[ISN] Secunia Weekly Summary - Issue: 2006-13
InfoSec News
isn at c4i.org
Fri Mar 31 01:24:34 EST 2006
========================================================================
The Secunia Weekly Advisory Summary
2006-03-23 - 2006-03-30
This week : 89 advisories
========================================================================
Table of Contents:
1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing
========================================================================
1) Word From Secunia:
The Secunia staff is spending hours every day to assure you the best
and most reliable source for vulnerability information. Every single
vulnerability report is being validated and verified before a Secunia
advisory is written.
Secunia validates and verifies vulnerability reports in many different
ways e.g. by downloading the software and performing comprehensive
tests, by reviewing source code, or by validating the credibility of
the source from which the vulnerability report was issued.
As a result, Secunia's database is the most correct and complete source
for recent vulnerability information available on the Internet.
Secunia Online Vulnerability Database:
http://secunia.com/
========================================================================
2) This Week in Brief:
The vulnerability in Microsoft Internet Explorer published last week
has been upgraded to Extremely Critical since exploit code is now
publicly available.
All users of Microsoft Internet Explorer are strongly advised to
review the referenced Secunia advisory below for a temporary
workaround.
Reference:
http://secunia.com/SA18680
Companies have the option of requesting a Secunia account for
immediate notification when a patch is released by Microsoft.
Request Secunia Account:
https://ca.secunia.com/?page=requestaccount&s
--
Multiple vulnerabilities have been reported in Veritas Netbackup, which
can be exploited by malicious people to compromise a vulnerable system.
The vendor has released patches. Please see the referenced Secunia
advisory.
Reference:
http://secunia.com/SA19417
--
Various RealNetworks products, including the popular RealOne and
RealPlayer, are affected by several vulnerabilities, which can be
exploited by malicious people to compromise a user's system.
The complete list of vulnerable products may be found in the
referenced Secunia advisory. All users of RealNetworks products are
advised to check for available patches.
Reference:
http://secunia.com/SA19358
VIRUS ALERTS:
Secunia has not issued any virus alerts during the week.
========================================================================
3) This Weeks Top Ten Most Read Advisories:
1. [SA18680] Microsoft Internet Explorer "createTextRange()" Code
Execution
2. [SA19342] Sendmail Signal Handling Memory Corruption Vulnerability
3. [SA19118] AVG Anti-Virus Updated Files Insecure File Permissions
4. [SA19358] RealNetworks Products Multiple Buffer Overflow
Vulnerabilities
5. [SA19378] Internet Explorer Unspecified Automatic .HTA Application
Execution
6. [SA18963] Mac OS X File Association Meta Data Shell Script
Execution
7. [SA19406] Microsoft .NET Framework SDK ildasm Buffer Overflow
8. [SA19357] Linux Kernel IPv4 "sockaddr_in.sin_zero" Information
Disclosure
9. [SA19360] Sun Solaris Sendmail Signal Handling Memory Corruption
10. [SA19331] Debian Network Installation Insecure Default Directory
Permissions
========================================================================
4) Vulnerabilities Summary Listing
Windows:
[SA19378] Internet Explorer Unspecified Automatic .HTA Application
Execution
[SA19441] EzASPSite "scheme" Parameter SQL Injection Vulnerability
[SA19415] Absolute Live Support XE Script Insertion Vulnerability
[SA19406] Microsoft .NET Framework SDK ildasm Buffer Overflow
[SA19385] Metisware Instructor Task Script Insertion Vulnerability
[SA19451] McAfee VirusScan DUNZIP32.dll Buffer Overflow Vulnerability
[SA19430] couponZONE Cross-Site Scripting Vulnerabilities
[SA19427] classifiedZONE "rtn" Cross-Site Scripting Vulnerability
[SA19416] Web Quiz Pro Multiple Cross-Site Scripting Vulnerabilities
[SA19401] Toast Forums Cross-Site Scripting Vulnerabilities
[SA19399] ssCMS "keywords" Cross-Site Scripting Vulnerability
[SA19398] dotNetBB "em" Cross-Site Scripting Vulnerability
[SA19397] uniForum "wbsecadmin.aspx" Cross-Site Scripting
[SA19396] Absolute FAQ Manager "question" Cross-Site Scripting
[SA19386] EZHomepagePro Cross-Site Scripting Vulnerabilities
[SA19381] E-School Management System "msg" Cross-Site Scripting
[SA19375] Helm Web Hosting Control Panel Cross-Site Scripting
Vulnerabilities
UNIX/Linux:
[SA19466] NetBSD Sendmail Memory Corruption Vulnerability
[SA19450] F-Secure Messaging Security Gateway Sendmail Vulnerability
[SA19407] OpenBSD update for sendmail
[SA19404] Avaya Products Sendmail Signal Handling Memory Corruption
[SA19394] HP-UX update for sendmail
[SA19390] Gentoo update for realplayer
[SA19380] Debian update for evolution
[SA19463] NetBSD racoon IKE Message Processing Denial of Service
[SA19449] PHPCollab "Forgot password" SQL Injection Vulnerability
[SA19436] Debian update for netpbm-free
[SA19425] Sourceworkshop newsletter "email" SQL Injection
Vulnerability
[SA19424] Debian update for flex
[SA19418] MPlayer AVI "indx" Chunk and ASF Handling Vulnerabilities
[SA19408] SUSE Updates for Multiple Packages
[SA19377] SCO OpenServer update for xpdf
[SA19374] Debian update for kernel-source-2.6.8
[SA19371] Trustix update for curl
[SA19369] Debian update for kernel-source-2.4.27
[SA19457] UnixWare update for curl
[SA19429] realestateZONE Cross-Site Scripting Vulnerabilities
[SA19387] BlankOL "bol.cgi" Cross-Site Scripting Vulnerability
[SA19405] SUSE update for freeradius
[SA19395] Avaya PDS HP-UX swagentd Denial of Service Vulnerability
[SA19373] HP-UX swagentd Denial of Service Vulnerability
[SA19465] NetBSD mail Insecure Record File Creation
[SA19464] NetBSD if_bridge Kernel Memory Disclosure Vulnerability
[SA19444] Sun Cluster SunPlex Manager File Disclosure Vulnerability
[SA19442] Gentoo bsd-games Privilege Escalation Vulnerability
[SA19433] Gentoo update for openoffice / openoffice-bin
[SA19426] Sun Solaris Process Environment Disclosure Security Issue
[SA19376] Gentoo nethack / falconseye / slashem Privilege Escalation
[SA19402] Linux Kernel IP ID Value Increment Weakness
Other:
Cross Platform:
[SA19438] Virtual War "vwar_root" File Inclusion Vulnerability
[SA19428] PHP Live Helper "abs_path" File Inclusion Vulnerability
[SA19389] csDoom Format String and Buffer Overflow Vulnerabilities
[SA19452] NetOffice "Forgot password" SQL Injection Vulnerability
[SA19448] VBook Multiple Vulnerabilities
[SA19447] Tilde CMS "id" SQL Injection Vulnerability
[SA19446] OneOrZero "id" SQL Injection Vulnerability
[SA19439] Cholod Mysql based message board Script Insertion and SQL
Injection
[SA19435] VNews Multiple Vulnerabilities
[SA19422] vCounter "url" SQL Injection Vulnerability
[SA19421] Pixel Motion Blog SQL Injection Vulnerabilities
[SA19420] VSNS Lemon Multiple Vulnerabilities
[SA19414] G-Book "g_message" Script Insertion Vulnerability
[SA19413] Null news Multiple SQL Injection Vulnerabilities
[SA19410] TWiki Restricted Content Access and Denial of Service
[SA19403] Vihor Design Local File Disclosure Vulnerability
[SA19400] WEBalbum Local File Inclusion Vulnerability
[SA19392] Mambo AkoComment Module SQL Injection Vulnerabilities
[SA19391] phpNewsManager Multiple SQL Injection Vulnerabilities
[SA19388] Vavoom Two Denial of Service Vulnerabilities
[SA19384] phpPgAds / phpAdsNew Two Vulnerabilities
[SA19382] Nuked-Klan "m" SQL Injection Vulnerability
[SA19417] Veritas NetBackup Multiple Buffer Overflow Vulnerabilities
[SA19460] Explorer XP "chemin" Cross-Site Scripting and Directory
Traversal
[SA19445] Arab Portal "title" Cross-Site Scripting Vulnerability
[SA19443] PHP Script Index "search" Cross-Site Scripting Vulnerability
[SA19440] PHP Classifieds "searchword" Cross-Site Scripting
Vulnerability
[SA19434] Connect Daily Cross-Site Scripting Vulnerabilities
[SA19432] CONTROLzx HMS Multiple Cross-Site Scripting Vulnerabilities
[SA19431] ActiveCampaign SupportTrio "terms" Cross-Site Scripting
[SA19423] Greymatter gm-upload.cgi File Upload Vulnerability
[SA19419] phpCOIN "fs" Cross-Site Scripting Vulnerabilities
[SA19412] PHP Ticket "frm_search_in" SQL Injection Vulnerability
[SA19411] TFT Gallery "passwd" Exposure of User Credentials
[SA19409] phpmyfamily "name" Cross-Site Scripting Vulnerability
[SA19393] Calender Express Cross-Site Scripting Vulnerability
[SA19383] PHP "html_entity_decode()" Information Disclosure
Vulnerability
[SA19379] CoMoblog "img.php" Cross-Site Scripting Vulnerability
[SA19372] Meeting Reserve Cross-Site Scripting Vulnerability
[SA19370] EasyMoblog "img.php" Cross-Site Scripting Vulnerability
========================================================================
5) Vulnerabilities Content Listing
Windows:--
[SA19378] Internet Explorer Unspecified Automatic .HTA Application
Execution
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-27
Jeffrey van der Stad has reported a vulnerability in Internet Explorer,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/19378/
--
[SA19441] EzASPSite "scheme" Parameter SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-30
Mustafa Can Bjorn has discovered a vulnerability in EzASPSite, which
can be exploited by malicious people conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19441/
--
[SA19415] Absolute Live Support XE Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported a vulnerability in Absolute Live Support XE, which can
be exploited by malicious people to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/19415/
--
[SA19406] Microsoft .NET Framework SDK ildasm Buffer Overflow
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-03-27
A vulnerability has been discovered in Microsoft .NET Framework SDK,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/19406/
--
[SA19385] Metisware Instructor Task Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported a vulnerability in Metisware Instructor, which can be
exploited by malicious people to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/19385/
--
[SA19451] McAfee VirusScan DUNZIP32.dll Buffer Overflow Vulnerability
Critical: Less critical
Where: From remote
Impact: System access
Released: 2006-03-30
A vulnerability has been discovered in McAfee VirusScan, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/19451/
--
[SA19430] couponZONE Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-28
r0t has reported some vulnerabilities in couponZONE, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19430/
--
[SA19427] classifiedZONE "rtn" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-28
r0t has reported a vulnerability in classifiedZONE, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19427/
--
[SA19416] Web Quiz Pro Multiple Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported some vulnerabilities in Web Quiz Pro, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19416/
--
[SA19401] Toast Forums Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has discovered some vulnerabilities in Toast Forums, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19401/
--
[SA19399] ssCMS "keywords" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported a vulnerability in ssCMS, which can be exploited by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19399/
--
[SA19398] dotNetBB "em" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported a vulnerability in dotNetBB, which can be exploited by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19398/
--
[SA19397] uniForum "wbsecadmin.aspx" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported a vulnerability in uniForum, which can be exploited by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19397/
--
[SA19396] Absolute FAQ Manager "question" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported a vulnerability in Absolute FAQ Manager, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19396/
--
[SA19386] EZHomepagePro Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported some vulnerabilities in EZHomepagePro, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19386/
--
[SA19381] E-School Management System "msg" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported a vulnerability in E-School Management System, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/19381/
--
[SA19375] Helm Web Hosting Control Panel Cross-Site Scripting
Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has discovered some vulnerabilities in Helm Web Hosting Control
Panel, which can be exploited by malicious people to conduct cross-site
scripting attacks.
Full Advisory:
http://secunia.com/advisories/19375/
UNIX/Linux:--
[SA19466] NetBSD Sendmail Memory Corruption Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-30
NetBSD has acknowledged a vulnerability in sendmail, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19466/
--
[SA19450] F-Secure Messaging Security Gateway Sendmail Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-29
F-Secure has acknowledged a vulnerability in F-Secure Messaging
Security Gateway, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19450/
--
[SA19407] OpenBSD update for sendmail
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-27
OpenBSD has issued an update for sendmail. This fixes a vulnerability,
which can be exploited by malicious people to compromise a vulnerable
system.
Full Advisory:
http://secunia.com/advisories/19407/
--
[SA19404] Avaya Products Sendmail Signal Handling Memory Corruption
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-27
Avaya has acknowledged a vulnerability in various Avaya products, which
can be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19404/
--
[SA19394] HP-UX update for sendmail
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-28
HP has issued an update for sendmail. This fixes a vulnerability, which
can be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19394/
--
[SA19390] Gentoo update for realplayer
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-27
Gentoo has issued an update for realplayer. This fixes a vulnerability,
which can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/19390/
--
[SA19380] Debian update for evolution
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-24
Debian has issued an update for evolution. This fixes some
vulnerabilities, which can be exploited by malicious people to
compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19380/
--
[SA19463] NetBSD racoon IKE Message Processing Denial of Service
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-03-30
NetBSD has acknowledged a vulnerability in racoon, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/19463/
--
[SA19449] PHPCollab "Forgot password" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-29
rgod has discovered a vulnerability in PHPCollab, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19449/
--
[SA19436] Debian update for netpbm-free
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-03-29
Debian has issued an update for netpbm-free. This fixes a
vulnerability, which can be exploited by malicious people to compromise
a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19436/
--
[SA19425] Sourceworkshop newsletter "email" SQL Injection
Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-29
Aliaksandr Hartsuyeu has discovered a vulnerability in Sourceworkshop
newsletter, which can be exploited by malicious people to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/19425/
--
[SA19424] Debian update for flex
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-03-28
Debian has issued an update for flex. This fixes a vulnerability, which
potentially can be exploited by malicious people to compromise a user's
system.
Full Advisory:
http://secunia.com/advisories/19424/
--
[SA19418] MPlayer AVI "indx" Chunk and ASF Handling Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-03-29
xfocus has reported some vulnerabilities in MPlayer, which can be
exploited by malicious people to cause a DoS (Denial of Service) and
potentially to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/19418/
--
[SA19408] SUSE Updates for Multiple Packages
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-03-27
SUSE has issued an update for multiple packages. This fixes some
vulnerabilities, which can be exploited by malicious people to cause a
DoS (Denial of Service) and potentially to compromise a user's system.
Full Advisory:
http://secunia.com/advisories/19408/
--
[SA19377] SCO OpenServer update for xpdf
Critical: Moderately critical
Where: From remote
Impact: DoS, System access
Released: 2006-03-24
SCO has issued an update for xpdf. This fixes some vulnerabilities,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a user's system.
Full Advisory:
http://secunia.com/advisories/19377/
--
[SA19374] Debian update for kernel-source-2.6.8
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information,
Privilege escalation, DoS
Released: 2006-03-24
Debian has issued an update for kernel-source-2.6.8. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
disclose potentially sensitive information, cause a DoS (Denial of
Service), gain escalated privileges, and bypass certain security
restrictions, or by malicious people to cause a DoS, bypass certain
security restrictions, and disclose certain sensitive information.
Full Advisory:
http://secunia.com/advisories/19374/
--
[SA19371] Trustix update for curl
Critical: Moderately critical
Where: From remote
Impact: System access
Released: 2006-03-24
Trustix has issued an update for curl. This fixes a vulnerability,
which potentially can be exploited by malicious people to compromise a
user's system.
Full Advisory:
http://secunia.com/advisories/19371/
--
[SA19369] Debian update for kernel-source-2.4.27
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Exposure of sensitive information,
Privilege escalation, DoS
Released: 2006-03-24
Debian has issued an update for kernel-source-2.4.27. This fixes some
vulnerabilities, which can be exploited by malicious, local users to
gain knowledge of potentially sensitive information, cause a DoS
(Denial of Service), and gain escalated privileges, or by malicious
people to cause a DoS and bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/19369/
--
[SA19457] UnixWare update for curl
Critical: Less critical
Where: From remote
Impact: Unknown
Released: 2006-03-30
SCO has issued an update for curl. This fixes a vulnerability with an
unknown impact.
Full Advisory:
http://secunia.com/advisories/19457/
--
[SA19429] realestateZONE Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-28
r0t has reported some vulnerabilities in realestateZONE, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19429/
--
[SA19387] BlankOL "bol.cgi" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
r0t has reported a vulnerability in BlankOL, which can be exploited by
malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19387/
--
[SA19405] SUSE update for freeradius
Critical: Less critical
Where: From local network
Impact: Security Bypass, DoS
Released: 2006-03-28
SUSE has issued an update for freeradius. This fixes a vulnerability,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/19405/
--
[SA19395] Avaya PDS HP-UX swagentd Denial of Service Vulnerability
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2006-03-27
Avaya has acknowledged a vulnerability in Avaya Predictive Dialing
System (PDS), which can be exploited by malicious people to cause a DoS
(Denial of Service).
Full Advisory:
http://secunia.com/advisories/19395/
--
[SA19373] HP-UX swagentd Denial of Service Vulnerability
Critical: Less critical
Where: From local network
Impact: DoS
Released: 2006-03-24
A vulnerability has been reported in HP-UX, which can be exploited by
malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/19373/
--
[SA19465] NetBSD mail Insecure Record File Creation
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2006-03-30
A security issue has been reported in NetBSD, which can be exploited by
malicious, local users to gain knowledge of potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/19465/
--
[SA19464] NetBSD if_bridge Kernel Memory Disclosure Vulnerability
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2006-03-30
A vulnerability has been reported in NetBSD, which can be exploited by
malicious, local users to gain knowledge of potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/19464/
--
[SA19444] Sun Cluster SunPlex Manager File Disclosure Vulnerability
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2006-03-30
A vulnerability has been reported in Sun Cluster, which can be
exploited by malicious, local users to gain knowledge of potentially
sensitive information.
Full Advisory:
http://secunia.com/advisories/19444/
--
[SA19442] Gentoo bsd-games Privilege Escalation Vulnerability
Critical: Less critical
Where: Local system
Impact: Privilege escalation
Released: 2006-03-30
Tavis Ormandy has reported some vulnerabilities in the bsd-games
package, which potentially can be exploited by malicious, local users
to gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/19442/
--
[SA19433] Gentoo update for openoffice / openoffice-bin
Critical: Less critical
Where: Local system
Impact: Unknown
Released: 2006-03-28
Gentoo has issued updates for openoffice / openoffice-bin. These fix a
vulnerability, which has an unknown impact.
Full Advisory:
http://secunia.com/advisories/19433/
--
[SA19426] Sun Solaris Process Environment Disclosure Security Issue
Critical: Less critical
Where: Local system
Impact: Exposure of sensitive information
Released: 2006-03-28
A security issue has been reported in Solaris, which can be exploited
by malicious, local users to gain knowledge of potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/19426/
--
[SA19376] Gentoo nethack / falconseye / slashem Privilege Escalation
Critical: Less critical
Where: Local system
Impact: Manipulation of data, Privilege escalation
Released: 2006-03-24
Gentoo has reported some vulnerabilities in the nethack / falconseye /
slashem packages, which can be exploited by malicious, local users to
gain escalated privileges.
Full Advisory:
http://secunia.com/advisories/19376/
--
[SA19402] Linux Kernel IP ID Value Increment Weakness
Critical: Not critical
Where: From remote
Impact: Security Bypass, Exposure of system information
Released: 2006-03-28
Marco Ivaldi has reported a weakness in the Linux kernel, which can be
exploited by malicious people to disclose certain system information
and potentially to bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/19402/
Other:
Cross Platform:--
[SA19438] Virtual War "vwar_root" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-29
[Oo] has discovered a vulnerability in Virtual War, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19438/
--
[SA19428] PHP Live Helper "abs_path" File Inclusion Vulnerability
Critical: Highly critical
Where: From remote
Impact: System access
Released: 2006-03-28
rUnViRuS has reported a vulnerability in PHP Live Helper, which can be
exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19428/
--
[SA19389] csDoom Format String and Buffer Overflow Vulnerabilities
Critical: Highly critical
Where: From remote
Impact: DoS, System access
Released: 2006-03-27
Luigi Auriemma has reported some vulnerabilities in csDoom, which can
be exploited by malicious people to cause a DoS (Denial of Service) and
potentially to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19389/
--
[SA19452] NetOffice "Forgot password" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-29
rgod has discovered a vulnerability in NetOffice, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19452/
--
[SA19448] VBook Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data, System access
Released: 2006-03-30
Aliaksandr Hartsuyeu has discovered multiple vulnerabilities in VBook,
which can be exploited by malicious people to conduct script insertion
attacks and SQL injection attacks, and by malicious users to compromise
a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19448/
--
[SA19447] Tilde CMS "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-29
Preddy has reported a vulnerability in Tilde CMS, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19447/
--
[SA19446] OneOrZero "id" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-29
Preddy has discovered a vulnerability in OneOrZero, which can be
exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19446/
--
[SA19439] Cholod Mysql based message board Script Insertion and SQL
Injection
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data
Released: 2006-03-29
kspecial has discovered some vulnerabilities in Cholod Mysql based
message board, which can be exploited by malicious people to conduct
script insertion and SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19439/
--
[SA19435] VNews Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting, Manipulation of data, System access
Released: 2006-03-30
Aliaksandr Hartsuyeu has reported some vulnerabilities in VNews, which
can be exploited by malicious users to compromise a vulnerable system
and by malicious people to conduct script insertion and SQL injection
attacks.
Full Advisory:
http://secunia.com/advisories/19435/
--
[SA19422] vCounter "url" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-29
Aliaksandr Hartsuyeu has discovered a vulnerability in vCounter, which
can be exploited by malicious people to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19422/
--
[SA19421] Pixel Motion Blog SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-28
Morocco Security Team has discovered two vulnerabilities in Pixel
Motion Blog, which can be exploited by malicious people to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/19421/
--
[SA19420] VSNS Lemon Multiple Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, Cross Site Scripting, Manipulation of
data
Released: 2006-03-28
Aliaksandr Hartsuyeu has discovered multiple vulnerabilities in VSNS
Lemon, which can be exploited by malicious people to conduct script
insertion attacks, to bypass certain authentication, and to conduct SQL
injection attack.
Full Advisory:
http://secunia.com/advisories/19420/
--
[SA19414] G-Book "g_message" Script Insertion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
matrix_killer has discovered a vulnerability in G-Book, which can be
exploited by malicious people to conduct script insertion attacks.
Full Advisory:
http://secunia.com/advisories/19414/
--
[SA19413] Null news Multiple SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-29
Aliaksandr Hartsuyeu has discovered some vulnerabilities in Null news,
which can be exploited by malicious people to conduct SQL injection
attacks.
Full Advisory:
http://secunia.com/advisories/19413/
--
[SA19410] TWiki Restricted Content Access and Denial of Service
Critical: Moderately critical
Where: From remote
Impact: Security Bypass, DoS
Released: 2006-03-27
A vulnerability and a security issue have been reported in TWiki, which
can be exploited by malicious people to cause a DoS (Denial of Service)
and bypass certain security restrictions.
Full Advisory:
http://secunia.com/advisories/19410/
--
[SA19403] Vihor Design Local File Disclosure Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of system information, Exposure of sensitive
information
Released: 2006-03-27
Patriotic Hackers has discovered a vulnerability in Vihor Design, which
can be exploited by malicious people to gain knowledge of potentially
sensitive information.
Full Advisory:
http://secunia.com/advisories/19403/
--
[SA19400] WEBalbum Local File Inclusion Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2006-03-27
rgod has discovered a vulnerability in WEBalbum, which can be exploited
by malicious people to gain knowledge of potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/19400/
--
[SA19392] Mambo AkoComment Module SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-28
Stefan Keller has reported two vulnerabilities in the AkoComment module
for Mambo, which can be exploited by malicious people to conduct SQL
injection attacks.
Full Advisory:
http://secunia.com/advisories/19392/
--
[SA19391] phpNewsManager Multiple SQL Injection Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-30
Aliaksandr Hartsuyeu has reported multiple vulnerabilities in
phpNewsManager, which can be exploited by malicious people to conduct
SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19391/
--
[SA19388] Vavoom Two Denial of Service Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: DoS
Released: 2006-03-27
Luigi Auriemma has reported two vulnerabilities in Vavoom, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Full Advisory:
http://secunia.com/advisories/19388/
--
[SA19384] phpPgAds / phpAdsNew Two Vulnerabilities
Critical: Moderately critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
Two vulnerabilities have been reported in phpPgAds / phpAdsNew, which
can be exploited by malicious people to conduct cross-site scripting
and script insertion attacks.
Full Advisory:
http://secunia.com/advisories/19384/
--
[SA19382] Nuked-Klan "m" SQL Injection Vulnerability
Critical: Moderately critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-28
Moroccan Security Team has discovered a vulnerability in Nuked-Klan,
which can be exploited by malicious people to conduct SQL injection
attacks.
Full Advisory:
http://secunia.com/advisories/19382/
--
[SA19417] Veritas NetBackup Multiple Buffer Overflow Vulnerabilities
Critical: Moderately critical
Where: From local network
Impact: System access
Released: 2006-03-28
Multiple vulnerabilities have been reported in Veritas Netbackup, which
can be exploited by malicious people to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19417/
--
[SA19460] Explorer XP "chemin" Cross-Site Scripting and Directory
Traversal
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting, Exposure of system information
Released: 2006-03-30
Silitix has discovered a vulnerability and a weakness in Fabien
Gauharou Explorer XP, which can be exploited by malicious people to
disclose system information and conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19460/
--
[SA19445] Arab Portal "title" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-29
stranger-killer has discovered a vulnerability in Arab Portal, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/19445/
--
[SA19443] PHP Script Index "search" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-29
Preddy has reported a vulnerability in PHP Script Index, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19443/
--
[SA19440] PHP Classifieds "searchword" Cross-Site Scripting
Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-29
Preddy has discovered a vulnerability in PHP Classifieds, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19440/
--
[SA19434] Connect Daily Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-28
r0t has discovered some vulnerabilities in Connect Daily, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19434/
--
[SA19432] CONTROLzx HMS Multiple Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-28
r0t has reported multiple vulnerabilities in CONTROLzx HMS, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/19432/
--
[SA19431] ActiveCampaign SupportTrio "terms" Cross-Site Scripting
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting, Exposure of system information
Released: 2006-03-28
r0t has reported a vulnerability in ActiveCampaign SupportTrio, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/19431/
--
[SA19423] Greymatter gm-upload.cgi File Upload Vulnerability
Critical: Less critical
Where: From remote
Impact: System access
Released: 2006-03-28
syst3m_f4ult has discovered a vulnerability in Greymatter, which can be
exploited by malicious users to compromise a vulnerable system.
Full Advisory:
http://secunia.com/advisories/19423/
--
[SA19419] phpCOIN "fs" Cross-Site Scripting Vulnerabilities
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-28
r0t has discovered some vulnerabilities in phpCOIN, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19419/
--
[SA19412] PHP Ticket "frm_search_in" SQL Injection Vulnerability
Critical: Less critical
Where: From remote
Impact: Manipulation of data
Released: 2006-03-27
undefined1_ has discovered a vulnerability in PHP Ticket, which can be
exploited by malicious users to conduct SQL injection attacks.
Full Advisory:
http://secunia.com/advisories/19412/
--
[SA19411] TFT Gallery "passwd" Exposure of User Credentials
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2006-03-27
undefined1_ has discovered a security issue in TFT Gallery, which can
be exploited by malicious people to disclose sensitive information.
Full Advisory:
http://secunia.com/advisories/19411/
--
[SA19409] phpmyfamily "name" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting, Exposure of system information
Released: 2006-03-28
matrix_killer has discovered a vulnerability in phpmyfamily, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/19409/
--
[SA19393] Calender Express Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
Pratiksha Doshi has reported a vulnerability in Calendar Express, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/19393/
--
[SA19383] PHP "html_entity_decode()" Information Disclosure
Vulnerability
Critical: Less critical
Where: From remote
Impact: Exposure of sensitive information
Released: 2006-03-29
A vulnerability has been discovered in PHP, which can be exploited by
malicious people to gain knowledge of potentially sensitive
information.
Full Advisory:
http://secunia.com/advisories/19383/
--
[SA19379] CoMoblog "img.php" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-24
FarhadKey has discovered a vulnerability in CoMoblog, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19379/
--
[SA19372] Meeting Reserve Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-27
Pratiksha Doshi has reported a vulnerability in Meeting Reserve, which
can be exploited by malicious people to conduct cross-site scripting
attacks.
Full Advisory:
http://secunia.com/advisories/19372/
--
[SA19370] EasyMoblog "img.php" Cross-Site Scripting Vulnerability
Critical: Less critical
Where: From remote
Impact: Cross Site Scripting
Released: 2006-03-24
FarhadKey has discovered a vulnerability in EasyMoblog, which can be
exploited by malicious people to conduct cross-site scripting attacks.
Full Advisory:
http://secunia.com/advisories/19370/
========================================================================
Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Subscribe:
http://secunia.com/secunia_weekly_summary/
Contact details:
Web : http://secunia.com/
E-mail : support at secunia.com
Tel : +45 70 20 51 44
Fax : +45 70 20 51 45
More information about the ISN
mailing list