Section: .. / 0705-advisories /
| /// File Name: |
glsa-200705-17.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200705-17 - Stefan Esser discovered that mod_security processes NULL characters as terminators in POST requests using the application/x-www-form-urlencoded encoding type, while other parsers used in web applications do not. Versions less than 2.1.1 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 2683 | | Related CVE(s): | CVE-2007-1359 | | Last Modified: | May 21 04:51:20 2007 |
| MD5 Checksum: | 17f0309269d69d5e877cc81250d35153 |
|
| /// File Name: |
glsa-200705-16.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200705-16 - Harold Hallikainen has reported that the Upload page fails to properly check the extension of a file. Versions less than 1.3.10-r3 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 2599 | | Related CVE(s): | CVE-2007-2024, CVE-2007-2025 | | Last Modified: | May 21 04:51:06 2007 |
| MD5 Checksum: | 9bf97383337dfa4c93c14dc8286bccfb |
|
| /// File Name: |
dsa-1291-2.txt |
Description:
|
Debian Security Advisory 1291-2 - Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data. Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.
| | Homepage: | http://www.debian.org/security | | File Size: | 24189 | | Related CVE(s): | CVE-2007-2446, CVE-2007-2447 | | Last Modified: | May 21 04:47:15 2007 |
| MD5 Checksum: | bd00f0426584818823ae786c91fe45a4 |
|
| /// File Name: |
dsa-1293-1.txt |
Description:
|
Debian Security Advisory 1293-1 - Paul Jakma discovered that specially crafted UPDATE messages can trigger an out of boundary read that can result in a system crash of quagga, the BGP/OSPF/RIP routing daemon.
| | Homepage: | http://www.debian.org/security | | File Size: | 7915 | | Related CVE(s): | CVE-2007-1995 | | Last Modified: | May 21 04:44:19 2007 |
| MD5 Checksum: | 02fe5b809432ed3d4b6d91c2d20229b5 |
|
| /// File Name: |
cabright-help.txt |
Description:
|
CA is aware that two functional exploit code samples were publicized on May 16, 2007. These two denial of service exploits are associated with vulnerabilities in CA BrightStor ARCserve Backup Mediasvr.exe and caloggerd.exe.
| | Author: | Ken Williams | | Homepage: | http://www3.ca.com/ | | File Size: | 1715 | | Last Modified: | May 17 04:33:55 2007 |
| MD5 Checksum: | fb0c6a521acccd5bd50ad4e8d0b6006b |
|
| /// File Name: |
SYM07-007.txt |
Description:
|
CERT notified Symantec that a buffer overflow exists in an ActiveX Control used by Norton Personal Firewall. The error occurs in the Get() and Set() functions used by ISAlertDataCOM, which is part of ISLALERT.DLL. A successful exploit of this vulnerability could potentially allow the remote execution of code on a vulnerable system, with the rights of the logged-in user.
| | Author: | Will Dormann | | Homepage: | http://www.symantec.com/ | | File Size: | 3523 | | Last Modified: | May 17 04:33:02 2007 |
| MD5 Checksum: | ede6160ce3905e7d5b3e1667b1d5fcaf |
|
| /// File Name: |
USN-460-1.txt |
Description:
|
Ubuntu Security Notice 460-1 - Paul Griffith and Andrew Hogue discovered that Samba did not fully drop root privileges while translating SIDs. A remote authenticated user could issue SMB operations during a small window of opportunity and gain root privileges. Brian Schafer discovered that Samba did not handle NDR parsing correctly. A remote attacker could send specially crafted MS-RPC requests that could overwrite heap memory and execute arbitrary code. It was discovered that Samba did not correctly escape input parameters for external scripts defined in smb.conf. Remote authenticated users could send specially crafted MS-RPC requests and execute arbitrary shell commands.
| | Homepage: | http://security.ubuntu.com/ | | File Size: | 24858 | | Related CVE(s): | CVE-2007-2444, CVE-2007-2446, CVE-2007-2447 | | Last Modified: | May 17 04:22:48 2007 |
| MD5 Checksum: | 476081583b5fad8dc1a8e0b09b69c66f |
|
| /// File Name: |
dsa-1292-1.txt |
Description:
|
Debian Security Advisory 1292-1 - Andreas Nolden discovered a bug in the UTF8 decoding routines in qt4-x11, a C++ GUI library framework, that could allow remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.
| | Homepage: | http://www.debian.org/security | | File Size: | 17503 | | Related CVE(s): | CVE-2007-0242 | | Last Modified: | May 17 04:18:16 2007 |
| MD5 Checksum: | 12a7b7221ee6b51883cf8a3d510ec1d1 |
|
| /// File Name: |
ZDI-07-033.txt |
Description:
|
A vulnerability allows attackers to execute arbitrary code on vulnerable installations of Samba. User interaction is not required to exploit this vulnerability. The specific flaw exists in the parsing of RPC requests to the LSA RPC interface. When parsing a request to LsarLookupSids/LsarLookupSids2, heap allocation is calculated based on user input. By specifying invalid values, heap blocks can be overwritten leading to remote code execution.
| | Homepage: | http://www.zerodayinitiative.com/ | | File Size: | 2510 | | Related CVE(s): | CVE-2007-2446 | | Last Modified: | May 17 04:15:58 2007 |
| MD5 Checksum: | 35687f97d20fbe66af1e1da1c5b0e9ab |
|
| /// File Name: |
ZDI-07-032.txt |
Description:
|
A vulnerability allows attackers to execute arbitrary code on vulnerable installations of Samba. User interaction is not required to exploit this vulnerability. The specific flaw exists in the parsing of RPC requests to the SRVSVC RPC interface. When parsing a request to NetSetFileSecurity, heap allocation is calculated based on user input. By specifying invalid values, heap blocks can be overwritten leading to remote code execution.
| | Homepage: | http://www.zerodayinitiative.com/ | | File Size: | 2493 | | Related CVE(s): | CVE-2007-2446 | | Last Modified: | May 17 04:15:26 2007 |
| MD5 Checksum: | f4fe06853dd941c84f9b054af34a737b |
|
| /// File Name: |
ZDI-07-031.txt |
Description:
|
A vulnerability allows attackers to execute arbitrary code on vulnerable installations of Samba. User interaction is not required to exploit this vulnerability. The specific flaw exists in the parsing of RPC requests to the SPOOLSS RPC interface. When parsing a request to RFNPCNEX, heap allocation is calculated based on user input. By specifying invalid values, heap blocks can be overwritten leading to remote code execution.
| | Homepage: | http://www.zerodayinitiative.com/ | | File Size: | 2495 | | Related CVE(s): | CVE-2007-2446 | | Last Modified: | May 17 04:14:52 2007 |
| MD5 Checksum: | f8dc71e8ab1c7c4c646b490428db484b |
|
| /// File Name: |
ZDI-07-030.txt |
Description:
|
A vulnerability allows attackers to execute arbitrary code on vulnerable installations of Samba. User interaction is not required to exploit this vulnerability. The specific flaw exists in the parsing of RPC requests to the DFS RPC interface. When parsing a request to DFSEnum, heap allocation is calculated based on user input. By specifying invalid values, heap blocks can be overwritten leading to remote code execution.
| | Homepage: | http://www.zerodayinitiative.com/ | | File Size: | 2493 | | Related CVE(s): | CVE-2007-2446 | | Last Modified: | May 17 04:12:06 2007 |
| MD5 Checksum: | d549778dfbb738edf585c7b51106b601 |
|
| /// File Name: |
ZDI-07-029.txt |
Description:
|
A vulnerability allows attackers to execute arbitrary code on vulnerable installations of Samba. User interaction is not required to exploit this vulnerability. The specific flaw exists in the parsing of RPC requests to the LSA RPC interface. When parsing a request to LsarAddPrivilegesToAccount, heap allocation is calculated based on user input. By specifying invalid values, heap blocks can be overwritten leading to remote code execution.
| | Homepage: | http://www.zerodayinitiative.com/ | | File Size: | 2508 | | Related CVE(s): | CVE-2007-2446 | | Last Modified: | May 17 04:08:01 2007 |
| MD5 Checksum: | ce96031b28a8ba05deb2c066745918c9 |
|
| /// File Name: |
dsa-1291-1.txt |
Description:
|
Debian Security Advisory 1291-1 - Several issues have been identified in Samba, the SMB/CIFS file and print server implementation for GNU/Linux. When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish addition means of gaining root access to the server. Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data. Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution
| | Homepage: | http://www.debian.org/security | | File Size: | 19272 | | Related CVE(s): | CVE-2007-2444, CVE-2007-2446, CVE-2007-2447 | | Last Modified: | May 17 03:51:46 2007 |
| MD5 Checksum: | abe8236f5ffb6e401b46583bc92e37e5 |
|
| /// File Name: |
glsa-200705-15.txt |
Description:
|
Gentoo Linux Security Advisory GLSA 200705-15 - Samba contains a logical error in the smbd daemon when translating local SID to user names (CVE-2007-2444). Furthermore, Samba contains several bugs when parsing NDR encoded RPC parameters (CVE-2007-2446). Lastly, Samba fails to properly sanitize remote procedure input provided via Microsoft Remote Procedure Calls (CVE-2007-2447). Versions less than 3.0.24-r2 are affected.
| | Homepage: | http://security.gentoo.org | | File Size: | 2834 | | Related CVE(s): | CVE-2007-2444, CVE-2007-2446, CVE-2007-2447 | | Last Modified: | May 17 03:41:45 2007 |
| MD5 Checksum: | 65698138a6ca1abe5ee01f4f35c2a8eb |
|
| /// File Name: |
bypassing-pwf-hips.txt |
Description:
|
A flaw with how various personal firewalls and HIPS software use process identifiers in Microsoft Windows allows for complete bypass. Comodo Firewall Pro 2.4.18.184, Comodo Personal Firewall 2.3.6.81, and ZoneAlarm Pro 6.1.744.001 are some of the products affected.
| | Homepage: | http://www.matousec.com/ | | Related Exploit: | BTP00000P000ZA.zip | | File Size: | 1854 | | Last Modified: | May 17 02:41:16 2007 |
| MD5 Checksum: | 579317c5c7048a1cd8e38680cff269df |
|
| /// File Name: |
GS07-01.txt |
Description:
|
Various HTTP content scanning systems fail to properly scan full-width/half-width Unicode encoded traffic. This may allow malicious content to bypass HTTP content scanning systems. Systems affected include Checkpoint Web Intelligence and IBM ISS Proventia Series systems.
| | Author: | Fatih Ozavci, Caglar Cakici | | Homepage: | http://www.gamasec.net/ | | File Size: | 1932 | | Last Modified: | May 17 02:35:37 2007 |
| MD5 Checksum: | 0a9c643277ef9ac0d42b10d2a455e812 |
|
| /// File Name: |
sa25286.txt |
Description:
|
Secunia Security Advisory - Derek Abdine has reported some vulnerabilities in Caucho Resin, which can be exploited by malicious people to disclose sensitive information.
| | Homepage: | http://secunia.com/advisories/25286/ | | File Size: | 3166 | | Last Modified: | May 16 03:04:41 2007 |
| MD5 Checksum: | 27e74db63ef76f8aec7b4910af20b6a6 |
|
| /// File Name: |
sa25285.txt |
Description:
|
Secunia Security Advisory - A vulnerability has been reported in various Cisco products, which can be exploited by malicious people to bypass certain security restrictions.
| | Homepage: | http://secunia.com/advisories/25285/ | | File Size: | 2680 | | Last Modified: | May 16 03:04:41 2007 |
| MD5 Checksum: | ee68efcd86c45f74f9eef3a4e396f85c |
|
| /// File Name: |
sa25284.txt |
Description:
|
Secunia Security Advisory - Some vulnerabilities and two security issues have been reported in BEA WebLogic, which can be exploited by malicious users to disclose sensitive information, bypass certain security restrictions, and conduct script insertion attacks, and by malicious people to bypass certain security restrictions, brute force an administrator's password, conduct cross-site scripting attacks, and cause a DoS (Denial of Service).
| | Homepage: | http://secunia.com/advisories/25284/ | | File Size: | 7747 | | Last Modified: | May 16 03:04:41 2007 |
| MD5 Checksum: | 6188f47b1c36b56366a13e2ea4ba8201 |
|
| /// File Name: |
sa25283.txt |
Description:
|
Secunia Security Advisory - Some vulnerabilities have been reported in JRockit, which can be exploited by malicious people to bypass certain security restrictions or to compromise a vulnerable system.
| | Homepage: | http://secunia.com/advisories/25283/ | | File Size: | 2849 | | Last Modified: | May 16 03:04:41 2007 |
| MD5 Checksum: | c47c4cf78752f3c990fcdfb3ce0d94d6 |
|
| /// File Name: |
sa25280.txt |
Description:
|
Secunia Security Advisory - Red Hat has issued an update for tomcat. This fixes a security issue, which can be exploited by malicious people to bypass certain security restrictions.
| | Homepage: | http://secunia.com/advisories/25280/ | | File Size: | 2235 | | Last Modified: | May 16 03:04:41 2007 |
| MD5 Checksum: | 8aa552462589a1643c07afce54e6a3a3 |
|
| /// File Name: |
sa25279.txt |
Description:
|
Secunia Security Advisory - Jesper Jurcenoks has discovered some vulnerabilities in SonicBB, which can be exploited by malicious people to conduct SQL injection attacks or cross-site scripting attacks.
| | Homepage: | http://secunia.com/advisories/25279/ | | File Size: | 3036 | | Last Modified: | May 16 03:04:41 2007 |
| MD5 Checksum: | 4cb95069ee1e41994cb927b274d0f2ec |
|
| /// File Name: |
sa25275.txt |
Description:
|
Secunia Security Advisory - Luka Treiber and Aljosa Ocepek have reported a vulnerability in HP Systems Insight Manager, which can be exploited by malicious people to conduct session fixation attacks.
| | Homepage: | http://secunia.com/advisories/25275/ | | File Size: | 2635 | | Last Modified: | May 16 03:04:41 2007 |
| MD5 Checksum: | 7c949c5fcb17315060afc628619efd7d |
|
| /// File Name: |
sa25274.txt |
Description:
|
Secunia Security Advisory - Some vulnerabilities have been discovered in NagiosQL, which can be exploited by malicious people to disclose sensitive information or to compromise a vulnerable system.
| | Homepage: | http://secunia.com/advisories/25274/ | | File Size: | 2490 | | Last Modified: | May 16 03:04:41 2007 |
| MD5 Checksum: | 614ac1a5bc91da18cf3bf6da0f09bdd8 |
|
|
|
|
|
![.:[ packet storm ]:.](/images/ps-ani.gif)
