Sax2 Network Intrusion Detection System

A professional intrusion detection and prevention  system (NIDS) which excels at real-time packet capture, 24/7 network monitor, advanced protocol analysis and automatic expert detection.  

  Name: CVE-2007-0001

Description:
The file watch implementation in the audit subsystem (auditctl -w) in the Red Hat Enterprise Linux (RHEL) 4 kernel 2.6.9 allows local users to cause a denial of service (kernel panic) by replacing a watched file, which does not cause the watch on the old inode to be dropped.

Status: Candidate
Phase: Assigned (20061219)
Reference: MISC:http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=223129
Reference: REDHAT:RHSA-2007:0085
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0085.html
Reference: BID:22737
Reference: URL:http://www.securityfocus.com/bid/22737
Reference: SECTRACK:1017705
Reference: URL:http://www.securitytracker.com/id?1017705
Reference: SECUNIA:24300
Reference: URL:http://secunia.com/advisories/24300

Votes:

Description:
Multiple heap-based buffer overflows in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allow user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file in which values to loop counters are not properly handled in the (1) WP3TablesGroup::_readContents and (2) WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup functions. NOTE: the integer overflow has been split into CVE-2007-1466.

Status: Candidate
Phase: Assigned (20061219)
Reference: IDEFENSE:20070316 Multiple Vendor libwpd Multiple Buffer Overflow Vulnerabilities
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=490
Reference: BUGTRAQ:20070316 rPSA-2007-0057-1 libwpd
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/463033/100/0/threaded
Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?release_id=494122
Reference: DEBIAN:DSA-1268
Reference: URL:http://www.debian.org/security/2007/dsa-1268
Reference: DEBIAN:DSA-1270
Reference: URL:http://www.debian.org/security/2007/dsa-1270
Reference: FEDORA:FEDORA-2007-350
Reference: URL:http://fedoranews.org/cms/node/2805
Reference: GENTOO:GLSA-200704-07
Reference: URL:http://security.gentoo.org/glsa/glsa-200704-07.xml
Reference: GENTOO:GLSA-200704-12
Reference: URL:http://www.gentoo.org/security/en/glsa/glsa-200704-12.xml
Reference: MANDRIVA:MDKSA-2007:063
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:063
Reference: MANDRIVA:MDKSA-2007:064
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:064
Reference: REDHAT:RHSA-2007:0055
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0055.html
Reference: SLACKWARE:SSA-2007-085-02
Reference: URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.399659
Reference: SUNALERT:102863
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102863-1
Reference: SUSE:SUSE-SA:2007:023
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Mar/0007.html
Reference: UBUNTU:USN-437-1
Reference: URL:http://www.ubuntu.com/usn/usn-437-1
Reference: BID:23006
Reference: URL:http://www.securityfocus.com/bid/23006
Reference: FRSIRT:ADV-2007-0976
Reference: URL:http://www.frsirt.com/english/advisories/2007/0976
Reference: FRSIRT:ADV-2007-1032
Reference: URL:http://www.frsirt.com/english/advisories/2007/1032
Reference: FRSIRT:ADV-2007-1339
Reference: URL:http://www.frsirt.com/english/advisories/2007/1339
Reference: SECTRACK:1017789
Reference: URL:http://www.securitytracker.com/id?1017789
Reference: SECUNIA:24507
Reference: URL:http://secunia.com/advisories/24507
Reference: SECUNIA:24557
Reference: URL:http://secunia.com/advisories/24557
Reference: SECUNIA:24572
Reference: URL:http://secunia.com/advisories/24572
Reference: SECUNIA:24580
Reference: URL:http://secunia.com/advisories/24580
Reference: SECUNIA:24573
Reference: URL:http://secunia.com/advisories/24573
Reference: SECUNIA:24581
Reference: URL:http://secunia.com/advisories/24581
Reference: SECUNIA:24593
Reference: URL:http://secunia.com/advisories/24593
Reference: SECUNIA:24465
Reference: URL:http://secunia.com/advisories/24465
Reference: SECUNIA:24794
Reference: URL:http://secunia.com/advisories/24794
Reference: SECUNIA:24856
Reference: URL:http://secunia.com/advisories/24856
Reference: SECUNIA:24906
Reference: URL:http://secunia.com/advisories/24906
Reference: SECUNIA:24588
Reference: URL:http://secunia.com/advisories/24588
Reference: SECUNIA:24613
Reference: URL:http://secunia.com/advisories/24613
Reference: SECUNIA:24591
Reference: URL:http://secunia.com/advisories/24591

Votes:

Description:
pam_unix.so in Linux-PAM 0.99.7.0 allows context-dependent attackers to log into accounts whose password hash, as stored in /etc/passwd or /etc/shadow, has only two characters.

Status: Candidate
Phase: Assigned (20061219)
Reference: MLIST:[fedora-devel-list] 20070122 Re: rawhide report: 20070120 changes
Reference: URL:http://www.redhat.com/archives/fedora-devel-list/2007-January/msg01271.html
Reference: MLIST:[fedora-devel-list] 20070122 Re: rawhide report: 20070120 changes
Reference: URL:http://www.redhat.com/archives/fedora-devel-list/2007-January/msg01277.html
Reference: MLIST:[pam-list] 20070123 Linux-PAM 0.99.7.1 released
Reference: URL:https://www.redhat.com/archives/pam-list/2007-January/msg00017.html
Reference: SUSE:SUSE-SR:2007:003
Reference: URL:http://www.novell.com/linux/security/advisories/2007_3_sr.html
Reference: BID:22204
Reference: URL:http://www.securityfocus.com/bid/22204
Reference: FRSIRT:ADV-2007-0323
Reference: URL:http://www.frsirt.com/english/advisories/2007/0323
Reference: SECUNIA:23858
Reference: URL:http://secunia.com/advisories/23858
Reference: XF:linuxpam-pamunix-security-bypass(31739)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31739

Votes:

Description:
The NFS client implementation in the kernel in Red Hat Enterprise Linux (RHEL) 3, when a filesystem is mounted with the noacl option, checks permissions for the open system call via vfs_permission (mode bits) data rather than an NFS ACCESS call to the server, which allows local client processes to obtain a false success status from open calls that the server would deny, and possibly obtain sensitive information about file permissions on the server, as demonstrated in a root_squash environment. NOTE: it is uncertain whether any scenarios involving this issue cross privilege boundaries.

Status: Candidate
Phase: Assigned (20061219)
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=199715

Votes:

Description:
Multiple buffer overflows in the (1) read and (2) write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 allow local users to gain privileges.

Status: Candidate
Phase: Assigned (20061219)
Reference: BUGTRAQ:20070309 Buffer Overflow in Linux Drivers for Omnikey CardMan 4040 (CVE-2007-0005)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/462300/100/0/threaded
Reference: BUGTRAQ:20070615 rPSA-2007-0124-1 kernel xen
Reference: URL:http://www.securityfocus.com/archive/1/471457
Reference: CONFIRM:http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.21-rc3
Reference: CONFIRM:https://issues.rpath.com/browse/RPL-1035
Reference: DEBIAN:DSA-1286
Reference: URL:http://www.debian.org/security/2007/dsa-1286
Reference: FEDORA:FEDORA-2007-335
Reference: URL:http://fedoranews.org/cms/node/2787
Reference: FEDORA:FEDORA-2007-336
Reference: URL:http://fedoranews.org/cms/node/2788
Reference: MANDRIVA:MDKSA-2007:078
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:078
Reference: REDHAT:RHSA-2007:0099
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0099.html
Reference: UBUNTU:USN-486-1
Reference: URL:http://www.ubuntu.com/usn/usn-486-1
Reference: UBUNTU:USN-489-1
Reference: URL:http://www.ubuntu.com/usn/usn-489-1
Reference: BID:22870
Reference: URL:http://www.securityfocus.com/bid/22870
Reference: FRSIRT:ADV-2007-0872
Reference: URL:http://www.frsirt.com/english/advisories/2007/0872
Reference: OSVDB:33023
Reference: URL:http://www.osvdb.org/33023
Reference: SECUNIA:24436
Reference: URL:http://secunia.com/advisories/24436
Reference: SECUNIA:24518
Reference: URL:http://secunia.com/advisories/24518
Reference: SECUNIA:24777
Reference: URL:http://secunia.com/advisories/24777
Reference: SECUNIA:24901
Reference: URL:http://secunia.com/advisories/24901
Reference: SECUNIA:25078
Reference: URL:http://secunia.com/advisories/25078
Reference: SECUNIA:25691
Reference: URL:http://secunia.com/advisories/25691
Reference: SECUNIA:26133
Reference: URL:http://secunia.com/advisories/26133
Reference: SECUNIA:26139
Reference: URL:http://secunia.com/advisories/26139
Reference: XF:kernel-cardman4040drivers-bo(32880)
Reference: URL:http://xforce.iss.net/xforce/xfdb/32880

Votes:

Description:
The key serial number collision avoidance code in the key_alloc_serial function in Linux kernel 2.6.9 up to 2.6.20 allows local users to cause a denial of service (crash) via vectors that trigger a null dereference, as originally reported as "spinlock CPU recursion."

Status: Candidate
Phase: Assigned (20061219)
Reference: BUGTRAQ:20070615 rPSA-2007-0124-1 kernel xen
Reference: URL:http://www.securityfocus.com/archive/1/471457
Reference: CONFIRM:http://bugzilla.kernel.org/show_bug.cgi?id=7727
Reference: CONFIRM:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=227495
Reference: CONFIRM:https://issues.rpath.com/browse/RPL-1097
Reference: MANDRIVA:MDKSA-2007:047
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:047
Reference: MANDRIVA:MDKSA-2007:060
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:060
Reference: REDHAT:RHSA-2007:0085
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0085.html
Reference: REDHAT:RHSA-2007:0099
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0099.html
Reference: SUSE:SUSE-SA:2007:021
Reference: URL:http://www.novell.com/linux/security/advisories/2007_21_kernel.html
Reference: UBUNTU:USN-451-1
Reference: URL:http://www.ubuntu.com/usn/usn-451-1
Reference: BID:22539
Reference: URL:http://www.securityfocus.com/bid/22539
Reference: SECUNIA:24109
Reference: URL:http://secunia.com/advisories/24109
Reference: SECUNIA:24259
Reference: URL:http://secunia.com/advisories/24259
Reference: SECUNIA:24300
Reference: URL:http://secunia.com/advisories/24300
Reference: SECUNIA:24429
Reference: URL:http://secunia.com/advisories/24429
Reference: SECUNIA:24482
Reference: URL:http://secunia.com/advisories/24482
Reference: SECUNIA:24547
Reference: URL:http://secunia.com/advisories/24547
Reference: SECUNIA:24752
Reference: URL:http://secunia.com/advisories/24752
Reference: SECUNIA:25691
Reference: URL:http://secunia.com/advisories/25691

Votes:

Description:
gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.

Status: Candidate
Phase: Assigned (20061219)
Reference: CONFIRM:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=223233
Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?group_id=192&release_id=487446
Reference: FEDORA:FEDORA-2007-256
Reference: URL:http://fedoranews.org/cms/node/2725
Reference: MANDRIVA:MDKSA-2007:046
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:046
Reference: BID:22610
Reference: URL:http://www.securityfocus.com/bid/22610
Reference: FRSIRT:ADV-2007-0653
Reference: URL:http://www.frsirt.com/english/advisories/2007/0653
Reference: SECUNIA:24225
Reference: URL:http://secunia.com/advisories/24225
Reference: SECUNIA:24226
Reference: URL:http://secunia.com/advisories/24226
Reference: SECUNIA:24317
Reference: URL:http://secunia.com/advisories/24317
Reference: XF:gnucash-symlink(32558)
Reference: URL:http://xforce.iss.net/xforce/xfdb/32558

Votes:

Description:
Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the "Master Secret", which results in a heap-based overflow.

Status: Candidate
Phase: Assigned (20061219)
Reference: BUGTRAQ:20070226 rPSA-2007-0040-1 firefox
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/461336/100/0/threaded
Reference: BUGTRAQ:20070303 rPSA-2007-0040-3 firefox thunderbird
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/461809/100/0/threaded
Reference: CONFIRM:http://www.mozilla.org/security/announce/2007/mfsa2007-06.html
Reference: IDEFENSE:20070223 Mozilla Network Security Services SSLv2 Client Integer Underflow Vulnerability
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482
Reference: MISC:https://bugzilla.mozilla.org/show_bug.cgi?id=364319
Reference: CONFIRM:https://issues.rpath.com/browse/RPL-1081
Reference: CONFIRM:https://issues.rpath.com/browse/RPL-1103
Reference: DEBIAN:DSA-1336
Reference: URL:http://www.debian.org/security/2007/dsa-1336
Reference: FEDORA:FEDORA-2007-278
Reference: URL:http://fedoranews.org/cms/node/2709
Reference: FEDORA:FEDORA-2007-279
Reference: URL:http://fedoranews.org/cms/node/2711
Reference: FEDORA:FEDORA-2007-281
Reference: URL:http://fedoranews.org/cms/node/2713
Reference: FEDORA:FEDORA-2007-293
Reference: URL:http://fedoranews.org/cms/node/2728
Reference: FEDORA:FEDORA-2007-308
Reference: URL:http://fedoranews.org/cms/node/2747
Reference: FEDORA:FEDORA-2007-309
Reference: URL:http://fedoranews.org/cms/node/2749
Reference: GENTOO:GLSA-200703-18
Reference: URL:http://security.gentoo.org/glsa/glsa-200703-18.xml
Reference: GENTOO:GLSA-200703-22
Reference: URL:http://www.gentoo.org/security/en/glsa/glsa-200703-22.xml
Reference: HP:HPSBUX02153
Reference: URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
Reference: HP:SSRT061181
Reference: URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
Reference: MANDRIVA:MDKSA-2007:050
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:050
Reference: MANDRIVA:MDKSA-2007:052
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:052
Reference: REDHAT:RHSA-2007:0079
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0079.html
Reference: REDHAT:RHSA-2007:0077
Reference: URL:http://rhn.redhat.com/errata/RHSA-2007-0077.html
Reference: REDHAT:RHSA-2007:0078
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0078.html
Reference: REDHAT:RHSA-2007:0097
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0097.html
Reference: REDHAT:RHSA-2007:0108
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0108.html
Reference: SGI:20070301-01-P
Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc
Reference: SGI:20070202-01-P
Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc
Reference: SLACKWARE:SSA:2007-066-03
Reference: URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851
Reference: SLACKWARE:SSA:2007-066-04
Reference: URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947
Reference: SLACKWARE:SSA:2007-066-05
Reference: URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
Reference: SUNALERT:102856
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1
Reference: SUNALERT:102945
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1
Reference: SUSE:SUSE-SA:2007:019
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
Reference: SUSE:SUSE-SA:2007:022
Reference: URL:http://www.novell.com/linux/security/advisories/2007_22_mozilla.html
Reference: UBUNTU:USN-428-1
Reference: URL:http://www.ubuntu.com/usn/usn-428-1
Reference: UBUNTU:USN-431-1
Reference: URL:http://www.ubuntu.com/usn/usn-431-1
Reference: CERT-VN:VU#377812
Reference: URL:http://www.kb.cert.org/vuls/id/377812
Reference: BID:22694
Reference: URL:http://www.securityfocus.com/bid/22694
Reference: FRSIRT:ADV-2007-0719
Reference: URL:http://www.frsirt.com/english/advisories/2007/0719
Reference: FRSIRT:ADV-2007-0718
Reference: URL:http://www.frsirt.com/english/advisories/2007/0718
Reference: FRSIRT:ADV-2007-1165
Reference: URL:http://www.frsirt.com/english/advisories/2007/1165
Reference: FRSIRT:ADV-2007-2141
Reference: URL:http://www.frsirt.com/english/advisories/2007/2141
Reference: OSVDB:32105
Reference: URL:http://www.osvdb.org/32105
Reference: SECTRACK:1017696
Reference: URL:http://www.securitytracker.com/id?1017696
Reference: SECUNIA:24238
Reference: URL:http://secunia.com/advisories/24238
Reference: SECUNIA:24252
Reference: URL:http://secunia.com/advisories/24252
Reference: SECUNIA:24253
Reference: URL:http://secunia.com/advisories/24253
Reference: SECUNIA:24277
Reference: URL:http://secunia.com/advisories/24277
Reference: SECUNIA:24287
Reference: URL:http://secunia.com/advisories/24287
Reference: SECUNIA:24290
Reference: URL:http://secunia.com/advisories/24290
Reference: SECUNIA:24205
Reference: URL:http://secunia.com/advisories/24205
Reference: SECUNIA:24328
Reference: URL:http://secunia.com/advisories/24328
Reference: SECUNIA:24333
Reference: URL:http://secunia.com/advisories/24333
Reference: SECUNIA:24343
Reference: URL:http://secunia.com/advisories/24343
Reference: SECUNIA:24320
Reference: URL:http://secunia.com/advisories/24320
Reference: SECUNIA:24293
Reference: URL:http://secunia.com/advisories/24293
Reference: SECUNIA:24395
Reference: URL:http://secunia.com/advisories/24395
Reference: SECUNIA:24384
Reference: URL:http://secunia.com/advisories/24384
Reference: SECUNIA:24389
Reference: URL:http://secunia.com/advisories/24389
Reference: SECUNIA:24410
Reference: URL:http://secunia.com/advisories/24410
Reference: SECUNIA:24522
Reference: URL:http://secunia.com/advisories/24522
Reference: SECUNIA:24562
Reference: URL:http://secunia.com/advisories/24562
Reference: SECUNIA:24703
Reference: URL:http://secunia.com/advisories/24703
Reference: SECUNIA:24650
Reference: URL:http://secunia.com/advisories/24650
Reference: SECUNIA:25597
Reference: URL:http://secunia.com/advisories/25597
Reference: SECUNIA:24406
Reference: URL:http://secunia.com/advisories/24406
Reference: SECUNIA:24455
Reference: URL:http://secunia.com/advisories/24455
Reference: SECUNIA:24456
Reference: URL:http://secunia.com/advisories/24456
Reference: SECUNIA:24457
Reference: URL:http://secunia.com/advisories/24457
Reference: SECUNIA:24342
Reference: URL:http://secunia.com/advisories/24342
Reference: SECUNIA:25588
Reference: URL:http://secunia.com/advisories/25588
Reference: XF:nss-mastersecret-bo(32666)
Reference: URL:http://xforce.iss.net/xforce/xfdb/32666

Votes:

Description:
Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via invalid "Client Master Key" length values.

Status: Candidate
Phase: Assigned (20061219)
Reference: BUGTRAQ:20070226 rPSA-2007-0040-1 firefox
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/461336/100/0/threaded
Reference: BUGTRAQ:20070303 rPSA-2007-0040-3 firefox thunderbird
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/461809/100/0/threaded
Reference: CONFIRM:http://www.mozilla.org/security/announce/2007/mfsa2007-06.html
Reference: IDEFENSE:20070223 Mozilla Network Security Services SSLv2 Server Stack Overflow Vulnerability
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483
Reference: MISC:https://bugzilla.mozilla.org/show_bug.cgi?id=364323
Reference: CONFIRM:https://issues.rpath.com/browse/RPL-1081
Reference: CONFIRM:https://issues.rpath.com/browse/RPL-1103
Reference: DEBIAN:DSA-1336
Reference: URL:http://www.debian.org/security/2007/dsa-1336
Reference: FEDORA:FEDORA-2007-278
Reference: URL:http://fedoranews.org/cms/node/2709
Reference: FEDORA:FEDORA-2007-279
Reference: URL:http://fedoranews.org/cms/node/2711
Reference: FEDORA:FEDORA-2007-308
Reference: URL:http://fedoranews.org/cms/node/2747
Reference: FEDORA:FEDORA-2007-309
Reference: URL:http://fedoranews.org/cms/node/2749
Reference: GENTOO:GLSA-200703-18
Reference: URL:http://security.gentoo.org/glsa/glsa-200703-18.xml
Reference: GENTOO:GLSA-200703-22
Reference: URL:http://www.gentoo.org/security/en/glsa/glsa-200703-22.xml
Reference: HP:HPSBUX02153
Reference: URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
Reference: HP:SSRT061181
Reference: URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
Reference: MANDRIVA:MDKSA-2007:050
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:050
Reference: MANDRIVA:MDKSA-2007:052
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:052
Reference: REDHAT:RHSA-2007:0079
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0079.html
Reference: REDHAT:RHSA-2007:0077
Reference: URL:http://rhn.redhat.com/errata/RHSA-2007-0077.html
Reference: REDHAT:RHSA-2007:0078
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0078.html
Reference: REDHAT:RHSA-2007:0097
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0097.html
Reference: REDHAT:RHSA-2007:0108
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0108.html
Reference: SGI:20070301-01-P
Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc
Reference: SGI:20070202-01-P
Reference: URL:ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc
Reference: SLACKWARE:SSA:2007-066-03
Reference: URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851
Reference: SLACKWARE:SSA:2007-066-04
Reference: URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947
Reference: SLACKWARE:SSA:2007-066-05
Reference: URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
Reference: SUNALERT:102856
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1
Reference: SUNALERT:102945
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1
Reference: SUSE:SUSE-SA:2007:019
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
Reference: SUSE:SUSE-SA:2007:022
Reference: URL:http://www.novell.com/linux/security/advisories/2007_22_mozilla.html
Reference: UBUNTU:USN-428-1
Reference: URL:http://www.ubuntu.com/usn/usn-428-1
Reference: UBUNTU:USN-431-1
Reference: URL:http://www.ubuntu.com/usn/usn-431-1
Reference: CERT-VN:VU#592796
Reference: URL:http://www.kb.cert.org/vuls/id/592796
Reference: FRSIRT:ADV-2007-0719
Reference: URL:http://www.frsirt.com/english/advisories/2007/0719
Reference: FRSIRT:ADV-2007-0718
Reference: URL:http://www.frsirt.com/english/advisories/2007/0718
Reference: FRSIRT:ADV-2007-1165
Reference: URL:http://www.frsirt.com/english/advisories/2007/1165
Reference: FRSIRT:ADV-2007-2141
Reference: URL:http://www.frsirt.com/english/advisories/2007/2141
Reference: OSVDB:32106
Reference: URL:http://www.osvdb.org/32106
Reference: SECTRACK:1017696
Reference: URL:http://www.securitytracker.com/id?1017696
Reference: SECUNIA:24253
Reference: URL:http://secunia.com/advisories/24253
Reference: SECUNIA:24277
Reference: URL:http://secunia.com/advisories/24277
Reference: SECUNIA:24287
Reference: URL:http://secunia.com/advisories/24287
Reference: SECUNIA:24290
Reference: URL:http://secunia.com/advisories/24290
Reference: SECUNIA:24333
Reference: URL:http://secunia.com/advisories/24333
Reference: SECUNIA:24343
Reference: URL:http://secunia.com/advisories/24343
Reference: SECUNIA:24293
Reference: URL:http://secunia.com/advisories/24293
Reference: SECUNIA:24395
Reference: URL:http://secunia.com/advisories/24395
Reference: SECUNIA:24384
Reference: URL:http://secunia.com/advisories/24384
Reference: SECUNIA:24389
Reference: URL:http://secunia.com/advisories/24389
Reference: SECUNIA:24410
Reference: URL:http://secunia.com/advisories/24410
Reference: SECUNIA:24522
Reference: URL:http://secunia.com/advisories/24522
Reference: SECUNIA:24562
Reference: URL:http://secunia.com/advisories/24562
Reference: SECUNIA:24703
Reference: URL:http://secunia.com/advisories/24703
Reference: SECUNIA:24650
Reference: URL:http://secunia.com/advisories/24650
Reference: SECUNIA:25597
Reference: URL:http://secunia.com/advisories/25597
Reference: SECUNIA:24406
Reference: URL:http://secunia.com/advisories/24406
Reference: SECUNIA:24455
Reference: URL:http://secunia.com/advisories/24455
Reference: SECUNIA:24456
Reference: URL:http://secunia.com/advisories/24456
Reference: SECUNIA:24457
Reference: URL:http://secunia.com/advisories/24457
Reference: SECUNIA:24342
Reference: URL:http://secunia.com/advisories/24342
Reference: SECUNIA:25588
Reference: URL:http://secunia.com/advisories/25588
Reference: XF:nss-clientmasterkey-bo(32663)
Reference: URL:http://xforce.iss.net/xforce/xfdb/32663

Votes:

Description:
The GdkPixbufLoader function in GIMP ToolKit (GTK+) in GTK 2 (gtk2) before 2.4.13 allows context-dependent attackers to cause a denial of service (crash) via a malformed image file.

Status: Candidate
Phase: Assigned (20061219)
Reference: CONFIRM:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218932
Reference: CONFIRM:https://issues.rpath.com/browse/RPL-984
Reference: DEBIAN:DSA-1256
Reference: URL:http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00011.html
Reference: MANDRIVA:MDKSA-2007:039
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:039
Reference: REDHAT:RHSA-2007:0019
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0019.html
Reference: SUSE:SUSE-SR:2007:002
Reference: URL:http://www.novell.com/linux/security/advisories/2007_02_sr.html
Reference: UBUNTU:USN-415-1
Reference: URL:http://www.ubuntu.com/usn/usn-415-1
Reference: BID:22209
Reference: URL:http://www.securityfocus.com/bid/22209
Reference: FRSIRT:ADV-2007-0331
Reference: URL:http://www.frsirt.com/english/advisories/2007/0331
Reference: SECTRACK:1017552
Reference: URL:http://securitytracker.com/id?1017552
Reference: SECUNIA:23884
Reference: URL:http://secunia.com/advisories/23884
Reference: SECUNIA:23933
Reference: URL:http://secunia.com/advisories/23933
Reference: SECUNIA:23935
Reference: URL:http://secunia.com/advisories/23935
Reference: SECUNIA:24010
Reference: URL:http://secunia.com/advisories/24010
Reference: SECUNIA:24006
Reference: URL:http://secunia.com/advisories/24006
Reference: SECUNIA:24095
Reference: URL:http://secunia.com/advisories/24095
Reference: SECUNIA:23984
Reference: URL:http://secunia.com/advisories/23984

Votes:

Description:
The web portal interface in Citrix Access Gateway (aka Citrix Advanced Access Control) before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or browser cache.

Status: Candidate
Phase: Assigned (20070101)
Reference: BUGTRAQ:20071022 Corsaire Security Advisory - Citrix Access Gateway session ID disclosure issue
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/482626/100/100/threaded
Reference: CONFIRM:http://support.citrix.com/article/CTX112803
Reference: CONFIRM:http://support.citrix.com/article/CTX113814
Reference: BID:24975
Reference: URL:http://www.securityfocus.com/bid/24975
Reference: FRSIRT:ADV-2007-2583
Reference: URL:http://www.frsirt.com/english/advisories/2007/2583
Reference: SECTRACK:1018435
Reference: URL:http://securitytracker.com/id?1018435
Reference: SECUNIA:26143
Reference: URL:http://secunia.com/advisories/26143
Reference: XF:citrix-access-unspeci-information-disclosure(35510)
Reference: URL:http://xforce.iss.net/xforce/xfdb/35510

Votes:

Description:
Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service (Internet Explorer crash) via an object tag with an encoded applet and an undefined name attribute, which triggers a NULL pointer dereference in jpiexp32.dll when the applet is decoded and passed to the JVM.

Status: Candidate
Phase: Assigned (20070101)
Reference: BUGTRAQ:20080108 Corsaire Security Advisory: Sun J2RE DoS issue
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/485942/100/0/threaded
Reference: BID:27185
Reference: URL:http://www.securityfocus.com/bid/27185
Reference: SREASON:3527
Reference: URL:http://securityreason.com/securityalert/3527
Reference: XF:sun-java-jpiexp32-dos(39549)
Reference: URL:http://xforce.iss.net/xforce/xfdb/39549

Votes:

Description:
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Status: Candidate
Phase: Assigned (20070101)

Votes:

Description:
ChainKey Java Code Protection allows attackers to decompile Java class files via a Java class loader with a modified defineClass method that saves the bytecode to a file before it is passed to the JVM.

Status: Candidate
Phase: Assigned (20070101)
Reference: BUGTRAQ:20070112 Corsaire Security Advisory: ChainKey Java Code Protection Bypass issue
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456712/100/0/threaded
Reference: BUGTRAQ:20070112 Re: Corsaire Security Advisory: ChainKey Java Code Protection Bypass issue
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456734/100/0/threaded

Votes:

Description:
Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI.

Status: Candidate
Phase: Assigned (20070101)
Reference: MISC:http://projects.info-pull.com/moab/MOAB-01-01-2007.html
Reference: MILW0RM:3064
Reference: URL:http://milw0rm.com/exploits/3064
Reference: MISC:http://landonf.bikemonkey.org/code/macosx/MOAB_Day_1.20070102060815.15950.zadder.local.html
Reference: MISC:http://isc.sans.org/diary.html?storyid=2094
Reference: MISC:http://secunia.com/blog/7/
Reference: CONFIRM:http://docs.info.apple.com/article.html?artnum=304989
Reference: APPLE:APPLE-SA-2007-01-23
Reference: URL:http://lists.apple.com/archives/Security-announce/2007/Jan/msg00000.html
Reference: CERT:TA07-005A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-005A.html
Reference: CERT-VN:VU#442497
Reference: URL:http://www.kb.cert.org/vuls/id/442497
Reference: BID:21829
Reference: URL:http://www.securityfocus.com/bid/21829
Reference: FRSIRT:ADV-2007-0001
Reference: URL:http://www.frsirt.com/english/advisories/2007/0001
Reference: OSVDB:31023
Reference: URL:http://www.osvdb.org/31023
Reference: SECTRACK:1017461
Reference: URL:http://securitytracker.com/id?1017461
Reference: SECUNIA:23540
Reference: URL:http://secunia.com/advisories/23540
Reference: XF:quicktime-rtsp-url-bo(31203)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31203

Votes:

Description:
Stack-based buffer overflow in MoviePlay 4.76 allows remote attackers to execute arbitrary code via a long filename in a LST file.

Status: Candidate
Phase: Assigned (20070102)
Reference: MILW0RM:4051
Reference: URL:http://www.milw0rm.com/exploits/4051
Reference: BID:21840
Reference: URL:http://www.securityfocus.com/bid/21840
Reference: SECUNIA:22959
Reference: URL:http://secunia.com/advisories/22959

Votes:

Description:
Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.

Status: Candidate
Phase: Assigned (20070102)
Reference: MLIST:[vlc-devel] 20070102 Security hole in VLC media player for Mac...
Reference: URL:http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html
Reference: MISC:http://projects.info-pull.com/moab/MOAB-02-01-2007.html
Reference: MISC:http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html
Reference: MISC:http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html
Reference: CONFIRM:http://trac.videolan.org/vlc/changeset/18481
Reference: CONFIRM:http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch
Reference: CONFIRM:http://www.videolan.org/sa0701.html
Reference: DEBIAN:DSA-1252
Reference: URL:http://www.debian.org/security/2007/dsa-1252
Reference: GENTOO:GLSA-200701-24
Reference: URL:http://security.gentoo.org/glsa/glsa-200701-24.xml
Reference: SUSE:SUSE-SA:2007:013
Reference: URL:http://www.novell.com/linux/security/advisories/2007_13_xine.html
Reference: BID:21852
Reference: URL:http://www.securityfocus.com/bid/21852
Reference: FRSIRT:ADV-2007-0026
Reference: URL:http://www.frsirt.com/english/advisories/2007/0026
Reference: SECTRACK:1017464
Reference: URL:http://securitytracker.com/id?1017464
Reference: SECUNIA:23592
Reference: URL:http://secunia.com/advisories/23592
Reference: SECUNIA:23829
Reference: URL:http://secunia.com/advisories/23829
Reference: SECUNIA:23910
Reference: URL:http://secunia.com/advisories/23910
Reference: SECUNIA:23971
Reference: URL:http://secunia.com/advisories/23971
Reference: XF:vlcmediaplayer-udp-format-string(31226)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31226

Votes:

Description:
Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. NOTE: the products include (1) NCTsoft NCTAudioStudio, NCTAudioEditor, and NCTDialogicVoice; (2) Magic Audio Recorder, Music Editor, and Audio Converter; (3) Aurora Media Workshop; DB Audio Mixer And Editor; (4) J. Hepple Products including Fx Audio Editor and others; (5) EXPStudio Audio Editor; (6) iMesh; (7) Quikscribe; (8) RMBSoft AudioConvert and SoundEdit Pro 2.1; (9) CDBurnerXP; (10) Code-it Software Wave MP3 Editor and aBasic Editor; (11) Movavi VideoMessage, DVD to iPod, and others; (12) SoftDiv Software Dexster, iVideoMAX, and others; (13) Sienzo Digital Music Mentor (DMM); (14) MP3 Normalizer; (15) Roemer Software FREE and Easy Hi-Q Recorder, and Easy Hi-Q Converter; (16) Audio Edit Magic; (17) Joshua Video and Audio Converter; (18) Virtual CD; (19) Cheetah CD and DVD Burner; (20) Mystik Media AudioEdit Deluxe, Blaze Media, and others; (21) Power Audio Editor; (22) DanDans Digital Media Full Audio Converter, Music Editing Master, and others; (23) Xrlly Software Text to Speech Makerand Arial Sound Recorder / Audio Converter; (24) Absolute Sound Recorder, Video to Audio Converter, and MP3 Splitter; (25) Easy Ringtone Maker; (26) RecordNRip; (27) McFunSoft iPod Audio Studio, Audio Recorder for Free, and others; (28) MP3 WAV Converter; (29) BearShare 6.0.2.26789; and (30) Oracle Siebel SimBuilder and CRM 7.x.

Status: Candidate
Phase: Assigned (20070102)
Reference: BUGTRAQ:20070124 Re: Secunia Research: NCTsoft Products NCTAudioFile2 ActiveXControl Buffer Overflow
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457965/100/200/threaded
Reference: BUGTRAQ:20070124 Secunia Research: NCTsoft Products NCTAudioFile2 ActiveX ControlBuffer Overflow
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457936/100/200/threaded
Reference: BUGTRAQ:20070124 Secunia Research: Sienzo Digital Music Mentor NCTAudioFile2ActiveX Control Buffer Overflow
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457940/100/200/threaded
Reference: MISC:http://secunia.com/secunia_research/2007-2/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-3/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-4/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-5/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-6/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-7/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-8/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-9/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-10/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-11/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-12/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-13/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-14/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-15/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-16/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-17/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-18/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-19/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-20/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-21/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-22/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-23/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-24/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-25/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-26/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-27/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-28/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-29/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-30/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-31/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-32/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-33/advisory/
Reference: MISC:http://secunia.com/secunia_research/2007-34/advisory/
Reference: MISC:http://secunia.com/blog/6/
Reference: MISC:http://secunia.com/secunia_research/2007-50/advisory/
Reference: CERT-VN:VU#292713
Reference: URL:http://www.kb.cert.org/vuls/id/292713
Reference: BID:22196
Reference: URL:http://www.securityfocus.com/bid/22196
Reference: BID:23892
Reference: URL:http://www.securityfocus.com/bid/23892
Reference: FRSIRT:ADV-2007-0310
Reference: URL:http://www.frsirt.com/english/advisories/2007/0310
Reference: SECUNIA:23475
Reference: URL:http://secunia.com/advisories/23475
Reference: SECUNIA:23493
Reference: URL:http://secunia.com/advisories/23493
Reference: SECUNIA:23532
Reference: URL:http://secunia.com/advisories/23532
Reference: SECUNIA:23543
Reference: URL:http://secunia.com/advisories/23543
Reference: SECUNIA:23551
Reference: URL:http://secunia.com/advisories/23551
Reference: SECUNIA:23552
Reference: URL:http://secunia.com/advisories/23552
Reference: SECUNIA:23553
Reference: URL:http://secunia.com/advisories/23553
Reference: SECUNIA:23557
Reference: URL:http://secunia.com/advisories/23557
Reference: SECUNIA:23568
Reference: URL:http://secunia.com/advisories/23568
Reference: SECUNIA:23485
Reference: URL:http://secunia.com/advisories/23485
Reference: SECUNIA:23495
Reference: URL:http://secunia.com/advisories/23495
Reference: SECUNIA:23511
Reference: URL:http://secunia.com/advisories/23511
Reference: SECUNIA:23516
Reference: URL:http://secunia.com/advisories/23516
Reference: SECUNIA:23530
Reference: URL:http://secunia.com/advisories/23530
Reference: SECUNIA:23534
Reference: URL:http://secunia.com/advisories/23534
Reference: SECUNIA:23535
Reference: URL:http://secunia.com/advisories/23535
Reference: SECUNIA:23536
Reference: URL:http://secunia.com/advisories/23536
Reference: SECUNIA:23541
Reference: URL:http://secunia.com/advisories/23541
Reference: SECUNIA:23542
Reference: URL:http://secunia.com/advisories/23542
Reference: SECUNIA:23544
Reference: URL:http://secunia.com/advisories/23544
Reference: SECUNIA:23546
Reference: URL:http://secunia.com/advisories/23546
Reference: SECUNIA:23548
Reference: URL:http://secunia.com/advisories/23548
Reference: SECUNIA:23550
Reference: URL:http://secunia.com/advisories/23550
Reference: SECUNIA:23554
Reference: URL:http://secunia.com/advisories/23554
Reference: SECUNIA:23558
Reference: URL:http://secunia.com/advisories/23558
Reference: SECUNIA:23560
Reference: URL:http://secunia.com/advisories/23560
Reference: SECUNIA:23561
Reference: URL:http://secunia.com/advisories/23561
Reference: SECUNIA:23562
Reference: URL:http://secunia.com/advisories/23562
Reference: SECUNIA:23565
Reference: URL:http://secunia.com/advisories/23565
Reference: SECUNIA:23745
Reference: URL:http://secunia.com/advisories/23745
Reference: SECUNIA:23753
Reference: URL:http://secunia.com/advisories/23753
Reference: SECUNIA:23795
Reference: URL:http://secunia.com/advisories/23795
Reference: SECUNIA:22922
Reference: URL:http://secunia.com/advisories/22922
Reference: SECUNIA:25993
Reference: URL:http://secunia.com/advisories/25993
Reference: SECUNIA:26046
Reference: URL:http://secunia.com/advisories/26046
Reference: SECUNIA:26100
Reference: URL:http://secunia.com/advisories/26100
Reference: SECUNIA:26101
Reference: URL:http://secunia.com/advisories/26101
Reference: SECUNIA:28407
Reference: URL:http://secunia.com/advisories/28407
Reference: XF:nctaudiofile2-multiple-bo(31707)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31707

Votes:

Description:
Multiple heap-based buffer overflows in rumpusd in Rumpus 5.1 and earlier (1) allow remote authenticated users to execute arbitrary code via a long LIST command and other unspecified requests to the FTP service, and (2) allow remote attackers to execute arbitrary code via unspecified requests to the HTTP service.

Status: Candidate
Phase: Assigned (20070102)
Reference: MISC:http://projects.info-pull.com/moab/MOAB-18-01-2007.html
Reference: SECUNIA:23842
Reference: URL:http://secunia.com/advisories/23842
Reference: XF:rumpus-ftp-service-bo(31594)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31594

Votes:

Description:
Heap-based buffer overflow in the SFTP protocol handler for Panic Transmit (Transmit.app) up to 3.5.5 allows remote attackers to execute arbitrary code via a long ftps:// URL.

Status: Candidate
Phase: Assigned (20070102)
Reference: MISC:http://projects.info-pull.com/moab/MOAB-19-01-2007.html
Reference: MILW0RM:3160
Reference: URL:http://milw0rm.com/exploits/3160
Reference: FRSIRT:ADV-2007-0273
Reference: URL:http://www.frsirt.com/english/advisories/2007/0273
Reference: SECUNIA:23861
Reference: URL:http://secunia.com/advisories/23861
Reference: XF:transmit-url-handler-bo(31673)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31673

Votes:

Description:
Format string vulnerability in Apple iChat 3.1.6 allows remote attackers to cause a denial of service (null pointer dereference and application crash) and possibly execute arbitrary code via format string specifiers in an aim:// URI.

Status: Candidate
Phase: Assigned (20070102)
Reference: MISC:http://projects.info-pull.com/moab/MOAB-20-01-2007.html
Reference: CONFIRM:http://docs.info.apple.com/article.html?artnum=305102
Reference: APPLE:APPLE-SA-2007-02-15
Reference: URL:http://lists.apple.com/archives/Security-announce/2007/Feb/msg00000.html
Reference: CERT:TA07-047A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-047A.html
Reference: CERT-VN:VU#794752
Reference: URL:http://www.kb.cert.org/vuls/id/794752
Reference: BID:22146
Reference: URL:http://www.securityfocus.com/bid/22146
Reference: FRSIRT:ADV-2007-0274
Reference: URL:http://www.frsirt.com/english/advisories/2007/0274
Reference: SECTRACK:1017661
Reference: URL:http://www.securitytracker.com/id?1017661
Reference: SECUNIA:24198
Reference: URL:http://secunia.com/advisories/24198
Reference: XF:ichat-aim-format-string(31679)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31679

Votes:

Description:
Untrusted search path vulnerability in writeconfig in Apple Mac OS X 10.4.8 allows local users to gain privileges via a modified PATH that points to a malicious launchctl program.

Status: Candidate
Phase: Assigned (20070102)
Reference: MISC:http://projects.info-pull.com/moab/MOAB-21-01-2007.html
Reference: CONFIRM:http://docs.info.apple.com/article.html?artnum=305391
Reference: APPLE:APPLE-SA-2007-04-19
Reference: URL:http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html
Reference: CERT:TA07-109A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-109A.html
Reference: BID:22148
Reference: URL:http://www.securityfocus.com/bid/22148
Reference: FRSIRT:ADV-2007-1470
Reference: URL:http://www.frsirt.com/english/advisories/2007/1470
Reference: FRSIRT:ADV-2007-0074
Reference: URL:http://www.frsirt.com/english/advisories/2007/0074
Reference: OSVDB:31605
Reference: URL:http://www.osvdb.org/31605
Reference: SECTRACK:1017941
Reference: URL:http://www.securitytracker.com/id?1017941
Reference: SECUNIA:23793
Reference: URL:http://secunia.com/advisories/23793
Reference: SECUNIA:24966
Reference: URL:http://secunia.com/advisories/24966
Reference: XF:macos-writeconfig-privilege-escalation(31677)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31677

Votes:

Description:
The CFUserNotificationSendRequest function in UserNotificationCenter.app in Apple Mac OS X 10.4.8, when used in combination with diskutil, allows local users to gain privileges via a malicious InputManager in Library/InputManagers in a user's home directory, which is executed when Cocoa applications attempt to notify the user.

Status: Candidate
Phase: Assigned (20070102)
Reference: MISC:http://projects.info-pull.com/moab/MOAB-22-01-2007.html
Reference: CONFIRM:http://docs.info.apple.com/article.html?artnum=305102
Reference: APPLE:APPLE-SA-2007-02-15
Reference: URL:http://lists.apple.com/archives/Security-announce/2007/Feb/msg00000.html
Reference: CERT:TA07-047A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-047A.html
Reference: CERT-VN:VU#315856
Reference: URL:http://www.kb.cert.org/vuls/id/315856
Reference: BID:22188
Reference: URL:http://www.securityfocus.com/bid/22188
Reference: FRSIRT:ADV-2007-0074
Reference: URL:http://www.frsirt.com/english/advisories/2007/0074
Reference: OSVDB:32695
Reference: URL:http://www.osvdb.org/32695
Reference: SECTRACK:1017542
Reference: URL:http://securitytracker.com/id?1017542
Reference: SECUNIA:23846
Reference: URL:http://secunia.com/advisories/23846
Reference: SECUNIA:24198
Reference: URL:http://secunia.com/advisories/24198
Reference: XF:macos-inputmanager-privilege-escalation(31676)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31676

Votes:

Description:
Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow, aka the "VML Buffer Overrun Vulnerability."

Status: Candidate
Phase: Assigned (20070103)
Reference: IDEFENSE:20070109 Microsoft Windows VML Element Integer Overflow Vulnerability
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=462
Reference: BUGTRAQ:20070116 MS07-004 VML Integer Overflow Exploit
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457053/100/0/threaded
Reference: BUGTRAQ:20070117 Re: MS07-004 VML Integer Overflow Exploit
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457164/100/0/threaded
Reference: CONFIRM:http://support.avaya.com/elmodocs2/security/ASA-2007-009.htm
Reference: HP:HPSBST02184
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: HP:SSRT071296
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: MS:MS07-004
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-004.mspx
Reference: MSKB:929969
Reference: URL:http://support.microsoft.com/?kbid=929969
Reference: CERT:TA07-009A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-009A.html
Reference: CERT-VN:VU#122084
Reference: URL:http://www.kb.cert.org/vuls/id/122084
Reference: BID:21930
Reference: URL:http://www.securityfocus.com/bid/21930
Reference: FRSIRT:ADV-2007-0105
Reference: URL:http://www.frsirt.com/english/advisories/2007/0105
Reference: FRSIRT:ADV-2007-0129
Reference: URL:http://www.frsirt.com/english/advisories/2007/0129
Reference: OSVDB:31250
Reference: URL:http://www.osvdb.org/31250
Reference: OVAL:oval:org.mitre.oval:def:1058
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1058
Reference: SECTRACK:1017489
Reference: URL:http://securitytracker.com/id?1017489
Reference: SECUNIA:23677
Reference: URL:http://secunia.com/advisories/23677
Reference: XF:ie-vml-record-bo(31287)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31287

Votes:

Description:
The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the the AfxOleSetEditMenu function in MFC42u.dll.

Status: Candidate
Phase: Assigned (20070103)
Reference: MS:MS07-012
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-012.mspx
Reference: CERT:TA07-044A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-044A.html
Reference: CERT-VN:VU#932041
Reference: URL:http://www.kb.cert.org/vuls/id/932041
Reference: BID:22476
Reference: URL:http://www.securityfocus.com/bid/22476
Reference: FRSIRT:ADV-2007-0581
Reference: URL:http://www.frsirt.com/english/advisories/2007/0581
Reference: OSVDB:31887
Reference: URL:http://www.osvdb.org/31887
Reference: OVAL:oval:org.mitre.oval:def:157
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:157
Reference: SECTRACK:1017638
Reference: URL:http://www.securitytracker.com/id?1017638
Reference: SECUNIA:24150
Reference: URL:http://secunia.com/advisories/24150

Votes:

Description:
The OLE Dialog component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption.

Status: Candidate
Phase: Assigned (20070103)
Reference: MS:MS07-011
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-011.mspx
Reference: CERT:TA07-044A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-044A.html
Reference: CERT-VN:VU#497756
Reference: URL:http://www.kb.cert.org/vuls/id/497756
Reference: BID:22483
Reference: URL:http://www.securityfocus.com/bid/22483
Reference: FRSIRT:ADV-2007-0580
Reference: URL:http://www.frsirt.com/english/advisories/2007/0580
Reference: OSVDB:31885
Reference: URL:http://www.osvdb.org/31885
Reference: OVAL:oval:org.mitre.oval:def:540
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:540
Reference: SECTRACK:1017637
Reference: URL:http://www.securitytracker.com/id?1017637
Reference: SECUNIA:24147
Reference: URL:http://secunia.com/advisories/24147

Votes:

Description:
Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via malformed IMDATA records that trigger memory corruption.

Status: Candidate
Phase: Assigned (20070103)
Reference: HP:HPSBST02184
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: HP:SSRT071296
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: MS:MS07-002
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx
Reference: CERT:TA07-009A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-009A.html
Reference: CERT-VN:VU#749964
Reference: URL:http://www.kb.cert.org/vuls/id/749964
Reference: BID:21856
Reference: URL:http://www.securityfocus.com/bid/21856
Reference: FRSIRT:ADV-2007-0103
Reference: URL:http://www.frsirt.com/english/advisories/2007/0103
Reference: OSVDB:31255
Reference: URL:http://www.osvdb.org/31255
Reference: OVAL:oval:org.mitre.oval:def:119
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:119
Reference: SECTRACK:1017487
Reference: URL:http://securitytracker.com/id?1017487

Votes:

Description:
Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file, which results in an "Improper Memory Access Vulnerability." NOTE: an early disclosure of this issue used CVE-2006-3432, but only CVE-2007-0028 should be used.

Status: Candidate
Phase: Assigned (20070103)
Reference: MISC:http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-30.html
Reference: MISC:http://www.fortinet.com/FortiGuardCenter/advisory/FGA-2007-01.html
Reference: HP:HPSBST02184
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: HP:SSRT071296
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: MS:MS07-002
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx
Reference: CERT:TA07-009A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-009A.html
Reference: CERT-VN:VU#493185
Reference: URL:http://www.kb.cert.org/vuls/id/493185
Reference: BID:21952
Reference: URL:http://www.securityfocus.com/bid/21952
Reference: FRSIRT:ADV-2007-0103
Reference: URL:http://www.frsirt.com/english/advisories/2007/0103
Reference: OSVDB:31249
Reference: URL:http://www.osvdb.org/31249
Reference: OVAL:oval:org.mitre.oval:def:768
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:768
Reference: SECTRACK:1017485
Reference: URL:http://securitytracker.com/id?1017485
Reference: SECUNIA:23676
Reference: URL:http://secunia.com/advisories/23676

Votes:

Description:
Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string, aka "Excel Malformed String Vulnerability."

Status: Candidate
Phase: Assigned (20070103)
Reference: HP:HPSBST02184
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: HP:SSRT071296
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: MS:MS07-002
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx
Reference: CERT:TA07-009A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-009A.html
Reference: BID:21877
Reference: URL:http://www.securityfocus.com/bid/21877
Reference: FRSIRT:ADV-2007-0103
Reference: URL:http://www.frsirt.com/english/advisories/2007/0103
Reference: OSVDB:31256
Reference: URL:http://www.osvdb.org/31256
Reference: OVAL:oval:org.mitre.oval:def:1102
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1102
Reference: SECTRACK:1017487
Reference: URL:http://securitytracker.com/id?1017487

Votes:

Description:
Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via an Excel file with an out-of-range Column field in certain BIFF8 record types, which references arbitrary memory.

Status: Candidate
Phase: Assigned (20070103)
Reference: IDEFENSE:20070109 Microsoft Excel Invalid Column Heap Corruption Vulnerability
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=460
Reference: HP:HPSBST02184
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: HP:SSRT071296
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: MS:MS07-002
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx
Reference: CERT:TA07-009A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-009A.html
Reference: CERT-VN:VU#302836
Reference: URL:http://www.kb.cert.org/vuls/id/302836
Reference: BID:21925
Reference: URL:http://www.securityfocus.com/bid/21925
Reference: FRSIRT:ADV-2007-0103
Reference: URL:http://www.frsirt.com/english/advisories/2007/0103
Reference: OSVDB:31257
Reference: URL:http://www.osvdb.org/31257
Reference: OVAL:oval:org.mitre.oval:def:323
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:323
Reference: SECTRACK:1017487
Reference: URL:http://securitytracker.com/id?1017487

Votes:

Description:
Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a BIFF8 spreadsheet with a PALETTE record that contains a large number of entries.

Status: Candidate
Phase: Assigned (20070103)
Reference: IDEFENSE:20070109 Microsoft Excel Long Palette Heap Overflow Vulnerability
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=461
Reference: HP:HPSBST02184
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: HP:SSRT071296
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: MS:MS07-002
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-002.mspx
Reference: CERT:TA07-009A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-009A.html
Reference: CERT-VN:VU#625532
Reference: URL:http://www.kb.cert.org/vuls/id/625532
Reference: BID:21922
Reference: URL:http://www.securityfocus.com/bid/21922
Reference: FRSIRT:ADV-2007-0103
Reference: URL:http://www.frsirt.com/english/advisories/2007/0103
Reference: OSVDB:31258
Reference: URL:http://www.osvdb.org/31258
Reference: OVAL:oval:org.mitre.oval:def:753
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:753
Reference: SECTRACK:1017487
Reference: URL:http://securitytracker.com/id?1017487

Votes:

Description:
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Status: Candidate
Phase: Assigned (20070103)

Votes:

Description:
Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal meeting request or ICS file.

Status: Candidate
Phase: Assigned (20070103)
Reference: HP:HPSBST02184
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: HP:SSRT071296
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: MS:MS07-003
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-003.mspx
Reference: CERT:TA07-009A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-009A.html
Reference: CERT-VN:VU#476900
Reference: URL:http://www.kb.cert.org/vuls/id/476900
Reference: BID:21931
Reference: URL:http://www.securityfocus.com/bid/21931
Reference: FRSIRT:ADV-2007-0104
Reference: URL:http://www.frsirt.com/english/advisories/2007/0104
Reference: OSVDB:31252
Reference: URL:http://www.osvdb.org/31252
Reference: OVAL:oval:org.mitre.oval:def:516
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:516
Reference: SECTRACK:1017488
Reference: URL:http://securitytracker.com/id?1017488
Reference: SECUNIA:23674
Reference: URL:http://secunia.com/advisories/23674

Votes:

Description:
Buffer overflow in the Advanced Search (Finder.exe) feature of Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted Outlook Saved Searches (OSS) file that triggers memory corruption, aka "Microsoft Outlook Advanced Find Vulnerability."

Status: Candidate
Phase: Assigned (20070103)
Reference: BUGTRAQ:20070111 Computer Terrorism (UK) :: Incident Response Centre - Microsoft Outlook Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456589/100/0/threaded
Reference: MISC:http://www.computerterrorism.com/research/ct09-01-2007.htm
Reference: HP:HPSBST02184
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: HP:SSRT071296
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457274/100/0/threaded
Reference: MS:MS07-003
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/MS07-003.mspx
Reference: CERT:TA07-009A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-009A.html
Reference: CERT-VN:VU#271860
Reference: URL:http://www.kb.cert.org/vuls/id/271860
Reference: BID:21936
Reference: URL:http://www.securityfocus.com/bid/21936
Reference: FRSIRT:ADV-2007-0104
Reference: URL:http://www.frsirt.com/english/advisories/2007/0104
Reference: OSVDB:31254
Reference: URL:http://www.osvdb.org/31254
Reference: OVAL:oval:org.mitre.oval:def:153
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:153
Reference: SECTRACK:1017488
Reference: URL:http://securitytracker.com/id?1017488
Reference: SECUNIA:23674
Reference: URL:http://secunia.com/advisories/23674

Votes:

Description:
Word (or Word Viewer) in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly handle data in a certain array, which allows user-assisted remote attackers to execute arbitrary code, aka the "Word Array Overflow Vulnerability."

Status: Candidate
Phase: Assigned (20070103)
Reference: HP:HPSBST02214
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/468871/100/200/threaded
Reference: HP:SSRT071422
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/468871/100/200/threaded
Reference: MS:MS07-024
Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms07-024.mspx
Reference: CERT:TA07-128A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-128A.html
Reference: CERT-VN:VU#260777
Reference: URL:http://www.kb.cert.org/vuls/id/260777
Reference: BID:23804
Reference: URL:http://www.securityfocus.com/bid/23804
Reference: FRSIRT:ADV-2007-1709
Reference: URL:http://www.frsirt.com/english/advisories/2007/1709
Reference: OSVDB:34387
Reference: URL:http://www.osvdb.org/34387
Reference: OVAL:oval:org.mitre.oval:def:1737
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1737
Reference: SECTRACK:1018013
Reference: URL:http://www.securitytracker.com/id?1018013

Votes:

Description:
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Status: Candidate
Phase: Assigned (20070103)

Votes:

Description:
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Status: Candidate
Phase: Assigned (20070103)

Votes:

Description:
Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.

Status: Candidate
Phase: Assigned (20070103)
Reference: BUGTRAQ:20070330 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/464269/100/0/threaded
Reference: BUGTRAQ:20070330 Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/464339/100/0/threaded
Reference: BUGTRAQ:20070331 RE: [Full-disclosure] 0-day ANI vulnerability in Microsoft Windows(CVE-2007-0038)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/464342/100/0/threaded
Reference: BUGTRAQ:20070331 Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/464340/100/0/threaded
Reference: BUGTRAQ:20070402 More information on ZERT patch for ANI 0day
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/464459/100/100/threaded
Reference: BUGTRAQ:20070402 MS announces out-of-band patch for ANI 0day
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/464460/100/100/threaded
Reference: FULLDISC:20070330 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)
Reference: URL:http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0470.html
Reference: MILW0RM:3634
Reference: URL:http://milw0rm.com/exploits/3634
Reference: MISC:http://www.determina.com/security_center/security_advisories/securityadvisory_0day_032907.asp
Reference: HP:HPSBST02206
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/466186/100/200/threaded
Reference: HP:SSRT071354
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/466186/100/200/threaded
Reference: MS:MS07-017
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/ms07-017.mspx
Reference: CERT:TA07-089A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-089A.html
Reference: CERT:TA07-093A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-093A.html
Reference: CERT:TA07-100A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-100A.html
Reference: CERT-VN:VU#191609
Reference: URL:http://www.kb.cert.org/vuls/id/191609
Reference: FRSIRT:ADV-2007-1215
Reference: URL:http://www.frsirt.com/english/advisories/2007/1215
Reference: OSVDB:33629
Reference: URL:http://www.osvdb.org/33629
Reference: OVAL:oval:org.mitre.oval:def:1854
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1854
Reference: SECUNIA:24659
Reference: URL:http://secunia.com/advisories/24659
Reference: SREASON:2542
Reference: URL:http://securityreason.com/securityalert/2542
Reference: XF:windows-ani-code-execution(33301)
Reference: URL:http://xforce.iss.net/xforce/xfdb/33301

Votes:

Description:
The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.

Status: Candidate
Phase: Assigned (20070103)
Reference: BUGTRAQ:20070508 Exchange Calendar MODPROPS Denial of Service (CVE-2007-0039)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/468047/100/0/threaded
Reference: FULLDISC:20070509 Exchange Calendar MODPROPS Denial of Service (CVE-2007-0039)
Reference: URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063232.html
Reference: MISC:http://www.determina.com/security.research/vulnerabilities/exchange-ical-modprops.html
Reference: HP:HPSBST02214
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/468871/100/200/threaded
Reference: HP:SSRT071422
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/468871/100/200/threaded
Reference: MS:MS07-026
Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms07-026.mspx
Reference: CERT:TA07-128A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-128A.html
Reference: BID:23808
Reference: URL:http://www.securityfocus.com/bid/23808
Reference: FRSIRT:ADV-2007-1711
Reference: URL:http://www.frsirt.com/english/advisories/2007/1711
Reference: OSVDB:34390
Reference: URL:http://www.osvdb.org/34390
Reference: OVAL:oval:org.mitre.oval:def:1593
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1593
Reference: SECTRACK:1018015
Reference: URL:http://www.securitytracker.com/id?1018015
Reference: SECUNIA:25183
Reference: URL:http://secunia.com/advisories/25183
Reference: XF:exchange-ical-dos(33888)
Reference: URL:http://xforce.iss.net/xforce/xfdb/33888

Votes:

Description:
The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4, Server 2003 SP1 and SP2, Server 2003 x64 Edition and SP2, and Server 2003 for Itanium-based Systems SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted LDAP request with an unspecified number of "convertible attributes."

Status: Candidate
Phase: Assigned (20070103)
Reference: ISS:20070710 Microsoft Windows Active Directory Remote Code Execution
Reference: URL:http://www.iss.net/threats/267.html
Reference: HP:SSRT071446
Reference: URL:http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
Reference: MS:MS07-039
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/ms07-039.mspx
Reference: CERT:TA07-191A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-191A.html
Reference: CERT-VN:VU#487905
Reference: URL:http://www.kb.cert.org/vuls/id/487905
Reference: BID:24800
Reference: URL:http://www.securityfocus.com/bid/24800
Reference: FRSIRT:ADV-2007-2481
Reference: URL:http://www.frsirt.com/english/advisories/2007/2481
Reference: OVAL:oval:org.mitre.oval:def:2012
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2012
Reference: SECTRACK:1018355
Reference: URL:http://www.securitytracker.com/id?1018355
Reference: SECUNIA:26002
Reference: URL:http://secunia.com/advisories/26002

Votes:

Description:
The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow.

Status: Candidate
Phase: Assigned (20070103)
Reference: HP:SSRT071446
Reference: URL:http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
Reference: MS:MS07-040
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/ms07-040.mspx
Reference: CERT:TA07-191A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-191A.html
Reference: BID:24778
Reference: URL:http://www.securityfocus.com/bid/24778
Reference: FRSIRT:ADV-2007-2482
Reference: URL:http://www.frsirt.com/english/advisories/2007/2482
Reference: OVAL:oval:org.mitre.oval:def:2093
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2093
Reference: SECTRACK:1018356
Reference: URL:http://www.securitytracker.com/id?1018356
Reference: SECUNIA:26003
Reference: URL:http://secunia.com/advisories/26003
Reference: XF:ms-dotnet-pe-loader-bo(34637)
Reference: URL:http://xforce.iss.net/xforce/xfdb/34637

Votes:

Description:
Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."

Status: Candidate
Phase: Assigned (20070103)
Reference: MISC:http://security-assessment.com/files/advisories/2007-07-11_Multiple_.NET_Null_Byte_Injection_Vulnerabilities.pdf
Reference: HP:SSRT071446
Reference: URL:http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
Reference: MS:MS07-040
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/ms07-040.mspx
Reference: CERT:TA07-191A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-191A.html
Reference: FRSIRT:ADV-2007-2482
Reference: URL:http://www.frsirt.com/english/advisories/2007/2482
Reference: OVAL:oval:org.mitre.oval:def:2070
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2070
Reference: SECTRACK:1018356
Reference: URL:http://www.securitytracker.com/id?1018356
Reference: SECUNIA:26003
Reference: URL:http://secunia.com/advisories/26003

Votes:

Description:
The Just In Time (JIT) Compiler service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer," probably a buffer overflow, aka ".NET JIT Compiler Vulnerability".

Status: Candidate
Phase: Assigned (20070103)
Reference: HP:SSRT071446
Reference: URL:http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
Reference: MS:MS07-040
Reference: URL:http://www.microsoft.com/technet/security/Bulletin/ms07-040.mspx
Reference: CERT:TA07-191A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-191A.html
Reference: BID:24811
Reference: URL:http://www.securityfocus.com/bid/24811
Reference: FRSIRT:ADV-2007-2482
Reference: URL:http://www.frsirt.com/english/advisories/2007/2482
Reference: OVAL:oval:org.mitre.oval:def:1873
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1873
Reference: SECTRACK:1018356
Reference: URL:http://www.securitytracker.com/id?1018356
Reference: SECUNIA:26003
Reference: URL:http://secunia.com/advisories/26003
Reference: XF:ms-dotnet-jit-bo(34639)
Reference: URL:http://xforce.iss.net/xforce/xfdb/34639

Votes:

Description:
Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."

Status: Candidate
Phase: Assigned (20070103)
Reference: BUGTRAQ:20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455801/100/0/threaded
Reference: MISC:http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
Reference: MISC:http://www.wisec.it/vulns.php?page=9
Reference: GENTOO:GLSA-200701-16
Reference: URL:http://security.gentoo.org/glsa/glsa-200701-16.xml
Reference: REDHAT:RHSA-2008:0144
Reference: URL:http://www.redhat.com/support/errata/RHSA-2008-0144.html
Reference: SUSE:SUSE-SA:2007:011
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
Reference: BID:21858
Reference: URL:http://www.securityfocus.com/bid/21858
Reference: FRSIRT:ADV-2007-0032
Reference: URL:http://www.frsirt.com/english/advisories/2007/0032
Reference: SECTRACK:1017469
Reference: URL:http://securitytracker.com/id?1017469
Reference: SECUNIA:23812
Reference: URL:http://secunia.com/advisories/23812
Reference: SECUNIA:23882
Reference: URL:http://secunia.com/advisories/23882
Reference: SECUNIA:29065
Reference: URL:http://secunia.com/advisories/29065
Reference: SREASON:2090
Reference: URL:http://securityreason.com/securityalert/2090
Reference: XF:adobe-acrobat-pdf-csrf(31266)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31266

Votes:

Description:
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0 for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."

Status: Candidate
Phase: Assigned (20070103)
Reference: BUGTRAQ:20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455801/100/0/threaded
Reference: BUGTRAQ:20070103 RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous
Reference: URL:http://www.securityfocus.com/archive/1/455836/100/0/threaded
Reference: BUGTRAQ:20070103 Re: Universal XSS with PDF files: highly dangerous
Reference: URL:http://www.securityfocus.com/archive/1/455800/100/0/threaded
Reference: BUGTRAQ:20070103 Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous
Reference: URL:http://www.securityfocus.com/archive/1/455831/100/0/threaded
Reference: BUGTRAQ:20070103 Universal XSS with PDF files: highly dangerous
Reference: URL:http://www.securityfocus.com/archive/1/455790/100/0/threaded
Reference: BUGTRAQ:20070104 Universal PDF XSS After Party
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455906/100/0/threaded
Reference: MISC:http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
Reference: MISC:http://www.wisec.it/vulns.php?page=9
Reference: MISC:http://www.disenchant.ch/blog/hacking-with-browser-plugins/34
Reference: MISC:http://www.gnucitizen.org/blog/universal-pdf-xss-after-party
Reference: CONFIRM:http://www.gnucitizen.org/blog/danger-danger-danger/
Reference: CONFIRM:http://www.adobe.com/support/security/advisories/apsa07-01.html
Reference: CONFIRM:http://www.adobe.com/support/security/advisories/apsa07-02.html
Reference: CONFIRM:http://www.adobe.com/support/security/bulletins/apsb07-01.html
Reference: CONFIRM:http://www.mozilla.org/security/announce/2007/mfsa2007-02.html
Reference: GENTOO:GLSA-200701-16
Reference: URL:http://security.gentoo.org/glsa/glsa-200701-16.xml
Reference: HP:HPSBUX02153
Reference: URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
Reference: HP:SSRT061181
Reference: URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
Reference: REDHAT:RHSA-2007:0017
Reference: URL:https://rhn.redhat.com/errata/RHSA-2007-0017.html
Reference: REDHAT:RHSA-2007:0021
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0021.html
Reference: SLACKWARE:SSA:2007-066-05
Reference: URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
Reference: SUNALERT:102847
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1
Reference: SUSE:SUSE-SA:2007:011
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
Reference: CERT-VN:VU#815960
Reference: URL:http://www.kb.cert.org/vuls/id/815960
Reference: BID:21858
Reference: URL:http://www.securityfocus.com/bid/21858
Reference: FRSIRT:ADV-2007-0032
Reference: URL:http://www.frsirt.com/english/advisories/2007/0032
Reference: FRSIRT:ADV-2007-0957
Reference: URL:http://www.frsirt.com/english/advisories/2007/0957
Reference: SECTRACK:1017469
Reference: URL:http://securitytracker.com/id?1017469
Reference: SECUNIA:23483
Reference: URL:http://secunia.com/advisories/23483
Reference: SECUNIA:23691
Reference: URL:http://secunia.com/advisories/23691
Reference: SECUNIA:23812
Reference: URL:http://secunia.com/advisories/23812
Reference: SECUNIA:23877
Reference: URL:http://secunia.com/advisories/23877
Reference: SECUNIA:23882
Reference: URL:http://secunia.com/advisories/23882
Reference: SECUNIA:24533
Reference: URL:http://secunia.com/advisories/24533
Reference: SECUNIA:24457
Reference: URL:http://secunia.com/advisories/24457
Reference: SREASON:2090
Reference: URL:http://securityreason.com/securityalert/2090
Reference: XF:adobe-acrobat-pdf-xss(31271)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31271

Votes:

Description:
Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.

Status: Candidate
Phase: Assigned (20070103)
Reference: BUGTRAQ:20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455801/100/0/threaded
Reference: MISC:http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
Reference: MISC:http://www.wisec.it/vulns.php?page=9
Reference: CONFIRM:http://www.adobe.com/support/security/bulletins/apsb07-01.html
Reference: GENTOO:GLSA-200701-16
Reference: URL:http://security.gentoo.org/glsa/glsa-200701-16.xml
Reference: REDHAT:RHSA-2007:0017
Reference: URL:https://rhn.redhat.com/errata/RHSA-2007-0017.html
Reference: REDHAT:RHSA-2007:0021
Reference: URL:http://www.redhat.com/support/errata/RHSA-2007-0021.html
Reference: SUNALERT:102847
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1
Reference: SUSE:SUSE-SA:2007:011
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
Reference: FRSIRT:ADV-2007-0032
Reference: URL:http://www.frsirt.com/english/advisories/2007/0032
Reference: FRSIRT:ADV-2007-0957
Reference: URL:http://www.frsirt.com/english/advisories/2007/0957
Reference: SECTRACK:1017469
Reference: URL:http://securitytracker.com/id?1017469
Reference: SECUNIA:23691
Reference: URL:http://secunia.com/advisories/23691
Reference: SECUNIA:23812
Reference: URL:http://secunia.com/advisories/23812
Reference: SECUNIA:23877
Reference: URL:http://secunia.com/advisories/23877
Reference: SECUNIA:23882
Reference: URL:http://secunia.com/advisories/23882
Reference: SECUNIA:24533
Reference: URL:http://secunia.com/advisories/24533
Reference: SREASON:2090
Reference: URL:http://securityreason.com/securityalert/2090
Reference: XF:adobe-acrobat-msvcrt-code-execution(31272)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31272

Votes:

Description:
CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.

Status: Candidate
Phase: Assigned (20070103)
Reference: MISC:http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
Reference: SUSE:SUSE-SA:2007:011
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
Reference: FRSIRT:ADV-2007-0032
Reference: URL:http://www.frsirt.com/english/advisories/2007/0032
Reference: SECTRACK:1017469
Reference: URL:http://securitytracker.com/id?1017469
Reference: SECUNIA:23882
Reference: URL:http://secunia.com/advisories/23882
Reference: XF:adobe-acrobat-xmlhttp-response-splitting(31291)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31291

Votes:

Description:
Adobe Acrobat Reader Plugin before 8.0.0, when used with Internet Explorer, allows remote attackers to cause a denial of service (memory consumption) via a long sequence of # (hash) characters appended to a PDF URL.

Status: Candidate
Phase: Assigned (20070103)
Reference: BUGTRAQ:20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455801/100/0/threaded
Reference: MISC:http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
Reference: MISC:http://www.wisec.it/vulns.php?page=9
Reference: CONFIRM:http://www.adobe.com/support/security/bulletins/apsb07-01.html
Reference: GENTOO:GLSA-200701-16
Reference: URL:http://security.gentoo.org/glsa/glsa-200701-16.xml
Reference: SUSE:SUSE-SA:2007:011
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
Reference: FRSIRT:ADV-2007-0032
Reference: URL:http://www.frsirt.com/english/advisories/2007/0032
Reference: SECTRACK:1017469
Reference: URL:http://securitytracker.com/id?1017469
Reference: SECUNIA:23812
Reference: URL:http://secunia.com/advisories/23812
Reference: SECUNIA:23882
Reference: URL:http://secunia.com/advisories/23882
Reference: SREASON:2090
Reference: URL:http://securityreason.com/securityalert/2090
Reference: XF:adobe-acrobat-character-dos(31273)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31273

Votes:

Description:
Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add action with a modified GroupID in a direct request to Customize.asp.

Status: Candidate
Phase: Assigned (20070103)
Reference: MILW0RM:3068
Reference: URL:http://milw0rm.com/exploits/3068
Reference: BID:21847
Reference: URL:http://www.securityfocus.com/bid/21847
Reference: SECUNIA:23564
Reference: URL:http://secunia.com/advisories/23564
Reference: XF:tasktrackerpro-customize-auth-bypass(31235)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31235

Votes:

Description:
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in OpenPinboard 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the language parameter. NOTE: this issue has been disputed by the developer and a third party, since the variable is set before use. CVE analysis suggests that there is a small time window of risk before the installation is complete.

Status: Candidate
Phase: Assigned (20070103)
Reference: BUGTRAQ:20070103 OpenPinboard <= Remote File Include
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455795/100/0/threaded
Reference: BUGTRAQ:20070103 Re: OpenPinboard <= Remote File Include
Reference: URL:http://www.securityfocus.com/archive/1/455818/100/0/threaded

Votes:

Description:
Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070104 DMA[2007-0104a] - 'iLife iPhoto Photocasing Format String Vulnerability'
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455968/100/0/threaded
Reference: MISC:http://projects.info-pull.com/moab/MOAB-04-01-2007.html
Reference: MISC:http://www.digitalmunition.com/DMA[2007-0104a].txt
Reference: MILW0RM:3080
Reference: URL:http://milw0rm.com/exploits/3080
Reference: CONFIRM:http://docs.info.apple.com/article.html?artnum=305215
Reference: APPLE:APPLE-SA-2007-03-13
Reference: URL:http://lists.apple.com/archives/security-announce/2007/Mar//msg00003.html
Reference: BID:21871
Reference: URL:http://www.securityfocus.com/bid/21871
Reference: FRSIRT:ADV-2007-0057
Reference: URL:http://www.frsirt.com/english/advisories/2007/0057
Reference: SECUNIA:23615
Reference: URL:http://secunia.com/advisories/23615
Reference: XF:iphoto-xmltitle-format-string(31281)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31281

Votes:

Description:
SQL injection vulnerability in haberdetay.asp in Vizayn Haber allows remote attackers to execute arbitrary SQL commands via the id parameter.

Status: Candidate
Phase: Assigned (20070104)
Reference: MILW0RM:3061
Reference: URL:http://milw0rm.com/exploits/3061
Reference: BID:21836
Reference: URL:http://www.securityfocus.com/bid/21836
Reference: FRSIRT:ADV-2007-0015
Reference: URL:http://www.frsirt.com/english/advisories/2007/0015
Reference: SECUNIA:23576
Reference: URL:http://secunia.com/advisories/23576
Reference: XF:vicayn-haberdetay-sql-injection(31213)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31213

Votes:

Description:
SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the iPro parameter.

Status: Candidate
Phase: Assigned (20070104)
Reference: MILW0RM:3062
Reference: URL:http://milw0rm.com/exploits/3062
Reference: BID:21833
Reference: URL:http://www.securityfocus.com/bid/21833
Reference: FRSIRT:ADV-2007-0016
Reference: URL:http://www.frsirt.com/english/advisories/2007/0016
Reference: SECUNIA:23572
Reference: URL:http://secunia.com/advisories/23572
Reference: XF:autodealer-detail-sql-injection(31219)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31219

Votes:

Description:
Cross-site scripting (XSS) vulnerability in gbrowse.php in Belchior Foundry vCard PRO allows remote attackers to inject arbitrary web script or HTML via the sortby parameter.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070101 vBulletin vCard PRO XSS
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455615/100/0/threaded
Reference: BID:21844
Reference: URL:http://www.securityfocus.com/bid/21844
Reference: XF:vcard-gbrowse-xss(31182)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31182

Votes:

Description:
Directory traversal vulnerability in formbankcgi.exe/AbfrageForm in Formbankserver 1.9 allows remote attackers to read arbitrary files via directory traversal sequences in the Name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

Status: Candidate
Phase: Assigned (20070104)
Reference: MILW0RM:3063
Reference: URL:http://milw0rm.com/exploits/3063
Reference: FRSIRT:ADV-2007-0012
Reference: URL:http://www.frsirt.com/english/advisories/2007/0012
Reference: SECUNIA:23539
Reference: URL:http://secunia.com/advisories/23539
Reference: XF:formbankserver-name-directory-traversal(31214)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31214

Votes:

Description:
Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) ashop/catalogue.php and (b) ashop/basket.php, the (2) exp parameter to ashop/catalogue.php, the (3) searchstring parameter to (c) ashop/search.php, the (4) checkout and (5) action parameters to (d) ashop/shipping.php, the cat parameter to (f) cart-path/admin/editcatalogue.php, and the (7) resultpage parameter to (g) cart-path/admin/salesadmin.php.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070101 AShop Shopping Cart Multiple XSS Vulnerabilities
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455629/100/0/threaded
Reference: BID:21845
Reference: URL:http://www.securityfocus.com/bid/21845
Reference: FRSIRT:ADV-2007-0028
Reference: URL:http://www.frsirt.com/english/advisories/2007/0028
Reference: SECUNIA:23547
Reference: URL:http://secunia.com/advisories/23547
Reference: SREASON:2091
Reference: URL:http://securityreason.com/securityalert/2091
Reference: XF:ashop-multiple-scripts-xss(31178)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31178

Votes:

Description:
Cisco Clean Access (CCA) 3.6.x through 3.6.4.2 and 4.0.x through 4.0.3.2 does not properly configure or allow modification of a shared secret authentication key, which causes all devices to have the same shared sercet and allows remote attackers to gain unauthorized access.

Status: Candidate
Phase: Assigned (20070104)
Reference: CISCO:20070103 Multiple Vulnerabilities in Cisco Clean Access
Reference: URL:http://www.cisco.com/warp/public/707/cisco-sa-20070103-CleanAccess.shtml
Reference: FRSIRT:ADV-2007-0030
Reference: URL:http://www.frsirt.com/english/advisories/2007/0030
Reference: SECTRACK:1017465
Reference: URL:http://securitytracker.com/id?1017465
Reference: SECUNIA:23617
Reference: URL:http://secunia.com/advisories/23617

Votes:

Description:
Cisco Clean Access (CCA) 3.5.x through 3.5.9 and 3.6.x through 3.6.1.1 on the Clean Access Manager (CAM) allows remote attackers to bypass authentication and download arbitrary manual database backups by guessing the snapshot filename using brute force, then making a direct request for the file.

Status: Candidate
Phase: Assigned (20070104)
Reference: CISCO:20070103 Multiple Vulnerabilities in Cisco Clean Access
Reference: URL:http://www.cisco.com/warp/public/707/cisco-sa-20070103-CleanAccess.shtml
Reference: FRSIRT:ADV-2007-0030
Reference: URL:http://www.frsirt.com/english/advisories/2007/0030
Reference: OSVDB:32579
Reference: URL:http://www.osvdb.org/32579
Reference: SECTRACK:1017465
Reference: URL:http://securitytracker.com/id?1017465
Reference: SECUNIA:23556
Reference: URL:http://secunia.com/advisories/23556

Votes:

Description:
Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI, which is executed in a local zone during preview, as exploited by a MySpace worm.

Status: Candidate
Phase: Assigned (20070104)
Reference: MISC:http://projects.info-pull.com/moab/MOAB-03-01-2007.html
Reference: MISC:http://www.gnucitizen.org/blog/backdooring-quicktime-movies/
Reference: APPLE:APPLE-SA-2007-03-05
Reference: URL:http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html
Reference: CONFIRM:http://docs.info.apple.com/article.html?artnum=305149
Reference: CERT-VN:VU#304064
Reference: URL:http://www.kb.cert.org/vuls/id/304064

Votes:

Description:
Stack-based buffer overflow in the Message Queuing Server (Cam.exe) in CA (formerly Computer Associates) Message Queuing (CAM / CAFT) software before 1.11 Build 54_4 on Windows and NetWare, as used in CA Advantage Data Transport, eTrust Admin, certain BrightStor products, certain CleverPath products, and certain Unicenter products, allows remote attackers to execute arbitrary code via a crafted message to TCP port 3104.

Status: Candidate
Phase: Assigned (20070104)
Reference: ISS:20070724 CA Message Queuing Server (Cam.exe) Overflow
Reference: URL:http://www.iss.net/threats/272.html
Reference: BUGTRAQ:20070725 [CAID 35527]: CA Message Queuing (CAM / CAFT) Buffer Overflow Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/474602/100/0/threaded
Reference: CONFIRM:http://supportconnectw.ca.com/public/dto_transportit/infodocs/camsgquevul-secnot.asp
Reference: CONFIRM:http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=149809
Reference: BID:25051
Reference: URL:http://www.securityfocus.com/bid/25051
Reference: FRSIRT:ADV-2007-2638
Reference: URL:http://www.frsirt.com/english/advisories/2007/2638
Reference: SECTRACK:1018449
Reference: URL:http://www.securitytracker.com/id?1018449
Reference: SECUNIA:26190
Reference: URL:http://secunia.com/advisories/26190
Reference: XF:systems-management-bo(32234)
Reference: URL:http://xforce.iss.net/xforce/xfdb/32234

Votes:

Description:
The DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed packet that triggers "corrupt stack memory."

Status: Candidate
Phase: Assigned (20070104)
Reference: ISS:20070919 VMWare DHCP Server Remote Code Execution Vulnerabilities
Reference: URL:http://www.iss.net/threats/275.html
Reference: FULLDISC:20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player
Reference: URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
Reference: CONFIRM:http://www.vmware.com/support/ace/doc/releasenotes_ace.html
Reference: CONFIRM:http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
Reference: CONFIRM:http://www.vmware.com/support/player/doc/releasenotes_player.html
Reference: CONFIRM:http://www.vmware.com/support/player2/doc/releasenotes_player2.html
Reference: CONFIRM:http://www.vmware.com/support/server/doc/releasenotes_server.html
Reference: CONFIRM:http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html
Reference: CONFIRM:http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
Reference: GENTOO:GLSA-200711-23
Reference: URL:http://security.gentoo.org/glsa/glsa-200711-23.xml
Reference: UBUNTU:USN-543-1
Reference: URL:http://www.ubuntu.com/usn/usn-543-1
Reference: BID:25729
Reference: URL:http://www.securityfocus.com/bid/25729
Reference: FRSIRT:ADV-2007-3229
Reference: URL:http://www.frsirt.com/english/advisories/2007/3229
Reference: SECTRACK:1018717
Reference: URL:http://www.securitytracker.com/id?1018717
Reference: SECUNIA:26890
Reference: URL:http://secunia.com/advisories/26890
Reference: SECUNIA:27694
Reference: URL:http://secunia.com/advisories/27694
Reference: SECUNIA:27706
Reference: URL:http://secunia.com/advisories/27706
Reference: XF:dhcp-malformed-packet-bo(33101)
Reference: URL:http://xforce.iss.net/xforce/xfdb/33101

Votes:

Description:
Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before 3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528; allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a malformed DHCP packet with a large dhcp-max-message-size that triggers a stack-based buffer overflow, related to servers configured to send many DHCP options to clients.

Status: Candidate
Phase: Assigned (20070104)
Reference: ISS:20070919 VMWare DHCP Server Remote Code Execution Vulnerabilities
Reference: URL:http://www.iss.net/threats/275.html
Reference: FULLDISC:20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player
Reference: URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
Reference: CONFIRM:http://www.vmware.com/support/ace/doc/releasenotes_ace.html
Reference: CONFIRM:http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
Reference: CONFIRM:http://www.vmware.com/support/player/doc/releasenotes_player.html
Reference: CONFIRM:http://www.vmware.com/support/player2/doc/releasenotes_player2.html
Reference: CONFIRM:http://www.vmware.com/support/server/doc/releasenotes_server.html
Reference: CONFIRM:http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html
Reference: CONFIRM:http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
Reference: CONFIRM:http://bugs.gentoo.org/show_bug.cgi?id=227135
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=339561
Reference: GENTOO:GLSA-200711-23
Reference: URL:http://security.gentoo.org/glsa/glsa-200711-23.xml
Reference: GENTOO:GLSA-200808-05
Reference: URL:http://security.gentoo.org/glsa/glsa-200808-05.xml
Reference: UBUNTU:USN-543-1
Reference: URL:http://www.ubuntu.com/usn/usn-543-1
Reference: BID:25729
Reference: URL:http://www.securityfocus.com/bid/25729
Reference: FRSIRT:ADV-2007-3229
Reference: URL:http://www.frsirt.com/english/advisories/2007/3229
Reference: SECTRACK:1018717
Reference: URL:http://www.securitytracker.com/id?1018717
Reference: SECUNIA:26890
Reference: URL:http://secunia.com/advisories/26890
Reference: SECUNIA:27694
Reference: URL:http://secunia.com/advisories/27694
Reference: SECUNIA:27706
Reference: URL:http://secunia.com/advisories/27706
Reference: SECUNIA:31396
Reference: URL:http://secunia.com/advisories/31396
Reference: XF:dhcp-param-overflow(33102)
Reference: URL:http://xforce.iss.net/xforce/xfdb/33102

Votes:

Description:
Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.

Status: Candidate
Phase: Assigned (20070104)
Reference: ISS:20070919 VMWare DHCP Server Remote Code Execution Vulnerabilities
Reference: URL:http://www.iss.net/threats/275.html
Reference: FULLDISC:20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player
Reference: URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
Reference: CONFIRM:http://www.vmware.com/support/ace/doc/releasenotes_ace.html
Reference: CONFIRM:http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
Reference: CONFIRM:http://www.vmware.com/support/player/doc/releasenotes_player.html
Reference: CONFIRM:http://www.vmware.com/support/player2/doc/releasenotes_player2.html
Reference: CONFIRM:http://www.vmware.com/support/server/doc/releasenotes_server.html
Reference: CONFIRM:http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html
Reference: CONFIRM:http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
Reference: GENTOO:GLSA-200711-23
Reference: URL:http://security.gentoo.org/glsa/glsa-200711-23.xml
Reference: UBUNTU:USN-543-1
Reference: URL:http://www.ubuntu.com/usn/usn-543-1
Reference: BID:25729
Reference: URL:http://www.securityfocus.com/bid/25729
Reference: FRSIRT:ADV-2007-3229
Reference: URL:http://www.frsirt.com/english/advisories/2007/3229
Reference: SECTRACK:1018717
Reference: URL:http://www.securitytracker.com/id?1018717
Reference: SECUNIA:26890
Reference: URL:http://secunia.com/advisories/26890
Reference: SECUNIA:27694
Reference: URL:http://secunia.com/advisories/27694
Reference: SECUNIA:27706
Reference: URL:http://secunia.com/advisories/27706
Reference: XF:dhcp-param-underflow(33103)
Reference: URL:http://xforce.iss.net/xforce/xfdb/33103

Votes:

Description:
Heap-based buffer overflow in Windows Media Format Runtime 7.1, 9, 9.5, 9.5 x64 Edition, 11, and Windows Media Services 9.1 for Microsoft Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.

Status: Candidate
Phase: Assigned (20070104)
Reference: HP:HPSBST02299
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/485268/100/0/threaded
Reference: HP:SSRT071506
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/485268/100/0/threaded
Reference: MS:MS07-068
Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms07-068.mspx
Reference: CERT:TA07-345A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-345A.html
Reference: CERT-VN:VU#319385
Reference: URL:http://www.kb.cert.org/vuls/id/319385
Reference: BID:26776
Reference: URL:http://www.securityfocus.com/bid/26776
Reference: FRSIRT:ADV-2007-4183
Reference: URL:http://www.frsirt.com/english/advisories/2007/4183
Reference: OVAL:oval:org.mitre.oval:def:3622
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:3622
Reference: SECTRACK:1019074
Reference: URL:http://www.securitytracker.com/id?1019074
Reference: SECUNIA:28034
Reference: URL:http://secunia.com/advisories/28034

Votes:

Description:
Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, Office 2004 for Mac, and Visual basic 6.0 SP6 allows remote attackers to execute arbitrary code via a crafted script request.

Status: Candidate
Phase: Assigned (20070104)
Reference: HP:HPSBST02314
Reference: URL:http://marc.info/?l=bugtraq&m=120361015026386&w=2
Reference: HP:SSRT080016
Reference: URL:http://marc.info/?l=bugtraq&m=120361015026386&w=2
Reference: MS:MS08-008
Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms08-008.mspx
Reference: CERT:TA08-043C
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA08-043C.html
Reference: BID:27661
Reference: URL:http://www.securityfocus.com/bid/27661
Reference: FRSIRT:ADV-2008-0510
Reference: URL:http://www.frsirt.com/english/advisories/2008/0510/references
Reference: OVAL:oval:org.mitre.oval:def:5388
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5388
Reference: SECTRACK:1019373
Reference: URL:http://www.securitytracker.com/id?1019373
Reference: SECUNIA:28902
Reference: URL:http://secunia.com/advisories/28902

Votes:

Description:
The kernel in Microsoft Windows 2000 SP4, XP SP2, and Server 2003, when ICMP Router Discovery Protocol (RDP) is enabled, allows remote attackers to cause a denial of service via fragmented router advertisement ICMP packets that trigger an out-of-bounds read, aka "Windows Kernel TCP/IP/ICMP Vulnerability."

Status: Candidate
Phase: Assigned (20070104)
Reference: ISS:20070108 Multiple (3) Microsoft Windows TCP/IP Remote Code Execution and DoS Vulnerabilities
Reference: URL:http://www.iss.net/threats/282.html
Reference: MISC:http://blogs.technet.com/swi/archive/2008/01/08/ms08-001-part-2-the-case-of-the-moderate-icmp-mitigations.aspx
Reference: HP:HPSBST02304
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/486317/100/0/threaded
Reference: HP:SSRT080003
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/486317/100/0/threaded
Reference: MS:MS08-001
Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms08-001.mspx
Reference: CERT:TA08-008A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA08-008A.html
Reference: BID:27139
Reference: URL:http://www.securityfocus.com/bid/27139
Reference: FRSIRT:ADV-2008-0069
Reference: URL:http://www.frsirt.com/english/advisories/2008/0069
Reference: OVAL:oval:org.mitre.oval:def:5271
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5271
Reference: SECTRACK:1019166
Reference: URL:http://securitytracker.com/id?1019166
Reference: SECUNIA:28297
Reference: URL:http://secunia.com/advisories/28297
Reference: XF:win-tcpip-icmp-dos(39254)
Reference: URL:http://xforce.iss.net/xforce/xfdb/39254

Votes:

Description:
Unspecified vulnerability in the Lotus Domino Web Server 6.0, 6.5.x before 6.5.6, and 7.0.x before 7.0.3 allows remote attackers to cause a denial of service (daemon crash) via requests for URLs that reference certain files.

Status: Candidate
Phase: Assigned (20070104)
Reference: CONFIRM:http://www-1.ibm.com/support/docview.wss?uid=swg21257251
Reference: BID:24307
Reference: URL:http://www.securityfocus.com/bid/24307
Reference: FRSIRT:ADV-2007-2046
Reference: URL:http://www.frsirt.com/english/advisories/2007/2046
Reference: SECTRACK:1018189
Reference: URL:http://www.securitytracker.com/id?1018189
Reference: SECUNIA:25542
Reference: URL:http://secunia.com/advisories/25542
Reference: XF:domino-unspecified-dos(34689)
Reference: URL:http://xforce.iss.net/xforce/xfdb/34689

Votes:

Description:
IBM Lotus Domino 7.0.x before 7.0.3 does not revalidate the signature on a signed scheduled agent after the agent is modified, which allows remote authenticated users to gain privileges via a modified agent in a server database.

Status: Candidate
Phase: Assigned (20070104)
Reference: CONFIRM:http://www-1.ibm.com/support/docview.wss?uid=swg21258784
Reference: BID:24322
Reference: URL:http://www.securityfocus.com/bid/24322
Reference: FRSIRT:ADV-2007-2063
Reference: URL:http://www.frsirt.com/english/advisories/2007/2063
Reference: SECUNIA:25520
Reference: URL:http://secunia.com/advisories/25520
Reference: XF:domino-signature-privilege-escalation(34718)
Reference: URL:http://xforce.iss.net/xforce/xfdb/34718

Votes:

Description:
Unspecified vulnerability in the kernel in Microsoft Windows XP SP2, Server 2003, and Vista allows remote attackers to cause a denial of service (CPU consumption) and possibly execute arbitrary code via crafted (1) IGMPv3 and (2) MLDv2 packets that trigger memory corruption, aka "Windows Kernel TCP/IP/IGMPv3 and MLDv2 Vulnerability."

Status: Candidate
Phase: Assigned (20070104)
Reference: ISS:20070108 Multiple (3) Microsoft Windows TCP/IP Remote Code Execution and DoS Vulnerabilities
Reference: URL:http://www.iss.net/threats/282.html
Reference: MISC:http://blogs.technet.com/swi/archive/2008/01/08/ms08-001-part-3-the-case-of-the-igmp-network-critical.aspx
Reference: HP:HPSBST02304
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/486317/100/0/threaded
Reference: HP:SSRT080003
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/486317/100/0/threaded
Reference: MS:MS08-001
Reference: URL:http://www.microsoft.com/technet/security/bulletin/ms08-001.mspx
Reference: CERT:TA08-008A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA08-008A.html
Reference: CERT-VN:VU#115083
Reference: URL:http://www.kb.cert.org/vuls/id/115083
Reference: BID:27100
Reference: URL:http://www.securityfocus.com/bid/27100
Reference: FRSIRT:ADV-2008-0069
Reference: URL:http://www.frsirt.com/english/advisories/2008/0069
Reference: OVAL:oval:org.mitre.oval:def:5370
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5370
Reference: SECTRACK:1019166
Reference: URL:http://securitytracker.com/id?1019166
Reference: SECUNIA:28297
Reference: URL:http://secunia.com/advisories/28297
Reference: XF:win-ssm-igmp-bo(39452)
Reference: URL:http://xforce.iss.net/xforce/xfdb/39452
Reference: XF:win-ssm-mld-bo(39453)
Reference: URL:http://xforce.iss.net/xforce/xfdb/39453

Votes:

Description:
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Status: Candidate
Phase: Assigned (20070104)

Votes:

Description:
Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.

Status: Candidate
Phase: Assigned (20070104)
Reference: ISS:20080408 Adobe Flash Player Invalid Pointer Vulnerability
Reference: URL:http://www.iss.net/threats/289.html
Reference: MISC:http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf
Reference: MISC:http://www.matasano.com/log/1032/this-new-vulnerability-dowds-inhuman-flash-exploit/
Reference: MISC:http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html
Reference: MISC:http://isc.sans.org/diary.html?storyid=4465
Reference: CONFIRM:http://www.adobe.com/support/security/bulletins/apsb08-11.html
Reference: APPLE:APPLE-SA-2008-05-28
Reference: URL:http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
Reference: GENTOO:GLSA-200804-21
Reference: URL:http://www.gentoo.org/security/en/glsa/glsa-200804-21.xml
Reference: REDHAT:RHSA-2008:0221
Reference: URL:http://www.redhat.com/support/errata/RHSA-2008-0221.html
Reference: SUNALERT:238305
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1
Reference: SUSE:SUSE-SA:2008:022
Reference: URL:http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html
Reference: CERT:TA08-100A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA08-100A.html
Reference: CERT:TA08-150A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA08-150A.html
Reference: CERT:TA08-149A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA08-149A.html
Reference: CERT-VN:VU#159523
Reference: URL:http://www.kb.cert.org/vuls/id/159523
Reference: CERT-VN:VU#395473
Reference: URL:http://www.kb.cert.org/vuls/id/395473
Reference: BID:28695
Reference: URL:http://www.securityfocus.com/bid/28695
Reference: BID:29386
Reference: URL:http://www.securityfocus.com/bid/29386
Reference: FRSIRT:ADV-2008-1662
Reference: URL:http://www.frsirt.com/english/advisories/2008/1662/references
Reference: FRSIRT:ADV-2008-1697
Reference: URL:http://www.frsirt.com/english/advisories/2008/1697
Reference: FRSIRT:ADV-2008-1724
Reference: URL:http://www.frsirt.com/english/advisories/2008/1724/references
Reference: OSVDB:44282
Reference: URL:http://www.osvdb.org/44282
Reference: SECTRACK:1019811
Reference: URL:http://www.securitytracker.com/id?1019811
Reference: SECTRACK:1020114
Reference: URL:http://www.securitytracker.com/id?1020114
Reference: SECUNIA:29763
Reference: URL:http://secunia.com/advisories/29763
Reference: SECUNIA:29865
Reference: URL:http://secunia.com/advisories/29865
Reference: SECUNIA:30404
Reference: URL:http://secunia.com/advisories/30404
Reference: SECUNIA:30430
Reference: URL:http://secunia.com/advisories/30430
Reference: SECUNIA:30507
Reference: URL:http://secunia.com/advisories/30507
Reference: XF:multimedia-file-integer-overflow(37277)
Reference: URL:http://xforce.iss.net/getrecord.jsp?id=37277

Votes:

Description:
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Status: Candidate
Phase: Assigned (20070104)

Votes:

Description:
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Status: Candidate
Phase: Assigned (20070104)

Votes:

Description:
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Status: Candidate
Phase: Assigned (20070104)

Votes:

Description:
AspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for db/aspbb.mdb.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070102 AspBB Remote Password Disclosure
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455683/100/0/threaded
Reference: MISC:http://www.aria-security.com/forum/showthread.php?t=82
Reference: SREASON:2100
Reference: URL:http://securityreason.com/securityalert/2100
Reference: XF:aspbb-aspbb-info-disclosure(31230)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31230

Votes:

Description:
Openforum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for openforum.mdb.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070102 Openforum Remote password Disclosure
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455684/100/0/threaded
Reference: MISC:http://www.aria-security.com/forum/showthread.php?t=80
Reference: SREASON:2099
Reference: URL:http://securityreason.com/securityalert/2099
Reference: XF:openforum-openforum-password-disclosure(31209)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31209

Votes:

Description:
lblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a certain file in admin/db/newFolder/.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070102 lblog Remote Password Disclosure
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455681/100/0/threaded
Reference: MISC:http://www.aria-security.com/forum/showthread.php?t=79
Reference: SECTRACK:1017462
Reference: URL:http://securitytracker.com/id?1017462
Reference: SREASON:2098
Reference: URL:http://securityreason.com/securityalert/2098
Reference: XF:lblog-newfolder-information-disclosure(31229)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31229

Votes:

Description:
BattleBlog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/blankmaster.mdb.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070101 BattleBlog Database Download Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455614/100/0/threaded
Reference: MISC:http://www.aria-security.com/forum/showthread.php?t=76
Reference: SREASON:2097
Reference: URL:http://securityreason.com/securityalert/2097
Reference: XF:battleblog-blankmaster-info-disclosure(31224)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31224

Votes:

Description:
rblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) data/admin.mdb or (2) data/rblog.mdb.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070101 rblog Database Download Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455626/100/0/threaded
Reference: MISC:http://www.aria-security.com/forum/showthread.php?t=77
Reference: SECUNIA:23538
Reference: URL:http://secunia.com/advisories/23538
Reference: SREASON:2102
Reference: URL:http://securityreason.com/securityalert/2102
Reference: XF:rblog-database-info-disclosure(31200)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31200

Votes:

Description:
** DISPUTED ** Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance. NOTE: the impact of this issue has been disputed by a reliable third party and the vendor, who states that exploitation is limited "only to local administrators who have write access to the server configuration files." CVE concurs with the dispute.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070102 FreeRadius 1.1.3 SMB_Handle_Type SMB_Connect_Server arbitrary code execution
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455678/100/0/threaded
Reference: BUGTRAQ:20070103 Re: FreeRadius 1.1.3 SMB_Handle_Type SMB_Connect_Server arbitrary code execution
Reference: URL:http://www.securityfocus.com/archive/1/455812/100/0/threaded
Reference: MISC:http://www.freeradius.org/security.html
Reference: VIM:20070211 FreeRADIUS dispute of CVE-2007-0080
Reference: URL:http://www.attrition.org/pipermail/vim/2007-February/001304.html
Reference: SECTRACK:1017463
Reference: URL:http://securitytracker.com/id?1017463
Reference: XF:freeradius-smbconnectserver-bo(31248)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31248

Votes:

Description:
Sunbelt Kerio Personal Firewall (SKPF) 4.3.268 and 4.3.246, and possibly other versions allows local users to provide a Trojan horse iphlpapi.dll to SKPF by placing it in the installation directory.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070101 Kerio Fake 'iphlpapi' DLL injection Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455624/100/0/threaded
Reference: MISC:http://www.matousec.com/info/advisories/Kerio-Fake-iphlpapi-DLL-injection.php
Reference: BID:21828
Reference: URL:http://www.securityfocus.com/bid/21828
Reference: OSVDB:33356
Reference: URL:http://www.osvdb.org/33356
Reference: SREASON:2095
Reference: URL:http://securityreason.com/securityalert/2095
Reference: XF:kerio-directory-code-execution(31232)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31232

Votes:

Description:
users_adm/start1.php in IMGallery 2.5 and earlier does not properly handle files with multiple extensions, which allows remote authenticated users to upload and execute arbitrary PHP scripts.

Status: Candidate
Phase: Assigned (20070104)
Reference: MILW0RM:3049
Reference: URL:http://milw0rm.com/exploits/3049
Reference: BID:21827
Reference: URL:http://www.securityfocus.com/bid/21827
Reference: FRSIRT:ADV-2007-0010
Reference: URL:http://www.frsirt.com/english/advisories/2007/0010
Reference: XF:imgallery-start1-file-upload(31237)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31237

Votes:

Description:
Cross-site scripting (XSS) vulnerability in Nuked Klan 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a getURL statement in a .swf file, as demonstrated by "Remote Cookie Disclosure." NOTE: it could be argued that this is an issue in Shockwave instead of Nuked Klan.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070102 Nuked Klan <= 1.7 Remote Cookie Disclosure Exploit
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455726/100/0/threaded
Reference: BID:21850
Reference: URL:http://www.securityfocus.com/bid/21850
Reference: SREASON:2101
Reference: URL:http://securityreason.com/securityalert/2101

Votes:

Description:
** DISPUTED ** Buffer overflow in the Windows NT Message Compiler (MC) 1.00.5239 on Microsoft Windows XP allows local users to gain privileges via a long MC-filename. NOTE: this issue has been disputed by a reliable third party who states that the compiler is not a privileged program, so privilege boundaries cannot be crossed.

Status: Candidate
Phase: Assigned (20070104)
Reference: BUGTRAQ:20070102 Windows NT Message Compiler 1.00.5239 arbitrary code execution
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455729/100/0/threaded
Reference: BUGTRAQ:20070103 Re: Windows NT Message Compiler 1.00.5239 arbitrary code execution
Reference: URL:http://www.securityfocus.com/archive/1/455789/100/0/threaded

Votes:

Description:
Unspecified vulnerability in sys/dev/pci/vga_pci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agp_ioctl NULL pointer reference.

Status: Candidate
Phase: Assigned (20070104)
Reference: MLIST:[openbsd-cvs] 20070103 Re: CVS: cvs.openbsd.org: src
Reference: URL:http://marc.theaimsgroup.com/?l=openbsd-cvs&m=116781980706409&w=2
Reference: MLIST:[openbsd-cvs] 20070103 CVS: cvs.openbsd.org: www
Reference: URL:http://marc.theaimsgroup.com/?l=openbsd-cvs&m=116785923301416&w=2
Reference: MISC:http://ilja.netric.org/files/Unusual%20bugs%2023c3.pdf
Reference: OPENBSD:[3.9] 017: SECURITY FIX: January 3, 2007
Reference: URL:http://www.openbsd.org/errata39.html#agp
Reference: OPENBSD:[4.0] 007: SECURITY FIX: January 3, 2007
Reference: URL:http://www.openbsd.org/errata.html#agp
Reference: FRSIRT:ADV-2007-0043
Reference: URL:http://www.frsirt.com/english/advisories/2007/0043
Reference: OSVDB:32574
Reference: URL:http://www.osvdb.org/32574
Reference: SECTRACK:1017468
Reference: URL:http://securitytracker.com/id?1017468
Reference: SECUNIA:23608
Reference: URL:http://secunia.com/advisories/23608
Reference: XF:openbsd-vga-privilege-escalation(31276)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31276

Votes:

Description:
** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.

Status: Candidate
Phase: Assigned (20070105)
Reference: BUGTRAQ:20070103 a cheesy Apache / IIS DoS vuln (+a question)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455833/100/0/threaded
Reference: BUGTRAQ:20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)
Reference: URL:http://www.securityfocus.com/archive/1/455879/100/0/threaded
Reference: BUGTRAQ:20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)
Reference: URL:http://www.securityfocus.com/archive/1/455920/100/0/threaded
Reference: BUGTRAQ:20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)
Reference: URL:http://www.securityfocus.com/archive/1/455882/100/0/threaded

Votes:

Description:
** DISPUTED ** Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.

Status: Candidate
Phase: Assigned (20070105)
Reference: BUGTRAQ:20070103 a cheesy Apache / IIS DoS vuln (+a question)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455833/100/0/threaded
Reference: BUGTRAQ:20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)
Reference: URL:http://www.securityfocus.com/archive/1/455879/100/0/threaded
Reference: BUGTRAQ:20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)
Reference: URL:http://www.securityfocus.com/archive/1/455920/100/0/threaded
Reference: BUGTRAQ:20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)
Reference: URL:http://www.securityfocus.com/archive/1/455882/100/0/threaded

Votes:

Description:
Multiple directory traversal vulnerabilities in openmedia allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) src parameter to page.php or the (2) format parameter to search_form.php.

Status: Candidate
Phase: Assigned (20070105)
Reference: BUGTRAQ:20070102 openmedia local read file
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455786/100/0/threaded
Reference: SREASON:2103
Reference: URL:http://securityreason.com/securityalert/2103
Reference: XF:openmedia-page-directory-traversal(31258)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31258

Votes:

Description:
jgbbs stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/bbs.mdb.

Status: Candidate
Phase: Assigned (20070105)
Reference: BUGTRAQ:20070103 jgbbs
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455832/100/0/threaded
Reference: MISC:http://aria-security.com/forum/showthread.php?t=87
Reference: XF:jgbbs-bbs-information-disclosure(31274)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31274

Votes:

Description:
WineGlass stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/data.mdb.

Status: Candidate
Phase: Assigned (20070105)
Reference: BUGTRAQ:20070103 WineGlass "data.mdb" Remote Password Disclosure
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455807/100/0/threaded
Reference: MISC:http://aria-security.com/forum/showthread.php?p=112
Reference: FRSIRT:ADV-2007-0037
Reference: URL:http://www.frsirt.com/english/advisories/2007/0037
Reference: SECUNIA:23594
Reference: URL:http://secunia.com/advisories/23594

Votes:

Description:
newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for newsCMS.mdb.

Status: Candidate
Phase: Assigned (20070105)
Reference: MILW0RM:3066
Reference: URL:http://milw0rm.com/exploits/3066
Reference: XF:newscmslite-newscms-info-disclosure(31222)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31222

Votes:

Description:
SQL injection vulnerability in productdetail.asp in E-SMARTCART 1.0 allows remote attackers to execute arbitrary SQL commands via the product_id parameter.

Status: Candidate
Phase: Assigned (20070105)
Reference: MILW0RM:3074
Reference: URL:http://milw0rm.com/exploits/3074
Reference: FRSIRT:ADV-2007-0036
Reference: URL:http://www.frsirt.com/english/advisories/2007/0036
Reference: SECUNIA:23610
Reference: URL:http://secunia.com/advisories/23610
Reference: XF:esmartcart-productdetail-sql-injection(31243)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31243

Votes:

Description:
SQL injection vulnerability in page.php in Simple Web Content Management System allows remote attackers to execute arbitrary SQL commands via the id parameter.

Status: Candidate
Phase: Assigned (20070105)
Reference: BUGTRAQ:20070103 Simple Web Content Management System SQL Injection Exploit
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455814/100/0/threaded
Reference: MISC:http://acid-root.new.fr/poc/18070102.txt
Reference: MILW0RM:3076
Reference: URL:http://milw0rm.com/exploits/3076
Reference: FRSIRT:ADV-2007-0040
Reference: URL:http://www.frsirt.com/english/advisories/2007/0040
Reference: SECUNIA:23590
Reference: URL:http://secunia.com/advisories/23590
Reference: SREASON:2106
Reference: URL:http://securityreason.com/securityalert/2106
Reference: XF:swcms-page-sql-injection(31261)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31261

Votes:

Description:
Sven Moderow GuestBook 0.3a stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for (1) gbook97.mdb or (2) gbook.mdb in ~db/.

Status: Candidate
Phase: Assigned (20070105)
Reference: BUGTRAQ:20070103 GuestBook v0.3a Remote Password Disclosure
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455788/100/0/threaded
Reference: MISC:http://aria-security.com/forum/showthread.php?p=114
Reference: SREASON:2105
Reference: URL:http://securityreason.com/securityalert/2105
Reference: XF:guestbook-gbook-information-disclosure(31245)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31245

Votes:

Description:
phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message.

Status: Candidate
Phase: Assigned (20070105)
Reference: FULLDISC:20070102 Inforamtion Discloser Vulnerabilities in phpMyAdmin
Reference: URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051544.html
Reference: MANDRIVA:MDKSA-2007:199
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:199
Reference: SREASON:2104
Reference: URL:http://securityreason.com/securityalert/2104
Reference: XF:phpmyadmin-darkblueorange-path-disclosure(31223)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31223

Votes:

Description:
CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for DataBase/Carbon2.4d.mdb.

Status: Candidate
Phase: Assigned (20070105)
Reference: MISC:http://aria-security.com/forum/showthread.php?t=85
Reference: FRSIRT:ADV-2007-0038
Reference: URL:http://www.frsirt.com/english/advisories/2007/0038
Reference: XF:carboncommunities-carbon2-info-disclosure(31253)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31253

Votes:

Description:
Multiple stack-based buffer overflows in the (1) LoadTree and (2) ReadHeader functions in PAISO.DLL 1.7.3.0 (1.7.3 beta) in ConeXware PowerArchiver 2006 9.64.02 allow user-assisted attackers to execute arbitrary code via a crafted ISO file containing a file within several nested directories.

Status: Candidate
Phase: Assigned (20070105)
Reference: BUGTRAQ:20070104 [vuln.sg] PowerArchiver PAISO.DLL Buffer Overflow Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455892/100/0/threaded
Reference: FULLDISC:20070104 PowerArchiver PAISO.DLL Buffer Overflow
Reference: URL:http://marc.theaimsgroup.com/?l=full-disclosure&m=116791509125050&w=2
Reference: MISC:http://vuln.sg/powarc964-en.html
Reference: FRSIRT:ADV-2007-0041
Reference: URL:http://www.frsirt.com/english/advisories/2007/0041
Reference: SECUNIA:23559
Reference: URL:http://secunia.com/advisories/23559
Reference: XF:powerarchiver-loadtree-readheader-bo(31263)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31263

Votes:

Description:
Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.

Status: Candidate
Phase: Assigned (20070105)
Reference: MILW0RM:3075
Reference: URL:http://milw0rm.com/exploits/3075
Reference: FRSIRT:ADV-2007-0035
Reference: URL:http://www.frsirt.com/english/advisories/2007/0035
Reference: XF:verliadmin-language-file-include(31241)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31241

Votes:

Description:
Race condition in the msxml3 module in Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) via many nested tags in an XML document in an IFRAME, when synchronous document rendering is frequently disrupted with asynchronous events, as demonstrated using a JavaScript timer, which can trigger null pointer dereferences or memory corruption.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070104 Concurrency strikes MSIE (potentially exploitable msxml3 flaws)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455965/100/0/threaded
Reference: BUGTRAQ:20070104 RE: [Full-disclosure] Concurrency strikes MSIE (potentially exploitablemsxml3 flaws)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455986/100/0/threaded
Reference: BUGTRAQ:20070104 Re: RE: [Full-disclosure] Concurrency strikes MSIE (potentially exploitablemsxml3 flaws)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456343/100/0/threaded
Reference: FULLDISC:20070104 Concurrency strikes MSIE (potentially exploitable msxml3 flaws)
Reference: URL:http://seclists.org/fulldisclosure/2007/Jan/0110.html
Reference: MISC:http://isc.sans.org/diary.php?storyid=2004
Reference: BID:21872
Reference: URL:http://www.securityfocus.com/bid/21872
Reference: SECUNIA:23655
Reference: URL:http://secunia.com/advisories/23655

Votes:

Description:
The Perforce client does not restrict the set of files that it overwrites upon receiving a request from the server, which allows remote attackers to overwrite arbitrary files by modifying the client config file on the server, or by operating a malicious server.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070104 Perforce client: security hole by design
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455977/100/0/threaded

Votes:

Description:
Cross-site request forgery (CSRF) vulnerability in SPINE allows remote attackers to perform unauthorized actions as administrators via unspecified vectors. NOTE: some of these details are obtained from third party information.

Status: Candidate
Phase: Assigned (20070108)
Reference: MISC:http://spine.sourceforge.net/changelog.html
Reference: FRSIRT:ADV-2007-0042
Reference: URL:http://www.frsirt.com/english/advisories/2007/0042
Reference: SECUNIA:23537
Reference: URL:http://secunia.com/advisories/23537
Reference: XF:spine-unspecified-csrf(31283)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31283

Votes:

Description:
The Adobe PDF specification 1.3, as implemented by Apple Mac OS X Preview, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Status: Candidate
Phase: Assigned (20070108)
Reference: MISC:http://projects.info-pull.com/moab/MOAB-06-01-2007.html
Reference: CONFIRM:http://docs.info.apple.com/article.html?artnum=305214
Reference: CERT:TA07-072A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-072A.html
Reference: BID:21910
Reference: URL:http://www.securityfocus.com/bid/21910
Reference: FRSIRT:ADV-2007-0930
Reference: URL:http://www.frsirt.com/english/advisories/2007/0930
Reference: SECTRACK:1017749
Reference: URL:http://www.securitytracker.com/id?1017749
Reference: SECUNIA:24479
Reference: URL:http://secunia.com/advisories/24479
Reference: XF:multiple-vendor-pdf-code-execution(31364)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31364

Votes:

Description:
The Adobe PDF specification 1.3, as implemented by Adobe Acrobat before 8.0.0, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Status: Candidate
Phase: Assigned (20070108)
Reference: CONFIRM:http://docs.info.apple.com/article.html?artnum=305214
Reference: CERT:TA07-072A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-072A.html
Reference: BID:21910
Reference: URL:http://www.securityfocus.com/bid/21910
Reference: MISC:http://projects.info-pull.com/moab/MOAB-06-01-2007.html
Reference: FRSIRT:ADV-2007-0930
Reference: URL:http://www.frsirt.com/english/advisories/2007/0930
Reference: SECTRACK:1017749
Reference: URL:http://www.securitytracker.com/id?1017749
Reference: SECUNIA:24479
Reference: URL:http://secunia.com/advisories/24479
Reference: XF:multiple-vendor-pdf-code-execution(31364)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31364

Votes:

Description:
The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070116 [KDE Security Advisory] kpdf/kword/xpdf denial of service vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/457055/100/0/threaded
Reference: CONFIRM:http://www.kde.org/info/security/advisory-20070115-1.txt
Reference: CONFIRM:https://issues.rpath.com/browse/RPL-964
Reference: CONFIRM:http://support.novell.com/techcenter/psdb/44d7cb9b669d58e0ce5aa5d7ab2c7c53.html
Reference: CONFIRM:http://docs.info.apple.com/article.html?artnum=305214
Reference: MANDRIVA:MDKSA-2007:018
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:018
Reference: MANDRIVA:MDKSA-2007:020
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:020
Reference: MANDRIVA:MDKSA-2007:022
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:022
Reference: MANDRIVA:MDKSA-2007:019
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:019
Reference: MANDRIVA:MDKSA-2007:021
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:021
Reference: MANDRIVA:MDKSA-2007:024
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:024
Reference: SUSE:SUSE-SR:2007:003
Reference: URL:http://www.novell.com/linux/security/advisories/2007_3_sr.html
Reference: UBUNTU:USN-410-1
Reference: URL:http://www.ubuntu.com/usn/usn-410-1
Reference: UBUNTU:USN-410-2
Reference: URL:http://www.ubuntu.com/usn/usn-410-2
Reference: CERT:TA07-072A
Reference: URL:http://www.us-cert.gov/cas/techalerts/TA07-072A.html
Reference: BID:21910
Reference: URL:http://www.securityfocus.com/bid/21910
Reference: MISC:http://projects.info-pull.com/moab/MOAB-06-01-2007.html
Reference: FRSIRT:ADV-2007-0203
Reference: URL:http://www.frsirt.com/english/advisories/2007/0203
Reference: FRSIRT:ADV-2007-0212
Reference: URL:http://www.frsirt.com/english/advisories/2007/0212
Reference: FRSIRT:ADV-2007-0244
Reference: URL:http://www.frsirt.com/english/advisories/2007/0244
Reference: FRSIRT:ADV-2007-0930
Reference: URL:http://www.frsirt.com/english/advisories/2007/0930
Reference: SECTRACK:1017514
Reference: URL:http://securitytracker.com/id?1017514
Reference: SECTRACK:1017749
Reference: URL:http://www.securitytracker.com/id?1017749
Reference: SECUNIA:23799
Reference: URL:http://secunia.com/advisories/23799
Reference: SECUNIA:23791
Reference: URL:http://secunia.com/advisories/23791
Reference: SECUNIA:23808
Reference: URL:http://secunia.com/advisories/23808
Reference: SECUNIA:23813
Reference: URL:http://secunia.com/advisories/23813
Reference: SECUNIA:23815
Reference: URL:http://secunia.com/advisories/23815
Reference: SECUNIA:23844
Reference: URL:http://secunia.com/advisories/23844
Reference: SECUNIA:23839
Reference: URL:http://secunia.com/advisories/23839
Reference: SECUNIA:23876
Reference: URL:http://secunia.com/advisories/23876
Reference: SECUNIA:24204
Reference: URL:http://secunia.com/advisories/24204
Reference: SECUNIA:24479
Reference: URL:http://secunia.com/advisories/24479
Reference: XF:multiple-vendor-pdf-code-execution(31364)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31364

Votes:

Description:
Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted HTTP GET request.

Status: Candidate
Phase: Assigned (20070108)
Reference: CISCO:20070105 Multiple Vulnerabilities in Cisco Secure Access Control Server
Reference: URL:http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml
Reference: CERT-VN:VU#744249
Reference: URL:http://www.kb.cert.org/vuls/id/744249
Reference: BID:21900
Reference: URL:http://www.securityfocus.com/bid/21900
Reference: FRSIRT:ADV-2007-0068
Reference: URL:http://www.frsirt.com/english/advisories/2007/0068
Reference: OSVDB:32642
Reference: URL:http://www.osvdb.org/32642
Reference: SECTRACK:1017475
Reference: URL:http://securitytracker.com/id?1017475
Reference: SECUNIA:23629
Reference: URL:http://secunia.com/advisories/23629
Reference: XF:cisco-acs-csadmin-bo(31323)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31323

Votes:

Description:
Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 Advisory 01/2007: WordPress CSRF Protection XSS Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456048/100/0/threaded
Reference: MISC:http://www.hardened-php.net/advisory_012007.140.html
Reference: CONFIRM:http://wordpress.org/development/2007/01/wordpress-206/
Reference: BID:21893
Reference: URL:http://www.securityfocus.com/bid/21893
Reference: FRSIRT:ADV-2007-0061
Reference: URL:http://www.frsirt.com/english/advisories/2007/0061
Reference: SECUNIA:23595
Reference: URL:http://secunia.com/advisories/23595
Reference: SREASON:2114
Reference: URL:http://securityreason.com/securityalert/2114

Votes:

Description:
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 Advisory 02/2007: WordPress Trackback Charset Decoding SQL Injection Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456049/100/0/threaded
Reference: MISC:http://www.hardened-php.net/advisory_022007.141.html
Reference: CONFIRM:http://wordpress.org/development/2007/01/wordpress-206/
Reference: GENTOO:GLSA-200701-10
Reference: URL:http://security.gentoo.org/glsa/glsa-200701-10.xml
Reference: OPENPKG:OpenPKG-SA-2007.005
Reference: URL:http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html
Reference: BID:21907
Reference: URL:http://www.securityfocus.com/bid/21907
Reference: FRSIRT:ADV-2007-0061
Reference: URL:http://www.frsirt.com/english/advisories/2007/0061
Reference: SECUNIA:23595
Reference: URL:http://secunia.com/advisories/23595
Reference: SECUNIA:23741
Reference: URL:http://secunia.com/advisories/23741
Reference: SREASON:2112
Reference: URL:http://securityreason.com/securityalert/2112
Reference: XF:wordpress-mbstring-security-bypass(31297)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31297

Votes:

Description:
nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/2003 does not delete user profiles during a Terminal Service or Citrix session, which allows remote authenticated users to invoke alternate user profiles.

Status: Candidate
Phase: Assigned (20070108)
Reference: CONFIRM:http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974970.htm
Reference: BID:21886
Reference: URL:http://www.securityfocus.com/bid/21886
Reference: FRSIRT:ADV-2007-0064
Reference: URL:http://www.frsirt.com/english/advisories/2007/0064
Reference: SECTRACK:1017471
Reference: URL:http://securitytracker.com/id?1017471
Reference: SECUNIA:23619
Reference: URL:http://secunia.com/advisories/23619
Reference: XF:novell-profile-security-bypass(31343)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31343

Votes:

Description:
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070103 Wordpress <= 2.x dictionnary & Bruteforce attack
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/455927/100/0/threaded
Reference: GENTOO:GLSA-200701-10
Reference: URL:http://security.gentoo.org/glsa/glsa-200701-10.xml
Reference: FRSIRT:ADV-2007-0062
Reference: URL:http://www.frsirt.com/english/advisories/2007/0062
Reference: SECUNIA:23621
Reference: URL:http://secunia.com/advisories/23621
Reference: SECUNIA:23741
Reference: URL:http://secunia.com/advisories/23741
Reference: SREASON:2113
Reference: URL:http://securityreason.com/securityalert/2113
Reference: XF:wordpress-account-enumeration(31262)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31262

Votes:

Description:
Cross-site scripting (XSS) vulnerability in nidp/idff/sso in Novell Access Manager Identity Server before 3.0.0-1013 allows remote attackers to inject arbitrary web script or HTML via the IssueInstant parameter, which is not properly handled in the resulting error message.

Status: Candidate
Phase: Assigned (20070108)
Reference: CONFIRM:https://secure-support.novell.com/KanisaPlatform/Publishing/143/3615264_f.SAL_Public.html
Reference: BID:21921
Reference: URL:http://www.securityfocus.com/bid/21921
Reference: FRSIRT:ADV-2007-0073
Reference: URL:http://www.frsirt.com/english/advisories/2007/0073
Reference: SECTRACK:1017483
Reference: URL:http://securitytracker.com/id?1017483
Reference: SECUNIA:23654
Reference: URL:http://secunia.com/advisories/23654

Votes:

Description:
Buffer overflow in Resco Photo Viewer for PocketPC 4.11 and 6.01, as used in mobile devices running Windows Mobile 5.0, 2003, and 2003SE, allows remote attackers to execute arbitrary code via a crafted PNG image.

Status: Candidate
Phase: Assigned (20070108)
Reference: MISC:http://blog.trendmicro.com/flaw-in-3rd-party-app-weakens-windows-mobile/
Reference: MISC:http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VName=Vulnerability+in+Resco+Photo+Viewer+6%2E01+Enabling+Code+Injection+and+Arbitrary+Code+Execution
Reference: BID:21920
Reference: URL:http://www.securityfocus.com/bid/21920
Reference: FRSIRT:ADV-2007-0072
Reference: URL:http://www.frsirt.com/english/advisories/2007/0072
Reference: SECUNIA:23658
Reference: URL:http://secunia.com/advisories/23658

Votes:

Description:
SQL injection vulnerability in cats.asp in createauction allows remote attackers to execute arbitrary SQL commands via the catid parameter.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070107 createauction (cats.asp) Remote SQL Injection Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456272/100/0/threaded
Reference: BID:21929
Reference: URL:http://www.securityfocus.com/bid/21929
Reference: SREASON:2111
Reference: URL:http://securityreason.com/securityalert/2111
Reference: XF:createauction-cats-sql-injection(31356)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31356

Votes:

Description:
Buffer overflow in Packeteer PacketShaper PacketWise 8.x allows remote authenticated users to cause a denial of service (reset or reboot) via (1) a long traffic class argument to the "class show" command or (2) a long POLICY parameter value in clastree.htm.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070108 Packeteer PacketWise CLI overflow DoS
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456267/100/0/threaded
Reference: BID:21933
Reference: URL:http://www.securityfocus.com/bid/21933
Reference: FRSIRT:ADV-2007-0098
Reference: URL:http://www.frsirt.com/english/advisories/2007/0098
Reference: SECUNIA:23685
Reference: URL:http://secunia.com/advisories/23685
Reference: SREASON:2110
Reference: URL:http://securityreason.com/securityalert/2110
Reference: XF:packetshaper-argument-dos(31357)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31357

Votes:

Description:
Sun Java System Content Delivery Server 5.0 and 5.0 PU1 allows remote attackers to obtain sensitive information regarding "content details" via unspecified vectors.

Status: Candidate
Phase: Assigned (20070108)
Reference: SUNALERT:102764
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102764-1
Reference: BID:21908
Reference: URL:http://www.securityfocus.com/bid/21908
Reference: FRSIRT:ADV-2007-0076
Reference: URL:http://www.frsirt.com/english/advisories/2007/0076
Reference: SECUNIA:23630
Reference: URL:http://secunia.com/advisories/23630
Reference: XF:sun-java-cds-info-disclosure(31345)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31345

Votes:

Description:
Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php, which is injected into an error message in security.log.php, which can then be accessed using viewlog.php.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 Coppermine Photo Gallery <= 1.4.10 SQL Injection Exploit
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456051/100/0/threaded
Reference: VIM:20070108 Source verify - Coppermine Photo Gallery <= 1.4.10 code injection
Reference: URL:http://www.attrition.org/pipermail/vim/2007-January/001218.html
Reference: MISC:http://acid-root.new.fr/poc/19070104.txt
Reference: SREASON:2107
Reference: URL:http://securityreason.com/securityalert/2107

Votes:

Description:
Digger Solutions Intranet Open Source (IOS) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 Intranet Open Source Remote Password Disclosure "intranet.mdb"
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456047/100/0/threaded
Reference: MISC:http://aria-security.com/forum/showthread.php?goto=newpost&t=88
Reference: SREASON:2109
Reference: URL:http://securityreason.com/securityalert/2109
Reference: XF:intranet-intranet-info-disclosure(31308)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31308

Votes:

Description:
DiskManagementTool in the DiskManagement.framework 92.29 on Mac OS X 10.4.8 does not properly validate Bill of Materials (BOM) files, which allows attackers to gain privileges via a BOM file under /Library/Receipts/, which triggers arbitrary file permission changes upon execution of a diskutil permission repair operation.

Status: Candidate
Phase: Assigned (20070108)
Reference: MISC:http://projects.info-pull.com/moab/MOAB-05-01-2007.html
Reference: BID:21899
Reference: URL:http://www.securityfocus.com/bid/21899
Reference: FRSIRT:ADV-2007-0074
Reference: URL:http://www.frsirt.com/english/advisories/2007/0074
Reference: SECUNIA:23653
Reference: URL:http://secunia.com/advisories/23653

Votes:

Description:
Multiple absolute path traversal vulnerabilities in EditTag 1.2 allow remote attackers to read arbitrary files via an absolute pathname in the file parameter to (1) edittag.cgi, (2) edittag.pl, (3) edittag_mp.cgi, or (4) edittag_mp.pl.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 Multiple bugs in EditTag
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456055/100/0/threaded
Reference: BID:21890
Reference: URL:http://www.securityfocus.com/bid/21890
Reference: SECUNIA:7950
Reference: URL:http://secunia.com/advisories/7950

Votes:

Description:
Multiple cross-site scripting (XSS) vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain parameter to (1) mkpw_mp.cgi, (2) mkpw.pl, or (3) mkpw.cgi.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 Multiple bugs in EditTag
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456055/100/0/threaded
Reference: BID:21891
Reference: URL:http://www.securityfocus.com/bid/21891
Reference: SECUNIA:7950
Reference: URL:http://secunia.com/advisories/7950

Votes:

Description:
Acunetix Web Vulnerability Scanner (WVS) 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of service (application crash) via multiple HTTP requests containing invalid Content-Length values.

Status: Candidate
Phase: Assigned (20070108)
Reference: MILW0RM:3078
Reference: URL:http://milw0rm.com/exploits/3078
Reference: BID:21898
Reference: URL:http://www.securityfocus.com/bid/21898
Reference: XF:acunetix-content-length-dos(31279)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31279

Votes:

Description:
Cross-site scripting (XSS) vulnerability in search.asp in RI Blog 1.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 RI Blog 1.3 XSS Vuln.
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456052/100/0/threaded
Reference: BID:21880
Reference: URL:http://www.securityfocus.com/bid/21880
Reference: FRSIRT:ADV-2007-0083
Reference: URL:http://www.frsirt.com/english/advisories/2007/0083
Reference: SECUNIA:23657
Reference: URL:http://secunia.com/advisories/23657
Reference: SREASON:2108
Reference: URL:http://securityreason.com/securityalert/2108
Reference: XF:riblog-search-xss(31317)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31317

Votes:

Description:
Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via (1) the cat parameter to albmgr.php, and possibly (2) the gid parameter to usermgr.php; (3) the start parameter to db_ecard.php; and the albumid parameter to unspecified files, related to the (4) filename_to_title and (5) del_titles functions.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 Coppermine Photo Gallery <= 1.4.10 SQL Injection Exploit
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456051/100/0/threaded
Reference: MILW0RM:3085
Reference: URL:http://milw0rm.com/exploits/3085
Reference: MISC:http://acid-root.new.fr/poc/19070104.txt
Reference: BID:21894
Reference: URL:http://www.securityfocus.com/bid/21894
Reference: SECUNIA:25846
Reference: URL:http://secunia.com/advisories/25846
Reference: SREASON:2123
Reference: URL:http://securityreason.com/securityalert/2123

Votes:

Description:
Unrestricted file upload vulnerability in Uber Uploader 4.2 allows remote attackers to upload and execute arbitrary PHP scripts by naming them with a .phtml extension, which bypasses the .php extension check but is still executable on some server configurations.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 Uber Uploader 4.2 Arbitrary File Upload Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456045/100/0/threaded
Reference: SREASON:2116
Reference: URL:http://securityreason.com/securityalert/2116
Reference: XF:uber-uploader-phtml-file-upload(31303)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31303

Votes:

Description:
Unspecified vulnerability in Drupal before 4.6.11, and 4.7 before 4.7.5, when MySQL is used, allows remote authenticated users to cause a denial of service by poisoning the page cache via unspecified vectors, which triggers erroneous 404 HTTP errors for pages that exist.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 [DRUPAL-SA-2007-002] Drupal 4.6.11 / 4.7.5 fixes DoS issue
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456056/100/0/threaded
Reference: CONFIRM:http://drupal.org/node/104238
Reference: BID:21895
Reference: URL:http://www.securityfocus.com/bid/21895
Reference: FRSIRT:ADV-2007-0051
Reference: URL:http://www.frsirt.com/english/advisories/2007/0051
Reference: SECUNIA:23586
Reference: URL:http://secunia.com/advisories/23586
Reference: SREASON:2115
Reference: URL:http://securityreason.com/securityalert/2115

Votes:

Description:
Kaspersky Labs Antivirus Engine 6.0 for Windows and 5.5-10 for Linux before 20070102 enter an infinite loop upon encountering an invalid NumberOfRvaAndSizes value in the Optional Windows Header of a portable executable (PE) file, which allows remote attackers to cause a denial of service (CPU consumption) by scanning a crafted PE file.

Status: Candidate
Phase: Assigned (20070108)
Reference: IDEFENSE:20070105 Kaspersky Antivirus Scan Engine PE File Denial of Service Vulnerability
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=459
Reference: BID:21901
Reference: URL:http://www.securityfocus.com/bid/21901
Reference: FRSIRT:ADV-2007-0067
Reference: URL:http://www.frsirt.com/english/advisories/2007/0067
Reference: SECTRACK:1017476
Reference: URL:http://securitytracker.com/id?1017476
Reference: SECUNIA:23575
Reference: URL:http://secunia.com/advisories/23575
Reference: XF:kaspersky-antivirus-pe-dos(31315)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31315

Votes:

Description:
Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index bytes in the Define Huffman Table (DHT) marker.

Status: Candidate
Phase: Assigned (20070108)
Reference: IDEFENSE:20070105 Opera Software Opera Web Browser JPG Image DHT Marker Heap Corruption Vulnerability
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457
Reference: CONFIRM:http://www.opera.com/support/search/supsearch.dml?index=852
Reference: GENTOO:GLSA-200701-08
Reference: URL:http://www.gentoo.org/security/en/glsa/glsa-200701-08.xml
Reference: SUSE:SUSE-SA:2007:009
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Jan/0009.html
Reference: FRSIRT:ADV-2007-0060
Reference: URL:http://www.frsirt.com/english/advisories/2007/0060
Reference: SECTRACK:1017473
Reference: URL:http://securitytracker.com/id?1017473
Reference: SECUNIA:23613
Reference: URL:http://secunia.com/advisories/23613
Reference: SECUNIA:23739
Reference: URL:http://secunia.com/advisories/23739
Reference: SECUNIA:23771
Reference: URL:http://secunia.com/advisories/23771
Reference: XF:opera-jpeg-dht-bo(31305)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31305

Votes:

Description:
The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.

Status: Candidate
Phase: Assigned (20070108)
Reference: IDEFENSE:20070105 Opera Software Opera Web Browser createSVGTransformFromMatrix Object Typecasting Vulnerability
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458
Reference: CONFIRM:http://www.opera.com/support/search/supsearch.dml?index=851
Reference: GENTOO:GLSA-200701-08
Reference: URL:http://www.gentoo.org/security/en/glsa/glsa-200701-08.xml
Reference: SUSE:SUSE-SA:2007:009
Reference: URL:http://lists.suse.com/archive/suse-security-announce/2007-Jan/0009.html
Reference: FRSIRT:ADV-2007-0060
Reference: URL:http://www.frsirt.com/english/advisories/2007/0060
Reference: SECTRACK:1017473
Reference: URL:http://securitytracker.com/id?1017473
Reference: SECUNIA:23613
Reference: URL:http://secunia.com/advisories/23613
Reference: SECUNIA:23739
Reference: URL:http://secunia.com/advisories/23739
Reference: SECUNIA:23771
Reference: URL:http://secunia.com/advisories/23771

Votes:

Description:
SQL injection vulnerability in info_book.asp in Digirez 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the book_id parameter.

Status: Candidate
Phase: Assigned (20070108)
Reference: MILW0RM:3081
Reference: URL:http://milw0rm.com/exploits/3081
Reference: FRSIRT:ADV-2007-0053
Reference: URL:http://www.frsirt.com/english/advisories/2007/0053
Reference: SECUNIA:23606
Reference: URL:http://secunia.com/advisories/23606

Votes:

Description:
SQL injection vulnerability in main.asp in LocazoList 2.01a beta5 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatID parameter.

Status: Candidate
Phase: Assigned (20070108)
Reference: MILW0RM:3073
Reference: URL:http://milw0rm.com/exploits/3073
Reference: FRSIRT:ADV-2007-0052
Reference: URL:http://www.frsirt.com/english/advisories/2007/0052
Reference: XF:locazolist-main-sql-injection(31242)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31242

Votes:

Description:
SQL injection vulnerability in user.php in iGeneric iG Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 IG Calendar SQL Injection
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456044/100/0/threaded
Reference: MILW0RM:3082
Reference: URL:http://milw0rm.com/exploits/3082
Reference: BID:21873
Reference: URL:http://www.securityfocus.com/bid/21873
Reference: FRSIRT:ADV-2007-0055
Reference: URL:http://www.frsirt.com/english/advisories/2007/0055
Reference: SECUNIA:23602
Reference: URL:http://secunia.com/advisories/23602
Reference: XF:igcalendar-user-sql-injection(31300)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31300

Votes:

Description:
JAMWiki before 0.5.0 does not properly check permissions during moves of "read-only or admin-only topics," which allows remote attackers to make unauthorized changes to the wiki.

Status: Candidate
Phase: Assigned (20070108)
Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?group_id=171441&release_id=475663
Reference: BID:21879
Reference: URL:http://www.securityfocus.com/bid/21879
Reference: SECUNIA:23634
Reference: URL:http://secunia.com/advisories/23634
Reference: XF:jamwiki-permission-security-bypass(31296)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31296

Votes:

Description:
SQL injection vulnerability in compare_product.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 IG Shop remote code execution
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456043/100/0/threaded
Reference: MILW0RM:3083
Reference: URL:http://milw0rm.com/exploits/3083
Reference: MISC:http://packetstormsecurity.nl/0701-exploits/igshop10-multiple.txt
Reference: BID:21874
Reference: URL:http://www.securityfocus.com/bid/21874
Reference: FRSIRT:ADV-2007-0056
Reference: URL:http://www.frsirt.com/english/advisories/2007/0056
Reference: SECUNIA:23604
Reference: URL:http://secunia.com/advisories/23604
Reference: XF:igshop-compareproduct-sql-injection(31299)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31299

Votes:

Description:
Multiple SQL injection vulnerabilities in display_review.php in iGeneric iG Shop 1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) user_login_cookie parameter.

Status: Candidate
Phase: Assigned (20070108)
Reference: FRSIRT:ADV-2007-0056
Reference: URL:http://www.frsirt.com/english/advisories/2007/0056

Votes:

Description:
Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in (1) cart.php and (2) page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1.4.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 IG Shop remote code execution
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456043/100/0/threaded
Reference: BUGTRAQ:20070619 iG Shop 1.4 eval Inclusion Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/471722/100/0/threaded
Reference: MISC:http://packetstormsecurity.nl/0701-exploits/igshop10-multiple.txt
Reference: MILW0RM:3083
Reference: URL:http://milw0rm.com/exploits/3083
Reference: VIM:20070618 Dup: iG Shop 1.4 (page.php) Remote Code Execution Exploit
Reference: URL:http://www.attrition.org/pipermail/vim/2007-June/001664.html
Reference: BID:21875
Reference: URL:http://www.securityfocus.com/bid/21875
Reference: FRSIRT:ADV-2007-0056
Reference: URL:http://www.frsirt.com/english/advisories/2007/0056
Reference: SECUNIA:23604
Reference: URL:http://secunia.com/advisories/23604
Reference: XF:igshop-cartpage-code-execution(31301)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31301

Votes:

Description:
PHP remote file inclusion vulnerability in inc/init.inc.php in Aratix 0.2.2 beta 11 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the current_path parameter.

Status: Candidate
Phase: Assigned (20070108)
Reference: VIM:20070108 Source verify of Aratix RFI
Reference: URL:http://www.attrition.org/pipermail/vim/2007-January/001219.html
Reference: MISC:http://securityreason.com/exploitalert/1698
Reference: MILW0RM:3079
Reference: URL:http://milw0rm.com/exploits/3079
Reference: FRSIRT:ADV-2007-0054
Reference: URL:http://www.frsirt.com/english/advisories/2007/0054
Reference: XF:aratix-init-file-include(31282)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31282

Votes:

Description:
Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in the (1) filter and (2) system modules. NOTE: some of these details are obtained from third party information.

Status: Candidate
Phase: Assigned (20070108)
Reference: BUGTRAQ:20070105 [DRUPAL-SA-2007-001] Drupal 4.6.11 / 4.7.5 fixes XSS issue
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456054/100/100/threaded
Reference: FULLDISC:20070105 [DRUPAL-SA-2007-001] Drupal 4.6.11 / 4.7.5 fixes
Reference: URL:http://marc.theaimsgroup.com/?l=full-disclosure&m=116799778408115&w=2
Reference: CONFIRM:http://drupal.org/node/104233
Reference: CONFIRM:http://drupal.org/files/sa-2007-001/advisory.txt
Reference: FRSIRT:ADV-2007-0050
Reference: URL:http://www.frsirt.com/english/advisories/2007/0050
Reference: XF:drupal-core-unspecified-xss(31311)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31311

Votes:

Description:
Cross-site scripting (XSS) vulnerability in SimpleBoxes/SerendipityNZ Serene Bach 2.05R and earlier, and 2.08D and earlier in the 2.08 series; and (2) sb 1.13D and earlier, and 1.18R and earlier in the 1.18 series; allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Status: Candidate
Phase: Assigned (20070108)
Reference: MISC:http://jvn.jp/jp/JVN%2365500885/index.html
Reference: CONFIRM:http://serenebach.net/log/sb119R.html
Reference: CONFIRM:http://serenebach.net/log/sb209R.html
Reference: BID:21884
Reference: URL:http://www.securityfocus.com/bid/21884
Reference: FRSIRT:ADV-2007-0065
Reference: URL:http://www.frsirt.com/english/advisories/2007/0065
Reference: SECTRACK:1017470
Reference: URL:http://securitytracker.com/id?1017470
Reference: SECUNIA:23623
Reference: URL:http://secunia.com/advisories/23623
Reference: XF:serene-bach-unspecified-xss(31302)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31302

Votes:

Description:
formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with (1) AbfrageForm or (2) EingabeForm, allows remote attackers to cause a denial of service (daemon crash) via multiple requests containing many /../ sequences in the Name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

Status: Candidate
Phase: Assigned (20070108)
Reference: SECUNIA:23539
Reference: URL:http://secunia.com/advisories/23539
Reference: XF:formbankserver-formbank-dos(31216)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31216

Votes:

Description:
Unspecified vulnerability in the DECnet-Plus 7.3-2 feature in DECnet/OSI 7.3-2 for OpenVMS ALPHA, and the DECnet-Plus 7.3 feature in DECnet/OSI 7.3 for OpenVMS VAX, allows attackers to obtain "unintended privileged access to data and system resources" via unspecified vectors, related to (1) [SYSEXE]CTF$UI.EXE, (2) [SYSMSG]CTF$MESSAGES.EXE, (3) [SYSHLP]CTF$HELP.HLB, and (4) [SYSMGR]CTF$STARTUP.COM.

Status: Candidate
Phase: Assigned (20070108)
Reference: CONFIRM:ftp://ftp.itrc.hp.com/openvms_patches/alpha/V7.3-2/AXP_DNVOSIMUP01-V0703-2.txt
Reference: CONFIRM:ftp://ftp.itrc.hp.com/openvms_patches/vax/V7.3/VAX_DNVOSIMUP01-V0703.txt
Reference: FRSIRT:ADV-2007-0063
Reference: URL:http://www.frsirt.com/english/advisories/2007/0063
Reference: SECUNIA:23636
Reference: URL:http://secunia.com/advisories/23636

Votes:

Description:
SQL injection vulnerability in down.asp in Kolayindir Download (Yenionline) allows remote attackers to execute arbitrary SQL commands via the id parameter.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070105 Kolayindir Download (Yenionline) (tr) SqL Injection Vuln.
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456068/100/0/threaded
Reference: BID:21889
Reference: URL:http://www.securityfocus.com/bid/21889
Reference: FRSIRT:ADV-2007-0079
Reference: URL:http://www.frsirt.com/english/advisories/2007/0079
Reference: SECUNIA:23645
Reference: URL:http://secunia.com/advisories/23645
Reference: SREASON:2122
Reference: URL:http://securityreason.com/securityalert/2122
Reference: XF:kolayindirdownload-down-sql-injection(31320)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31320

Votes:

Description:
Cross-site scripting (XSS) vulnerability in yald.php in Yet Another Link Directory 1.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070106 Yet Another Link Directory v1.0
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456122/100/0/threaded
Reference: BID:21904
Reference: URL:http://www.securityfocus.com/bid/21904
Reference: FRSIRT:ADV-2007-0082
Reference: URL:http://www.frsirt.com/english/advisories/2007/0082
Reference: SECUNIA:23646
Reference: URL:http://secunia.com/advisories/23646
Reference: SREASON:2121
Reference: URL:http://securityreason.com/securityalert/2121
Reference: XF:yald-yald-xss(31322)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31322

Votes:

Description:
SQL injection vulnerability in orange.asp in ShopStoreNow E-commerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the CatID parameter.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070106 shopstorenow (orange.asp) sql injection
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456127/100/0/threaded
Reference: BID:21905
Reference: URL:http://www.securityfocus.com/bid/21905
Reference: FRSIRT:ADV-2007-0080
Reference: URL:http://www.frsirt.com/english/advisories/2007/0080
Reference: SECUNIA:23642
Reference: URL:http://secunia.com/advisories/23642
Reference: SREASON:2120
Reference: URL:http://securityreason.com/securityalert/2120
Reference: XF:shopstorenow-orange-sql-injection(31313)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31313

Votes:

Description:
Multiple PHP remote file inclusion vulnerabilities in NUNE News Script 2.0pre2 allow remote attackers to execute arbitrary PHP code via a URL in the custom_admin_path parameter to (1) index.php or (2) archives.php.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 NUNE News Script (custom_admin_path) Remote File Include Vulnerablity
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456242/100/0/threaded
Reference: MILW0RM:3090
Reference: URL:http://milw0rm.com/exploits/3090
Reference: FRSIRT:ADV-2007-0078
Reference: URL:http://www.frsirt.com/english/advisories/2007/0078
Reference: SECUNIA:23635
Reference: URL:http://secunia.com/advisories/23635
Reference: XF:nune-index-archives-file-include(31312)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31312

Votes:

Description:
Cross-site scripting (XSS) vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the ordernum parameter.

Status: Candidate
Phase: Assigned (20070109)
Reference: MILW0RM:3089
Reference: URL:http://milw0rm.com/exploits/3089
Reference: SECUNIA:23652
Reference: URL:http://secunia.com/advisories/23652
Reference: XF:qos-search-xss(31321)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31321

Votes:

Description:
PHP remote file inclusion vulnerability in bn_smrep1.php in BinGoPHP News (BP News) 3.01 allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter, a different vector than CVE-2006-4648 and CVE-2006-4649.

Status: Candidate
Phase: Assigned (20070109)
Reference: SECTRACK:1017477
Reference: URL:http://securitytracker.com/id?1017477
Reference: XF:bingo-bnsmrep1-file-include(31328)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31328

Votes:

Description:
Multiple cross-site scripting (XSS) vulnerabilities in Fix and Chips CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in (a) delete-announce.php; the (2) Announcement form field in (b) staff.php; the (3) Client Name, (4) Business Name, (5) Street, (6) Address 2, (7) Town/City, (8) Postcode, (9) Phone Number, (10) Email Address and (11) Website Address form fields in (c) new_customer.php; and unspecified fields in (d) search.php and (e) client-results.php.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070106 Fix & Chips CMS v1.0
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456121/100/0/threaded
Reference: FRSIRT:ADV-2007-0081
Reference: URL:http://www.frsirt.com/english/advisories/2007/0081
Reference: OSVDB:32646
Reference: URL:http://www.osvdb.org/32646
Reference: OSVDB:32647
Reference: URL:http://www.osvdb.org/32647
Reference: OSVDB:32648
Reference: URL:http://www.osvdb.org/32648
Reference: OSVDB:32649
Reference: URL:http://www.osvdb.org/32649
Reference: OSVDB:32650
Reference: URL:http://www.osvdb.org/32650
Reference: SECUNIA:23625
Reference: URL:http://secunia.com/advisories/23625
Reference: SREASON:2119
Reference: URL:http://securityreason.com/securityalert/2119
Reference: XF:fixandchips-multiple-scripts-xss(31319)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31319

Votes:

Description:
Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles.

Status: Candidate
Phase: Assigned (20070109)
Reference: CONFIRM:http://www.cuyahoga-project.org/10/section.aspx/61
Reference: CONFIRM:http://cuyahoga.svn.sourceforge.net/viewvc/cuyahoga?view=rev&revision=551
Reference: BID:21927
Reference: URL:http://www.securityfocus.com/bid/21927
Reference: SECUNIA:23662
Reference: URL:http://secunia.com/advisories/23662

Votes:

Description:
Format string vulnerability in OmniGroup OmniWeb 5.5.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in the Javascript alert function.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070111 DMA[2007-0107a] OmniWeb Javascript Alert Format String Vulnerabiity and DMA[2007-0109a] Apple Finder Disk Image Volume Label Overflow / DoS
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456578/100/0/threaded
Reference: MISC:http://projects.info-pull.com/moab/MOAB-07-01-2007.html
Reference: MILW0RM:3098
Reference: URL:http://milw0rm.com/exploits/3098
Reference: MISC:http://www.digitalmunition.com/DMA%5B2007-0107a%5D.txt
Reference: CONFIRM:http://www.omnigroup.com/applications/omniweb/releasenotes/
Reference: CONFIRM:http://blog.omnigroup.com/2007/01/07/omniweb-552-now-available-and-more-secure/
Reference: BID:21911
Reference: URL:http://www.securityfocus.com/bid/21911
Reference: FRSIRT:ADV-2007-0075
Reference: URL:http://www.frsirt.com/english/advisories/2007/0075
Reference: SECUNIA:23624
Reference: URL:http://secunia.com/advisories/23624
Reference: XF:omniweb-alert-format-string(31324)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31324

Votes:

Description:
EMembersPro 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for users.mdb.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 EMembersPro 1.0 Remote Password Disclosure Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456228/100/0/threaded
Reference: SREASON:2118
Reference: URL:http://securityreason.com/securityalert/2118
Reference: XF:ememberspro-users-info-disclosure(31329)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31329

Votes:

Description:
Multiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a URL in the (1) page, (2) subject, and (3) q parameters.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 Dayfox Blog Remote File Include Vuln.
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456212/100/0/threaded
Reference: FRSIRT:ADV-2007-0099
Reference: URL:http://www.frsirt.com/english/advisories/2007/0099
Reference: SECUNIA:23661
Reference: URL:http://secunia.com/advisories/23661
Reference: SREASON:2117
Reference: URL:http://securityreason.com/securityalert/2117
Reference: XF:dayfoxblog-index-file-include(31336)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31336

Votes:

Description:
MitiSoft stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for access_MS/MitiSoft.mdb.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 MitiSoft Remote Password Disclosure Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456230/100/0/threaded
Reference: XF:mitisoft-mitisoft-info-disclosure(31341)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31341

Votes:

Description:
OhhASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/OhhASP.mdb.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070106 ohhASP Remote Password Disclosure
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456117/100/0/threaded
Reference: MISC:http://64.38.62.221/ariasecucom/forum/showthread.php?t=89
Reference: XF:ohhasp-ohhasp-info-disclosure(31342)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31342

Votes:

Description:
AJLogin 3.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for ajlogin.mdb.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 AJLogin v3.5 Remote Password Disclosure Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456226/100/0/threaded
Reference: SREASON:2127
Reference: URL:http://securityreason.com/securityalert/2127
Reference: XF:ajlogin-ajlogin-info-disclosure(31331)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31331

Votes:

Description:
Webulas stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/db.mdb.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 Webulas Remote Password Disclosure Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456239/100/0/threaded
Reference: SREASON:2126
Reference: URL:http://securityreason.com/securityalert/2126
Reference: XF:webulas-db-info-disclosure(31338)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31338

Votes:

Description:
HarikaOnline 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for harikaonline.mdb.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 HarikaOnline v2.0 Remote Password Disclosure Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456238/100/0/threaded
Reference: SREASON:2125
Reference: URL:http://securityreason.com/securityalert/2125
Reference: XF:harikaonline-harikaonline-info-disclosure(31339)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31339

Votes:

Description:
M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request to db/uyelik.mdb.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 M-Core Remote Password Disclosure Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456235/100/0/threaded
Reference: SREASON:2124
Reference: URL:http://securityreason.com/securityalert/2124
Reference: XF:mcore-uyelik-info-disclosure(31340)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31340

Votes:

Description:
Array index error in the uri_lookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-bit platforms, allows remote malicious servers to cause a denial of service (crash) via a URI with non-ASCII characters, which triggers a buffer under-read due to a type conversion error that generates a negative index.

Status: Candidate
Phase: Assigned (20070109)
Reference: MLIST:[neon] 20070107 invalid chars cause sigserv in neon
Reference: URL:http://mailman.webdav.org/pipermail/neon/2007-January/002362.html
Reference: MLIST:[cadaver] 20070123 release 0.22.5
Reference: URL:http://mailman.webdav.org/pipermail/cadaver/2007-January/001015.html
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi/neon26_0.26.2-3_to_mdx1.diff?bug=404723;msg=5;att=2
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=404723
Reference: CONFIRM:http://www.webdav.org/cadaver/
Reference: MANDRIVA:MDKSA-2007:013
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:013
Reference: SUSE:SUSE-SR:2007:002
Reference: URL:http://www.novell.com/linux/security/advisories/2007_02_sr.html
Reference: BID:22035
Reference: URL:http://www.securityfocus.com/bid/22035
Reference: FRSIRT:ADV-2007-0172
Reference: URL:http://www.frsirt.com/english/advisories/2007/0172
Reference: FRSIRT:ADV-2007-0362
Reference: URL:http://www.frsirt.com/english/advisories/2007/0362
Reference: SECUNIA:23763
Reference: URL:http://secunia.com/advisories/23763
Reference: SECUNIA:23751
Reference: URL:http://secunia.com/advisories/23751
Reference: SECUNIA:23984
Reference: URL:http://secunia.com/advisories/23984

Votes:

Description:
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Status: Candidate
Phase: Assigned (20070109)

Votes:

Description:
Directory traversal vulnerability in the GeoIP_update_database_general function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers (possibly only update.maxmind.com) to overwrite arbitrary files via a .. (dot dot) in the database filename, which is returned by a request to app/update_getfilename.

Status: Candidate
Phase: Assigned (20070109)
Reference: MISC:http://arctic.org/~dean/patches/GeoIP-1.4.0-update-vulnerability.patch
Reference: MANDRIVA:MDKSA-2007:004
Reference: URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:004
Reference: UBUNTU:USN-412-1
Reference: URL:http://www.ubuntu.com/usn/usn-412-1
Reference: BID:21959
Reference: URL:http://www.securityfocus.com/bid/21959
Reference: FRSIRT:ADV-2007-0117
Reference: URL:http://www.frsirt.com/english/advisories/2007/0117
Reference: FRSIRT:ADV-2007-0118
Reference: URL:http://www.frsirt.com/english/advisories/2007/0118
Reference: SECUNIA:23880
Reference: URL:http://secunia.com/advisories/23880
Reference: SECUNIA:23906
Reference: URL:http://secunia.com/advisories/23906
Reference: XF:geoip-geoipupdate-directory-traversal(31383)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31383

Votes:

Description:
Stack-based buffer overflow in the LiveJournal support (hooks/ljhook.cc) in CenterICQ 4.9.11 through 4.21.0, when using unofficial LiveJournal servers, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by adding the victim as a friend and using long (1) username and (2) real name strings.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 TK53 Advisory #1: CenterICQ remote DoS buffer overflow in LiveJournal handling
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456255/100/0/threaded
Reference: GENTOO:GLSA-200701-20
Reference: URL:http://www.gentoo.org/security/en/glsa/glsa-200701-20.xml
Reference: BID:21932
Reference: URL:http://www.securityfocus.com/bid/21932
Reference: FRSIRT:ADV-2007-0306
Reference: URL:http://www.frsirt.com/english/advisories/2007/0306
Reference: SECTRACK:1017545
Reference: URL:http://securitytracker.com/id?1017545
Reference: SREASON:2129
Reference: URL:http://securityreason.com/securityalert/2129
Reference: XF:centericq-username-bo(31330)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31330

Votes:

Description:
The PML Driver HPZ12 (HPZipm12.exe) in the HP all-in-one drivers, as used by multiple HP products, uses insecure SERVICE_CHANGE_CONFIG DACL permissions, which allows local users to gain privileges and execute arbitrary programs, as demonstrated by modifying the binpath argument, a related issue to CVE-2006-0023.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070108 HP Multiple Products PML Driver Local Privilege Escalation
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456259/100/0/threaded
Reference: MISC:http://secway.org/advisory/AD20070108.txt
Reference: BID:21935
Reference: URL:http://www.securityfocus.com/bid/21935
Reference: FRSIRT:ADV-2007-0094
Reference: URL:http://www.frsirt.com/english/advisories/2007/0094
Reference: SECUNIA:23663
Reference: URL:http://secunia.com/advisories/23663
Reference: SREASON:2128
Reference: URL:http://securityreason.com/securityalert/2128
Reference: XF:pml-driver-config-privilege-escalation(31361)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31361

Votes:

Description:
Unsanity Application Enhancer (APE) 2.0.2 installs with insecure permissions for the (1) ApplicationEnhancer binary and the (2) /Library/Frameworks/ApplicationEnhancer.framework directory, which allows local users to gain privileges by modifying or replacing the binary or library files.

Status: Candidate
Phase: Assigned (20070109)
Reference: MISC:http://landonf.bikemonkey.org/code/macosx/MOAB_Day_8.20070109002959.18582.timor.html
Reference: MISC:http://projects.info-pull.com/moab/MOAB-08-01-2007.html
Reference: BID:21951
Reference: URL:http://www.securityfocus.com/bid/21951
Reference: SECUNIA:23649
Reference: URL:http://secunia.com/advisories/23649
Reference: XF:ape-appenhancer-privilege-escalation(31349)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31349

Votes:

Description:
SecureKit Steganography 1.7.1 and 1.8 embeds password information in the carrier file, which allows remote attackers to bypass authentication requirements and decrypt embedded steganography by replacing the last 20 bytes of the JPEG image with alternate password information.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070106 Cracking Steganography Application in less than ONE minute
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456283/100/0/threaded
Reference: BUGTRAQ:20070107 A Major design Bug in Steganography 1.7.x, 1.8 (latest) (Updated Version)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456519/100/0/threaded
Reference: MISC:http://homepage.mac.com/adonismac/Advisory/steg/steganography.html
Reference: SECUNIA:23639
Reference: URL:http://secunia.com/advisories/23639
Reference: XF:steganography-password-security-bypass(31378)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31378

Votes:

Description:
Camouflage 1.2.1 embeds password information in the carrier file, which allows remote attackers to bypass authentication requirements and decrypt embedded steganography by replacing certain bytes of the JPEG image with alternate password information.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070107 A Major design Bug in Camouflage 1.2.1 (latest)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456541/100/0/threaded
Reference: MISC:http://homepage.mac.com/adonismac/Advisory/steg/camouflage.html
Reference: BID:21939
Reference: URL:http://www.securityfocus.com/bid/21939
Reference: SECUNIA:23578
Reference: URL:http://secunia.com/advisories/23578
Reference: XF:camouflage-password-security-bypass(31375)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31375

Votes:

Description:
Unspecified vulnerability in libnsl in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (crash) via malformed RPC requests that trigger a crash in rpcbind.

Status: Candidate
Phase: Assigned (20070109)
Reference: CONFIRM:http://support.avaya.com/elmodocs2/security/ASA-2007-036.htm
Reference: SUNALERT:102713
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102713-1
Reference: BID:21964
Reference: URL:http://www.securityfocus.com/bid/21964
Reference: FRSIRT:ADV-2007-0110
Reference: URL:http://www.frsirt.com/english/advisories/2007/0110
Reference: OVAL:oval:org.mitre.oval:def:2210
Reference: URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2210
Reference: SECTRACK:1017492
Reference: URL:http://securitytracker.com/id?1017492
Reference: SECUNIA:23700
Reference: URL:http://secunia.com/advisories/23700
Reference: SECUNIA:24056
Reference: URL:http://secunia.com/advisories/24056
Reference: XF:solaris-rpcbind-dos(31366)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31366

Votes:

Description:
The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink attack.

Status: Candidate
Phase: Assigned (20070109)
Reference: FREEBSD:FreeBSD-SA-07:01
Reference: URL:http://security.freebsd.org/advisories/FreeBSD-SA-07:01.jail.asc
Reference: BID:22011
Reference: URL:http://www.securityfocus.com/bid/22011
Reference: SECTRACK:1017505
Reference: URL:http://securitytracker.com/id?1017505
Reference: SECUNIA:23730
Reference: URL:http://secunia.com/advisories/23730

Votes:

Description:
Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in (1) config_admin.php, (2) config_main.php, (3) config_member.php, and (4) mysql_config.php in config/; (5) admin.php and (6) index.php in admini/; (7) paypalipn/ipnprocess.php; (8) index.php and (9) registration.php in members/; and (10) ppcbannerclick.php and (11) ppcclick.php in main/.

Status: Candidate
Phase: Assigned (20070109)
Reference: BUGTRAQ:20070109 ppc engine Multiple file inclusion
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456386/100/0/threaded
Reference: MILW0RM:3104
Reference: URL:http://milw0rm.com/exploits/3104
Reference: VIM:20070109 "ppc engine" is WGS-PPC
Reference: URL:http://www.attrition.org/pipermail/vim/2007-January/001221.html
Reference: BID:21961
Reference: URL:http://www.securityfocus.com/bid/21961
Reference: OSVDB:33444
Reference: URL:http://www.osvdb.org/33444
Reference: OSVDB:33445
Reference: URL:http://www.osvdb.org/33445
Reference: OSVDB:33446
Reference: URL:http://www.osvdb.org/33446
Reference: OSVDB:33447
Reference: URL:http://www.osvdb.org/33447
Reference: OSVDB:33448
Reference: URL:http://www.osvdb.org/33448
Reference: OSVDB:33449
Reference: URL:http://www.osvdb.org/33449
Reference: OSVDB:33450
Reference: URL:http://www.osvdb.org/33450
Reference: OSVDB:33451
Reference: URL:http://www.osvdb.org/33451
Reference: OSVDB:33452
Reference: URL:http://www.osvdb.org/33452
Reference: OSVDB:33453
Reference: URL:http://www.osvdb.org/33453
Reference: OSVDB:33454
Reference: URL:http://www.osvdb.org/33454
Reference: SREASON:2134
Reference: URL:http://securityreason.com/securityalert/2134
Reference: XF:demoppc-inc-file-include(31355)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31355

Votes:

Description:
The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allows remote attackers to execute arbitrary code via certain data in opnum 0xBF in an RPC request, which is directly executed.

Status: Candidate
Phase: Assigned (20070110)
Reference: BUGTRAQ:20070111 ZDI-07-002: CA BrightStor ARCserve Backup Tape Engine Code Execution Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456616/100/0/threaded
Reference: BUGTRAQ:20070111 LS-20061002 - Computer Associates BrightStor ARCserve Backup Remote Code Execution Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/456637
Reference: BUGTRAQ:20070111 [CAID 34955, 34956, 34957, 34958, 34959, 34817]: CA BrightStor ARCserve Backup Multiple Overflow Vulnerabilities
Reference: URL:http://www.securityfocus.com/archive/1/456711
Reference: MISC:http://www.zerodayinitiative.com/advisories/ZDI-07-002.html
Reference: MISC:http://livesploit.com/advisories/LS-20061002.pdf
Reference: MISC:http://www.lssec.com/advisories/LS-20061002.pdf
Reference: CONFIRM:http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.asp
Reference: CERT-VN:VU#662400
Reference: URL:http://www.kb.cert.org/vuls/id/662400
Reference: BID:22010
Reference: URL:http://www.securityfocus.com/bid/22010
Reference: FRSIRT:ADV-2007-0154
Reference: URL:http://www.frsirt.com/english/advisories/2007/0154
Reference: SECTRACK:1017506
Reference: URL:http://securitytracker.com/id?1017506
Reference: SECUNIA:23648
Reference: URL:http://secunia.com/advisories/23648
Reference: XF:brightstor-tapeengine-code-execution(31442)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31442

Votes:

Description:
Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allow remote attackers to execute arbitrary code via RPC requests with crafted data for opnums (1) 0x2F and (2) 0x75 in the (a) Message Engine RPC service, or opnum (3) 0xCF in the Tape Engine service.

Status: Candidate
Phase: Assigned (20070110)
Reference: IDEFENSE:20070111 Computer Associates BrightStor ARCserve Backup RPC Engine PFC Request Buffer Overflow Vulnerability
Reference: URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=467
Reference: BUGTRAQ:20070111 ZDI-07-003: CA BrightStor ARCserve Backup Message Engine Buffer Overflow Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456619/100/0/threaded
Reference: BUGTRAQ:20070111 ZDI-07-004: CA BrightStor ARCserve Backup Tape Engine Buffer Overflow Vulnerability
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/456618/100/0/threaded
Reference: BUGTRAQ:20070111 [CAID 34955, 34956, 34957, 34958, 34959, 34817]: CA BrightStor ARCserve Backup Multiple Overflow Vulnerabilities
Reference: URL:http://www.securityfocus.com/archive/1/456711
Reference: MISC:http://www.zerodayinitiative.com/advisories/ZDI-07-003.html
Reference: MISC:http://www.zerodayinitiative.com/advisories/ZDI-07-004.html
Reference: CONFIRM:http://supportconnectw.ca.com/public/storage/infodocs/babimpsec-notice.asp
Reference: CERT-VN:VU#180336
Reference: URL:http://www.kb.cert.org/vuls/id/180336
Reference: CERT-VN:VU#151032
Reference: URL:http://www.kb.cert.org/vuls/id/151032
Reference: BID:22005
Reference: URL:http://www.securityfocus.com/bid/22005
Reference: BID:22006
Reference: URL:http://www.securityfocus.com/bid/22006
Reference: FRSIRT:ADV-2007-0154
Reference: URL:http://www.frsirt.com/english/advisories/2007/0154
Reference: SECTRACK:1017506
Reference: URL:http://securitytracker.com/id?1017506
Reference: SECUNIA:23648
Reference: URL:http://secunia.com/advisories/23648
Reference: XF:brightstor-messageengine-rpc-bo(31443)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31443
Reference: XF:brightstor-tapeengine-rpc-bo(31433)
Reference: URL:http://xforce.iss.net/xforce/xfdb/31433