Summary of Security Items from October 13 through October 19, 2004
This bulletin
provides a summary of new or updated vulnerabilities, exploits, trends, viruses,
and trojans. Updates to items appearing in previous
bulletins are listed in bold text. The text in the Risk column appears in
red for vulnerabilities ranking High. The risks
levels applied to vulnerabilities in the Cyber Security Bulletin are based on
how the "system" may be impacted. The Recent Exploit/Technique table contains a
"Workaround or Patch Available" column that indicates whether a workaround or
patch has been published for the vulnerability which the script exploits.
The table below summarizes vulnerabilities
that have been identified, even if they are not being exploited. Complete
details about patches or workarounds are available from the source of the
information or from the URL provided in the section. CVE numbers are listed
where applicable. Vulnerabilities that affect both Windows and
Unix Operating Systems are included in the Multiple Operating
Systems section.
Note: All the information included in the following tables
has been discussed in newsgroups and on web sites.
The Risk levels
defined below are based on how the system may be impacted:
High - A
high-risk vulnerability is defined as one that will allow an intruder to
immediately gain privileged access (e.g., sysadmin or root) to the system or
allow an intruder to execute code or alter arbitrary system files. An example
of a high-risk vulnerability is one that allows an unauthorized user to send a
sequence of instructions to a machine and the machine responds with a command
prompt with administrator privileges.
Medium - A
medium-risk vulnerability is defined as one that will allow an intruder
immediate access to a system with less than privileged access. Such
vulnerability will allow the intruder the opportunity to continue the attempt
to gain privileged access. An example of medium-risk vulnerability is a server
configuration error that allows an intruder to capture the password
file.
Low - A
low-risk vulnerability is defined as one that will provide information to an
intruder that could lead to further compromise attempts or a Denial of Service
(DoS) attack. It should be noted that while the DoS attack is deemed low from
a threat potential, the frequency of this type of attack is very high. DoS
attacks against mission-critical nodes are not included in this rating and any
attack of this nature should instead be considered to be a "High"
threat.
Adobe Acrobat 6.01 and 6.02; Adobe Reader 6.01 and 6.02
A vulnerability exists which can be exploited by malicious people to
disclose sensitive information. This is because embedded Macromedia flash
files are executed in a local context.
No workaround or patch available at time of publishing.
We are not aware of any exploits for this vulnerability.
Adobe Acrobat / Adobe Reader Disclosure of Sensitive
Information
Medium
Secunia Advisory, SA12809, October 13, 2004
Best Software
SalesLogix 6
Multiple vulnerabilities were reported in which a remote malicious user
can gain administrative access on the application. A remote user can
inject SQL commands, determine the installation path, determine passwords,
and upload arbitrary files.
SecurityTracker Alert ID: 1011769, October 18, 2004
Cisco Systems
Access Control Server Solution Engine, Secure Access Control Server 3.2
(3), 3.2 (2), 3.2, Secure ACS for Windows Server 3.2
Multiple vulnerabilities exist: a remote Denial of Service
vulnerability exists in the web-based management interface (CSAdmin); a
remote Denial of Service vulnerability exists when processing LEAP (Light
Extensible Authentication Procotol) authentication requests when the
device is configured as a LEAP RADIUS proxy; a vulnerability exists when
handling NDS (Novell Directory Services) users, which could let a remote
malicious user bypass authentication; and a vulnerability exists in the
ACS administration web services, which could let a remote malicious user
bypass authentication.
Cisco has released an updated advisory that contains workaround
details and updates to address these issues.
There is no exploit code required.
Secure Access Control Server Multiple Remote
Vulnerabilities
Low/Medium
(Medium if authentication can be bypassed)
Cisco Security Advisory, 61603, August 25, 2004
Cisco Security Advisory, 61603, Revision 1.2, October 4, 2004
CyberStrong
eShop 4.6
An input verification vulnerability exists which can be exploited by
malicious people to conduct Cross-Site Scripting attacks.
No workaround or patch available at time of publishing.
We are not aware of any exploits for this vulnerability.
CyberStrong eShop ASP Shopping Card Unspecified
Cross-Site Scripting
High
Secunia Advisory ID, SA12842, October 15, 2004
Digicraft Software
Yak! 2.1.2
An input verification vulnerability exists in the built-in FTP server,
which may allow a remote malicious user to upload arbitrary code anywhere
on the system.
No workaround or patch available at time of publishing.
A Proof of Concept exploit has been published.
Digicraft Yak! Directory Traversal
Medium
SecuriTeam, October 18, 2004
DmxReady
Dmxready Site Chassis Manager
Input verification vulnerabilities exist which can be exploited by
malicious people to conduct Cross-Site Scripting and SQL injection
attacks.
No workaround or patch available at time of publishing.
We are not aware of any exploits for this vulnerability.
Dmxready Site Chassis Manager Cross-Site Scripting &
SQL Injection Vulnerabilities
High
Secunia Advisory ID, SA12841, October 15, 2004
Ideal Science
IdealBB Multiple 0.1.5.3
Several input validation vulnerabilities were reported that could
allow a remote malicious user to can inject SQL commands, conduct
Cross-Site Scripting attacks, and conduct HTTP response splitting attacks.
No workaround or patch available at time of publishing.
We are not aware of any exploits for this vulnerability.
We are not aware of any exploits for this vulnerability.
MailEnable Professional Denial of Service
Vulnerabilities
Low
Secunia Advisory ID, SA12815, October 14, 2004
Mavel d.o.o. Software Company
ShixxNote 6.net
A buffer overflow vulnerability exists that could permit a remote
malicious user to execute arbitrary code on the target system. It is
reported that a remote user can supply a specially crafted value for the
field that specifies the font.
No workaround or patch available at time of publishing.
A Proof of Concept exploit has been published.
Mavel ShixxNote 6.net Buffer Overflow in Font
Field
High
SecurityTracker Alert ID, 1011672, October 14, 2004
Microsoft
Cabarc
An input validation vulnerability was reported in Microsoft Cabarc
which could allow a remote malicious user to create or overwrite arbitrary
files on the target user's system.
No workaround or patch available at time of publishing.
A Proof of Concept exploit has been published.
Microsoft Cabarc Directory Traversal Flaw Allows Remote
File Creation
Medium
SecurityFocus Bugtraq ID, 11376, October 12, 2004
Microsoft
Internet Explorer
A security vulnerability was reported that may allow a malicious user
to spoof a user's homepage website.
No workaround or patch available at time of publishing.
A Proof of Concept exploit has been published.
Microsoft Internet Explorer Incorrect URL Display
Medium
SecurityTracker Alert ID, 1011735, October 16, 2004
Microsoft
asycpict.dll in Windows (Me), Windows (NT), Windows (95), Windows (98),
Windows (2000), Windows (2003), Windows (XP)
A vulnerability was reported in 'asycpict.dll' in the processing of
JPEG images in which a remote malicious user can cause a target user's
system to crash.
No workaround or patch available at time of publishing.
A Proof of Concept exploit has been published.
Microsoft Operating System 'asycpict.dll' Denial of
Service
Low
SecurityTracker Alert ID, 1011706, October 15, 2004
Microsoft
Microsoft Office Visio 2002 Viewer Microsoft Office PowerPoint 2003
Viewer Microsoft Office Visio 2003 Viewer
A vulnerability has been discovered in three Microsoft
Office Viewers, which can be exploited by malicious people to
compromise a user's system.
We are not aware of any exploits for this vulnerability.
Microsoft PowerPoint / Visio Viewer JPEG Processing Buffer
Overflow
High
Secunia Advisory SA12671, October 12,2004
Microsoft
Windows 2003
A potential vulnerably was reported in Windows 2003. The default
access control lists for the Distributed Link Tracking and Internet
Connection Firewall services allow authenticated malicious users to stop
the services.
No workaround or patch available at time of publishing.
We are not aware of any exploits for this vulnerability.
Microsoft Windows 2003 Default ACL Permissions Firewall
Services
Low
SecurityTracker Alert ID, 1011627, October 12, 2004
Microsoft
Windows 2003
It is reported that the default SACL access right settings for
multiple Microsoft Windows 2003 services allow unprivileged local
malicious users to start them.
No workaround or patch available at time of publishing.
We are not aware of any exploits for this vulnerability.
Microsoft Windows 2003 Services Default SACL
Configuration
Medium
SecurityFocus Bugtraq ID, 11387, October 15, 2004
Microsoft
Windows XP Home SP2 Windows XP Media Center Edition SP2 Windows
XP Professional SP2
A default configuration vulnerability exists that may allow malicious
users to create a listening port to provide remote access to a vulnerable
computer. This is due to a weakness in the Internet Connection Firewall
(ICF).
No workaround or patch available at time of publishing.
A Proof of Concept exploit has been published.
Microsoft Windows XP Weak Default Configuration
Medium
SecurityFocus Bugtraq ID, 11410, October 13, 2004
Microsoft
Windows NT Server 4.0, Windows NT Server 4.0 Enterprise Edition,
Windows NT Server 4.0 Terminal Server Edition; Avaya DefinityOne
Media Servers, IP600 Media Servers, Modular Messaging (MSS) 1.1, (MSS)
2.0, S3400 Message Application Server, S8100 Media Servers
An information disclosure and Denial of Service vulnerability exists
when the RPC Runtime Library processes specially crafted messages. A
malicious user who successfully exploited this vulnerability could
potentially read portions of active memory or cause the affected system to
stop responding.
Microsoft Security Bulletin MS04-029, October 12, 2004
US-CERT Cyber Security Alert SA04-286A, October 12, 2004
SecurityFocus, October 18, 2004
Microsoft
Windows NT Server 4.0, Windows NT Server 4.0 Enterprise
Edition, Windows NT Server 4.0 Terminal Server Edition, Windows 2000
Advanced Server, Windows 2000 Datacenter Server, Windows 2000 Server,
Windows 2000 Professional, Windows XP Home Edition, Windows XP
Professional, Windows Server 2003 Enterprise Edition, Windows Server 2003
Standard Edition, Windows Server 2003 Web Edition, Windows Server 2003
Datacenter Edition, Windows 98, Windows 98 SE, Windows ME
A Shell vulnerability and Program Group vulnerability exists in
Microsoft Windows. These vulnerabilities could allow remote code
execution.
Microsoft Security Bulletin MS04-037, October 12, 2004
US-CERT Cyber Security Alert SA04-286A, October 12, 2004
US-CERT Vulnerability Note VU#543864, October 15, 2004
Microsoft
Windows Server 2003 Datacenter Edition, Windows Server 2003 Enterprise
Edition, Windows Server 2003 Standard Edition, Windows Server 2003 Web
Edition, Exchange Server 2003
A remote code execution vulnerability exists in the Windows Server 2003
SMTP component because of the way that it handles Domain Name System (DNS)
lookups. A malicious user could exploit the vulnerability by causing the
server to process a particular DNS response that could potentially allow
remote code execution. The vulnerability also exists in the Microsoft
Exchange Server 2003 Routing Engine component when installed on Microsoft
Windows 2000 Service Pack 3 or on Microsoft Windows 2000 Service Pack
4.
Microsoft Security Bulletin MS04-035, October 12, 2004
US-CERT Cyber Security Alert SA04-286A, October 12, 2004
US-CERT Vulnerability Note VU#394792, October 15, 2004
Microsoft
Internet Explorer 5.01, Internet Explorer 6, Internet
Explorer 6.0 for Windows Server 2003, Internet Explorer 6.0 for Windows XP
Service Pack 2, Windows 98, Windows 98 SE, Windows ME, Internet Explorer
5.5; Avaya DefinityOne Media Servers, IP600 Media Servers, Modular
Messaging (MSS) 1.1, (MSS) 2.0, S3400 Message Application
Server, S8100 Media Servers
Multiple vulnerabilities are corrected with Microsoft Security Update
MS04-038. These vulnerabilities include: Cascading Style Sheets (CSS) Heap
Memory Corruption Vulnerability; Similar Method Name Redirection Cross
Domain Vulnerability; Install Engine Vulnerability; Drag and Drop
Vulnerability; Address Bar Spoofing on Double Byte Character Set Locale
Vulnerability; Plug-in Navigation Address Bar Spoofing Vulnerability;
Script in Image Tag File Download Vulnerability; SSL Caching
Vulnerability. These vulnerabilities could allow remote code execution.
A vulnerability exists in the Microsoft MSN 'heartbeat.ocx'
component, used by Internet Explorer on some MSN gaming sites
Microsoft Security Bulletin MS04-038, October 12, 2004
US-CERT Cyber Security Alert SA04-286A, October 12, 2004
US-CERT Vulnerability Notes VU#637760, October 13, 2004,
VU#625616, October 15, 2004, VU#431576, VU#630720, & VU#291304,
October 18, 2004, VU#673134 & VU#795720, October 19, 2004
SecurityFocus, October 18, 2004
Microsoft
Office 2000, Excel 2000, Office XP, Excel 2002, Office 2001 for
Macintosh, Office v. X for Macintosh
A remote code execution vulnerability exists in Excel. If a user is
logged on with administrative privileges, a malicious user who
successfully exploited this vulnerability could take complete control of
the affected system.
Microsoft Security Bulletin MS04-033, October 12, 2004
US-CERT Cyber Security Alert SA04-286A, October 12, 2004
US-CERT Vulnerability Note VU#274496, October 13, 2004
Microsoft
Windows NT Server 4.0, Windows NT Server 4.0 Enterprise Edition,
Windows NT Server 4.0 Terminal Server Edition, Windows 2000 Advanced
Server, Windows 2000 Datacenter Server, Windows 2000 Professional, Windows
2000 Server, Windows XP Home Edition, Windows XP Professional, Windows
Server 2003 Datacenter Edition, Windows Server 2003 Enterprise Edition,
Windows Server 2003 Standard Edition, Windows Server 2003 Web Edition,
Windows 98, Windows 98 SE, Windows ME; Avaya DefinityOne Media
Servers, IP600 Media Servers, Modular Messaging (MSS) 1.1, (MSS) 2.0,
S3400 Message Application Server, S8100 Media Servers
A remote code execution vulnerability exists in the NetDDE services
because of an unchecked buffer. A malicious user who successfully
exploited this vulnerability could take complete control of an affected
system. However, the NetDDE services are not started by default and would
have to be manually started for an attacker to attempt to remotely exploit
this vulnerability. This vulnerability could also be used to attempt to
perform a local elevation of privileges or remote Denial of Service.
Microsoft Security Bulletin MS04-031, October 12, 2004
US-CERT Cyber Security Alert SA04-286A, October 12, 2004
US-CERT Vulnerability Note VU#640488, October 13, 2004
SecurityFocus, October 18, 2004
Microsoft
Windows NT Server 4.0, Windows NT Server 4.0 Enterprise Edition,
Windows 2000 Advanced Server, Windows 2000 Datacenter Server, Windows 2000
Server, Windows Server 2003 Datacenter Edition, Windows Server 2003
Enterprise Edition, Windows Server 2003 Standard Edition, Windows Server
2003 Web Edition, Exchange 2000 Server, Exchange Server 2003;
Avaya DefinityOne Media Servers, IP600 Media Servers, Modular
Messaging (MSS) 1.1, (MSS) 2.0, S3400 Message Application
Server, S8100 Media Servers
A remote code execution vulnerability exists within the Network News
Transfer Protocol (NNTP) component of the affected operating systems,
which could let a remote malicious user execute arbitrary code. This
vulnerability could potentially affect systems that do not use NNTP.
Microsoft Security Bulletin MS04-036, October 12, 2004
US-CERT Cyber Security Alert SA04-286A, October 12, 2004
SecurityFocus, October 18, 2004
Microsoft
Windows NT Server 4.0, Windows NT Server 4.0 Enterprise Edition,
Windows NT Server 4.0 Terminal Server Edition, Windows 2000 Advanced
Server, Windows 2000 Datacenter Server, Windows 2000 Professional, Windows
2000 Server, Windows XP Home Edition, Windows XP Professional, Windows
Server 2003, Datacenter Edition, Windows Server 2003, Enterprise Edition,
Windows Server 2003, Standard Edition, Windows Server 2003, Web Edition,
Windows 98, Windows 98 SE, Windows ME
Multiple vulnerabilities are corrected with Microsoft Security Update
MS04-032. These vulnerabilities include: Window Management Vulnerability,
Virtual DOS Machine Vulnerability, Graphics Rendering Engine
Vulnerability, Windows Kernel Vulnerability. These vulnerabilities could
permit elevation of privilege, remote code execution, and Denial of
Service.
A vulnerability exists in the Windows SetWindowLong and
SetWindowLongPtr API function calls. In some cases this can be exploited
to gain execution control.
Microsoft Security Bulletin MS04-032, October 12, 2004
US-CERT Cyber Security Alert SA04-286A, October 12, 2004
US-CERT Vulnerability Notes, VU#910998, VU#218526, VU#806278,
October 13, 2004, VU#119262, October 15, 2004
Microsoft
Windows XP Home Edition, XP Professional, Windows Server 2003
Datacenter Edition, Windows Server 2003 Enterprise Edition, Windows Server
2003 Standard Edition, Windows Server 2003 Web Edition
A remote code execution vulnerability exists in Compressed (zipped)
Folders because of an unchecked buffer in the way that it handles
specially crafted compressed files. A malicious user could exploit the
vulnerability by constructing a malicious compressed file that could
potentially allow remote code execution if a user visited a malicious web
site.
Microsoft Security Bulletin MS04-034, October 12, 2004
US-CERT Cyber Security Alert SA04-286A, October 12, 2004
US-CERT Vulnerability Note VU#649374, October 14, 2004
Multiple Vendors
McAfee, Computer Associates, Kaspersky, Sophos, Eset and RAV
Remote exploitation of an exceptional condition error in multiple
vendors' anti-virus software allows malicious users to bypass security
protections by evading virus detection. The problem specifically exists in
the parsing of .zip archive headers. This vulnerability affects multiple
anti-virus vendors including McAfee, Computer Associates, Kaspersky,
Sophos, Eset and RAV.
SecurityTracker Alert ID, 1011692, October 14, 2004
Pinnacle Systems
ShowCenter v1.51 build 121
A vulnerability exists which can be exploited by malicious people to
conduct Cross-Site Scripting attacks. Invalid input passed to the 'Skin'
parameter in 'SettingsBase.php' isn't validated before being returned to
the user in a error page.
No workaround or patch available at time of publishing.
An input validation vulnerability exists that could allow a remote
malicious user to conduct Cross-Site Scripting attacks. The
'/cp/render.UserLayoutRootNode.uP' script does not properly validate
user-supplied input in the 'utf' parameter.
No workaround or patch available at time of publishing.
Norton Internet Security 2004 Norton Internet Security 2004
Professional Symantec Norton AntiVirus 2004
A vulnerability exists which can be exploited by malicious, local users
to disable the auto-protection. The vulnerability is caused due to an
error in the auto-protection functionality when dealing with certain
Visual Basic scripts.
No workaround or patch available at time of publishing.
We are not aware of any exploits for this vulnerability.
A vulnerability exists when the 'SSLCipherSuite' directive is used in a
directory or location context to require a restricted set of cipher
suites, which could let a remote malicious user bypass security policies
and obtain sensitive information.
A buffer overflow vulnerability exists in Apache mod_proxy when a
‘ContentLength:’ header is submitted that contains a large negative value,
which could let a remote malicious user cause a Denial of Service and
possibly execute arbitrary code.
A stack-based buffer overflow has been reported in the Apache mod_ssl
module. This issue would most likely result in a Denial of Service if
triggered, but could theoretically allow for execution of arbitrary code.
The issue is not believed to be exploitable to execute arbitrary code on
x86 architectures, though this may not be the case with other
architectures.
Gentoo Linux Security Advisory, GLSA 200406-05, June 9, 2004
Mandrakelinux Security Update Advisories, MDKSA-2004:054 & 055,
June 1. 2004
OpenPKG Security Advisory, OpenPKG-SA-2004.026, May 27, 2004
RedHat Security Advisory, RHSA-2004:342-10, July 6, 2004
SGI Security Advisory, 20040605-01-U, June 21, 2004
Tinysofa Security Advisory, TSSA-2004-008, June 2, 2004
Trustix Security Advisory, TSLSA-2004-0031, June 2, 2004
Fedora Legacy Update Advisory, FLSA:1888, October 14, 2004
Carnegie Mellon University
Cyrus SASL 1.5.24, 1.5.27, 1.5.28, 2.1.9-2.1.18
Several vulnerabilities exist: a buffer overflow vulnerability exists
in 'digestmda5.c,' which could let a remote malicious user execute
arbitrary code; and an input validation vulnerability exists in the
'SASL_PATH' environment variable, which could let a malicious user execute
arbitrary code.
Several vulnerabilities exist: a vulnerability exists in the backup
feature, which could let a remote authenticated malicious user obtain
sensitive information; a vulnerability exists when FrontPage extensions
are turned on or off, which could let a remote authenticated malicious
user change ownership of critical files; and a vulnerability exists in the
'_private' directory when FrontPage extensions are turned on or off, which
could let a remote authenticated malicious user change permissions on any
file on the target system to 0755.
No workaround or patch available at time of
publishing.
SecurityTracker Alert ID, 1011762, October 18, 2004
Federico David Sacerdoti
Ansel 1.2, 1.3, 1.4, 2.0
A vulnerability exists due to insecure default permissions when picture
albums are created, which could let a remote malicious user obtain
unauthorized access.
Federico David Sacerdoti Ansel Insecure Default
Permissions
Medium
SecurityFocus, October 14, 2004
gnofract4d. sourceforge.net
Gnofract 4D prior to 2.2
A vulnerability exists due to an error in the handling of '.fct'
parameter files, which could let a remote malicious user execute arbitrary
Phyton code.
We are not aware of any exploits for this vulnerability.
Gnofract 4 Remote Arbitrary Code Execution
High
SecurityTracker Alert ID, 1011757, October 17, 2004
libtiff.org
LibTIFF 3.6.1
Several buffer overflow vulnerabilities exist: a vulnerability exists
because a specially crafted image file can be created, which could let a
remote malicious user cause a Denial of Service or execute arbitrary code;
a remote Denial of Service vulnerability exists in 'libtiff/tif_dirread.c'
due to a division by zero error; and a vulnerability exists in the
'tif_next.c,' 'tif_thunder.c,' and 'tif_luv.c' RLE decoding routines,
which could let a remote malicious user execute arbitrary code.
Gentoo Linux Security Advisory, GLSA 200410-11, October 13, 2004
Fedora Update Notification, FEDORA-2004-334, October 14, 2004
OpenPKG Security Advisory, OpenPKG-SA-2004.043, October 14, 2004
Debian Security Advisory, DSA 567-1, October 15, 2004
Trustix Secure Linux Security Advisory, TSLSA-2004-0054, October 15,
2004
Martin Schoenert
Unzoo 4.4
A vulnerability exists when a specially crafted archive is created due
to insufficient validation, which could let a remote malicious user create
or overwrite files.
No workaround or patch available at time of
publishing.
We are not aware of any exploits for this vulnerability.
unzoo Input Validation
Medium
SecurityTracker Alert ID, 1011673, October 14, 2004
mpg123.de
mpg123 0.x
A buffer overflow vulnerability exists in the 'do_layer2()' function,
which could let a remote malicious user execute arbitrary code.
Gentoo Linux Security Advisory, GLSA 200409-20, September 16, 2004
Mandrakelinux Security Update Advisory, MDKSA-2004:100, September 22,
2004
Debian Security Advisory, DSA 564-1, October 13, 2004
Mr. S.K.
LHA 1.14
Multiple vulnerabilities exist: a buffer overflow vulnerability exists
in the parsing of archives, which could let a remote malicious user
execute arbitrary code; a buffer overflow vulnerability exists in the
parsing of command-line arguments, which could let a remote malicious user
execute arbitrary code; and a vulnerability exists due to insufficient
validation of shell meta characters in directories, which could let a
remote malicious user execute arbitrary shell commands.
Fedora Update Notifications FEDORA-2004-294 & 295, September 8,
2004
Gentoo Linux Security Advisory, GLSA 200409-13, September 8, 2004
Fedora Legacy Update Advisory, FLSA:1833, October 14, 2004
Multiple Vendors
MySQL AB MySQL 3.20 .x, 3.20.32 a, 3.21.x, 3.22 .x, 3.22.26-3.22.30,
3.22.32, 3.23 .x, 3.23.2-3.23.5, 3.23.8-3.23.10, 3.23.22-3.23.34,
3.23.36-3.23.54, 3.23.56, 3.23.58, 3.23.59, 4.0.0-4.0.15, 4.0.18,
4.0.20; Trustix Secure Enterprise Linux 2.0, Secure Linux 1.5, 2.0,
2.1
A vulnerability exists in the 'GRANT' command due to a failure to
ensure sufficient privileges, which could let a malicious user obtain
unauthorized access.
Multiple vulnerabilities exist: two buffer overflow vulnerabilities
exist when creating a carefully crafted LHA archive, which could let a
remote malicious user execute arbitrary code; and several Directory
Traversal vulnerabilities exist, which could let a remote malicious user
corrupt/overwrite files in the context of the user who is running the
affected LHA utility.
Conectiva Linux Security Announcement, CLA-2004:840, May 7, 2004
Debian Security Advisory DSA 515-1 , June 5, 2004
F-Secure Security Bulletin, FSC-2004-1, May 26, 2004
Fedora Update Notification, FEDORA-2004-119, May 11, 2004
Gentoo Linux Security Advisory, GLSA 200405-02, May 9, 2004
Red Hat Security Advisory, RHSA-2004:179-01, April 30, 2004
SGI Security Advisories, 20040602-01-U & 20040603-01-U, June 21,
2004
Slackware Security Advisory, SSA:2004-125-01, May 5, 2004
Fedora Legacy Update Advisory, FLSA:1833, October 14, 2004
Multiple Vendors
Apple Mac OS X 10.2-10.2.8, 10.3 -10.3.5, OS X Server 10.2-10.2.8, 10.3
-10.3.5; Easy Software Products CUPS 1.0.4 -8, 1.0.4, 1.1.1, 1.1.4-5,
1.1.4 -3, 1.1.4 -2, 1.1.4, 1.1.6, 1.1.7, 1.1.10, 1.1.12-1.1.21
A vulnerability exists in 'error_log' when certain methods of remote
printing are carried out by an authenticated malicious user, which could
disclose user passwords.
Multiple vulnerabilities exist: a stack overflow exists in
'xpmParseColors()' in 'parse.c' when a specially crafted XPMv1 and XPMv2/3
file is submitted, which could let a remote malicious user execute
arbitrary code; a stack overflow vulnerability exists in the
'ParseAndPutPixels()' function in -create.c' when reading pixel values,
which could let a remote malicious user execute arbitrary code; and an
integer overflow vulnerability exists in the colorTable allocation in
'xpmParseColors()' in 'parse.c,' which could let a remote malicious user
execute arbitrary code.
A buffer overflow vulnerability exists in the 'mysql_real_connect'
function due to insufficient boundary checking, which could let a remote
malicious user cause a Denial of Service and possibly execute arbitrary
code. Note: Computers using glibc on Linux and BSD platforms may not
be vulnerable to this issue.
Trustix Secure Linux Security Advisory, TSLSA-2004-0054, October 15,
2004
MySQL AB
MySQL 3.x, 4.x
Two vulnerabilities exist: a vulnerability exists due to an error in
'ALTER TABLE ... RENAME' operations because the 'CREATE/INSERT' rights of
old tables are checked, which potentially could let a remote malicious
user bypass security restrictions; and a remote Denial of Service
vulnerability exists when multiple threads issue 'alter' commands against
'merge' tables to modify the 'union.'
A vulnerability exists in the MIME-based transformation system with
'external' transformations, which could let a remote malicious user
execute arbitrary code. Note: Successful exploitation requires that
PHP's safe mode is disabled.
PNG Development
Group Conectiva Debian Fedora Gentoo
Mandrakesoft RedHat SuSE Sun
Solaris HP-UX GraphicsMagick ImageMagick Slackware
libpng 1.2.5 and 1.0.15
Multiple vulnerabilities exist in the libpng library
which could allow a remote malicious user to crash or execute arbitrary
code on an affected system. These vulnerabilities include:
libpng fails to properly check length of transparency chunk (tRNS)
data,
A vulnerability exists due to a time delay difference in the
login process for existing and non-existing usernames, which could let
a remote malicious user obtain sensitive information.
No workaround or patch available at time of
publishing.
An exploit script has been published.
ProFTPd Login Timing Account Disclosure
Medium
LSS Security Team Advisory, October 14, 2004
Samba.org
Samba version 3.0 - 3.0.6
Several vulnerabilities exist: a remote Denial of Service
vulnerability exists in the 'process_logon_packet()' function due to
insufficient validation of 'SAM_UAS_CHANGE' request packets; and a remote
Denial of Service vulnerability exists when a malicious user submits a
malformed packet to a target 'smbd' server.
Multiple vulnerabilities exist that could allow a remote malicious user
to execute arbitrary code This is due to boundary errors within the
"st_wavstartread()" function when processing ".WAV" file headers and can
be exploited to cause stack-based buffer overflows. Successful
exploitation requires that a user is tricked into playing a malicious
".WAV" file with a large value in a length field.
SecurityTracker Alerts 1010800 and 1010801, July 28/29, 2004
Mandrakesoft Security Advisory MDKSA-2004:076, July 28, 2004
PacketStorm, August 5, 2004
Slackware Security Advisory, SSA:2004-223-03, august 10,
2004
SGI Security Advisory, 20040802-01-U, August 14, 2004
Debian Security Advisory, DSA 565-1, October 13,
2004
Squid-cache.org
Squid 2.5-STABLE6, 3.0-PRE3-20040702; when compiled with SNMP support
A remote Denial of Service vulnerability exists in the
'asn_parse_header()' function in 'snmplib/asn1.c' due to an input
validation error when handling certain negative length fields.
We are not aware of any exploits for this vulnerability.
Sun Solaris Gzip File Access
Medium
Sun(sm) Alert Notification, 57600, October 1, 2004
US-CERT Vulnerability Note VU#635998, October 18, 2004
Todd Miller
Sudo 1.6.8
A vulnerability exists due to insufficient validation of
symbolic links when sudoedit ("sudo -u" option) copies temporary files,
which could let a malicious user access the contents of arbitrary files
with superuser privileges.
There is no exploit code required; however, a Proof of Concept exploit
script has been published.
Sudo Information Disclosure
High
Secunia Advisory, SA12596, September 20, 2004
US-CERT Vulnerability Note VU#424358, October 19, 2004
WeHelpBUS
WeHelpBUS 0.1
A vulnerability exists in 'wehelpbus/sk.cgi.in,'
'wehelpbus/skdoc.cgi.in,' 'wehelpbus/wehelpbus.pl.in,'
'wehelpbus/info.cgi.in,' 'wehelpbus/man.cgi.in,' 'wehelpbus/rpm.cgi.in,'
and 'wehelpbus/code.cgi.in,' which could let a remote malicious user
execute arbitrary commands.
SecurityTracker Alert ID, 1011743, October 16, 2004
Yukihiro Matsumoto
Ruby 1.6, 1.8
A vulnerability exists in the CGI session management component due to
the way temporary files are processed, which could let a malicious user
obtain elevated privileges.
Several vulnerabilities exist: an unspecified security issue exists
which may cause duplicate login IPs to be displayed; an unspecified error
exists in the DHCP service; and a remote Denial of Service vulnerability
exists due to an unspecified boundary error.
A vulnerability exists when a remote malicious user connects to a
certain web page, which could lead to the disclosure of sensitive
information and administrative access.
No workaround or patch available at time of
publishing.
There is no exploit code required; however, Proof of Concept exploit
has been published.
3Com 3CRADSL72 ADSL Wireless Router Information
Disclosure & Authentication Bypass
Medium/ High
(High if administrative access can be obtained)
Bugtraq, October 15, 2004
Alivesites
Forum 2.0
Multiple input validation vulnerabilities exist: a Cross-Site Scripting
vulnerability exists due to insufficient sanitization of unspecified
input, which could let a remote malicious user execute arbitrary HTML and
script code; and a Cross-Site Scripting vulnerability exists due to
insufficient sanitization of unspecified input before used in a SQL query,
which could let a remote malicious user execute arbitrary SQL code.
No workaround or patch available at time of
publishing.
There is no exploit code required
AliveSites Forum Multiple Unspecified Remote Input
Validation
High
Secunia Advisory, SA12844, October 15, 2004
ASN.1
ASN.1 Compiler 0.9.4
Several vulnerabilities exist: a vulnerability exists in
'OCTET_STRING.c'. when processing ANY type tags; and a vulnerability
exists due to the way CHOICE types are handled when extensions have
indefinite length structures.
We are not aware of any exploits for these vulnerabilities.
ASN1 Multiple Vulnerabilities
Not
Specified
Secunia Advisory, SA12794, October 12, 2004
clientexec.com
ClientExec 2.2.1
A vulnerability exists because 'phpinfo.php' is installed in the main
ClientExec directory, which could let a remote malicious user obtain
sensitive information.
No workaround or patch available at time of
publishing.
A Proof of Concept exploit has been published.
ClientExec Default Installation Information Disclosure
Medium
Secunia Advisory, SA12862, October 18, 2004
cphp.sourceforge.net
CoolPHP Web Portal 1.0 -stable
Multiple vulnerabilities exist: a Cross-Site Scripting vulnerability
exists in 'index.php' due to insufficient sanitization of the 'query' and
'nick' parameters, which could let a remote malicious user execute
arbitrary HTML and script code; a vulnerability exists in 'index.php' due
to insufficient verification of the 'op' parameter, which could let a
remote malicious user include arbitrary files from local resources; and a
vulnerability exists in 'index.php' when an invalid 'op' value is
submitted, which could let a remote malicious user obtain sensitive
information.
No workaround or patch available at time of
publishing.
There is no exploit code required; however, Proofs of Concept exploits
have been published.
CoolPHP Multiple Remote Input Validation
Medium/ High
(High if arbitrary code can be executed)
CHT Security Research Center-2004, October 16, 2004
DevoyBB
DevoyBB Web Forum 1.0
Multiple input validation vulnerabilities exist: a Cross-Site Scripting
vulnerability exists due to insufficient sanitization of unspecified
input, which could let a remote malicious user execute arbitrary HTML and
script code; and a Cross-Site Scripting vulnerability exists due to
insufficient sanitization of unspecified input before used in a SQL query,
which could let a remote malicious user execute arbitrary SQL code.
No workaround or patch available at time of
publishing.
There is no exploit code required
DevoyBB Forum Multiple Unspecified Remote Input Validation
High
SecurityFocus, October 15, 2004
Express-Web
Content Management System
A Cross-Site Scripting vulnerability exists due to insufficient
sanitization of unspecified input, which could let a remote malicious user
execute arbitrary HTML and script code.
No workaround or patch available at time of
publishing.
There is no exploit code required
Express-Web Content Management System Cross-Site
Scripting
High
Secunia Advisory, SA12839, October 15, 2004
FuseTalk Inc.
FuseTalk 4.0
A Cross-Site Scripting vulnerability exists due to insufficient
validation of user-supplied input in the IMG tag, which could let a remote
malicious user execute arbitrary HTML and script code.
No workaround or patch available at time of
publishing.
Proof of Concept exploits have been published.
FuseTalk Cross-Site Scripting
High
SecurityTracker Alert ID, 1011664, October 13, 2004
GoSmart Inc.
GoSmart Message Board
Multiple vulnerabilities exist: a vulnerability exists due to
insufficient sanitization of the 'QuestionNumber' and 'Category'
parameters in 'Forum.asp,' and the 'Username' and 'Password' parameters in
'Login_Exec.asp,' which could let a remote malicious user execute
arbitrary SQL code; and a vulnerability exists due to insufficient
sanitization of the 'Category' parameter in 'Forum.asp' and the
'MainMessageID' parameter in 'ReplyToQuestion.asp,' which could let a
remote malicious user execute arbitrary HTML and script code.
No workaround or patch available at time of
publishing.
There is no exploit code required; however, Proofs of Concept exploits
have been published.
GoSmart Message Board Multiple Input Validation
High
MAxpatrol Security Advisory, October 11, 2004
IBM
DB2 Universal Database for AIX 8.0, 8.1, DB2 Universal Database for
HP-UX 8.0, 8.1, DB2 Universal Database for Linux 8.0, 8.1, DB2 Universal
Database for Solaris 8.0, 8.1, DB2 Universal Database for Windows 8.0,
8.1
Multiple vulnerabilities exist: a buffer overflow
vulnerability exists in the 'DB2LPORT' environment variable due to
insufficient bounds checking, which could let a malicious user execute
arbitrary code; a buffer overflow vulnerability exists due to insufficient
validation uf user-supplied string length before copying them into finity
process buffers, which could let a remote malicious user execute arbitrary
code; a buffer overflow vulnerability exists in the 'DB2FMP' command due
to insufficient bounds checking, which could let a malicious user execute
arbitrary code; multiple buffer overflow vulnerabilities exist in the DB2
Application Programming Interface (API), which could let a remote
malicious user execute arbitrary code; a buffer overflow vulnerability
exists due to insufficient bounds checking of library names, which could
let a remote malicious user execute arbitrary code; a vulnerability exists
in the 'sqlvGenDtsFormat()' function when DTS to string conversion is
carried out; a buffer overflow vulnerability exists in 'JDBC' requests due
to insufficient bounds checks, which could let a remote malicious user
execute arbitrary code; a vulnerability exists (only on Windows operating
systems) because local malicious users can inappropriately connect to IPC
resources, which could lead to the disclosure of sensitive information; a
Denial of Service vulnerability exists when DB2 is installed on Microsoft
Windows operating systems due to a failure to properly ensure that only
authorized users can signal the DB2 UDB instance to shutdown; a buffer
overflow vulnerability exists due to insufficient bounds checking of data
that is handled through XML Extender UDF's, which could let a remote
malicious user execute arbitrary code; and a remote Denial of Service
vulnerability exists in the universal Database Security Service due to a
failure to handle malformed network messages (Windows operating systems
only).
We are not aware of any exploits for these vulnerabilities.
IBM DB2 Multiple Buffer Overflows
High
NGSSoftware Insight Security Research Advisory, October 5, 2004
SecurityFocus, October 13, 2004
Macromedia
JRun 3.0, 3.1, 4.0,
Multiple vulnerabilities exist: a vulnerability exists due to an
implementation error in the generation and handling of JSESSIONIDs, which
could let a remote malicious user hijack an authenticated user's session;
a Cross-Site Scripting vulnerability exists in the JRUN Management
Console, which could let a remote malicious user execute arbitrary HTML
and script code; a vulnerability exists due to an URL parsing error, which
could let a remote malicious user obtain sensitive information; and a
remote Denial of Service vulnerability exists in the verbose logging
module.
We are not aware of any exploits for these vulnerabilities.
Macromedia JRun Multiple Remote Vulnerabilities
Low/ Medium/ High
(Low if a DoS; Medium if sensitive information can be obtained; and
High if arbitrary code can be executed)
Macromedia Security Bulletin, MPSB04-08, September 23, 2004
US-CERT Vulnerability Notes VU#977440, VU#584958, &
VU#668206, October 12, 2004, VU#990200, October 14, 2004
Motorola
WR850G 4.0 3 firmware
A vulnerability exists due to an error in the session handling, which
could let a remote malicious user execute arbitrary commands with
administrative privileges; and a vulnerability exists which could let a
remote malicious user access the 'frame_debug.asp' page to obtain shell
access on the system.
SecurityTracker Alert ID, 1011413, September 26, 2004
SecurityFocus, October 13, 2004
Multiple Vendors
A vulnerability exists due to the way some networking devices store
cookies on a user's system when the 'Secure' attribute is not set, which
could let a remote malicious user obtain sensitive information.
US-CERT Vulnerability Note VU#546483, October 18, 2004
ocportal.com
Ocportal Web Content Management System 1.0-1.0.3
A vulnerability exists in 'index.php' due to insufficient verification
of the 'reg_path' parameter, which could let a remote malicious user
execute arbitrary code.
Multiple input validation vulnerabilities exist: a vulnerability
exists in 'index.php' due to insufficient sanitization of the 'pid'
parameter, which could let a remote malicious user execute arbitrary HTML
and script code; a vulnerability exists in the calendar module due to
insufficient sanitization of the 'cal_template' field, which could let a
remote malicious user execute arbitrary code; and a vulnerability exists
due to insufficient sanitization of input passed to the subject and
message fields, which could let a remote malicious user execute arbitrary
code.
GulfTech Security Research Security Advisory, August 31, 2004
US-CERT Vulnerability Note VU#925166 & VU#664422, October
19, 2004
Research In Motion Limited
BlackBerry Wireless Handheld 3.7.1.41; Model 7230
A remote Denial of Service vulnerability exists in the 'Location' field
due to a failure to handle meeting request messages with a string larger
than 128KB.
The vulnerability has been fixed in BlackBerry handheld software
version 3.8.
We are not aware of any exploits for this vulnerability.
Blackberry Operating System Remote Denial of Service
Low
Secunia Advisory, SA12814, October 15, 2004
The BNC Project
BNC 2.2.4, 2.4.6, 2.4.8, 2.6, 2.6.2, 2.8.8
A buffer overflow vulnerability exists due to a flaw when processing
the backspace character, which could let a remote malicious user execute
arbitrary code.
We are not aware of any exploits for this vulnerability.
BNC Buffer Overflow
High
SecurityTracker Alert ID, 1011583, October 9, 2004
Gentoo Linux Security Advisory, GLSA 200410-13, October 15,
2004
Thomas Ehrhardt
Powies PSCRIPT Forum 1.26 & prior
Several input validation vulnerabilities exist due to insufficient
sanitization of user-supplied input to the 'logincheck.php,'
'changepass.php,' and 'edituser.php' scripts, which could let a remote
malicious user execute arbitrary SQL code.
No workaround or patch available at time of
publishing.
We are not aware of any exploits for this vulnerability.
Powie's PSCRIPT Forum Input Validation
High
Secunia Advisory, SA12868, October 19, 2004
Veritas
Veritas Cluster Server 4.0 & prior
A vulnerability exists due to an unspecified error, which could let a
malicious user execute arbitrary code with root privileges.
We are not aware of any exploits for this vulnerability.
VERITAS Cluster Server Remote Code Execution
High
Secunia Advisory, SA12833, October 15, 2004
wikipedia. sourceforge.net
MediaWiki prior to 1.3.6
Multiple vulnerabilities exist: a vulnerability exists due to
insufficient sanitization of input passed in UnicodeConverter extension
and 'raw' page view, which could let a remote malicious user execute
arbitrary HTML and script code; a vulnerability exists due to insufficient
sanitization of input passed to 'Specialblcoklist,' 'SpecialEmailuser,'
'SpecialMaintenance,' and 'ImagePage,' which could let a remote malicious
user execute arbitrary HTML and script code; and a vulnerability exists in
'SpecialMaintenance' due to insufficient verification, which could let a
remote malicious user manipulate SQL queries.
We are not aware of any exploits for these vulnerabilities.
MediaWiki Multiple Vulnerabilities
Medium/ High
(High if arbitrary code can be executed)
Secunia Advisory, SA12825, October 14, 2004
WordPress
WordPress 1.2
Multiple Cross-Site Scripting vulnerabilities exist due to insufficient
verification of user-supplied input passed to certain parameters in
various scripts, which could let a remote malicious user execute arbitrary
HTML and script code.
There is no exploit code required; however, Proofs of Concept exploits
have been published.
Wordpress Multiple Cross-Site Scripting
High
Bugtraq, September 27, 2004
Secunia Advisory, SA12773, October 11, 2004
Gentoo Linux Security Advisory, GLSA 200410-12, October 14,
2004
WowBB
WowBB Web Forum
Multiple input validation vulnerabilities exist: a Cross-Site Scripting
vulnerability exists due to insufficient sanitization of unspecified
input, which could let a remote malicious user execute arbitrary HTML and
script code; and a Cross-Site Scripting vulnerability exists due to
insufficient sanitization of unspecified input before used in a SQL query,
which could let a remote malicious user execute arbitrary SQL code.
No workaround or patch available at time of
publishing.
There is no exploit code required
WowBB Forum Multiple Unspecified Remote Input
Validation
High
SecurityFocus, October 15, 2004
yahoopops.sourceforge. net
YPOPs! 0.x
Several buffer overflow vulnerabilities exist in the POP3 and SMTP
services, which could let a remote malicious user execute arbitrary code.
No workaround or patch available at time of
publishing.
Proofs of Concept exploit scripts have been published.
YPOPs! Buffer Overflows
High
Hat-Squad Advisory, September 27, 2004
SecurityFocus, October 18, 2004
yapig.sourceforge.net
YaPiG prior to 0.92.2b
A Cross-Site Scripting vulnerability exists due to insufficient
sanitization of user-supplied input, which could let a remote malicious
user execute arbitrary HTML and script code.
The table below
contains a sample of exploit scripts and "how to" guides identified during this
period. The "Workaround or Patch Available" column indicates if vendors,
security vulnerability listservs, or Computer Emergency Response Teams (CERTs)
have published workarounds or patches.
Note: At times,
scripts/techniques may contain names or content that may be considered
offensive.
Date of
Script (Reverse Chronological
Order)
Script
name
Workaround or Patch Available
Script
Description
October 18, 2004
yahoopops.c 101_ypops.cpp dc_ypop.c
No
Exploits for the YPOPs! Buffer Overflows vulnerabilities.
October 15, 2004
proftpd.c
No
Script that exploits the ProFTPd Login Timing Differences Disclose
Valid User Account Names vulnerability.
October 13, 2004
sessmgr.c
No
Script that exploits the Microsoft Windows XP Weak Default
Configuration vulnerability.
October 13, 2004
shixxbof.zip
No
Exploit for the ShixxNOTE 6.net Remote Buffer Overflow
vulnerability.
Multiple vendors' networking devices fail to set the
"Secure" cookie attribute and could disclose sensitive information about a
user's HTTP session. Many networking devices provide a built-in web server,
which may support the HTTPS protocol. When a user logs into the device with a
username/password via HTTP, a cookie may be stored for that session by the web
application. When storing this cookie, the "Secure" attribute should be set so
that the user-agent only sends this cookie over secure connections (i.e.
HTTPS). For more information, see US-CERT Vulnerability Note VU#546483 located
at: http://www.kb.cert.org/vuls/id/546483.
CipherTrust, an e-mail security company, in a survey this
month of more than 4 million pieces of e-mail found that most phishing
attempts come from about 1000 compromised "zombie" computers owned by
broadband customers, and the phishing attacks are likely generated by less
than five phishing operations. For more information, see "Has Your PC Gone
Phishing?" located at: http://www.pcworld.com/news/article/0,aid,118171,00.asp.
A list of high threat
viruses, as reported to various anti-virus vendors and virus incident reporting
organizations, has been ranked and categorized in the table below. For the
purposes of collecting and collating data, infections involving multiple systems
at a single location are considered a single infection. It is therefore possible
that a virus has infected hundreds of machines but has only been counted once.
With the number of viruses that appear each month, it is possible that a new
virus will become widely distributed before the next edition of this
publication. To limit the possibility of infection, readers are reminded to
update their anti-virus packages as soon as updates become available. The table
lists the viruses by ranking (number of sites affected), common virus name, type
of virus code (i.e., boot, file, macro, multi-partite, script), trends (based on
number of infections reported since last week), and approximate date first
found.
Rank
Common
Name
Type
of Code
Trends
Date
1
Netsky-P
Win32 Worm
Stable
March 2004
2
Zafi-B
Win32 Worm
Stable
June 2004
3
Netsky-Z
Win32 Worm
Stable
April 2004
4
Netsky-D
Win32 Worm
Stable
March 2004
5
Bagle-AA
Win32 Worm
Stable
April 2004
6
Netsky-B
Win32 Worm
Stable
February 2004
7
Netsky-Q
Win32 Worm
Stable
March 2004
8
MyDoom-O
Win32 Worm
Stable
July 2004
9
Bagle-Z
Win32 Worm
Stable
April 2004
10
MyDoom.M
Win32 Worm
Stable
July 2004
Table
Updated October 19, 2004
Viruses or
Trojans Considered to be a High Level of Threat
Netsky.AG - A new variant of the Netsky virus has been discovered and rated as a medium risk by some anti-virus vendors. Like other Netsky viruses, W32/Netskyag@MM uses an e-mail to gain entry and install itself into several files via the Windows directory. Once installed, it harvests e-mail addresses from the infected machine and sends out copies of itself in messages. The virus differs from earlier versions in that it uses different compression technologies when sending itself out. This makes it more difficult to detect. (CNET News.com, October 14, 2004)
The following table provides, in
alphabetical order, a list of new viruses, variations of previously encountered
viruses, and Trojans that have been discovered during the period covered by this
bulletin. This information has been compiled from the following anti-virus
vendors: Sophos, Trend Micro, Symantec, McAfee, Network Associates, Central
Command, F-Secure, Kaspersky Labs, MessageLabs, Panda Software, Computer
Associates, and The WildList Organization International. Users should keep
anti-virus software up to date and should contact their anti-virus vendors to
obtain specific information on the Trojans and Trojan variants that anti-virus
software detects.
NOTE: At times, viruses and
Trojans may contain names or content that may be considered offensive.
