[ISN] Secunia Weekly Summary - Issue: 2004-42
InfoSec News
isn at c4i.org
Fri Oct 15 06:28:09 EDT 2004
========================================================================
The Secunia Weekly Advisory Summary
2004-10-07 - 2004-10-14
This week : 57 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
Microsoft's latest patch release may leave the impression that the new
Service Pack 2 (SP2) for Windows XP is a uniform patch that removes
many security issues that affect previous versions of Windows.
While security has improved in many ways with SP2, there is no reason
to believe that most of the future vulnerabilities discovered in other
versions of Windows won't affect Windows XP SP2 as well.
According to eEye and others, Microsoft has known about the
vulnerabilities fixed by the latest patches since Q1 and Q2 2004. Some,
if not all, of the patches were already included in Service Pack 2 when
it was released in August.
In other words, all of the issues weren't "eliminated" by SP2 through
change of security models and general review of code, but through
traditional patching bundled in a Service Pack.
========================================================================
2) This Week in Brief:
ADVISORIES:
Microsoft has released their monthly security updates, which correct
vulnerabilities in almost all core components of the Microsoft product
line.
In other words, if you are a Microsoft user, then it is required that
you check Windows-Update for the latest patches.
Additional details about all security updates can be found in the
referenced Secunia advisories below.
References:
http://secunia.com/SA12808
http://secunia.com/SA12807
http://secunia.com/SA12806
http://secunia.com/SA12804
http://secunia.com/SA12803
http://secunia.com/SA12805
http://secunia.com/SA12802
http://secunia.com/SA12801
http://secunia.com/SA12800
http://secunia.com/SA12799
--
Jelmer has discovered a vulnerability in Adobe Acrobat and Adobe
Reader, which can be exploited by malicious people to read content of
local files.
Currently, the vendor has not issued a fix for this vulnerability,
for an alternate solution please read Secunia advisory below.
Reference:
http://secunia.com/SA12809
--
Georgi Guninski has found a Microsoft patch for a 2 year old
vulnerability in Internet Explorer to be insufficient.
The vulnerability, which was first discovered by GreyMagic Software,
can be exploited by a malicious web site to read contents of XML files
located on arbitrary web sites in the context of a user's session.
Reference:
http://secunia.com/SA12765
--
Microsoft Word is vulnerable to a buffer overflow, which potentially
can be exploited to compromise a vulnerable system.
Microsoft has not released a patch for this issue, and users are
therefore advised to only open trusted documents.
In addition, for Internet Explorer users another attack vector is
enabled, which increases the severity of this issue slightly. Please
read Secunia advisory below for details.
Reference:
http://secunia.com/SA12758
VIRUS ALERTS:
Secunia has not issued any virus alerts during the last week.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA12758] Microsoft Word Document Parsing Buffer Overflow
Vulnerability
2. [SA12304] Internet Explorer Address Bar Spoofing Vulnerability
3. [SA12321] Microsoft Internet Explorer Drag and Drop Vulnerability
4. [SA12806] Internet Explorer Multiple Vulnerabilities
5. [SA11978] Multiple Browsers Frame Injection Vulnerability
6. [SA12765] Microsoft Internet Explorer Disclosure of Sensitive XML
Information
7. [SA12804] Microsoft Windows Multiple Vulnerabilities
8. [SA12048] Microsoft Internet Explorer Multiple Vulnerabilities
9. [SA12749] ASP.NET Canonicalization Vulnerability
10. [SA12027] Mozilla Fails to Restrict Access to "shell:"
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA12806] Internet Explorer Multiple Vulnerabilities
[SA12808] Microsoft Windows Shell and Program Group Converter
Vulnerabilities
[SA12807] Microsoft Windows SMTP Component Buffer Overflow
Vulnerability
[SA12805] Microsoft Windows Compressed Folders Buffer Overflow
Vulnerability
[SA12804] Microsoft Windows Multiple Vulnerabilities
[SA12802] Microsoft Windows NNTP Component Buffer Overflow
Vulnerability
[SA12772] Crystal Reports JPEG Processing Buffer Overflow
Vulnerability
[SA12801] Microsoft Windows WebDAV XML Message Handler Denial of
Service
[SA12790] GoSmart Message Board SQL Injection and Cross-Site Scripting
[SA12789] IceWarp Web Mail Cross-Site Scripting Vulnerabilities
[SA12776] Monolith Multiple Games Buffer Overflow Vulnerability
[SA12803] Microsoft Windows NetDDE Buffer Overflow Vulnerability
[SA12816] Cabinet Tool "Cabarc.exe" Directory Traversal Vulnerability
[SA12765] Microsoft Internet Explorer Disclosure of Sensitive XML
Information
[SA12799] Microsoft Windows NT RPC Runtime Library Vulnerability
[SA12759] Flash Messaging Server Denial of Service Vulnerability
UNIX/Linux:
[SA12820] Debian update for mpg123
[SA12811] ocPortal "index.php" Arbitrary File Inclusion Vulnerability
[SA12810] UnixWare update for libpng
[SA12782] Sun Solaris libXpm Vulnerabilities
[SA12781] Debian update for xfree86
[SA12777] Gentoo update for lesstif
[SA12763] Debian update for lesstif
[SA12762] Gentoo update for cyrus-sasl
[SA12819] Debian update for sox
[SA12779] Gentoo update for ncompress
[SA12770] BNC IRC Proxy Backspace User Identity Spoofing Vulnerability
[SA12797] Slackware update for rsync
[SA12795] Yeemp Spoofed Sender File Transfer Vulnerability
[SA12788] Unarj Directory Traversal Vulnerability
[SA12821] Fedora update for squid
[SA12812] UnixWare update for CUPS
[SA12791] Squid "asn_parse_header()" Function Denial of Service
Vulnerability
[SA12784] Debian update for mysql
[SA12798] Debian update for cyrus-sasl
[SA12780] Gentoo update for ed
[SA12775] Gentoo update for gettext
[SA12774] GNU gettext Insecure Temporary File Creation Vulnerability
[SA12771] Fedora update for cyrus-sasl
[SA12768] Gentoo update for cups
[SA12767] Red Hat update for cyrus-sasl
[SA12761] Mandrake update for cyrus-sasl
[SA12778] renattach "pipe" Potential Shell Command Injection Security
Issue
Other:
Cross Platform:
[SA12813] phpMyAdmin Unspecified Arbitrary Command Execution
Vulnerability
[SA12800] Microsoft Excel Unspecified Code Execution Vulnerability
[SA12792] ZanfiCmsLite "index.php" Arbitrary File Inclusion
Vulnerability
[SA12760] Cyrus SASL Library Buffer Overflow and "SASL_PATH" Privilege
Escalation
[SA12809] Adobe Acrobat / Adobe Reader Disclosure of Sensitive
Information
[SA12794] The ASN.1 Compiler Unspecified Security Issues
[SA12785] Turbo Traffic Trader Nitro Cross-Site Scripting and SQL
Injection
[SA12773] Wordpress "wp-login.php" HTTP Response Splitting
Vulnerability
[SA12769] Rippy the Aggregator Unspecified Filter Dependence Security
Issue
[SA12766] RealNetworks Helix Universal Server Denial of Service
Vulnerability
[SA12764] CubeCart "cat_id" SQL Injection Vulnerability
[SA12787] Apache2 mod_ssl SSLCipherSuite Security Bypass
[SA12786] CJOverkill "trade.php" Cross-Site Scripting Vulnerabilities
[SA12783] MySQL Two Vulnerabilities
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA12806] Internet Explorer Multiple Vulnerabilities
Critical: Extremely critical
Where: From remote
Impact: Spoofing, Exposure of sensitive information, System
access
Released: 2004-10-12
Multiple vulnerabilities have been reported in Internet Explorer, where
the most critical can be exploited by malicious people to compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/12806/
--
[SA12808] Microsoft Windows Shell and Program Group Converter
Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-13
Two vulnerabilities have been reported in Microsoft Windows, which can
be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/12808/
--
[SA12807] Microsoft Windows SMTP Component Buffer Overflow
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-12
A vulnerability has been reported in the Microsoft Windows, which can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12807/
--
[SA12805] Microsoft Windows Compressed Folders Buffer Overflow
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-12
eEye Digital Security has reported a vulnerability in Microsoft
Windows, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/12805/
--
[SA12804] Microsoft Windows Multiple Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: Privilege escalation, DoS, System access
Released: 2004-10-12
Multiple vulnerabilities have been reported in Microsoft Windows, which
can be exploited to cause a DoS (Denial of Service), gain escalated
privileges, or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12804/
--
[SA12802] Microsoft Windows NNTP Component Buffer Overflow
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-12
Core Security Technologies has reported a vulnerability in Microsoft
Windows, which can be exploited by malicious people to compromise a
vulnerable system.
Full Advisory:
http://secunia.com/advisories/12802/
--
[SA12772] Crystal Reports JPEG Processing Buffer Overflow
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-09
BusinessObjects has acknowledged a vulnerability in Crystal Reports,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/12772/
--
[SA12801] Microsoft Windows WebDAV XML Message Handler Denial of
Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2004-10-12
Amit Klein has reported a vulnerability in Microsoft Windows, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/12801/
--
[SA12790] GoSmart Message Board SQL Injection and Cross-Site Scripting
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2004-10-11
Positive Technologies has reported some vulnerabilities in GoSmart
Message Board, which can be exploited by malicious people to conduct
SQL injection and cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/12790/
--
[SA12789] IceWarp Web Mail Cross-Site Scripting Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Unknown, Cross Site Scripting
Released: 2004-10-12
Some vulnerabilities have been reported in IceWarp Web Mail, where some
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/12789/
--
[SA12776] Monolith Multiple Games Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2004-10-11
Luigi Auriemma has reported a vulnerability in multiple games, which
can be exploited by malicious people to cause a DoS (Denial of Service)
and potentially compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12776/
--
[SA12803] Microsoft Windows NetDDE Buffer Overflow Vulnerability
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2004-10-12
John Heasman has reported a vulnerability in Microsoft Windows, which
can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/12803/
--
[SA12816] Cabinet Tool "Cabarc.exe" Directory Traversal Vulnerability
Critical: Less critical
Where: From remote
Impact: System access
Released: 2004-10-13
Jelmer has discovered a vulnerability in Cabinet Tool, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/12816/
--
[SA12765] Microsoft Internet Explorer Disclosure of Sensitive XML
Information
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2004-10-09
Georgi Guninski has reported that a two year old vulnerability has been
reintroduced in Microsoft Internet Explorer and can be exploited by
malicious people to disclose potentially sensitive information.
Full Advisory:
http://secunia.com/advisories/12765/
--
[SA12799] Microsoft Windows NT RPC Runtime Library Vulnerability
Critical: Less critical
Where: From local network
Impact: Exposure of sensitive information, DoS
Released: 2004-10-12
BindView has reported a vulnerability in Microsoft Windows, which can
be exploited by malicious people to cause a DoS (Denial of Service) or
expose sensitive information.
Full Advisory:
http://secunia.com/advisories/12799/
--
[SA12759] Flash Messaging Server Denial of Service Vulnerability
Critical: Less critical
Where: From local network
Impact: Security Bypass, DoS
Released: 2004-10-08
Luigi Auriemma has reported a vulnerability in Flash Messaging server,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/12759/
UNIX/Linux:--
[SA12820] Debian update for mpg123
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-13
Debian has issued an update for mpg123. This fixes a vulnerability,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/12820/
--
[SA12811] ocPortal "index.php" Arbitrary File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-13
Exoduks has reported a vulnerability in ocPortal, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12811/
--
[SA12810] UnixWare update for libpng
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2004-10-13
SCO has issued an update for libpng. This fixes multiple
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) or compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12810/
--
[SA12782] Sun Solaris libXpm Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-11
Sun has acknowledged some vulnerabilities in Solaris, which potentially
can be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12782/
--
[SA12781] Debian update for xfree86
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-11
Debian has issued an update for XFree86. This fixes multiple
vulnerabilities, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12781/
--
[SA12777] Gentoo update for lesstif
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-11
Gentoo has issued an update for lesstif. This fixes multiple
vulnerabilities, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12777/
--
[SA12763] Debian update for lesstif
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-08
Debian has issued an update for lesstif. This fixes multiple
vulnerabilities, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12763/
--
[SA12762] Gentoo update for cyrus-sasl
Critical: Highly critical
Where: From remote
Impact: Privilege escalation, System access
Released: 2004-10-08
Gentoo has issued an update for cyrus-sasl. This fixes two
vulnerabilities, which can be exploited by malicious people to
compromise a vulnerable system and by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/12762/
--
[SA12819] Debian update for sox
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2004-10-13
Debian has issued an update for SoX. This fixes two vulnerabilities,
which potentially can be exploited by malicious people to compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/12819/
--
[SA12779] Gentoo update for ncompress
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2004-10-11
Gentoo has issued an update for ncompress. This fixes an old
vulnerability, which potentially can be exploited by malicious people
to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12779/
--
[SA12770] BNC IRC Proxy Backspace User Identity Spoofing Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Spoofing
Released: 2004-10-09
Yak has reported a vulnerability in BNC IRC proxy, which can be
exploited by malicious users to spoof their identity.
Full Advisory:
http://secunia.com/advisories/12770/
--
[SA12797] Slackware update for rsync
Critical: Less critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2004-10-12
Slackware has issued an update for rsync. This fixes a vulnerability,
which potentially can be exploited by malicious users to read or write
arbitrary files on a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12797/
--
[SA12795] Yeemp Spoofed Sender File Transfer Vulnerability
Critical: Less critical
Where: From remote
Impact: Spoofing
Released: 2004-10-12
A vulnerability has been reported in Yeemp, which can be exploited by
malicious people to spoof their identity.
Full Advisory:
http://secunia.com/advisories/12795/
--
[SA12788] Unarj Directory Traversal Vulnerability
Critical: Less critical
Where: From remote
Impact: System access
Released: 2004-10-12
Doubles has reported a vulnerability in Unarj, which potentially can be
exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/12788/
--
[SA12821] Fedora update for squid
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2004-10-13
Fedora has issued an update for squid. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/12821/
--
[SA12812] UnixWare update for CUPS
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2004-10-13
SCO has issued an update for CUPS. This fixes a vulnerability, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
Full Advisory:
http://secunia.com/advisories/12812/
--
[SA12791] Squid "asn_parse_header()" Function Denial of Service
Vulnerability
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2004-10-12
A vulnerability has been reported in Squid, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/12791/
--
[SA12784] Debian update for mysql
Critical: Less critical
Where: From local network
Impact: Security Bypass, DoS, System access
Released: 2004-10-11
Debian has issued an update for mysql. This fixes multiple
vulnerabilities, which can be exploited by malicious users to bypass
certain security restrictions, cause a DoS (Denial of Service), and
potentially compromise the system.
Full Advisory:
http://secunia.com/advisories/12784/
--
[SA12798] Debian update for cyrus-sasl
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-10-12
Debian has issued an update for cyrus-sasl. This fixes a vulnerability,
which can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/12798/
--
[SA12780] Gentoo update for ed
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-10-11
Gentoo has issued an update for ed. This fixes an old vulnerability,
which can be exploited by malicious, local users to perform certain
actions on a vulnerable system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/12780/
--
[SA12775] Gentoo update for gettext
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-10-11
Gentoo has issued an update for gettext. This fixes a vulnerability,
which can be exploited by malicious, local users to perform certain
actions on a vulnerable system with escalated privileges.
Full Advisory:
http://secunia.com/advisories/12775/
--
[SA12774] GNU gettext Insecure Temporary File Creation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-10-11
A vulnerability has been reported in gettext, which can be exploited by
malicious, local users to perform certain actions on a vulnerable system
with escalated privileges.
Full Advisory:
http://secunia.com/advisories/12774/
--
[SA12771] Fedora update for cyrus-sasl
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-10-09
Fedora has issued an update for cyrus-sasl. This fixes a vulnerability,
which can be exploited by malicious, local users to gain escalated
privileges.
Full Advisory:
http://secunia.com/advisories/12771/
--
[SA12768] Gentoo update for cups
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2004-10-09
Gentoo has issued an update for cups. This fixes a vulnerability, which
can be exploited by malicious, local users to gain knowledge of
sensitive information.
Full Advisory:
http://secunia.com/advisories/12768/
--
[SA12767] Red Hat update for cyrus-sasl
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-10-08
Red Hat has issued an update for cyrus-sasl. This fixes a
vulnerability, which can be exploited by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/12767/
--
[SA12761] Mandrake update for cyrus-sasl
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2004-10-08
MandrakeSoft has issued an update for cyrus-sasl. This fixes a
vulnerability, which can be exploited by malicious, local users to gain
escalated privileges.
Full Advisory:
http://secunia.com/advisories/12761/
--
[SA12778] renattach "pipe" Potential Shell Command Injection Security
Issue
Critical: Not critical
Where: From remote
Impact: Unknown
Released: 2004-10-11
A security issue has been reported in renattach, which has an unknown
impact, but potentially could allow execution of arbitrary commands.
Full Advisory:
http://secunia.com/advisories/12778/
Other:
Cross Platform:--
[SA12813] phpMyAdmin Unspecified Arbitrary Command Execution
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-13
A vulnerability has been reported in phpMyAdmin, which potentially can
be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12813/
--
[SA12800] Microsoft Excel Unspecified Code Execution Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-12
Brett Moore has reported a vulnerability in Microsoft Excel, which can
be exploited by malicious people to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/12800/
--
[SA12792] ZanfiCmsLite "index.php" Arbitrary File Inclusion
Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2004-10-12
Cracklove has reported a vulnerability in ZanfiCmsLite, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/12792/
--
[SA12760] Cyrus SASL Library Buffer Overflow and "SASL_PATH" Privilege
Escalation
Critical: Highly critical
Where: From remote
Impact: Privilege escalation, System access
Released: 2004-10-08
Two vulnerabilities have been reported in Cyrus SASL library, which can
be exploited by malicious people to compromise a vulnerable system and
by malicious, local users to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/12760/
--
[SA12809] Adobe Acrobat / Adobe Reader Disclosure of Sensitive
Information
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2004-10-13
Jelmer has discovered a vulnerability in Adobe Acrobat and Adobe
Reader, which can be exploited by malicious people to disclose
sensitive information.
Full Advisory:
http://secunia.com/advisories/12809/
--
[SA12794] The ASN.1 Compiler Unspecified Security Issues
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2004-10-12
Two security issues with unknown impacts have been reported in The
ASN.1 Compiler.
Full Advisory:
http://secunia.com/advisories/12794/
--
[SA12785] Turbo Traffic Trader Nitro Cross-Site Scripting and SQL
Injection
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2004-10-11
aCiDBiTS has reported some vulnerabilities in Turbo Traffic Trader
Nitro, which can be exploited by malicious people to conduct cross-site
scripting and SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/12785/
--
[SA12773] Wordpress "wp-login.php" HTTP Response Splitting
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2004-10-11
Chaotic Evil has reported a vulnerability in Wordpress, which can be
exploited by malicious people to conduct script insertion and
cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/12773/
--
[SA12769] Rippy the Aggregator Unspecified Filter Dependence Security
Issue
Critical: Moderately critical
Where: From remote
Impact: Unknown
Released: 2004-10-09
A security issue with an unknown impact has been reported in Rippy the
Aggregator.
Full Advisory:
http://secunia.com/advisories/12769/
--
[SA12766] RealNetworks Helix Universal Server Denial of Service
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2004-10-08
A vulnerability has been reported in Helix Universal Server, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/12766/
--
[SA12764] CubeCart "cat_id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2004-10-08
Pedro Sanches has reported a vulnerability in CubeCart, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/12764/
--
[SA12787] Apache2 mod_ssl SSLCipherSuite Security Bypass
Critical: Less critical
Where: From remote
Impact: Security Bypass
Released: 2004-10-11
A security issue has been reported in Apache2, which can be exploited
by malicious people to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/12787/
--
[SA12786] CJOverkill "trade.php" Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2004-10-11
aCiDBiTS has reported some vulnerabilities in CJOverkill, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/12786/
--
[SA12783] MySQL Two Vulnerabilities
Critical: Less critical
Where: From local network
Impact: Security Bypass, DoS
Released: 2004-10-11
Two vulnerabilities have been reported in MySQL, which can be exploited
by malicious users to bypass certain security restrictions or cause a
DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/12783/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support at secunia.com
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
========================================================================
More information about the ISN
mailing list