93.50.96.3

Matthias Andree reports:

When using Unicode databases (default in more recent bogofilter installations), upon encountering invalid input sequences, bogofilter or bogolexer could overrun a malloc()'d buffer, corrupting the heap, while converting character sets. Bogofilter would usually be processing untrusted data received from the network at that time.

This problem was aggravated by an unrelated bug that made bogofilter process binary attachments as though they were text, and attempt charset conversion on them. Given the MIME default character set, US-ASCII, all input octets in the range 0x80...0xff were considered invalid input sequences and could trigger the heap corruption.

CVE-2005-4591 http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01 2005-10-22 2006-01-07
rxvt-unicode -- restore permissions on tty devices rxvt-unicode 6.3

A rxvt-unicode changelog reports:

SECURITY FIX: on systems using openpty, permissions were not correctly updated on the tty device and were left as world-readable and world-writable (likely in original rxvt, too), and were not restored properly. Affected are only systems where non-unix ptys were used (such as most BSDs). Found, patched and debugged by Ryan Beasley.

http://dist.schmorp.de/rxvt-unicode/Changes 2005-12-31 2006-01-04
apache -- mod_imap cross-site scripting flaw apache 1.31.3.34_3 2.0.352.0.55_2 2.12.1.9_3 2.22.2.0_3 apache+mod_perl 1.3.34_1 apache_fp apache+ipv6 0 ru-apache 1.3.34+30.22_1 ru-apache+mod_ssl 1.3.34+30.22+2.8.25_1 apache+ssl 1.3.01.3.33.1.55_2 apache+mod_ssl apache+mod_ssl+ipv6 apache+mod_ssl+mod_accel apache+mod_ssl+mod_accel+ipv6 apache+mod_ssl+mod_accel+mod_deflate apache+mod_ssl+mod_accel+mod_deflate+ipv6 apache+mod_ssl+mod_deflate apache+mod_ssl+mod_deflate+ipv6 apache+mod_ssl+mod_snmp apache+mod_ssl+mod_snmp+mod_accel apache+mod_ssl+mod_snmp+mod_accel+ipv6 apache+mod_ssl+mod_snmp+mod_deflate apache+mod_ssl+mod_snmp+mod_deflate+ipv6 apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 1.3.34+2.8.25_1

The Apache HTTP Server Project reports:

A flaw in mod_imap when using the Referer directive with image maps. In certain site configurations a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers.

CVE-2005-3352 15834 http://www.apacheweek.com/features/security-13 http://www.apacheweek.com/features/security-20 2005-11-01 2006-01-01 2006-01-03
nbd-server -- buffer overflow vulnerability nbd-server 2.8.2_1

Kurt Fitzner reports a buffer overflow vulnerability within nbd. This could potentially allow the execution of arbitrary code on the nbd server.

CVE-2005-3534 http://www.debian.org/security/2005/dsa-924 2005-12-21 2005-12-22 2005-12-25
scponly -- local privilege escalation exploits scponly 4.2

Max Vozeler reports:

If ALL the following conditions are true, administrators using scponly-4.1 or older may be at risk of a local privilege escalation exploit:

  • the chrooted setuid scponlyc binary is installed
  • regular non-scponly users have interactive shell access to the box
  • a user executable dynamically linked setuid binary (such as ping) exists on the same file system mount as the user's home directory
  • the operating system supports an LD_PRELOAD style mechanism to overload dynamic library loading

Pekka Pessi also reports:

If ANY the following conditions are true, administrators using scponly-4.1 or older may be at risk of a local privilege escalation exploit:

  • scp compatibility is enabled
  • rsync compatibility is enabled
https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html http://sublimation.org/scponly/#relnotes 2005-12-21 2005-12-22
fetchmail -- null pointer dereference in multidrop mode with headerless email fetchmail 6.3.1

The fetchmail team reports:

Fetchmail contains a bug that causes an application crash when fetchmail is configured for multidrop mode and the upstream mail server sends a message without headers. As fetchmail does not record this message as "previously fetched", it will crash with the same message if it is re-executed, so it cannot make progress. A malicious or broken-into upstream server could thus cause a denial of service in fetchmail clients.

CVE-2005-4348 http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt http://article.gmane.org/gmane.mail.fetchmail.user/7573 http://bugs.debian.org/343836 2005-12-19 2005-12-19
mantis -- "t_core_path" file inclusion vulnerability mantis 1.0.0rc3

Secunia Research reports:

Input passed to the "t_core_path" parameter in "bug_sponsorship_list_view_inc.php" isn't properly verified, before it used to include files. This can be exploited to include arbitrary files from external and local resources.

CVE-2005-3335 http://secunia.com/secunia_research/2005-46/advisory/ 2005-10-26 2005-12-14
mantis -- "view_filters_page.php" cross-site scripting vulnerability mantis 1.0.0rc4

r0t reports:

Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because input passed to "target_field" parameter in "view_filters_page.php" isn't properly sanitised before being returned to the user. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

15842 http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html 2005-12-13 2005-12-14
mnemo -- Cross site scripting vulnerabilities in several of the notepad name and note data fields mnemo 2.0.3

Announce of Mnemo H3 (2.0.3) (final):

This [2.0.3] is a security release that fixes cross site scripting vulnerabilities in several of the notepad name and note data fields. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Mnemo 2.0.2 upgrade to 2.0.3 as soon as possible.

http://marc.theaimsgroup.com/?l=horde-announce&m=113433279228172&w=2 2005-12-11 2005-12-11
nag -- Cross site scripting vulnerabilities in several of the tasklist name and task data fields nag 2.0.4

Announce of Nag H3 (2.0.4) (final):

This [2.0.4] is a security release that fixes cross site scripting vulnerabilities in several of the tasklist name and task data fields. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Nag 2.0.3 upgrade to 2.0.4 as soon as possible.

http://marc.theaimsgroup.com/?l=horde-announce&m=113433205826731&w=2 2005-12-11 2005-12-11
turba -- Cross site scripting vulnerabilities in several of the address book name and contact data fields turba 2.0.5

Announce of Turba H3 (2.0.5) (final):

This [2.0.5] is a security release that fixes cross site scripting vulnerabilities in several of the address book name and contact data fields. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Turba 2.0.4 upgrade to 2.0.5 as soon as possible.

http://marc.theaimsgroup.com/?l=horde-announce&m=113433120829232&w=2 2005-12-11 2005-12-11
kronolith -- Cross site scripting vulnerabilities in several of the calendar name and event data fields kronolith 2.0.6

Announce of Kronolith H3 (2.0.6) (final):

This [2.0.6] is a security release that fixes cross site scripting vulnerabilities in several of the calendar name and event data fields. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Kronolith 2.0.5 upgrade to 2.0.6 as soon as possible.

http://marc.theaimsgroup.com/?l=kronolith&m=113433029822279&w=2 2005-12-11 2005-12-11
horde -- Cross site scripting vulnerabilities in several of Horde's templates horde horde-php5 3.0.8

Announce of Horde H3 3.0.8 (final):

This [3.0.8] is a security release that fixes cross site scripting vulnerabilities in several of Horde's templates. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Horde 3.0.7 upgrade to 3.0.8 as soon as possible.

http://marc.theaimsgroup.com/?l=horde-announce&m=113433346726097&w=2 2005-12-11 2005-12-11
curl -- URL buffer overflow vulnerability curl 7.11.27.15.1

A Project cURL Security Advisory reports:

libcurl's URL parser function can overflow a malloced buffer in two ways, if given a too long URL.

1 - pass in a URL with no protocol (like "http://") prefix, using no slash and the string is 256 bytes or longer. This leads to a single zero byte overflow of the malloced buffer.

2 - pass in a URL with only a question mark as separator (no slash) between the host and the query part of the URL. This leads to a single zero byte overflow of the malloced buffer.

Both overflows can be made with the same input string, leading to two single zero byte overwrites.

The affected flaw cannot be triggered by a redirect, but the long URL must be passed in "directly" to libcurl. It makes this a "local" problem. Of course, lots of programs may still pass in user-provided URLs to libcurl without doing much syntax checking of their own, allowing a user to exploit this vulnerability.

15756 CVE-2005-4077 http://curl.haxx.se/docs/adv_20051207.html http://www.hardened-php.net/advisory_242005.109.html http://secunia.com/advisories/17907/ 2005-12-07 2005-12-09 2006-01-01
phpmyadmin -- register_globals emulation "import_blacklist" manipulation phpMyAdmin 2.7.0.1

Secunia reports:

Stefan Esser has reported a vulnerability in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks, disclose sensitive information, and compromise a vulnerable system.

The vulnerability is caused due to an error in the register_globals emulation layer in "grab_globals.php" where the "import_blacklist" variable is not properly protected from being overwritten. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site, and include arbitrary files from external and local resources.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9 http://www.hardened-php.net/advisory_252005.110.html http://secunia.com/advisories/17925/ 2005-12-07 2005-12-07
phpmyadmin -- XSS vulnerabilities phpMyAdmin 2.7.0

A phpMyAdmin security advisory reports:

It was possible to conduct an XSS attack via the HTTP_HOST variable; also, some scripts in the libraries directory that handle header generation were vulnerable to XSS.

CVE-2005-3665 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8 http://secunia.com/advisories/17895/ 2005-12-05 2005-12-07
ffmpeg -- libavcodec buffer overflow vulnerability ffmpeg 0.4.9.p1_4 ffmpeg-devel 0.4.9.c.2005120600

Secunia reports:

Simon Kilvington has reported a vulnerability in FFmpeg libavcodec, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system.

The vulnerability is caused due to a boundary error in the "avcodec_default_get_buffer()" function of "utils.c" in libavcodec. This can be exploited to cause a heap-based buffer overflow when a specially-crafted 1x1 ".png" file containing a palette is read.

http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558 http://secunia.com/advisories/17892/ 2005-11-30 2005-12-07
trac -- search module SQL injection vulnerability trac 0.9.2

Secunia reports:

A vulnerability has been reported in Trac, which can be exploited by malicious people to conduct SQL injection attacks.

Some unspecified input passed in the search module isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

http://projects.edgewall.com/trac/wiki/ChangeLog#a0.9.2 http://secunia.com/advisories/17894/ 2005-12-05 2005-12-07
drupal -- multiple vulnerabilities drupal 4.6.4

Secunia reports:

Some vulnerabilities have been reported in Drupal, which can be exploited by malicious people to bypass certain security restrictions, and conduct script insertion and HTTP response splitting attacks.

1) An input validation error in the filtering of HTML code can be exploited to inject arbitrary JavaScript code in submitted content, which will be executed in a user's browser session in context of an affected site when the malicious user data is viewed. Successful exploitation requires that the user has access to the full HTML input format. Ref: sa-2005-007

2) An input validation error in the attachment handling can be exploited to upload a malicious image with embedded HTML and script content, which will be executed in a user's browser session in context of an affected site when viewed directly with the Microsoft Internet Explorer browser. This can also be exploited to inject arbitrary HTTP headers, which will be included in the response sent to the user. Ref: sa-2005-008

3) The problem is that it is possible to bypass the "access user profile" permission. However, this cannot be exploited to modify data. Successful exploitation requires that the server runs PHP 5. Ref: sa-2005-009

http://drupal.org/files/sa-2005-007/advisory.txt http://drupal.org/files/sa-2005-008/advisory.txt http://drupal.org/files/sa-2005-009/advisory.txt http://secunia.com/advisories/17824/ 2005-12-01 2005-12-01
opera -- multiple vulnerabilities linux-opera opera-devel opera 8.51

Opera reports:

It is possible to make a form input that looks like an image link. If the form input has a "title" attribute, the status bar will show the "title". A "title" which looks like a URL can mislead the user, since the title can say http://nice.familiar.com/, while the form action can be something else.

Opera's tooltip says "Title:" before the title text, making a spoof URL less convincing. A user who has enabled the status bar and disabled tooltips can be affected by this. Neither of these settings are Opera's defaults.

This exploit is mostly of interest to users who disable JavaScript. If JavaScript is enabled, any link target or form action can be overridden by the script. The tooltip and the statusbar can only be trusted to show the true location if JavaScript is disabled.

Java code using LiveConnect methods to remove a property of a JavaScript object may in some cases use null pointers that can make Opera crash. This crash is not exploitable and such code is rare on the web.

CVE-2005-3699 http://secunia.com/advisories/17571/ http://www.opera.com/support/search/supsearch.dml?index=817 http://www.opera.com/support/search/supsearch.dml?index=819 2005-11-16 2005-11-30
opera -- command line URL shell command injection linux-opera opera-devel opera 8.51

An Opera Advisory reports:

Opera for UNIX uses a wrapper shell script to start up Opera. This shell script reads the input arguments, like the file names or URLs that Opera is to open. It also performs some environment checks, for example whether Java is available and if so, where it is located.

This wrapper script can also run commands embedded in the URL, so that a specially crafted URL can make arbitrary commands run on the recipient's machine. Users who have other programs set up to use Opera to open Web links are vulnerable to this flaw. For these users, clicking a Web link in for example OpenOffice.org or Evolution can run a command that was put into the link.

15521 CVE-2005-3750 http://secunia.com/secunia_research/2005-57/advisory/ http://www.opera.com/support/search/supsearch.dml?index=818 2005-11-17 2005-11-30
mambo -- "register_globals" emulation layer overwrite vulnerability mambo 4.5.3

A Secunia Advisory reports:

peter MC tachatte has discovered a vulnerability in Mambo, which can be exploited by malicious people to manipulate certain information and compromise a vulnerable system.

The vulnerability is caused due to an error in the "register_globals" emulation layer in "globals.php" where certain arrays used by the system can be overwritten. This can be exploited to include arbitrary files from external and local resources via the "mosConfig_absolute_path" parameter.

Successful exploitation requires that "register_globals" is disabled.

http://www.mamboserver.com/index.php?option=com_content&task=view&id=172&Itemid=1 http://secunia.com/advisories/17622/ 2005-11-17 2005-11-30
ghostscript -- insecure temporary file creation vulnerability ghostscript-gnu ghostscript-gnu-nox11 7.07_14 ghostscript-afpl ghostscript-afpl-nox11 8.53_1

Ghostscript is affected by an insecure temporary file creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the existence of a file before writing to it.

An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. Reportedly this issue is unlikely to facilitate privilege escalation.

11285 CVE-2004-0967 2004-10-19 2005-11-27
horde -- Cross site scripting vulnerabilities in MIME viewers horde horde-php5 3.0.7

Announce of Horde 3.0.7 (final):

This [3.0.7] is a security release that fixes cross site scripting vulnerabilities in two of Horde's MIME viewers. These holes could for example be exploited by an attacker sending specially crafted emails to Horde's webmail client IMP. The attack could be used to steal users' identity information, taking over users' sessions, or changing users' settings.

As a hotfix the css and tgz MIME drivers can be disabled by removing their entries from the $mime_drivers_map['horde']['registered'] list in horde/config/mime_drivers.php.

15535 CVE-2005-3759 http://lists.horde.org/archives/announce/2005/000232.html 2005-11-22 2005-11-22 2005-11-26
phpmyadmin -- HTTP Response Splitting vulnerability phpMyAdmin 2.6.4.4

A phpMyAdmin security advisory reports:

Some scripts in phpMyAdmin are vulnerable to an HTTP Response Splitting attack.

Severity:

We consider these vulnerabilities to be serious. However, they can only be triggered on systems running with register_globals = on.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6 http://secunia.com/advisories/17578/ http://www.fitsec.com/advisories/FS-05-02.txt 2005-11-15 2005-11-16
phpSysInfo -- "register_globals" emulation layer overwrite vulnerability phpSysInfo 2.5.1

A Secunia Advisory reports:

Christopher Kunz has reported a vulnerability in phpSysInfo, which can be exploited by malicious people to manipulate certain information.

The vulnerability is caused due to an error in the "register_globals" emulation layer where certain arrays used by the system can be overwritten. This can be exploited to execute arbitrary HTML and script code in a user's browser session and include arbitrary files from local resources.

http://www.hardened-php.net/advisory_222005.81.html http://secunia.com/advisories/17441/ 2005-11-10 2005-11-13 2005-12-25
Macromedia flash player -- swf file handling arbitrary code linux-flashplugin6 6.0r79_3 linux-flashplugin7 7.0r61

A Secunia Advisory reports:

A vulnerability has been reported in Macromedia Flash Player, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to missing validation of the frame type identifier that is read from a SWF file. This value is used as an index in Flash.ocx to reference an array of function pointers. This can be exploited via a specially crafted SWF file to cause the index to reference memory that is under the attacker's control, which causes Flash Player to use attacker supplied values as function pointers.

Successful exploitation allows execution of arbitrary code.

http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html http://secunia.com/advisories/17430/ http://www.eeye.com/html/research/advisories/AD20051104.html 2005-06-27 2005-11-13
flyspray -- cross-site scripting vulnerabilities flyspray 0.9.8

A Secunia Advisory reports:

Lostmon has reported some vulnerabilities in Flyspray, which can be exploited by malicious people to conduct cross-site scripting attacks.

Some input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

15209 http://secunia.com/advisories/17316/ http://lostmon.blogspot.com/2005/10/flyspray-bug-killer-multiple-variable.html 2005-10-26 2005-11-10 2005-11-29
p5-Mail-SpamAssassin -- long message header denial of service p5-Mail-SpamAssassin 3.1.0

A Secunia Advisory reports:

A vulnerability has been reported in SpamAssassin, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to the use of an inefficient regular expression in "/SpamAssassin/Message.pm" to parse email headers. This can cause perl to crash when it runs out of stack space and can be exploited via a malicious email that contains a large number of recipients.

http://secunia.com/advisories/17386/ http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570 2005-11-10 2005-11-10
qpopper -- multiple privilege escalation vulnerabilities qpopper 4.04.0.5

Jens Steube reports that qpopper is vulnerable to a privilege escalation vulnerability. qpopper does not properly drop root privileges so that user supplied configuration and trace files can be processed with root privileges. This could allow a local attacker to create or modify arbitrary files.

qpopper is also affected by improper umask settings which could allow users to create group or world-writeable files, possibly allowing an attacker to overwrite arbitrary files.

CVE-2005-1151 CVE-2005-1152 http://secunia.com/advisories/15475/ 2005-05-26 2005-11-07 2005-11-26
pear-PEAR -- PEAR installer arbitrary code execution vulnerability pear-PEAR 1.4.3

Gregory Beaver reports:

A standard feature of the PEAR installer implemented in all versions of PEAR can lead to the execution of arbitrary PHP code upon running the "pear" command or loading the Web/Gtk frontend.

To be vulnerable, a user must explicitly install a publicly released malicious package using the PEAR installer, or explicitly install a package that depends on a malicious package.

http://pear.php.net/advisory-20051104.txt 2005-11-01 2005-11-04
openvpn -- potential denial-of-service on servers in TCP mode openvpn 2.02.0.4

James Yonan reports:

If the TCP server accept() call returns an error status, the resulting exception handler may attempt to indirect through a NULL pointer, causing a segfault. Affects all OpenVPN 2.0 versions.

CVE-2005-3409 http://openvpn.net/changelog.html 2005-11-01 2005-11-01 2005-11-04
openvpn -- arbitrary code execution on client through malicious or compromised server openvpn 2.02.0.4

James Yonan reports:

A format string vulnerability in the foreign_option function in options.c could potentially allow a malicious or compromised server to execute arbitrary code on the client. Only non-Windows clients are affected. The vulnerability only exists if (a) the client's TLS negotiation with the server succeeds, (b) the server is malicious or has been compromised such that it is configured to push a maliciously crafted options string to the client, and (c) the client indicates its willingness to accept pushed options from the server by having "pull" or "client" in its configuration file (Credit: Vade79).

CVE-2005-3393 http://www.securityfocus.com/archive/1/415293/30/0/threaded http://openvpn.net/changelog.html 2005-10-31 2005-11-01 2005-11-04
PHP -- multiple vulnerabilities mod_php4-twig php4-cgi php4-cli php4-dtc php4-horde php4-nms php4 4.4.1 mod_php mod_php4 44.4.1,1

A Secunia Advisory reports:

Some vulnerabilities have been reported in PHP, which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, and potentially compromise a vulnerable system.

http://secunia.com/advisories/17371/ 2005-10-31 2005-11-01
skype -- multiple buffer overflow vulnerabilities skype 1.2.0.18

A Secunia Advisory reports:

Some vulnerabilities have been reported in Skype, which can be exploited by malicious people to cause a DoS or to compromise a user's system.

CVE-2005-3265 CVE-2005-3267 930345 668193 http://secunia.com/advisories/17305/ http://skype.com/security/skype-sb-2005-02.html http://skype.com/security/skype-sb-2005-03.html 2005-10-25 2005-11-01 2005-11-02
squid -- FTP server response handling denial of service squid 2.5.11_3

A Secunia Advisory reports:

M.A.Young has reported a vulnerability in Squid, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in handling certain FTP server responses. This can be exploited to crash Squid by visiting a malicious FTP server via the proxy.

CVE-2005-3258 http://secunia.com/advisories/17271/ 2005-10-19 2005-11-01
base -- PHP SQL injection vulnerability base 1.2.1

A Secunia Advisory reports:

Remco Verhoef has discovered a vulnerability in Basic Analysis and Security Engine (BASE), which can be exploited by malicious users to conduct SQL injection attacks.

15199 http://secunia.com/advisories/17314/ 2005-10-25 2005-10-31
fetchmail -- fetchmailconf local password exposure fetchmail 6.2.5.2_1

The fetchmail team reports:

The fetchmailconf program before and excluding version 1.49 opened the run control file, wrote the configuration to it, and only then changed the mode to 0600 (rw-------). Writing the file, which usually contains passwords, before making it unreadable to other users, can expose sensitive password information.

CVE-2005-3088 http://fetchmail.berlios.de/fetchmail-SA-2005-02.txt 2005-10-21 2005-10-30
lynx -- remote buffer overflow lynx ja-lynx 2.8.5_1 2.8.6*2.8.6d14 lynx-ssl 2.8.5_1

Ulf Härnhammar reports:

When Lynx connects to an NNTP server to fetch information about the available articles in a newsgroup, it will call a function called HTrjis() with the information from certain article headers. The function adds missing ESC characters to certain data, to support Asian character sets. However, it does not check if it writes outside of the char array buf, and that causes a remote stack-based buffer overflow.

CVE-2005-3120 http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html 2005-10-17 2005-10-30 2006-10-05
ruby -- vulnerability in the safe level settings ruby ruby_static 1.6.*1.6.8.2004.07.28_2 1.8.*1.8.2_5

Ruby home page reports:

The Object Oriented Scripting Language Ruby supports safely executing an untrusted code with two mechanisms: safe level and taint flag on objects.

A vulnerability has been found that allows bypassing these mechanisms.

By using the vulnerability, arbitrary code can be executed beyond the restrictions specified in each safe level. Therefore, Ruby has to be updated on all systems that use safe level to execute untrusted code.

CVE-2005-2337 http://www.ruby-lang.org/en/20051003.html 2005-10-02 2005-10-27
xloadimage -- buffer overflows in NIFF image title handling xloadimage 4.1.15 xli 1.17.0_4

Ariel Berkman reports:

Unlike most of the supported image formats in xloadimage, the NIFF image format can store a title name of arbitrary length as part of the image file.

When xloadimage is processing a loaded image, it is creating a new Image object and then writing the processed image to it. At that point, it will also copy the title from the old image to the newly created image.

The 'zoom', 'reduce', and 'rotate' functions are using a fixed length buffer to construct the new title name when an image processing is done. Since the title name in a NIFF format is of varying length, and there are insufficient buffer size validations, the buffer can be overflowed.

15051 CVE-2005-3178 http://marc.theaimsgroup.com/?l=bugtraq&m=112862493918840&w=2 2005-10-05 2005-10-20 2005-10-23
snort -- Back Orifice preprocessor buffer overflow vulnerability snort 2.4.02.4.3

Jennifer Steffens reports:

The Back Orifice preprocessor contains a stack-based buffer overflow. This vulnerability could be leveraged by an attacker to execute code remotely on a Snort sensor where the Back Orifice preprocessor is enabled. However, there are a number of factors that make remote code execution difficult to achieve across different builds of Snort on different platforms, even on the same platform with different compiler versions, and it is more likely that an attacker could use the vulnerability as a denial of service attack.

The Back Orifice preprocessor can be disabled by commenting out the line "preprocessor bo" in snort.conf. This can be done in any text editor using the following procedure:

  1. Locate the line "preprocessor bo"
  2. Comment out this line by preceding it with a hash (#). The new line will look like "#preprocessor bo"
  3. Save the file
  4. Restart snort
175500 http://www.snort.org/pub-bin/snortnews.cgi#99 http://xforce.iss.net/xforce/alerts/id/207 2005-10-18 2005-10-18
webcalendar -- remote file inclusion vulnerability WebCalendar 1.0.1

WebCalendar is proven vulnerable to a remote file inclusion vulnerability. The send_reminders.php does not properly verify the "includedir" parameter, giving remote attackers the possibility to include local and remote files. These files can be used by the attacker to gain access to the system.

14651 CVE-2005-2717 http://sourceforge.net/forum/forum.php?thread_id=1342085&forum_id=11587 2005-08-26 2005-10-15 2005-11-08
gallery2 -- file disclosure vulnerability gallery2 2.0.1

Michael Dipper wrote:

A vulnerability has been discovered in gallery, which allows remote users unauthorized access to files on the webserver.

A remote user accessing gallery over the web may use specially crafted HTTP parameters to access arbitrary files located on the webserver. All files readable by the webserver process are subject to disclosure. The vulnerability is *not* restricted to the webserver's document root but extends to the whole server file space.

The vulnerabilty may be used by any anonymous user, there is no login to the application required.

15108 CVE-2005-3251 http://dipper.info/security/20051012/ 2005-10-12 2005-10-15 2005-11-08
openssl -- potential SSL 2.0 rollback openssl openssl-overwrite-base 0.9.7g 0.9.80.9.8_1 0.9.*_200503250.9.*_20051011 openssl-beta openssl-beta-overwrite-base 0.9.8_1 0.9.*_200503250.9.*_20051011 compat5x-alpha compat5x-amd64 compat5x-i386 compat5x-sparc64 5.4.0.8 FreeBSD 4.10_19 4.114.11_13 5.35.3_23 5.45.4_8

Vulnerability:

Such applications are affected if they use the option SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of SSL_OP_ALL, which is intended to work around various bugs in third-party software that might prevent interoperability. The SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in the SSL 2.0 server supposed to prevent active protocol-version rollback attacks. With this verification step disabled, an attacker acting as a "man in the middle" can force a client and a server to negotiate the SSL 2.0 protocol even if these parties both support SSL 3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe cryptographic weaknesses and is supported as a fallback only.

Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor SSL_OP_ALL are not affected. Also, applications that disable use of SSL 2.0 are not affected.

SA-05:21.openssl CVE-2005-2969 http://www.openssl.org/news/secadv_20051011.txt 2005-10-11 2005-10-12 2005-10-25
phpmyadmin -- local file inclusion vulnerability phpMyAdmin 2.6.4.r12.6.4.1

A phpMyAdmin security announcement reports:

In libraries/grab_globals.lib.php, the $__redirect parameter was not correctly validated, opening the door to a local file inclusion attack.

We consider this vulnerability to be serious.

15053 http://marc.theaimsgroup.com/?l=bugtraq&m=112907764728209 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4 2005-10-11 2005-10-11 2005-10-13
zope -- expose RestructuredText functionality to untrusted users zope 2.6.02.7.8 2.8.02.8.1_2

A Zope Hotfix Alert reports:

This hotfix resolves a security issue with docutils.

Affected are possibly all Zope instances that expose RestructuredText functionalies to untrusted users through the web.

CVE-2005-3323 15082 http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert 2005-10-09 2005-10-11 2005-11-28
libxine -- format string vulnerability libxine 1.1.0_1

Gentoo Linux Security Advisory reports:

Ulf Harnhammar discovered a format string bug in the routines handling CDDB server response contents.

An attacker could submit malicious information about an audio CD to a public CDDB server (or impersonate a public CDDB server). When the victim plays this CD on a multimedia frontend relying on xine-lib, it could end up executing arbitrary code.

CVE-2005-2967 http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml http://xinehq.de/index.php/security/XSA-2005-1 2005-10-08 2005-10-09
imap-uw -- mailbox name handling remote buffer vulnerability imap-uw 2004g

FrSIRT reports:

A vulnerability has been identified in UW-IMAP, which could be exploited by remote attackers to execute arbitrary commands. This flaw is due to a stack overflow error in the "mail_valid_net_parse_work()" [src/c-client/mail.c] function that does not properly handle specially crafted mailbox names containing a quote (") character, which could be exploited by authenticated remote attackers to execute arbitrary commands with the privileges of the IMAP server.

CVE-2005-2933 http://www.frsirt.com/english/advisories/2005/1953 http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities http://www.washington.edu/imap/documentation/RELNOTES.html 2005-10-05 2005-10-05
weex -- remote format string vulnerability weex 2.6.1.5_1

Emanuel Haupt reports:

Someone who controls an FTP server that weex will log in to can set up malicious data in the account that weex will use, and that will cause a format string bug that will allow remote code execution. It will only happen when weex is first run or when its cache files are rebuilt with the -r option, though. The vulnerability was found by Ulf Harnhammar.

ports/86833 2005-10-02 2005-10-02
picasm -- buffer overflow vulnerability picasm 1.12c

Shaun Colley reports:

When generating error and warning messages, picasm copies strings into fixed length buffers without bounds checking.

If an attacker could trick a user into assembling a source file with a malformed 'error' directive, arbitrary code could be executed with the privileges of the user. This could result in full system compromise.

13698 CVE-2005-1679 http://marc.theaimsgroup.com/?l=bugtraq&m=111661253517089 2005-05-20 2005-10-02
uim -- privilege escalation vulnerability ja-uim 0.4.9.1

The uim developers reports:

Masanari Yamamoto discovered that incorrect use of environment variables in uim. This bug causes privilege escalation if setuid/setgid applications was linked to libuim.

This bug appears in 'immodule for Qt' enabled Qt. (Normal Qt is also safe.) In some distribution, mlterm is also an setuid/setgid application.

http://lists.freedesktop.org/archives/uim/2005-September/001346.html 2005-09-28 2005-10-01
cfengine -- arbitrary file overwriting vulnerability cfengine 2.1.6_1 cfengine2 0

A Debian Security Advisory reports:

Javier Fernández-Sanguino Peña discovered several insecure temporary file uses in cfengine, a tool for configuring and maintaining networked machines, that can be exploited by a symlink attack to overwrite arbitrary files owned by the user executing cfengine, which is probably root.

CVE-2005-2960 14994 http://www.debian.org/security/2005/dsa-835 http://www.debian.org/security/2005/dsa-836 2005-10-01 2005-10-01 2005-10-07
clamav -- arbitrary code execution and DoS vulnerabilities clamav 0.87 clamav-devel 20050917

Gentoo Linux Security Advisory reports:

Clam AntiVirus is vulnerable to a buffer overflow in "libclamav/upx.c" when processing malformed UPX-packed executables. It can also be sent into an infinite loop in "libclamav/fsg.c" when processing specially-crafted FSG-packed executables.

By sending a specially-crafted file an attacker could execute arbitrary code with the permissions of the user running Clam AntiVirus, or cause a Denial of Service.

363713 CVE-2005-2919 CVE-2005-2920 http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml 2005-09-16 2005-09-24 2005-10-22
firefox & mozilla -- multiple vulnerabilities firefox 1.0.7,1 linux-firefox 1.0.7 mozilla 1.7.12,2 1.8.*,2 linux-mozilla 1.7.12 linux-mozilla-devel 0 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports of multiple issues:

Heap overrun in XBM image processing

jackerror reports that an improperly terminated XBM image ending with space characters instead of the expected end tag can lead to a heap buffer overrun. This appears to be exploitable to install or run malicious code on the user's machine.

Thunderbird does not support the XBM format and is not affected by this flaw.

Crash on "zero-width non-joiner" sequence

Mats Palmgren discovered that a reported crash on Unicode sequences with "zero-width non-joiner" characters was due to stack corruption that may be exploitable.

XMLHttpRequest header spoofing

It was possible to add illegal and malformed headers to an XMLHttpRequest. This could have been used to exploit server or proxy flaws from the user's machine, or to fool a server or proxy into thinking a single request was a stream of separate requests. The severity of this vulnerability depends on the value of servers which might be vulnerable to HTTP request smuggling and similar attacks, or which share an IP address (virtual hosting) with the attacker's page.

For users connecting to the web through a proxy this flaw could be used to bypass the same-origin restriction on XMLHttpRequests by fooling the proxy into handling a single request as multiple pipe-lined requests directed at arbitrary hosts. This could be used, for example, to read files on intranet servers behind a firewall.

Object spoofing using XBL <implements>

moz_bug_r_a4 demonstrated a DOM object spoofing bug similar to MFSA 2005-55 using an XBL control that <implements> an internal interface. The severity depends on the version of Firefox: investigation so far indicates Firefox 1.0.x releases don't expose any vulnerable functionality to interfaces spoofed in this way, but that early Deer Park Alpha 1 versions did.

XBL was changed to no longer allow unprivileged controls from web content to implement XPCOM interfaces.

JavaScript integer overflow

Georgi Guninski reported an integer overflow in the JavaScript engine. We presume this could be exploited to run arbitrary code under favorable conditions.

Privilege escalation using about: scheme

heatsync and shutdown report two different ways to bypass the restriction on loading high privileged "chrome" pages from an unprivileged "about:" page. By itself this is harmless--once the "about" page's privilege is raised the original page no longer has access--but should this be combined with a same-origin violation this could lead to arbitrary code execution.

Chrome window spoofing

moz_bug_r_a4 demonstrates a way to get a blank "chrome" canvas by opening a window from a reference to a closed window. The resulting window is not privileged, but the normal browser UI is missing and can be used to construct a spoof page without any of the safety features of the browser chrome designed to alert users to phishing sites, such as the address bar and the status bar.

CVE-2005-2701 CVE-2005-2702 CVE-2005-2703 CVE-2005-2704 CVE-2005-2705 CVE-2005-2706 CVE-2005-2707 http://www.mozilla.org/security/announce/mfsa2005-58.html 2005-09-22 2005-09-23 2005-10-26
firefox & mozilla -- command line URL shell command injection firefox 1.0.7,1 linux-firefox 1.0.7 mozilla 1.7.12,2 1.8.*,2 linux-mozilla 1.7.12 linux-mozilla-devel 0 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Secunia Advisory reports:

Peter Zelezny has discovered a vulnerability in Firefox, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the shell script used to launch Firefox parsing shell commands that are enclosed within backticks in the URL provided via the command line. This can e.g. be exploited to execute arbitrary shell commands by tricking a user into following a malicious link in an external application which uses Firefox as the default browser.

CVE-2005-2968 https://bugzilla.mozilla.org/show_bug.cgi?id=307185 http://secunia.com/advisories/16869/ http://www.mozilla.org/security/announce/mfsa2005-59.html 2005-09-06 2005-09-22 2005-10-26
apache -- Certificate Revocation List (CRL) off-by-one vulnerability apache 2.*2.0.54_1

Marc Stern reports an off-by-one vulnerability in within mod_ssl. The vulnerability lies in mod_ssl's Certificate Revocation List (CRL). If Apache is configured to use a CRL this could allow an attacker to crash a child process causing a Denial of Service.

14366 CVE-2005-1268 2005-07-12 2005-09-17
squirrelmail -- _$POST variable handling allows for various attacks squirrelmail ja-squirrelmail 1.4.01.4.5

A Squirrelmail Advisory reports:

An extract($_POST) was done in options_identities.php which allowed for an attacker to set random variables in that file. This could lead to the reading (and possible writing) of other people's preferences, cross site scripting or writing files in webserver-writable locations.

14254 CVE-2005-2095 http://www.squirrelmail.org/security/issue/2005-07-13 2005-07-13 2005-09-17 2005-09-19
X11 server -- pixmap allocation vulnerability XFree86-Server 4.5.0_2 xorg-server 6.8.2_5 6.8.996.8.99.12_1

Allocating large pixmaps by a client can trigger an integer overflow in the X server, potentially leading to execution of arbitrary code with elevated (root) privileges.

14807 102441 CVE-2005-2495 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166856 https://bugs.freedesktop.org/show_bug.cgi?id=594 2005-09-12 2005-09-15
unzip -- permission race vulnerability unzip zh-unzip ko-unzip 5.52_2

Imran Ghory reports a vulnerability within unzip. The vulnerability is caused by a race condition between extracting an archive and changing the permissions of the extracted files. This would give an attacker enough time to remove a file and hardlink it to another file owned by the user running unzip. When unzip changes the permissions of the file it could give the attacker access to files that normally would not have been accessible for others.

14450 CVE-2005-2475 http://marc.theaimsgroup.com/?l=bugtraq&m=112300046224117 2005-08-02 2005-09-13
firefox & mozilla -- buffer overflow vulnerability firefox 1.0.6_5,1 linux-firefox 1.0.7 mozilla 1.7.11_1,2 1.8.*,21.8.b1_5,2 linux-mozilla 1.7.12 linux-mozilla-devel 0 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

Tom Ferris reports:

A buffer overflow vulnerability exists within Firefox version 1.0.6 and all other prior versions which allows for an attacker to remotely execute arbitrary code on an affected host.

The problem seems to be when a hostname which has all dashes causes the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec to return true, but is sets encHost to an empty string. Meaning, Firefox appends 0 to approxLen and then appends the long string of dashes to the buffer instead.

Note: It is possible to disable IDN support as a workaround to protect against this buffer overflow. How to do this is described on the What Firefox and Mozilla users should know about the IDN buffer overflow security issue web page.

14784 573857 CVE-2005-2871 http://marc.theaimsgroup.com/?l=full-disclosure&m=112624614008387 http://www.mozilla.org/security/idn.html https://bugzilla.mozilla.org/show_bug.cgi?id=307259 http://www.mozilla.org/security/announce/mfsa2005-57.html 2005-09-08 2005-09-10 2005-10-26
htdig -- cross site scripting vulnerability htdig 3.2.0.b6_1

Michael Krax reports a vulnerability within htdig. The vulnerability lies within an unsanitized config parameter, allowing a malicious attacker to execute arbitrary scripting code on the target's browser. This might allow the attacker to obtain the user's cookies which are associated with the site, including cookies used for authentication.

12442 CVE-2005-0085 http://www.securitytracker.com/alerts/2005/Feb/1013078.html 2005-02-03 2005-09-04 2005-09-13
squid -- Denial Of Service Vulnerability in sslConnectTimeout squid 2.5.10_5

The squid patches page notes:

After certain slightly odd requests Squid crashes with a segmentation fault in sslConnectTimeout.

14731 CVE-2005-2796 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout http://www.squid-cache.org/bugs/show_bug.cgi?id=1355 http://secunia.com/advisories/16674/ 2005-07-21 2005-09-04 2005-10-02
squid -- Possible Denial Of Service Vulnerability in store.c squid 2.5.10_5

The squid patches page notes:

Squid crashes with the above assertion failure [assertion failed: store.c:523: "e->store_status == STORE_PENDING"] in certain conditions involving aborted requests.

14761 CVE-2005-2794 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING http://www.squid-cache.org/bugs/show_bug.cgi?id=1368 http://secunia.com/advisories/16708/ 2005-08-02 2005-09-04 2005-10-02
bind9 -- denial of service bind9 9.3.0 FreeBSD 5.35.3_16

Problem description

A DNSSEC-related validator function in BIND 9.3.0 contains an inappropriate internal consistency test. When this test is triggered, named(8) will exit.

Impact

On systems with DNSSEC enabled, a remote attacker may be able to inject a specially crafted packet that will cause the internal consistency test to trigger, and named(8) to terminate. As a result, the name server will no longer be available to service requests.

Workaround

DNSSEC is not enabled by default, and the "dnssec-enable" directive is not normally present. If DNSSEC has been enabled, disable it by changing the "dnssec-enable" directive to "dnssec-enable no;" in the named.conf(5) configuration file.

938617 CVE-2005-0034 http://www.uniras.gov.uk/niscc/docs/al-20050125-00060.html?lang=en http://www.isc.org/sw/bind/bind9.3.php#security 2005-01-25 2005-09-03
bind -- buffer overrun vulnerability bind84 8.4.48.4.6

An ISC advisory reports a buffer overrun vulnerability within bind. The vulnerability could result in a Denial of Service. A workaround is available by disabling recursion and glue fetching.

327633 CVE-2005-0033 http://www.uniras.gov.uk/niscc/docs/al-20050125-00059.html?lang=en http://www.isc.org/sw/bind/bind-security.php 2005-01-25 2005-09-03 2005-09-21
urban -- stack overflow vulnerabilities urban 1.5.3_2

Several filename-related stack overflow bugs allow a local attacker to elevate its privileges to the games group, since urban is installed setgid games.

Issue discovered and fixed by <shaun@rsc.cx>.

CVE-2005-2864 http://marc.theaimsgroup.com/?l=bugtraq&m=112604855119036 2005-09-02 2005-09-02 2005-09-22
fswiki - command injection vulnerability fswiki 3.5.9

There is a command injection vulnerability in admin page of fswiki.

http://jvn.jp/jp/JVN%2342435855/index.html 2005-08-29 2005-08-29
evolution -- remote format string vulnerabilities evolution 1.52.2.3_1

A SITIC Vulnerability Advisory reports:

Evolution suffers from several format string bugs when handling data from remote sources. These bugs lead to crashes or the execution of arbitrary assembly language code.

  1. The first format string bug occurs when viewing the full vCard data attached to an e-mail message.
  2. The second format string bug occurs when displaying contact data from remote LDAP servers.
  3. The third format string bug occurs when displaying task list data from remote servers.
  4. The fourth, and least serious, format string bug occurs when the user goes to the Calendars tab to save task list data that is vulnerable to problem 3 above. Other calendar entries that do not come from task lists are also affected.
14532 CVE-2005-2549 CVE-2005-2550 http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html 2005-08-10 2005-08-27 2006-03-24
pam_ldap -- authentication bypass vulnerability pam_ldap 1.8.0

Luke Howard reports:

If a pam_ldap client authenticates against an LDAP server that returns a passwordPolicyResponse control, but omits the optional "error" field of the PasswordPolicyResponseValue, then the LDAP authentication result will be ignored and the authentication step will always succeed.

CVE-2005-2641 778916 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163 2005-08-22 2005-08-27
pcre -- regular expression buffer overflow pcre pcre-utf8 6.2

The pcre library is vulnerable to a buffer overflow vulnerability due to insufficient validation of quantifier values. This could lead execution of arbitrary code with the permissions of the program using pcre by way of a specially crated regular expression.

14620 CVE-2005-2491 http://www.pcre.org/changelog.txt 2005-08-01 2005-08-26
elm -- remote buffer overflow in Expires header elm 2.5.8

Ulf Harnhammar has discovered a remotely exploitable buffer overflow in Elm e-mail client when parsing the Expires header of an e-mail message:

The attacker only needs to send the victim an e-mail message. When the victim with that message in his or her inbox starts Elm or simply views the inbox in an already started copy of Elm, the buffer overflow will happen immediately. The overflow is stack-based, and it gives full control over EIP, EBP and EBX. It is caused by a bad sscanf(3) call, using a format string containing "%s" to copy from a long char array to a shorter array.

http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html 2005-08-20 2005-08-23
openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server openvpn 2.0.1

James Yonan reports:

If two or more client machines try to connect to the server at the same time via TCP, using the same client certificate, and when --duplicate-cn is not enabled on the server, a race condition can crash the server with "Assertion failed at mtcp.c:411"

CVE-2005-2534 http://openvpn.net/changelog.html 2005-08-03 2005-08-19
openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory openvpn 2.0.1

James Yonan reports:

A malicious [authenticated] client in "dev tap" ethernet bridging mode could theoretically flood the server with packets appearing to come from hundreds of thousands of different MAC addresses, causing the OpenVPN process to deplete system virtual memory as it expands its internal routing table.

CVE-2005-2533 http://openvpn.net/changelog.html 2005-07-27 2005-08-19
openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients openvpn 2.0.1

James Yonan reports:

If the client sends a packet which fails to decrypt on the server, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error and responding to it, resulting in disconnection of the unrelated client.

CVE-2005-2532 http://openvpn.net/changelog.html 2005-07-27 2005-08-19
openvpn -- denial of service: client certificate validation can disconnect unrelated clients openvpn 2.0.1

James Yonan reports:

DoS attack against server when run with "verb 0" and without "tls-auth". If a client connection to the server fails certificate verification, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error and responding to it, resulting in disconnection of the unrelated client.

CVE-2005-2531 http://openvpn.net/changelog.html 2005-08-03 2005-08-19
tor -- diffie-hellman handshake flaw tor 0.1.0.14

A tor advisory reports

Tor clients can completely loose anonymity, confidentiality, and data integrity if the first Tor server in their path is malicious. Specifically, if the Tor client chooses a malicious Tor server for her first hop in the circuit, that server can learn all the keys she negotiates for the rest of the circuit (or just spoof the whole circuit), and then read and/or modify all her traffic over that circuit.

CVE-2005-2643 http://archives.seul.org/or/announce/Aug-2005/msg00002.html 2005-08-11 2005-08-17 2005-09-21
acroread -- plug-in buffer overflow vulnerability acroread 7.0.1 5.*,17.0.1,1 acroread4 acroread5 0 acroread7 7.0.1

A Adobe Security Advisory reports:

The identified vulnerability is a buffer overflow within a core application plug-in, which is part of Adobe Acrobat and Adobe Reader. If a malicious file were opened it could trigger a buffer overflow as the file is being loaded into Adobe Acrobat and Adobe Reader. A buffer overflow can cause the application to crash and increase the risk of malicious code execution.

CVE-2005-2470 http://www.adobe.com/support/techdocs/321644.html 2005-08-16 2005-08-16
pear-XML_RPC -- remote PHP code injection vulnerability pear-XML_RPC 1.4.0 phpmyfaq 1.4.11 drupal 4.6.3 eGroupWare 1.0.0.009 phpAdsNew 2.0.5 phpgroupware 0.9.16.007 b2evolution 0.9.0.12_2

A Hardened-PHP Project Security Advisory reports:

When the library parses XMLRPC requests/responses, it constructs a string of PHP code, that is later evaluated. This means any failure to properly handle the construction of this string can result in arbitrary execution of PHP code.

This new injection vulnerability is cause by not properly handling the situation, when certain XML tags are nested in the parsed document, that were never meant to be nested at all. This can be easily exploited in a way, that user-input is placed outside of string delimiters within the evaluation string, which obviously results in arbitrary code execution.

Note that several applications contains an embedded version on XML_RPC, therefor making them the vulnerable to the same code injection vulnerability.

CVE-2005-2498 http://b2evolution.net/news/2005/08/31/fix_for_xml_rpc_vulnerability_again_1 http://downloads.phpgroupware.org/changelog http://drupal.org/files/sa-2005-004/advisory.txt http://phpadsnew.com/two/nucleus/index.php?itemid=45 http://sourceforge.net/project/shownotes.php?release_id=349626 http://www.hardened-php.net/advisory_142005.66.html http://www.hardened-php.net/advisory_152005.67.html http://www.phpmyfaq.de/advisory_2005-08-15.php 2005-08-15 2005-08-15 2005-09-04
awstats -- arbitrary code execution vulnerability awstats 6.4_1

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation vulnerability in AWStats allows remote attackers to execute arbitrary commands.

The problem specifically exists because of insufficient input filtering before passing user-supplied data to an eval() function. As part of the statistics reporting function, AWStats displays information about the most common referrer values that caused users to visit the website. The referrer data is used without proper sanitation in an eval() statement, resulting in the execution of arbitrary perl code.

Successful exploitation results in the execution of arbitrary commands with permissions of the web service. Exploitation will not occur until the stats page has been regenerated with the tainted referrer values from the http access log. Note that AWStats is only vulnerable in situations where at least one URLPlugin is enabled.

CVE-2005-1527 http://marc.theaimsgroup.com/?l=full-disclosure&m=112377934108902 http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities 2005-08-09 2005-08-14 2005-08-23
libgadu -- multiple vulnerabilities gaim ja-gaim ko-gaim ru-gaim 1.4.0_1 kdenetwork 3.2.23.4.2 pl-ekg 1.6r3,1 centericq 4.21.0_1

Wojtek Kaniewski reports:

Multiple vulnerabilities have been found in libgadu, a library for handling Gadu-Gadu instant messaging protocol. It is a part of ekg, a Gadu-Gadu client, but is widely used in other clients. Also some of the user contributed scripts were found to behave in an insecure manner.

  • integer overflow in libgadu (CVE-2005-1852) that could be triggered by an incomming message and lead to application crash and/or remote code execution
  • insecure file creation (CVE-2005-1850) and shell command injection (CVE-2005-1851) in other user contributed scripts (discovered by Marcin Owsiany and Wojtek Kaniewski)
  • several signedness errors in libgadu that could be triggered by an incomming network data or an application passing invalid user input to the library
  • memory alignment errors in libgadu that could be triggered by an incomming message and lead to bus errors on architectures like SPARC
  • endianness errors in libgadu that could cause invalid behaviour of applications on big-endian architectures
14345 CVE-2005-1850 CVE-2005-1851 CVE-2005-1852 CVE-2005-2369 CVE-2005-2370 CVE-2005-2448 http://marc.theaimsgroup.com/?l=bugtraq&m=112198499417250 http://gaim.sourceforge.net/security/?id=20 http://www.kde.org/info/security/advisory-20050721-1.txt 2005-07-21 2005-08-12 2005-10-23
gaim -- AIM/ICQ non-UTF-8 filename crash gaim ja-gaim ko-gaim ru-gaim 1.4.0_1

The GAIM team reports:

A remote user could cause Gaim to crash on some systems by sending the Gaim user a file whose filename contains certain invalid characters. It is unknown what combination of systems are affected, but it is suspected that Windows users and systems with older versions of GTK+ are especially susceptible.

CVE-2005-2102 http://gaim.sourceforge.net/security/?id=21 2005-08-09 2005-08-12
gaim -- AIM/ICQ away message buffer overflow gaim ja-gaim ko-gaim ru-gaim 1.4.0_1

The GAIM team reports:

A remote AIM or ICQ user can cause a buffer overflow in Gaim by setting an away message containing many AIM substitution strings (such as %t or %n).

CVE-2005-2103 http://gaim.sourceforge.net/security/?id=22 2005-08-09 2005-08-12
xpdf -- disk fill DoS vulnerability xpdf 3.00_7 kdegraphics 3.4.2 gpdf 2.10.0_2 cups-base 1.1.23.0_5

xpdf is vulnerable to a denial of service vulnerability which can cause xpdf to create an infinitely large file, thereby filling up the /tmp partition, when opening a specially crafted PDF file.

Note that several applications contains an embedded version of xpdf, therefor making them the vulnerable to the same DoS. In CUPS this vulnerability would cause the pdftops filter to crash.

14529 CVE-2005-2097 http://rhn.redhat.com/errata/RHSA-2005-670.html http://www.kde.org/info/security/advisory-20050809-1.txt 2005-08-09 2005-08-12 2005-09-07
gforge -- XSS and email flood vulnerabilities gforge 0

Jose Antonio Coret reports that GForge contains multiple Cross Site Scripting vulnerabilities and an e-mail flood vulnerability:

The login form is also vulnerable to XSS (Cross Site Scripting) attacks. This may be used to launch phising attacks by sending HTML e-mails (i.e.: saying that you need to upgrade to the latest GForge version due to a security problem) and putting in the e-mail an HTML link that points to an specially crafted url that inserts an html form in the GForge login page and when the user press the login button, he/she send the credentials to the attackers website.

The 'forgot your password?' feature allows a remote user to load a certain URL to cause the service to send a validation e-mail to the specified user's e-mail address. There is no limit to the number of messages sent over a period of time, so a remote user can flood the target user's secondary e-mail address. E-Mail Flood, E-Mail bomber.

14405 CVE-2005-2430 CVE-2005-2431 http://marc.theaimsgroup.com/?l=bugtraq&m=112259845904350 2005-07-27 2005-08-09
postnuke -- multiple vulnerabilities postnuke 0.760

Postnuke Security Announcementss reports of the following vulnerabilities:

  • missing input validation within /modules/Messages/readpmsg.php
  • possible path disclosure within /user.php
  • possible path disclosure within /modules/News/article.php
  • possible remote code injection within /includes/pnMod.php
  • possible cross-site-scripting in /index.php
  • remote code injection via xml rpc library
CVE-2005-1621 CVE-2005-1695 CVE-2005-1696 CVE-2005-1698 CVE-2005-1777 CVE-2005-1778 CVE-2005-1921 http://marc.theaimsgroup.com/?l=bugtraq&m=111721364707520 http://secunia.com/advisories/15450/ http://news.postnuke.com/Article2691.html http://news.postnuke.com/Article2699.html 2005-05-27 2005-08-08
mambo -- multiple vulnerabilities mambo 4.5.2.3

A Secunia Advisory reports:

Some vulnerabilities have been reported in Mambo, where some have unknown impacts and others can be exploited by malicious people to conduct spoofing and SQL injection attacks.

  1. Input passed to the "user_rating" parameter when voting isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
  2. Some unspecified vulnerabilities in the "mosDBTable" class and the "DOMIT" library have an unknown impact.
  3. An unspecified error in the "administrator/index3.php" script can be exploited to spoof session IDs.
13966 CVE-2005-2002 http://secunia.com/advisories/15710/ 2005-06-15 2005-08-05
ipsec -- Incorrect key usage in AES-XCBC-MAC FreeBSD 5.45.4_6 5.*5.3_20

Problem description

A programming error in the implementation of the AES-XCBC-MAC algorithm for authentication resulted in a constant key being used instead of the key specified by the system administrator.

Impact

If the AES-XCBC-MAC algorithm is used for authentication in the absence of any encryption, then an attacker may be able to forge packets which appear to originate from a different system and thereby succeed in establishing an IPsec session. If access to sensitive information or systems is controlled based on the identity of the source system, this may result in information disclosure or privilege escalation.

CVE-2005-2359 SA-05:19.ipsec 2005-07-27 2005-08-05
zlib -- buffer overflow vulnerability linux_base-suse 9.3_1 FreeBSD 5.45.4_6 5.35.3_20

Problem description

A fixed-size buffer is used in the decompression of data streams. Due to erronous analysis performed when zlib was written, this buffer, which was belived to be sufficiently large to handle any possible input stream, is in fact too small.

Impact

A carefully constructed compressed data stream can result in zlib overwriting some data structures. This may cause applications to halt, resulting in a denial of service; or it may result in an attacker gaining elevated privileges.

CVE-2005-1849 SA-05:18.zlib 2005-07-27 2005-08-05 2005-09-24
devfs -- ruleset bypass FreeBSD 5.45.4_5 5.*5.3_19

Problem description

Due to insufficient parameter checking of the node type during device creation, any user can expose hidden device nodes on devfs mounted file systems within their jail. Device nodes will be created in the jail with their normal default access permissions.

Impact

Jailed processes can get access to restricted resources on the host system. For jailed processes running with superuser privileges this implies access to all devices on the system. This level of access can lead to information leakage and privilege escalation.

CVE-2005-2218 SA-05:17.devfs 2005-07-20 2005-08-05
proftpd -- format string vulnerabilities proftpd proftpd-mysql 1.3.0.rc2

The ProFTPD release notes states:

sean <infamous42md at hotpop.com> found two format string vulnerabilities, one in mod_sql's SQLShowInfo directive, and one involving the 'ftpshut' utility. Both can be considered low risk, as they require active involvement on the part of the site administrator in order to be exploited.

These vulnerabilities could potentially lead to information disclosure, a denial-of-server situation, or execution of arbitrary code with the permissions of the user running ProFTPD.

CVE-2005-2390 http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2 2005-07-26 2005-08-03
nbsmtp -- format string vulnerability nbsmtp 0.99_1

When nbsmtp is executed in debug mode, server messages will be printed to stdout and logged via syslog. Syslog is used insecurely and user-supplied format characters are directly fed to the syslog function, which results in a format string vulnerability.

Under some circumstances, an SMTP server may be able to abuse this vulnerability in order to alter the nbsmtp process and execute malicious code.

http://people.freebsd.org/~niels/issues/nbsmtp-20050726.txt 2005-07-25 2005-08-01
sylpheed -- MIME-encoded file name buffer overflow vulnerability sylpheed sylpheed-gtk2 sylpheed-claws 1.0.4

Sylpheed is vulnerable to a buffer overflow when displaying emails with attachments that have MIME-encoded file names. This could be used by a remote attacker to crash sylpheed potentially allowing execution of arbitrary code with the permissions of the user running sylpheed.

12934 CVE-2005-0926 http://sylpheed.good-day.net/changelog.html.en 2005-03-29 2005-07-31
phpmyadmin -- cross site scripting vulnerability phpmyadmin phpMyAdmin 2.6.2.r1

A phpMyAdmin security announcement reports:

The convcharset parameter was not correctly validated, opening the door to a XSS attack.

12982 CVE-2005-0992 http://marc.theaimsgroup.com/?l=bugtraq&m=111264361622660 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3 2005-04-03 2005-07-31
gnupg -- OpenPGP symmetric encryption vulnerability gnupg 1.4.1 p5-Crypt-OpenPGP 1.03 pgp 3.0

Serge Mister and Robert Zuccherato reports that the OpenPGP protocol is vulnerable to a cryptographic attack when using symmetric encryption in an automated way.

David Shaw reports about the impact:

This attack, while very significant from a cryptographic point of view, is not generally effective in the real world. To be specific, unless you have your OpenPGP program set up as part of an automated system to accept encrypted messages, decrypt them, and then provide a response to the submitter, then this does not affect you at all.

Note that the fix in GnuPG does note completely eliminate the potential problem:

These patches disable a portion of the OpenPGP protocol that the attack is exploiting. This change should not be user visible. With the patch in place, this attack will not work using a public-key encrypted message. It will still work using a passphrase-encrypted message.

303094 CVE-2005-0366 http://eprint.iacr.org/2005/033 http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html http://www.pgp.com/newsroom/ctocorner/openpgp.html 2005-02-08 2005-07-31 2007-04-23
vim -- vulnerabilities in modeline handling: glob, expand vim vim-lite vim+ruby 6.36.3.82

Georgi Guninski discovered a way to construct Vim modelines that execute arbitrary shell commands. The vulnerability can be exploited by including shell commands in modelines that call the glob() or expand() functions. An attacker could trick an user to read or edit a trojaned file with modelines enabled, after which the attacker is able to execute arbitrary commands with the privileges of the user.

Note: It is generally recommended that VIM users use set nomodeline in ~/.vimrc to avoid the possibility of trojaned text files.

14374 CVE-2005-2368 http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html 2005-07-25 2005-07-31
tiff -- buffer overflow vulnerability tiff 3.7.3 linux-tiff 3.6.1_3 pdflib pdflib-perl 6.0.1_2 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

A Gentoo Linux Security Advisory reports:

Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a stack based buffer overflow in the libTIFF library when reading a TIFF image with a malformed BitsPerSample tag.

Successful exploitation would require the victim to open a specially crafted TIFF image, resulting in the execution of arbitrary code.

CVE-2005-1544 http://bugzilla.remotesensing.org/show_bug.cgi?id=843 http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml http://www.remotesensing.org/libtiff/v3.7.3.html 2005-05-10 2005-07-30 2006-06-08
opera -- image dragging vulnerability linux-opera opera-devel opera 8.02

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to conduct cross-site scripting attacks and retrieve a user's files.

The vulnerability is caused due to Opera allowing a user to drag e.g. an image, which is actually a "javascript:" URI, resulting in cross-site scripting if dropped over another site. This may also be used to populate a file upload form, resulting in uploading of arbitrary files to a malicious web site.

Successful exploitation requires that the user is tricked into dragging and dropping e.g. an image or a link.

http://secunia.com/advisories/15756/ http://www.opera.com/freebsd/changelogs/802/ 2005-07-28 2005-07-30 2006-06-08
opera -- download dialog spoofing vulnerability linux-opera opera-devel opera 8.02

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to trick users into executing malicious files.

The vulnerability is caused due to an error in the handling of extended ASCII codes in the download dialog. This can be exploited to spoof the file extension in the file download dialog via a specially crafted "Content-Disposition" HTTP header.

Successful exploitation may result in users being tricked into executing a malicious file via the download dialog, but requires that the "Arial Unicode MS" font (ARIALUNI.TTF) has been installed on the system.

http://secunia.com/advisories/15870/ http://www.opera.com/freebsd/changelogs/802/ 2005-07-28 2005-07-30
ethereal -- multiple protocol dissectors vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.8.50.10.12

An Ethreal Security Advisories reports:

Our testing program has turned up several more security issues:

  • The LDAP dissector could free static memory and crash.
  • The AgentX dissector could crash.
  • The 802.3 dissector could go into an infinite loop.
  • The PER dissector could abort.
  • The DHCP dissector could go into an infinite loop.
  • The BER dissector could abort or loop infinitely.
  • The MEGACO dissector could go into an infinite loop.
  • The GIOP dissector could dereference a null pointer.
  • The SMB dissector was susceptible to a buffer overflow.
  • The WBXML could dereference a null pointer.
  • The H1 dissector could go into an infinite loop.
  • The DOCSIS dissector could cause a crash.
  • The SMPP dissector could go into an infinite loop.
  • SCTP graphs could crash.
  • The HTTP dissector could crash.
  • The SMB dissector could go into a large loop.
  • The DCERPC dissector could crash.
  • Several dissectors could crash while reassembling packets.

Steve Grubb at Red Hat found the following issues:

  • The CAMEL dissector could dereference a null pointer.
  • The DHCP dissector could crash.
  • The CAMEL dissector could crash.
  • The PER dissector could crash.
  • The RADIUS dissector could crash.
  • The Telnet dissector could crash.
  • The IS-IS LSP dissector could crash.
  • The NCP dissector could crash.

iDEFENSE found the following issues:

  • Several dissectors were susceptible to a format string overflow.

Impact:

It may be possible to make Ethereal crash, use up available memory, or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

http://www.ethereal.com/appnotes/enpa-sa-00020.html 2005-07-26 2005-07-30
apache -- http request smuggling apache 1.3.33_2 2.*2.0.54_1 2.1.02.1.6_1 apache+ssl 1.3.33.1.55_1 apache+mod_perl 1.3.33_3 apache+mod_ssl apache+mod_ssl+ipv6 apache+mod_ssl+mod_accel apache+mod_ssl+mod_accel+ipv6 apache+mod_ssl+mod_accel+mod_deflate apache+mod_ssl+mod_accel+mod_deflate+ipv6 apache+mod_ssl+mod_deflate apache+mod_ssl+mod_deflate+ipv6 apache+mod_ssl+mod_snmp apache+mod_ssl+mod_snmp+mod_accel apache+mod_ssl+mod_snmp+mod_accel+ipv6 apache+mod_ssl+mod_snmp+mod_deflate apache+mod_ssl+mod_snmp+mod_deflate+ipv6 apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 1.3.33+2.8.22_1 apache_fp apache+ipv6 0 ru-apache 1.3.34+30.22 ru-apache+mod_ssl 1.3.34+30.22+2.8.25

A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this vulnerability requires multiple carefully crafted HTTP requests, taking advantage of an caching server, proxy server, web application firewall etc. This only affects installations where Apache is used as HTTP proxy in combination with the following web servers:

  • IIS/6.0 and 5.0
  • Apache 2.0.45 (as web server)
  • apache 1.3.29
  • WebSphere 5.1 and 5.0
  • WebLogic 8.1 SP1
  • Oracle9iAS web server 9.0.2
  • SunONE web server 6.1 SP4
14106 CVE-2005-2088 http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf 2005-07-25 2005-07-26 2005-12-25
clamav -- multiple remote buffer overflows clamav 0.86.2 clamav-devel 20050704

An Secunia Advisory reports:

Neel Mehta and Alex Wheeler have reported some vulnerabilities in Clam AntiVirus, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

  1. Two integer overflow errors in "libclamav/tnef.c" when processing TNEF files can be exploited to cause a heap-based buffer overflow via a specially crafted TNEF file with a length value of -1 in the header.
  2. An integer overflow error in "libclamav/chmunpack.c" can be exploited to cause a heap-based buffer overflow via a specially crafted CHM file with a chunk entry that has a filename length of -1.
  3. A boundary error in "libclamav/fsg.c" when processing a FSG compressed file can cause a heap-based buffer overflow.
http://www.rem0te.com/public/images/clamav.pdf http://secunia.com/advisories/16180/ 2005-07-24 2005-07-25
isc-dhcpd -- format string vulnerabilities isc-dhcp3-client isc-dhcp3-devel isc-dhcp3-relay isc-dhcp3-server isc-dhcp3 isc-dhcp isc-dhcpd 3.0.1

The ISC DHCP programs are vulnerable to several format string vulnerabilities which may allow a remote attacker to execute arbitrary code with the permissions of the DHCP programs, typically root for the DHCP server.

11591 448384 CVE-2004-1006 http://marc.theaimsgroup.com/?l=dhcp-announce&m=109996073218290 2004-11-08 2005-07-23
egroupware -- multiple cross-site scripting (XSS) and SQL injection vulnerabilities egroupware 1.0.0.007

Multiple cross-site scripting (XSS) vulnerabilities in eGroupware before 1.0.0.007 allow remote attackers to inject arbitrary web script or HTML via the (1) ab_id, (2) page, (3) type, or (4) lang parameter to index.php or (5) category_id parameter.

Multiple SQL injection vulnerabilities in index.php in eGroupware before 1.0.0.007 allow remote attackers to execute arbitrary SQL commands via the (1) filter or (2) cats_app parameter.

CVE-2005-1202 CVE-2005-1203 http://sourceforge.net/project/shownotes.php?release_id=320768 2005-04-20 2005-07-23
fetchmail -- denial of service/crash from malicious POP3 server fetchmail 6.2.5.1

In fetchmail 6.2.5.1, the the remote code injection via POP3 UIDL was fixed, but a denial of service attack was introduced:

Two possible NULL-pointer dereferences allow a malicous POP3 server to crash fetchmail by respondig with UID lines containing only the article number but no UID (in violation of RFC-1939), or a message without Message-ID when no UIDL support is available.

http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt 2005-07-21 2005-07-22
dnrd -- remote buffer and stack overflow vulnerabilities dnrd 2.19.1

Natanael Copa reports that dnrd is vulnerable to a remote buffer overflow and a remote stack overflow. These vulnerabilities can be triggered by sending invalid DNS packets to dnrd.

The buffer overflow could potentially be used to execute arbitrary code with the permissions of the dnrd daemon. Note that dnrd runs in an chroot environment and runs as non-root.

The stack overflow vulnerability can cause dnrd to crash.

CVE-2005-2315 CVE-2005-2316 ports/83851 2005-07-21 2005-07-21
PowerDNS -- LDAP backend fails to escape all queries powerdns 2.9.18

The LDAP backend in PowerDNS has issues with escaping queries which could cause connection errors. This would make it possible for a malicious user to temporarily blank domains.

This is known to affect all releases prior to 2.9.18.

CVE-2005-2302 http://doc.powerdns.com/security-policy.html http://marc.theaimsgroup.com/?l=bugtraq&m=112155941310297&w=2 2005-07-16 2005-07-21
fetchmail -- remote root/code injection from malicious POP3 server fetchmail 6.2.5.1

fetchmail's POP3/UIDL code does not truncate received UIDs properly. A malicious or compromised POP3 server can thus corrupt fetchmail's stack and inject code when fetchmail is using UIDL, either through configuration, or as a result of certain server capabilities. Note that fetchmail is run as root on some sites, so an attack might compromise the root account and thus the whole machine.

CVE-2005-2335 ports/83805 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762 http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt 2005-07-20 2005-07-20 2005-07-21
kdebase -- Kate backup file permission leak kdebase 3.2.03.4.1 linux_base-suse 9.39.3_2

A KDE Security Advisory explains:

Kate / Kwrite create a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set.

Depending on the system security settings, backup files might be readable by other users. Kate / Kwrite are network transparent applications and therefore this vulnerability might not be restricted to local users.

CVE-2005-1920 https://bugs.kde.org/show_bug.cgi?id=103331 http://www.kde.org/info/security/advisory-20050718-1.txt 2005-07-18 2005-07-18 2005-10-09
firefox & mozilla -- multiple vulnerabilities firefox 1.0.5,1 linux-firefox 1.0.5 mozilla 1.7.9,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.9 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

The Mozilla Foundation reports of multiple security vulnerabilities in Firefox and Mozilla:

  • MFSA 2005-56 Code execution through shared function objects
  • MFSA 2005-55 XHTML node spoofing
  • MFSA 2005-54 Javascript prompt origin spoofing
  • MFSA 2005-53 Standalone applications can run arbitrary code through the browser
  • MFSA 2005-52 Same origin violation: frame calling top.focus()
  • MFSA 2005-51 The return of frame-injection spoofing
  • MFSA 2005-50 Possibly exploitable crash in InstallVersion.compareTo()
  • MFSA 2005-49 Script injection from Firefox sidebar panel using data:
  • MFSA 2005-48 Same-origin violation with InstallTrigger callback
  • MFSA 2005-47 Code execution via "Set as Wallpaper"
  • MFSA 2005-46 XBL scripts ran even when Javascript disabled
  • MFSA 2005-45 Content-generated event vulnerabilities
CVE-2005-1937 CVE-2005-2260 CVE-2005-2261 CVE-2005-2262 CVE-2005-2263 CVE-2005-2264 CVE-2005-2265 CVE-2005-2266 CVE-2005-2267 CVE-2005-2268 CVE-2005-2269 CVE-2005-2270 http://www.mozilla.org/projects/security/known-vulnerabilities.html http://www.mozilla.org/security/announce/mfsa2005-45.html http://www.mozilla.org/security/announce/mfsa2005-46.html http://www.mozilla.org/security/announce/mfsa2005-47.html http://www.mozilla.org/security/announce/mfsa2005-48.html http://www.mozilla.org/security/announce/mfsa2005-49.html http://www.mozilla.org/security/announce/mfsa2005-50.html http://www.mozilla.org/security/announce/mfsa2005-51.html http://www.mozilla.org/security/announce/mfsa2005-52.html http://www.mozilla.org/security/announce/mfsa2005-53.html http://www.mozilla.org/security/announce/mfsa2005-54.html http://www.mozilla.org/security/announce/mfsa2005-55.html http://www.mozilla.org/security/announce/mfsa2005-56.html 2005-07-12 2005-07-16
drupal -- PHP code execution vulnerabilities drupal 4.6.2

Kuba Zygmunt discovered a flaw in the input validation routines of Drupal's filter mechanism. An attacker could execute arbitrary PHP code on a target site when public comments or postings are allowed.

CVE-2005-1921 CVE-2005-2106 http://drupal.org/files/sa-2005-002/advisory.txt 2005-06-29 2005-07-16
phpSysInfo -- cross site scripting vulnerability phpSysInfo 2.5.1

A Securityreason.com advisory reports that various cross site scripting vulnerabilities have been found in phpSysInfo. Input is not properly sanitised before it is returned to the user. A malicious person could exploit this to execute arbitrary HTML and script code in a users browser session. Also it is possible to view the full path of certain scripts by accessing them directly.

12887 CVE-2005-0869 CVE-2005-0870 http://marc.theaimsgroup.com/?l=bugtraq&m=111161017209422 2005-03-22 2005-07-09 2005-12-25
mysql-server -- insecure temporary file creation mysql-server 4.14.1.12 5.05.0.6

A Zataz advisory reports that MySQL contains a security flaw which could allow a malicious local user to inject arbitrary SQL commands during the initial database creation process.

The problem lies in the mysql_install_db script which creates temporary files based on the PID used by the script.

13660 CVE-2005-1636 http://www.zataz.net/adviso/mysql-05172005.txt 2005-05-07 2005-07-09
net-snmp -- fixproc insecure temporary file creation net-snmp 5.2.1.2

A Gentoo advisory reports:

Net-SNMP creates temporary files in an insecure manner, possibly allowing the execution of arbitrary code.

A malicious local attacker could exploit a race condition to change the content of the temporary files before they are executed by fixproc, possibly leading to the execution of arbitrary code. A local attacker could also create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When fixproc is executed, this would result in the file being overwritten.

13715 CVE-2005-1740 http://security.gentoo.org/glsa/glsa-200505-18.xml 2005-05-23 2005-07-09 2005-07-13
phpbb -- multiple vulnerabilities phpbb 2.0.12

phpBB is vulnerable to remote exploitation of an input validation vulnerability allows attackers to read the contents of arbitrary system files under the privileges of the webserver. This also allows remote attackers to unlink arbitrary system files under the privileges of the webserver.

12618 12621 12623 CVE-2005-0258 CVE-2005-0259 http://security.gentoo.org/glsa/glsa-200503-02.xml http://www.idefense.com/application/poi/display?id=205&type=vulnerabilities http://www.idefense.com/application/poi/display?id=204&type=vulnerabilities 2005-02-22 2005-07-09
shtool -- insecure temporary file creation shtool 2.0.1

A Zataz advisory reports that shtool contains a security flaw which could allow a malicious local user to create or overwrite the contents of arbitrary files. The attacker could fool a user into executing the arbitrary file possibly executing arbitrary code.

13767 http://www.zataz.net/adviso/shtool-05252005.txt 2005-05-25 2005-07-09
phppgadmin -- "formLanguage" local file inclusion vulnerability phppgadmin 3.5.4

A Secunia Advisory reports:

A vulnerability has been reported in phpPgAdmin, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "formLanguage" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

14142 CVE-2005-2256 http://secunia.com/advisories/15941/ http://sourceforge.net/project/shownotes.php?release_id=342261 2005-07-05 2005-07-08 2005-07-21
pear-XML_RPC -- information disclosure vulnerabilities pear-XML_RPC 1.3.2

The pear-XML_RPC release notes reports that the following issues has been fixed:

Eliminate path disclosure vulnerabilities by suppressing error messages when eval()'ing.

Eliminate path disclosure vulnerability by catching bogus parameters submitted to XML_RPC_Value::serializeval().

http://pear.php.net/package/XML_RPC/download/1.3.2 2005-07-07 2005-07-08
ekg -- insecure temporary file creation pl-ekg 1.6r2,1

Eric Romang reports that ekg creates temporary files in an insecure manner. This can be exploited by an attacker using a symlink attack to overwrite arbitrary files and possibly execute arbitrary commands with the permissions of the user running ekg.

14146 CVE-2005-1916 http://marc.theaimsgroup.com/?l=bugtraq&m=112060146011122 http://bugs.gentoo.org/show_bug.cgi?id=94172 2005-07-05 2005-07-08 2005-07-31
bugzilla -- multiple vulnerabilities bugzilla ja-bugzilla 2.17.12.18.2

A Bugzilla Security Advisory reports:

Any user can change any flag on any bug, even if they don't have access to that bug, or even if they can't normally make bug changes. This also allows them to expose the summary of a bug.

Bugs are inserted into the database before they are marked as private, in Bugzilla code. Thus, MySQL replication can lag in between the time that the bug is inserted and when it is marked as private (usually less than a second). If replication lags at this point, the bug summary will be accessible to all users until replication catches up. Also, on a very slow machine, there may be a pause longer than a second that allows users to see the title of the newly-filed bug.

CVE-2005-2173 CVE-2005-2174 http://www.bugzilla.org/security/2.18.1/ https://bugzilla.mozilla.org/show_bug.cgi?id=292544 https://bugzilla.mozilla.org/show_bug.cgi?id=293159 2005-07-07 2005-07-08 2005-07-18
nwclient -- multiple vulnerabilities nwclient 0

Insecure file permissions, network access control and DNS usage put systems that use Legato NetWorker at risk.

When the software is running, several files that contain sensitive information are created with insecure permissions. The information exposed include passwords and can therefore be used for privilege elevation.

An empty "servers" file, which should normally contain hostnames of authorized backup servers, may allow unauthorized backups to be made. Sensitive information can be extracted from these backups.

When reverse DNS fails for the Legato client IP a weak authorization scheme, containing a flaw that allows unauthorized access, is used. This may allow unauthorized access.

3564 3840 3842 CVE-2001-0910 CVE-2002-0113 CVE-2002-0114 http://portal1.legato.com/resources/bulletins/372.html 2002-01-10 2005-07-08
acroread -- insecure temporary file creation acroread4 acroread5 0 acroread 7.0.0 5.*,17.0.0,1

Secunia Research reports:

Secunia has discovered a security issue in Adobe Reader for Linux, which can be exploited by malicious, local users to gain knowledge of sensitive information.

The problem is caused due to temporary files being created with permissions based on a user's umask in the "/tmp" folder under certain circumstances when documents are opened.

Successful exploitation allows an unprivileged user to read arbitrary users' documents.

CVE-2005-1912 http://secunia.com/secunia_research/2005-6/advisory/ 2005-06-29 2005-07-06
clamav -- cabinet file handling DoS vulnerability clamav 0.86 clamav-devel 20050620

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation error in Clam AntiVirus ClamAV allows attackers to cause a denial of service condition.

The vulnerability specifically exists due to insufficient validation on cabinet file header data. The ENSURE_BITS() macro fails to check for zero length reads, allowing a carefully constructed cabinet file to cause an infinite loop.

ClamAV is used in a number of mail gateway products. Successful exploitation requires an attacker to send a specially constructed CAB file through a mail gateway or personal anti-virus client utilizing the ClamAV scanning engine. The infinate loop will cause the ClamAV software to use all available processor resources, resulting in a denial of service or severe degradation to system performance. Remote exploitation can be achieved by sending a malicious file in an e-mail message or during an HTTP session.

CVE-2005-1923 http://marc.theaimsgroup.com/?l=bugtraq&m=112006456809016 2005-06-29 2005-07-06
clamav -- MS-Expand file handling DoS vulnerability clamav 0.86 clamav-devel 20050620

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation error in Clam AntiVirus ClamAV allows attackers to cause a denial of service condition.

The vulnerability specifically exists due to improper behavior during exceptional conditions.

Successful exploitation allows attackers to exhaust file descriptors pool and memory. Anti-virus detection functionality will fail if there is no file descriptors available with which to open files. Remote exploitation can be achieved by sending a malicious file in an e-mail message or during an HTTP session.

CVE-2005-1922 http://marc.theaimsgroup.com/?l=bugtraq&m=112006402411598 2005-06-29 2005-07-06
zlib -- buffer overflow vulnerability zsync 0.4.1 FreeBSD 5.45.4_4 5.35.3_18

Problem Description

An error in the handling of corrupt compressed data streams can result in a buffer being overflowed.

Impact

By carefully crafting a corrupt compressed data stream, an attacker can overwrite data structures in a zlib-using application. This may cause the application to halt, causing a denial of service; or it may result in the attacker gaining elevated privileges.

CVE-2005-2096 SA-05:16.zlib 2005-07-06 2005-07-06 2005-10-01
acroread -- buffer overflow vulnerability acroread4 acroread5 0 acroread 7.0.0 5.*,17.0.0,1

An Adobe Security Advisory reports:

A vulnerability within Adobe Reader has been identified. Under certain circumstances, remote exploitation of a buffer overflow in Adobe Reader could allow an attacker to execute arbitrary code.

If exploited, it could allow the execution of arbitrary code under the privileges of the local user. Remote exploitation is possible if the malicious PDF document is sent as an email attachment or if the PDF document is accessed via a web link.

CVE-2005-1625 http://www.adobe.com/support/techdocs/329083.html http://marc.theaimsgroup.com/?l=bugtraq&m=112059685332569 2005-07-05 2005-07-06
net-snmp -- remote DoS vulnerability net-snmp 5.2.1.2

A Net-SNMP release announcement reports:

A security vulnerability has been found in Net-SNMP releases that could allow a denial of service attack against Net-SNMP agent's which have opened a stream based protocol (EG, TCP but not UDP; it should be noted that Net-SNMP does not by default open a TCP port).

14168 CVE-2005-2177 http://marc.theaimsgroup.com/?l=net-snmp-announce&m=112059518426328 2005-07-02 2005-07-05 2005-10-26
cacti -- multiple vulnerabilities cacti 0.8.6f

Stefan Esser reports:

Wrongly implemented user input filters lead to multiple SQL Injection vulnerabilities which can lead f.e. to disclosure of the admin password hash.

Wrongly implemented user input filters allows injection of user input into executed commandline.

Alberto Trivero posted his Remote Command Execution Exploit for Cacti <= 0.8.6d to Bugtraq on the 22th June. Having analysed his bug we come to the conclusion, that the malfunctioning input filters, which were already mentioned in the previous advisory are also responsible for this bug still being exploitable.

A HTTP headers bypass switch can also be used to completely bypass the authentification system of Cacti. As admin it is possible to execute shell commands with the permission of the webserver.

While looking at the source of Cacti a HTTP headers bypass switch was discovered, that also switches off a call to session_start() and the manual application of addslashes() in case of magic_quotes_gpc=Off.

When register_globals is turned on* an attacker can use this switch to disables Cacti's use of PHP's session support and therefore supply the session variables on his own through f.e. the URL. Additionally using the switch renders several SQL statements vulnerable to SQL Injections attacks, when magic_quotes_gpc is turned off, which is the recommended setting.

Logged in as an admin it is possible to issue shell commands.

(*) register_globals is turned off by default since PHP 4.2 but is activated on most servers because of older scripts requiring it.

http://marc.theaimsgroup.com/?l=bugtraq&m=111954136315248 http://www.hardened-php.net/advisory-032005.php http://www.hardened-php.net/advisory-042005.php http://www.hardened-php.net/advisory-052005.php 2005-06-22 2005-07-05
wordpress -- multiple vulnerabilities wordpress 1.5.1.3,1

GulfTech Security Research reports:

There are a number of vulnerabilities in WordPress that may allow an attacker to ultimately run arbitrary code on the vulnerable system. These vulnerabilities include SQL Injection, Cross Site Scripting, and also issues that may aid an attacker in social engineering.

CVE-2005-2107 CVE-2005-2108 CVE-2005-2109 CVE-2005-2110 http://marc.theaimsgroup.com/?l=bugtraq&m=112006967221438 2005-06-28 2005-07-05
wordpress -- multiple vulnerabilities wordpress 1.5.1.2,1

A Gentoo Linux Security Advisory reports:

Due to a lack of input validation, WordPress is vulnerable to SQL injection and XSS attacks.

An attacker could use the SQL injection vulnerabilites to gain information from the database. Furthermore the cross-site scripting issues give an attacker the ability to inject and execute malicious script code or to steal cookie-based authentication credentials, potentially compromising the victim's browser.

CVE-2005-1810 http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml 2005-04-12 2005-07-05
phpbb -- remote PHP code execution vulnerability phpbb 2.0.16

FrSIRT Advisory reports:

A vulnerability was identified in phpBB, which may be exploited by attackers to compromise a vulnerable web server. This flaw is due to an input validation error in the "viewtopic.php" script that does not properly filter the "highlight" parameter before calling the "preg_replace()" function, which may be exploited by remote attackers to execute arbitrary PHP commands with the privileges of the web server.

CVE-2005-2086 http://www.frsirt.com/english/advisories/2005/0904 http://www.phpbb.com/phpBB/viewtopic.php?t=302011 2005-06-28 2005-07-03 2005-07-07
pear-XML_RPC -- arbitrary remote code execution pear-XML_RPC 1.3.1

GulfTech Security Research Team reports:

PEAR XML_RPC is vulnerable to a very high risk php code injection vulnerability due to unsanatized data being passed into an eval() call.

CVE-2005-1921 http://www.gulftech.org/?node=research&article_id=00087-07012005 http://www.hardened-php.net/advisory-022005.php 2005-06-29 2005-07-03
kernel -- ipfw packet matching errors with address tables FreeBSD 5.45.4_3

Problem Description

The ipfw tables lookup code caches the result of the last query. The kernel may process multiple packets concurrently, performing several concurrent table lookups. Due to an insufficient locking, a cached result can become corrupted that could cause some addresses to be incorrectly matched against a lookup table.

Impact

When lookup tables are used with ipfw, packets may on very rare occasions incorrectly match a lookup table. This could result in a packet being treated contrary to the defined packet filtering ruleset. For example, a packet may be allowed to pass through when it should have been discarded.

The problem can only occur on Symmetric Multi-Processor (SMP) systems, or on Uni Processor (UP) systems with the PREEMPTION kernel option enabled (not the default).

Workaround

a) Do not use lookup tables.

OR

b) Disable concurrent processing of packets in the network stack by setting the "debug.mpsafenet=0" tunable:

# echo "debug.mpsafenet=0" << /boot/loader.conf

CVE-2005-2019 SA-05:13.ipfw 2005-06-29 2005-06-29 2005-07-06
bzip2 -- denial of service and permission race vulnerabilities FreeBSD 5.45.4_3 5.*5.3_17 4.114.11_11 4.10_16 bzip2 1.0.3_1

Problem Description

Two problems have been discovered relating to the extraction of bzip2-compressed files. First, a carefully constructed invalid bzip2 archive can cause bzip2 to enter an infinite loop. Second, when creating a new file, bzip2 closes the file before setting its permissions.

Impact

The first problem can cause bzip2 to extract a bzip2 archive to an infinitely large file. If bzip2 is used in automated processing of untrusted files this could be exploited by an attacker to create an denial-of-service situation by exhausting disk space or by consuming all available cpu time.

The second problem can allow a local attacker to change the permissions of local files owned by the user executing bzip2 providing that they have write access to the directory in which the file is being extracted.

Workaround

Do not uncompress bzip2 archives from untrusted sources and do not uncompress files in directories where untrusted users have write access.

CVE-2005-0953 CVE-2005-1260 SA-05:14.bzip2 http://scary.beasts.org/security/CESA-2005-002.txt 2005-03-30 2005-06-29 2005-07-06
kernel -- TCP connection stall denial of service FreeBSD 5.45.4_3 5.*5.3_17 4.114.11_11 4.10_16

Problem Description

Two problems have been discovered in the FreeBSD TCP stack.

First, when a TCP packets containing a timestamp is received, inadequate checking of sequence numbers is performed, allowing an attacker to artificially increase the internal "recent" timestamp for a connection.

Second, a TCP packet with the SYN flag set is accepted for established connections, allowing an attacker to overwrite certain TCP options.

Impact

Using either of the two problems an attacker with knowledge of the local and remote IP and port numbers associated with a connection can cause a denial of service situation by stalling the TCP connection. The stalled TCP connection my be closed after some time by the other host.

Workaround

In some cases it may be possible to defend against these attacks by blocking the attack packets using a firewall. Packets used to effect either of these attacks would have spoofed source IP addresses.

637934 CVE-2005-0356 CVE-2005-2068 SA-05:15.tcp 2005-06-29 2005-06-29 2005-07-06
ethereal -- multiple protocol dissectors vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.8.140.10.11

An Ethreal Security Advisories reports:

An aggressive testing program as well as independent discovery has turned up a multitude of security issues:

  • The ANSI A dissector was susceptible to format string vulnerabilities. Discovered by Bryan Fulton.
  • The GSM MAP dissector could crash.
  • The AIM dissector could cause a crash.
  • The DISTCC dissector was susceptible to a buffer overflow. Discovered by Ilja van Sprundel
  • The FCELS dissector was susceptible to a buffer overflow. Discovered by Neil Kettle
  • The SIP dissector was susceptible to a buffer overflow. Discovered by Ejovi Nuwere.
  • The KINK dissector was susceptible to a null pointer exception, endless looping, and other problems.
  • The LMP dissector was susceptible to an endless loop.
  • The Telnet dissector could abort.
  • The TZSP dissector could cause a segmentation fault.
  • The WSP dissector was susceptible to a null pointer exception and assertions.
  • The 802.3 Slow protocols dissector could throw an assertion.
  • The BER dissector could throw assertions.
  • The SMB Mailslot dissector was susceptible to a null pointer exception and could throw assertions.
  • The H.245 dissector was susceptible to a null pointer exception.
  • The Bittorrent dissector could cause a segmentation fault.
  • The SMB dissector could cause a segmentation fault and throw assertions.
  • The Fibre Channel dissector could cause a crash.
  • The DICOM dissector could attempt to allocate large amounts of memory.
  • The MGCP dissector was susceptible to a null pointer exception, could loop indefinitely, and segfault.
  • The RSVP dissector could loop indefinitely.
  • The DHCP dissector was susceptible to format string vulnerabilities, and could abort.
  • The SRVLOC dissector could crash unexpectedly or go into an infinite loop.
  • The EIGRP dissector could loop indefinitely.
  • The ISIS dissector could overflow a buffer.
  • The CMIP, CMP, CMS, CRMF, ESS, OCSP, PKIX1Explitit, PKIX Qualified, and X.509 dissectors could overflow buffers.
  • The NDPS dissector could exhaust system memory or cause an assertion, or crash.
  • The Q.931 dissector could try to free a null pointer and overflow a buffer.
  • The IAX2 dissector could throw an assertion.
  • The ICEP dissector could try to free the same memory twice.
  • The MEGACO dissector was susceptible to an infinite loop and a buffer overflow.
  • The DLSw dissector was susceptible to an infinite loop.
  • The RPC dissector was susceptible to a null pointer exception.
  • The NCP dissector could overflow a buffer or loop for a large amount of time.
  • The RADIUS dissector could throw an assertion.
  • The GSM dissector could access an invalid pointer.
  • The SMB PIPE dissector could throw an assertion.
  • The L2TP dissector was susceptible to an infinite loop.
  • The SMB NETLOGON dissector could dereference a null pointer.
  • The MRDISC dissector could throw an assertion.
  • The ISUP dissector could overflow a buffer or cause a segmentation fault.
  • The LDAP dissector could crash.
  • The TCAP dissector could overflow a buffer or throw an assertion.
  • The NTLMSSP dissector could crash.
  • The Presentation dissector could overflow a buffer.
  • Additionally, a number of dissectors could throw an assertion when passing an invalid protocol tree item length.
13391 13504 13567 CVE-2005-1281 CVE-2005-1456 CVE-2005-1457 CVE-2005-1458 CVE-2005-1459 CVE-2005-1460 CVE-2005-1461 CVE-2005-1462 CVE-2005-1463 CVE-2005-1464 CVE-2005-1465 CVE-2005-1466 CVE-2005-1467 CVE-2005-1468 CVE-2005-1469 CVE-2005-1470 http://www.ethereal.com/appnotes/enpa-sa-00019.html 2005-05-04 2005-06-24
tor -- information disclosure tor 0.1.0.10

Roger Dingledine reports:

The Tor 0.1.0.10 release from a few days ago includes a fix for a bug that might allow an attacker to read arbitrary memory (maybe even keys) from an exit server's process space. We haven't heard any reports of exploits yet, but hey.

http://archives.seul.org/or/announce/Jun-2005/msg00001.html 2005-06-16 2005-06-24
linux-realplayer -- RealText parsing heap overflow linux-realplayer 10.0.4_1

An iDEFENSE Security Advisory reports:

Remote exploitation of a heap-based buffer overflow vulnerability in the RealText file format parser within various versions of RealNetworks Inc.'s RealPlayer could allow attackers to execute arbitrary code.

CVE-2005-1277 http://www.idefense.com/application/poi/display?id=250&type=vulnerabilities&flashstatus=false http://service.real.com/help/faq/security/050623_player/EN/ 2005-06-23 2005-06-24
ruby -- arbitrary command execution on XMLRPC server ruby ruby_static 1.8.*1.8.2_3

Nobuhiro IMAI reports:

the default value modification on Module#public_instance_methods (from false to true) breaks s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style security protection.

This problem could allow a remote attacker to execute arbitrary commands on XMLRPC server of libruby.

CVE-2005-1992 http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064 2005-06-22 2005-06-23 2005-11-06
cacti -- potential SQL injection and cross site scripting attacks cacti 0.8.6d

iDEFENSE security group disclosed potential SQL injection attacks from unchecked user input and two security holes regarding potential cross site scripting attacks

http://www.cacti.net/release_notes_0_8_6e.php 2005-06-21 2005-06-21
opera -- XMLHttpRequest security bypass linux-opera opera-devel opera 8.*8.01

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to steal content or to perform actions on other web sites with the privileges of the user.

Normally, it should not be possible for the XMLHttpRequest object to access resources from outside the domain of which the object was opened. However, due to insufficient validation of server side redirects, it is possible to circumvent this restriction.

CVE-2005-1475 http://secunia.com/advisories/15008/ http://secunia.com/secunia_research/2005-4/advisory/ http://www.opera.com/freebsd/changelogs/801/#security 2005-06-16 2005-06-20
opera -- "javascript:" URL cross-site scripting vulnerability linux-opera opera-devel opera 8.01

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to conduct cross-site scripting attacks and to read local files.

The vulnerability is caused due to Opera not properly restricting the privileges of "javascript:" URLs when opened in e.g. new windows or frames.

CVE-2005-1669 http://secunia.com/advisories/15411/ http://www.opera.com/freebsd/changelogs/801/#security 2005-06-16 2005-06-20
opera -- redirection cross-site scripting vulnerability linux-opera opera-devel opera 8.*8.01

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to conduct cross-site scripting attacks against users.

The vulnerability is caused due to input not being sanitised, when Opera generates a temporary page for displaying a redirection when "Automatic redirection" is disabled (not default setting).

http://secunia.com/advisories/15423/ http://secunia.com/secunia_research/2003-1/advisory/ http://www.opera.com/freebsd/changelogs/801/#security 2005-06-16 2005-06-20
sudo -- local race condition vulnerability sudo 1.6.8.9

Todd C. Miller reports:

A race condition in Sudo's command pathname handling prior to Sudo version 1.6.8p9 that could allow a user with Sudo privileges to run arbitrary commands.

Exploitation of the bug requires that the user be allowed to run one or more commands via Sudo and be able to create symbolic links in the filesystem. Furthermore, a sudoers entry giving another user access to the ALL pseudo-command must follow the user's sudoers entry for the race to exist.

13993 CVE-2005-1993 http://marc.theaimsgroup.com/?l=bugtraq&m=111928183431376 2005-06-20 2005-06-20 2005-11-14
trac -- file upload/download vulnerability trac 0.8.4

Stefan Esser reports:

Trac's wiki and ticket systems allows to add attachments to wiki entries and bug tracker tickets. These attachments are stored within directories that are determined by the id of the corresponding ticket or wiki entry.

Due to a missing validation of the id parameter it is possible for an attacker to supply arbitrary paths to the upload and attachment viewer scripts. This means that a potential attacker can retrieve any file accessible by the webserver user.

Additionally it is possible to upload arbitrary files (up to a configured file length) to any place the webserver has write access too.

For obvious reasons this can lead to the execution of arbitrary code if it possible to upload files to the document root or it's subdirectories. One example of a configuration would be f.e. running Trac and s9y/wordpress with writeable content directories on the same webserver.

Another potential usage of this exploit would be to abuse Trac powered webservers as storage for f.e. torrent files.

13990 http://www.hardened-php.net/advisory-012005.php http://projects.edgewall.com/trac/wiki/ChangeLog 2005-06-20 2005-06-20
razor-agents -- denial of service vulnerability razor-agents 2.71

A Secunia security advisory reports:

Two vulnerabilities have been reported in Razor-agents, which can be exploited by malicious people to cause a DoS (Denial of Service).

  1. An unspecified error in the preprocessing of certain HTML messages can be exploited to crash the application.
  2. A bug in the discovery logic causes Razor-agents to go into an infinite loop and consume a large amount of memory when discovery fails.
http://secunia.com/advisories/15739/ 2005-06-17 2005-06-20
p5-Mail-SpamAssassin -- denial of service vulnerability p5-Mail-SpamAssassin 3.0.13.0.4

Apache SpamAssassin Security Team reports:

Apache SpamAssassin 3.0.4 was recently released, and fixes a denial of service vulnerability in versions 3.0.1, 3.0.2, and 3.0.3. The vulnerability allows certain misformatted long message headers to cause spam checking to take a very long time.

While the exploit has yet to be seen in the wild, we are concerned that there may be attempts to abuse the vulnerability in the future. Therefore, we strongly recommend all users of these versions upgrade to Apache SpamAssassin 3.0.4 as soon as possible.

CVE-2005-1266 http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e 2005-06-15 2005-06-18
squirrelmail -- Several cross site scripting vulnerabilities squirrelmail ja-squirrelmail 1.4.01.4.4

A SquirrelMail Security Advisory reports:

Several cross site scripting (XSS) vulnerabilities have been discovered in SquirrelMail versions 1.4.0 - 1.4.4.

The vulnerabilities are in two categories: the majority can be exploited through URL manipulation, and some by sending a specially crafted email to a victim. When done very carefully, this can cause the session of the user to be hijacked.

CVE-2005-1769 http://www.squirrelmail.org/security/issue/2005-06-15 2005-06-15 2005-06-18
acroread -- XML External Entity vulnerability acroread7 ja-acroread 7.0.07.0.1

Sverre H. Huseby discovered a vulnerability in Adobe Acrobat and Adobe Reader. Under certain circumstances, using XML scripts it is possible to discover the existence of local files.

CVE-2005-1306 http://shh.thathost.com/secadv/adobexxe/ http://www.adobe.com/support/techdocs/331710.html http://support.adobe.co.jp/faq/faq/qadoc.sv?226360+002+3 2005-06-15 2005-06-18 2005-08-28
gzip -- directory traversal and permission race vulnerabilities FreeBSD 5.45.4_2 5.05.3_16 4.114.11_10 4.104.10_15 4.94.9_18 4.8_33 gzip 1.3.5_2

Problem Description

Two problems related to extraction of files exist in gzip:

The first problem is that gzip does not properly sanitize filenames containing "/" when uncompressing files using the -N command line option.

The second problem is that gzip does not set permissions on newly extracted files until after the file has been created and the file descriptor has been closed.

Impact

The first problem can allow an attacker to overwrite arbitrary local files when uncompressing a file using the -N command line option.

The second problem can allow a local attacker to change the permissions of arbitrary local files, on the same partition as the one the user is uncompressing a file on, by removing the file the user is uncompressing and replacing it with a hardlink before the uncompress operation is finished.

Workaround

Do not use the -N command line option on untrusted files and do not uncompress files in directories where untrusted users have write access.

CVE-2005-0988 CVE-2005-1228 SA-05:11.gzip http://marc.theaimsgroup.com/?l=bugtraq&m=111271860708210 http://marc.theaimsgroup.com/?l=bugtraq&m=111402732406477 2005-04-20 2005-06-18 2005-07-06
tcpdump -- infinite loops in protocol decoding FreeBSD 5.45.4_2 5.35.3_16 tcpdump 3.8.3_2

Problem Description

Several tcpdump protocol decoders contain programming errors which can cause them to go into infinite loops.

Impact

An attacker can inject specially crafted packets into the network which, when processed by tcpdump, could lead to a denial-of-service. After the attack, tcpdump would no longer capture traffic, and would potentially use all available processor time.

CVE-2005-1267 CVE-2005-1278 CVE-2005-1279 CVE-2005-1280 SA-05:10.tcpdump http://marc.theaimsgroup.com/?l=bugtraq&m=111454406222040 http://marc.theaimsgroup.com/?l=bugtraq&m=111454461300644 http://marc.theaimsgroup.com/?l=bugtraq&m=111928309502304 2005-06-09 2005-06-18 2005-06-20
gaim -- Yahoo! remote crash vulnerability gaim ja-gaim ko-gaim ru-gaim 1.3.1

Jacopo Ottaviani reports that Gaim can be crashed by being offered files with names containing non-ASCII characters via the Yahoo! protocol.

13931 CVE-2005-1269 http://gaim.sourceforge.net/security/index.php?id=18 2005-06-10 2005-06-17
gaim -- MSN Remote DoS vulnerability gaim ja-gaim ko-gaim ru-gaim 1.3.1

The GAIM team reports:

Remote attackers can cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an integer signedness error.

13932 CVE-2005-1934 http://gaim.sourceforge.net/security/index.php?id=19 2005-06-10 2005-06-17
gallery -- remote code injection via HTTP_POST_VARS gallery 1.4.1.1

A web server running Gallery can be exploited for arbitrary PHP code execution through the use of a maliciously crafted URL.

CVE-2004-2124 http://marc.theaimsgroup.com/?l=bugtraq&m=107524414317693 2004-01-27 2005-06-17
gallery -- cross-site scripting gallery 1.4.4.5

Gallery includes several cross-site scripting vulnerabilities that could allow malicious content to be injected.

CVE-2004-1106 CVE-2005-0219 CVE-2005-0220 CVE-2005-0221 CVE-2005-0222 11602 http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147 http://marc.theaimsgroup.com/?l=bugtraq&m=110608459222364 2005-01-26 2005-06-17
kstars -- exploitable set-user-ID application fliccd kdeedu 3.3.2_1

A KDE Security Advisory explains:

Overview

KStars includes support for the Instrument Neutral Distributed Interface (INDI). The build system of this extra 3rd party software contained an installation hook to install fliccd (part of INDI) as SUID root application.

Erik Sjölund discovered that the code contains several vulnerabilities that allow stack based buffer overflows.

Impact

If the fliccd binary is installed as suid root, it enables root privilege escalation for local users, or, if the daemon is actually running (which it does not by default) and is running as root, remote root privilege escalation.

CVE-2005-0011 http://www.kde.org/info/security/advisory-20050215-1.txt 2005-01-05 2005-06-17
fd_set -- bitmap index overflow in multiple applications gatekeeper 2.2.1 citadel 6.29 3proxy 0.5.b jabber 1.4.3.1_1,1 1.4.4 bnc 2.9.3 rinetd 0.62_1 dante 1.1.15 bld 0.3.3

3APA3A reports:

If programmer fails to check socket number before using select() or fd_set macros, it's possible to overwrite memory behind fd_set structure. Very few select() based application actually check FD_SETSIZE value. [...]

Depending on vulnerable application it's possible to overwrite portions of memory. Impact is close to off-by-one overflows, code execution doesn't seems exploitable.

http://www.gotbnc.com/changes.html#2.9.3 http://www.security.nnov.ru/advisories/sockets.asp http://marc.theaimsgroup.com/?l=bugtraq&m=110660879328901 2004-12-12 2005-06-17 2006-09-03
leafnode -- denial of service vulnerability leafnode 1.11.3

Matthias Andree reports:

A vulnerability was found in the fetchnews program (the NNTP client) that may under some circumstances cause a wait for input that never arrives, fetchnews "hangs". [...]

As only one fetchnews program can run at a time, subsequently started fetchnews and texpire programs will terminate. [...]

Upgrade your leafnode package to version 1.11.3.

CVE-2005-1911 http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt ports/82056 http://marc.theaimsgroup.com/?l=vulnwatch&m=111827180929063 2005-06-08 2005-06-09
gforge -- directory traversal vulnerability gforge 4.0

An STG Security Advisory reports:

GForge CVS module made by Dragos Moinescu and another module made by Ronald Petty have a directory traversal vulnerability. [...] malicious attackers can read arbitrary directory lists.

CVE-2005-0299 12318 http://marc.theaimsgroup.com/?l=bugtraq&m=110627132209963 2005-01-20 2005-06-03
imap-uw -- authentication bypass when CRAM-MD5 is enabled imap-uw 2004b,1

The CRAM-MD5 authentication support of the University of Washington IMAP and POP3 servers contains a vulnerability that may allow an attacker to bypass authentication and impersonate arbitrary users. Only installations with CRAM-MD5 support configured are affected.

CVE-2005-0198 702777 2005-01-04 2005-06-03
squid -- denial-of-service vulnerabilities squid 2.5.9

The Squid team reported several denial-of-service vulnerabilities related to the handling of DNS responses and NT Lan Manager messages. These may allow an attacker to crash the Squid cache.

CVE-2005-0446 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert CVE-2005-0096 CVE-2005-0097 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_auth 2005-01-16 2005-06-03
racoon -- remote denial-of-service racoon 20050510a

Sebastian Krahmer discovered that the racoon ISAKMP daemon could be crashed with a maliciously crafted UDP packet. No authentication is required in order to perform the attack.

CVE-2005-0398 http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&forum_id=32000 http://xforce.iss.net/xforce/xfdb/19707 https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&action=view 2005-03-12 2005-06-03
xli -- integer overflows in image size calculations xli 1.17.0_1

Tavis Ormandy discovered several integer overflows in xli's image size handling. A maliciously crafted image may be able to cause a heap buffer overflow and execute arbitrary code.

CVE-2005-0639 http://bugs.gentoo.org/show_bug.cgi?id=79762 http://pantransit.reptiles.org/prog/xli/CHANGES 2005-02-08 2005-06-03
xloadimage -- arbitrary command execution when handling compressed files xli 1.17.0_1 xloadimage 4.1.10

Tavis Ormandy discovered that xli and xloadimage attempt to decompress images by piping them through gunzip or similar decompression tools. Unfortunately, the unsanitized file name is included as part of the command. This is dangerous, as in some situations, such as mailcap processing, an attacker may control the input file name. As a result, an attacker may be able to cause arbitrary command execution.

CVE-2005-0638 http://bugs.gentoo.org/show_bug.cgi?id=79762 2005-02-18 2005-06-03
xloadimage -- buffer overflow in FACES image handling xli 1.17.0_1 xloadimage 4.1.9

In 2001, zen-parse discovered a buffer overflow in xloadimage's FACES image loader. A maliciously crafted image could cause xloadimage to execute arbitrary code. A published exploit exists for this vulnerability.

In 2005, Rob Holland discovered that the same vulnerability was present in xli.

CVE-2001-0775 http://marc.theaimsgroup.com/?l=bugtraq&m=99477230306845 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186 http://bugs.gentoo.org/show_bug.cgi?id=79762 2000-02-19 2005-06-03
yamt -- buffer overflow and directory traversal issues yamt 0.5_2

Stanislav Brabec discovered errors in yamt's path name handling that lead to buffer overflows and directory traversal issues. When processing a file with a maliciously crafted ID3 tag, yamt might overwrite arbitrary files or possibly execute arbitrary code.

The SuSE package ChangeLog contains:

  • Several security fixes (#49337):
  • directory traversal in rename
  • directory traversal in sort
  • buffer overflow in sort
  • buffer overflow in rename
CVE-2005-1846 CVE-2005-1847 http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/yamt-0.5-1277.src.rpm 2005-01-20 2005-06-03
xview -- multiple buffer overflows in xv_parse_one xview 3.2.1_3

A Debian Security Advisory reports:

Erik Sjölund discovered that programs linked against xview are vulnerable to a number of buffer overflows in the XView library. When the overflow is triggered in a program which is installed setuid root a malicious user could perhaps execute arbitrary code as privileged user.

CVE-2005-0076 http://www.debian.org/security/2005/dsa-672 http://xforce.iss.net/xforce/xfdb/19271 2005-02-09 2005-06-01
xtrlock -- X display locking bypass xtrlock 2.0.10

The X display locking program xtrlock contains an integer overflow bug. It is possible for an attacker with physical access to the system to bypass the display lock.

CVE-2005-0079 http://www.debian.org/security/2005/dsa-649 http://xforce.iss.net/xforce/xfdb/18991 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278191 2004-10-25 2005-06-01
linux_base -- vulnerabilities in Red Hat 7.1 libraries linux_base 7.3

Trevor Johnson reported that the Red Hat Linux RPMs used by linux_base contained multiple older vulnerabilities, such as a DNS resolver issue and critical bugs in X font handling and XPM image handling.

http://fedoralegacy.org/updates/RH7.3/2004-10-23-FLSA_2004_1947__Updated_glibc_packages_fix_flaws.html http://rhn.redhat.com/errata/RHSA-2004-059.html http://rhn.redhat.com/errata/RHSA-2004-478.html http://rhn.redhat.com/errata/RHSA-2004-612.html CVE-2002-0029 CVE-2004-0083 CVE-2004-0084 CVE-2004-0106 CVE-2004-0687 CVE-2004-0688 CVE-2004-0692 CVE-2004-0914 2004-09-27 2005-06-01
squirrelmail -- XSS and remote code injection vulnerabilities squirrelmail ja-squirrelmail 1.4.4

A SquirrelMail Security Advisory reports:

SquirrelMail 1.4.4 has been released to resolve a number of security issues disclosed below. It is strongly recommended that all running SquirrelMail prior to 1.4.4 upgrade to the latest release.

Remote File Inclusion

Manoel Zaninetti reported an issue in src/webmail.php which would allow a crafted URL to include a remote web page. This was assigned CAN-2005-0103 by the Common Vulnerabilities and Exposures.

Cross Site Scripting Issues

A possible cross site scripting issue exists in src/webmail.php that is only accessible when the PHP installation is running with register_globals set to On. This issue was uncovered internally by the SquirrelMail Development team. This isssue was assigned CAN-2005-0104 by the Common Vulnerabilities and Exposures.

A second issue which was resolved in the 1.4.4-rc1 release was uncovered and assigned CAN-2004-1036 by the Common Vulnerabilities and Exposures. This issue could allow a remote user to send a specially crafted header and cause execution of script (such as javascript) in the client browser.

Local File Inclusion

A possible local file inclusion issue was uncovered by one of our developers involving custom preference handlers. This issue is only active if the PHP installation is running with register_globals set to On.

CVE-2004-1036 CVE-2005-0075 CVE-2005-0103 CVE-2005-0104 http://marc.theaimsgroup.com/?l=bugtraq&m=110702772714662 http://www.squirrelmail.org/security/issue/2005-01-14 http://www.squirrelmail.org/security/issue/2005-01-19 http://www.squirrelmail.org/security/issue/2005-01-20 2005-01-29 2005-06-01
sympa -- buffer overflow in "queue" sympa 4.1.2_1

Erik Sjölund discovered a vulnerabilitiy in Sympa. The queue application processes messages received via aliases. It contains a buffer overflow in the usage of sprintf. In some configurations, it may allow an attacker to execute arbitrary code as the sympa user.

CVE-2005-0073 http://www.debian.org/security/2005/dsa-677 2005-02-11 2005-06-01
mailman -- generated passwords are poor quality mailman ja-mailman 2.1.6

Florian Weimer wrote:

Mailman 2.1.5 uses weak auto-generated passwords for new subscribers. These passwords are assigned when members subscribe without specifying their own password (either by email or the web frontend). Knowledge of this password allows an attacker to gain access to the list archive even though she's not a member and the archive is restricted to members only. [...]

This means that only about 5 million different passwords are ever generated, a number that is in the range of brute force attacks -- you only have to guess one subscriber address (which is usually not that hard).

CVE-2004-1143 http://mail.python.org/pipermail/mailman-developers/2004-December/017553.html http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht 2004-12-15 2005-06-01
mailman -- password disclosure mailman ja-mailman 2.1.5

Barry Warsaw reports:

Today I am releasing Mailman 2.1.5, a bug fix release [...] This version also contains a fix for an exploit that could allow 3rd parties to retrieve member passwords. It is thus highly recommended that all existing sites upgrade to the latest version.

CVE-2004-0412 http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html 2004-05-15 2005-06-01
tomcat -- Tomcat Manager cross-site scripting jakarta-tomcat 5.0.*5.0.30_5 5.5.*5.5.7

Oliver Karow discovered cross-site scripting issues in the Apache Jakarta Tomcat manager. The developers refer to the issues as minor.

http://www.oliverkarow.de/research/jakarta556_xss.txt http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html 2005-01-03 2005-06-01 2006-09-12
fswiki -- XSS problem in file upload form fswiki 3.5.6

A Secunia security advisory reports:

A vulnerability has been reported in FreeStyle Wiki and FSWikiLite, which can be exploited by malicious people to conduct script insertion attacks.

Input passed in uploaded attachments is not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious attachment is viewed.

CVE-2005-1799 http://secunia.com/advisories/15538 ports/81520 http://fswiki.poi.jp/wiki.cgi?page=%CD%FA%CE%F2%2F2005%2D5%2D19 http://jvn.jp/jp/JVN%23465742E4/index.html 2005-05-19 2005-05-29 2005-06-01
freeradius -- sql injection and denial of service vulnerability freeradius 1.0.2_1 freeradius-devel 0

A Gentoo Advisory reports:

The FreeRADIUS server is vulnerable to an SQL injection attack and a buffer overflow, possibly resulting in disclosure and modification of data and Denial of Service.

13540 13541 http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml 2005-05-17 2005-05-22
ppxp -- local root exploit ppxp 0 ja-ppxp 0

A Debian Advisory reports:

Jens Steube discovered that ppxp, yet another PPP program, does not release root privileges when opening potentially user supplied log files. This can be tricked into opening a root shell.

CVE-2005-0392 http://www.debian.org/security/2005/dsa-725 2005-05-19 2005-05-22
oops -- format string vulnerability oops 1.5.24

A RST/GHC Advisory reports that there is an format string vulnerability in oops. The vulnerability can be found in the MySQL/PgSQL authentication module. Succesful exploitation may allow execution of arbitrary code.

13172 CVE-2005-1121 http://rst.void.ru/papers/advisory24.txt 2005-04-14 2005-05-22
cdrdao -- unspecified privilege escalation vulnerability cdrdao 1.2.0

The developers of cdrdao report that there is a potential root exploit in the software. In order to be able to succesfully exploit this vulnerability cdrdao must be installed setuid root. When succesfully exploited a local user might get escalated privileges. By default this port is not installed setuid root.

http://secunia.com/advisories/15354/ http://sourceforge.net/forum/forum.php?forum_id=466399 2005-05-13 2005-05-19
gaim -- MSN remote DoS vulnerability gaim ja-gaim ko-gaim ru-gaim 1.3.0

The GAIM team reports:

Potential remote denial of service bug resulting from not checking a pointer for non-NULL before passing it to strncmp, which results in a crash. This can be triggered by a remote client sending an SLP message with an empty body.

CVE-2005-1262 http://gaim.sourceforge.net/security/index.php?id=17 2005-05-10 2005-05-14
gaim -- remote crash on some protocols gaim ja-gaim ko-gaim ru-gaim 1.3.0

The GAIM team reports that GAIM is vulnerable to a denial-of-service vulnerability which can cause GAIM to crash:

It is possible for a remote user to overflow a static buffer by sending an IM containing a very large URL (greater than 8192 bytes) to the Gaim user. This is not possible on all protocols, due to message length restrictions. Jabber are SILC are known to be vulnerable.

CVE-2005-1261 http://gaim.sourceforge.net/security/index.php?id=16 2005-05-10 2005-05-14
kernel -- information disclosure when using HTT FreeBSD 5.45.4_1 5.05.3_15 4.114.11_9 4.10_14

Problem description and impact

When running on processors supporting Hyper-Threading Technology, it is possible for a malicious thread to monitor the execution of another thread.

Information may be disclosed to local users, allowing in many cases for privilege escalation. For example, on a multi-user system, it may be possible to steal cryptographic keys used in applications such as OpenSSH or SSL-enabled web servers.

NOTE: Similar problems may exist in other simultaneous multithreading implementations, or even some systems in the absence of simultaneous multithreading. However, current research has only demonstrated this flaw in Hyper-Threading Technology, where shared memory caches are used.

Workaround

Systems not using processors with Hyper-Threading Technology support are not affected by this issue. On systems which are affected, the security flaw can be eliminated by setting the "machdep.hlt_logical_cpus" tunable:

# echo "machdep.hlt_logical_cpus=1" >> /boot/loader.conf

The system must be rebooted in order for tunables to take effect.

Use of this workaround is not recommended on "dual-core" systems, as this workaround will also disable one of the processor cores.

CVE-2005-0109 SA-05:09.htt http://www.daemonology.net/hyperthreading-considered-harmful/ 2005-05-13 2005-05-13
leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout leafnode 1.9.481.11.2

When an upstream server aborts the transmission or stops sending data after the fetchnews program has requested an article header or body, fetchnews may crash, without querying further servers that are configured. This can prevent articles from being fetched.

http://leafnode.sourceforge.net/leafnode-SA-2005-01.txt CVE-2005-1453 ports/80663 13489 13492 http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&forum_id=10210 http://article.gmane.org/gmane.network.leafnode.announce/52 http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html http://www.fredi.de/maillist/msg00111.html http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html http://www.frsirt.com/english/advisories/2005/0468 http://secunia.com/advisories/15252 2005-05-04 2005-05-13
mozilla -- privilege escalation via non-DOM property overrides firefox 1.0.4,1 linux-firefox 1.0.4 mozilla 1.7.8,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.8 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Additional checks were added to make sure Javascript eval and Script objects are run with the privileges of the context that created them, not the potentially elevated privilege of the context calling them in order to protect against an additional variant of MFSA 2005-41.

The Mozilla Foundation Security Advisory MFSA 2005-41 reports:

moz_bug_r_a4 reported several exploits giving an attacker the ability to install malicious code or steal data, requiring only that the user do commonplace actions like click on a link or open the context menu.

http://www.mozilla.org/security/announce/mfsa2005-44.html 2005-05-11 2005-05-12
mozilla -- "Wrapped" javascript: urls bypass security checks firefox 1.0.4,1 linux-firefox 1.0.4 mozilla 1.7.8,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.8 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Some security checks intended to prevent script injection were incorrect and could be bypassed by wrapping a javascript: url in the view-source: pseudo-protocol. Michael Krax demonstrated that a variant of his favicon exploit could still execute arbitrary code, and the same technique could also be used to perform cross-site scripting.

Georgi Guninski demonstrated the same flaw wrapping javascript: urls with the jar: pseudo-protocol.

L. David Baron discovered a nested variant that defeated checks in the script security manager.

Workaround: Disable Javascript

http://www.mozilla.org/security/announce/mfsa2005-43.html 2005-05-11 2005-05-12
mozilla -- code execution via javascript: IconURL vulnerability firefox 1.0.4,1 linux-firefox 1.0.4 mozilla 1.7.8,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.8 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Two vulnerabilities have been discovered in Firefox, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a user's system.

  1. The problem is that "IFRAME" JavaScript URLs are not properly protected from being executed in context of another URL in the history list. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.
  2. Input passed to the "IconURL" parameter in "InstallTrigger.install()" is not properly verified before being used. This can be exploited to execute arbitrary JavaScript code with escalated privileges via a specially crafted JavaScript URL.

Successful exploitation requires that the site is allowed to install software (default sites are "update.mozilla.org" and "addons.mozilla.org").

A combination of vulnerability 1 and 2 can be exploited to execute arbitrary code.

CVE-2005-1476 CVE-2005-1477 http://www.mozilla.org/security/announce/mfsa2005-42.html 2005-05-08 2005-05-11
groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files ja-groff 1.18.11.18.1_8

The eqn2graph and pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files.

ports/80671 12058 CVE-2004-1296 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372 2004-12-20 2005-05-09
groff -- groffer uses temporary files unsafely ja-groff 1.181.18.1_8

The groffer script in the groff package 1.18 and later versions allows local users to overwrite files via a symlink attack on temporary files.

ports/80671 11287 CVE-2004-0969 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278265 2004-09-30 2005-05-09
sharutils -- unshar insecure temporary file creation sharutils 4.3.80

An Ubuntu Advisory reports:

Joey Hess discovered that "unshar" created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program.

12981 CVE-2005-0990 http://www.ubuntulinux.org/support/documentation/usn/usn-104-1 2005-04-04 2005-05-01
rsnapshot -- local privilege escalation rsnapshot 1.1.7

An rsnapshot Advisory reports:

The copy_symlink() subroutine in rsnapshot incorrectly changes file ownership on the files pointed to by symlinks, not on the symlinks themselves. This would allow, under certain circumstances, an arbitrary user to take ownership of a file on the main filesystem.

13095 CVE-2005-1064 http://www.rsnapshot.org/security/2005/001.html 2005-04-10 2005-05-01
coppermine -- IP spoofing and XSS vulnerability coppermine 1.3.2

GHC team reports about coppermine

The lack of sanitizing of user defined variables may result in undesirable consequences such as IP spoofing or XSS attack.

Generally users of Coppermine Gallery can post comments. Remote address & x-forwarded-for variables are logged for admin's eyes. X-Forwarded-for variable does not pass throu any filtration before logging into database. User can define/redefine this variable.

http://www.securityfocus.com/archive/1/396080 13218 CVE-2005-1172 http://coppermine.sourceforge.net/board/index.php?topic=17134.0 2005-04-18 2005-05-01
ImageMagick -- ReadPNMImage() heap overflow vulnerability ImageMagick 6.2.2

Damian Put reports about ImageMagick:

Remote exploitation of a heap overflow vulnerability could allow execution of arbitrary code or course denial of service.

A heap overflow exists in ReadPNMImage() function, that is used to decode a PNM image files.

13351 http://marc.theaimsgroup.com/?l=bugtraq&m=111445767107869 2005-04-25 2005-04-27
mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities mplayer mplayer-gtk mplayer-gtk2 mplayer-esound mplayer-gtk-esound mplayer-gtk2-esound 0.99.7 libxine 0.9.91.0.1

A xine security announcement reports:

By a user receiving data from a malicious network streaming server, an attacker can overrun a heap buffer, which can, on some systems, lead to or help in executing attacker-chosen malicious code with the permissions of the user running a xine-lib based media application.

Both the MMS and Real RTSP streaming client code made some too-strong assumptions on the transferred data. Several critical bounds checks were missing, resulting in the possibility of heap overflows, should the remote server not adhere to these assumptions. In the MMS case, a remote server could present content with too many individual streams; in the RTSP case, a remote server's reply could have too many lines.

An attacker can set up a server delivering malicious data to the users. This can be used to overflow a heap buffer, which can, with certain implementations of heap management, lead to attacker chosen data written to the stack. This can cause attacker-chosen code being executed with the permissions of the user running the application. By tricking users to retrieve a stream, which can be as easy as providing a link on a website, this vulnerability can be exploited remotely.

13270 13271 CVE-2005-1195 http://www.mplayerhq.hu/homepage/design7/news.html#vuln10 http://www.mplayerhq.hu/homepage/design7/news.html#vuln11 http://xinehq.de/index.php/security/XSA-2004-8 2005-04-16 2005-04-25
gaim -- AIM/ICQ remote denial of service vulnerability gaim ja-gaim ko-gaim ru-gaim 1.1.3

The GAIM team reports that GAIM is vulnerable to a denial-of-service vulnerability which can cause GAIM to freeze:

Certain malformed SNAC packets sent by other AIM or ICQ users can trigger an infinite loop in Gaim when parsing the SNAC. The remote user would need a custom client, able to generate malformed SNACs.

CVE-2005-0472 http://gaim.sourceforge.net/security/index.php?id=10 2005-02-17 2005-04-25
gaim -- remote DoS on receiving malformed HTML gaim ja-gaim ko-gaim ru-gaim 1.1.4

The GAIM team reports:

Receiving malformed HTML can result in an invalid memory access causing Gaim to crash.

CVE-2005-0208 CVE-2005-0473 http://gaim.sourceforge.net/security/index.php?id=11 http://gaim.sourceforge.net/security/index.php?id=12 2005-02-17 2005-04-25
kdewebdev -- kommander untrusted code execution vulnerability kdewebdev 3.4.0_1,2

A KDE Security Advisory reports:

Kommander executes without user confirmation data files from possibly untrusted locations. As they contain scripts, the user might accidentally run arbitrary code.

Impact: Remotly supplied kommander files from untrusted sources are executed without confirmation.

CVE-2005-0754 http://www.kde.org/info/security/advisory-20050420-1.txt 2005-04-20 2005-04-23
junkbuster -- heap corruption vulnerability and configuration modification vulnerability junkbuster 2.0.2_3 junkbuster-zlib 0

A Debian advisory reports:

James Ranson discovered that an attacker can modify the referrer setting with a carefully crafted URL by accidently overwriting a global variable.

Tavis Ormandy from the Gentoo Security Team discovered several heap corruptions due to inconsistent use of an internal function that can crash the daemon or possibly lead to the execution of arbitrary code.

13146 13147 CVE-2005-1108 CVE-2005-1109 http://www.debian.org/security/2005/dsa-713 http://www.gentoo.org/security/en/glsa/glsa-200504-11.xml 2005-04-13 2005-04-22
kdelibs -- kimgio input validation errors kdelibs 3.23.4.0_2

A KDE Security Advisory reports:

kimgio contains a PCX image file format reader that does not properly perform input validation. A source code audit performed by the KDE security team discovered several vulnerabilities in the PCX and other image file format readers, some of them exploitable to execute arbitrary code.

Impact: Remotely supplied, specially crafted image files can be used to execute arbitrary code.

CVE-2005-1046 http://bugs.kde.org/102328 http://www.kde.org/info/security/advisory-20050421-1.txt 2005-04-21 2005-04-22
gld -- format string and buffer overflow vulnerabilities gld 1.5

Gld has been found vulnerable to multiple buffer overflows as well as multiple format string vulnerabilities.

An attacker could exploit this vulnerability to execute arbitrary code with the permissions of the user running Gld, the default user being root.

The FreeBSD port defaults to running gld as the root user. The risk of exploitation can be minimized by making gld listen on the loopback address only, or configure it to only accept connections from trusted smtp servers.

13129 13133 CVE-2005-1099 CVE-2005-1100 http://marc.theaimsgroup.com/?l=bugtraq&m=111339935903880 http://marc.theaimsgroup.com/?l=bugtraq&m=111342432325670 2005-04-12 2005-04-19
axel -- remote buffer overflow axel 1.0a_4

A Debian Security Advisory reports:

Ulf Härnhammar from the Debian Security Audit Project discovered a buffer overflow in axel, a light download accelerator. When reading remote input the program did not check if a part of the input can overflow a buffer and maybe trigger the execution of arbitrary code.

13059 CVE-2005-0390 http://www.debian.org/security/2005/dsa-706 2005-04-16 2005-04-17
firefox -- PLUGINSPAGE privileged javascript execution firefox 1.0.3,1 linux-firefox 1.0.3

A Mozilla Foundation Security Advisory reports:

When a webpage requires a plugin that is not installed the user can click to launch the Plugin Finder Service (PFS) to find an appropriate plugin. If the service does not have an appropriate plugin the EMBED tag is checked for a PLUGINSPAGE attribute, and if one is found the PFS dialog will contain a "manual install" button that will load the PLUGINSPAGE url.

Omar Khan reported that if the PLUGINSPAGE attribute contains a javascript: url then pressing the button could launch arbitrary code capable of stealing local data or installing malicious code.

Doron Rosenberg reported a variant that injects script by appending it to a malformed URL of any protocol.

CVE-2005-0752 http://www.mozilla.org/security/announce/mfsa2005-34.html https://bugzilla.mozilla.org/show_bug.cgi?id=288556 https://bugzilla.mozilla.org/show_bug.cgi?id=289171 2005-03-31 2005-04-16
jdk -- jar directory traversal vulnerability jdk 1.2.2p11_3 1.3.*1.3.1p9_4 1.4.*1.4.2p7 1.5.*1.5.0p1_1 linux-ibm-jdk 1.4.2_1 linux-sun-jdk 1.4.2.08_1 1.5.*1.5.2.02,2 linux-blackdown-jdk 1.4.2_2 diablo-jdk 1.3.1.0_1 diablo-jdk-freebsd6 i386.1.5.0.07.00 linux-jdk 0

Pluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system.

The jar tool does not check properly if the files to be extracted have the string "../" on its names, so it's possible for an attacker to create a malicious jar file in order to overwrite arbitrary files within the filesystem.

CVE-2005-1080 http://marc.theaimsgroup.com/?l=bugtraq&m=111331593310508 http://www.securiteam.com/securitynews/5IP0C0AFGW.html http://secunia.com/advisories/14902/ 2005-04-11 2005-04-16 2006-09-12
mozilla -- privilege escalation via DOM property overrides firefox 1.0.3,1 linux-firefox 1.0.3 mozilla 1.7.7,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.7 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

moz_bug_r_a4 reported several exploits giving an attacker the ability to install malicious code or steal data, requiring only that the user do commonplace actions like click on a link or open the context menu. The common cause in each case was privileged UI code ("chrome") being overly trusting of DOM nodes from the content window. Scripts in the web page can override properties and methods of DOM nodes and shadow the native values, unless steps are taken to get the true underlying values.

We found that most extensions also interacted with content DOM in a natural, but unsafe, manner. Changes were made so that chrome code using this natural DOM coding style will now automatically use the native DOM value if it exists without having to use cumbersome wrapper objects.

Most of the specific exploits involved tricking the privileged code into calling eval() on an attacker-supplied script string, or the equivalent using the Script() object. Checks were added in the security manager to make sure eval and Script objects are run with the privileges of the context that created them, not the potentially elevated privileges of the context calling them.

Workaround: Disable Javascript

http://www.mozilla.org/security/announce/mfsa2005-41.html 2005-04-15 2005-04-16
mozilla -- code execution through javascript: favicons firefox 1.0.3,1 linux-firefox 1.0.3 mozilla 1.7.7,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.7 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Firefox and the Mozilla Suite support custom "favicons" through the <LINK rel="icon"> tag. If a link tag is added to the page programmatically and a javascript: url is used, then script will run with elevated privileges and could run or install malicious software.

Workaround: Disable Javascript

http://www.mozilla.org/security/announce/mfsa2005-37.html 2005-04-12 2005-04-16
mozilla -- javascript "lambda" replace exposes memory contents firefox 1.0.3,1 linux-firefox 1.0.3 mozilla 1.7.7,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.7 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

A bug in javascript's regular expression string replacement when using an anonymous function as the replacement argument allows a malicious script to capture blocks of memory allocated to the browser. A web site could capture data and transmit it to a server without user interaction or knowledge.

Workaround: Disable Javascript

CVE-2005-0989 http://www.mozilla.org/security/announce/mfsa2005-33.html https://bugzilla.mozilla.org/show_bug.cgi?id=288688 2005-04-01 2005-04-16
firefox -- arbitrary code execution in sidebar panel firefox 1.0.3,1 linux-firefox 1.0.3

A Mozilla Foundation Security Advisory reports:

Sites can use the _search target to open links in the Firefox sidebar. Two missing security checks allow malicious scripts to first open a privileged page (such as about:config) and then inject script using a javascript: url. This could be used to install malicious code or steal data without user interaction.

Workaround: Disable Javascript

http://www.mozilla.org/security/announce/mfsa2005-39.html 2005-04-12 2005-04-16
openoffice -- DOC document heap overflow vulnerability openoffice ar-openoffice ca-openoffice cs-openoffice de-openoffice dk-openoffice el-openoffice es-openoffice et-openoffice fi-openoffice fr-openoffice gr-openoffice hu-openoffice it-openoffice ja-openoffice ko-openoffice nl-openoffice pl-openoffice pt-openoffice pt_BR-openoffice ru-openoffice se-openoffice sk-openoffice sl-openoffice-SI tr-openoffice zh-openoffice-CN zh-openoffice-TW jp-openoffice kr-openoffice sl-openoffice-SL zh-openoffice zh_TW-openoffice 1.1.4_2 2.*2.0.20050406 openoffice ja-openoffice 6.0.a6096.0.a638 641c645 1.1RC4 1.1rc5

AD-LAB reports that a heap-based buffer overflow vulnerability exists in OpenOffice's handling of DOC documents. When reading a DOC document 16 bit from a 32 bit integer is used for memory allocation, but the full 32 bit is used for further processing of the document. This can allow an attacker to crash OpenOffice, or potentially execute arbitrary code as the user running OpenOffice, by tricking an user into opening a specially crafted DOC document.

13092 CVE-2005-0941 http://marc.theaimsgroup.com/?l=bugtraq&m=111325305109137 http://www.openoffice.org/issues/show_bug.cgi?id=46388 2005-04-11 2005-04-13 2005-04-20
portupgrade -- insecure temporary file handling vulnerability portupgrade 20041226_2

Simon L. Nielsen discovered that portupgrade handles temporary files in an insecure manner. This could allow an unprivileged local attacker to execute arbitrary commands or overwrite arbitrary files with the permissions of the user running portupgrade, typically root, by way of a symlink attack.

The following issues exist where the temporary files are created, by default in the world writeable directory /var/tmp, with the permissions of the user running portupgrade:

  • pkg_fetch download packages with a predictable local filename allowing a local attacker to overwrite arbitrary local files or potentially replace the downloaded package after download but before install with a package with malicious content, allowing the attacker to run arbitrary commands.
  • portupgrade will, when upgrading ports/packages, write the old package to a predictable temporary file, allowing an attacker to overwrite arbitrary files via a symlink attack.
  • portupgrade will touch a temporary temporary file with a constant filename (pkgdb.fixme) allowing an attacker to create arbitrary zero-byte files via a symlink attack.

A workaround for these issues is to set the PKG_TMPDIR environment variable to a directory only write-able by the user running portupgrade.

CVE-2005-0610 2005-04-12 2005-04-12
gaim -- jabber remote crash gaim ja-gaim ko-gaim ru-gaim 1.2.1

The GAIM team reports:

A remote jabber user can cause Gaim to crash by sending a specific file transfer request.

13004 CVE-2005-0967 http://gaim.sourceforge.net/security/?id=15 2005-04-04 2005-04-10
gaim -- remote DoS on receiving certain messages over IRC gaim ja-gaim ko-gaim ru-gaim 1.2.1

The GAIM team reports:

The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite, or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown, irc_msg_nochan functions.

13003 CVE-2005-0966 http://gaim.sourceforge.net/security/?id=14 2005-04-02 2005-04-10
gaim -- remote DoS on receiving malformed HTML gaim ja-gaim ko-gaim ru-gaim 1.2.1

The GAIM team reports:

The gaim_markup_strip_html function in Gaim 1.2.0, and possibly earlier versions, allows remote attackers to cause a denial of service (application crash) via a string that contains malformed HTML, which causes an out-of-bounds read.

12999 CVE-2005-0965 http://gaim.sourceforge.net/security/?id=13 2005-04-02 2005-04-10
php -- readfile() DoS vulnerability mod_php4-twig php4-cgi php4-cli php4-dtc php4-horde php4-nms php4 4.3.5_7 mod_php mod_php4 4.3.5_7,1

A SUSE Security advisory reports:

A bug in the readfile() function of php4 could be used to to crash the httpd running the php4 code when accessing files with a multiple of the architectures page size leading to a denial of service.

12665 CVE-2005-0596 http://bugs.php.net/bug.php?id=27037 http://www.novell.com/linux/security/advisories/2005_06_sr.html 2004-01-25 2005-04-10
squid -- DoS on failed PUT/POST requests vulnerability squid 2.5.7_12

The squid patches page notes:

An inconsistent state is entered on a failed PUT/POST request making a high risk for segmentation faults or other strange errors

CVE-2005-0718 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post http://www.squid-cache.org/bugs/show_bug.cgi?id=1224 2005-02-03 2005-04-10
horde -- Horde Page Title Cross-Site Scripting Vulnerability horde horde-php5 3.*3.0.4

Secunia Advisory: SA14730

A vulnerability has been reported in Horde, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed when setting the parent frame's page title via JavaScript is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability has been reported in version 3.0.4-RC2. Prior versions may also be affected.

CVE-2005-0961 http://lists.horde.org/archives/announce/2005/000176.html http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&r2=1.515.2.93&ty=h 2005-03-29 2005-04-05
wu-ftpd -- remote globbing DoS vulnerability wu-ftpd 2.6.2_6 wu-ftpd+ipv6 2.6.2_7

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation vulnerability in version 2.6.2 of WU-FPTD could allow for a denial of service of the system by resource exhaustion.

The vulnerability specifically exists in the wu_fnmatch() function in wu_fnmatch.c. When a pattern containing a '*' character is supplied as input, the function calls itself recursively on a smaller substring. By supplying a string which contains a large number of '*' characters, the system will take a long time to return the results, during which time it will be using a large amount of CPU time.

CVE-2005-0256 http://marc.theaimsgroup.com/?l=bugtraq&m=110935886414939 2005-02-05 2005-04-04
hashcash -- format string vulnerability hashcash 1.17

A Gentoo Linux Security Advisory reports:

Tavis Ormandy of the Gentoo Linux Security Audit Team identified a flaw in the Hashcash utility that an attacker could expose by specifying a malformed reply address.

Successful exploitation would permit an attacker to disrupt Hashcash users, and potentially execute arbitrary code.

CVE-2005-0687 http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml 2005-03-06 2005-04-02 2005-04-03
clamav -- zip handling DoS vulnerability clamav 0.81 clamav-devel 20050408

The clamav daemon is vulnerable to a DoS vulnerability due to insufficient handling of malformed zip files which can crash the clamav daemon.

12408 CVE-2005-0133 http://sourceforge.net/project/shownotes.php?release_id=300116 2005-01-27 2005-03-26 2005-04-09
wine -- information disclosure due to insecure temporary file handling wine 20050310

Due to insecure temporary file creation in the Wine Windows emulator, it is possible for any user to read potentially sensitive information from temporary registry files.

When a Win32 application is launched by wine, wine makes a dump of the Windows registry in /tmp with name regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal value of the current wine process and yyyy is an integer value usually equal to zero.

regxxxxyyyy.tmp is created with 0644 (-rw-r--r--) permissions. This could represent a security problem in a multi-user environment. Indeed, any local user could access to windows regstry's dump and get sensitive information, like passwords and other private data.

CVE-2005-0787 http://marc.theaimsgroup.com/?l=bugtraq&m=111082537009842 http://bugs.winehq.org/show_bug.cgi?id=2715 http://www.securitytracker.com/alerts/2005/Mar/1013428.html http://www.zone-h.org/advisories/read/id=7300 http://www.securityfocus.com/bid/12791 http://xforce.iss.net/xforce/xfdb/19697 2005-03-13 2005-03-24
firefox -- arbitrary code execution from sidebar panel firefox 1.0.2,1 linux-firefox 1.0.2

A Mozilla Foundation Security Advisory states:

If a user bookmarked a malicious page as a Firefox sidebar panel that page could execute arbitrary programs by opening a privileged page and injecting javascript into it.

CVE-2005-0402 http://www.mozilla.org/security/announce/mfsa2005-31.html 2005-03-03 2005-03-24
mozilla -- heap buffer overflow in GIF image processing firefox 1.0.2,1 thunderbird linux-firefox 1.0.2 mozilla 1.7.6,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.6 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory states:

An (sic) GIF processing error when parsing the obsolete Netscape extension 2 can lead to an exploitable heap overrun, allowing an attacker to run arbitrary code on the user's machine.

CVE-2005-0399 http://www.mozilla.org/security/announce/mfsa2005-30.html http://xforce.iss.net/xforce/alerts/id/191 https://bugzilla.mozilla.org/show_bug.cgi?id=285595 2005-03-10 2005-03-24
sylpheed -- buffer overflow in header processing sylpheed sylpheed-claws sylpheed-gtk2 0.8.*1.0.3 1.9.*1.9.5

The Sylpheed web site states:

A buffer overflow which occurred when replying to a message with certain headers which contain non-ascii characters was fixed.

CVE-2005-0667 http://sylpheed.good-day.net/index.cgi.en#changes 2005-03-07 2005-03-23
xv -- filename handling format string vulnerability xv ja-xv 3.10a_5

A Gentoo Linux Security Advisory reports:

Tavis Ormandy of the Gentoo Linux Security Audit Team identified a flaw in the handling of image filenames by xv.

Successful exploitation would require a victim to process a specially crafted image with a malformed filename, potentially resulting in the execution of arbitrary code.

CVE-2005-0665 http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml 2005-03-01 2005-03-21
kdelibs -- local DCOP denial of service vulnerability ja-kdelibs kdelibs-nocups kdelibs 3.4.0

A KDE Security Advisory reports:

Sebastian Krahmer of the SUSE LINUX Security Team reported a local denial of service vulnerability in KDE's Desktop Communication Protocol (DCOP) daemon better known as dcopserver.

A local user can lock up the dcopserver of arbitrary other users on the same machine. This can cause a significant reduction in desktop functionality for the affected users including, but not limited to, the inability to browse the internet and the inability to start new applications.

CVE-2005-0396 http://www.kde.org/info/security/advisory-20050316-1.txt 2005-03-16 2005-03-21
phpmyadmin -- increased privilege vulnerability phpmyadmin phpMyAdmin 2.6.1.3

The phpMyAdmin team reports:

Escaping of the "_" character was not properly done, giving a wildcard privilege when editing db-specific privileges with phpMyAdmin.

CVE-2005-0653 http://sourceforge.net/forum/forum.php?forum_id=450948 http://sourceforge.net/tracker/index.php?func=detail&aid=1113788&group_id=23067&atid=377408 2005-02-01 2005-03-15
ethereal -- multiple protocol dissectors vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.9.10.10.10

An Ethreal Security Advisories reports:

Issues have been discovered in the following protocol dissectors:

  • Matevz Pustisek discovered a buffer overflow in the Etheric dissector. CVE: CAN-2005-0704
  • The GPRS-LLC dissector could crash if the "ignore cipher bit" option was enabled. CVE: CAN-2005-0705
  • Diego Giago discovered a buffer overflow in the 3GPP2 A11 dissector. This flaw was later reported by Leon Juranic. CVE: CAN-2005-0699
  • Leon Juranic discovered a buffer overflow in the IAPP dissector. CVE: CAN-2005-0739
  • A bug in the JXTA dissector could make Ethereal crash.
  • A bug in the sFlow dissector could make Ethereal crash.
12759 CVE-2005-0699 CVE-2005-0704 CVE-2005-0705 CVE-2005-0739 http://www.ethereal.com/appnotes/enpa-sa-00018.html 2005-03-09 2005-03-14 2005-06-24
grip -- CDDB response multiple matches buffer overflow vulnerability grip 3.2.0_7

Joseph VanAndel reports that grip is vulnerability to a buffer overflow vulnerability when receiving more than 16 CDDB responses. This could lead to a crash in grip and potentially execution arbitrary code.

A workaround is to disable CDDB lookups.

12770 CVE-2005-0706 http://sourceforge.net/tracker/index.php?func=detail&aid=834724&group_id=3714&atid=103714 2003-11-02 2005-03-14 2005-03-18
mysql-server -- multiple remote vulnerabilities mysql-server 4.0.04.0.24 4.1.04.1.10a

SecurityFocus reports:

MySQL is reported prone to an insecure temporary file creation vulnerability.

Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE' privileges on an affected installation may leverage this vulnerability to corrupt files with the privileges of the MySQL process.

MySQL is reported prone to an input validation vulnerability that can be exploited by remote users that have INSERT and DELETE privileges on the 'mysql' administrative database.

Reports indicate that this issue may be leveraged to load an execute a malicious library in the context of the MySQL process.

Finally, MySQL is reported prone to a remote arbitrary code execution vulnerability. It is reported that the vulnerability may be triggered by employing the 'CREATE FUNCTION' statement to manipulate functions in order to control sensitive data structures.

This issue may be exploited to execute arbitrary code in the context of the database process.

12781 CVE-2005-0709 CVE-2005-0710 CVE-2005-0711 2005-03-11 2005-03-14
rxvt-unicode -- buffer overflow vulnerability rxvt-unicode 5.3

A rxvt-unicode changelog reports:

Fix a bug that allowed to overflow a buffer via a long escape sequence, which is probably exploitable (fix by Rob Holland / Yoann Vandoorselaere / Gentoo Audit Team).

http://dist.schmorp.de/rxvt-unicode/Changes 2005-03-13 2005-03-13
phpmyadmin -- information disclosure vulnerability phpmyadmin phpMyAdmin 2.6.1.2

A phpMyAdmin security announcement reports:

By calling some scripts that are part of phpMyAdmin in an unexpected way (especially scripts in the libraries subdirectory), it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

Mitigation factor: This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual.

CVE-2005-0544 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2 2005-02-22 2005-03-08
phpmyadmin -- arbitrary file include and XSS vulnerabilities phpmyadmin phpMyAdmin 1.3.12.6.1.2

A phpMyAdmin security announcement reports:

We received two bug reports by Maksymilian Arciemowicz about those vulnerabilities and we wish to thank him for his work. The vulnerabilities apply to those points:

  1. css/phpmyadmin.css.php was vulnerable against $cfg and GLOBALS variable injections. This way, a possible attacker could manipulate any configuration parameter. Using phpMyAdmin's theming mechanism, he was able to include arbitrary files. This is especially dangerous if php is not running in safe mode.
  2. A possible attacker could manipulate phpMyAdmin's localized strings via the URL and inject harmful JavaScript code this way, which could be used for XSS attacks.
12644 12645 CVE-2005-0543 CVE-2005-0567 http://marc.theaimsgroup.com/?l=bugtraq&m=110929725801154 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1 2005-02-21 2005-03-08
libexif -- buffer overflow vulnerability libexif 0.6.10_1

Sylvain Defresne reports that libexif is vulnerable to a buffer overflow vulnerability due to insufficient input checking. This could lead crash of applications using libexif.

12744 CVE-2005-0664 https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7152 2005-03-03 2005-03-08
phpbb - Insuffient check against HTML code in usercp_register.php phpbb 2.0.13

Neo Security Team reports:

If we specify a variable in the html code (any type: hidden, text, radio, check, etc) with the name allowhtml, allowbbcode or allowsmilies, is going to be on the html, bbcode and smilies in our signature.

This is a low risk vulnerability that allows users to bypass forum-wide configuration.

http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274 http://marc.theaimsgroup.com/?l=bugtraq&m=110988400407204 2005-02-28 2005-03-05 2005-03-07
postnuke -- SQL injection vulnerabilities postnuke 0.760

Two separate SQL injection vulnerabilites have been identified in the PostNuke PHP content management system. An attacker can use this vulnerability to potentially insert executable PHP code into the content management system (to view all files within the PHP scope, for instance). Various other SQL injection vulnerabilities exist, which give attackers the ability to run SQL queries on any tables within the database.

CVE-2005-0617 CVE-2005-0615 http://marc.theaimsgroup.com/?l=bugtraq&m=110962710805864 http://marc.theaimsgroup.com/?l=bugtraq&m=110962819232255 http://news.postnuke.com/Article2669.html 2005-02-28 2005-03-04
postnuke -- cross-site scripting (XSS) vulnerabilities postnuke 0.760

A cross-site scripting vulnerability is present in the PostNuke PHP content management system. By passing data injected through exploitable errors in input validation, an attacker can insert code which will run on the machine of anybody viewing the page. It is feasible that this attack could be used to retrieve session information from cookies, thereby allowing the attacker to gain administrative access to the CMS.

CVE-2005-0616 http://marc.theaimsgroup.com/?l=bugtraq&m=110962768300373 http://news.postnuke.com/Article2669.html 2005-02-28 2005-03-04
realplayer -- remote heap overflow linux-realplayer 10.0.2

Two exploits have been identified in the Linux RealPlayer client. RealNetworks states:

RealNetworks, Inc. has addressed recently discovered security vulnerabilities that offered the potential for an attacker to run arbitrary or malicious code on a customer's machine. RealNetworks has received no reports of machines compromised as a result of the now-remedied vulnerabilities. RealNetworks takes all security vulnerabilities very seriously.

The specific exploits were:

  • Exploit 1: To fashion a malicious WAV file to cause a buffer overflow which could have allowed an attacker to execute arbitrary code on a customer's machine.
  • Exploit 2: To fashion a malicious SMIL file to cause a buffer overflow which could have allowed an attacker to execute arbitrary code on a customer's machine.
CVE-2005-0611 http://marc.theaimsgroup.com/?l=vulnwatch&m=110977858619314 http://service.real.com/help/faq/security/050224_player/EN/ 2005-03-01 2005-03-04
ImageMagick -- format string vulnerability ImageMagick 6.2.0.3

Tavis Ormandy reports:

magemagick-6.2.0-3 fixes an potential issue handling malformed filenames, the flaw may affect webapps or scripts that use the imagemagick utilities for image processing, or applications linked with libMagick.

This vulnerability could crash ImageMagick or potentially lead to the execution of arbitrary code with the permissions of the user running ImageMagick.

CVE-2005-0397 http://www.ubuntulinux.org/support/documentation/usn/usn-90-1 2005-03-02 2005-03-03
uim -- privilege escalation vulnerability ja-uim 0.4.6

The uim developers reports:

Takumi ASAKI discovered that uim always trusts environment variables. But this is not correct behavior, sometimes environment variables shouldn't be trusted. This bug causes privilege escalation when libuim is linked against setuid/setgid application. Since GTK+ prohibits setuid/setgid applications, the bug appears only in 'immodule for Qt' enabled Qt. (Normal Qt is also safe.)

CVE-2005-0503 http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html 12604 http://secunia.com/advisories/13981 2005-02-21 2005-03-01
lighttpd -- script source disclosure vulnerability lighttpd 1.3.8

The lighttpd website reports:

In lighttpd 1.3.7 and below it is possible to fetch the source files which should be handled by CGI or FastCGI applications.

The vulnerability is in the handling of urlencoded trailing NUL bytes. Installations that do not use CGI or FastCGI are not affected.

CVE-2005-0453 http://article.gmane.org/gmane.comp.web.lighttpd/1171 http://www.lighttpd.net/news/ http://xforce.iss.net/xforce/xfdb/19350 12567 2005-02-12 2005-03-01
phpbb -- privilege elevation and path disclosure phpbb 2.0.13

The phpbb developer group reports:

phpBB Group announces the release of phpBB 2.0.13, the "Beware of the furries" edition. This release addresses two recent security exploits, one of them critical. They were reported a few days after .12 was released and no one is more annoyed than us, having to release a new version ini such a short period of time. Fortunately both fixes are easy and in each case just one line needs to be edited.

http://www.phpbb.com/phpBB/viewtopic.php?t=267563 12678 2005-02-27 2005-02-28 2005-03-05
curl -- authentication buffer overflow vulnerability curl 7.13.1

Two iDEFENSE Security Advisories reports:

An exploitable stack-based buffer overflow condition exists when using NT Lan Manager (NTLM) authentication. The problem specifically exists within Curl_input_ntlm() defined in lib/http_ntlm.c.

Successful exploitation allows remote attackers to execute arbitrary code under the privileges of the target user. Exploitation requires that an attacker either coerce or force a target to connect to a malicious server using NTLM authentication.

An exploitable stack-based buffer overflow condition exists when using Kerberos authentication. The problem specifically exists within the functions Curl_krb_kauth() and krb4_auth() defined in lib/krb4.c.

Successful exploitation allows remote attackers to execute arbitrary code under the privileges of the target user. Exploitation requires that an attacker either coerce or force a target to connect to a malicious server using Kerberos authentication.

12615 12616 CVE-2005-0490 http://marc.theaimsgroup.com/?l=bugtraq&m=110902850731457 http://marc.theaimsgroup.com/?l=bugtraq&m=110902601221592 2004-12-21 2005-02-27
cyrus-imapd -- multiple buffer overflow vulnerabilities cyrus-imapd 2.1.18 2.2.*2.2.11

The Cyrus IMAP Server ChangeLog states:

  • Fix possible single byte overflow in mailbox handling code.
  • Fix possible single byte overflows in the imapd annotate extension.
  • Fix stack buffer overflows in fetchnews (exploitable by peer news server), backend (exploitable by admin), and in imapd (exploitable by users though only on platforms where a filename may be larger than a mailbox name).

The 2.1.X series are reportedly only affected by the second issue.

These issues may lead to execution of arbitrary code with the permissions of the user running the Cyrus IMAP Server.

12636 CVE-2005-0546 http://asg.web.cmu.edu/cyrus/download/imapd/changes.html 2005-02-14 2005-02-27 2005-04-05
sup -- format string vulnerability sup 2.0.20050226

Debian Security Advisory reports:

jaguar@felinemenace.org discovered a format string vulnerability in sup, a set of programs to synchronize collections of files across a number of machines, whereby a remote attacker could potentially cause arbitrary code to be executed with the privileges of the supfilesrv process (this process does not run automatically by default).

10571 CVE-2004-0451 http://www.securityfocus.com/advisories/6874 2004-06-19 2005-02-27
mozilla -- insecure temporary directory vulnerability firefox 1.0.1,1 mozilla 1.7.6,2 linux-mozilla linux-mozilla-devel 1.7.6 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

A predictable name is used for the plugin temporary directory. A malicious local user could symlink this to the victim's home directory and wait for the victim to run Firefox. When Firefox shuts down the victim's directory would be erased.

http://www.mozilla.org/security/announce/mfsa2005-28.html https://bugzilla.mozilla.org/show_bug.cgi?id=281284 2005-02-06 2005-02-26
mozilla -- arbitrary code execution vulnerability firefox 1.0.1,1 mozilla 1.7.6,2 linux-mozilla linux-mozilla-devel 1.7.6 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Plugins (such as flash) can be used to load privileged content into a frame. Once loaded various spoofs can be applied to get the user to interact with the privileged content. Michael Krax's "Fireflashing" example demonstrates that an attacker can open about:config in a frame, hide it with an opacity setting, and if the attacker can get the victim to click at a particular spot (design some kind of simple game) you could toggle boolean preferences, some of which would make further attacks easier.

The "firescrolling" example demonstrates arbitrary code execution (in this case downloading a file) by convincing the user to scroll twice.

Workaround: Disable JavaScript.

CVE-2005-0527 http://www.mikx.de/fireflashing/ http://www.mikx.de/firescrolling/ http://www.mozilla.org/security/announce/mfsa2005-27.html 2005-02-24 2005-02-26
mkbold-mkitalic -- format string vulnerability mkbold-mkitalic 0.07

The version 0.06_1 and prior have a format string vulnerability which can be triggered by using a carefully-crafted BDF font file.

http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/15568 2005-02-23 2005-02-24
phpbb -- multiple information disclosure vulnerabilities phpbb 2.0.12

psoTFX reports:

phpBB Group are pleased to announce the release of phpBB 2.0.12 the "Horray for Furrywood" release. This release addresses a number of bugs and a couple of potential exploits. [...] one of the potential exploits addressed in this release could be serious in certain situations and thus we urge all users, as always, to upgrade to this release as soon as possible. Mostly this release is concerned with eliminating disclosures of information which while useful in debug situations may allow third parties to gain information which could be used to do harm via unknown or unfixed exploits in this or other applications.

The ChangeLog for phpBB 2.0.12 states:

  • Prevented full path display on critical messages
  • Fixed full path disclosure in username handling caused by a PHP 4.3.10 bug - AnthraX101
  • Added exclude list to unsetting globals (if register_globals is on) - SpoofedExistence
  • Fixed arbitrary file disclosure vulnerability in avatar handling functions - AnthraX101
  • Fixed arbitrary file unlink vulnerability in avatar handling functions - AnthraX101
  • Fixed path disclosure bug in search.php caused by a PHP 4.3.10 bug (related to AnthraX101's discovery)
  • Fixed path disclosure bug in viewtopic.php caused by a PHP 4.3.10 bug - matrix_killer
http://www.phpbb.com/support/documents.php?mode=changelog http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=265423 ports/77943 2005-02-22 2005-02-23 2005-02-25
unace -- multiple vulnerabilities unace 1.2b_2 linux-unace 0

Ulf Härnhammar reports:

  • There are buffer overflows when extracting, testing or listing specially prepared ACE archives.
  • There are directory traversal bugs when extracting ACE archives.
  • There are also buffer overflows when dealing with long (>17000 characters) command line arguments.

Secunia reports:

The vulnerabilities have been confirmed in version 1.2b. One of the buffer overflow vulnerabilities have also been reported in version 2.04, 2.2 and 2.5. Other versions may also be affected.

Successful exploitation may allow execution of arbitrary code.

215006 CVE-2005-0160 CVE-2005-0161 http://marc.theaimsgroup.com/?l=full-disclosure&m=110911451613135 http://secunia.com/advisories/14359/ 2005-02-14 2005-02-22 2006-09-26
putty -- pscp/psftp heap corruption vulnerabilities putty 0.57

Simon Tatham reports:

This version fixes a security hole in previous versions of PuTTY, which can allow a malicious SFTP server to attack your client. If you use either PSCP or PSFTP, you should upgrade. Users of the main PuTTY program are not affected. (However, note that the server must have passed host key verification before this attack can be launched, so a man-in-the-middle shouldn't be able to attack you if you're careful.)

12601 CVE-2005-0467 http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html http://marc.theaimsgroup.com/?l=bugtraq&m=110902510713763 http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html 2005-02-20 2005-02-20 2005-02-23
kdelibs -- insecure temporary file creation kdelibs ja-kdelibs 3.3.2_5

Davide Madrisan reports:

The `dcopidlng' script in the KDE library package (kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary files in a unsecure manner.

Note: dcopidlng is only used at build time, so only users installing KDE are vulnerable, not users already running KDE.

CVE-2005-0365 http://bugs.kde.org/show_bug.cgi?id=97608 http://marc.theaimsgroup.com/?l=bugtraq&m=110814653804757 2005-01-21 2005-02-18 2005-02-20
bidwatcher -- format string vulnerability bidwatcher 1.3.17

A Debian Security Advisory reports:

Ulf Härnhammer from the Debian Security Audit Project discovered a format string vulnerability in bidwatcher, a tool for watching and bidding on eBay auctions. This problem can be triggered remotely by a web server of eBay, or someone pretending to be eBay, sending certain data back.

12590 CVE-2005-0158 http://www.debian.org/security/2005/dsa-687 2005-02-18 2005-02-18
gftp -- directory traversal vulnerability gftp 2.0.18

A Debian Security Advisory reports:

Albert Puigsech Galicia discovered a directory traversal vulnerability in a proprietary FTP client (CAN-2004-1376) which is also present in gftp, a GTK+ FTP client. A malicious server could provide a specially crafted filename that could cause arbitrary files to be overwritten or created by the client.

12539 CVE-2005-0372 http://www.debian.org/security/2005/dsa-686 http://www.gftp.org/changelog.html 2005-02-04 2005-02-18
opera -- "data:" URI handler spoofing vulnerability opera opera-devel linux-opera 7.54.20050131

A Secunia Advisory reports:

Michael Holzt has discovered a vulnerability in Opera, which can be exploited by malicious people to trick users into executing malicious files.

The vulnerability is caused due to an error in the processing of "data:" URIs, causing wrong information to be shown in a download dialog. This can be exploited by e.g. a malicious website to trick users into executing a malicious file by supplying a specially crafted "data:" URI.

CVE-2005-0456 882926 http://secunia.com/advisories/13818/ http://www.opera.com/freebsd/changelogs/754u2/ 2005-01-12 2005-02-18
opera -- kfmclient exec command execution vulnerability opera opera-devel linux-opera 7.54.20050131

Giovanni Delvecchio reports:

Opera for linux uses "kfmclient exec" as "Default Application" to handle saved files. This could be used by malicious remote users to execute arbitrary shell commands on a target system.

CVE-2004-1491 http://secunia.com/advisories/13447/ http://www.opera.com/freebsd/changelogs/754u2/ http://www.zone-h.org/advisories/read/id=6503 2004-12-12 2005-02-18
postgresql -- multiple buffer overflows in PL/PgSQL parser postgresql postgresql-server ja-postgresql 7.3.9_1 7.4.*7.4.7_1 8.*8.0.1_1

The PL/PgSQL parser in postgresql is vulnerable to several buffer overflows. These could be exploited by a remote attacker to execute arbitrary code with the permissions of the postgresql server by running a specially crafted query.

CVE-2005-0247 http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php 2005-02-07 2005-02-17 2005-02-19
awstats -- arbitrary command execution awstats 6.4

Several input validation errors exist in AWStats that allow a remote unauthenticated attacker to execute arbitrary commands with the priviliges of the web server. These programming errors involve CGI parameters including loadplugin, logfile, pluginmode, update, and possibly others.

Additionally, the debug and other CGI parameters may be used to cause AWStats to disclose AWStats and system configuration information.

CVE-2005-0362 CVE-2005-0363 CVE-2005-0435 CVE-2005-0436 CVE-2005-0437 CVE-2005-0438 12543 12545 http://marc.theaimsgroup.com/?l=bugtraq&m=110840530924124 http://awstats.sourceforge.net/docs/awstats_changelog.txt http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488 http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf 2005-02-10 2005-02-16 2005-02-23
powerdns -- DoS vulnerability powerdns 2.9.17

PowerDNS is vulnerable to a temporary denial-of-service vulnerability that can be triggered using a random stream of bytes.

12446 http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21 http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17 2004-09-18 2005-02-14
emacs -- movemail format string vulnerability zh-emacs emacs 20.7_4 21.*21.3_4 xemacs xemacs-mule zh-xemacs zh-xemacs-mule 21.4.17 xemacs-devel 21.5.b19,1 xemacs-devel-21.5 b11 xemacs-devel-mule 21.5.b19 mule-common hanemacs 0

Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs. They can be exploited when connecting to a malicious POP server and can allow an attacker can execute arbitrary code under the privileges of the user running Emacs.

CVE-2005-0100 12462 2005-01-31 2005-02-14
ngircd -- format string vulnerability ngircd 0.8.3

A No System Group security advisory reports that ngircd is vulnerable to a format string vulnerability in the Log_Resolver() function of log.c, if IDENT support is enabled. This could allow a remote attacker to execute arbitrary code with the permissions of the ngircd daemon, which is root by default.

Note: By default the FreeBSD ngircd port does not enable IDENT support.

CVE-2005-0226 12434 http://marc.theaimsgroup.com/?l=bugtraq&m=110746413108183 2005-02-03 2005-02-13
ngircd -- buffer overflow vulnerability ngircd 0.8.2

Florian Westphal discovered a buffer overflow in ngircd which can be used remotely crash the server and possibly execute arbitrary code.

CVE-2005-0199 12397 http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html 2005-01-26 2005-02-13
mod_python -- information leakage vulnerability mod_python 2.7.11 3.*3.1.4

Mark J Cox reports:

Graham Dumpleton discovered a flaw which can affect anyone using the publisher handle of the Apache Software Foundation mod_python. The publisher handle lets you publish objects inside modules to make them callable via URL. The flaw allows a carefully crafted URL to obtain extra information that should not be visible (information leak).

CVE-2005-0088 2005-01-30 2005-02-13
mailman -- directory traversal vulnerability mailman ja-mailman 2.1.5_2

A directory traversal vulnerability in mailman allow remote attackers to read arbitrary files due to inadequate input sanitizing. This could, among other things, lead remote attackers to gaining access to the mailman configuration database (which contains subscriber email addresses and passwords) or to the mail archives for private lists.

CVE-2005-0202 http://marc.theaimsgroup.com/?l=full-disclosure&m=110797575304304 2005-01-02 2005-02-12
enscript -- multiple vulnerabilities enscript-a4 enscript-letter enscript-letterdj 1.6.4_1

Erik Sjölund discovered several issues in enscript: it suffers from several buffer overflows, quotes and shell escape characters are insufficiently sanitized in filenames, and it supported taking input from an arbitrary command pipe, with unwanted side effects.

CVE-2004-1184 CVE-2004-1185 CVE-2004-1186 http://www.gentoo.org/security/en/glsa/glsa-200502-03.xml 2005-02-02 2005-02-11
postgresql -- privilege escalation vulnerability postgresql postgresql-server ja-postgresql 7.3.9 7.4.*7.4.7 8.*8.0.1 postgresql-devel 8.0.1,1

John Heasman and others disovered that non-privileged users could use the LOAD extension to load arbitrary libraries into the postgres server process space. This could be used by non-privileged local users to execute arbitrary code with the privileges of the postgresql server.

12411 CVE-2005-0227 http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php 2005-01-21 2005-02-08
ethereal -- multiple protocol dissectors vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.8.100.10.9

An Ethreal Security Advisories reports:

Issues have been discovered in the following protocol dissectors:

  • The COPS dissector could go into an infinite loop. CVE: CAN-2005-0006
  • The DLSw dissector could cause an assertion. CVE: CAN-2005-0007
  • The DNP dissector could cause memory corruption. CVE: CAN-2005-0008
  • The Gnutella dissector could cuase an assertion. CVE: CAN-2005-0009
  • The MMSE dissector could free statically-allocated memory. CVE: CAN-2005-0010
  • The X11 dissector is vulnerable to a string buffer overflow. CVE: CAN-2005-0084

Impact: It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

CVE-2005-0006 CVE-2005-0007 CVE-2005-0008 CVE-2005-0009 CVE-2005-0010 CVE-2005-0084 12326 http://www.ethereal.com/appnotes/enpa-sa-00017.html 2005-01-18 2005-02-08
squid -- correct handling of oversized HTTP reply headers squid 2.5.7_12

The squid patches page notes:

This patch addresses a HTTP protocol mismatch related to oversized reply headers. In addition it enhances the cache.log reporting on reply header parsing failures to make it easier to track down which sites are malfunctioning.

It is believed that this bug may lead to cache pollution or allow access controls to be bypassed.

CVE-2005-0241 http://www.squid-cache.org/bugs/show_bug.cgi?id=1216 http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch ports/76967 823350 2005-01-31 2005-02-08
python -- SimpleXMLRPCServer.py allows unrestricted traversal python python+ipv6 2.22.2.3_7 2.32.3.4_4 2.42.4_1 2.5.a0.200501292.5.a0.20050129_1

According to Python Security Advisory PSF-2005-001,

The Python development team has discovered a flaw in the SimpleXMLRPCServer library module which can give remote attackers access to internals of the registered object or its module or possibly other modules. The flaw only affects Python XML-RPC servers that use the register_instance() method to register an object without a _dispatch() method. Servers using only register_function() are not affected.

On vulnerable XML-RPC servers, a remote attacker may be able to view or modify globals of the module(s) containing the registered instance's class(es), potentially leading to data loss or arbitrary code execution. If the registered object is a module, the danger is particularly serious. For example, if the registered module imports the os module, an attacker could invoke the os.system() function.

Note: This vulnerability affects your system only if you're running SimpleXMLRPCServer-based server. This isn't harmful at all if you don't run any internet server written in Python or your server doesn't serve in XML-RPC protocol.

CVE-2005-0089 http://www.python.org/security/PSF-2005-001/ 2005-02-03 2005-02-03 2006-10-08
perl -- vulnerabilities in PERLIO_DEBUG handling perl 5.85.8.6_2

Kevin Finisterre discovered bugs in perl's I/O debug support:

  • The environmental variable PERLIO_DEBUG is honored even by the set-user-ID perl command (usually named sperl or suidperl). As a result, a local attacker may be able to gain elevated privileges. (CVE-2005-0155)
  • A buffer overflow may occur in threaded versions of perl when the full pathname of the script being executed is very long. (CVE-2005-0156).

Note: By default, no set-user-ID perl binary is installed. An administrator must enable it manually at build time with the ENABLE_SUIDPERL port flag.

CVE-2005-0155 CVE-2005-0156 2005-02-02 2005-02-02
newsgrab -- insecure file and directory creation newsgrab 0.4.0

The newsgrab script uses insecure permissions during the creation of the local output directory and downloaded files.

After a file is created, permissions on it are set using the mode value of the newsgroup posting. This can potentially be a problem when the mode is not restrictive enough. In addition, the output directory is created with world writable permissions allowing other users to drop symlinks or other files at that location.

http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt http://sourceforge.net/project/shownotes.php?release_id=300562 CVE-2005-0154 2005-01-18 2005-02-01
newsgrab -- directory traversal vulnerability newsgrab 0.4.0

The newsgrab script creates files by using the names provided in the newsgroup messages in a perl open() call. This is done without performing any security checks to prevent a directory traversal. A specially crafted newsgroup message could cause newsgrab to drop an attachment anywhere on the file system using the permissions of the user running the script.

http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt http://sourceforge.net/project/shownotes.php?release_id=300562 CVE-2005-0153 2005-01-18 2005-02-01
newspost -- server response buffer overflow vulnerability newspost 2.1.1

The newspost program uses a function named socket_getline to read server responses from the network socket. Unfortunately this function does not check the length of the buffer in which the read data is stored and only stops reading when a newline character is found.

A malicious NNTP server could use this bug to cause a buffer overflow by sending an overly long response. Such an overflow allows arbitrary code to be executed, with the privileges of the newspost process, on the affected systems.

http://people.freebsd.org/~niels/issues/newspost-20050114.txt CVE-2005-0101 2005-01-14 2005-02-01
newsfetch -- server response buffer overflow vulnerability newsfetch 1.21_1

The newsfetch program uses the sscanf function to read information from server responses into static memory buffers. Unfortunately this is done without any proper bounds checking. As a result long server responses may cause an overflow when a newsgroup listing is requested from an NNTP server.

http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt CVE-2005-0132 2005-01-18 2005-02-01
squid -- buffer overflow in WCCP recvfrom() call squid 2.5.7_10

According to the Squid Proxy Cache Security Update Advisory SQUID-2005:3,

The WCCP recvfrom() call accepts more data than will fit in the allocated buffer. An attacker may send a larger-than-normal WCCP message to Squid and overflow this buffer.

Severity:

The bug is important because it allows remote attackers to crash Squid, causing a disription in service. However, the bug is exploitable only if you have configured Squid to send WCCP messages to, and expect WCCP replies from, a router.

Sites that do not use WCCP are not vulnerable.

Note that while the default configuration of the FreeBSD squid port enables WCCP support in general, the default configuration supplied does not actually configure squid to send and receive WCCP messages.

CVE-2005-0211 886006 http://www.squid-cache.org/Advisories/SQUID-2005_3.txt http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow http://www.squid-cache.org/bugs/show_bug.cgi?id=1217 2005-01-28 2005-01-28 2005-02-13
xpdf -- makeFileKey2() buffer overflow vulnerability xpdf 3.00_6 kdegraphics 3.3.2_2 gpdf 2.8.3 teTeX-base 2.0.2_9 cups-base 1.1.23.0_3 koffice 1.3.5_2,1 pdftohtml 0.36_2

An iDEFENSE Security Advisory reports:

Remote exploitation of a buffer overflow vulnerability in the xpdf PDF viewer included in multiple Unix and Linux distributions could allow for arbitrary code execution as the user viewing a PDF file.

The vulnerability specifically exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. The offending code can be found in the Decrypt::makeFileKey2 function in the source file xpdf/Decrypt.cc.

CVE-2005-0064 http://marc.theaimsgroup.com/?l=bugtraq&m=110608898221554 http://www.koffice.org/security/advisory-20050120-1.txt 2005-01-06 2005-01-26 2005-02-03
zhcon -- unauthorized file access zhcon zh-zhcon 0.2.3_3

Martin Joey Schulze reports:

Erik Sjöund discovered that zhcon, a fast console CJK system using the Linux framebuffer, accesses a user-controlled configuration file with elevated privileges. Thus, it is possible to read arbitrary files.

When installed from the FreeBSD Ports Collection, zhcon is installed set-user-ID root.

CVE-2005-0072 2005-01-25 2005-01-25
evolution -- arbitrary code execution vulnerability evolution 2.0.3_1

Martin Joey Schulze reports:

Max Vozeler discovered an integer overflow in the helper application camel-lock-helper which runs setuid root or setgid mail inside of Evolution, a free groupware suite. A local attacker can cause the setuid root helper to execute arbitrary code with elevated privileges via a malicious POP server.

12354 CVE-2005-0102 http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&view=log#rev1.5.74.1 2005-01-20 2005-01-25 2005-02-02
mod_dosevasive -- insecure temporary file creation mod_dosevasive20 1.10

An LSS Security Advisory reports:

When a denial of service attack is detected, mod_dosevasive will, among other things, create a temporary file which it will use to trace actions from the offensive IP address. This file is insecurely created in /tmp and it's name is easily predictable.

It is then easy for an attacker to create arbitrary files in any directory that the user under which apache runs has privileges to write.

[...] once the target file is opened, there is a race attack (although difficult to exploit) which can lead to mod_dosevasive overwriting any file that the user under which apache runs has privileges to write.

ports/77513 http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-01 2005-01-04 2005-01-24 2005-02-22
squid -- possible cache-poisoning via malformed HTTP responses squid 2.5.7_9

The squid patches page notes:

This patch makes Squid considerably stricter while parsing the HTTP protocol.

  1. A Content-length header should only appear once in a valid request or response. Multiple Content-length headers, in conjunction with specially crafted requests, may allow Squid's cache to be poisoned with bad content in certain situations.
  2. CR characters is only allowed as part of the CR NL line terminator, not alone. This to ensure that all involved agrees on the structure of HTTP headers.
  3. Rejects requests/responses that have whitespace in an HTTP header name.

To enable these strict parsing rules, update to at least squid-2.5.7_9 and specify relaxed_header_parser off in squid.conf.

CVE-2005-0174 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing 768702 2005-01-24 2005-01-24 2006-01-02
bugzilla -- cross-site scripting vulnerability bugzilla ja-bugzilla 2.16.8 2.17.*2.18

A Bugzilla advisory states:

This advisory covers a single cross-site scripting issue that has recently been discovered and fixed in the Bugzilla code: If a malicious user links to a Bugzilla site using a specially crafted URL, a script in the error page generated by Bugzilla will display the URL unaltered in the page, allowing scripts embedded in the URL to execute.

CVE-2004-1061 http://www.bugzilla.org/security/2.16.7-nr/ https://bugzilla.mozilla.org/show_bug.cgi?id=272620 2004-12-01 2005-01-24
web browsers -- window injection vulnerabilities firefox 1.0.1,1 mozilla 1.7.6,2 linux-mozilla linux-mozilla-devel 1.7.6 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 mozilla-gtk1 0 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0 kdebase kdelibs 3.3.2 opera opera-devel linux-opera 7.54.20050131

A Secunia Research advisory reports:

Secunia Research has reported a vulnerability in multiple browsers, which can be exploited by malicious people to spoof the content of websites.

The problem is that a website can inject content into another site's window if the target name of the window is known. This can e.g. be exploited by a malicious website to spoof the content of a pop-up window opened on a trusted website.

Secunia has constructed a test, which can be used to check if your browser is affected by this issue: http://secunia.com/multiple_browsers_window_injection_vulnerability_test/

A workaround for Mozilla-based browsers is available.

http://secunia.com/secunia_research/2004-13/advisory/ http://secunia.com/multiple_browsers_window_injection_vulnerability_test/ CVE-2004-1156 http://secunia.com/advisories/13129/ https://bugzilla.mozilla.org/show_bug.cgi?id=273699 https://bugzilla.mozilla.org/show_bug.cgi?id=103638 http://mozillanews.org/?article_date=2004-12-08+06-48-46 CVE-2004-1157 http://secunia.com/advisories/13253/ CVE-2004-1158 http://secunia.com/advisories/13254/ http://www.kde.org/info/security/advisory-20041213-1.txt CVE-2004-1160 http://secunia.com/advisories/13402/ 2004-12-08 2005-01-24 2005-02-26
yamt -- arbitrary command execution vulnerability yamt 0.5_2

Manigandan Radhakrishnan discovered a security vulnerability in YAMT which can lead to execution of arbitrary commands with the privileges of the user running YAMT when sorting based on MP3 tags. The problem exist in the id3tag_sort() routine which does not properly sanitize the artist tag from the MP3 file before using it as an argument to the mv command.

11999 CVE-2004-1302 http://tigger.uic.edu/~jlongs2/holes/yamt.txt 2004-12-15 2005-01-23 2005-01-25
squid -- HTTP response splitting cache pollution attack squid 2.5.7_8

According to a whitepaper published by Sanctum, Inc., it is possible to mount cache poisoning attacks against, among others, squid proxies by inserting false replies into the HTTP stream.

The squid patches page notes:

This patch additionally strengthens Squid from the HTTP response attack described by Sanctum.

CVE-2005-0175 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting http://www.squid-cache.org/bugs/show_bug.cgi?id=1200 https://www.watchfire.com/securearea/whitepapers.aspx?id=8 625878 2004-03-01 2005-01-22 2005-02-07
horde -- XSS vulnerabilities horde horde-php5 3.*3.0.1

A Hyperdose Security Advisory reports:

Horde contains two XSS attacks that can be exploited through GET requests. Once exploited, these requests could be used to execute any javascript commands in the context of that user, potentially including but not limited to reading and deleting email, and stealing auth tokens.

12255 http://marc.theaimsgroup.com/?l=bugtraq&m=110564059322774 http://lists.horde.org/archives/announce/2005/000159.html 2005-01-04 2005-01-22
mc -- multiple vulnerabilities mc 4.6.0

Andrew V. Samoilov reported several vulnerabilities that were corrected in MidnightCommand 4.6.0:

  • Format string issues (CVE-2004-1004)
  • Buffer overflows (CVE-2004-1005)
  • Denial-of-service, infinite loop (CVE-2004-1009)
  • Denial-of-service, corrupted section header (CVE-2004-1090)
  • Denial-of-service, null pointer dereference (CVE-2004-1091)
  • Freeing unallocated memory (CVE-2004-1092)
  • Using already freed memory (CVE-2004-1093)
CVE-2004-1004 CVE-2004-1005 CVE-2004-1009 CVE-2004-1090 CVE-2004-1091 CVE-2004-1092 CVE-2004-1093 2004-12-01 2005-01-21
perl -- File::Path insecure file/directory permissions perl 05.6.2 5.8.05.8.6

Jeroen van Wolffelaar reports that the Perl module File::Path contains a race condition wherein traversed directories and files are temporarily made world-readable/writable.

CVE-2004-0452 http://www.debian.org/security/2004/dsa-620 http://xforce.iss.net/xforce/xfdb/18650 2004-12-30 2005-01-21 2005-02-01
opera -- multiple vulnerabilities in Java implementation opera opera-devel linux-opera 7.54.20041210

Marc Schoenefeld reports:

Opera 7.54 is vulnerable to leakage of the java sandbox, allowing malicious applets to gain unacceptable privileges. This allows them to be used for information gathering (spying) of local identity information and system configurations as well as causing annoying crash effects.

Opera 754 [sic] which was released Aug 5,2004 is vulnerable to the XSLT processor covert channel attack, which was corrected with JRE 1.4.2_05 [released in July 04], but in disadvantage to the users the opera packaging guys chose to bundle the JRE 1.4.2_04 [...]

Internal pointer DoS exploitation: Opera.jar contains the opera replacement of the java plugin. It therefore handles communication between javascript and the Java VM via the liveconnect protocol. The public class EcmaScriptObject exposes a system memory pointer to the java address space, by constructing a special variant of this type an internal cache table can be polluted by false entries that infer proper function of the JSObject class and in the following proof-of-concept crash the browser.

Exposure of location of local java installation Sniffing the URL classpath allows to retrieve the URLs of the bootstrap class path and therefore the JDK installation directory.

Exposure of local user name to an untrusted applet An attacker could use the sun.security.krb5.Credentials class to retrieve the name of the currently logged in user and parse his home directory from the information which is provided by the thrown java.security.AccessControlException.

http://marc.theaimsgroup.com/?l=bugtraq&m=110088923127820 2004-11-19 2005-01-24
sudo -- environmental variable CDPATH is not cleared sudo 1.6.8.4

A sudo bug report says:

sudo doesn't unset the CDPATH variable, which leads to possible security problems.

http://www.sudo.ws/bugs/show_bug.cgi?id=155 http://www.sudo.ws/pipermail/sudo-announce/2004-November/000044.html 2004-10-18 2005-01-21
fcron -- multiple vulnerabilities fcron 2.9.5.1

An iDEFENSE Security Advisory states:

Multiple vulnerabilities have been found in Fcron.

  1. File contents disclosure
  2. Configuration Bypass Vulnerability
  3. File Removal and Empty File Creation Vulnerability
  4. Information Disclosure Vulnerability
http://www.idefense.com/application/poi/display?id=157&type=vulnerabilities&flashstatus=false CVE-2004-1030 CVE-2004-1031 CVE-2004-1032 CVE-2004-1033 2004-11-15 2005-01-21
realplayer -- arbitrary file deletion and other vulnerabilities linux-realplayer 10.0.2

An NGSSoftware Insight Security Research Advisory reports:

Two vulnerabilities have been discovered in RealPlayer which may potentially be leveraged to allow remote code execution, or may used in combination with the Real Metadata Package File Deletion vulnerability to reliably delete files from a users system.

http://www.ngssoftware.com/advisories/real-02full.txt http://www.ngssoftware.com/advisories/real-03full.txt http://service.real.com/help/faq/security/040928_player/EN/ 2004-10-06 2005-01-21
imlib -- xpm heap buffer overflows and integer overflows imlib 1.9.15_2 imlib2 1.1.2_1

Pavel Kankovsky reports:

Imlib affected by a variant of CAN-2004-0782 too.

I've discovered more vulnerabilities in Imlib (1.9.13). In particular, it appears to be affected by a variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see http://scary.beasts.org/security/CESA-2004-003.txt). Look at the attached image, it kills ee on my 7.3.

The flaws also affect imlib2.

CVE-2004-1025 CVE-2004-1026 11830 https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138516 http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c#rev1.3 2004-12-06 2005-01-21
egroupware -- arbitrary file download in JiNN eGroupWare 1.0.0.006

eGroupWare contains a bug in the JiNN component that allows a remote attacker to download arbitrary files.

http://cvs.sourceforge.net/viewcvs.py/egroupware/jinn/CHANGELOG#rev1.24 http://sourceforge.net/mailarchive/forum.php?thread_id=5915445&forum_id=35178 2004-10-15 2005-01-21
quake2 -- multiple critical vulnerabilities quake2forge 0 quake2lnx 0.16.2

An advisory published by Richard Stanway describes numerous critical vulnerabilities in the Quake II engine:

Due to unchecked input at various stages in the server, remote users are able to cause the server to crash, reveal sensitive information or potentially execute arbitrary code.

http://secur1ty.net/advisories/001 http://marc.theaimsgroup.com/?l=bugtraq&m=109892527321706 2004-10-27 2005-01-21 2005-03-15
konversation -- shell script command injection konversation 0.15

Konversation comes with Perl scripts that do not properly escape shell characters on executing a script. This makes it possible to attack Konversation with shell script command injection.

CVE-2005-0129 CVE-2005-0130 CVE-2005-0131 http://marc.theaimsgroup.com/?l=full-disclosure&m=110616016509114 2005-01-19 2005-01-19 2005-01-21
squid -- no sanity check of usernames in squid_ldap_auth squid 2.5.7_7

The LDAP authentication helper did not strip leading or trailing spaces from the login name. According to the squid patches page:

LDAP is very forgiving about spaces in search filters and this could be abused to log in using several variants of the login name, possibly bypassing explicit access controls or confusing accounting.

Workaround: Block logins with spaces

	    acl login_with_spaces proxy_auth_regex [:space:]
		    http_access deny login_with_spaces
	    
CVE-2005-0173 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces http://www.squid-cache.org/bugs/show_bug.cgi?id=1187 924198 2005-01-10 2005-01-19 2005-02-08
cups-base -- CUPS server remote DoS vulnerability cups-base 1.1.211.1.23

Kenshi Muto discovered that the CUPS server would enter an infinite loop when processing a URL containing /...

12200 CVE-2005-2874 http://www.cups.org/str.php?L1042 2004-12-30 2005-01-18 2005-09-21
tiff -- divide-by-zero denial-of-service tiff linux-tiff 3.6.0 pdflib pdflib-perl 6.0.1 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

A US-CERT vulnerability note reports:

An Integer overflow in the LibTIFF library may allow a remote attacker to cause a divide-by-zero error that results in a denial-of-service condition.

CVE-2004-0804 555304 http://bugzilla.remotesensing.org/show_bug.cgi?id=111 2002-03-27 2005-01-18 2006-06-08
zgv -- exploitable heap overflows zgv 5.8_1 xzgv 0.8_2

infamous41md reports:

zgv uses malloc() frequently to allocate memory for storing image data. When calculating how much to allocate, user supplied data from image headers is multiplied and/or added without any checks for arithmetic overflows. We can overflow numerous calculations, and cause small buffers to be allocated. Then we can overflow the buffer, and eventually execute code. There are a total of 11 overflows that are exploitable to execute arbitrary code.

These bugs exist in both zgv and xzgv.

http://marc.theaimsgroup.com/?l=bugtraq&m=109886210702781 http://marc.theaimsgroup.com/?l=bugtraq&m=109898111915661 http://rus.members.beeb.net/xzgv.html http://www.svgalib.org/rus/zgv/ CVE-2004-0994 http://www.idefense.com/application/poi/display?id=160&type=vulnerabilities&flashstatus=false 2004-10-26 2005-01-18 2005-01-21
mozilla -- insecure permissions for some downloaded files thunderbird 0.9 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 1.0.r2,1 de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7.5 mozilla 1.7.5,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0

In a Mozilla bug report, Daniel Kleinsinger writes:

I was comparing treatment of attachments opened directly from emails on different platforms. I discovered that Linux builds save attachments in /tmp with world readable rights. This doesn't seem like a good thing. Couldn't someone else logged onto the same machine read your attachments?

This could expose the contents of downloaded files or email attachments to other users on a multi-user system.

https://bugzilla.mozilla.org/show_bug.cgi?id=251297 http://marc.theaimsgroup.com/?l=full-disclosure&m=109865078103911 2004-07-13 2005-01-18
awstats -- remote command execution vulnerability awstats 6.3

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation vulnerability in AWStats allows attackers to execute arbitrary commands under the privileges of the web server.

The problem specifically exists when the application is running as a CGI script on a web server. The "configdir" parameter contains unfiltered user-supplied data that is utilized in a call to the Perl routine open()...

Successful exploitation allows remote attackers to execute arbitrary commands under the privileges of the web server. This can lead to further compromise as it provides remote attackers with local access.

12270 CVE-2005-0116 272296 http://marc.theaimsgroup.com/?l=full-disclosure&m=110600949323439 http://awstats.sourceforge.net/docs/awstats_changelog.txt http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false 2004-10-21 2005-01-18 2005-02-23
ImageMagick -- PSD handler heap overflow vulnerability ImageMagick 6.1.8.8

An iDEFENSE Security Advisory reports:

Remote exploitation of a buffer overflow vulnerability in The ImageMagick's Project's ImageMagick PSD image-decoding module could allow an attacker to execute arbitrary code.

Exploitation may allow attackers to run arbitrary code on a victim's computer if the victim opens a specially formatted image. Such images could be delivered by e-mail or HTML, in some cases, and would likely not raise suspicion on the victim's part. Exploitation is also possible when a web-based application uses ImageMagick to process user-uploaded image files.

CVE-2005-0005 http://www.idefense.com/application/poi/display?id=184&type=vulnerabilities 2004-12-21 2005-01-18
cups-lpr -- lppasswd multiple vulnerabilities cups-lpr fr-cups-lpr 1.1.23

D. J. Bernstein reports that Bartlomiej Sieka has discovered several security vulnerabilities in lppasswd, which is part of CUPS. In the following excerpt from Bernstein's email, CVE names have been added for each issue:

First, lppasswd blithely ignores write errors in fputs(line,outfile) at lines 311 and 315 of lppasswd.c, and in fprintf(...) at line 346. An attacker who fills up the disk at the right moment can arrange for /usr/local/etc/cups/passwd to be truncated. (CAN-2004-1268)

Second, if lppasswd bumps into a file-size resource limit while writing passwd.new, it leaves passwd.new in place, disabling all subsequent invocations of lppasswd. Any local user can thus disable lppasswd... (CAN-2004-1269)

Third, line 306 of lppasswd.c prints an error message to stderr but does not exit. This is not a problem on systems that ensure that file descriptors 0, 1, and 2 are open for setuid programs, but it is a problem on other systems; lppasswd does not check that passwd.new is different from stderr, so it ends up writing a user-controlled error message to passwd if the user closes file descriptor 2. (CAN-2004-1270)

Note: The third issue, CVE-2004-1270, does not affect FreeBSD 4.6-RELEASE or later systems, as these systems ensure that the file descriptors 0, 1, and 2 are always open for set-user-ID and set-group-ID programs.

CVE-2004-1268 CVE-2004-1269 CVE-2004-1270 12007 12004 http://www.cups.org/str.php?L1023 http://tigger.uic.edu/~jlongs2/holes/cups2.txt 2004-12-11 2005-01-17
cups-base -- HPGL buffer overflow vulnerability cups-base fr-cups-base 1.1.22.0_2

Ariel Berkman has discovered a buffer overflow vulnerability in CUPS's HPGL input driver. This vulnerability could be exploited to execute arbitrary code with the permission of the CUPS server by printing a specially crated HPGL file.

11968 CVE-2004-1267 http://tigger.uic.edu/~jlongs2/holes/cups.txt http://www.cups.org/str.php?L1024 2004-12-15 2005-01-17
mysql-scripts -- mysqlaccess insecure temporary file creation mysql-scripts 3.23.58_2 4.*4.0.23a_1 4.1.*4.1.9_1 5.*5.0.2_1

The Debian Security Team reports:

Javier Fernández-Sanguino Peña from the Debian Security Audit Project discovered a temporary file vulnerability in the mysqlaccess script of MySQL that could allow an unprivileged user to let root overwrite arbitrary files via a symlink attack and could also could unveil the contents of a temporary file which might contain sensitive information.

CVE-2005-0004 http://lists.mysql.com/internals/20600 2005-01-12 2005-01-16 2005-01-17
unrtf -- buffer overflow vulnerability unrtf 0.19.3_1

Yosef Klein and Limin Wang have found a buffer overflow vulnerability in unrtf that can allow an attacker to execute arbitrary code with the permissions of the user running unrtf, by running unrtf on a specially crafted rtf document.

12030 CVE-2004-1297 http://tigger.uic.edu/~jlongs2/holes/unrtf.txt 2004-12-15 2005-01-16 2005-02-11
mozilla -- heap overflow in NNTP handler de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 0 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7.5 mozilla 1.7.5,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape mozilla+ipv6 mozilla-embedded mozilla-gtk2 mozilla-gtk 0

Maurycy Prodeus reports a critical vulnerability in Mozilla-based browsers:

Mozilla browser supports NNTP urls. Remote side is able to trigger news:// connection to any server. I found a flaw in NNTP handling code which may cause heap overflow and allow remote attacker to execute arbitrary code on client machine.

CVE-2004-1316 http://isec.pl/vulnerabilities/isec-0020-mozilla.txt http://marc.theaimsgroup.com/?l=bugtraq&m=110436284718949 2004-12-29 2005-01-13
mpg123 -- buffer overflow vulnerability mpg123 mpg123-nas mpg123-esound 0.59r_17

Yuri D'Elia has found a buffer overflow vulnerability in mpg123's parsing of frame headers in input streams. This vulnerability can potentially lead to execution of arbitrary code with the permissions of the user running mpg123, if the user runs mpg123 on a specially crafted MP2 or MP3 file.

CVE-2004-0991 2005-01-01 2005-01-13
squid -- denial of service with forged WCCP messages squid 2.5.7_6

The squid patches page notes:

WCCP_I_SEE_YOU messages contain a 'number of caches' field which should be between 1 and 32. Values outside that range may crash Squid if WCCP is enabled, and if an attacker can spoof UDP packets with the WCCP router's IP address.

CVE-2005-0095 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service http://www.squid-cache.org/bugs/show_bug.cgi?id=1190 http://www.squid-cache.org/Advisories/SQUID-2005_2.txt 2005-01-07 2005-01-12 2005-01-22
squid -- buffer overflow vulnerability in gopherToHTML squid 2.5.7_6

The squid patches page notes:

A malicious gopher server may return a response with very long lines that cause a buffer overflow in Squid.

Workaround: Since gopher is very obscure these days, do not allow Squid to any gopher servers. Use an ACL rule like:

acl Gopher proto gopher
http_access deny Gopher
CVE-2005-0094 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing http://www.squid-cache.org/bugs/show_bug.cgi?id=1189 http://www.squid-cache.org/Advisories/SQUID-2005_1.txt 2005-01-11 2005-01-12 2005-01-22
libxine -- DVD subpicture decoder heap overflow libxine 1.0.r6

A xine security announcement states:

A heap overflow has been found in the DVD subpicture decoder of xine-lib. This can be used for a remote heap overflow exploit, which can, on some systems, lead to or help in executing malicious code with the permissions of the user running a xine-lib based media application.

CVE-2004-1379 http://xinehq.de/index.php/security/XSA-2004-5 2004-09-06 2005-01-12 2005-01-19
libxine -- multiple vulnerabilities in VideoCD handling libxine 1.0.r21.0.r6

A xine security announcement states:

Several string overflows on the stack have been fixed in xine-lib, some of them can be used for remote buffer overflow exploits leading to the execution of arbitrary code with the permissions of the user running a xine-lib based media application.

Stack-based string overflows have been found:

  1. in the code which handles VideoCD MRLs
  2. in VideoCD code reading the disc label
  3. in the code which parses text subtitles and prepares them for display
http://xinehq.de/index.php/security/XSA-2004-4 2004-09-07 2005-01-12
libxine -- multiple buffer overflows in RTSP mplayer mplayer-gtk mplayer-gtk2 mplayer-esound mplayer-gtk-esound mplayer-gtk2-esound 0.99.4 libxine 1.0.r4

A xine security announcement states:

Multiple vulnerabilities have been found and fixed in the Real-Time Streaming Protocol (RTSP) client for RealNetworks servers, including a series of potentially remotely exploitable buffer overflows. This is a joint advisory by the MPlayer and xine teams as the code in question is common to these projects.

Severity: High (arbitrary remote code execution under the user ID running the player) when playing Real RTSP streams. At this time, there is no known exploit for these vulnerabilities.

CVE-2004-0433 http://xinehq.de/index.php/security/XSA-2004-3 http://xforce.iss.net/xforce/xfdb/16019 10245 2004-05-25 2005-01-12
hylafax -- unauthorized login vulnerability hylafax 4.2.1

A flaw in HylaFAX may allow an attacker to bypass normal authentication by spoofing their DNS PTR records.

CVE-2004-1182 http://marc.theaimsgroup.com/?l=bugtraq&m=110546971307585 2005-01-11 2005-01-11
xshisen -- local buffer overflows xshisen 1.36_1

Steve Kemp has found buffer overflows in the handling of the command line flag -KCONV and the XSHISENLIB environment variable. Ulf Härnhammer has detected an unbounded copy from the GECOS field to a char array. All overflows can be exploited to gain group games privileges.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=213957 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784 CVE-2003-1053 CVE-2005-0117 2005-01-11 2005-01-11 2005-01-19
helvis -- arbitrary file deletion problem ko-helvis 1.8h2_1 helvis 1.8h2_1

The setuid root elvprsv utility, used to preserve recovery helvis files, can be abused by local users to delete with root privileges.

The problem is that elvprsv deletes files when it thinks they have become corrupt. When elvprsv is pointed to a normal file then it will almost always think the file is corrupt and deletes it. This behavior may be exploited by local attackers to delete critical files.

CVE-2005-0120 http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt 2004-11-24 2005-01-10 2005-01-19
helvis -- information leak vulnerabilities ko-helvis 1.8h2_1 helvis 1.8h2_1

Once a recovery file has been preserved by the setuid root elvprsv utility it is placed in a worldreadable directory with worldreadable permissions. This possibly allows sensitive information to leak.

In addition to this information leak, it is possible for users to recover files that belong to other users by using elvrec, another setuid root binary.

CVE-2005-0118 CVE-2005-0119 http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt 2004-11-24 2005-01-10 2005-01-19
dillo -- format string vulnerability dillo 0.8.3_1

dillo contains a format string vulnerability which could lead to execution of arbitrary code simply by viewing a web page or opening a HTML file.

CVE-2005-0012 http://bugs.gentoo.org/show_bug.cgi?id=76665 2005-01-04 2005-01-08
tnftp -- mget does not check for directory escapes tnftp 20050103

When downloading a batch of files from an FTP server the mget command does not check for directory escapes. A specially crafted file on the FTP server could then potentially overwrite an existing file of the user.

CVE-2004-1294 http://tigger.uic.edu/~jlongs2/holes/tnftp.txt http://cvsweb.netbsd.org/bsdweb.cgi/othersrc/usr.bin/tnftp/src/cmds.c?rev=1.1.1.3&content-type=text/x-cvsweb-markup http://it.slashdot.org/article.pl?sid=04/12/15/2113202 http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132 2004-12-15 2005-01-07 2005-01-13
tiff -- tiffdump integer overflow vulnerability tiff 3.7.1_2 linux-tiff 3.6.1_1

Dmitry V. Levin found a potential integer overflow in the tiffdump utility which could lead to execution of arbitrary code. This could be exploited by tricking an user into executing tiffdump on a specially crafted tiff image.

CVE-2004-1183 2005-01-06 2005-01-06 2005-03-01
tiff -- directory entry count integer overflow vulnerability tiff 3.7.1 linux-tiff 3.6.1_1 pdflib pdflib-perl 6.0.1_1 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

In an iDEFENSE Security Advisory infamous41md reports:

Remote exploitation of a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code.

The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry. A TIFF file includes a number of directory entry header fields that describe the data in the file. Included in these entries is an entry count and offset value that are calculated to determine the size and location of the data for that entry.

12075 CVE-2004-1308 http://www.idefense.com/application/poi/display?id=174&type=vulnerabilities 125598 2004-12-17 2005-01-06 2006-06-08
vim -- vulnerabilities in modeline handling vim vim-lite vim+ruby 6.3.45

Ciaran McCreesh discovered news ways in which a VIM modeline can be used to trojan a text file. The patch by Bram Moolenaar reads:

Problem: Unusual characters in an option value may cause unexpected behavior, especially for a modeline. (Ciaran McCreesh)

Solution: Don't allow setting termcap options or 'printdevice' or 'titleold' in a modeline. Don't list options for "termcap" and "all" in a modeline. Don't allow unusual characters in 'filetype', 'syntax', 'backupext', 'keymap', 'patchmode' and 'langmenu'.

Note: It is generally recommended that VIM users use set nomodeline in ~/.vimrc to avoid the possibility of trojaned text files.

CVE-2004-1138 ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045 http://groups.yahoo.com/group/vimdev/message/38084 2004-12-09 2005-01-06 2005-01-13
pcal -- buffer overflow vulnerabilities pcal 4.8.0

Danny Lungstrom has found two buffer overflow vulnerabilities in pcal which can lead to execution of arbitrary code by making a user run pcal on a specially crafted calendar file.

CVE-2004-1289 12035 12036 http://securesoftware.list.cr.yp.to/archive/0/46 2004-12-15 2005-01-06
exim -- two buffer overflow vulnerabilities exim exim-ldap exim-ldap2 exim-mysql exim-postgresql exim-sa-exim 4.43+28_1

1. The function host_aton() can overflow a buffer if it is presented with an illegal IPv6 address that has more than 8 components.

2. The second report described a buffer overflow in the function spa_base64_to_bits(), which is part of the code for SPA authentication.

http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html http://marc.theaimsgroup.com/?l=bugtraq&m=110573573800377 CVE-2005-0021 CVE-2005-0022 12185 12188 12268 2005-01-05 2005-01-05 2005-01-18
mpg123 -- playlist processing buffer overflow vulnerability mpg123 mpg123-nas mpg123-esound 0.59r_15

A buffer overflow vulnerability exists in the playlist processing of mpg123. A specially crafted playlist entry can cause a stack overflow that can be used to inject arbitrary code into the mpg123 process

Note that a malicious playlist, demonstrating this vulnerability, was released by the bug finder and may be used as a template by attackers.

CVE-2004-1284 http://tigger.uic.edu/~jlongs2/holes/mpg123.txt http://secunia.com/advisories/13511/ http://xforce.iss.net/xforce/xfdb/18626 11958 http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132 2004-12-15 2005-01-03 2005-01-13
greed -- insecure GRX file processing greed 0.81p

A buffer overflow vulnerability has been detected in the greed URL handling code. This bug can especially be a problem when greed is used to process GRX (GetRight) files that originate from untrusted sources.

The bug finder, Manigandan Radhakrishnan, gave the following description:

Here are the bugs. First, in main.c, DownloadLoop() uses strcat() to copy an input filename to the end of a 128-byte COMMAND array. Second, DownloadLoop() passes the input filename to system() without checking for special characters such as semicolons.

CVE-2004-1273 CVE-2004-1274 http://tigger.uic.edu/~jlongs2/holes/greed.txt http://secunia.com/advisories/13534/ http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132 2004-12-15 2005-01-03 2005-01-13
golddig -- local buffer overflow vulnerabilities golddig 2.0

Two buffer overflow vulnerabilities where detected. Both issues can be used by local users to gain group games privileges on affected systems.

The first overflow exists in the map name handling and can be triggered when a very long name is given to the program during command-line execution

The second overflow exists in the username processing while writing the players score to disk. Excessivly long usernames, set via the USER environment variable, are stored without any length checks in a memory buffer.

CVE-2005-0121 http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125 2004-11-11 2005-01-03 2005-01-19
up-imapproxy -- multiple vulnerabilities up-imapproxy 1.2.2 pop3proxy 1.1

Timo Sirainen reports:

There are various bugs in up-imapproxy which can crash it. Since up-imapproxy runs in a single process with each connection handled in a separate thread, any crash kills all the connections and stops listening for new ones.

In 64bit systems it might be possible to make it leak data (mails, passwords, ..) from other connections to attacker's connection. However I don't think up-imapproxy actually works in any 64bit system so this is just a theoretical problem.

CVE-2004-1035 11630 http://marc.theaimsgroup.com/?l=bugtraq&m=109995749510773 2004-11-17 2005-01-02 2005-01-13
kdelibs3 -- konqueror FTP command injection vulnerability ja-kdelibs kdelibs 3.3.2_2

Albert Puigsech Galicia reports that Konqueror (more specifically kio_ftp) and Microsoft Internet Explorer are vulnerable to a FTP command injection vulnerability which can be exploited by tricking an user into clicking a specially crafted FTP URI.

It is also reported by Ian Gulliver and Emanuele Balla that this vulnerability can be used to tricking a client into sending out emails without user interaction.

11827 CVE-2004-1165 http://marc.theaimsgroup.com/?l=bugtraq&m=110245752232681 http://marc.theaimsgroup.com/?l=full-disclosure&m=110387390226693 http://marc.theaimsgroup.com/?l=full-disclosure&m=110390734925183 http://www.kde.org/info/security/advisory-20050101-1.txt 2004-12-01 2005-01-01 2005-01-04
a2ps -- insecure temporary file creation a2ps-a4 a2ps-letter a2ps-letterdj 4.13b_3

A Secunia Security Advisory reports that Javier Fernández-Sanguino Peña has found temporary file creation vulnerabilities in the fixps and psmandup scripts which are part of a2ps. These vulnerabilities could lead to an attacker overwriting arbitrary files with the credentials of the user running the vulnerable scripts.

CVE-2004-1377 12108 12109 http://secunia.com/advisories/13641/ 2004-12-27 2004-12-30 2005-01-19
libxine -- buffer-overflow vulnerability in aiff support libxine 1.0.r5_3

Due to a buffer overflow in the open_aiff_file function in demux_aiff.c, a remote attacker is able to execute arbitrary code via a modified AIFF file.

CVE-2004-1300 http://tigger.uic.edu/~jlongs2/holes/xine-lib.txt http://xinehq.de/index.php/security/XSA-2004-7 2004-12-15 2004-12-29 2005-01-12
jabberd -- denial-of-service vulnerability jabber 1.4.3.1

José Antonio Calvo discovered a bug in the Jabber 1.x server. According to Matthias Wimmer:

Without this patch, it is possible to remotly crash jabberd14, if there is access to one of the following types of network sockets:

  • Socket accepting client connections
  • Socket accepting connections from other servers
  • Socket connecting to an other Jabber server
  • Socket accepting connections from server components
  • Socket connecting to server components

This is any socket on which the jabberd server parses XML!

The problem existed in the included expat XML parser code. This patch removes the included expat code from jabberd14 and links jabberd against an installed version of expat.

CVE-2004-1378 http://devel.amessage.info/jabberd14/README.html http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html 2004-09-19 2004-12-26 2005-01-19
squid -- confusing results on empty acl declarations squid 2.5.7_5

Applying an empty ACL list results in unexpected behavior: anything will match an empty ACL list. For example,

The meaning of the configuration gets very confusing when we encounter empty ACLs such as

acl something src "/path/to/empty_file.txt"
http_access allow something somewhere

gets parsed (with warnings) as

http_access allow somwhere

And similarily if you are using proxy_auth acls without having any auth schemes defined.

CVE-2005-0194 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls http://www.squid-cache.org/bugs/show_bug.cgi?id=1166 2004-12-21 2004-12-23 2005-02-08
ethereal -- multiple vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.10.8

An Ethreal Security Advisories reports:

Issues have been discovered in the following protocol dissectors:

  • Matthew Bing discovered a bug in DICOM dissection that could make Ethereal crash.
  • An invalid RTP timestamp could make Ethereal hang and create a large temporary file, possibly filling available disk space.
  • The HTTP dissector could access previously-freed memory, causing a crash.
  • Brian Caswell discovered that an improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization.

Impact: It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

CVE-2004-1139 CVE-2004-1140 CVE-2004-1141 CVE-2004-1142 http://www.ethereal.com/appnotes/enpa-sa-00016.html 2004-12-14 2004-12-23
xpdf -- buffer overflow vulnerability xpdf 3.00_5 kdegraphics 3.3.2_1 gpdf 2.8.1 teTeX-base 2.0.2_6 cups-base 1.1.22.0 koffice 1.3.5,1 pdftohtml 0.36_1

An iDEFENSE Security Advisory reports:

Remote exploitation of a buffer overflow vulnerability in the xpdf PDF viewer, as included in multiple Linux distributions, could allow attackers to execute arbitrary code as the user viewing a PDF file. The offending code can be found in the Gfx::doImage() function in the source file xpdf/Gfx.cc.

CVE-2004-1125 http://www.idefense.com/application/poi/display?id=172&type=vulnerabilities 2004-11-23 2004-12-23 2005-01-13
acroread5 -- mailListIsPdf() buffer overflow vulnerability acroread acroread4 acroread5 5.10

An iDEFENSE Security Advisory reports:

Remote exploitation of a buffer overflow in version 5.09 of Adobe Acrobat Reader for Unix could allow for execution of arbitrary code.

The vulnerability specifically exists in a the function mailListIsPdf(). This function checks if the input file is an email message containing a PDF. It unsafely copies user supplied data using strcat into a fixed sized buffer.

CVE-2004-1152 253024 http://www.adobe.com/support/techdocs/331153.html http://www.idefense.com/application/poi/display?id=161&type=vulnerabilities 2004-10-14 2004-12-21 2005-01-06
ecartis -- unauthorised access to admin interface ecartis 1.0.0.s20031228_2,1

A Debian security advisory reports:

A problem has been discovered in ecartis, a mailing-list manager, which allows an attacker in the same domain as the list admin to gain administrator privileges and alter list settings.

CVE-2004-0913 http://www.debian.org/security/2004/dsa-572 http://secunia.com/advisories/12918/ 2004-10-12 2004-12-21
mplayer -- multiple vulnerabilities mplayer mplayer-gtk mplayer-gtk2 mplayer-esound mplayer-gtk-esound mplayer-gtk2-esound 0.99.5_5 libxine 1.0.r5_3

iDEFENSE and the MPlayer Team have found multiple vulnerabilities in MPlayer:

  • Potential heap overflow in Real RTSP streaming code
  • Potential stack overflow in MMST streaming code
  • Multiple buffer overflows in BMP demuxer
  • Potential heap overflow in pnm streaming code
  • Potential buffer overflow in mp3lib

These vulnerabilities could allow a remote attacker to execute arbitrary code as the user running MPlayer. The problem in the pnm streaming code also affects xine.

CVE-2004-1187 CVE-2004-1188 http://mplayerhq.hu/homepage/design7/news.html#mplayer10pre5try2 http://marc.theaimsgroup.com/?l=bugtraq&m=110322526210300 http://www.idefense.com/application/poi/display?id=166 http://marc.theaimsgroup.com/?l=bugtraq&m=110322829807443 http://www.idefense.com/application/poi/display?id=167 http://marc.theaimsgroup.com/?l=bugtraq&m=110323022605345 http://www.idefense.com/application/poi/display?id=168 http://xinehq.de/index.php/security/XSA-2004-6 2004-12-10 2004-12-21 2005-01-12
krb5 -- heap buffer overflow vulnerability in libkadm5srv krb5 krb5-beta 1.3.6

A MIT krb5 Security Advisory reports:

The MIT Kerberos 5 administration library (libkadm5srv) contains a heap buffer overflow in password history handling code which could be exploited to execute arbitrary code on a Key Distribution Center (KDC) host. The overflow occurs during a password change of a principal with a certain password history state. An administrator must have performed a certain password policy change in order to create the vulnerable state.

An authenticated user, not necessarily one with administrative privileges, could execute arbitrary code on the KDC host, compromising an entire Kerberos realm.

CVE-2004-1189 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt 2004-12-06 2004-12-21
samba -- integer overflow vulnerability samba 3.0.10,1 ja-samba 2.2.12.j1.0beta1_2 3.*3.0.10,1

Greg MacManus, iDEFENSE Labs reports:

Remote exploitation of an integer overflow vulnerability in the smbd daemon included in Samba 2.0.x, Samba 2.2.x, and Samba 3.0.x prior to and including 3.0.9 could allow an attacker to cause controllable heap corruption, leading to execution of arbitrary commands with root privileges.

Successful remote exploitation allows an attacker to gain root privileges on a vulnerable system. In order to exploit this vulnerability an attacker must possess credentials that allow access to a share on the Samba server. Unsuccessful exploitation attempts will cause the process serving the request to crash with signal 11, and may leave evidence of an attack in logs.

CVE-2004-1154 http://www.idefense.com/application/poi/display?id=165&type=vulnerabilities http://www.samba.org/samba/security/CAN-2004-1154.html 2004-12-02 2004-12-21 2005-05-29
php -- multiple vulnerabilities mod_php4-twig php4-cgi php4-cli php4-dtc php4-horde php4-nms php4 4.3.10 mod_php mod_php4 44.3.10,1 php5 php5-cgi php5-cli 5.0.3 mod_php5 5.0.3,1

Secunia reports:

Multiple vulnerabilities have been reported in PHP, which can be exploited to gain escalated privileges, bypass certain security restrictions, gain knowledge of sensitive information, or compromise a vulnerable system.

http://secunia.com/advisories/13481/ CVE-2004-1019 CVE-2004-1065 http://www.php.net/release_4_3_10.php http://www.hardened-php.net/advisories/012004.txt 2004-12-16 2004-12-17 2004-12-18
mysql -- GRANT access restriction problem mysql-server 3.23.58_3 4.*4.0.21

When a user is granted access to a database with a name containing an underscore and the underscore is not escaped then that user might also be able to access other, similarly named, databases on the affected system.

The problem is that the underscore is seen as a wildcard by MySQL and therefore it is possible that an admin might accidently GRANT a user access to multiple databases.

CVE-2004-0957 11435 http://bugs.mysql.com/bug.php?id=3933 http://rhn.redhat.com/errata/RHSA-2004-611.html http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html 2004-03-29 2004-12-16 2005-03-15
mysql -- ALTER MERGE denial of service vulnerability mysql-server 3.23.58_3 4.*4.0.21 4.1.*4.1.1

Dean Ellis reported a denial of service vulnerability in the MySQL server:

Multiple threads ALTERing the same (or different) MERGE tables to change the UNION eventually crash the server or hang the individual threads.

Note that a script demonstrating the problem is included in the MySQL bug report. Attackers that have control of a MySQL account can easily use a modified version of that script during an attack.

CVE-2004-0837 11357 http://bugs.mysql.com/bug.php?id=2408 http://rhn.redhat.com/errata/RHSA-2004-611.html 2004-01-15 2004-12-16 2005-03-15
mysql -- FTS request denial of service vulnerability mysql-server 4.*4.0.21

A special crafted MySQL FTS request can cause the server to crash. Malicious MySQL users can abuse this bug in a denial of service attack against systems running an affected MySQL daemon.

Note that because this bug is related to the parsing of requests, it may happen that this bug is triggered accidently by a user when he or she makes a typo.

http://bugs.mysql.com/bug.php?id=3870 CVE-2004-0956 11432 2004-03-23 2004-12-16
mysql -- mysql_real_connect buffer overflow vulnerability mysql-server 3.23.58_3 4.*4.0.21 mysql-client 3.23.58_3 4.*4.0.21

The mysql_real_connect function doesn't properly handle DNS replies by copying the IP address into a buffer without any length checking. A specially crafted DNS reply may therefore be used to cause a buffer overflow on affected systems.

Note that whether this issue can be exploitable depends on the system library responsible for the gethostbyname function. The bug finder, Lukasz Wojtow, explaines this with the following words:

In glibc there is a limitation for an IP address to have only 4 bytes (obviously), but generally speaking the length of the address comes with a response for dns query (i know it sounds funny but read rfc1035 if you don't believe). This bug can occur on libraries where gethostbyname function takes length from dns's response

CVE-2004-0836 10981 http://bugs.mysql.com/bug.php?id=4017 http://lists.mysql.com/internals/14726 http://rhn.redhat.com/errata/RHSA-2004-611.html http://www.osvdb.org/displayvuln.php?osvdb_id=10658 2004-06-04 2004-12-16 2005-03-15
mysql -- erroneous access restrictions applied to table renames mysql-server 3.23.58_3 4.*4.0.21

A Red Hat advisory reports:

Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked the CREATE/INSERT rights of the old table instead of the new one.

Table access restrictions, on the affected MySQL servers, may accidently or intentially be bypassed due to this bug.

CVE-2004-0835 11357 http://bugs.mysql.com/bug.php?id=3270 http://rhn.redhat.com/errata/RHSA-2004-611.html http://xforce.iss.net/xforce/xfdb/17666 2004-03-23 2004-12-16 2005-03-15
phpmyadmin -- command execution vulnerability phpMyAdmin 2.6.0.22.6.1.r1

A phpMyAdmin security announcement reports:

Command execution: since phpMyAdmin 2.6.0-pl2, on a system where external MIME-based transformations are activated, an attacker can put into MySQL data an offensive value that starts a shell command when browsed.

Enabling PHP safe mode on the server can be used as a workaround for this vulnerability.

CVE-2004-1147 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4 http://www.exaprobe.com/labs/advisories/esa-2004-1213.html 2004-12-13 2004-12-15 2004-12-19
phpmyadmin -- file disclosure vulnerability phpMyAdmin 2.6.1.r1

A phpMyAdmin security announcement reports:

File disclosure: on systems where the UploadDir mecanism is active, read_dump.php can be called with a crafted form; using the fact that the sql_localfile variable is not sanitized can lead to a file disclosure.

Enabling PHP safe mode on the server can be used as a workaround for this vulnerability.

CVE-2004-1148 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4 http://www.exaprobe.com/labs/advisories/esa-2004-1213.html 2004-12-13 2004-12-15 2004-12-19
wget -- multiple vulnerabilities wget wget-devel 1.10.a1 wgetpro wget+ipv6 0

Jan Minar reports that there exists multiple vulnerabilities in wget:

Wget erroneously thinks that the current directory is a fair game, and will happily write in any file in and below it. Malicious HTTP response or malicious HTML file can redirect wget to a file that is vital to the system, and wget will create/append/overwrite it.

Wget apparently has at least two methods of ``sanitizing'' the potentially malicious data it receives from the HTTP stream, therefore a malicious redirects can pass the check. We haven't find a way to trick wget into writing above the parent directory, which doesn't mean it's not possible.

Malicious HTTP response can overwrite parts of the terminal so that the user will not notice anything wrong, or will believe the error was not fatal.

CVE-2004-1487 CVE-2004-1488 11871 http://marc.theaimsgroup.com/?l=bugtraq&m=110269474112384 http://bugs.debian.org/261755 2004-12-09 2004-12-14 2005-04-15
konqueror -- Password Disclosure for SMB Shares kdebase kdelibs 3.2.03.3.1

When browsing SMB shares with Konqueror, shares with authentication show up with hidden password in the browser bar. It is possible to store the URL as a shortcut on the desktop where the password is then available in plain text.

CVE-2004-1171 305294 http://www.kde.org/info/security/advisory-20041209-1.txt http://marc.theaimsgroup.com/?l=bugtraq&m=110178786809694 2004-10-06 2004-12-12 2005-01-13
mod_access_referer -- null pointer dereference vulnerability mod_access_referer 1.0.2_1

A malformed Referer header field causes the Apache ap_parse_uri_components function to discard it with the result that a pointer is not initialized. The mod_access_referer module does not take this into account with the result that it may use such a pointer.

The null pointer vulnerability may possibly be used in a remote denial of service attack against affected Apache servers.

CVE-2003-1054 7375 http://secunia.com/advisories/8612/ http://marc.theaimsgroup.com/?l=full-disclosure&m=105053485515811 2003-04-16 2004-12-11 2005-01-19
squid -- possible information disclosure squid 2.5.7_4

The squid-2.5 patches pages notes:

In certain conditions Squid returns random data as error messages in response to malformed host name, possibly leaking random internal information which may come from other requests.

http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost 2004-11-23 2004-12-09
viewcvs -- information leakage viewcvs 0.9.2_2

The hide_cvsroot and forbidden configuration options are not properly honored by viewcvs when exporting to a tar file which can lead to information leakage.

CVE-2004-0915 11819 2004-11-25 2004-12-08 2004-12-12
cscope -- symlink attack vulnerability cscope 15.5_1

cscope is vulnerable to a symlink attack which could lead to an attacker overwriting arbitrary files with the permissions of the user running cscope.

CVE-2004-0996 11697 http://marc.theaimsgroup.com/?l=bugtraq&m=110133485519690 http://marc.theaimsgroup.com/?l=bugtraq&m=110072752707293 http://sourceforge.net/tracker/index.php?func=detail&aid=1062807&group_id=4664&atid=104664 2003-04-03 2004-12-07
bnc -- remotely exploitable buffer overflow in getnickuserhost bnc 2.9.1

A LSS Security Advisory reports:

There is a buffer overflow vulnerability in getnickuserhost() function that is called when BNC is processing response from IRC server.

Vulnerability can be exploited if attacker tricks user to connect to his fake IRC server that will exploit this vulnerability. If the attacker has access to BNC proxy server, this vulnerability can be used to gain shell access on machine where BNC proxy server is set.

CVE-2004-1052 http://marc.theaimsgroup.com/?l=bugtraq&m=110011817627839 http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03 http://www.gotbnc.com/changes.html 2004-11-10 2004-12-04 2005-02-22
rssh & scponly -- arbitrary command execution rssh 2.2.2 scponly 4.0

Jason Wies identified both rssh & scponly have a vulnerability that allows arbitrary command execution. He reports:

The problem is compounded when you recognize that the main use of rssh and scponly is to allow file transfers, which in turn allows a malicious user to transfer and execute entire custom scripts on the remote machine.

11791 11792 ports/74633 http://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273 2004-11-28 2004-12-02 2004-12-12
rockdodger -- buffer overflows rockdodger 0.6_3

The environment variable HOME is copied without regard to buffer size, which can be used to gain elevated privilege if the binary is installed setgid games, and a string is read from the high score file without bounds check.

The port installs the binary without setgid, but with a world-writable high score file.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278878 2004-10-29 2004-12-02
zip -- long path buffer overflow zip 2.3_2

A HexView security advisory reports:

When zip performs recursive folder compression, it does not check for the length of resulting path. If the path is too long, a buffer overflow occurs leading to stack corruption and segmentation fault. It is possible to exploit this vulnerability by embedding a shellcode in directory or file name. While the issue is not of primary concern for regular users, it can be critical for environments where zip archives are re-compressed automatically using Info-Zip application.

CVE-2004-1010 11603 http://www.hexview.com/docs/20041103-1.txt 2004-10-03 2004-12-01 2004-12-12
sudoscript -- signal delivery vulnerability sudoscript 2.1.2

If non-root access is enabled in sudoscript, any member of the ssers group can send a SIGHUP signal to any process.

http://egbok.com/sudoscript/archives/2004/11/sudoscript_212.html 2004-11-14 2004-12-01
jabberd -- remote buffer overflow vulnerability jabberd 2.*2.0.4

Caused by improper bounds-checking of username and password in the C2S module, it is possible for an attacker to cause a remote buffer overflow. The server directly handles the userinput with SQL backend functions - malicious input may lead to buffer overflow.

http://marc.theaimsgroup.com/?l=bugtraq&m=110144303826709 2004-11-24 2004-11-30
Open DC Hub -- remote buffer overflow vulnerability opendchub 0.7.14_2

Donato Ferrante reported an exploitable buffer overflow in this software package. Any user that can login with 'admin' privileges can abuse it, trough the $RedirectAll command, to execute arbitrary code.

http://marc.theaimsgroup.com/?l=bugtraq&m=110144606411674 http://www.gentoo.org/security/en/glsa/glsa-200411-37.xml 2004-11-24 2004-11-27 2005-02-13
unarj -- long filename buffer overflow unarj 2.43_2

Ludwig Nussel has discovered a buffer overflow vulnerability in unarj's handling of long filenames which could potentially lead to execution of arbitrary code with the permissions of the user running unarj.

CVE-2004-0947 11665 2004-11-09 2004-11-26
unarj -- directory traversal vulnerability unarj 2.43_2

unarj has insufficient checks for filenames that contain ... This can allow an attacker to overwrite arbitrary files with the permissions of the user running unarj.

CVE-2004-1027 11436 http://marc.theaimsgroup.com/?l=full-disclosure&m=109748984030292 2004-10-10 2004-11-26
jdk/jre -- Security Vulnerability With Java Plugin jdk 1.4.01.4.2p6_6 1.3.01.3.1p9_5 linux-jdk linux-sun-jdk 1.4.01.4.2.05 1.3.01.3.1.13 linux-blackdown-jdk 1.3.01.4.2 linux-ibm-jdk 1.3.01.4.2 diablo-jdk diablo-jre 1.3.1.01.3.1.0_1

The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1&searchclause=%22category:security%22%20%22availability,%20security%22 http://www.securityfocus.com/archive/1/382072 CVE-2004-1029 http://marc.theaimsgroup.com/?l=bugtraq&m=110125046627909 2004-11-24 2004-11-25 2005-04-27
ProZilla -- server response buffer overflow vulnerabilities prozilla 1.3.6_3

Buffer overflow vulnerabilities have been reported to exist in this software package. The vulnerabilities can be triggered by a remote server and can be used to inject malicious code in the ProZilla process.

CVE-2004-1120 http://www.gentoo.org/security/en/glsa/glsa-200411-31.xml http://bugs.gentoo.org/show_bug.cgi?id=70090 http://marc.theaimsgroup.com/?l=bugtraq&m=110136626320497 2004-11-23 2004-11-25 2005-10-01
Cyrus IMAPd -- APPEND command uses undefined programming construct cyrus-imapd 2.2.72.2.8

To support MULTIAPPENDS the cmd_append handler uses the global stage array. This array is one of the things that gets destructed when the fatal() function is triggered. When the Cyrus IMAP code adds new entries to this array this is done with the help of the postfix increment operator in combination with memory allocation functions. The increment is performed on a global variable counting the number of allocated stages. Because the memory allocation function can fail and therefore internally call fatal() this construct is undefined arcording to ANSI C. This means that it is not clearly defined if the numstage counter is already increased when fatal() is called or not. While older gcc versions increase the counter after the memory allocation function has returned, on newer gcc versions (3.x) the counter gets actually increased before. In such a case the stage destructing process will try to free an uninitialised and maybe attacker supplied pointer. Which again could lead to remote code execution. (Because it is hard for an attacker to let the memory allocation functions fail in the right moment no PoC code for this problem was designed)

http://security.e-matters.de/advisories/152004.html 2004-11-06 2004-11-22
Cyrus IMAPd -- FETCH command out of bounds memory corruption cyrus-imapd 2.1.17 2.2.*2.2.8

The argument parser of the fetch command suffers a bug very similiar to the partial command problem. Arguments like "body[p", "binary[p" or "binary[p" will be wrongly detected and the bufferposition can point outside of the allocated buffer for the rest of the parsing process. When the parser triggers the PARSE_PARTIAL macro after such a malformed argument was received this can lead to a similiar one byte memory corruption and allows remote code execution, when the heap layout was successfully controlled by the attacker.

CVE-2004-1013 http://security.e-matters.de/advisories/152004.html 2004-11-06 2004-11-22 2004-11-24
Cyrus IMAPd -- PARTIAL command out of bounds memory corruption cyrus-imapd 2.1.17 2.2.*2.2.6

Due to a bug within the argument parser of the partial command an argument like "body[p" will be wrongly detected as "body.peek". Because of this the bufferposition gets increased by 10 instead of 5 and could therefore point outside the allocated memory buffer for the rest of the parsing process. In imapd versions prior to 2.2.7 the handling of "body" or "bodypeek" arguments was broken so that the terminating ']' got overwritten by a '\0'. Combined the two problems allow a potential attacker to overwrite a single byte of malloc() control structures, which leads to remote code execution if the attacker successfully controls the heap layout.

CVE-2004-1012 http://security.e-matters.de/advisories/152004.html 2004-11-06 2004-11-22 2004-11-24
Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow cyrus-imapd 2.2.42.2.8

When the option imapmagicplus is activated on a server the PROXY and LOGIN commands suffer a standard stack overflow, because the username is not checked against a maximum length when it is copied into a temporary stack buffer. This bug is especially dangerous because it can be triggered before any kind of authentification took place.

CVE-2004-1011 http://security.e-matters.de/advisories/152004.html 2004-11-06 2004-11-22
phpMyAdmin -- cross-site scripting vulnerabilities phpMyAdmin 2.6.0.2

Multiple cross-site scripting vulnerabilities, caused by improper input parameter sanitizing, were detected in phpMyAdmin, which may enable an attacker to do cross-site scripting attacks.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3 2004-11-18 2004-11-20
Overflow error in fetch FreeBSD 5.35.3_1 5.2.15.2.1_12 5.15.1_18 5.05.0_22 4.104.10_4 4.94.9_13 4.84.8_26 4.7_28

An integer overflow condition in fetch(1) in the processing of HTTP headers can result in a buffer overflow.

A malicious server or CGI script can respond to an HTTP or HTTPS request in such a manner as to cause arbitrary portions of the client's memory to be overwritten, allowing for arbitrary code execution.

SA-04:16.fetch CVE-2004-1053 11702 2004-11-14 2004-11-18
smbd -- buffer-overrun vulnerability samba 3.*3.0.8,1

Caused by improper bounds checking of certain trans2 requests, there is a possible buffer overrun in smbd. The attacker needs to be able to create files with very specific Unicode filenames on the share to take advantage of this issue.

CVE-2004-0882 11678 http://marc.theaimsgroup.com/?l=bugtraq&m=110055646329581 2004-11-15 2004-11-17 2004-12-12
twiki -- arbitrary shell command execution twiki 20040902

Hans Ulrich Niedermann reports:

The TWiki search function uses a user supplied search string to compose a command line executed by the Perl backtick (``) operator.

The search string is not checked properly for shell metacharacters and is thus vulnerable to search string containing quotes and shell commands.

IMPACT: An attacker is able to execute arbitrary shell commands with the privileges of the TWiki process.

CVE-2004-1037 http://marc.theaimsgroup.com/?l=bugtraq&m=110037207516456 http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch 2004-11-12 2004-11-15 2004-11-23
proxytunnel -- format string vulnerability proxytunnel 1.2.3

A Gentoo Linux Security Advisory reports:

Florian Schilhabel of the Gentoo Linux Security Audit project found a format string vulnerability in Proxytunnel. When the program is started in daemon mode (-a [port]), it improperly logs invalid proxy answers to syslog.

A malicious remote server could send specially-crafted invalid answers to exploit the format string vulnerability, potentially allowing the execution of arbitrary code on the tunnelling host with the rights of the Proxytunnel process.

CVE-2004-0992 http://proxytunnel.sourceforge.net/news.html http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml 2004-11-01 2004-11-15
sudo -- privilege escalation with bash scripts sudo 1.6.8.2

A Sudo Security Alerts reports:

A flaw in exists in sudo's environment sanitizing prior to sudo version 1.6.8p2 that could allow a malicious user with permission to run a shell script that utilized the bash shell to run arbitrary commands.

http://www.courtesan.com/sudo/alerts/bash_functions.html 2004-11-11 2004-11-13
ruby -- CGI DoS ruby ruby_r 1.7.*1.8.2.p2_2 1.6.8.2004.07.28_1 ruby-1.7.0 a2001.05.12a2001.05.26

The Ruby CGI.rb module contains a bug which can cause the CGI module to go into an infinite loop, thereby causing a denial-of-service situation on the web server by using all available CPU time.

CVE-2004-0983 http://www.debian.org/security/2004/dsa-586 2004-11-06 2004-11-13 2004-11-25
samba -- potential remote DoS vulnerability samba 33.0.8,1

Karol Wiesek at iDEFENSE reports:

A remote attacker could cause an smbd process to consume abnormal amounts of system resources due to an input validation error when matching filenames containing wildcard characters.

Although samba.org classifies this as a DoS vulnerability, several members of the security community believe it may be exploitable for arbitrary code execution.

ports/73701 CVE-2004-0930 http://us4.samba.org/samba/security/CAN-2004-0930.html 2004-09-30 2004-11-12
gnats -- format string vulnerability gnats 4.*4.0_2 3.113.1_9

Gnats suffers from a format string bug, which may enable an attacker to execute arbitary code.

CVE-2004-0623 http://marc.theaimsgroup.com/?l=bugtraq&m=108820000823191 2004-06-21 2004-11-12
squirrelmail -- cross site scripting vulnerability ja-squirrelmail 1.4.3a_4,2 squirrelmail 1.4.3a_3

A SquirrelMail Security Notice reports:

There is a cross site scripting issue in the decoding of encoded text in certain headers. SquirrelMail correctly decodes the specially crafted header, but doesn't sanitize the decoded strings.

http://marc.theaimsgroup.com/?l=bugtraq&m=110012133608004 2004-11-03 2004-11-12
hafiye -- lack of terminal escape sequence filtering hafiye 1.0_1

A siyahsapka.org advisory reads:

Hafiye-1.0 doesnt filter the payload when printing it to the terminal. A malicious attacker can send packets with escape sequence payloads to exploit this vulnerability.

If Hafiye has been started with -n packet count option , the vulnerability could allow remote code execution. For remote code execution the victim must press Enter after program exit.

Note that it appears that this bug can only be exploited in conjunction with a terminal emulator that honors the appropriate escape sequences.

ports/70978 http://deicide.siyahsapka.org/hafiye_esc.txt http://www.enderunix.org/hafiye/ 2004-08-23 2004-11-11
ez-ipupdate -- format string vulnerability ez-ipupdate 3.0.11b8_2

Data supplied by a remote server is used as the format string instead of as parameters in a syslog() call. This may lead to crashes or potential running of arbitrary code. It is only a problem when running in daemon mode (very common) and when using some service types.

CVE-2004-0980 http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html 2004-11-11 2004-11-11
ImageMagick -- EXIF parser buffer overflow ImageMagick 6.1.3

There exists a buffer overflow vulnerability in ImageMagick's EXIF parsing code which may lead to execution of arbitrary code.

11548 CVE-2004-0981 http://secunia.com/advisories/12995/ http://www.imagemagick.org/www/Changelog.html 2004-10-25 2004-11-11 2004-12-12
apache2 multiple space header denial-of-service vulnerability apache 2.*2.0.52_2

It is possible for remote attackers to cause a denial-of-service scenario on Apache 2.0.52 and earlier by sending an HTTP GET request with a MIME header containing multiple lines full of whitespaces.

CVE-2004-0942 http://marc.theaimsgroup.com/?l=full-disclosure&m=109930632317208 2004-11-01 2004-11-10 2004-11-11
socat -- format string vulnerability socat 1.4.0.3

Socat Security Advisory 1 states:

socat up to version 1.4.0.2 contains a syslog() based format string vulnerability. This issue was originally reported by CoKi on 19 Oct.2004 http://www.nosystem.com.ar/advisories/advisory-07.txt. Further investigation showed that this vulnerability could under some circumstances lead to local or remote execution of arbitrary code with the privileges of the socat process.

http://www.dest-unreach.org/socat/advisory/socat-adv-1.html http://www.nosystem.com.ar/advisories/advisory-07.txt 2004-10-18 2004-11-10
libxml -- remote buffer overflows libxml 1.8.17_3 libxml2 2.6.15

infamous41md reports that libxml contains multiple buffer overflows in the URL parsing and DNS name resolving functions. These vulnerabilities could lead to execution of arbitrary code.

CVE-2004-0989 11526 http://marc.theaimsgroup.com/?l=bugtraq&m=109880813013482 http://www.debian.org/security/2004/dsa-582 2004-10-26 2004-11-09 2004-11-10
p5-Archive-Zip -- virus detection evasion p5-Archive-Zip 1.14

An AMaViS Security Announcement reports that a vulnerability exist in the Archive::Zip Perl module which may lead to bypass of malicious code in anti-virus programs by creating specially crafted ZIP files.

http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities http://www.amavis.org/security/asa-2004-6.txt http://rt.cpan.org/NoAuth/Bug.html?id=8077 2004-10-18 2004-11-08
apache mod_include buffer overflow vulnerability apache 1.3.33 apache+mod_ssl 1.3.32+2.8.21_1 apache+mod_ssl+ipv6 1.3.32+2.8.21_1 apache+mod_perl 1.3.31 apache+ipv6 1.3.33 apache+ssl 1.3.29.1.55 ru-apache 1.3.33+30.21 ru-apache+mod_ssl 1.3.33+30.21+2.8.22

There is a buffer overflow in a function used by mod_include that may enable a local user to gain privileges of a httpd child. Only users that are able to create SSI documents can take advantage of that vulnerability.

CVE-2004-0940 http://www.securitylab.ru/48807.html 2004-10-22 2004-11-06
postgresql-contrib -- insecure temporary file creation postgresql-contrib 7.2.6 7.3.*7.3.8 7.4.*7.4.6

The make_oidjoins_check script in the PostgreSQL RDBMS has insecure handling of temporary files, which could lead to an attacker overwriting arbitrary files with the credentials of the user running the make_oidjoins_check script.

CVE-2004-0977 11295 http://www.postgresql.org/news/234.html http://www.trustix.net/errata/2004/0050/ 2004-09-10 2004-11-06
gd -- integer overflow gd uk-gd ja-gd 2.0.29,1 1.*,22.*,2

infamous41md reports about the GD Graphics Library:

There is an integer overflow when allocating memory in the routine that handles loading PNG image files. This later leads to heap data structures being overwritten. If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image.

11523 CVE-2004-0990 http://marc.theaimsgroup.com/?l=bugtraq&m=109882489302099 http://www.boutell.com/gd/manual2.0.29.html#whatsnew2.0.29 2004-10-26 2004-11-05
putty -- buffer overflow vulnerability in ssh2 support putty 0.56

There is a bug in SSH2 support that allows a server to execute malicious code on a connecting PuTTY client. This attack can be performed before host key verification happens, so a different machine -- man in the middle attack -- could fake the machine you are connecting to.

http://marc.theaimsgroup.com/?l=bugtraq&m=109890310929207 http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html 2004-10-26 2004-11-04 2005-01-19
wzdftpd -- remote DoS wzdftpd 0.4.3

wzdftpd contains a potential remote Denial-of-Service.

http://sourceforge.net/project/shownotes.php?release_id=263573 2004-10-28 2004-11-03
rssh -- format string vulnerability rssh 2.2.1

There is a format string bug in rssh that enables an attacker to execute arbitrary code from an account configured to use rssh. On FreeBSD it is only possible to compromise the rssh running account, not root.

http://www.pizzashack.org/rssh/security.shtml http://marc.theaimsgroup.com/?l=bugtraq&m=109855982425122 2004-10-23 2004-10-25
horde -- cross-site scripting vulnerability in help window horde horde-devel 2.2.7

A Horde Team announcement states that a potential cross-site scripting vulnerability in the help window has been corrected. The vulnerability appears to involve the handling of the topic and module parameters of the help window template.

http://marc.theaimsgroup.com/?l=horde-announce&m=109879164718625 2004-10-06 2004-10-27
bogofilter -- RFC 2047 decoder denial-of-service vulnerability bogofilter bogofilter-qdbm bogofilter-tdb ru-bogofilter 0.17.40.92.8

The bogofilter team has been provided with a test case of a malformatted (non-conformant) RFC-2047 encoded word that can cause bogofilter versions 0.92.7 and prior to try to write a NUL byte into a memory location that is either one byte past the end of a flex buffer or to a location that is the negative of the encoded word's start of payload data, causing a segmentation fault.

73144 CVE-2004-1007 http://article.gmane.org/gmane.mail.bogofilter.devel/3308 http://article.gmane.org/gmane.mail.bogofilter.devel/3317 http://bugs.debian.org/275373 http://bogofilter.sourceforge.net/security/bogofilter-SA-2004-01 2004-10-09 2004-10-26 2004-11-03
xpdf -- integer overflow vulnerabilities gpdf cups-base 1.1.22.0 xpdf 3.00_4 kdegraphics 3.3.0_1 koffice 1.3.2_1,1 teTeX-base 2.0.2_4

Chris Evans discovered several integer arithmetic overflows in the xpdf 2 and xpdf 3 code bases. The flaws have impacts ranging from denial-of-service to arbitrary code execution.

CVE-2004-0888 CVE-2004-0889 http://scary.beasts.org/security/CESA-2004-002.txt http://scary.beasts.org/security/CESA-2004-007.txt http://www.kde.org/info/security/advisory-20041021-1.txt 2004-10-21 2004-10-25
gaim -- MSN denial-of-service vulnerabilities gaim ja-gaim ko-gaim ru-gaim 1.0.2 gaim 20030000

The Gaim team discovered denial-of-service vulnerabilities in the MSN protocol handler:

After accepting a file transfer request, Gaim will attempt to allocate a buffer of a size equal to the entire filesize, this allocation attempt will cause Gaim to crash if the size exceeds the amount of available memory.

Gaim allocates a buffer for the payload of each message received based on the size field in the header of the message. A malicious peer could specify an invalid size that exceeds the amount of available memory.

http://gaim.sourceforge.net/security/?id=7 http://gaim.sourceforge.net/security/?id=8 2004-10-19 2004-10-25
gaim -- Content-Length header denial-of-service vulnerability gaim ja-gaim ko-gaim ru-gaim 0.82 gaim 20030000

Sean infamous42md reports:

When a remote server provides a large "content-length" header value, Gaim will attempt to allocate a buffer to store the content, however this allocation attempt will cause Gaim to crash if the length exceeds the amount of possible memory. This happens when reading profile information on some protocols. It also happens when smiley themes are installed via drag and drop.

http://gaim.sourceforge.net/security/?id=6 2004-08-26 2004-10-25
gaim -- multiple buffer overflows gaim ja-gaim ko-gaim ru-gaim 0.82 gaim 20030000

Sean infamous42md reports several situations in gaim that may result in exploitable buffer overflows:

  • Rich Text Format (RTF) messages in Novell GroupWise protocol
  • Unsafe use of gethostbyname in zephyr protocol
  • URLs which are over 2048 bytes long once decoded
CVE-2004-0785 http://gaim.sourceforge.net/security/?id=3 http://gaim.sourceforge.net/security/?id=4 http://gaim.sourceforge.net/security/?id=5 2004-08-26 2004-10-25
gaim -- heap overflow exploitable by malicious GroupWise server gaim ja-gaim ko-gaim ru-gaim 0.82 gaim 20030000

Sean infamous42md reports that a malicous GroupWise messaging server may be able to exploit a heap buffer overflow in gaim, leading to arbitrary code execution.

CVE-2004-0754 http://gaim.sourceforge.net/security/?id=2 2004-08-26 2004-10-25
gaim -- malicious smiley themes gaim ja-gaim ko-gaim ru-gaim 0.82 gaim 20030000

The Gaim Security Issues page documents a problem with installing smiley themes from an untrusted source:

To install a new smiley theme, a user can drag a tarball from a graphical file manager, or a hypertext link to one from a web browser. When a tarball is dragged, Gaim executes a shell command to untar it. However, it does not escape the filename before sending it to the shell. Thus, a specially crafted filename could execute arbitrary commands if the user could be convinced to drag a file into the smiley theme selector.

CVE-2004-0784 http://gaim.sourceforge.net/security/?id=1 2004-08-22 2004-10-25
gaim -- buffer overflow in MSN protocol support gaim ja-gaim ru-gaim 0.791.0.1 gaim 20030000

Due to a buffer overflow in the MSN protocol support for gaim 0.79 to 1.0.1, it is possible for remote clients to do a denial-of-service attack on the application. This is caused by an unbounded copy operation, which writes to the wrong buffer.

CVE-2004-0891 http://gaim.sourceforge.net/security/?id=9 2004-10-19 2004-10-25
mod_ssl -- SSLCipherSuite bypass ru-apache+mod_ssl 1.3.31+30.20+2.8.18 apache+mod_ssl 1.3.31+2.8.20 apache+mod_ssl+ipv6 1.3.31+2.8.18_4 apache2 2.0.52_1

It is possible for clients to use any cipher suite configured by the virtual host, whether or not a certain cipher suite is selected for a specific directory. This might result in clients using a weaker encryption than originally configured.

CVE-2004-0885 http://marc.theaimsgroup.com/?l=apache-modssl&m=109724918128044 http://issues.apache.org/bugzilla/show_bug.cgi?id=31505 2004-10-01 2004-10-23
mpg123 -- buffer overflow in URL handling mpg123 mpg123-nas mpg123-esound 0.59r_15

Carlos Barros reports that mpg123 contains two buffer overflows. These vulnerabilities can potentially lead to execution of arbitrary code.

The first buffer overflow can occur when mpg123 parses a URL with a user-name/password field that is more than 256 characters long. This problem can be triggered either locally or remotely via a specially crafted play list. The second potential buffer overflow may be triggered locally by a specially crafted symlink to the mpg123 binary. This problem is not as serious, since mpg123 is not installed setuid by default.

11468 CVE-2004-0982 http://marc.theaimsgroup.com/?l=bugtraq&m=109834486312407 2004-10-02 2004-10-23 2004-12-30
apache2 -- SSL remote DoS apache 2.02.0.51

The Apache HTTP Server 2.0.51 release notes report that the following issues have been fixed:

A segfault in mod_ssl which can be triggered by a malicious remote server, if proxying to SSL servers has been configured. [CAN-2004-0751]

A potential infinite loop in mod_ssl which could be triggered given particular timing of a connection abort. [CAN-2004-0748]

11094 11154 CVE-2004-0748 CVE-2004-0751 http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=109527608022322 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=30134 2004-07-07 2004-10-21
phpmyadmin -- remote command execution vulnerability phpMyAdmin phpmyadmin 2.6.0.2

From the phpMyAdmin 2.6.0p2 release notes:

If PHP is not running in safe mode, a problem in the MIME-based transformation system (with an "external" transformation) allows to execute any command with the privileges of the web server's user.

11391 http://sourceforge.net/project/shownotes.php?release_id=274709 http://sourceforge.net/tracker/index.php?func=detail&aid=1044864&group_id=23067&atid=377408 2004-10-11 2004-10-20
cabextract -- insecure directory handling cabextract 1.1

cabextract has insufficient checks for file names that contain ../. This can cause files to be extracted to the parent directory.

CVE-2004-0916 http://www.kyz.uklinux.net/cabextract.php#changes 2004-10-18 2004-10-20 2004-10-22
a2ps -- insecure command line argument handling a2ps-a4 4.13b_2 a2ps-letter 4.13b_2 a2ps-letterdj 4.13b_2

Rudolf Polzer reports:

a2ps builds a command line for file() containing an unescaped version of the file name, thus might call external programs described by the file name. Running a cronjob over a public writable directory a2ps-ing all files in it - or simply typing "a2ps *.txt" in /tmp - is therefore dangerous.

CVE-2004-1170 ports/70618 11025 http://www.osvdb.org/9176 http://marc.theaimsgroup.com/?l=full-disclosure&m=109334851517137 2004-08-18 2004-10-20 2004-12-30
ifmail -- unsafe set-user-ID application ifmail ifmail-2.15_4

Niels Heinen reports that ifmail allows one to specify a configuration file. Since ifmail runs set-user-ID `news', this may allow a local attacker to write to arbitrary files or execute arbitrary commands as the `news' user.

http://cvsweb.freebsd.org/ports/news/ifmail 2004-08-23 2004-10-19
imwheel -- insecure handling of PID file imwheel 1.0.0.p12

A Computer Academic Underground advisory describes the consequences of imwheel's handling of the process ID file (PID file):

imwheel exclusively uses a predictably named PID file for management of multiple imwheel processes. A race condition exists when the -k command-line option is used to kill existing imwheel processes. This race condition may be used by a local user to Denial of Service another user using imwheel, lead to resource exhaustion of the host system, or append data to arbitrary files.

http://www.caughq.org/advisories/CAU-2004-0002.txt http://imwheel.sourceforge.net/files/DEVELOPMENT.txt 2004-08-20 2004-10-19
squid -- NTLM authentication denial-of-service vulnerability squid 2.5.7

A remote attacker is able to cause a denial-of-service situation, when NTLM authentication is enabled in squid. NTLM authentication uses two functions which lack correct offset checking.

CVE-2004-0832 http://www.squid-cache.org/bugs/show_bug.cgi?id=1045 2004-08-18 2004-08-16
cacti -- SQL injection cacti 0.8.6

Fernando Quintero reports that Cacti 0.8.5a suffers from a SQL injection attack where an attacker can change the password for any Cacti user. This attack is not possible if the PHP option magic_quotes_gpc is set to On, which is the default for PHP in FreeBSD.

http://marc.theaimsgroup.com/?l=full-disclosure&m=109269427427368 2004-08-16 2004-10-17
apache13-modssl -- format string vulnerability in proxy support apache+mod_ssl 1.3.31+2.8.19 apache+mod_ssl+ipv6 1.3.31+2.8.19 ru-apache+mod_ssl 1.3.31+30.20+2.8.19

A OpenPKG Security Advisory reports:

Triggered by a report to Packet Storm from Virulent, a format string vulnerability was found in mod_ssl, the Apache SSL/TLS interface to OpenSSL, version (up to and including) 2.8.18 for Apache 1.3. The mod_ssl in Apache 2.x is not affected. The vulnerability could be exploitable if Apache is used as a proxy for HTTPS URLs and the attacker established a own specially prepared DNS and origin server environment.

10736 303448 CVE-2004-0700 http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html http://packetstormsecurity.org/0407-advisories/modsslFormat.txt http://marc.theaimsgroup.com/?l=apache-modssl&m=109001100906749 2004-07-16 2004-10-17
tor -- remote DoS and loss of anonymity tor 0.0.8.1

Tor has various remote crashes which could lead to a remote denial-of-service and be used to defeat clients anonymity. It is not expected that these vulnerabilities are exploitable for arbitrary code execution.

http://archives.seul.org/or/announce/Aug-2004/msg00001.html http://archives.seul.org/or/announce/Oct-2004/msg00000.html 2004-08-25 2004-10-15
icecast -- Cross-Site Scripting Vulnerability icecast 1.3.12_2

Caused by improper filtering of HTML code in the status display, it is possible for a remote user to execute scripting code in the target user's browser.

CVE-2004-0781 http://www.securitytracker.com/alerts/2004/Aug/1011047.html 2004-08-24 2004-10-13
icecast -- HTTP header overflow icecast2 2.0.2,1

It is possible to execute remote code simply using HTTP request plus 31 headers followed by a shellcode that will be executed directly.

http://marc.theaimsgroup.com/?l=full-disclosure&m=109646043512722 2004-09-29 2004-10-13
freeradius -- denial-of-service vulnerability freeradius 0.8.01.0.1

A remote attacker may be able to crash the freeRADIUS Server due to three independant bugs in the function which does improper checking values while processing RADIUS attributes.

CVE-2004-0938 CVE-2004-0960 CVE-2004-0961 http://www.securitytracker.com/alerts/2004/Sep/1011364.html 541574 11222 2004-09-20 2004-10-13 2004-10-19
xerces-c2 -- Attribute blowup denial-of-service xerces-c2 2.6.0

Amit Klein reports about Xerces-C++:

An attacker can craft a malicious XML document, which uses XML attributes in a way that inflicts a denial of service condition on the target machine (XML parser). The result of this attack is that the XML parser consumes all the CPU.

11312 http://marc.theaimsgroup.com/?l=bugtraq&m=109674050017645 2004-10-02 2004-10-13 2004-10-14
wordpress -- XSS in administration panel wordpress 1.2.1

Pages in the administration panel of Wordpress are vulnerable for XSS attacks.

http://wordpress.org/development/2004/10/wp-121/ http://marc.theaimsgroup.com/?l=bugtraq&m=109641484723194 2004-09-27 2004-10-13
tiff -- multiple integer overflows tiff 3.6.1_2 linux-tiff 3.6.1 pdflib pdflib-perl 6.0.1 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

Dmitry V. Levin discovered numerous integer overflow bugs in libtiff. Most of these bugs are related to memory management, and are believed to be exploitable for arbitrary code execution.

687568 CVE-2004-0886 http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities 2004-10-13 2004-10-13 2006-06-08
CUPS -- local information disclosure cups-base 1.1.22

Certain methods of authenticated remote printing in CUPS can disclose user names and passwords in the log files.

A workaround for this problem is to set more strict access permissions on the CUPS logfiles.

http://docs.info.apple.com/article.html?artnum=61798 http://secunia.com/advisories/12690/ http://www.cups.org/str.php?L920 CVE-2004-0923 557062 2004-09-23 2004-10-13
zinf -- potential buffer overflow playlist support zinf 2.2.5 freeamp 0

The audio player Zinf is vulnerable to a buffer-overflow bug in the management of the playlist files.

http://marc.theaimsgroup.com/?l=bugtraq&m=109608092609200 2004-09-24 2004-10-12
tiff -- RLE decoder heap overflows tiff 3.6.1_1 linux-tiff 3.6.1 pdflib pdflib-perl 6.0.1 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

Chris Evans discovered several heap buffer overflows in libtiff's RLE decoder. These overflows could be triggered by a specially-crafted TIFF image file, resulting in an application crash and possibly arbitrary code execution.

948752 CVE-2004-0803 http://scary.beasts.org/security/CESA-2004-006.txt 2004-10-13 2004-10-13 2006-06-08
sharutils -- buffer overflows sharutils 4.2.1_2

From Gentoo advisory GLSA 200410-01:

sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer overflow in shar.c, where the length of data returned by the wc command is not checked. Florian Schilhabel discovered another buffer overflow in unshar.c.

An attacker could exploit these vulnerabilities to execute arbitrary code as the user running one of the sharutils programs.

11298 http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=265904 2004-08-15 2004-10-13
mail-notification -- denial-of-service vulnerability mail-notification 0.7.0

Caused by an untested return value, and a resulting null pointer dereference, it is possible for an attacker to crash the application. However, the attacker must first hijack the connection between Mail Notification and the Gmail or IMAP server.

http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:2.asc http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:3.asc 2004-10-06 2004-10-12
squid -- SNMP module denial-of-service vulnerability squid 2.5.7

The Squid-2.5 patches page notes:

If a certain malformed SNMP request is received squid restarts with a Segmentation Fault error.

This only affects squid installations where SNMP is explicitly enabled via "make config". As a workaround, SNMP can be disabled by defining "snmp_port 0" in squid.conf.

CVE-2004-0918 http://www.idefense.com/application/poi/display?id=152&type=vulnerabilities http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump 2004-09-29 2004-10-12
cyrus-sasl -- potential buffer overflow in DIGEST-MD5 plugin cyrus-sasl 2.*2.1.19

The Cyrus SASL DIGEST-MD5 plugin contains a potential buffer overflow when quoting is required in the output.

https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c#rev1.171 2004-07-06 2004-10-12
cyrus-sasl -- dynamic library loading and set-user-ID applications cyrus-sasl 1.5.28_3 2.*2.1.19

The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASL_PATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application (such as chsh) utilizes libsasl, it may be possible for a local attacker to gain superuser privileges.

CVE-2004-0884 https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c#rev1.104 2004-09-22 2004-10-08
imp3 -- XSS hole in the HTML viewer imp 3.2.6

The script vulnerabilities can only be exposed with certain browsers and allow XSS attacks when viewing HTML messages with the HTML MIME viewer

http://thread.gmane.org/gmane.comp.horde.imp/15488 http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.389.2.109&r2=1.389.2.111&ty=h 2004-08-20 2004-10-05
bmon -- unsafe set-user-ID application bmon 1.2.1_2

Jon Nistor reported that the FreeBSD port of bmon was installed set-user-ID root, and executes commands using relative paths. This could allow local user to easily obtain root privileges.

ports/67340 2004-05-29 2004-10-05
gnutls -- certificate chain verification DoS gnutls 1.0.17 gnutls-devel 1.1.*1.1.12

Patric Hornik reports on a problem in the certificate chain verification procedures of GnuTLS that may result in a denial-of-service vulnerability:

The certificate chain should be verified from last root certificate to the first certificate. Otherwise a lot of unauthorized CPU processing can be forced to check certificate signatures signed with arbitrary RSA/DSA keys chosen by attacker.

In GnuTLS the signatures are checked from first to last certificate, there is no limit on size of keys and no limit on length of certificate chain.

http://www.hornik.sk/SA/SA-20040802.txt http://secunia.com/advisories/12156 2004-08-02 2004-10-05
php -- vulnerability in RFC 1867 file upload processing php4 php4-cgi 4.3.8_2 mod_php4 4.3.8_2,1 php5 php5-cgi 5.0.1 mod_php5 5.0.1,1

Stefano Di Paola discovered an issue with PHP that could allow someone to upload a file to any directory writeable by the httpd process. Any sanitizing performed on the prepended directory path is ignored. This bug can only be triggered if the $_FILES element name contains an underscore.

http://marc.theaimsgroup.com/?l=bugtraq&m=109534848430404 http://marc.theaimsgroup.com/?l=bugtraq&m=109648426331965 2004-09-15 2004-09-15 2004-10-12
php -- php_variables memory disclosure mod_php4-twig php4-cgi php4-cli php4-dtc php4-horde php4-nms php4 4.3.8_2 mod_php mod_php4 44.3.8_2,1 php5 php5-cgi php5-cli 5.0.1 mod_php5 5.0.1,1

Stefano Di Paola reports:

Bad array parsing in php_variables.c could lead to show arbitrary memory content such as pieces of php code and other data. This affects all GET, POST or COOKIES variables.

http://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492 2004-09-15 2004-10-05
xv -- exploitable buffer overflows xv xv-m17n 3.10a_4

In a Bugtraq posting, infamous41md(at)hotpop.com reported:

there are at least 5 exploitable buffer and heap overflows in the image handling code. this allows someone to craft a malicious image, trick a user into viewing the file in xv, and upon viewing that image execute arbitrary code under privileges of the user viewing image. note the AT LEAST part of the above sentence. there is such a plethora of bad code that I just stopped reading after a while. there are at least 100 calls to sprintf() and strcpy() with no regards for bounds of buffers. 95% of these deal with program arguments or filenames, so they are of no interest to exploit. however I just got sick of reading this code after not too long. so im sure there are still other overflows in the image handling code for other image types.

The posting also included an exploit.

http://marc.theaimsgroup.com/?l=bugtraq&m=109302498125092 2004-08-20 2004-10-05 2004-10-12
getmail -- symlink vulnerability during maildir delivery getmail 3.2.5

David Watson reports a symlink vulnerability in getmail. If run as root (not the recommended mode of operation), a local user may be able to cause getmail to write files in arbitrary directories via a symlink attack on subdirectories of the maildir.

http://marc.theaimsgroup.com/?l=bugtraq&m=109571883130372 CVE-2004-0881 11224 2004-09-19 2004-10-04
Boundary checking errors in syscons FreeBSD 5.05.2.1_11

The syscons CONS_SCRSHOT ioctl(2) does insufficient validation of its input arguments. In particular, negative coordinates or large coordinates may cause unexpected behavior.

It may be possible to cause the CONS_SCRSHOT ioctl to return portions of kernel memory. Such memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way. For example, a terminal buffer might include a user-entered password.

This bug may be exploitable by users who have access to the physical console or can otherwise open a /dev/ttyv* device node.

CVE-2004-0919 SA-04:15.syscons http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/dev/syscons/syscons.c#rev1.429 2004-09-30 2004-10-04
racoon -- improper certificate handling racoon 20040818a

Thomas Walpuski noted when OpenSSL would detect an error condition for a peer certificate, racoon mistakenly ignored the error. This could allow five invalid certificate states to properly be used for authentication.

http://marc.theaimsgroup.com/?l=bugtraq&m=108726102304507 http://www.kame.net/racoon/racoon-ml/msg00517.html 2004-01-31 2004-10-03
distcc -- incorrect parsing of IP access control rules distcc 2.16

Fix bug that might cause IP-based access control rules not to be interpreted correctly on 64-bit platforms.

CVE-2004-0601 http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS 2004-06-23 2004-10-03
mozilla -- scripting vulnerabilities thunderbird 0.8 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 1.p de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7.3 mozilla 1.7.3,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0

Several scripting vulnerabilities were discovered and corrected in Mozilla:

CVE-2004-0905

javascript; links dragged onto another frame or page allows an attacker to steal or modify sensitive information from other sites. The user could be convinced to drag obscurred links in the context of a game or even a fake scrollbar. If the user could be convinced to drag two links in sequence into a separate window (not frame) the attacker would be able to run arbitrary programs.

CVE-2004-0908

Untrusted javascript code can read and write to the clipboard, stealing any sensitive data the user might have copied. Workaround: disable javascript

CVE-2004-0909

Signed scripts requesting enhanced abilities could construct the request in a way that led to a confusing grant dialog, possibly fooling the user into thinking the privilege requested was inconsequential while actually obtaining explicit permission to run and install software. Workaround: Never grant enhanced abilities of any kind to untrusted web pages.

CVE-2004-0905 CVE-2004-0908 CVE-2004-0909 http://bugzilla.mozilla.org/show_bug.cgi?id=250862 http://bugzilla.mozilla.org/show_bug.cgi?id=257523 http://bugzilla.mozilla.org/show_bug.cgi?id=253942 2004-09-13 2004-09-30
mozilla -- users may be lured into bypassing security dialogs thunderbird 0.7 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0.9.2 de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7 mozilla 1.7,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0

According to the Mozilla project:

An attacker who could lure users into clicking in particular places, or typing specific text, could cause a security permission or software installation dialog to pop up under the user's mouse click, clicking on the grant (or install) button.

CVE-2004-0762 http://bugzilla.mozilla.org/show_bug.cgi?id=162020 2004-06-05 2004-09-30
mozilla -- hostname spoofing bug thunderbird 0.7 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0.9.2 de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7 mozilla 1.7,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0

When processing URIs that contain an unqualified host name-- specifically, a domain name of only one component-- Mozilla will perform matching against the first component of the domain name in SSL certificates. In other words, in some situations, a certificate issued to "www.example.com" will be accepted as matching "www".

CVE-2004-0765 http://bugzilla.mozilla.org/show_bug.cgi?id=234058 2004-02-12 2004-09-30
samba -- remote file disclosure samba 2.2.12 3.a3.0.2a_1,1 ja-samba 2.2.11.j1.0_1

According to a Samba Team security notice:

A security vulnerability has been located in Samba 2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.5. A remote attacker may be able to gain access to files which exist outside of the share's defined path. Such files must still be readable by the account used for the connection.

The original notice for CAN-2004-0815 indicated that Samba 3.0.x <= 3.0.5 was vulnerable to the security issue. After further research, Samba developers have confirmed that only Samba 3.0.2a and earlier releases contain the exploitable code.

CVE-2004-0815 http://www.samba.org/samba/news/#security_2.2.12 2004-09-30 2004-09-30 2004-10-15
mozilla -- BMP decoder vulnerabilities thunderbird 0.7.3_1 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird linux-phoenix phoenix ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0.9.3_1 de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 linux-mozilla linux-mozilla-devel 1.7.3 mozilla-gtk1 1.7.2_3 mozilla 1.7.2_2,2 1.8.a,21.8.a3_1,2 mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk mozilla-gtk2 mozilla-thunderbird linux-netscape de-linux-netscape fr-linux-netscape ja-linux-netscape 0

Gael Delalleau discovered several integer overflows in Mozilla's BMP decoder that can result in denial-of-service or arbitrary code execution.

CVE-2004-0904 http://bugzilla.mozilla.org/show_bug.cgi?id=255067 TA04-261A 847200 2004-09-13 2004-09-28 2004-09-30
mozilla -- vCard stack buffer overflow thunderbird 0.7.3_1 mozilla 1.7.2_2,2 1.8.a,21.8.a3_1,2 mozilla-gtk1 1.7.2_3 linux-mozilla 1.7.3

Georgi Guninski discovered a stack buffer overflow which may be triggered when viewing email messages with vCard attachments.

CVE-2004-0903 http://bugzilla.mozilla.org/show_bug.cgi?id=257314 TA04-261A 414240 2004-09-13 2004-09-28 2004-09-30
mozilla -- multiple heap buffer overflows thunderbird 0.7.3_1 firefox 0.9.3_1 mozilla 1.7.2_2,2 1.8.a,21.8.a3_1,2 mozilla-gtk1 1.7.2_3 linux-mozilla 1.7.3 linux-mozillafirebird 0

Several heap buffer overflows were discovered and fixed in the most recent versions of Mozilla, Firefox, and Thunderbird. These overflows may occur when:

  • Using the "Send Page" function.
  • Checking mail on a malicious POP3 server.
  • Processing non-ASCII URLs.

Each of these vulnerabilities may be exploited for remote code execution.

CVE-2004-0902 http://bugzilla.mozilla.org/show_bug.cgi?id=258005 http://bugzilla.mozilla.org/show_bug.cgi?id=245066 http://bugzilla.mozilla.org/show_bug.cgi?id=226669 http://bugzilla.mozilla.org/show_bug.cgi?id=256316 TA04-261A 2004-09-13 2004-09-28
php -- strip_tags cross-site scripting vulnerability mod_php4-twig php4 php4-cgi php4-cli php4-dtc php4-horde php4-nms 4.3.7_3 mod_php4 4.3.7_3,1 php5 php5-cgi php5-cli 5.0.0.r3_2 mod_php5 5.0.0.r3_2,1

Stefan Esser of e-matters discovered that PHP's strip_tags() function would ignore certain characters during parsing of tags, allowing these tags to pass through. Select browsers could then parse these tags, possibly allowing cross-site scripting attacks.

CVE-2004-0595 http://marc.theaimsgroup.com/?l=bugtraq&m=108981589117423 http://security.e-matters.de/advisories/122004.html 10724 2007-07-07 2004-09-27 2004-10-02
php -- memory_limit related vulnerability mod_php4-twig php4 php4-cgi php4-cli php4-dtc php4-horde php4-nms 4.3.7_3 mod_php4 4.3.7_3,1 php5 php5-cgi php5-cli 5.0.0.r3_2 mod_php5 5.0.0.r3_2,1

Stefan Esser of e-matters discovered a condition within PHP that may lead to remote execution of arbitrary code. The memory_limit facility is used to notify functions when memory contraints have been met. Under certain conditions, the entry into this facility is able to interrupt functions such as zend_hash_init() at locations not suitable for interruption. The result would leave these functions in a vulnerable state.

An attacker that is able to trigger the memory_limit abort within zend_hash_init() and is additionally able to control the heap before the HashTable itself is allocated, is able to supply his own HashTable destructor pointer. [...]

All mentioned places outside of the extensions are quite easy to exploit, because the memory allocation up to those places is deterministic and quite static throughout different PHP versions. [...]

Because the exploit itself consist of supplying an arbitrary destructor pointer this bug is exploitable on any platform.

CVE-2004-0594 http://marc.theaimsgroup.com/?l=bugtraq&m=108981780109154 http://security.e-matters.de/advisories/112004.html 10725 2007-07-07 2004-09-27 2004-10-02
subversion -- WebDAV fails to protect metadata subversion subversion-perl subversion-python 1.0.8

In some situations, subversion metadata may be unexpectedly disclosed via WebDAV. A subversion advisory states:

mod_authz_svn, the Apache httpd module which does path-based authorization on Subversion repositories, is not correctly protecting all metadata on unreadable paths.

This security issue is not about revealing the contents of protected files: it only reveals metadata about protected areas such as paths and log messages. This may or may not be important to your organization, depending on how you're using path-based authorization, and the sensitivity of the metadata.

CVE-2004-0749 http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt 2004-09-15 2004-09-26
lha -- numerous vulnerabilities when extracting archives lha 1.14i_6

Source code reviews of lha by Lukasz Wojtow, Thomas Biege, and others uncovered a number of vulnerabilities affecting lha:

  • Buffer overflows when handling archives and filenames. (CVE-2004-0694)
  • Possible command execution via shell meta-characters when built with NOMKDIR. (CVE-2004-0745)
  • Buffer overflow resulting in arbitrary code execution when handling long pathnames in LHZ archives. (CVE-2004-0769)
  • Buffer overflow in the extract_one. (CVE-2004-0771)
CVE-2004-0694 CVE-2004-0745 CVE-2004-0769 CVE-2004-0771 http://marc.theaimsgroup.com/?l=bugtraq&m=108464470103227 http://marc.theaimsgroup.com/?l=bugtraq&m=108668791510153 http://bugs.gentoo.org/show_bug.cgi?id=51285 http://xforce.iss.net/xforce/xfdb/16196 10354 2004-05-17 2004-09-23
mysql -- heap buffer overflow with prepared statements mysql-server mysql-client 4.1.04.1.4

There is a buffer overflow in the prepared statements API (libmysqlclient) when a statement containing thousands of placeholders is executed.

http://bugs.mysql.com/bug.php?id=5194 http://dev.mysql.com/doc/mysql/en/News-4.1.5.html http://mysql.bkbits.net:8080/mysql-4.1/cset@1.1932.152.4 2004-09-08 2004-09-23
mozilla -- security icon spoofing firefox 0.9 linux-mozilla linux-mozilla-devel 1.7 mozilla 1.7,2 mozilla-gtk1 1.7

Under certain situations it is possible for the security icon which Mozilla displays when connected to a site using SSL to be spoofed. This could be used to make so-called "phishing attacks" more difficult to detect.

CVE-2004-0761 https://bugzilla.mozilla.org/show_bug.cgi?id=240053 2004-04-08 2004-09-22
mozilla -- NULL bytes in FTP URLs firefox 0.9.3 linux-mozilla linux-mozilla-devel 1.7.2 mozilla 1.7.2,2 1.8.a,2 mozilla-gtk1 1.7.2

When handling FTP URLs containing NULL bytes, Mozilla will interpret the file content as HTML. This may allow unexpected execution of Javascript when viewing plain text or other file types via FTP.

CVE-2004-0760 http://bugzilla.mozilla.org/show_bug.cgi?id=250906 2004-07-11 2004-09-22 2004-09-24
mozilla -- automated file upload mozilla 1.7.a,21.7,2 1.8.a,21.8.a2,2 mozilla-gtk1 1.7.a1.7

A malicious web page can cause an automated file upload from the victim's machine when viewed with Mozilla with Javascript enabled. This is due to a bug permitting default values for type="file" <input> elements in certain situations.

CVE-2004-0759 https://bugzilla.mozilla.org/show_bug.cgi?id=241924 2004-04-28 2004-09-22 2004-09-26
mozilla -- built-in CA certificates may be overridden firefox 0.9.3 linux-mozilla linux-mozilla-devel 1.7.2 mozilla 1.7.2,2 1.8.a,2 mozilla-gtk1 1.7.2

Under some situations, Mozilla will automatically import a certificate from an email message or web site. This behavior can be used as a denial-of-service attack: if the certificate has a distinguished name (DN) identical to one of the built-in Certificate Authorities (CAs), then Mozilla will no longer be able to certify sites with certificates issued from that CA.

CVE-2004-0758 https://bugzilla.mozilla.org/show_bug.cgi?id=249004 160360 http://banquo.inf.ethz.ch:8080/ 2004-06-29 2004-09-22
rssh -- file name disclosure bug rssh 2.2.1

rssh expands command line paramters before invoking chroot. This could result in the disclosure to the client of file names outside of the chroot directory. A posting by the rssh author explains:

The cause of the problem identified by Mr. McCaw is that rssh expanded command-line arguments prior to entering the chroot jail. This bug DOES NOT allow a user to access any of the files outside the jail, but can allow them to discover what files are in a directory which is outside the jail, if their credentials on the server would normally allow them read/execute access in the specified directory.

CVE-2004-0609 http://marc.theaimsgroup.com/?l=bugtraq&m=108787373022844 10574 http://www.osvdb.org/7239 2004-06-19 2004-09-21
gnu-radius -- SNMP-related denial-of-service gnu-radius 1.2.94

An iDEFENSE security advisory reports:

Remote exploitation of an input validation error in version 1.2 of GNU radiusd could allow a denial of service.

The vulnerability specifically exists within the asn_decode_string() function defined in snmplib/asn1.c. When a very large unsigned number is supplied, it is possible that an integer overflow will occur in the bounds-checking code. The daemon will then attempt to reference unallocated memory, resulting in an access violation that causes the process to terminate.

CVE-2004-0849 http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities 2004-09-15 2004-09-20 2005-05-03
sudo -- sudoedit information disclosure sudo 1.6.8

A new feature of sudo 1.6.8 called "sudoedit" (a safe editing facility) may allow users to read files to which they normally have no access.

http://www.sudo.ws/sudo/alerts/sudoedit.html 2004-09-18 2004-09-20
apache -- heap overflow in mod_proxy apache 1.3.31_1 apache13-ssl 1.3.29.1.53_2 apache13-modssl 1.3.31+2.8.18_4 apache13+ipv6 1.3.29_2 apache13-modperl 1.3.31

A buffer overflow exists in mod_proxy which may allow an attacker to launch local DoS attacks and possibly execute arbitrary code.

CVE-2004-0492 http://www.guninski.com/modproxy1.html 2004-06-10 2004-09-19 2004-10-05
cvs -- numerous vulnerabilities cvs+ipv6 1.11.17 FreeBSD 5.25.2.1_10 4.104.10_3 4.94.9_12 4.84.8_25

A number of vulnerabilities were discovered in CVS by Stefan Esser, Sebastian Krahmer, and Derek Price.

  • Insufficient input validation while processing "Entry" lines. (CVE-2004-0414)
  • A double-free resulting from erroneous state handling while processing "Argumentx" commands. (CVE-2004-0416)
  • Integer overflow while processing "Max-dotdot" commands. (CVE-2004-0417)
  • Erroneous handling of empty entries handled while processing "Notify" commands. (CVE-2004-0418)
  • A format string bug while processing CVS wrappers.
  • Single-byte buffer underflows while processing configuration files from CVSROOT.
  • Various other integer overflows.

Additionally, iDEFENSE reports an undocumented command-line flag used in debugging does not perform input validation on the given path names.

CVS servers ("cvs server" or :pserver: modes) are affected by these vulnerabilities. They vary in impact but include information disclosure (the iDEFENSE-reported bug), denial-of-service (CVE-2004-0414, CVE-2004-0416, CVE-2004-0417 and other bugs), or possibly arbitrary code execution (CVE-2004-0418). In very special situations where the attacker may somehow influence the contents of CVS configuration files in CVSROOT, additional attacks may be possible.

CVE-2004-0414 CVE-2004-0416 CVE-2004-0417 CVE-2004-0418 CVE-2004-0778 http://secunia.com/advisories/11817 http://secunia.com/advisories/12309 http://security.e-matters.de/advisories/092004.html http://www.idefense.com/application/poi/display?id=130&type=vulnerabilities&flashstatus=false https://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.104 http://www.osvdb.org/6830 http://www.osvdb.org/6831 http://www.osvdb.org/6832 http://www.osvdb.org/6833 http://www.osvdb.org/6834 http://www.osvdb.org/6835 http://www.osvdb.org/6836 10499 SA-04:14.cvs 2004-05-20 2004-08-17 2004-09-19
gdk-pixbuf -- image decoding vulnerabilities linux-gdk-pixbuf 0.22.0.11.3.5 gtk 2.02.4.9_1 gdk-pixbuf 0.22.0_2

Chris Evans discovered several flaws in the gdk-pixbuf XPM image decoder:

  • Heap-based overflow in pixbuf_create_from_xpm
  • Stack-based overflow in xpm_extract_color
  • Integer overflows in io-ico.c

Some of these flaws are believed to be exploitable.

CVE-2004-0782 CVE-2004-0783 CVE-2004-0788 http://scary.beasts.org/security/CESA-2004-005.txt 2004-09-15 2004-09-15 2004-11-09
xpm -- image decoding vulnerabilities agenda-snow-libs linux_base open-motif-devel mupad zh-cle_base 0 libXpm 3.5.1_1 XFree86-libraries 4.4.0_1 xorg-libraries 6.7.0_2 lesstif 0.93.96,2 xpm 3.4k_1 linux-openmotif 2.2.4 open-motif 2.2.3_1

Chris Evans discovered several vulnerabilities in the libXpm image decoder:

  • A stack-based buffer overflow in xpmParseColors
  • An integer overflow in xpmParseColors
  • A stack-based buffer overflow in ParsePixels and ParseAndPutPixels

The X11R6.8.1 release announcement reads:

This version is purely a security release, addressing multiple integer and stack overflows in libXpm, the X Pixmap library; all known versions of X (both XFree86 and X.Org) are affected, so all users of X are strongly encouraged to upgrade.

CVE-2004-0687 CVE-2004-0688 http://freedesktop.org/pipermail/xorg/2004-September/003172.html http://scary.beasts.org/security/CESA-2004-003.txt 537878 882750 2004-09-15 2004-09-15 2005-01-03
cups -- print queue browser denial-of-service cups-base 1.1.21

If the CUPS server (cupsd) receives a zero-length UDP message, it will disable its print queue browser service.

CVE-2004-0558 http://www.cups.org/str.php?L863 2004-08-23 2004-09-15
apache -- apr_uri_parse IPv6 address handling vulnerability apache 2.02.0.50_3

The Apache Software Foundation Security Team discovered a programming error in the apr-util library function apr_uri_parse. When parsing IPv6 literal addresses, it is possible that a length is incorrectly calculated to be negative, and this value is passed to memcpy. This may result in an exploitable vulnerability on some platforms, including FreeBSD.

CVE-2004-0786 http://httpd.apache.org 2004-09-15 2004-09-15
mod_dav -- lock related denial-of-service apache 2.02.0.50_3 mod_dav 1.0.3_1

A malicious user with DAV write privileges can trigger a null pointer dereference in the Apache mod_dav module. This could cause the server to become unavailable.

CVE-2004-0809 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=31183 2004-09-15 2004-09-15
apache -- ap_resolve_env buffer overflow apache 2.02.0.50_3

SITIC discovered a vulnerability in Apache 2's handling of environmental variable settings in the httpd configuration files (the main `httpd.conf' and `.htaccess' files). According to a SITIC advisory:

The buffer overflow occurs when expanding ${ENVVAR} constructs in .htaccess or httpd.conf files. The function ap_resolve_env() in server/util.c copies data from environment variables to the character array tmp with strcat(3), leading to a buffer overflow.

CVE-2004-0747 http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html 2004-09-15 2004-09-15
webmin -- insecure temporary file creation at installation time webmin 1.150_5

The Webmin developers documented a security issue in the release notes for version 1.160:

Fixed a security hole in the maketemp.pl script, used to create the /tmp/.webmin directory at install time. If an un-trusted user creates this directory before Webmin is installed, he could create in it a symbolic link pointing to a critical file on the system, which would be overwritten when Webmin writes to the link filename.

CVE-2004-0559 http://www.webmin.com/changes-1.160.html 2004-09-05 2004-09-14 2004-09-15
samba3 DoS attack samba3 3.0.7,1

Code found in nmbd and smbd may allow a remote attacker to effectively crash the nmbd server or use the smbd server to exhaust the system memory.

CVE-2004-0807 CVE-2004-0808 http://www.idefense.com/application/poi/display?id=139&type=vulnerabilities 2004-09-02 2004-09-14
mozilla -- POP client heap overflow mozilla 1.7,2 linux-mozilla 1.7 netscape7 7.2 thunderbird 0.7

zen-parse discovered a heap buffer overflow in Mozilla's POP client implementation. A malicious POP server could exploit this vulnerability to cause Mozilla to execute arbitrary code.

CVE-2004-0757 http://bugzilla.mozilla.org/show_bug.cgi?id=229374 http://bugzilla.mozilla.org/show_bug.cgi?id=157644 2004-07-22 2004-09-14
mozilla -- SOAPParameter integer overflow firefox 0.9 linux-mozilla linux-mozilla-devel mozilla-gtk1 1.7 mozilla 1.7,2 netscape7 7.2

zen-parse discovered and iDEFENSE reported an exploitable integer overflow in a scriptable Mozilla component `SOAPParameter':

Improper input validation to the SOAPParameter object constructor in Netscape and Mozilla allows execution of arbitrary code. The SOAPParameter object's constructor contains an integer overflow which allows controllable heap corruption. A web page can be constructed to leverage this into remote execution of arbitrary code.

CVE-2004-0722 http://bugzilla.mozilla.org/show_bug.cgi?id=236618 2004-08-02 2004-09-14 2004-09-22
openoffice -- document disclosure openoffice ar-openoffice ca-openoffice cs-openoffice de-openoffice dk-openoffice el-openoffice es-openoffice et-openoffice fi-openoffice fr-openoffice gr-openoffice hu-openoffice it-openoffice ja-openoffice ko-openoffice nl-openoffice pl-openoffice pt-openoffice pt_BR-openoffice ru-openoffice se-openoffice sk-openoffice sl-openoffice-SI tr-openoffice zh-openoffice-CN zh-openoffice-TW 1.1.2_1 2.0

OpenOffice creates a working directory in /tmp on startup, and uses this directory to temporarily store document content. However, the permissions of the created directory may allow other user on the system to read these files, potentially exposing information the user likely assumed was inaccessible.

CVE-2004-0752 http://www.openoffice.org/issues/show_bug.cgi?id=33357 http://securitytracker.com/alerts/2004/Sep/1011205.html http://marc.theaimsgroup.com/?l=bugtraq&m=109483308421566 2004-08-24 2004-09-14
mpg123 buffer overflow mpg123 mpg123-nas mpg123-esound 0.59r

The mpg123 software version 0.59r contains a buffer overflow vulnerability which may permit the execution of arbitrary code as the owner of the mpg123 process.

CVE-2004-0805 http://www.alighieri.org/advisories/advisory-mpg123.txt 2003-08-16 2004-09-14
ImageMagick -- BMP decoder buffer overflow ImageMagick ImageMagick-nox11 6.0.6.2

Marcus Meissner discovered that ImageMagick's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability.

CVE-2004-0827 http://www.imagemagick.org/www/Changelog.html 2004-08-25 2004-08-31 2004-09-14
Mutiple browser frame injection vulnerability kdelibs 3.2.3_3 kdebase 3.2.3_1 linux-opera opera 7.507.52 firefox 0.9 linux-mozilla linux-mozilla-devel mozilla-gtk1 1.7 mozilla 1.7,2 netscape7 7.2

A class of bugs affecting many web browsers in the same way was discovered. A Secunia advisory reports:

The problem is that the browsers don't check if a target frame belongs to a website containing a malicious link, which therefore doesn't prevent one browser window from loading content in a named frame in another window.

Successful exploitation allows a malicious website to load arbitrary content in an arbitrary frame in another browser window owned by e.g. a trusted site.

A KDE Security Advisory reports:

A malicious website could abuse Konqueror to insert its own frames into the page of an otherwise trusted website. As a result the user may unknowingly send confidential information intended for the trusted website to the malicious website.

Secunia has provided a demonstration of the vulnerability at http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/.

CVE-2004-0717 CVE-2004-0718 CVE-2004-0721 http://secunia.com/advisories/11978/ http://bugzilla.mozilla.org/show_bug.cgi?id=246448 ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-htmlframes.patch ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdebase-htmlframes.patch 2004-08-11 2004-08-12 2004-09-14
isakmpd payload handling denial-of-service vulnerabilities isakmpd 20030903

Numerous errors in isakmpd's input packet validation lead to denial-of-service vulnerabilities. From the Rapid7 advisory:

The ISAKMP packet processing functions in OpenBSD's isakmpd daemon contain multiple payload handling flaws that allow a remote attacker to launch a denial of service attack against the daemon.

Carefully crafted ISAKMP packets will cause the isakmpd daemon to attempt out-of-bounds reads, exhaust available memory, or loop endlessly (consuming 100% of the CPU).

CVE-2004-0218 CVE-2004-0219 CVE-2004-0220 CVE-2004-0221 CVE-2004-0222 http://www.rapid7.com/advisories/R7-0018.html http://www.openbsd.org/errata34.html 2004-03-17 2004-03-31 2004-09-14
imlib -- BMP decoder heap buffer overflow imlib 1.9.14_4

Marcus Meissner discovered that imlib's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability. It is believed that this bug could be exploited for arbitrary code execution.

CVE-2004-0817 http://bugzilla.gnome.org/show_bug.cgi?id=151034 2004-08-25 2004-08-31 2004-09-02
krb5 -- double-free vulnerabilities krb5 1.3.4_1

An advisory published by the MIT Kerberos team says:

The MIT Kerberos 5 implementation's Key Distribution Center (KDC) program contains a double-free vulnerability that potentially allows a remote attacker to execute arbitrary code. Compromise of a KDC host compromises the security of the entire authentication realm served by the KDC. Additionally, double-free vulnerabilities exist in MIT Kerberos 5 library code, making client programs and application servers vulnerable.

Double-free vulnerabilities of this type are not believed to be exploitable for code execution on FreeBSD systems. However, the potential for other ill effects may exist.

CVE-2004-0642 CVE-2004-0643 CVE-2004-0772 795632 866472 350792 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt 2004-08-31 2004-08-31
krb5 -- ASN.1 decoder denial-of-service vulnerability krb5 1.2.21.3.4

An advisory published by the MIT Kerberos team says:

The ASN.1 decoder library in the MIT Kerberos 5 distribution is vulnerable to a denial-of-service attack causing an infinite loop in the decoder. The KDC is vulnerable to this attack.

An unauthenticated remote attacker can cause a KDC or application server to hang inside an infinite loop.

An attacker impersonating a legitimate KDC or application server may cause a client program to hang inside an infinite loop.

CVE-2004-0644 550464 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt 2004-08-31 2004-08-31
imlib2 -- BMP decoder buffer overflow imlib2 1.1.1

Marcus Meissner discovered that imlib2's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability. There appears to be both a stack-based and a heap-based buffer overflow that are believed to be exploitable for arbitrary code execution.

CVE-2004-0802 http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&view=markup 2004-08-31 2004-08-31
SpamAssassin -- denial-of-service in tokenize_headers p5-Mail-SpamAssassin 2.64

According to the SpamAssassin 2.64 release announcement:

Security fix prevents a denial of service attack open to certain malformed messages; this DoS affects all SpamAssassin 2.5x and 2.6x versions to date.

The issue appears to be triggered by overly long message headers.

CVE-2004-0796 10957 http://marc.theaimsgroup.com/?l=spamassassin-announce&m=109168121628767 http://search.cpan.org/src/JMASON/Mail-SpamAssassin-2.64/Changes 2004-08-04 2004-08-23 2004-08-28
tnftpd -- remotely exploitable vulnerability tnftpd 20040810 lukemftpd 0 FreeBSD 4.7

lukemftpd(8) is an enhanced BSD FTP server produced within the NetBSD project. The sources for lukemftpd are shipped with some versions of FreeBSD, however it is not built or installed by default. The build system option WANT_LUKEMFTPD must be set to build and install lukemftpd. [NOTE: An exception is FreeBSD 4.7-RELEASE, wherein lukemftpd was installed, but not enabled, by default.]

Przemyslaw Frasunek discovered several vulnerabilities in lukemftpd arising from races in the out-of-band signal handling code used to implement the ABOR command. As a result of these races, the internal state of the FTP server may be manipulated in unexpected ways.

A remote attacker may be able to cause FTP commands to be executed with the privileges of the running lukemftpd process. This may be a low-privilege `ftp' user if the `-r' command line option is specified, or it may be superuser privileges if `-r' is *not* specified.

CVE-2004-0794 10967 http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpd.c#rev1.158 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc http://lists.netsys.com/pipermail/full-disclosure/2004-August/025418.html 2004-08-17 2004-08-17 2004-08-28
MySQL authentication bypass / buffer overflow mysql-server 4.14.1.3 55.0.0_2

By submitting a carefully crafted authentication packet, it is possible for an attacker to bypass password authentication in MySQL 4.1. Using a similar method, a stack buffer used in the authentication mechanism can be overflowed.

CVE-2004-0627 CVE-2004-0628 184030 645326 http://www.nextgenss.com/advisories/mysql-authbypass.txt http://dev.mysql.com/doc/mysql/en/News-4.1.3.html http://secunia.com/advisories/12020 http://www.osvdb.org/7475 http://www.osvdb.org/7476 http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html 2004-07-01 2004-07-05 2004-08-28
Ruby insecure file permissions in the CGI session management ruby 1.6.8.2004.07.26 1.7.01.8.1.2004.07.23

According to a Debian Security Advisory:

Andres Salomon noticed a problem in the CGI session management of Ruby, an object-oriented scripting language. CGI::Session's FileStore (and presumably PStore [...]) implementations store session information insecurely. They simply create files, ignoring permission issues. This can lead an attacker who has also shell access to the webserver to take over a session.

CVE-2004-0755 http://xforce.iss.net/xforce/xfdb/16996 http://www.debian.org/security/2004/dsa-537 http://marc.theaimsgroup.com/?l=bugtraq&m=109267579822250&w=2 2004-08-16 2004-08-16 2004-08-28
nss -- exploitable buffer overflow in SSLv2 protocol handler nss 3.9.2

ISS X-Force reports that a remotely exploitable buffer overflow exists in the Netscape Security Services (NSS) library's implementation of SSLv2. From their advisory:

The NSS library contains a flaw in SSLv2 record parsing that may lead to remote compromise. When parsing the first record in an SSLv2 negotiation, the client hello message, the server fails to validate the length of a record field. As a result, it is possible for an attacker to trigger a heap-based overflow of arbitrary length.

Note that the vulnerable NSS library is also present in Mozilla-based browsers. However, it is not believed that browsers are affected, as the vulnerability is present only in code used by SSLv2 *servers*.

http://xforce.iss.net/xforce/alerts/id/180 http://www.osvdb.org/9116 http://secunia.com/advisories/12362 11015 2004-08-23 2004-08-27
ripMIME -- decoding bug allowing content filter bypass ripmime 1.3.2.3

ripMIME may prematurely terminate decoding Base64 encoded messages when it encounters multiple blank lines or other non-standard Base64 constructs. Virus scanning and content filtering tools that use ripMIME may therefore be bypassed.

The ripMIME CHANGELOG file says:

There's viruses going around exploiting the ability to hide the majority of their data in an attachment by using blank lines and other tricks to make scanning systems prematurely terminate their base64 decoding.

10848 http://www.osvdb.org/8287 http://www.pldaniels.com/ripmime/CHANGELOG http://secunia.com/advisories/12201 http://xforce.iss.net/xforce/xfdb/16867 2004-07-30 2004-08-27
moinmoin -- ACL group bypass moinmoin 1.2.3

The moinmoin package contains two bugs with ACLs and anonymous users. Both bugs may permit anonymous users to gain access to administrative functions; for example the delete function.

There is no known workaround, the vulnerability exists regardless if a site is using ACLs or not.

http://www.osvdb.org/8194 http://www.osvdb.org/8195 http://security.gentoo.org/glsa/glsa-200408-25.xml http://secunia.com/advisories/11832 10805 10801 2004-07-21 2004-08-26
rsync -- path sanitizing vulnerability rsync 2.6.2_2

An rsync security advisory reports:

There is a path-sanitizing bug that affects daemon mode in all recent rsync versions (including 2.6.2) but only if chroot is disabled.

The bug may allow a remote user to access files outside of an rsync module's configured path with the privileges configured for that module.

CVE-2004-0792 http://samba.org/rsync/#security_aug04 http://lists.samba.org/archive/rsync-announce/2004/000017.html http://secunia.com/advisories/12294 http://www.osvdb.org/8829 2004-08-12 2004-08-26
gnomevfs -- unsafe URI handling gnomevfs2 2.6.2_1 gnomevfs 1.0.5_6 mc 4.6.0_12

Alexander Larsson reports that some versions of gnome-vfs and MidnightCommander contain a number of `extfs' scripts that do not properly validate user input. If an attacker can cause her victim to process a specially-crafted URI, arbitrary commands can be executed with the privileges of the victim.

CVE-2004-0494 10864 http://www.ciac.org/ciac/bulletins/o-194.shtml http://xforce.iss.net/xforce/xfdb/16897 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127263 2004-08-04 2004-08-26
SoX buffer overflows when handling .WAV files sox 12.17.112.17.4_1

Ulf Härnhammar discovered a pair of buffer overflows in the WAV file handling code of SoX. If an attacker can cause her victim to process a specially-crafted WAV file with SoX (e.g. through social engineering or through some other program that relies on SoX), arbitrary code can be executed with the privileges of the victim.

CVE-2004-0557 http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html http://secunia.com/advisories/12175 http://www.osvdb.org/8267 2004-07-28 2004-08-26
kdelibs -- konqueror cross-domain cookie injection kdelibs 3.2.3_3

According to a KDE Security Advisory:

WESTPOINT internet reconnaissance services alerted the KDE security team that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains.

Web sites operating under the affected domains can set HTTP cookies in such a way that the Konqueror web browser will send them to all other web sites operating under the same domain. A malicious website can use this as part of a session fixation attack. See e.g. http://www.acros.si/papers/session_fixation.pdf

Affected are all country specific secondary top level domains that use more than 2 characters in the secondary part of the domain name and that use a secondary part other than com, net, mil, org, gov, edu or int. Examples of affected domains are .ltd.uk, .plc.uk and .firm.in

It should be noted that popular domains such as .co.uk, .co.in and .com are NOT affected.

CVE-2004-0746 http://www.kde.org/info/security/advisory-20040823-1.txt http://www.osvdb.org/9117 http://secunia.com/advisories/12341 http://www.acros.si/papers/session_fixation.pdf 10991 2004-08-23 2004-08-26
fidogate -- write files as `news' user fidogate 4.4.9_3 fidogate-ds 5.1.1_1

Neils Heinen reports that the setuid `news' binaries installed as part of fidogate may be used to create files or append to file with the privileges of the `news' user by setting the LOGFILE environmental variable.

http://cvs.sourceforge.net/viewcvs.py/fidogate/fidogate/ChangeLog?rev=4.320&view=markup 2004-08-21 2004-08-22 2004-08-23
Arbitrary code execution via a format string vulnerability in jftpgw jftpgw 0.13.5

The log functions in jftpgw may allow remotely authenticated user to execute arbitrary code via the format string specifiers in certain syslog messages.

CVE-2004-0448 http://www.debian.org/security/2004/dsa-510 10438 http://xforce.iss.net/xforce/xfdb/16271 2004-05-30 2004-08-13 2004-08-23
qt -- image loader vulnerabilities qt 3.3.3

Qt contains several vulnerabilities related to image loading, including possible crashes when loading corrupt GIF, BMP, or JPEG images. Most seriously, Chris Evans reports that the BMP crash is actually due to a heap buffer overflow. It is believed that an attacker may be able to construct a BMP image that could cause a Qt-using application to execute arbitrary code when it is loaded.

CVE-2004-0691 CVE-2004-0692 CVE-2004-0693 http://www.trolltech.com/developer/changes/changes-3.3.3.html http://scary.beasts.org/security/CESA-2004-004.txt 2004-08-11 2004-08-22
courier-imap -- format string vulnerability in debug mode courier-imap 3.0.7,1

An iDEFENSE security advisory describes a format string vulnerability that could be exploited when Courier-IMAP is run in debug mode (DEBUG_LOGIN set).

CVE-2004-0777 http://lists.netsys.com/pipermail/full-disclosure/2004-August/025478.html http://www.idefense.com/application/poi/display?id=131&type=vulnerabilities&flashstatus=false 10976 2004-08-18 2004-08-22
mysql -- mysqlhotcopy insecure temporary file creation mysql-scripts 3.23.58 44.0.20 4.14.1.3 55.0.0_1

According to Christian Hammers:

[mysqlhotcopy created] temporary files in /tmp which had predictable filenames and such could be used for a tempfile run attack.

Jeroen van Wolffelaar is credited with discovering the issue.

CVE-2004-0457 http://www.debian.org/security/2004/dsa-540 http://lists.mysql.com/internals/15185 2004-08-18 2004-08-22
Multiple Potential Buffer Overruns in Samba samba 33.0.5,1 2.2.10 ja-samba 2.2.10.j1.0

Evgeny Demidov discovered that the Samba server has a buffer overflow in the Samba Web Administration Tool (SWAT) on decoding Base64 data during HTTP Basic Authentication. Versions 3.0.2 through 3.0.4 are affected.

Another buffer overflow bug has been found in the code used to support the "mangling method = hash" smb.conf option. The default setting for this parameter is "mangling method = hash2" and therefore not vulnerable. Versions between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are affected.

CVE-2004-0600 CVE-2004-0686 http://www.securityfocus.com/archive/1/369698 http://www.securityfocus.com/archive/1/369706 http://www.samba.org/samba/whatsnew/samba-3.0.5.html http://www.samba.org/samba/whatsnew/samba-2.2.10.html http://www.osvdb.org/8190 http://www.osvdb.org/8191 http://secunia.com/advisories/12130 2004-07-14 2004-07-21 2004-08-15
Mozilla / Firefox user interface spoofing vulnerability firefox 0.9.1_1 linux-mozilla 1.7.1 linux-mozilla-devel 1.7.1 mozilla 1.7.1,2 1.8.a,21.8.a2,2 mozilla-gtk1 1.7.1_1

The Mozilla project's family of browsers contain a design flaw that can allow a website to spoof almost perfectly any part of the Mozilla user interface, including spoofing web sites for phishing or internal elements such as the "Master Password" dialog box. This achieved by manipulating "chrome" through remote XUL content. Recent versions of Mozilla have been fixed to not allow untrusted documents to utilize "chrome" in this way.

CVE-2004-0764 http://bugzilla.mozilla.org/show_bug.cgi?id=22183 http://bugzilla.mozilla.org/show_bug.cgi?id=244965 http://bugzilla.mozilla.org/show_bug.cgi?id=252198 http://www.nd.edu/~jsmith30/xul/test/spoof.html http://secunia.com/advisories/12188 10832 2004-07-19 2004-07-30 2004-08-15
libpng stack-based buffer overflow and other code concerns png 1.2.5_7 linux-png 1.0.14_3 1.21.2.2 firefox 0.9.3 thunderbird 0.7.3 linux-mozilla 1.7.2 linux-mozilla-devel 1.7.2 mozilla 1.7.2,2 1.8.a,21.8.a2,2 mozilla-gtk1 1.7.2 netscape-communicator netscape-navigator 4.78 linux-netscape-communicator linux-netscape-navigator ko-netscape-navigator-linux ko-netscape-communicator-linux ja-netscape-communicator-linux ja-netscape-navigator-linux 4.8 netscape7 ja-netscape7 7.1 pt_BR-netscape7 fr-netscape7 de-netscape7 7.02

Chris Evans has discovered multiple vulnerabilities in libpng, which can be exploited by malicious people to compromise a vulnerable system or cause a DoS (Denial of Service).

http://www.securityfocus.com/archive/1/370853 http://scary.beasts.org/security/CESA-2004-001.txt http://www.osvdb.org/8312 http://www.osvdb.org/8313 http://www.osvdb.org/8314 http://www.osvdb.org/8315 http://www.osvdb.org/8316 CVE-2004-0597 CVE-2004-0598 CVE-2004-0599 388984 236656 160448 477512 817368 286464 http://secunia.com/advisories/12219 http://secunia.com/advisories/12232 http://bugzilla.mozilla.org/show_bug.cgi?id=251381 TA04-217A http://dl.sourceforge.net/sourceforge/libpng/ADVISORY.txt 2004-08-04 2004-08-04 2004-08-15
kdelibs insecure temporary file handling kdelibs 3.2.3_3

According to a KDE Security Advisory, KDE may sometimes create temporary files without properly checking the ownership and type of the target path. This could allow a local attacker to cause KDE applications to overwrite arbitrary files.

CVE-2004-0689 CVE-2004-0690 http://www.kde.org/info/security/advisory-20040811-1.txt http://www.kde.org/info/security/advisory-20040811-2.txt ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-kstandarddirs.patch ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-dcopserver.patch 2004-08-11 2004-08-12
gaim remotely exploitable vulnerabilities in MSN component gaim ja-gaim ko-gaim ru-gaim 0.81_1 gaim 20030000

Sebastian Krahmer discovered several remotely exploitable buffer overflow vulnerabilities in the MSN component of gaim.

In two places in the MSN protocol plugins (object.c and slp.c), strncpy was used incorrectly; the size of the array was not checked before copying to it. Both bugs affect MSN's MSNSLP protocol, which is peer-to-peer, so this could potentially be easy to exploit.

CVE-2004-0500 http://gaim.sourceforge.net/security/?id=0 2004-08-12 2004-08-12 2004-10-25
acroread uudecoder input validation error acroread acroread4 acroread5 5.0.9

An iDEFENSE security advisory reports:

Remote exploitation of an input validation error in the uudecoding feature of Adobe Acrobat Reader (Unix) 5.0 allows an attacker to execute arbitrary code.

The Unix and Linux versions of Adobe Acrobat Reader 5.0 automatically attempt to convert uuencoded documents back into their original format. The vulnerability specifically exists in the failure of Acrobat Reader to check for the backtick shell metacharacter in the filename before executing a command with a shell. This allows a maliciously constructed filename to execute arbitrary programs.

CVE-2004-0630 http://www.idefense.com/application/poi/display?id=124&type=vulnerabilities 2004-08-12 2004-08-12 2005-01-06
popfile file disclosure popfile 0.21.1_2

John Graham-Cumming reports that certain configurations of POPFile may allow the retrieval of any files with the extensions .gif, .png, .ico, .css, as well as some files with the extension .html.

http://sourceforge.net/mailarchive/forum.php?thread_id=5248725&forum_id=12356 2004-08-02 2004-08-12
isc-dhcp3-server buffer overflow in logging mechanism isc-dhcp3-relay isc-dhcp3-server 3.0.1.r123.0.1.r14

A buffer overflow exists in the logging functionality of the DHCP daemon which could lead to Denial of Service attacks and has the potential to allow attackers to execute arbitrary code.

CVE-2004-0460 http://www.osvdb.org/7237 TA04-174A 317350 http://www.securityfocus.com/archive/1/366801 http://www.securityfocus.com/archive/1/367286 2004-06-22 2004-06-25 2004-08-12
libpng denial-of-service linux-png 1.0.14_3 1.21.2.2 png 1.2.5_4

Steve Grubb reports a buffer read overrun in libpng's png_format_buffer function. A specially constructed PNG image processed by an application using libpng may trigger the buffer read overrun and possibly result in an application crash.

CVE-2004-0421 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120508 http://rhn.redhat.com/errata/RHSA-2004-181.html http://secunia.com/advisories/11505 http://www.osvdb.org/5726 10244 2004-04-29 2004-05-02 2004-08-12
Mozilla certificate spoofing firefox 0.9.10.9.2 linux-mozilla 1.7.2 linux-mozilla-devel 1.7.2 mozilla 1.7.2,2 1.8,21.8.a2,2 mozilla-gtk1 1.7.2

Mozilla and Mozilla Firefox contains a flaw that may allow a malicious user to spoof SSL certification.

http://www.securityfocus.com/archive/1/369953 http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory http://secunia.com/advisories/12160 http://bugzilla.mozilla.org/show_bug.cgi?id=253121 http://www.osvdb.org/8238 10796 CVE-2004-0763 2004-07-25 2004-07-30 2004-08-12
ImageMagick png vulnerability fix ImageMagick ImageMagick-nox11 6.0.4.2

Glenn Randers-Pehrson has contributed a fix for the png vulnerabilities discovered by Chris Evans.

http://studio.imagemagick.org/pipermail/magick-users/2004-August/013218.html http://freshmeat.net/releases/169228 http://secunia.com/advisories/12236 http://www.freebsd.org/ports/portaudit/f9e3e60b-e650-11d8-9b0a-000347a4fa7d.html 2004-08-04 2004-08-04 2004-08-12
Courier mail services: remotely exploitable buffer overflows courier 0.45 courier-imap 3.0,1 sqwebmail 4.0

The Courier set of mail services use a common Unicode library. This library contains buffer overflows in the converters for two popular Japanese character encodings. These overflows may be remotely exploitable, triggered by a maliciously formatted email message that is later processed by one of the Courier mail services. From the release notes for the corrected versions of the Courier set of mail services:

iso2022jp.c: Converters became (upper-)compatible with ISO-2022-JP (RFC1468 / JIS X 0208:1997 Annex 2) and ISO-2022-JP-1 (RFC2237). Buffer overflow vulnerability (when Unicode character is out of BMP range) has been closed. Convert error handling was implemented.

shiftjis.c: Broken SHIFT_JIS converters has been fixed and became (upper-)compatible with Shifted Encoding Method (JIS X 0208:1997 Annex 1). Buffer overflow vulnerability (when Unicode character is out of BMP range) has been closed. Convert error handling was implemented.

CVE-2004-0224 http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/iso2022jp.c?rev=1.10&view=markup http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/shiftjis.c?rev=1.6&view=markup 9845 http://secunia.com/advisories/11087 http://www.osvdb.org/4194 http://www.osvdb.org/6927 2004-02-01 2004-03-31 2004-07-16
multiple vulnerabilities in ethereal ethereal tethereal 0.10.3

Stefan Esser of e-matters Security discovered a baker's dozen of buffer overflows in Ethereal's decoders, including:

  • NetFlow
  • IGAP
  • EIGRP
  • PGM
  • IRDA
  • BGP
  • ISUP
  • TCAP
  • UCP

In addition, a vulnerability in the RADIUS decoder was found by Jonathan Heusser.

Finally, there is one uncredited vulnerability described by the Ethereal team as:

A zero-length Presentation protocol selector could make Ethereal crash.

http://www.ethereal.com/appnotes/enpa-sa-00013.html CVE-2004-0176 CVE-2004-0365 CVE-2004-0367 119876 124454 125156 433596 591820 644886 659140 695486 740188 792286 864884 931588 http://security.e-matters.de/advisories/032004.html http://secunia.com/advisories/11185 9952 http://www.osvdb.org/4462 http://www.osvdb.org/4463 http://www.osvdb.org/4464 2004-03-23 2004-03-26 2004-07-11
multiple vulnerabilities in ethereal ethereal ethereal-lite tethereal tethereal-lite 0.10.4

Issues have been discovered in multiple protocol dissectors.

http://www.ethereal.com/appnotes/enpa-sa-00014.html CVE-2004-0504 CVE-2004-0505 CVE-2004-0506 CVE-2004-0507 http://secunia.com/advisories/11608 10347 http://www.osvdb.org/6131 http://www.osvdb.org/6132 http://www.osvdb.org/6133 http://www.osvdb.org/6134 2004-05-13 2004-07-11
multiple vulnerabilities in ethereal ethereal ethereal-lite tethereal tethereal-lite 0.10.5

Issues have been discovered in multiple protocol dissectors.

http://www.ethereal.com/appnotes/enpa-sa-00015.html CVE-2004-0633 CVE-2004-0634 CVE-2004-0635 http://secunia.com/advisories/12024 10672 http://www.osvdb.org/7536 http://www.osvdb.org/7537 http://www.osvdb.org/7538 2004-07-06 2004-07-11
Format string vulnerability in SSLtelnet SSLtelnet 0.13_1

SSLtelnet contains a format string vulnerability that could allow remote code execution and privilege escalation.

CVE-2004-0640 http://www.idefense.com/application/poi/display?id=114&type=vulnerabilities 2003-04-03 2004-07-05
"Content-Type" XSS vulnerability affecting other webmail systems openwebmail 2.32 ilohamail 0.8.13

Roman Medina-Heigl Hernandez did a survey which other webmail systems where vulnerable to a bug he discovered in SquirrelMail. This advisory summarizes the results.

http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt http://www.freebsd.org/ports/portaudit/89a0de27-bf66-11d8-a252-02e0185c0b53.html http://www.freebsd.org/ports/portaudit/911f1b19-bd20-11d8-84f9-000bdb1444a4.html http://www.freebsd.org/ports/portaudit/c3e56efa-c42f-11d8-864c-02e0185c0b53.html CVE-2004-0519 2004-05-29 2004-07-05
Pavuk HTTP Location header overflow pavuk 0.9.28_5

When pavuk sends a request to a web server and the server sends back the HTTP status code 305 (Use Proxy), pavuk copies data from the HTTP Location header in an unsafe manner. This leads to a stack-based buffer overflow with control over EIP.

CVE-2004-0456 http://lists.netsys.com/pipermail/full-disclosure/2004-July/023322.html http://www.osvdb.org/7319 2004-06-30 2004-07-03
Several vulnerabilities found in PHPNuke phpnuke 7.3

Janek Vind "waraxe" reports that several issues in the PHPNuke software may be exploited via carefully crafted URL requests. These URLs will permit the injection of SQL code, cookie theft, and the readability of the PHPNuke administrator account.

CVE-2003-0279 CVE-2003-0318 CVE-2004-0266 CVE-2004-0269 http://www.waraxe.us/index.php?modname=sa&id=27 http://secunia.com/advisories/11920 2004-05-05 2004-07-03 2004-09-28
Remote code injection in phpMyAdmin phpMyAdmin 2.5.7.1

This vulnerability would allow remote user to inject PHP code to be executed by eval() function. This vulnerability is only exploitable if variable $cfg['LeftFrameLight'] is set to FALSE (in file config.inc.php).

http://sf.net/forum/forum.php?forum_id=387635 http://www.securityfocus.com/archive/1/367486 http://secunia.com/advisories/11974 http://eagle.kecapi.com/sec/fd/phpMyAdmin.html 2004-06-29 2004-07-02 2004-09-28
GNATS local privilege elevation gnats 3.113.1_9

GNATS 3.113.1 contains multiple buffer overflows, through which a local attacker could gain elevated privileges on the system.

ports/56006 http://www.securityfocus.com/archive/1/326337 http://www.securiteam.com/unixfocus/5CP0N0UAAA.html http://secunia.com/advisories/9096 http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2003-0x82-018-GNATS-bt.txt http://www.gnu.org/software/gnats/gnats.html http://www.osvdb.org/2190 http://www.osvdb.org/4600 http://www.osvdb.org/4601 http://www.osvdb.org/4607 2003-06-21 2004-07-02
Linux binary compatibility mode input validation error FreeBSD 4.94.9_10 4.84.8_23

A programming error in the handling of some Linux system calls may result in memory locations being accessed without proper validation.

It may be possible for a local attacker to read and/or overwrite portions of kernel memory, resulting in disclosure of sensitive information or potential privilege escalation. A local attacker can cause a system panic.

CVE-2004-0602 SA-04:13.linux 2004-06-18 2004-06-30
Remote Denial of Service of HTTP server and client giFT-FastTrack 0.8.7

giFT-FastTrack is susceptible to a remote Denial of Service attack which could allow a remote attacker to render HTTP services unusable. According to the developers, no code execution is possible; however, they recommend an immediate upgrade.

http://developer.berlios.de/forum/forum.php?forum_id=5814 http://www.osvdb.org/7266 http://secunia.com/advisories/11941 10604 2004-06-19 2004-06-25 2004-06-29
XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0 xorg-clients 6.7.0

When the IPv6 code was added to xdm a critical test to disable xdmcp was accidentally removed. This caused xdm to create the chooser socket regardless if DisplayManager.requestPort was disabled in xdm-config or not.

CVE-2004-0419 http://bugs.xfree86.org/show_bug.cgi?id=1376 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900 2004-05-19 2004-06-28 2004-06-28
MoinMoin administrative group name privilege escalation vulnerability moinmoin 1.2.2

A serious flaw exists in the MoinMoin software which may allow a malicious user to gain access to unauthorized privileges.

http://www.osvdb.org/6704 CVE-2004-0708 10568 http://secunia.com/advisories/11807 2004-05-04 2004-06-28
Cyrus IMAP pre-authentication heap overflow vulnerability cyrus 2.0.17 2.12.1.11

In December 2002, Timo Sirainen reported:

Cyrus IMAP server has a a remotely exploitable pre-login buffer overflow. [...] Note that you don't have to log in before exploiting this, and since Cyrus runs everything under one UID, it's possible to read every user's mail in the system.

It is unknown whether this vulnerability is exploitable for code execution on FreeBSD systems.

CVE-2002-1580 6298 740169 http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605 http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&msg=19349 2002-12-02 2004-05-12 2004-06-27
Cyrus IMSPd multiple vulnerabilities cyrus-imspd 1.6a5

The Cyrus team reported multiple vulnerabilities in older versions of Cyrus IMSPd:

These releases correct a recently discovered buffer overflow vulnerability, as well as clean up a significant amount of buffer handling throughout the code.

http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=25 2004-12-12 2004-05-12 2004-06-27
mplayer heap overflow in http requests mplayer mplayer-gtk mplayer-esound mplayer-gtk-esound 0.92.1

A remotely exploitable heap buffer overflow vulnerability was found in MPlayer's URL decoding code. If an attacker can cause MPlayer to visit a specially crafted URL, arbitrary code execution with the privileges of the user running MPlayer may occur. A `visit' might be caused by social engineering, or a malicious web server could use HTTP redirects which MPlayer would then process.

http://www.mplayerhq.hu/homepage/design6/news.html http://marc.theaimsgroup.com/?l=bugtraq&m=108066964709058 ports/64974 2004-03-30 2004-03-31 2004-06-27
ecartis buffer overflows and input validation bugs ecartis 1.0.0.s20030814,1

Timo Sirainen reports multiple buffer overflows that may be triggered while parsing messages, as well as input validation errors that could result in disclosure of mailing list passwords.

These bugs were resolved in the August 2003 snapshot of ecartis.

CVE-2003-0781 CVE-2003-0782 http://www.securiteam.com/unixfocus/5YP0H2AAUY.html ports/57082 2003-08-14 2004-03-29 2004-06-27
ModSecurity for Apache 2.x remote off-by-one overflow mod_security 1.7.5

When the directive "SecFilterScanPost" is enabled, the Apache 2.x version of ModSecurity is vulnerable to an off-by-one overflow

http://www.s-quadra.com/advisories/Adv-20040315.txt 9885 http://secunia.com/advisories/11138 779438 2004-02-09 2004-03-17 2004-06-27
clamav remote denial-of-service clamav 0.65_7

clamav will exit when a programming assertion is not met. A malformed uuencoded message can trigger this assertion, allowing an attacker to trivially crash clamd or other components of clamav.

ports/62586 http://www.securityfocus.com/archive/1/353186 http://www.osvdb.org/3894 9610 http://secunia.com/advisories/10826 CVE-2004-0270 http://xforce.iss.net/xforce/xfdb/15077 2004-02-09 2004-02-12 2004-06-27
neon date parsing vulnerability neon 0.24.5_1 sitecopy 0.13.4_1

Stefan Esser reports:

A vulnerability within a libneon date parsing function could cause a heap overflow which could lead to remote code execution, depending on the application using libneon.

The vulnerability is in the function ne_rfc1036_parse, which is in turn used by the function ne_httpdate_parse. Applications using either of these neon functions may be vulnerable.

CVE-2004-0398 http://security.e-matters.de/advisories/062004.html http://secunia.com/advisories/11785 2004-05-19 2004-05-19 2004-06-25
neon format string vulnerabilities neon 0.24.5 tla 1.2_1 sitecopy 0.13.4_1

Greuff reports that the neon WebDAV client library contains several format string bugs within error reporting code. A malicious server may exploit these bugs by sending specially crafted PROPFIND or PROPPATCH responses.

Although several applications include neon, such as cadaver and subversion, the FreeBSD Ports of these applications are not impacted. They are specifically configured to NOT use the included neon. Only packages listed as affected in this notice are believed to be impacted.

CVE-2004-0179 http://www.webdav.org/neon/ http://secunia.com/advisories/11785 2004-04-14 2004-04-15 2004-06-25
Gallery 1.4.3 and ealier user authentication bypass gallery 1.4.3.2

A flaw exists in Gallery versions previous to 1.4.3-pl1 and post 1.2 which may give an attacker the potential to log in under the "admin" account. Data outside of the gallery is unaffected and the attacker cannot modify any data other than the photos or photo albums.

CVE-2004-0522 http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=123 http://secunia.com/advisories/11752 2004-06-01 2004-06-24
Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling mc 4.6.0_10

Jakub Jelinek reports several security related bugs in Midnight Commander, including:

  • Multiple buffer overflows (CVE-2004-0226)
  • Insecure temporary file handling (CVE-2004-0231)
  • Format string bug (CVE-2004-0232)
CVE-2004-0226 CVE-2004-0231 CVE-2004-0232 2004-04-29 2004-05-02 2004-06-14
Buffer overflow in Squid NTLM authentication helper squid 2.5.5_9

Remote exploitation of a buffer overflow vulnerability in the NTLM authentication helper routine of the Squid Web Proxy Cache could allow a remote attacker to execute arbitrary code. A remote attacker can compromise a target system if the Squid Proxy is configured to use the NTLM authentication helper. The attacker can send an overly long password to overflow the buffer and execute arbitrary code.

http://www.idefense.com/application/poi/display?id=107&type=vulnerabilities&flashstatus=false CVE-2004-0541 http://www.osvdb.org/6791 http://secunia.com/advisories/11804 10500 http://www.squid-cache.org/bugs/show_bug.cgi?id=998 2004-05-20 2004-06-09
Vulnerabilities in H.323 implementations pwlib 1.5.0_5 asterisk 0.7.2 openh323 1.12.0_4

The NISCC and the OUSPG developed a test suite for the H.323 protocol. This test suite has uncovered vulnerabilities in several H.323 implementations with impacts ranging from denial-of-service to arbitrary code execution.

In the FreeBSD Ports Collection, `pwlib' is directly affected. Other applications such as `asterisk' and `openh323' incorporate `pwlib' statically and so are also independently affected.

http://www.uniras.gov.uk/vuls/2004/006489/h323.htm http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/h2250v4/index.html CA-2004-01 749342 CVE-2004-0097 http://www.southeren.com/blog/archives/000055.html 2004-01-13 2004-02-22 2004-06-08
jailed processes can manipulate host routing tables FreeBSD 4.94.9_10 4.84.8_23

A programming error resulting in a failure to verify that an attempt to manipulate routing tables originated from a non-jailed process.

Jailed processes running with superuser privileges could modify host routing tables. This could result in a variety of consequences including packets being sent via an incorrect network interface and packets being discarded entirely.

CVE-2004-0125 SA-04:12.jailroute 2004-02-03 2004-06-07
buffer cache invalidation implementation issues FreeBSD 5.05.2_8 4.94.9_9 4.04.8_22

Programming errors in the implementation of the msync(2) system call involving the MS_INVALIDATE operation lead to cache consistency problems between the virtual memory system and on-disk contents.

In some situations, a user with read access to a file may be able to prevent changes to that file from being committed to disk.

CVE-2004-0435 SA-04:11.msync 2004-04-24 2004-05-26
leafnode denial-of-service triggered by article request leafnode 1.9.201.9.30

The leafnode NNTP server may go into an unterminated loop with 100% CPU use when an article is requested by Message-ID that has been crossposted to several news groups when one of the group names is the prefix of another group name that the article was cross-posted to. Found by Jan Knutar.

http://leafnode.sourceforge.net/leafnode-SA-2002-01.txt CVE-2002-1661 http://sourceforge.net/mailarchive/message.php?msg_id=2796226 http://article.gmane.org/gmane.network.leafnode.announce/8 6490 ports/46613 2002-11-06 2004-05-21 2005-05-13
leafnode fetchnews denial-of-service triggered by missing header leafnode 1.9.31.9.41

Fetchnews could hang when a news article to be downloaded lacked one of the mandatory headers. Found by Joshua Crawford.

CVE-2003-0744 http://leafnode.sourceforge.net/leafnode-SA-2003-01.txt http://sourceforge.net/mailarchive/message.php?msg_id=5975563 http://article.gmane.org/gmane.network.leafnode.announce/21 8541 ports/53838 2003-06-20 2004-05-21 2005-05-13
leafnode fetchnews denial-of-service triggered by truncated transmission leafnode 1.9.47

When a downloaded news article ends prematurely, i. e. when the server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may wait indefinitely for data that never arrives. Workaround: configure "minlines=1" (or use a bigger value) in the configuration file. Found by Toni Viemerö.

CVE-2004-2068 http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt http://sourceforge.net/tracker/index.php?func=detail&aid=873149&group_id=57767&atid=485349 http://article.gmane.org/gmane.network.leafnode.announce/32 http://sourceforge.net/mailarchive/message.php?msg_id=6922570 ports/61105 2004-01-08 2004-05-21 2005-05-13
MySQL insecure temporary file creation (mysqlbug) mysql-client 4.04.0.20 4.14.1.1_2 5.05.0.0_2

Shaun Colley reports that the script `mysqlbug' included with MySQL sometimes creates temporary files in an unsafe manner. As a result, an attacker may create a symlink in /tmp so that if another user invokes `mysqlbug' and quits without making any changes, an arbitrary file may be overwritten with the bug report template.

http://marc.theaimsgroup.com/?l=bugtraq&m=108023246916294&w=2 http://bugs.mysql.com/bug.php?id=3284 9976 CVE-2004-0381 2004-03-25 2004-04-16 2004-05-21
subversion date parsing vulnerability subversion 1.0.2_1

Stefan Esser reports:

Subversion versions up to 1.0.2 are vulnerable to a date parsing vulnerability which can be abused to allow remote code execution on Subversion servers and therefore could lead to a repository compromise.

NOTE: This vulnerability is similar to the date parsing issue that affected neon. However, it is a different and distinct bug.

CVE-2004-0397 http://security.e-matters.de/advisories/082004.html 2004-05-19 2004-05-19
cvs pserver remote heap buffer overflow FreeBSD 5.25.2_7 5.15.1_17 5.05.0_21 4.94.9_8 4.84.8_21 4.04.7_27

Due to a programming error in code used to parse data received from the client, malformed data can cause a heap buffer to overflow, allowing the client to overwrite arbitrary portions of the server's memory.

A malicious CVS client can exploit this to run arbitrary code on the server at the privilege level of the CVS server software.

CVE-2004-0396 SA-04:10.cvs 2004-05-02 2004-05-19
Apache 2 mod_ssl denial-of-service apache 2.02.0.48_3

Joe Orton reports a memory leak in Apache 2's mod_ssl. A remote attacker may issue HTTP requests on an HTTPS port, causing an error. Due to a bug in processing this condition, memory associated with the connection is not freed. Repeated requests can result in consuming all available memory resources, probably resulting in termination of the Apache process.

CVE-2004-0113 http://www.apacheweek.com/features/security-20 http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.100.2.11&r2=1.100.2.12 http://marc.theaimsgroup.com/?l=apache-cvs&m=107869699329638 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27106 9826 2004-02-20 2004-03-08 2004-05-19
URI handler vulnerabilities in several browsers linux-opera opera 7.50 kdelibs 3.2.2_3

Karol Wiesek and Greg MacManus reported via iDEFENSE that the Opera web browser contains a flaw in the handling of certain URIs. When presented with these URIs, Opera would invoke external commands to process them after some validation. However, if the hostname component of a URI begins with a `-', it may be treated as an option by an external command. This could have undesirable side-effects, from denial-of-service to code execution. The impact is very dependent on local configuration.

After the iDEFENSE advisory was published, the KDE team discovered similar problems in KDE's URI handlers.

CVE-2004-0411 http://www.idefense.com/application/poi/display?id=104&type=vulnerabilities http://www.kde.org/info/security/advisory-20040517-1.txt http://freebsd.kde.org/index.php#n20040517 2004-05-12 2004-05-18
fsp buffer overflow and directory traversal vulnerabilities fspd 2.8.1.19

The Debian security team reported a pair of vulnerabilities in fsp:

A vulnerability was discovered in fsp, client utilities for File Service Protocol (FSP), whereby a remote user could both escape from the FSP root directory (CAN-2003-1022), and also overflow a fixed-length buffer to execute arbitrary code (CAN-2004-0011).

CVE-2003-1022 CVE-2004-0011 http://www.debian.org/security/2004/dsa-416 2004-01-06 2004-01-19 2004-05-17
proftpd IP address access control list breakage proftpd 1.2.91.2.10.r1

Jindrich Makovicka reports a regression in proftpd's handling of IP address access control lists (IP ACLs). Due to this regression, some IP ACLs are treated as ``allow all''.

CVE-2004-0432 http://bugs.proftpd.org/show_bug.cgi?id=2267 2003-11-04 2004-05-02 2004-05-15
insecure temporary file creation in xine-check, xine-bugreport xine 0.9.23_3

Some scripts installed with xine create temporary files insecurely. It is recommended that these scripts (xine-check, xine-bugreport) not be used. They are not needed for normal operation.

http://marc.theaimsgroup.com/?l=bugtraq&m=107997911025558 9939 2004-03-20 2004-03-26 2004-05-09
exim buffer overflow when verify = header_syntax is used exim exim-ldap2 exim-mysql exim-postgresql 4.33+20_1

A remote exploitable buffer overflow has been discovered in exim when verify = header_syntax is used in the configuration file. This does not affect the default configuration.

http://www.guninski.com/exim1.html CVE-2004-0400 2004-05-06 2004-05-06
phpBB session table exhaustion phpbb 2.0.8_2

The includes/sessions.php unnecessarily adds session item into session table and therefore vulnerable to a denial-of-service attack.

http://marc.theaimsgroup.com/?l=bugtraq&m=108256462710010 2004-03-05 2004-05-06
heimdal kadmind remote heap buffer overflow heimdal 0.6.1_1 FreeBSD 4.94.9_7 4.04.8_20

An input validation error was discovered in the kadmind code that handles the framing of Kerberos 4 compatibility administration requests. The code assumed that the length given in the framing was always two or more bytes. Smaller lengths will cause kadmind to read an arbitrary amount of data into a minimally-sized buffer on the heap.

A remote attacker may send a specially formatted message to kadmind, causing it to crash or possibly resulting in arbitrary code execution.

The kadmind daemon is part of Kerberos 5 support. However, this bug will only be present if kadmind was built with additional Kerberos 4 support. Thus, only systems that have *both* Heimdal Kerberos 5 and Kerberos 4 installed might be affected.

NOTE: On FreeBSD 4 systems, `kadmind' may be installed as `k5admind'.

CVE-2004-0434 SA-04:09.kadmind 2004-05-05 2004-05-05
CVS path validation errors cvs+ipv6 1.11.5_1 FreeBSD 5.25.2.1_5 4.94.9_5 4.84.8_18

Two programming errors were discovered in which path names handled by CVS were not properly validated. In one case, the CVS client accepts absolute path names from the server when determining which files to update. In another case, the CVS server accepts relative path names from the client when determining which files to transmit, including those containing references to parent directories (`../').

These programming errors generally only have a security impact when dealing with remote CVS repositories.

A malicious CVS server may cause a CVS client to overwrite arbitrary files on the client's system.

A CVS client may request RCS files from a remote system other than those in the repository specified by $CVSROOT. These RCS files need not be part of any CVS repository themselves.

CVE-2004-0180 CVE-2004-0405 http://ccvs.cvshome.org/servlets/NewsItemView?newsID=102 SA-04:07.cvs 2004-04-14 2004-04-14 2004-05-05
mksnap_ffs clears file system options FreeBSD 5.25.2_1 5.15.1_12

The kernel interface for creating a snapshot of a filesystem is the same as that for changing the flags on that filesystem. Due to an oversight, the mksnap_ffs(8) command called that interface with only the snapshot flag set, causing all other flags to be reset to the default value.

A regularly scheduled backup of a live filesystem, or any other process that uses the mksnap_ffs command (for instance, to provide a rough undelete functionality on a file server), will clear any flags in effect on the filesystem being snapshot. Possible consequences depend on local usage, but can include disabling extended access control lists or enabling the use of setuid executables stored on an untrusted filesystem.

The mksnap_ffs command is normally only available to the superuser and members of the `operator' group. There is therefore no risk of a user gaining elevated privileges directly through use of the mksnap_ffs command unless it has been intentionally made available to unprivileged users.

CVE-2004-0099 SA-04:01.mksnap_ffs 2004-01-30 2004-04-07 2004-05-05
shmat reference counting bug FreeBSD 5.25.2_2 5.15.1_14 5.05.0_20 4.94.9_2 4.84.8_15 4.7_25

A programming error in the shmat(2) system call can result in a shared memory segment's reference count being erroneously incremented.

It may be possible to cause a shared memory segment to reference unallocated kernel memory, but remain valid. This could allow a local attacker to gain read or write access to a portion of kernel memory, resulting in sensitive information disclosure, bypass of access control mechanisms, or privilege escalation.

CVE-2004-0114 SA-04:02.shmat http://www.pine.nl/press/pine-cert-20040201.txt 2004-02-01 2004-04-07 2004-05-05
jailed processes can attach to other jails FreeBSD 5.15.1_14 5.25.2.1

A programming error has been found in the jail_attach(2) system call which affects the way that system call verifies the privilege level of the calling process. Instead of failing immediately if the calling process was already jailed, the jail_attach system call would fail only after changing the calling process's root directory.

A process with superuser privileges inside a jail could change its root directory to that of a different jail, and thus gain full read and write access to files and directories within the target jail.

CVE-2004-0126 SA-04:03.jail 2004-02-19 2004-04-07 2004-05-05
many out-of-sequence TCP packets denial-of-service FreeBSD 5.25.2.1_2 5.05.1_15 4.94.9_3 4.84.8_16 4.7_26

FreeBSD does not limit the number of TCP segments that may be held in a reassembly queue. A remote attacker may conduct a low-bandwidth denial-of-service attack against a machine providing services based on TCP (there are many such services, including HTTP, SMTP, and FTP). By sending many out-of-sequence TCP segments, the attacker can cause the target machine to consume all available memory buffers (``mbufs''), likely leading to a system crash.

CVE-2004-0171 SA-04:04.tcp http://www.idefense.com/application/poi/display?id=78&type=vulnerabilities 2004-02-18 2004-04-07 2004-05-05
setsockopt(2) IPv6 sockets input validation error FreeBSD 5.25.2.1_4

From the FreeBSD Security Advisory:

A programming error in the handling of some IPv6 socket options within the setsockopt(2) system call may result in memory locations being accessed without proper validation.

It may be possible for a local attacker to read portions of kernel memory, resulting in disclosure of sensitive information. A local attacker can cause a system panic.

CVE-2004-0370 SA-04:06.ipv6 2004-03-29 2004-03-29 2004-05-05
OpenSSL ChangeCipherSpec denial-of-service vulnerability openssl openssl-beta 0.9.7d FreeBSD 4.04.8_17 4.94.9_4 5.05.1_16 5.25.2.1_3

A remote attacker could cause an application using OpenSSL to crash by performing a specially crafted SSL/TLS handshake.

CVE-2004-0079 http://www.openssl.org/news/secadv_20040317.txt SA-04:05.openssl 288574 9899 2004-03-17 2004-03-17 2004-05-05
bind8 negative cache poison attack bind 8.38.3.7 8.48.4.3 FreeBSD 5.15.1_11 5.05.0_19 4.94.9_1 4.84.8_14 4.74.7_24 4.64.6.2_27 4.54.5_37 4.4_47

A programming error in BIND 8 named can result in a DNS message being incorrectly cached as a negative response. As a result, an attacker may arrange for malicious DNS messages to be delivered to a target name server, and cause that name server to cache a negative response for some target domain name. The name server would thereafter respond negatively to legitimate queries for that domain name, resulting in a denial-of-service for applications that require DNS.

CVE-2003-0914 SA-03:19.bind 734644 2003-11-28 2003-12-12 2004-05-05
Incorrect cross-realm trust handling in Heimdal heimdal 0.6.1 FreeBSD 5.05.2_6 4.94.9_6 4.04.8_19

Heimdal does not correctly validate the `transited' field of Kerberos tickets when computing the authentication path. This could allow a rogue KDC with which cross-realm relationships have been established to impersonate any KDC in the authentication path.

CVE-2004-0371 SA-04:08.heimdal http://www.pdc.kth.se/heimdal/advisory/2004-04-01/ 2004-04-01 2004-04-02 2004-05-05
lha buffer overflows and path traversal issues lha 1.14i_4

Ulf Härnhammar discovered several vulnerabilities in LHa for UNIX's path name handling code. Specially constructed archive files may cause LHa to overwrite files or execute arbitrary code with the privileges of the user invoking LHa. This could be particularly harmful for automated systems that might handle archives such as virus scanning processes.

CVE-2004-0234 CVE-2004-0235 2004-04-29 2004-05-02 2004-05-03
xchat remotely exploitable buffer overflow (Socks5) xchat2 1.82.0.8_2

A straightforward stack buffer overflow exists in XChat's Socks5 proxy support.

The XChat developers report that `tsifra' discovered this issue.

NOTE: XChat Socks5 support is disabled by support in the FreeBSD Ports Collection.

CVE-2004-0409 http://xchat.org/files/source/2.0/patches/xc208-fixsocks5.diff http://marc.theaimsgroup.com/?l=xchat-announce&m=108114935507357 2004-04-05 2004-04-23 2004-05-03
rsync path traversal issue rsync 2.6.1

When running rsync in daemon mode, no checks were made to prevent clients from writing outside of a module's `path' setting.

CVE-2004-0426 http://rsync.samba.org/#security_apr04 2004-04-26 2004-05-02
xine-lib arbitrary file overwrite libxine 0.91.0.r3_5

From the xinehq advisory:

By opening a malicious MRL in any xine-lib based media player, an attacker can write arbitrary content to an arbitrary file, only restricted by the permissions of the user running the application.

The flaw is a result of a feature that allows MRLs (media resource locator URIs) to specify arbitrary configuration options.

10193 http://www.xinehq.de/index.php/security/XSA-2004-1 2004-04-20 2004-05-02
pound remotely exploitable vulnerability pound 1.6

An unknown remotely exploitable vulnerability was disclosed. Robert Segall writes:

a security vulnerability was brought to my attention (many thanks to Akira Higuchi). Everyone running any previous version should upgrade to 1.6 immediately - the vulnerability may allow a remote exploit. No exploits are currently known and none have been observed in the wild till now. The danger is minimised if you run Pound in a root jail and/or you run Pound as non-root user.

http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000 2003-12-01 2004-05-02
phpBB IP address spoofing phpbb 2.0.8_2

The common.php script always trusts the `X-Forwarded-For' header in the client's HTTP request. A remote user could forge this header in order to bypass any IP address access control lists (ACLs).

http://marc.theaimsgroup.com/?l=bugtraq&m=108239864203144 2004-04-18 2004-04-23
TCP denial-of-service attacks against long lived connections FreeBSD 0

NISCC / UNIRAS has published an advisory that re-visits the long discussed spoofed TCP RST denial-of-service vulnerability. This new look emphasizes the fact that for some applications such attacks are practically feasible.

CVE-2004-0230 http://www.uniras.gov.uk/vuls/2004/236929/index.htm 1995-06-01 2004-04-23
ident2 double byte buffer overflow ident2 1.04

Jack of RaptureSecurity reported a double byte buffer overflow in ident2. The bug may allow a remote attacker to execute arbitrary code within the context of the ident2 daemon. The daemon typically runs as user-ID `nobody', but with group-ID `wheel'.

CVE-2004-0408 http://cvsweb.freebsd.org/ports/security/ident2/files/patch-common.c 2004-04-15 2004-04-23
kdepim exploitable buffer overflow in VCF reader kdepim 3.1.03.1.4_1

A buffer overflow is present in some versions of the KDE personal information manager (kdepim) which may be triggered when processing a specially crafted VCF file.

CVE-2003-0988 http://www.kde.org/info/security/advisory-20040114-1.txt 2004-01-14 2004-04-15
racoon remote denial of service vulnerability (ISAKMP header length field) racoon 20040408a

When racoon receives an ISAKMP header, it will attempt to allocate sufficient memory for the entire ISAKMP message according to the header's length field. If an attacker crafts an ISAKMP header with a ridiculously large value in the length field, racoon may exceed operating system resource limits and be terminated, resulting in a denial of service.

CVE-2004-0403 http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/isakmp.c.diff?r1=1.180&r2=1.181 2004-03-31 2004-04-14
racoon remote denial of service vulnerability (IKE Generic Payload Header) racoon 20040407b

When racoon receives an IKE message with an incorrectly constructed Generic Payload Header, it may behave erratically, going into a tight loop and dropping connections.

CVE-2004-0392 http://orange.kame.net/dev/query-pr.cgi?pr=555 2003-12-03 2004-04-07 2004-04-14
tcpdump ISAKMP payload handling remote denial-of-service tcpdump 3.8.3 racoon 20040408a FreeBSD 0

Chad Loder has discovered vulnerabilities in tcpdump's ISAKMP protocol handler. During an audit to repair these issues, Bill Fenner discovered some related problems.

These vulnerabilities may be used by an attacker to crash a running `tcpdump' process. They can only be triggered if the `-v' command line option is being used.

NOTE: the racoon ISAKMP/IKE daemon incorporates the ISAKMP protocol handler from tcpdump, and so is also affected by this issue.

http://marc.theaimsgroup.com/?l=bugtraq&m=108067265931525 http://www.rapid7.com/advisories/R7-0017.html CVE-2004-0183 CVE-2004-0184 2004-03-12 2004-03-31 2004-04-14
Midnight Commander buffer overflow during symlink resolution mc 4.6.0_9

Midnight Commander uses a fixed sized stack buffer while resolving symbolic links within file archives (tar or cpio). If an attacker can cause a user to process a specially crafted file archive with Midnight Commander, the attacker may be able to obtain the privileges of the target user.

CVE-2003-1023 http://marc.theaimsgroup.com/?l=bugtraq&m=106399528518704 8658 2003-09-19 2004-04-03 2004-04-13
racoon fails to verify signature during Phase 1 racoon 20040407b

Ralf Spenneberg discovered a serious flaw in racoon. When using Phase 1 main or aggressive mode, racoon does not verify the client's RSA signature. Any installations using X.509 authentication are strongly urged to upgrade.

Installations using pre-shared keys are believed to be unaffected.

CVE-2004-0155 http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&content-type=text/x-cvsweb-markup 2004-04-05 2004-04-07
Several remotely exploitable buffer overflows in gaim gaim ja-gaim ko-gaim ru-gaim 0.75_3 0.75_5 0.76 gaim 20030000

Stefan Esser of e-matters found almost a dozen remotely exploitable vulnerabilities in Gaim. From the e-matters advisory:

While developing a custom add-on, an integer overflow in the handling of AIM DirectIM packets was revealed that could lead to a remote compromise of the IM client. After disclosing this bug to the vendor, they had to make a hurried release because of a change in the Yahoo connection procedure that rendered GAIM useless. Unfourtunately at the same time a closer look onto the sourcecode revealed 11 more vulnerabilities.

The 12 identified problems range from simple standard stack overflows, over heap overflows to an integer overflow that can be abused to cause a heap overflow. Due to the nature of instant messaging many of these bugs require man-in-the-middle attacks between client and server. But the underlying protocols are easy to implement and MIM attacks on ordinary TCP sessions is a fairly simple task.

In combination with the latest kernel vulnerabilities or the habit of users to work as root/administrator these bugs can result in remote root compromises.

http://security.e-matters.de/advisories/012004.txt CVE-2004-0005 CVE-2004-0006 CVE-2004-0007 CVE-2004-0008 2004-01-26 2004-02-12 2004-10-25
oftpd denial-of-service vulnerability (PORT command) oftpd 0.3.7

Philippe Oechslin reported a denial-of-service vulnerability in oftpd. The oftpd server can be crashed by sending a PORT command containing an integer over 8 bits long (over 255).

http://www.time-travellers.org/oftpd/oftpd-dos.html 9980 CVE-2004-0376 2004-03-04 2004-03-28 2004-04-05
squid ACL bypass due to URL decoding bug squid squid-2.5.5

From the Squid advisory:

Squid versions 2.5.STABLE4 and earlier contain a bug in the "%xx" URL decoding function. It may insert a NUL character into decoded URLs, which may allow users to bypass url_regex ACLs.

http://www.squid-cache.org/Advisories/SQUID-2004_1.txt CVE-2004-0189 2004-02-29 2004-03-26 2004-03-30
zebra/quagga denial of service vulnerability zebra 0.93b_7 quagga 0.96.4

A remote attacker could cause zebra/quagga to crash by sending a malformed telnet command to their management port.

CVE-2003-0858 http://rhn.redhat.com/errata/RHSA-2003-305.html http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=107140 http://lists.quagga.net/pipermail/quagga-users/2003-November/000906.html 2003-11-20 2004-03-29
multiple vulnerabilities in phpBB phpbb 2.0.8

Users with admin rights can severly damage an phpBB installation, potentially triggered by viewing a page with a malicious link sent by an attacker.

http://www.gulftech.org/03202004.php http://www.phpbb.com/phpBB/viewtopic.php?t=183982 9942 2004-03-20 2004-03-26 2004-03-29
ezbounce remote format string vulnerability ezbounce 1.04.a_1

A security hole exists that can be used to crash the proxy and execute arbitrary code. An exploit is circulating that takes advantage of this, and in some cases succeeds in obtaining a login shell on the machine.

CVE-2003-0510 http://ezbounce.dc-team.com/ 8071 2003-07-01 2004-03-26 2004-03-29
racoon security association deletion vulnerability racoon 20040116a

A remote attacker may use specially crafted IKE/ISAKMP messages to cause racoon to delete security associations. This could result in denial-of-service or possibly cause sensitive traffic to be transmitted in plaintext, depending upon configuration.

http://www.securityfocus.com/archive/1/349756 9416 9417 CVE-2004-0164 2004-01-13 2004-03-25 2004-03-29
wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed wu-ftpd 2.6.2_3 wu-ftpd+ipv6 2.6.2_5

Glenn Stewart reports a bug in wu-ftpd's ftpaccess `restricted-uid'/`restricted-gid' directives:

Users can get around the restriction to their home directory by issuing a simple chmod command on their home directory. On the next ftp log in, the user will have '/' as their root directory.

Matt Zimmerman discovered that the cause of the bug was a missing check for a restricted user within a code path that is executed only when a certain error is encountered.

CVE-2004-0148 9832 2004-02-17 2004-03-08 2004-03-29
GNU Anubis buffer overflows and format string vulnerabilities anubis 3.6.2_1

Ulf Härnhammar discovered several vulnerabilities in GNU Anubis.

  • Unsafe uses of `sscanf'. The `%s' format specifier is used, which allows a classical buffer overflow. (auth.c)
  • Format string bugs invoking `syslog'. (log.c, errs.c, ssl.c)

Ulf notes that these vulnerabilities can be exploited by a malicious IDENT server as a denial-of-service attack.

http://lists.netsys.com/pipermail/full-disclosure/2004-March/018290.html 9772 CVE-2004-0353 CVE-2004-0354 2004-03-04 2004-03-06 2004-03-29
Buffer overflows in XFree86 servers XFree86-Server 4.3.0_13 4.3.994.3.99.15_1

A number of buffer overflows were recently discovered in XFree86, prompted by initial discoveries by iDEFENSE. These buffer overflows are present in the font alias handling. An attacker with authenticated access to a running X server may exploit these vulnerabilities to obtain root privileges on the machine running the X server.

http://www.idefense.com/application/poi/display?id=72 http://www.idefense.com/application/poi/display?id=73 CVE-2004-0083 CVE-2004-0084 CVE-2004-0106 9636 9652 9655 2004-02-10 2004-02-12 2004-03-29
multiple buffer overflows in xboing xboing 2.4_2

Steve Kemp reports (in a Debian bug submission):

Due to improper bounds checking it is possible for a malicious user to gain a shell with membership group 'games'. (The binary is installed setgid games).

Environmental variables are used without being bounds-checked in any way, from the source code:

highscore.c:
   /* Use the environment variable if it exists */
   if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
	strcpy(filename, str);
   else
	strcpy(filename, HIGH_SCORE_FILE);

misc.c:
    if ((ptr = getenv("HOME")) != NULL)
	(void) strcpy(dest, ptr);

Neither of these checks are boundschecked, and will allow arbitary shell code to be run.

CVE-2004-0149 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924 9764 2003-01-01 2004-03-05 2004-03-29
metamail format string bugs and buffer overflows metamail 2.7_2

Ulf Härnhammar reported four bugs in metamail: two are format string bugs and two are buffer overflows. The bugs are in SaveSquirrelFile(), PrintHeader(), and ShareThisHeader().

These vulnerabilities could be triggered by a maliciously formatted email message if `metamail' or `splitmail' is used to process it, possibly resulting in arbitrary code execution with the privileges of the user reading mail.

CVE-2004-0104 CVE-2004-0105 9692 2004-02-18 2004-02-18 2004-03-29
Buffer overflows and format string bugs in Emil emil 2.1b9

Ulf Härnhammar reports multiple buffer overflows in Emil, some of which are triggered during the parsing of attachment filenames. In addition, some format string bugs are present in the error reporting code.

Depending upon local configuration, these vulnerabilities may be exploited using specially crafted messages in order to execute arbitrary code running with the privileges of the user invoking Emil.

http://lists.netsys.com/pipermail/full-disclosure/2004-March/019325.html http://www.debian.org/security/2004/dsa-468 CVE-2004-0152 CVE-2004-0153 2004-03-24 2004-03-28
Critical SQL injection in phpBB phpbb 2.0.8

Anyone can get admin's username and password's md5 hash via a single web request. A working example is provided in the advisory.

http://marc.theaimsgroup.com/?l=bugtraq&m=108032454818873 9984 2004-03-26 2004-03-28
uudeview buffer overflows uulib uudeview xdeview 0.5.20

The authors of UUDeview report repairing two buffer overflows in their software.

http://www.fpx.de/fp/Software/UUDeview/HISTORY.txt 2004-03-01 2004-03-18 2004-03-25
Apache 1.3 IP address access control failure on some 64-bit platforms apache 1.3.29_2 apache+mod_ssl 1.3.29+2.8.16_1 apache+ssl 1.3.29.1.53_1 ru-apache 1.3.29+30.19_1 ru-apache+mod_ssl 1.3.29+30.19+2.8.16_1

Henning Brauer discovered a programming error in Apache 1.3's mod_access that results in the netmasks in IP address access control rules being interpreted incorrectly on 64-bit, big-endian platforms. In some cases, this could cause a `deny from' IP address access control rule including a netmask to fail.

CVE-2003-0993 http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_access.c?r1=1.46&r2=1.47 http://www.apacheweek.com/features/security-13 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23850 http://marc.theaimsgroup.com/?l=apache-cvs&m=107869603013722 9829 2004-03-07 2004-03-08 2004-03-12
mod_python denial-of-service vulnerability in parse_qs mod_python 2.72.7.10 3.03.0.4

An attacker may cause Apache with mod_python to crash by using a specially constructed query string.

CVE-2003-0973 9129 http://www.modpython.org/pipermail/mod_python/2003-November/014532.html http://www.modpython.org/pipermail/mod_python/2004-January/014879.html 2003-11-28 2004-03-03 2004-03-11
mpg123 vulnerabilities mpg123 mpg123-nas mpg123-esound 0.59r_12

In 2003, two vulnerabilities were discovered in mpg123 that could result in remote code execution when using untrusted input or streaming from an untrusted server.

CVE-2003-0577 CVE-2003-0865 6629 8680 2003-01-16 2004-03-07
fetchmail denial-of-service vulnerability fetchmail 6.2.5

Dave Jones discovered a denial-of-service vulnerability in fetchmail. An email message containing a very long line could cause fetchmail to segfault due to missing NUL termination in transact.c.

Eric Raymond decided not to mention this issue in the release notes for fetchmail 6.2.5, but it was fixed there.

CVE-2003-0792 8843 http://xforce.iss.net/xforce/xfdb/13450 http://www.openbsd.org/cgi-bin/cvsweb/ports/mail/fetchmail/patches/Attic/patch-rfc822_c?rev=1.1 2003-10-16 2004-02-25 2004-03-05
mailman denial-of-service vulnerability in MailCommandHandler mailman 2.1

A malformed message could cause mailman to crash.

CVE-2003-0991 http://umn.dl.sourceforge.net/sourceforge/mailman/mailman-2.0.13-2.0.14-diff.txt 2003-11-18 2004-02-25
mailman XSS in admin script mailman 2.1.4

Dirk Mueller reports:

I've found a cross-site scripting vulnerability in the admin interface of mailman 2.1.3 that allows, under certain circumstances, for anyone to retrieve the (valid) session cookie.

CVE-2003-0965 http://mail.python.org/pipermail/mailman-announce/2003-December/000066.html http://xforce.iss.net/xforce/xfdb/14121 2003-12-31 2004-02-25
mailman XSS in create script mailman 2.1.3

From the 2.1.3 release notes:

Closed a cross-site scripting exploit in the create cgi script.

CVE-2003-0992 http://mail.python.org/pipermail/mailman-announce/2003-September/000061.html 2003-09-28 2004-02-25
mailman XSS in user options page mailman 2.1.1

From the 2.1.1 release notes:

Closed a cross-site scripting vulnerability in the user options page.

CVE-2003-0038 http://mail.python.org/pipermail/mailman-announce/2003-February/000056.html 2003-02-08 2004-02-25
SQL injection vulnerability in phpnuke phpnuke 6.9

Multiple researchers have discovered multiple SQL injection vulnerabilities in some versions of Php-Nuke. These vulnerabilities may lead to information disclosure, compromise of the Php-Nuke site, or compromise of the back-end database.

http://security.nnov.ru/search/document.asp?docid=5748 http://www.securityfocus.com/archive/1/348375 http://www.security-corporation.com/advisories-027.html http://www.securityfocus.com/archive/1/353201 2003-12-12 2004-02-25
lbreakout2 vulnerability in environment variable handling lbreakout2 2.2.2_1

Ulf Härnhammar discovered an exploitable vulnerability in lbreakout2's environmental variable handling. In several instances, the contents of the HOME environmental variable are copied to a stack or global buffer without range checking. A local attacker may use this vulnerability to acquire group-ID `games' privileges.

An exploit for this vulnerability has been published by ``Li0n7 voila fr''.

CVE-2004-0158 http://www.debian.org/security/2004/dsa-445 http://www.securityfocus.com/archive/1/354760 2004-02-21 2004-02-25
hsftp format string vulnerabilities hsftp 1.14

Ulf Härnhammar discovered a format string bug in hsftp's file listing code may allow a malicious server to cause arbitrary code execution by the client.

http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00044.html 2004-02-22 2004-02-25
Darwin Streaming Server denial-of-service vulnerability DarwinStreamingServer 4.1.3g

An attacker can cause an assertion to trigger by sending a long User-Agent field in a request.

CVE-2004-0169 http://www.idefense.com/application/poi/display?id=75 2004-02-23 2004-02-25
libxml2 stack buffer overflow in URI parsing libxml2 2.6.6

Yuuichi Teranishi reported a crash in libxml2's URI handling when a long URL is supplied. The implementation in nanohttp.c and nanoftp.c uses a 4K stack buffer, and longer URLs will overwrite the stack. This could result in denial-of-service or arbitrary code execution in applications using libxml2 to parse documents.

CVE-2004-0110 http://www.xmlsoft.org/news.html http://mail.gnome.org/archives/xml/2004-February/msg00070.html 2004-02-08 2004-02-25
file disclosure in phpMyAdmin phpMyAdmin 2.5.4

Lack of proper input validation in phpMyAdmin may allow an attacker to obtain the contents of any file on the target system that is readable by the web server.

CVE-2004-0129 http://marc.theaimsgroup.com/?l=bugtraq&m=107582619125932&w=2 http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/export.php#rev2.3.2.1 2004-02-17 2004-02-22
mnGoSearch buffer overflow in UdmDocToTextBuf() mnogosearch 3.2.*3.2.15

Jedi/Sector One <j@pureftpd.org> reported the following on the full-disclosure list:

Every document is stored in multiple parts according to its sections (description, body, etc) in databases. And when the content has to be sent to the client, UdmDocToTextBuf() concatenates those parts together and skips metadata.

Unfortunately, that function lacks bounds checking and a buffer overflow can be triggered by indexing a large enough document.

'len' is fixed to 10K [in UdmDocToTextBuf] in searchd.c . S->val length depends on the length of the original document and on the indexer settings (the sample configuration file has low limits that work around the bug, though).

Exploitation should be easy, moreover textbuf points to the stack.

http://lists.netsys.com/pipermail/full-disclosure/2004-February/017366.html 2004-02-15 2004-02-15
GNU libtool insecure temporary file handling libtool 1.31.3.5_2 1.41.4.3_3 1.51.5.2

libtool attempts to create a temporary directory in which to write scratch files needed during processing. A malicious user may create a symlink and then manipulate the directory so as to write to files to which she normally has no permissions.

This has been reported as a ``symlink vulnerability'', although I do not think that is an accurate description.

This vulnerability could possibly be used on a multi-user system to gain elevated privileges, e.g. root builds some packages, and another user successfully exploits this vulnerability to write to a system file.

http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&list=405 http://www.securityfocus.com/archive/1/352333 2004-01-30 2004-02-13
seti@home remotely exploitable buffer overflow setiathome 3.0.8

The seti@home client contains a buffer overflow in the HTTP response handler. A malicious, spoofed seti@home server can exploit this buffer overflow to cause remote code execution on the client. Exploit programs are widely available.

http://setiathome.berkeley.edu/version308.html http://web.archive.org/web/20030609204812/http://spoor12.edup.tudelft.nl/ 2003-04-08 2004-02-12
icecast 1.x multiple vulnerabilities icecast 1.3.12

icecast 1.3.11 and earlier contained numerous security vulnerabilities, the most severe allowing a remote attacker to execute arbitrary code as root.

CVE-2002-0177 CVE-2001-1230 CVE-2001-1229 CVE-2001-1083 CVE-2001-0784 4415 2933 2002-04-28 2004-02-12
nap allows arbitrary file access nap 1.4.5

According to the author:

Fixed security loophole which allowed remote clients to access arbitrary files on our system.

http://quasar.mathstat.uottawa.ca/~selinger/nap/NEWS 2001-04-12 2004-02-12
CCE contains exploitable buffer overflows zh-cce 0.40

The Chinese Console Environment contains exploitable buffer overflows.

http://programmer.lib.sjtu.edu.cn/cce/cce.html 2000-06-22 2004-02-12
ChiTeX/ChiLaTeX unsafe set-user-id root zh-chitex 0

Niels Heinen reports that ChiTeX installs set-user-id root executables that invoked system(3) without setting up the environment, trivially allowing local root compromise.

http://cvsweb.freebsd.org/ports/chinese/chitex/Attic/Makefile?rev=1.5&content-type=text/x-cvsweb-markup 2003-04-25 2004-02-12
pine remotely exploitable buffer overflow in newmail.c zh-pine iw-pine pine pine4-ssl 4.21

Kris Kennaway reports a remotely exploitable buffer overflow in newmail.c. Mike Silbersack submitted the fix.

http://www.freebsd.org/cgi/cvsweb.cgi/ports/mail/pine4/Makefile?rev=1.43&content-type=text/x-cvsweb-markup 2000-09-29 2004-02-12
pine insecure URL handling pine zh-pine iw-pine 4.44

An attacker may send an email message containing a specially constructed URL that will execute arbitrary commands when viewed.

SA-02:05.pine 2002-01-04 2004-02-12
pine remote denial-of-service attack pine zh-pine iw-pine 4.50

An attacker may send a specially-formatted email message that will cause pine to crash.

http://marc.theaimsgroup.com/?l=bugtraq&m=103668430620531&w=2 CVE-2002-1320 2002-10-23 2004-02-12
pine remotely exploitable vulnerabilities pine zh-pine iw-pine 4.58

Pine versions prior to 4.58 are affected by two vulnerabilities discovered by iDEFENSE, a buffer overflow in mailview.c and an integer overflow in strings.c. Both vulnerabilities can result in arbitrary code execution when processing a malicious message.

CVE-2003-0720 CVE-2003-0721 http://www.idefense.com/application/poi/display?id=5 2003-09-10 2004-02-12
rsync buffer overflow in server mode rsync 2.5.7

When rsync is run in server mode, a buffer overflow could allow a remote attacker to execute arbitrary code with the privileges of the rsync server. Anonymous rsync servers are at the highest risk.

CVE-2003-0962 http://lists.samba.org/archive/rsync-announce/2003/000011.html http://rsync.samba.org/#security 2003-12-04 2004-02-12
Samba 3.0.x password initialization bug samba 3.0,13.0.1_2,1

From the Samba 3.0.2 release notes:

Security Announcement: It has been confirmed that previous versions of Samba 3.0 are susceptible to a password initialization bug that could grant an attacker unauthorized access to a user account created by the mksmbpasswd.sh shell script.

http://www.samba.org/samba/whatsnew/samba-3.0.2.html CVE-2004-0082 2004-02-09 2004-02-12
Buffer overflow in Mutt 1.4 mutt ja-mutt 1.41.4.2

Mutt 1.4 contains a buffer overflow that could be exploited with a specially formed message, causing Mutt to crash or possibly execute arbitrary code.

CVE-2004-0078 http://www.mutt.org/news.html 2004-02-11 2004-02-12
Apache-SSL optional client certificate vulnerability apache+ssl 1.3.29.1.53

From the Apache-SSL security advisory:

If configured with SSLVerifyClient set to 1 or 3 (client certificates optional) and SSLFakeBasicAuth, Apache-SSL 1.3.28+1.52 and all earlier versions would permit a client to use real basic authentication to forge a client certificate.

All the attacker needed is the "one-line DN" of a valid user, as used by faked basic auth in Apache-SSL, and the fixed password ("password" by default).

http://www.apache-ssl.org/advisory-20040206.txt 2004-02-06 2004-02-10
L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump tcpdump 3.8.1_351 FreeBSD 5.2.1

Jonathan Heusser discovered vulnerabilities in tcpdump's L2TP, ISAKMP, and RADIUS protocol handlers. These vulnerabilities may be used by an attacker to crash a running `tcpdump' process.

CVE-2003-0989 CVE-2003-1029 CVE-2004-0057 http://www.tcpdump.org/lists/workers/2003/12/msg00083.html http://marc.theaimsgroup.com/?l=tcpdump-workers&m=107325073018070&w=2 2003-12-24 2004-01-19
Buffer overflow in INN control message handling inn 2.4.*2.4.1 inn-stable 20031022_1

A small, fixed-size stack buffer is used to construct a filename based on a received control message. This could result in a stack buffer overflow.

http://marc.theaimsgroup.com/?l=inn-workers&m=107351974008605 2004-01-07 2004-01-08 2004-10-21
ProFTPD ASCII translation bug resulting in remote root compromise proftpd 1.2.8_1

A buffer overflow exists in the ProFTPD code that handles translation of newline characters during ASCII-mode file uploads. An attacker may exploit this buffer overflow by uploading a specially crafted file, resulting in code execution and ultimately a remote root compromise.

http://xforce.iss.net/xforce/alerts/id/154 CVE-2003-0831 2003-09-23 2004-01-05
ElGamal sign+encrypt keys created by GnuPG can be compromised gnupg 1.0.21.2.3_4

Any ElGamal sign+encrypt keys created by GnuPG contain a cryptographic weakness that may allow someone to obtain the private key. These keys should be considered unusable and should be revoked.

The following summary was written by Werner Koch, GnuPG author:

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds.

...

Please take immediate action and revoke your ElGamal signing keys. Furthermore you should take whatever measures necessary to limit the damage done for signed or encrypted documents using that key.

Note that the standard keys as generated by GnuPG (DSA and ElGamal encryption) as well as RSA keys are NOT vulnerable. Note also that ElGamal signing keys cannot be generated without the use of a special flag to enable hidden options and even then overriding a warning message about this key type. See below for details on how to identify vulnerable keys.

CVE-2003-0971 http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html 2003-11-27 2003-12-12
Mathopd buffer overflow mathopd 1.4p2

Mathopd contains a buffer overflow in the prepare_reply() function that may be remotely exploitable.

http://www.mail-archive.com/mathopd%40mathopd.org/msg00136.html 2003-12-04 2003-12-12
lftp HTML parsing vulnerability lftp 2.6.10

A buffer overflow exists in lftp which may be triggered when requesting a directory listing from a malicious server over HTTP.

CVE-2003-0963 http://lftp.yar.ru/news.html#2.6.10 2003-12-11 2003-12-12
qpopper format string vulnerability qpopper 2.53_1

An authenticated user may trigger a format string vulnerability present in qpopper's UIDL code, resulting in arbitrary code execution with group ID `mail' privileges.

1241 CVE-2000-0442 http://www.netsys.com/suse-linux-security/2000-May/att-0137/01-b0f5-Qpopper.txt 2000-05-23 2003-12-12
Fetchmail address parsing vulnerability fetchmail 6.2.0

Fetchmail can be crashed by a malicious email message.

http://security.e-matters.de/advisories/052002.html 2003-10-25 2003-10-25
Buffer overflow in pam_smb password handling pam_smb 1.9.9_3

Applications utilizing pam_smb can be compromised by any user who can enter a password. In many cases, this is a remote root compromise.

http://www.skynet.ie/~airlied/pam_smb/ CVE-2003-0686 2003-10-25 2003-10-25 2003-10-25
Buffer overflows in libmcrypt libmcrypt 2.5.6

libmcrypt does incomplete input validation, leading to several buffer overflows. Additionally, a memory leak is present. Both of these problems may be exploited in a denial-of-service attack.

http://marc.theaimsgroup.com/?l=bugtraq&m=104162752401212&w=2 CVE-2003-0031 CVE-2003-0032 2003-10-25 2003-10-25 2003-10-25
phpbb -- arbitrary command execution and other vulnerabilities phpbb 2.0.11

The ChangeLog for phpBB 2.0.11 states:

Changes since 2.0.10

  • Fixed vulnerability in highlighting code (very high severity, please update your installation as soon as possible)
  • Fixed unsetting global vars - Matt Kavanagh
  • Fixed XSS vulnerability in username handling - AnthraX101
  • Fixed not confirmed sql injection in username handling - warmth
  • Added check for empty topic id in topic_review function
  • Added visual confirmation mod to code base

Additionally, a US-CERT Technical Cyber Security Alert reports:

phpBB contains an user input validation problem with regard to the parsing of the URL. An intruder can deface a phpBB website, execute arbitrary commands, or gain administrative privileges on a compromised bulletin board.

CVE-2004-1315 ports/74106 TA04-356A 497400 http://www.phpbb.com/support/documents.php?mode=changelog http://marc.theaimsgroup.com/?l=bugtraq&m=110029415208724 http://marc.theaimsgroup.com/?l=bugtraq&m=110079436714518 http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240636 2004-11-18 2004-12-22 2005-01-24
squid -- possible abuse of cachemgr.cgi squid 2.5.10

The squid patches page notes:

This patch adds access controls to the cachemgr.cgi script, preventing it from being abused to reach other servers than allowed in a local configuration file.

CVE-1999-0710 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf http://www.squid-cache.org/bugs/show_bug.cgi?id=1094 1999-07-29 2005-05-19
squid -- DNS lookup spoofing vulnerability squid 2.5.10

The squid patches page notes:

Malicious users may spoof DNS lookups if the DNS client UDP port (random, assigned by OS as startup) is unfiltered and your network is not protected from IP spoofing.

CVE-2005-1519 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_reply http://secunia.com/advisories/15294 2005-05-11 2005-05-19
jabberd -- 3 buffer overflows jabberd 2.0.9

There are 3 buffer overflows in jid.c that are triggered during parsing of JID strings when components (user, host or resource) are too long.

  1. jid.c, line 103: overflow in `str' buffer through strcpy() when "user" part is too long.
  2. jid.c, line 115: overflow in `str' buffer through strcpy() when "host" part is too long.
  3. jid.c, line 127: overflow in `str' buffer through strcpy() when "resource" part is too long.

These overflows can be used to perform a DoS attack on the server (sm process segfaults) and can possible be used for arbitrary code execution.

http://j2.openaether.org/bugzilla/show_bug.cgi?id=99 2005-07-25 2005-07-30
squid -- possible denial of service condition regarding NTLM authentication squid 2.5.10_6

The squid patches page notes:

Squid may crash with the above error [FATAL: Incorrect scheme in auth header] when given certain request sentences.

Workaround: disable NTLM authentication.

14977 CVE-2005-2917 http://www.squid-cache.org/bugs/show_bug.cgi?id=1391 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert http://secunia.com/advisories/16992/ 2005-09-12 2005-09-15 2005-10-02
phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution phpmyfaq 1.5.2

If magic quotes are off there's a SQL injection when sending a forgotten password. It's possible to overwrite the admin password and to take over the whole system. In some files in the admin section there are some cross site scripting vulnerabilities. In the public frontend it's possible to include arbitrary php files.

14927 14928 14929 14930 CVE-2005-3046 CVE-2005-3047 CVE-2005-3048 CVE-2005-3049 CVE-2005-3050 http://www.phpmyfaq.de/advisory_2005-09-23.php 2005-09-23 2005-09-29