Summary of Security Items from October 27 through November 2, 2004
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
- High: vulnerabilities with a CVSS base score of 7.0–10.0
- Medium: vulnerabilities with a CVSS base score of 4.0–6.9
- Low: vulnerabilities with a CVSS base score of 0.0–3.9
Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.
This bulletin provides a summary of new or updated vulnerabilities, exploits, trends, viruses, and trojans. Updates to items appearing in previous bulletins are listed in bold text. The text in the Risk column appears in red for vulnerabilities ranking High. The risks levels applied to vulnerabilities in the Cyber Security Bulletin are based on how the "system" may be impacted. The Recent Exploit/Technique table contains a "Workaround or Patch Available" column that indicates whether a workaround or patch has been published for the vulnerability which the script exploits.
Bugs,
Holes, & Patches
The table below summarizes vulnerabilities that have been identified, even if they are not being exploited. Complete details about patches or workarounds are available from the source of the information or from the URL provided in the section. CVE numbers are listed where applicable. Vulnerabilities that affect both Windows and Unix Operating Systems are included in the Multiple Operating Systems section.
Note: All the information included in the following tables has been discussed in newsgroups and on web sites.
The Risk levels defined below are based on how the system may be impacted:
- High - A high-risk vulnerability is defined as one that will allow an intruder to immediately gain privileged access (e.g., sysadmin or root) to the system or allow an intruder to execute code or alter arbitrary system files. An example of a high-risk vulnerability is one that allows an unauthorized user to send a sequence of instructions to a machine and the machine responds with a command prompt with administrator privileges.
- Medium - A medium-risk vulnerability is defined as one that will allow an intruder immediate access to a system with less than privileged access. Such vulnerability will allow the intruder the opportunity to continue the attempt to gain privileged access. An example of medium-risk vulnerability is a server configuration error that allows an intruder to capture the password file.
- Low - A low-risk vulnerability is defined as one that will provide information to an intruder that could lead to further compromise attempts or a Denial of Service (DoS) attack. It should be noted that while the DoS attack is deemed low from a threat potential, the frequency of this type of attack is very high. DoS attacks against mission-critical nodes are not included in this rating and any attack of this nature should instead be considered to be a "High" threat.
Vendor & Software Name | Vulnerability - Impact Patches - Workarounds Attacks Scripts | Common Name |
face="Arial, Helvetica, sans-serif">Risk |
face="Arial, Helvetica, sans-serif">Source |
AT-TFTP Server version 1.8 and prior | A vulnerability exists which could allow a remote malicious user to view or write files on the target system or cause the TFTP service to crash. A remote malicious user can supply a specially crafted filename containing '../' directory traversal characters to view files on or, if 'Read/Write' mode is enabled, upload files to the target system with the privileges of the TFTP service. It is also reported that a remote malicious user can send a filename field that can trigger a buffer overflow and cause the TFTP service to crash. No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Allied Telesyn AT-TFTP Server Arbitrary File Execution or Denial of Service
| Low/High (High if arbitrary code can be executed) | SecurityTracker Alert ID, 1012011, October 31, 2004 |
QuickTime prior to 6.5.2 | An integer overflow vulnerability may permit a remote malicious user to execute arbitrary code on the target system. A remote malicious user can create HTML that, when loaded by the target user, will trigger the integer overflow. The vendor has released a fixed version (6.5.2), available at: http://www.apple.com/quicktime/download/ We are not aware of any exploits for this vulnerability. | Apple QuickTime Integer Overflow CVE Name: | High | SecurityTracker Alert ID, 1011969, October 27, 2004 |
Age of Sail II 1.04.151 and prior versions | A buffer overflow vulnerability may permit a remote malicious user to execute arbitrary code on the target system. A remote user can join a game server and supply a specially crafted nickname to trigger a buffer overflow. No workaround or patch available at time of publishing. Another Proof of Concept exploit script has been published. | Akella Age of Sail II Buffer Overflow | High | Secunia Advisory ID, SA12905, October 21, 2004 Packetstorm, October 27, 2004 |
Ability (Mail and FTP) Server 2.3.4 | A buffer overflow vulnerability was reported in the Ability Server in the FTP service which could allow a remote authenticated malicious user to execute arbitrary code on the target system. No workaround or patch available at time of publishing. More exploit scripts have been published. | Code-Crafters Ability Server Buffer Overflow | High | Secunia Advisory ID, SA12941, October 25, 2004 SecurityFocus, Bugtraq ID 11508, October 22, 2004 Packetstorm, October 27, 2004 |
Cyber Web Filter 2.00 | A vulnerability exists which can be exploited by malicious people to bypass certain security restrictions. The web filter can be configured to restrict access based on the destination IP address of a website. The vulnerability is caused due to insufficient validation of IP addresses in client requests. No workaround or patch available at time of publishing. We are not aware of any exploits for this vulnerability. | Global Spy Software Cyber Web Filter IP Address Restriction Security Bypass | Medium | Secunia Advisory ID, SA13024, October 29, 2004 |
Google Desktop Search | A remote malicious user can create a specially crafted URL that, when loaded by a target user that has Google Desktop Search installed, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the Google site and will run in the security context of that site. No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Google Desktop Search 'meta' Tag Input Validation | High | SecurityTracker Alert ID, 1011928, October 26, 2004 |
GSuite | A vulnerability exists that could permit a local malicious user to obtain the target user's GMail password. A local user with access to the target user's 'documents and settings\user_name\Application Data\GSuite\' folder can view the 'settings.xml' file, which contains the target user's password in ASCII value encoded form. No workaround or patch available at time of publishing. No exploit is required. | Imspire GSuite Passwords Disclosure | Medium | SecurityTracker Alert ID, 1011994, October 29, 2004 |
XDICT 2002, 2003, 2004, 2005 | A buffer overflow vulnerability exists that could permit a remote malicious user to execute arbitrary code on the target user's computer. When the 'Screen Fetch' mode is enabled and the target user places the mouse over a word that is longer than 88 characters, a buffer overflow will be triggered that may allow a remote malicious user to execute arbitrary code. No workaround or patch available at time of publishing. No exploit is required. | Kingsoft XDICT Word Translation Buffer Overflow | High | SecurityTracker Alert ID, 1012017, November 1, 2004 |
MailEnable Professional prior to version 1.51 | A vulnerability with an unknown impact has been reported in Update to version 1.51: http://www.mailenable.com/download.asp We are not aware of any exploits for this vulnerability. | MailEnable Professional Unspecified Webmail | Low | Secunia Advisory ID, SA13062, November 2, 2004 |
Internet Explorer 6, Microsoft Outlook Express 6 | A vulnerability exists which can be exploited by malicious people to trick users into visiting a malicious website by obfuscating URLs. This vulnerability was confirmed in SP1 but not SP2. A Proof of Concept exploit has been published. | Microsoft Internet Explorer/Outlook Express Restricted Zone Status Bar Spoofing | Low | Secunia Advisory ID, SA13015, October 29, 2004 |
Internet Explorer 6.0 | Microsoft Internet Explorer is reported prone to a remote Denial of Service vulnerability. The issue presents itself due to a malfunction that occurs when certain font tags are encountered and rendered. When a page that contains the malicious HTML code is viewed, Internet Explorer will crash. No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Microsoft Internet Explorer Font Tag Denial of Service | Low | SecurityFocus Bugtraq ID, 1536, October 26, 2004 |
Internet Explorer 6.0 SP1, | A remote buffer overflow vulnerability exists due to insufficient boundary checks performed by the application and results in a Denial of Service condition. Arbitrary code execution may be possible as well.
No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Microsoft Internet Explorer Malformed IFRAME Remote Buffer Overflow | Low/High (High if arbitrary code can be executed) | SecurityFocus, Bugtraq ID 11515, October 25, 2004 |
Internet Explorer 6.0 SP2 | A vulnerability exists in the 'hhctrl' Internet Explorer ActiveX control and could allow a malicious user to influence Internet Explorer into running script in the context of a foreign domain. No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Microsoft Internet Explorer HHCtrl ActiveX Control Cross-Domain Scripting | High | SecurityFocus, Bugtraq ID 11521, October 25, 2004 |
Microsoft Remote Desktop on Windows XP prior to SP2 | A Denial of Service vulnerability was reported in Microsoft Remote Desktop on Windows XP. A remote authenticated malicious user can access the target system and issue the Tsshutdn command to restart a Windows XP-based system. The vendor has issued a fix as part of Windows XP SP2. The knowledge base article describing this issue is available at: http://support.microsoft.com/ A Proof of Concept exploit has been published. | Microsoft Remote Desktop on Windows XP Denial of Service | Low | SecurityTracker Alert ID, 1011940, October 26, 2004 |
Windows NT Server 4.0, Windows NT Server 4.0 Enterprise Edition, Windows 2000 Advanced Server, Windows 2000 Datacenter Server, Windows 2000 Server, Windows Server 2003 Datacenter Edition, Windows Server 2003 Enterprise Edition, Windows Server 2003 Standard Edition, Windows Server 2003 Web Edition, Exchange 2000 Server, Exchange Server 2003 | A remote code execution vulnerability exists within the Network News Transfer Protocol (NNTP) component of the affected operating systems, which could let a remote malicious user execute arbitrary code. This vulnerability could potentially affect systems that do not use NNTP. Updates available at:
href="http://www.microsoft.com/technet/security/bulletin/MS04-036.mspx">http://www.microsoft.com/technet/ A Proof of Concept exploit has been published. | High | Microsoft Security Bulletin MS04-036, October 12, 2004 US-CERT Cyber Security Alert SA04-286A, October 12, 2004 US-CERT Vulnerability Note VU#203126, October 22, 2004 SecurityFocus, Bugtraq ID 11379, October 26, 2004 | |
Windows NT Server 4.0, Windows NT Server 4.0 Enterprise Edition, Windows NT Server 4.0 Terminal Server Edition, Windows 2000 Advanced Server, Windows 2000 Datacenter Server, Windows 2000 Server, Windows 2000 Professional, Windows XP Home Edition, Windows XP Professional, Windows Server 2003 Enterprise Edition, Windows Server 2003 Standard Edition, Windows Server 2003 Web Edition, Windows Server 2003 Datacenter Edition, Windows 98, Windows 98 SE, Windows ME; Avaya DefinityOne Media Servers, IP600 Media Servers, Modular Messaging (MSS) 1.1, 2.0, Avaya S3400 Message Application Server | A Shell vulnerability and Program Group vulnerability exists in Microsoft Windows. These vulnerabilities could allow remote code execution. Updates available at: href="http://www.microsoft.com/technet/security/bulletin/MS04-037.mspx">http://www.microsoft.com/technet/security/bulletin/MS04-037.mspx Bulletin updated to reduce the scope of a documented workaround to only support Windows XP, Windows XP Service Pack 1, and Windows Server 2003. Avaya: Customers are advised to follow Microsoft's guidance for applying patches. Advisories are located at the following locations:
href="http://support.avaya.com/japple/css/japple?temp.groupID=128450&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=203487&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()">http://support.avaya.com/japple/css/japple?
href="http://support.avaya.com/japple/css/japple?temp.groupID=128450&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=203487&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()">http://support.avaya.com/japple/css/japple?temp.groupID We are not aware of any exploits for these vulnerabilities. | High | Microsoft Security Bulletin MS04-037 v1.1, October 25, 2004 US-CERT Cyber Security Alert SA04-286A, October 12, 2004 US-CERT Vulnerability Note VU#543864, October 15, 2004 SecurityFocus, October 26, 2004 | |
McAfee, Computer Associates, Kaspersky, Sophos, Eset and RAV Archive::Zip 1.13 | Remote exploitation of an exceptional condition error in multiple vendors' anti-virus software allows malicious users to bypass security protections by evading virus detection. The problem specifically exists in the parsing of .zip archive headers. This vulnerability affects multiple anti-virus vendors including McAfee, Computer Associates, Kaspersky, Sophos, Eset and RAV. Instructions for vendor fixes available at:
href="http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities&flashstatus=true">http://www.idefense.com/application/poi/display?id There is no solution for Archive::Zip Proofs of Concept exploits have been published. | Multiple Vendor Anti-Virus Software Detection Evasion CVE Names: | High | iDEFENSE Security Advisory, October 18, 2004 Secunia Advisory ID: SA13038, November 1, 2004 |
MailCarrier 2.51 | A buffer overflow vulnerability exists which could allow a remote malicious user to execute arbitrary code on the target system. The flaw resides in the processing of EHLO SMTP commands. No workaround or patch available at time of publishing. A Proof of Concept exploit script has been published. | Tabs Laboratories MailCarrier EHLO SMTP Commands Buffer Overflow | High | SecurityFocus Bugtraq ID, 11535, October 26, 2004 |
NetObjects Fusion 8.x | A buffer overflow vulnerability exists, which can be exploited by malicious people to compromise a vulnerable system. Update available at: http://netobjects.com/update /installer/ We are not aware of any exploits for this vulnerability. | Website Pros NetObjects Fusion JPEG Processing Buffer Overflow | High | NetObjects Fusion 8 Product Updates (version 8.00.0000.5030), October 26, 2004 |
| UNIX / Linux Operating Systems Only | ||||
Vendor & Software Name | Vulnerability - Impact Patches - Workarounds Attacks Scripts | Common Name | Risk | Source |
Apache 2.0 a9, 2.0, 2.0.28 Beta, 2.0.28, 2.0.32, 2.0.35-2.0.50 | A remote Denial of Service vulnerability exists in Apache 2 mod_ssl during SSL connections. Apache:
href="http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964">http://nagoya.apache.org/bugzilla/show_ RedHat: href="http://rhn.redhat.com/errata/RHSA-2004-349.html">http://rhn.redhat.com/errata/RHSA-2004-349.html SuSE: href="ftp://ftp.suse.com/pub/suse/i386/update/">ftp://ftp.suse.com/pub/suse/i386/update/ Gentoo: href="http://security.gentoo.org/glsa/glsa-200409-21.xml">http://security.gentoo.org/glsa/glsa-200409-21.xml Mandrake: href="http://www.mandrakesecure.net/en/ftp.php">http://www.mandrakesecure.net/en/ftp.php Trustix: href="http://http.trustix.org/pub/trustix/updates/">http://http.trustix.org/pub/trustix/updates/ Conectiva: ftp://atualizacoes.conectiva.com.br/ Fedora: http://download.fedora.redhat.com/pub/ We are not aware of any exploits for this vulnerability. | Low | SecurityFocus, September 6, 2004 Mandrakelinux Security Update Advisory, MDKSA-2004:096, September 15, 2004 Gentoo Linux Security Advisory, GLSA 200409-21, September 16, 2004 Trustix Secure Linux Security Advisory,TSLSA-2004-0047, September 16, 2004 Conectiva Linux Security Announcement, CLA-2004:868, September 23, 2004 Fedora Update Notification, HP Security Bulletin, | |
Apache 2.0.50 | A remote Denial of Service vulnerability exists in 'char_buffer_read()' when using a RewriteRule to reverse proxy SSL connections. Patch available at: SuSE: href="ftp://ftp.suse.com/pub/suse/">ftp://ftp.suse.com/pub/suse/ Mandrake: href="http://www.mandrakesecure.net/en/ftp.php">http://www.mandrakesecure.net/en/ftp.php RedHat:
href="http://rhn.redhat.com/errata/RHSA-2004-463.html">http://rhn.redhat.com/errata/ Gentoo:
href="http://security.gentoo.org/glsa/glsa-200409-21.xml">http://security.gentoo.org/glsa/ Trustix: href="http://www.trustix.org/errata/2004/0047/">http://www.trustix.org/errata/2004/0047/ Conectiva: ftp://atualizacoes.conectiva.com.br/ Fedora: http://download.fedora.redhat.com/pub/ HP: http://h30097.www3.hp.com/internet/ There is no exploit code required; however, Proofs of Concept exploits have been published. | Low | SecurityTracker Alert ID, 1011213, September 10, 2004 Mandrakelinux Security Update Advisory, MDKSA-2004:096, September 15, 2004 RedHat Security Advisory, RHSA-2004:463-09, September 15, 2004 Gentoo Linux Security Advisory GLSA 200409-21, September 16, 2004 Trustix Secure Linux Security Advisory , TSLSA-2004-0047, September 16, 2004 Conectiva Linux Security Announcement, CLA-2004:868, September 23, 2004 Fedora Update Notification, HP Security Bulletin, | |
Apache Software Foundation Apache 1.3.26‑1.3.29, 1.3.31; | A buffer overflow vulnerability exists in Apache mod_proxy when a ‘ContentLength:’ header is submitted that contains a large negative value, which could let a remote malicious user cause a Denial of Service and possibly execute arbitrary code.
Patches available at: http://marc.theaimsgroup.com/ OpenBSD: ftp://ftp.openbsd.org/pub/OpenBSD/patches/ OpenPKG: ftp://ftp.openpkg.org/release/2.0/ Gentoo: http://security.gentoo.org/glsa/glsa-200406-16.xml Mandrake: http://www.mandrakesoft.com/security/advisories SGI: ftp://patches.sgi.com/support/free/security/ Fedora Legacy: http://download.fedoralegacy.org/redhat/ Slackware: ftp://ftp.slackware.com/pub/slackware/ Currently we are not aware of any exploits for this vulnerability. | Apache Mod_Proxy Remote Buffer Overflow
CVE Name: | Low/High (High if arbitrary code can be executed) | SecurityTracker Alert, 1010462, June 10, 2004 Gentoo Linux Security Advisory, GLSA 200406-16, June 22, 2004 Mandrakelinux Security Update Advisory, MDKSA-2004:065, June 29, 2004 OpenPKG Security Advisory, OpenPKG-SA-2004.029, June 11, 2004 SGI Security Advisory, 20040605-01-U, June 21, 2004 Fedora Legacy Update Advisory, FLSA:1737, October 14, 2004 US-Cert Vulnerability Note VU#541310, October 19, 2004 Slackware Security Advisory, SSA:2004-299-01, October 26, 2004 |
Apache 2.0.51 | A vulnerability exists in the merging of the 'Satisfy' directive, which could let a remote malicious user obtain access to restricted resources. Fedora: http://download.fedora.redhat.com/ Gentoo: http://security.gentoo.org/glsa/ Trustix: http://http.trustix.org/pub/trustix/updates/ HP: http://h30097.www3.hp.com/internet/ There is no exploit code required. | Apache Satisfy Directive Access Control Bypass CVE Name: | Medium | SecurityFocus, September 24, 2004 HP Security Bulletin, |
MacOS X 10.2.8, 10.3.5 | A vulnerability exists in ServerAdmin because the same common self-signed certificate is used if the administrator has not replaced this example certificate, which could let a remote malicious user obtain sensitive information. Update available at: Apple QuickTime: We are not aware of any exploits for this vulnerability. | Apple ServerAdmin Default Certificate CVE Name: | Medium | Apple Security Advisory, SA-2004-09-30, October 4, 2004 Apple Security Advisory, APPLE-SA-2004-10-27, October 27, 2004 |
Remote Desktop 2.0
| A vulnerability exists due to a failure to activate applications with correct privileges, which could let a malicious user obtain superuser privileges. Upgrade available at: There is no exploit code required. | Apple Remote Desktop Administrator Privilege Elevation CVE Name: | High | Apple Security Advisory, APPLE-SA-2004-10-27, October 27, 2004 |
Caudium 1.2 .x, 1.3 .x, 1.4.1, 1.4.2. 1.4.4 RC1 | An off-by-one- buffer overflow vulnerability exists when processing HTTP requests which could let a remote malicious user cause a Denial of Service or possibly execute arbitrary code. Upgrades available at: There is no exploit code required; however, a Proof of Concept exploit has been published. | Caudium Off-by-One Buffer Overflow | Low/High (High if arbitrary code can be executed) | SecurityTracker Alert ID, 1011997, November 1, 2004 |
sudosh 1.0, 1.1, 1.2.2, 1.2.3, 1.3, 1.3.2, 1.3.4-1.3.6 | A vulnerability exists in the 'prepchild()' function in 'sudosh.c.' The impact was not specified. Upgrades available at: We are not aware of any exploits for this vulnerability. | Sudosh Shell Environment Variable Processing | No Specified | SecurityFocus, October 26, 2004 |
CatDoc 0.91.5
| A vulnerability exists in 'msxlsview.sh' due to a design error that causes the application to fail to verify the existence of a temporary file prior to writing to it, which could let a remote malicious user corrupt arbitrary files.
Debian: There is no exploit code required. | CatDoc XLSView Local Insecure Temporary File Creation CVE Name: | Medium | Debian Security Advisory DSA 575-1 , October 28, 2004 |
FreeRADIUS 0.2-0.5, 0.8, 0.8.1, 0.9-0.9.3. 1.0 | A remote Denial of Service vulnerability exists in 'radius.c' and 'eap_tls.c' due to a failure to handle malformed packets. Upgrades available at: Gentoo: http://security.gentoo.org/glsa/glsa-200409-29.xml Fedora: http://download.fedora.redhat.com/pub/ There is no exploit code required. | FreeRADIUS Access-Request Denial of Service | Low | Gentoo Linux Security Advisory, GLSA 200409-29, September 22, 2004 US-CERT Vulnerability Note VU#541574, October 11, 2004 Fedora Update Notification, |
Galeon Browser 1.3.18 | A vulnerability exists in the tabbed browsing feature, which could let a remote malicious user spoof web page functions.
No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Galeon Browser Tabbed Browsing Spoofing | Medium | SecurityTracker Alert ID, 1012002, October 30, 2004 |
gdlib 2.0.23, 2.0.26-2.0.28 | A vulnerability exists in the 'gdImageCreateFromPngCtx()' function when processing PNG images due to insufficient sanity checking on size values, which could let a remote malicious user execute arbitrary code.
Ubuntu: An exploit script has been published. | GD Graphics Library Remote Integer Overflow CVE Name: | High | Secunia Advisory, SA12996, October 28, 2004 |
Epiphany Browser 1.4.4 | A vulnerability exists in the tabbed browsing feature, which could let a remote malicious user spoof web page functions.
No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Epiphany Browser Tabbed Browsing Spoofing | Medium | SecurityTracker Alert ID, 1012003, October 30, 2004 |
GNU / GPL Samba 3.0.0 - 3.0.4 and 2.2.9 and prior
| Multiple buffer overflow vulnerabilities exist in Samba that could allow a remote user to execute arbitrary code on the target system. These are caused by boundary errors when decoding base64 data and when handling 'mangling method = hash.' Upgrade to version 3.0.5 or 2.2.10 available at: http://us2.samba.org/samba/ftp/ Conectiva: RedHat: RedHat Enterprise Linux AS 3, ES 3, WS 3: Gentoo: Mandrakesoft: Mandrake Multi Network Firewall 8.x, 9.x; Mandrake Corporate Server 2.x SuSE: SuSE Linux, Email, Database, and Enterprise Servers Trustix: Sun: http://sunsolve.sun.com/search/ A working exploit has been published. | Samba Buffer Overflow Vulnerabilities
CVE Names: | High | Samba Release Notes 3.0.5, July 20, 2004 Gentoo, RedHat, Mandrakesoft, SuSE, Trustix, Conectiva Advisories Sun(sm) Alert Notification, 57664, October 25, 2004 |
gettext 0.14.1 | A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files.
Trustix: ftp://ftp.trustix.org/pub/trustix/updates/ Gentoo: http://security.gentoo.org/glsa/glsa-200410-10.xml Ubuntu: http://security.ubuntu.com/ubuntu/ There is no exploit code required. | GNU CVE Name: | Medium | Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004 Gentoo Linux Security Advisory, GLSA 200410-10, October 10, 2004 Ubuntu Security Notice, USN-5-1 October 27, 2004 |
glibc 2.0-2.0.6, 2.1, 2.1.1 -6, 2.1.1, 2.1.2, 2.1.3 -10, 2.1.3, 2.1.9 & greater, 2.2-2.2.5, 2.3-2.3.4, 2.3.10 | A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files. Trustix: href="ftp://ftp.trustix.org/pub/trustix/updates/">ftp://ftp.trustix.org/pub/trustix/updates/ Gentoo: href="http://security.gentoo.org/glsa/glsa-200410-19.xml">http://security.gentoo.org/glsa/glsa-200410-19.xml Ubuntu: http://security.ubuntu.com/ubuntu/ There is no exploit code required. | Medium | Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004 Gentoo Linux Security Advisory, GLSA 200410-19, October 21, 2004 Ubuntu Security Notice, USN-4-1 October 27, 2004 | |
groff 1.19 | A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files.
Trustix: ftp://ftp.trustix.org/pub/trustix/updates/ Ubuntu: http://security.ubuntu.com/ubuntu/ There is no exploit code required. | GNU Troff (Groff) Insecure Temporary File Creation CVE Name: | Medium | Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004 Ubuntu Security Notice USN-13-1, November 1, 2004 |
InetUtils 1.4.2 | A buffer overflow vulnerability exists in 'main.c' due to boundary errors when handling DNS responses, which could let a remote malicious user execute arbitrary code. No workaround or patch available at time of publishing. We are not aware of any exploits for this vulnerability. | GNU InetUtils TFTP Client Remote Buffer Overflow | High | Bugtraq, October 26, 2004 |
iCab 2.9.8 | A cross-domain dialog box spoofing vulnerability exists which could let a remote malicious user spoof an interface of a trusted web site. No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit has been published. | ICab Web Browser Cross-Domain Dialog Box Spoofing | Medium | Secunia Advisory, SA12982, October 26, 2004 |
ImageMagick 5.3.3, 5.4.3, 5.4.4.5, 5.4.7, 5.4.8 .2-1.1.0, 5.4.8, | A buffer overflow vulnerability exists in the 'EXIF' parsing routine due to a boundary error, which could let a remote malicious user execute arbitrary code. Upgrades available at: Redhat: http://rhn.redhat.com/errata/RHSA-2004-480.html Ubuntu: http://security.ubuntu.com/ubuntu/pool/main/ We are not aware of any exploits for this vulnerability. | ImageMagick Remote EXIF Parsing Buffer Overflow CVE Name: | High | SecurityTracker Alert ID, 1011946, October 26, 2004 |
Media Player 0.4.2, 0.4.3 b, 0.4.3, 0.5 rc1 | A buffer overflow vulnerability exists in the processing of Content-Type headers in the 'http_open()' function in 'http.c' due to insufficient boundary checks on user-supplied strings prior to copying them into finite stack-based buffers, which could let a remote malicious user cause a Denial of Service and possibly execute arbitrary code. No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Kaffeine Media Player Remote Buffer Overflow | Low/High (High if arbitrary code can be executed) | Securiteam, October 26, 2004 |
Konqueror 3.1.4, 3.2.1, 3.2.2 -6 | A cross-domain scripting vulnerability exists due to a failure to prevent JavaScript that is rendered in one frame from accessing properties of a site contained in an alternate frame, which could let a remote malicious web site render JavaScript in the context of an alternate domain. This has been addressed in KDE Konqueror version 3.2.3. A Proof of Concept exploit has been published. | KDE Konqueror IFRAME Cross-Domain Scripting | Medium | SecurityFocus, October 27, 2004 |
Linux kernel 2.4 through 2.4.26, 2.6 through 2.6.7 | A vulnerability exists in the Linux kernel in the processing of 64-bit file offset pointers thus allowing a local malicious user to view kernel memory. The kernel's file handling API does not properly convert 64-bit file offsets to 32-bit file offsets. In addition, the kernel provides insecure access to the file offset member variable. As a result, a local user can gain read access to large portions of kernel memory. Fedora: http://download.fedora.redhat.com/pub/ RedHat: http://rhn.redhat.com/ SuSE: http://www.suse.de/de/security/2004_24_kernel.html Gentoo:http://security.gentoo.org/glsa/glsa-200408-24.xml Mandrake: http://www.mandrakesecure.net/en/ftp.php SGI: ftp://patches.sgi.com/support/free/security/ Trustix: ftp://ftp.trustix.org/pub/trustix/updates/ Conectiva: ftp://atualizacoes.conectiva.com.br/ A Proof of Concept exploit script has been published. | Linux Kernel 64-bit to 32-bit File Offset Conversion Errors Disclose Kernel Memory CVE Name: | High | ISEC Security Research, August 4, 2004 SGI Security Advisory, 20040804-01-U, August 26, 2004 Gentoo Linux Security Advisory GLSA 200408-24, August 25, 2004 Mandrakelinux Security Update Advisory, August 26, 2004 Trustix Secure Linux Security Advisory, TSLSA-2004-0041, August 9, 2004 Conectiva Linux Security Announcement, CLA-2004:879, October 26, 2004 |
Kerberos 5 1.3.4 | A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files.
Trustix: ftp://ftp.trustix.org/pub/trustix/updates/ Gentoo: http://security.gentoo.org/glsa/glsa-200410-24.xml There is no exploit code required. | MIT CVE Name: | Medium | Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004 Gentoo Linux Security Advisory GLSA 200410-24, October 25, 2004 |
mixplayd 0.53 | A format string vulnerability exists in 'main.c' because data is printed without proper format specifiers, which could let a remote malicious user execute arbitrary code. No workaround or patch available at time of publishing. We are not aware of any exploits for this vulnerability. | mixplayd Format String Flaw | High | Zone-h Security Advisory, ZH2004-17SA , October 29, 2004 |
Bugzilla 2.4, 2.6, 2.8, 2.10, 2.12, 2.14-2.14.5, 2.16-2.16.5, 2.17-2.17.7, 2.18 rc1&rc2 | Multiple vulnerabilities exist: a vulnerability exists in 'process_bug.cgi' when a specially crafted HTTP POST request to remove keywords from a bug is submitted, which could let a remote malicious user obtain sensitive information: a vulnerability exists when exporting bugs to XML, which could let a remote malicious user obtain sensitive information; and a vulnerability exists because various private attachment metadata is disclosed, which could let a remote malicious user see private attachments.
Upgrades available at: There is no exploit code required. | Mozilla Bugzilla Multiple Authentication Bypass& Information Disclosure | Medium | Bugzilla Security Advisory, October 24, 2004 |
Mozilla Browser 1.7, rc1-rc3, beta, alpha, 1.7.1-1.7.3, 1.8 Alpha 1-4, Firefox Preview Release | A vulnerability exists in the 'Open with' option because the software saves the file in the '/tmp' directory with world-readable permissions, which could let a malicious user obtain sensitive information. Fixes are available in the CVS repository. There is no exploit code required. | Mozilla Temporary File Insecure Permissions Information Disclosure | Medium | Secunia Advisory, SA12956, October 25, 2004 |
mpg123 pre0.59s, 0.59r | A buffer overflow vulnerability exists in the 'getauthfromURL()' function due to a boundary error, which could let a remote malicious user execute arbitrary code. Debian: http://security.debian.org/pool/updates/ Gentoo: http://security.gentoo.org/glsa/glsa-200410-27.xml A Proof of Concept exploit has been published. | MPG123 Remote URL Open Buffer Overflow CVE Name: | High | Securiteam, October 21, 2004 Gentoo Linux Security Advisory, GLSA 200410-27, October 27, 2004 Debian Security Advisory, DSA 578-1 , November 1, 2004 |
Apache Software Foundation Apache 2.0.50 & prior; Gentoo Linux 1.4; | A remote Denial of Service vulnerability exists in the Apache mod_dav module when an authorized malicious user submits a specific sequence of LOCK requests. Update available at: href=" http://httpd.apache.org/">http://httpd.apache.org/ Gentoo:
href="http://www.gentoo.org/security/en/glsa/glsa-200409-21.xml">http://www.gentoo.org/security/en/glsa/ RedHat: href=" ftp://updates.redhat.com/enterprise">ftp://updates.redhat.com/enterprise Trustix: href="ftp://ftp.trustix.org/pub/trustix/updates/">ftp://ftp.trustix.org/pub/trustix/updates/ Conectiva: ftp://atualizacoes.conectiva.com.br/ Fedora: http://download.fedora.redhat.com/pub/ Debian: http://security.debian.org/pool/updates/main/liba/ There is no exploit code required; however, a Proof of Concept exploit has been published. | Low | SecurityTracker Alert ID, 1011248, September 14, 2004 Conectiva Linux Security Announcement, CLA-2004:868, September 23, 2004 Fedora Update Notification, Debian Security Advisory DSA 558-1 , October 6, 2004 HP Security Bulletin, | |
Apache Software Foundation Apache 2.0.50 & prior; Gentoo Linux 1.4; MandrakeSoft Linux Mandrake 9.2, amd64, 10.0, AMD64; | A buffer overflow vulnerability exists in the apr-util library's IPv6 URI parsing functionality due to insufficient validation, which could let a remote malicious user execute arbitrary code. Note: On Linux based Unix variants this issue can only be exploited to trigger a Denial of Service condition. Patch available at: Gentoo: href="http://www.gentoo.org/security/en/glsa/glsa-200409-21.xml">http://www.gentoo.org/security/en/glsa/glsa-200409-21.xml Mandrake: href="http://www.mandrakesecure.net/en/ftp.php">http://www.mandrakesecure.net/en/ftp.php Redhat:
href="http://rhn.redhat.com/errata/RHSA-2004-463.html">http://rhn.redhat.com/errata/RHSA-2004-463.html SuSE: href="ftp://ftp.suse.com/pub/suse">ftp://ftp.suse.com/pub/suse Trustix: href="ftp://ftp.trustix.org/pub/trustix/updates/">ftp://ftp.trustix.org/pub/trustix/updates/ TurboLinux: Conectiva: ftp://atualizacoes.conectiva.com.br/ Fedora: http://download.fedora.redhat.com/pub/ HP: http://h30097.www3.hp.com/internet/download.htm We are not aware of any exploits for this vulnerability. | Low/High (High if arbitrary code can be executed) | SecurityFocus, September 16, 2004 Conectiva Linux Security Announcement, CLA-2004:868, September 23, 2004 Fedora Update Notifications, HP Security Bulletin, | |
| Multiple Vendors Fedora Mandrake Slackware RedHat SGI Slackware Linux –current, 9.1; | Multiple vulnerabilities exist: a vulnerability exists due to an input validation error that causes the application to exit improperly, which could let a malicious user obtain root privileges; and a vulnerability exists due to a failure to validate buffer boundaries, which could let a malicious user cause a Denial of Service.
Fedora: RedHat: SGI: Sun: http://sunsolve.sun.com/search/ A Proof of Concept exploit has been published. | UTempter Multiple Local Vulnerabilities CVE Name: | Low/High (Low if a DoS; and High if root privileges can be obtained) | Fedora Update Notification, FEDORA-2004-108, April 21, 2004 Mandrakelinux Security Update Advisory, MDKSA-2004:031-1, April 21, 2004 Slackware Security Advisory, SSA:2004-110-01, April 19, 2004 Red Hat Security Advisory, RHSA-2004:175-01, April 30, 2004 SGI Security Advisories, 20040602-01-U & 20040603-01-U, June 21, 2004 Sun(sm) Alert Notification, 57658, October 26, 2004 |
FileZilla Server 0.7, 0.7.1; OpenBSD -current, 3.5; | A remote Denial of Service vulnerability during the decompression process due to a failure to handle malformed input. Gentoo: href="http://security.gentoo.org/glsa/glsa-200408-26.xml">http://security.gentoo.org/glsa/glsa-200408-26.xml FileZilla:
href="http://sourceforge.net/project/showfiles.php?group_id=21558">http://sourceforge.net/project/showfiles. OpenBSD: OpenPKG: ftp ftp.openpkg.org Trustix: href="ftp://ftp.trustix.org/pub/trustix/updates/ ">ftp://ftp.trustix.org/pub/trustix/updates/ SuSE: href="ftp://ftp.suse.com/pub/suse/">ftp://ftp.suse.com/pub/suse/ Mandrake: href="http://www.mandrakesecure.net/en/ftp.php">http://www.mandrakesecure.net/en/ftp.php Conectiva: href="ftp://atualizacoes.conectiva.com.br/">ftp://atualizacoes.conectiva.com.br/ SCO: href="ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.17">ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.17 We are not aware of any exploits for this vulnerability. | Low | SecurityFocus, August 25, 2004 SUSE Security Announcement, SUSE-SA:2004:029, September 2, 2004 Mandrakelinux Security Update Advisory, MDKSA-2004:090, September 8, 2004 Conectiva Linux Security Announcement, CLA-2004:865, September 13, 2004 US-CERT Vulnerability Note VU#238678, October 1, 2004 SCO Security Advisory, SCOSA-2004.17, October 19, 2004 Conectiva Linux Security Announcement, CLA-2004:878, October 25, 2004 | |
Gentoo Linux, 1.4; Rob Flynn Gaim 0.10 x, 0.10.3, 0.50-0.75, 0.78, 0.82, 0.82.1, 1.0, 1.0.1; Slackware Linux -current, 9.0, 9.1, 10.0 | A buffer overflow vulnerability exists in the processing of MSNSLP messages due to insufficient verification, which could let a remote malicious user execute arbitrary code. Gentoo: href="http://security.gentoo.org/glsa/glsa-200410-23.xml">http://security.gentoo.org/glsa/glsa-200410-23.xml Rob Flynn: RedHat: href=" ftp://updates.redhat.com">ftp://updates.redhat.com Slackware:
Ubuntu:http://security.ubuntu.com/ubuntu/ We are not aware of any exploits for this vulnerability. | High | Gentoo Linux Security Advisory, GLSA 200410-23, October 25, 2004 RedHat Security Advisory, RHSA-2004:604-01, October 20, 2004 Slackware Security Advisory, SSA:2004-296-01, October 22, 2004 Ubuntu Security Notice, USN-8-1 October 27, 2004 | |
Linux kernel 2.6.8 rc1-rc3 | A Denial of Service vulnerability exists in the 'ReiserFS' file system functionality due to a failure to properly handle files under certain conditions. Upgrades available at: There is no exploit code required. | Linux Kernel ReiserFS File System Local Denial of Service CVE Name: | Low | SecurityFocus, October 26, 2004 |
LinuxPrinting.org Foomatic-Filters 3.03.0.2, 3.1; | A vulnerability exists in the foomatic-rip print filter due to insufficient validation of command-lines and environment variables, which could let a remote malicious user execute arbitrary commands. Mandrake: href="http://www.mandrakesecure.net/en/ftp.php">http://www.mandrakesecure.net/en/ftp.php SuSE: href="ftp://ftp.suse.com/pub/suse">ftp://ftp.suse.com/pub/suse Trustix: href="ftp://ftp.trustix.org/pub/trustix/updates/">ftp://ftp.trustix.org/pub/trustix/updates/ Fedora: http://download.fedora.redhat.com/pub Gentoo: http://security.gentoo.org/glsa/glsa-200409-24.xml Sun: http://sunsolve.sun.com/search/document.do Conectiva: ftp://atualizacoes.conectiva.com.br/ We are not aware of any exploits for this vulnerability. | High | Secunia Advisory, SA12557, September 16, 2004 Fedora Update Notification, Gentoo Linux Security Advisory, GLSA 200409-24, September 17, 2004 Sun(sm) Alert Notification, 57646, October 7, 2004 Conectiva Linux Security Announcement, CLA-2004:880, October 26, 2004 | |
Paul Mackerras PPPD 2.4.1; | A remote Denial of Service vulnerability exists in the 'cbcp_input()' function, due to a failure to properly handle invalid input.
Upgrade available at: We are not aware of any exploits for this vulnerability. | PPPD Remote Denial of Service | Low | Bugtraq, October 26, 2004 |
Net Integration Technologies Inc. WvTftp 0.9
| A buffer overflow vulnerability exists in the 'WvTFTPServer::new_connection ()' function in 'wvtftpserver.cc' due to a insufficient sanity checking, which could let a remote malicious user execute arbitrary code with root privileges. No workaround or patch available at time of publishing. An exploit script has been published. | WvTftp Processing TFTP Options Buffer Overflow | High | Bugtraq, October 26, 2004 |
Netatalk Open Source Apple File Share Protocol Suite 1.5 pre6, 1.6.1, 1.6.4 | A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files.
Trustix: ftp://ftp.trustix.org/pub/trustix/updates/ Gentoo: http://security.gentoo.org/glsa/glsa-200410-25.xml There is no exploit code required. | NetaTalk Insecure Temporary File Creation CVE Name: | Medium | Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004 Gentoo Linux Security Advisory GLSA 200410-25, October 25, 2004 |
OmniWeb 5.0.1 | A cross-domain dialog box spoofing vulnerability exists, which could let a remote malicious user spoof an interface of a trusted web site. No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit has been published. | Omni Group OmniWeb Browser Cross-Domain Dialog Box Spoofing | Medium | Secunia Advisory, SA13002, October 27, 2004 |
Mailing List Manager 2.6-2.6.3 | Some security vulnerabilities exist in PHPlist. The impact was not specified. Update available at: http://sourceforge.net/project/showfiles.php?group_id=91074 We are not aware of any exploits for this vulnerability. | PHPlist Unspecified Remote Security Vulnerabilities | Not Specified | SecurityTracker Alert ID: 1011958, October 27,2 004 |
PNG Development Group libpng 1.2.5 and 1.0.15 | Multiple vulnerabilities exist in the libpng library which could allow a remote malicious user to crash or execute arbitrary code on an affected system. These vulnerabilities include:
If using original, update to libpng version 1.2.6rc1 (release candidate 1) available at:
href="http://www.libpng.org/pub/png/libpng.html"> Conectiva:
href="http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000856">http://distro.conectiva.com.br/atualizacoes/ Debian:
href="http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00139.html">http://lists.debian.org/debian-security-announce/ Gentoo: href="http://security.gentoo.org/glsa/glsa-200408-03.xml">http://security.gentoo.org/glsa/glsa-200408-03.xml Mandrakesoft:
href="http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:079">http://www.mandrakesoft.com/security/advisories RedHat href="http://rhn.redhat.com/">http://rhn.redhat.com/ SuSE: href="http://www.suse.de/de/security/2004_23_libpng.html">http://www.suse.de/de/security/2004_23_libpng.html Fedora:
href="http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/">http://download.fedora.redhat.com/pub/ Sun Solaris:
href="http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57617">http://sunsolve.sun.com/pub-cgi/ HP-UX:
href="http://www4.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01065">http://www4.itrc.hp.com/service/cki/doc GraphicsMagick:
href="http://www.graphicsmagick.org/www/download.html ">http://www.graphicsmagick.org/ ImageMagick:
href="http://www.imagemagick.org/www/download.html">http://www.imagemagick.org/www/ Slackware:
href="http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.439243">http://www.slackware.com/security Yahoo: href="http://messenger.yahoo.com/">http://messenger.yahoo.com/ SuSE: ftp://ftp.suse.com/pub/suse SCO: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.16 Fedora Legacy: http://download.fedoralegacy.org/redhat/ A Proof of Concept exploit has been published. | Multiple Vulnerabilities in libpng CVE Names: | High | US-CERT Technical Cyber Security Alert TA04-217A, August 4, 2004 US-CERT Vulnerability Notes VU#160448, VU#388984, VU#817368, VU#236656, VU#477512, VU#286464, August 4, 2004 SUSE Security Announcement, SUSE-SA:2004:035, October 5, 2004 SCO Security Advisory, SCOSA-2004.16, October 12, 2004 Fedora Legacy Update Advisory, FLSA:2089, October 27, 2004 |
PostgreSQL 7.4.5 | A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files. Trustix: href="ftp://ftp.trustix.org/pub/trustix/updates/">ftp://ftp.trustix.org/pub/trustix/updates/ Gentoo: href="http://security.gentoo.org/glsa/glsa-200410-16.xml">http://security.gentoo.org/glsa/glsa-200410-16.xml Debian: http://security.debian.org/pool/updates/ OpenPKG: ftp://ftp.openpkg.org/release/ There is no exploit code required. | Medium | Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004 Gentoo Linux Security Advisory, GLSA 200410-16, October 18, 2004 Debian Security Advisory, DSA 577-1, October 29, 2004 OpenPKG Security Advisory, OpenPKG-SA-2004.046, October 29, 2004 | |
Qwikmail 0.3 | A vulnerability exists due to a format string error in 'qwik-smtpd.c,' which could let a remote malicious user execute arbitrary code. Patch available at: http://qwikmail.sourceforge.net/ We are not aware of any exploits for this vulnerability. | QwikMail Format String | High | Secunia Advisory, SA13037, November 1, 2004 |
HTML::Merge 3.0 - 3.42 | A vulnerability exists in 'printsource.pl' due to insufficient validation of the 'template' parameter, which could let a remote malicious user execute arbitrary code.
Update available at: http://sourceforge.net/project/showfiles.php?group We are not aware of any exploits for this vulnerability. | HTML::Merge 'printsource.pl' Input Validation | High | Secunia Advisory, SA13041, November 1, 2004 |
MIMEDefang 2.4, 2.14, 2.20, 2.21, 2.38, 2.39, 2.41-4.47 | Multiple vulnerabilities exists due to insufficient validation of I/O Upgrades available at: We are not aware of any exploits for this vulnerability. | Roaring Penguin Software MIMEDefang Multiple Vulnerabilities | Not Specified | SecurityTracker Alert ID, 1011996, October 29, 2004 |
zgv Image Viewer 5.5 | Several vulnerabilities exist due to various integer overflows when processing images, which could let a remote malicious user execute arbitrary code. No workaround or patch available at time of publishing. We are not aware of any exploits for this vulnerability. | ZGV Image Viewer Multiple Remote Integer Overflow | High | Bugtraq, October 26, 2004 |
LinuxStat 2.0-2.3 | A Directory Traversal vulnerability exists in the 'template' parameter due to insufficient sanitization of user-supplied input, which could let a remote malicious user obtain sensitive information. Update available at: http://sourceforge.net/project/showfiles.php?group_id=38678 There is no exploit code required; however, a Proof of Concept exploit has been published. | Ryszard Pydo LinuxStat Remote Directory Traversal | Medium | Secunia Advisory, SA12963, October 25, 2004 |
| SCO Group SCO OpenServer 5.x | Multiple vulnerabilities exist in SCO MMDF. According to SCO the vulnerabilities are: buffer overflows, null dereferences and core dumps. One of the buffer overflows is known to affect 'execmail.' Updates available at:
href="ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.7/">ftp://ftp.sco.com/pub/updates An exploit script has been published. | SCO OpenServer Multiple Vulnerabilities in MMDF CVE Names: | Medium | SCO Advisory, SCOSA-2004.7, July 14, 2004 Deprotect Security Advisory 20040206, July 2, 2004 PacketStorm October 26, 2004 |
Squid 2.5-STABLE6, 3.0-PRE3-20040702; when compiled with SNMP support
| A remote Denial of Service vulnerability exists in the 'asn_parse_header()' function in 'snmplib/asn1.c' due to an input validation error when handling certain negative length fields. Updates available at: href=" http://www.squid-cache.org/">http://www.squid-cache.org/ Fedora:
href="http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/">http://download.fedora.redhat.com/pub/ Gentoo: href="http://security.gentoo.org/glsa/glsa-200410-15.xml">http://security.gentoo.org/glsa/glsa-200410-15.xml Trustix: href="http://http.trustix.org/pub/trustix/updates/">http://http.trustix.org/pub/trustix/updates/ RedHat: href="http://rhn.redhat.com/errata/RHSA-2004-591.html">http://rhn.redhat.com/errata/RHSA-2004-591.html Mandrake: href="http://www.mandrakesecure.net/en/ftp.php">http://www.mandrakesecure.net/en/ftp.php Debian: http://security.debian.org/pool/updates/main/s/squid/ OpenPKG: ftp://ftp.openpkg.org/release/ We are not aware of any exploits for this vulnerability. | Low | iDEFENSE Security Advisory, October 11, 2004 Fedora Update Notification, Trustix Secure Linux Security Advisory, TSLSA-2004-0054, October 15, 2004 Gentoo Linux Security Advisory, GLSA 200410-15, October 18, 2004 RedHat Security Advisory, RHSA-2004:591-04, October 20, 2004 Mandrakelinux Security Update Advisory, MDKSA-2004:112, October 21, 2004 Debian Security Advisory, DSA 576-1, October 29, 2004 OpenPKG Security Advisory, OpenPKG-SA-2004.048, October 29, 2004 | |
Performance Suite 4.0, 4.1, Utilization Suite 4.0, 4.1 | A vulnerability exists in StorEdge QFS and SAM-FS, which could let a remote malicious user obtain sensitive information. Workaround available at: http://sunsolve.sun.com/search/document.do? There is no exploit code required. | Sun StorEdge Sparse File Information Disclosure | Medium | SecurityFocus, October 27, 2004 |
Shadow 4.0-4.0.4
| A vulnerability exists in the in the 'chfn' and 'chsh' utilities due to insufficient sanitization of user-supplied input, which could let a remote malicious user bypass authentication.
Upgrades available at : We are not aware of any exploits for this vulnerability. | Shadow Authentication Bypass | Medium | SecurityFocus, October 28, 2004 |
Windowmaker 0.20.1 -3, 0.52 -2, 0.53, 0.60, 0.61, 0.61.1, 0.62, 0.62.1, 0.63, 0.63.1, 0.64, 0.65, 0.65.1, 0.80, 0.80.2 | A format string vulnerability exists in the 'WMGLOBAL' configuration file related to the validation of font specifications, which could let a malicious user execute arbitrary code.
Upgrades available at: We are not aware of any exploits for this vulnerability. | Window Maker WMGLOBAL Font Specification Format String | High | SecurityFocus, October 26, 2004 |
Libxml2 2.6.12-2.6.14 | Multiple buffer overflow vulnerabilities exist: a vulnerability exists in the 'xmlNanoFTPScanURL()' function in 'nanoftp.c' due to a boundary error, which could let a remote malicious user execute arbitrary code; a vulnerability exists in the' xmlNanoFTPScanProxy()' function in 'nanoftp.c,' which could let a remote malicious user execute arbitrary code; and a vulnerability exists in the handling of DNS replies due to various boundary errors, which could let a remote malicious user execute arbitrary code. Upgrades available at: OpenPKG: Trustix: ftp://ftp.trustix.org/pub/trustix/updates/ An exploit script has been published. | Libxml2 Multiple Remote Stack Buffer Overflows CVE Name: | High | SecurityTracker Alert I, : 1011941, October 28, 2004 |
| Multiple Operating Systems - Windows / UNIX / Linux / Other | ||||
Vendor & Software Name | Vulnerability - Impact Patches - Workarounds Attacks Scripts | Common Name | Risk | Source |
HAR11A DSL Router | A vulnerability exists due to a failure to require authentication credentials prior to allowing administrative access to the devices CLI interface, which could let a remote malicious user obtain administrative access.
No workaround or patch available at time of publishing. There is no exploit code required. | Hawking Technology HAR11A DSL Router Unauthenticated Administrative Access | High | Bugtraq, October 26, 2004 |
Horde 2.0, 2.1, 2.1.3, 2.2, 2.2.1, 2.2.3, 2.2.4, RC1, 2.2.5, 2.2.6 | A Cross-Site Scripting vulnerability exists in the 'Help' window due to insufficient sanitization of user-supplied data, which could let a remote malicious user execute arbitrary HTML and script code. Upgrades available at: There is no exploit code required. | Horde Application Framework Help Window Cross-Site Scripting | High | SecurityTracker Alert ID, 1011959, October 27, 2004 |
Quake II Server 3.20, 3.21 | Multiple vulnerabilities exist: a remote Denial of Service vulnerability exists when handling 'Configstrings' and 'Baselines' due to an input validation error; a buffer overflow vulnerability exists when parsing command packets, which could let a remote malicious user execute arbitrary code; an input validation vulnerability exists when when requesting missing files such as No workaround or patch available at time of publishing. We are not aware of any exploits for these vulnerabilities. | ID Software Quake II Server Multiple Remote | Low/Medium/ (Low if a DoS: Medium if sensitive information can be obtained; and High if arbitrary code can be executed) | Bugtraq, October 27, 2004 |
Land Down Under 701 | Multiple input validation vulnerabilities exist due to insufficient validation of user-supplied input in several variables, which could let a remote malicious user obtain sensitive information. Update available at: http://www.neocrome.net/index.php?msingle&id91 Proofs of Concept exploits have been published. | Land Down Under Input Validation | Medium | SecurityTracker Alert ID, 1012015, November 1, 2004 |
Mozilla Browser 0.8, 0.9.2.1, 0.9.2- 0.9.9, 0.9.35, 0.9.48, 1.0, RC1& RC2, 1.0.1, 1.0.2, 1.1- 1.5 | A Cross-Site Scripting vulnerability exists in 'nsDOMClassInfo.cpp' and occurs when a large number of event handlers are used within HTML tags, which could let a remote malicious user execute arbitrary code. The vulnerability has been fixed in versions 1.6b and 1.4.2 available at: HP: Redhat: http://rhn.redhat.com/errata/RHSA-2004-110.html SGI: Fedora Legacy: http://download.fedoralegacy.org/redhat/ We are not aware of any exploits for this vulnerability. | Mozilla Browser Zombie Document Cross-Site Scripting Vulnerability
CVE Name: | High | SecurityFocus, February 25, 2004 Fedora Legacy Update Advisory, FLSA:2089, October 27, 2004 |
| Mozilla.org Mozilla 1.6 & prior; Netscape 7.0, 7.1, and prior | A input validation vulnerability exists in the SOAPParameter object constructor in Netscape and Mozilla which allows execution of arbitrary code. The SOAPParameter object's constructor contains an integer overflow that allows controllable heap corruption. A web page can be constructed to leverage this into remote execution of arbitrary code. Upgrade to Mozilla 1.7.1 available at:
href="http://www.mozilla.org/products/mozilla1.x/"> SuSE: href="ftp://ftp.suse.com/pub/suse/">ftp://ftp.suse.com/pub/suse/ Conectiva: href="ftp://atualizacoes.conectiva.com.br/">ftp://atualizacoes.conectiva.com.br/ Fedora Legacy: http://download.fedoralegacy.org/redhat/ We are not aware of any exploits for this vulnerability. | High | iDEFENSE Security Advisory, August 2, 2004 Bugzilla Bug 236618 SUSE Security Announcement, SUSE-SA:2004:036, October 6, 2004 Conectiva Linux Security Announcement, CLA-2004:877, October 22, 2004 Fedora Legacy Update Advisory, FLSA:2089, October 27, 2004 | |
| Mozilla.org Mozilla 1.6; | A Denial of Service vulnerability exists in which arbitrary root certificates are imported silently without presenting users with a import dialog box. Due to another problem, this can e.g. be exploited by malicious websites or HTML-based emails to prevent users from accessing valid SSL sites. Workaround: Check the certificate store and delete untrusted certificates if an error message is displayed with error code -8182 ("certificate presented by [domain] is invalid or corrupt") when attempting to access a SSL-based website. SuSE: href="ftp://ftp.suse.com/pub/suse/">ftp://ftp.suse.com/pub/suse/ Conectiva: href="ftp://atualizacoes.conectiva.com.br/">ftp://atualizacoes.conectiva.com.br/ Fedora Legacy: http://download.fedoralegacy.org/redhat/ Currently, we are not aware of any exploits for this vulnerability. | Low | Secunia Advisory, SA12076, July 16, 2004 SUSE Security Announcement, SUSE-SA:2004:036, October 6, 2004 Conectiva Linux Security Announcement, CLA-2004:877, October 22, 2004 Fedora Legacy Update Advisory, FLSA:2089, October 27, 2004 | |
name=mozilla-firefox>Mozilla.org Mozilla 1.7 and prior; | Multiple vulnerabilities exist in Mozilla, Firefox, and Thunderbird that could allow a malicious user to conduct spoofing attacks, compromise a vulnerable system, or cause a Denial of Service. These vulnerabilities include buffer overflow, input verification, insecure certificate name matching, and out-of-bounds reads. Upgrade to the latest version of Mozilla, Firefox, or Thunderbird available at: href="http://www.mozilla.org/download.html">http://www.mozilla.org/download.html Slackware:
href="http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.667659">http://www.slackware.com/security/viewer.php?l= Mandrakesoft:
href="http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:082">http://www.mandrakesoft.com/security/advisories? RedHat: href="http://rhn.redhat.com/errata/RHSA-2004-421.html">http://rhn.redhat.com/errata/RHSA-2004-421.html SGI:
href="ftp://patches.sgi.com/support/free/security/patches/ProPack/3">ftp://patches.sgi.com/support/free/security/ Gentoo: href="http://security.gentoo.org/glsa/glsa-200409-26.xml">http://security.gentoo.org/glsa/glsa-200409-26.xml HP: href="http://h30097.www3.hp.com/internet/download.htm">http://h30097.www3.hp.com/internet/download.htm SuSE: href="ftp://ftp.suse.com/pub/suse/">ftp://ftp.suse.com/pub/suse/ Conectiva: href="ftp://atualizacoes.conectiva.com.br/">ftp://atualizacoes.conectiva.com.br/ Fedora Legacy: http://download.fedoralegacy.org/redhat/ We are not aware of any exploits for these vulnerabilities. | Mozilla/Firefox/ Thunderbird CVE Name: | High | Secunia, SA10856, August 4, 2004 US-CERT Vulnerability Note VU#561022 RedHat Security Advisory, RHSA-2004:421-17, August 4, 2004 SGI Security Advisory, 20040802-01-U, August 14, 2004 Gentoo Linux Security Advisory, GLSA 200409-26, September 20, 2004 HP Security Bulletin, HPSBTU01081, October 5, 2004 SUSE Security Announcement, SUSE-SA:2004:036, October 6, 2004 Conectiva Linux Security Announcement, CLA-2004:877, October 22, 2004 Fedora Legacy Update Advisory, FLSA:2089, October 27, 2004 |
Mozilla 0.x, 1.0-1.7.x, Firefox 0.x, Thunderbird 0.x; Netscape Navigator 7.0, 7.0.2, 7.1, 7.2 | Multiple vulnerabilities exist: buffer overflow vulnerabilities exist in 'nsMsgCompUtils.cpp' when a specially crafted e-mail is forwarded, which could let a remote malicious user execute arbitrary code; a vulnerability exists due to insufficient restrictions on script generated events, which could let a remote malicious user obtain sensitive information; a buffer overflow vulnerability exists in the 'nsVCardObj.cpp' file due to insufficient boundary checks, which could let a remote malicious user execute arbitrary code; a buffer overflow vulnerability exists in 'nsPop3Protocol.cpp' due to boundary errors, which could let a remote malicious user execute arbitrary code; a heap overflow vulnerability exists when handling non-ASCII characters in URLs, which could let a remote malicious user execute arbitrary code; multiple integer overflow vulnerabilities exist in the image parsing routines due to insufficient boundary checks, which could let a remote malicious user execute arbitrary code; a cross-domain scripting vulnerability exists because URI links dragged from one browser window and dropped into another browser window will bypass same-origin policy security checks, which could let a remote malicious user execute arbitrary code; and a vulnerability exists because unsafe scripting operations are permitted, which could let a remote malicious user manipulate information displayed in the security dialog. Updates available at: link="#999999"> href=" http://www.mozilla.org/">http://www.mozilla.org/ Gentoo: href="http://security.gentoo.org/glsa/glsa-200409-26.xml">http://security.gentoo.org/glsa/glsa-200409-26.xml HP: href="http://h30097.www3.hp.com/internet/download.htm">http://h30097.www3.hp.com/internet/download.htm RedHat: href="http://rhn.redhat.com/errata/RHSA-2004-486.html">http://rhn.redhat.com/errata/RHSA-2004-486.html SuSE: href="ftp://ftp.suse.com/pub/suse/">ftp://ftp.suse.com/pub/suse/ Conectiva: href="ftp://atualizacoes.conectiva.com.br/">ftp://atualizacoes.conectiva.com.br/ Fedora Legacy: http://download.fedoralegacy.org/redhat/ Proofs of Concept exploits have been published. | Mozilla Multiple Remote Vulnerabilities CVE Names: | Medium/ High (High if arbitrary code can be executed) | Technical Cyber Security Alert TA04-261A, September 17, 2004 US-CERT Vulnerability Notes VU#414240, VU#847200, VU#808216, VU#125776, VU#327560, VU#651928, VU#460528, VU#113192, September 17, 2004 Gentoo Linux Security Advisory, GLSA 200409-26, September 20, 2004 RedHat Security Bulletin, RHSA-2004:486-18, September 30, 2004 HP Security Bulletin, HPSBTU01081, October 5, 2004 SUSE Security Announcement, SUSE-SA:2004:036, October 6, 2004 Conectiva Linux Security Announcement, CLA-2004:877, October 22, 2004 Fedora Legacy Update Advisory, FLSA:2089, October 27, 2004 |
name=mozillaonunload>Mozilla.org Mozilla Firefox 0.9.2 and Mozilla 1.7.1 on Windows | A spoofing vulnerability exists that could allow malicious sites to abuse SSL certificates of other sites. An attacker could make the browser load a valid certificate from a trusted website by using a specially crafted "onunload" event. The problem is that Mozilla loads the certificate from a trusted website and shows the "secure padlock" while actually displaying the content of the malicious website. The URL shown in the address bar correctly reads that of the malicious website. An additional cause has been noted due to Mozilla not restricting websites from including arbitrary, remote XUL (XML User Interface Language) files. Workaround: Do not follow links from untrusted websites and verify the correct URL in the address bar with the one in the SSL certificate. SuSE: href="ftp://ftp.suse.com/pub/suse/">ftp://ftp.suse.com/pub/suse/ Conectiva: href="ftp://atualizacoes.conectiva.com.br/">ftp://atualizacoes.conectiva.com.br/ Fedora Legacy: http://download.fedoralegacy.org/redhat/ A Proof of Concept exploit has been published. | Medium | Cipher.org, July 25, 2004 SUSE Security Announcement, SUSE-SA:2004:036, October 6, 2004 Conectiva Linux Security Announcement, CLA-2004:877, October 22, 2004 Fedora Legacy Update Advisory, FLSA:2089, October 27, 2004 | |
Simon Tatham PuTTY 0.48- 0.55; | A buffer overflow vulnerability exists in the 'ssh2_rdpkt()' function due to insufficient validation of the string length parameter in 'SSH2_MSG_DEBUG' packets, which could let a remote malicious user execute arbitrary code. Simon Tatham: Tortoise: Gentoo: http://security.gentoo.org/glsa/glsa-200410-29.xml We are not aware of any exploits for this vulnerability. | PuTTY Remote SSH2_MSG_DEBUG Remote Buffer Overflow | High | iDefense Security Advisory, October 27, 2004 |
Agnitum Outpost Firewall 2.1, 2.5; | A vulnerability exists due to content filtering bypass issues, which could let a remote malicious user execute arbitrary code on a client system thought to be protected.
No workaround or patch available at time of publishing. There is no exploit code required. | Multiple Vendor Content Filtering Bypass | High | Securiteam, November 1, 2004 |
HP HP-UX B.11.23, 11.11, 11.00; | A buffer overflow vulnerability exists in the Netscape Network Security Services (NSS) library suite due to insufficient boundary checks, which could let a remote malicious user which may result in remote execute arbitrary code. Mozilla:
href="ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_9_2_RTM/" Sun:
href="http://sunsolve.sun.com/search/document.do?assetkey=1-26-57643-1&searchclause=security">http://sunsolve.sun.com/search/document.do? Sun: http://sunsolve.sun.com/search/document.do We are not aware of any exploits for this vulnerability. | NSS Buffer Overflow | High | Internet Security Systems Advisory, August 23, 2004 Sun(sm) Alert Notification, 57643, September 16, 2004 Sun(sm) Alert Notification, 57632, October 25, 2004 |
Chesapeake TFTP Server 1.0 | Two vulnerabilities exist: a Directory Traversal vulnerability exists due to insufficient input validation, which could let a remote malicious user obtain sensitive information; and a remote Denial of Service vulnerability exists when a malicious user submits an UDP packet that is larger than 514 bytes. No workaround or patch available at time of publishing. Proofs of Concept exploits have been published. | Netcordia Chesapeake TFTP Server Directory Traversal & Remote Denial of Service | Low/Medium (Medium if sensitive information can be obtained) | Secunia Advisory, SA13033, November 1, 2004 |
Work Flow Engine 1.4-1.4.5 | Two vulnerabilities exist: a Cross-Site Scripting vulnerability exists in 'login.action' due to insufficient sanitization of input passed to the web client's 'url' parameter, which could let a remote malicious user execute arbitrary HTML and script code; and a vulnerability exists in the 'worklist URL' because arbitrary hosts are accepted, which could let a remote malicious user obtain sensitive information.
Update available at: http://sourceforge.net/cvs/?group_id=54621 There is no exploit code required; however, Proofs of Concept exploits have been published. | OpenWFE Remote Cross-Site Scripting & Connection Proxy | Medium/ (High if arbitrary code can be executed) | SecurityTracker Alert ID, 1011927, October 26, 2004 |
Phorum 5.0.11 | Multiple vulnerabilities exist: a Cross-Site Scripting vulnerability exists due to insufficient sanitization of certain input, which could let a remote malicious user execute arbitrary HTML and script code; and a vulnerability exists due to insufficient sanitization of unspecified input before being used in a SQL query, which could let a remote malicious user execute arbiter SQL code. No workaround or patch available at time of publishing. There is no exploit code required. | Phorum Cross-Site Scripting & SQL Injection | High | Secunia Advisory, SA12980, October 26, 2004 |
PHP 4.0-4.0.7, 4.0.7 RC1-RC3, 4.1 .0-4.1.2, 4.2 .0-4.2.3, 4.3-4.3.8, 5.0 candidate 1-3, 5.0 .0-5.0.2 | A vulnerability exists in the 'open_basedir' directory setting due to a failure of the cURL module to properly enforce restrictions, which could let a malicious user obtain sensitive information. No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit has been published. | PHP cURL Open_Basedir Restriction Bypass | Medium | SecurityTracker Alert ID, 1011984, October 28, 2004 |
phpCodeGenie 1.1, 1.4, 1.21, 3.0 Alpha | A vulnerability exists because php code may be injected through header and footer input, which could let a remote malicious user execute arbitrary code. Upgrades available at: There is no exploit code required. | phpCodeGenie Remote Arbitrary Code Execution | High | SecurityTracker Alert ID, 1011911, October 24, 2004 |
PostNuke 0.75 | A vulnerability exists because 'downloads.postnuke.com' was compromised and some files in the PostNuke .750 distribution were modified, which could let a remote malicious user execute arbitrary code. This is due to a vulnerability in the 'pafiledb' download management software Note: The compromise occurred on October 24, 2004 at 23:50 GMT; and the original software was restored on October 26, 2004 at 8:30 GMT. Solution available at: There is no exploit code required. | PostNuke Trojan Horse | High | SecurityTracker Alert ID, 1011938, October 26, 2004 |
Master of Orion III 1.2.5 | Multiple remote Denial of Service vulnerabilities exists due to a failure to properly handle exceptional conditions. No workaround or patch available at time of publishing. A Proof of Concept exploit script has been published. | Quicksilver Master of Orion III Multiple Remote Denials of Service | Low | Bugtraq, October 27, 2004 |
Mega Upload Progress Bar 1.30, 1.35, 1.43, 1.44 | A vulnerability exists in 'upload.cgi' due to an unspecified error in the way the file is passed to the PHP handler, which could let a remote malicious user obtain or modify sensitive information. Updates available at: http://sourceforge.net/project/showfiles.php?group_id=87646 We are not aware of any exploits for this vulnerability. | Raditha Dissanayake Mega Upload Filenames | Medium | Secunia Advisory, SA12993, October 27, 2004 |
RealOne Player 1.0, 2.0, RealPlayer 10.0 BETA, 10.0 v6.0.12.690, 10.0, 10.5 v6.0.12.1053, 10.5 v6.0.12.1040, 10.5 Beta v6.0.12.1016, 10.5 | A buffer overflow vulnerability exists in 'DUNZIP32.DLL' due to insufficient boundary checks on filenames contained in skin file archives, which could let a remote malicious user execute arbitrary code. Fixes are available via the 'Check for Update' feature. We are not aware of any exploits for this vulnerability. | RealPlayer Skin File Buffer Overflow | High | eEye Digital Security Advisory, October 26, 2004 |
IPplan 2.91, 2.92, 2.99, 3.0 1, 3.0, 3.2 | Several input validation vulnerabilities exists due to insufficient validation of numerous variables, which could let a remote malicious user execute arbitrary SQL commands.
Updates available at: There is no exploit code required. | Richard Ellerbrock IPplan Input Validation | High | SecurityTracker Alert ID, 1011919, October 25, 2004 |
SKForum 1.0, 1.1, 1.1.5, 1.2, 1.3, 1.4 | A vulnerability exists due to an unspecified error in 'my wiki' and 'wiki.' The impact was not specified.
Update available at: http://soft.killingar.net/wiki.view.action?wiki=SKForum We are not aware of any exploits for this vulnerability. | SKForum 'my wiki' & 'wiki' | Not Specified | Secunia Advisory, SA12965, October 25, 2004 |
cabextract 0.6, 1.0 | A Directory Traversal vulnerability exists in the 'create_output_name()' function in 'cabextract.c' due to insufficient input validation, which could let a remote malicious user create or overwrite files. Update available at:
href=" http://www.kyz.uklinux.net/downloads/cabextract-1.1.tar.gz">http://www.kyz.uklinux.net/downloads/ Debian: http://security.debian.org/pool/updates/main/c/cabextract There is no exploit code required. | Stuart Caie cabextract Remote Directory Traversal CVE Name: | Medium | Secunia Advisory, Debian Security Advisory, DSA 574-1, October 28, 2004 |
Java Web Proxy Server 3.6, SP1-SP4 | Multiple buffer overflow vulnerabilities exist due to insufficient bounds checks prior to copying user-supplied data into memory buffers, which could let a remote malicious user cause a Denial of Service and possibly execute arbitrary code.
Updates available at: We are not aware of any exploits for these vulnerabilities. | Sun Java System Web Proxy Server Multiple Buffer Overflows | Low/High (High if arbitrary code can be executed) | Sun(sm) Alert Notification, 57606, October 29, 2004 |
Recent Exploit Scripts/Techniques
The table below contains a sample of exploit scripts and "how to" guides identified during this period. The "Workaround or Patch Available" column indicates if vendors, security vulnerability listservs, or Computer Emergency Response Teams (CERTs) have published workarounds or patches.
Note: At times, scripts/techniques may contain names or content that may be considered offensive.
Date of Script | Script name | Workaround or Patch Available | Script Description |
| November 2, 2004 | everscan-0.8.2.tgz | N/A | A daemonized network scanner that randomly scans at a very slow pace for machines and stores the data to a database. It comes with a client to query for finds. |
| November 2, 2004 | SecondOrderCodeInjection.pdf | N/A | Whitepaper discussing how injection of data can later be used to carry out an attack at a different point in time. |
| November 1, 2004 | authfail-1.0.0.tgz | N/A | A tool for adding IP addresses to an ACL when entities from those addresses attempt to log into a system, but cause authentication failures in auth.log. It reads data from auth.log in real time and adds the IP into netfilter with a DROP/REJECT policy. |
| November 1, 2004 | mimedefang-2.48.tar.gz | N/A | A flexible MIME email scanner designed to protect Windows clients from viruses that includes the ability to do many other kinds of mail processing, such as replacing parts of messages with URLs. It can alter or delete various parts of a MIME message according to a very flexible configuration file. |
| November 1, 2004 | nixfo-ng-1.5.tar.gz | N/A | A script that scans Linux-based systems and does a complete inventory of anything installed, available, manipulated, or other wise. |
| October 30, 2004 | ability-ftpd-exploit.tar.bz2 | No | Exploit for the Code-Crafters Ability Server FTP STOR Argument Remote Buffer Overflow vulnerability. |
| October 30, 2004 | mimedefang-2.47.tar.gz | N/A | A flexible MIME email scanner designed to protect Windows clients from viruses that includes the ability to do many other kinds of mail processing, such as replacing parts of messages with URLs. |
| October 29, 2004 | hydra-4.4-src.tar.gz | N/A | A high quality parallelized login hacker for Samba, Smbnt, Cisco AAA, FTP, POP3, IMAP, Telnet, HTTP Auth, LDAP, NNTP, MySQL, VNC, ICQ, Socks5, PCNFS, Cisco and more. Includes SSL support, parallel scans, and is part of Nessus. |
| October 28, 2004 | bypassArticle.txt | N/A | Presentation: Bypassing client application protection techniques with notepad. |
| October 28, 2004 | moo3boom.zip | No | Proof of Concept for the Quicksilver Master of Orion III Multiple Remote Denial of Service vulnerabilities. |
| October 28, 2004 | wvftpd.c | No | Script that exploits the WvTftp Processing TFTP Options Buffer Overflow vulnerability. |
| October 27, 2004 | ability.c | No | Exploit for the Code-Crafters Ability Server FTP STOR Argument Remote Buffer Overflow vulnerability. |
| October 27, 2004 | aos2bof.zip | No | Script that exploits the Akella Privateer's Bounty: Age of Sail II Remote Nickname Buffer Overflow vulnerability. |
| October 27, 2004 | chmremote.txt | No | Full write up and exploitation walk-thru for the Microsoft Internet Explorer ms-its scheme/CHM remote code execution vulnerability. |
| October 27, 2004 | FakeRedhatPatchAnalysis.txt | N/A | A full analysis of the fake Fedora-Redhat security alert with trojan source code. |
| October 27, 2004 | gd-graphics.c | Yes | Script that exploits the GD Graphics Library Remote Integer Overflow vulnerability. |
| October 27, 2004 | kismet-2004-10-R1.tar.gz | N/A | An 802.11 layer 2 wireless network sniffer that can sniff 802.11b, 802.11a, and 802.11g traffic. It is capable of sniffing using almost any wireless card supported in Linux, which currently divide into cards handled by libpcap and the Linux-Wireless extensions (such as Cisco Aironet), and cards supported by the Wlan-NG project which use the Prism/2 chipset (such as Linksys, Dlink, and Zoom). Besides Linux, Kismet also supports FreeBSD, OpenBSD and Mac OS X systems. |
| October 27, 2004 | libxmlSploit.c | Yes | Proof of Concept exploit for the Libxml2 Multiple Remote Stack Buffer Overflow vulnerabilities. |
| October 27, 2004 | moo3boom.tar | No | Proof of Concept for the Quicksilver Master of Orion III Multiple Remote Denial of Service vulnerabilities. |
| October 27, 2004 | wx-01.tar.gz | N/A | New Macintosh OS-X rootkit that is roughly based off of adore. It hides itself from kextstat, netstat, utmp and wtmp. Further revisions to include a reverse shell triggered by ARP and DNS packets. |
| October 26, 2004 | libxml_exp.c | Yes | Proof of Concept exploit for the Libxml2 Multiple Remote Stack Buffer Overflow vulnerabilities. |
| October 26, 2004 | mailCarrierExploit.txt | No | Script that exploits the Tabs Laboratories MailCarrier Remote SMTP EHLO/HELO Buffer Overflow vulnerability. |
| October 26, 2004 | wvTftpRemoteRootExploit.c | No | Script that exploits theWvTftp Processing TFTP Options Buffer Overflow vulnerability. |
name=trends>Trends
- The RedHat Linux vendor warned in a message on its web site that an e-mail disguised as a Red Hat patch update is a fake designed to trick users into downloading malware. "Red Hat has been made aware that e-mails are circulating that pretend to come from the Red Hat Security Team," Red Hat Inc. said in the message. "These e-mails tell users to download and install malicious updates. These Trojan updates contain malicious code designed to compromise the systems they run on." For more information, see http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1019189,00.html.
- A new caller ID spoofing site has opened that offers subscribers a simple Web interface to a caller I.D. The service is called Camophone and is similar to star38.com, except that anyone can use it (not just government agencies).
For more information, see
http://www.securityfocus.com/news/9822.
name=viruses>Viruses/Trojans
Top Ten Virus Threats
A list of high threat viruses, as reported to various anti-virus vendors and virus incident reporting organizations, has been ranked and categorized in the table below. For the purposes of collecting and collating data, infections involving multiple systems at a single location are considered a single infection. It is therefore possible that a virus has infected hundreds of machines but has only been counted once. With the number of viruses that appear each month, it is possible that a new virus will become widely distributed before the next edition of this publication. To limit the possibility of infection, readers are reminded to update their anti-virus packages as soon as updates become available. The table lists the viruses by ranking (number of sites affected), common virus name, type of virus code (i.e., boot, file, macro, multi-partite, script), trends (based on number of infections reported since last week), and approximate date first found.
name=viruses>Viruses/Trojans
Top Ten Virus Threats
A list of high threat viruses, as reported to various anti-virus vendors and virus incident reporting organizations, has been ranked and categorized in the table below. For the purposes of collecting and collating data, infections involving multiple systems at a single location are considered a single infection. It is therefore possible that a virus has infected hundreds of machines but has only been counted once. With the number of viruses that appear each month, it is possible that a new virus will become widely distributed before the next edition of this publication. To limit the possibility of infection, readers are reminded to update their anti-virus packages as soon as updates become available. The table lists the viruses by ranking (number of sites affected), common virus name, type of virus code (i.e., boot, file, macro, multi-partite, script), trends (based on number of infections reported since last week), and approximate date first found.
face="Arial, Helvetica, sans-serif">Rank | Common Name | Type of Code |
face="Arial, Helvetica, sans-serif">Trends |
face="Arial, Helvetica, sans-serif">Date |
1 | Netsky-P | Win32 Worm | Stable | March 2004 |
2 | Zafi-B | Win32 Worm | Stable | June 2004 |
3 | Netsky-Z | Win32 Worm | Stable | April 2004 |
4 | Netsky-D | Win32 Worm | Stable | March 2004 |
5 | Bagle-AA | Win32 Worm | Stable | April 2004 |
6 | Netsky-B | Win32 Worm | Stable | February 2004 |
7 | Netsky-Q | Win32 Worm | Stable | March 2004 |
8 | Bagle-Z | Win32 Worm | Slight Increase | April 2004 |
9 | Bagle.AT | Win32 Worm | New to Table | October 2004 |
10 | Netsky-C* | Win32 Worm | New to Table | February 2004 |
Table Updated November 1, 2004
* Netsky-C made a large impact when first emerging in February 2004 and has consistently remained stable, just off the Top 10 list. Several anti-virus vendors have recently raised its rating slightly, which has pushed it into the Top 10.
Viruses or Trojans Considered to be a High Level of Threat
- Bagle.BB, Bagle AT- A new version of the Bagle mass-mailing worm was discovered Friday, October 29. Bagle.BB harvests addresses from local files and then uses those addresses in the "from" field to send itself. It also opens a backdoor for remote access to the user's computer. Antivirus software makers have also identified other variants of the Bagle virus that are successfully spreading. This virus can also disable the Windows SP2 firewall. (CNET.News, October 29, 2004)
The following table provides, in alphabetical order, a list of new viruses, variations of previously encountered viruses, and Trojans that have been discovered during the period covered by this bulletin. This information has been compiled from the following anti-virus vendors: Sophos, Trend Micro, Symantec, McAfee, Network Associates, Central Command, F-Secure, Kaspersky Labs, MessageLabs, Panda Software, Computer Associates, and The WildList Organization International. Users should keep anti-virus software up to date and should contact their anti-virus vendors to obtain specific information on the Trojans and Trojan variants that anti-virus software detects.
NOTE: At times, viruses and Trojans may contain names or content that may be considered offensive.
Last updated
Please share your thoughts
We recently updated our anonymous product survey; we’d welcome your feedback.