Информационная безопасность
[RU] switch to English


Многочисленные уязвимости в Microsoft Internet Explorer
дополнено с 31 марта 2010 г.
Опубликовано:5 апреля 2010 г.
Источник:
SecurityVulns ID:10725
Тип:удаленная
Уровень опасности:
9/10
Описание:Многочисленные уязвимости используются для скрытой установки вредоносного кода.
Затронутые продукты:MICROSOFT : Windows 2000 Server
 MICROSOFT : Windows 2000 Professional
 MICROSOFT : Windows XP
 MICROSOFT : Windows 2003 Server
 MICROSOFT : Windows Vista
 MICROSOFT : Windows 2008 Server
CVE:CVE-2010-0807 (Microsoft Internet Explorer 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, leading to memory corruption, aka "HTML Rendering Memory Corruption Vulnerability.")
 CVE-2010-0806 (Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability.")
 CVE-2010-0805 (The Tabular Data Control (TDC) ActiveX control in Microsoft Internet Explorer 5.01 SP4, 6 on Windows XP SP2 and SP3, and 6 SP1 allows remote attackers to execute arbitrary code via a long URL (DataURL parameter) that triggers memory corruption in the CTDCCtl::SecurityCHeckDataURL function, aka "Memory Corruption Vulnerability.")
 CVE-2010-0494 (Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window, aka "HTML Element Cross-Domain Vulnerability.")
 CVE-2010-0492 (Use-after-free vulnerability in mstime.dll in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via vectors related to the TIME2 behavior, the CTimeAction object, and destruction of markup, leading to memory corruption, aka "HTML Object Memory Corruption Vulnerability.")
 CVE-2010-0491 (Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 allows remote attackers to execute arbitrary code by changing unspecified properties of an HTML object that has an onreadystatechange event handler, aka "HTML Object Memory Corruption Vulnerability.")
 CVE-2010-0490 (Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability.")
 CVE-2010-0489 (Race condition in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Race Condition Memory Corruption Vulnerability.")
 CVE-2010-0488 (Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka "Post Encoding Information Disclosure Vulnerability.")
 CVE-2010-0267 (Microsoft Internet Explorer 6, 6 SP1, and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability.")
Оригинальный текстdocumentZDI, ZDI-10-034: Microsoft Internet Explorer Tabular Data Control ActiveX Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-033: Microsoft Internet Explorer TIME2 Behavior Remote Code Execution Vulnerability (05.04.2010)
 documentIDEFENSE, iDefense Security Advisory 03.30.10: Microsoft Internet Explorer 'onreadystatechange' Use After Free Vulnerability (31.03.2010)
 documentMICROSOFT, Microsoft Security Bulletin MS10-018 - Critical Cumulative Security Update for Internet Explorer (980182) (31.03.2010)
Файлы:Microsoft Security Bulletin MS10-018 - Critical Cumulative Security Update for Internet Explorer (980182)

Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)
Опубликовано:5 апреля 2010 г.
Источник:
SecurityVulns ID:10739
Тип:удаленная
Уровень опасности:
5/10
Описание:Инъекции PHP, инъекции SQL, обратный путь в каталогах, межсайтовый скриптинг, модификация файлов, утечка информации и т.д.
Затронутые продукты:PHPMYADMIN : phpMyAdmin 2.6
 MOINMOIN : moinmoin 1.7
 OSSIM : OSSIM 2.2
 VELHOST : velhost uploader 1.2
 ALPHACMS : ALPHA CMS 3.2
 CBCAPTCHA : CB Captcha 1.0
 DYNPG : DynPG 4.1
 ZABBIX : Zabbix 1.8
 MERETHIS : Centreon IT & Network Monitoring 2.1
CVE:CVE-2010-0828 (Cross-site scripting (XSS) vulnerability in action/Despam.py in the Despam action module in MoinMoin 1.8.7 and 1.9.2 allows remote authenticated users to inject arbitrary web script or HTML by creating a page with a crafted URI.)
Оригинальный текстdocumentMehdi Mahdjoub - Sysdream IT Security Services, Vulnerability Centreon IT & Network Monitoring v2.1.5 (05.04.2010)
 documentInj3ct0r.com, MKPortal whois module XSS Vulnerability (05.04.2010)
 documentDEBIAN, [SECURITY] [DSA 2024-1] New moin packages fix cross-site scripting (05.04.2010)
 documentDawid Golunski, Zabbix <= 1.8.1 SQL Injection (05.04.2010)
 documentnicolas.grandjean_(at)_conix.fr, CSRF Vulnerability in OSSIM 2.2.1 (05.04.2010)
 documenteidelweiss randy, DynPG CMS Multiple Remote File Inclusion Vulnerability (05.04.2010)
 documentMustLive, Insufficient Anti-automation vulnerability in CB Captcha for Joomla and Mambo (05.04.2010)
 documenteidelweiss, ALPHA CMS v3.2 <= Local File Inclusion Vulnerability (05.04.2010)
 documentInj3ct0r.com, velhost uploader script v1.2 Local File Inclusion Vulnerability (05.04.2010)
 documentInj3ct0r.com, MKPortal <= gbook module XSS Vulnerability (05.04.2010)
 documentInj3ct0r.com, PHP-fusion dsmsf (module downloads) SQL Inj3ct0r Exploit (05.04.2010)
 documentInj3ct0r.com, phpMyAdmin <= 2.6.1 disclosure ways (05.04.2010)
 documentInj3ct0r.com, MassMirror Uploader Multiple RFI Exploit (05.04.2010)
 documenteidelweiss, jevoncms (LFI/RFI) Multiple Vulnerabilities (05.04.2010)

Несанционированный доступ через libnss-db
Опубликовано:5 апреля 2010 г.
Источник:
SecurityVulns ID:10741
Тип:библиотека
Уровень опасности:
5/10
Описание:Возможен доступ к локальным файлам с повышенными привилегиями.
Затронутые продукты:libnssdb : libnss-db 2.2
CVE:CVE-2010-0826 (The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module.)
Оригинальный текстdocumentUBUNTU, [USN-922-1] libnss-db vulnerability (05.04.2010)

Timing-атаки на Apache CouchDB
Опубликовано:5 апреля 2010 г.
Источник:
SecurityVulns ID:10742
Тип:удаленная
Уровень опасности:
5/10
Описание:Алгоритм проверки пароля позволяет угадать длину совпадающей части.
Затронутые продукты:APACHE : CouchDB 0.10
CVE:CVE-2010-0009 (Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.)
Оригинальный текстdocumentAPACHE, [SECURITY] CVE-2008-2370: Apache CouchDB Timing Attack Vulnerability (05.04.2010)

DoS против torrent-клиента BitComet
Опубликовано:5 апреля 2010 г.
Источник:
SecurityVulns ID:10743
Тип:удаленная
Уровень опасности:
5/10
Описание:Отказ при обработке сообщения DHT
Затронутые продукты:BITCOMET : BitComet 1.19
Оригинальный текстdocumentPierre Noguès, BitComet <= 1.19 Remote DOS Exploit (05.04.2010)
Файлы:BitComet <= 1.19 Remote DOS Exploit

Многочисленные уязвимости безопасности в Apple QuickTime / iTunes
дополнено с 5 апреля 2010 г.
Опубликовано:12 апреля 2010 г.
Источник:
SecurityVulns ID:10740
Тип:библиотека
Уровень опасности:
8/10
Описание:Многочисленные уязвимости при разборе PICT, FLC и многочисленных графических и видео форматов.
Затронутые продукты:QUICKTIME : QuickTime 7.6
 APPLE : iTunes 9.0
CVE:CVE-2010-0529 (Heap-based buffer overflow in QuickTime.qts in Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a BkPixPat opcode (0x12) containing crafted values that are used in a calculation for memory allocation.)
 CVE-2010-0528 (Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted color tables in a movie file, related to malformed MediaVideo data, a sample description atom (STSD), and a crafted length value.)
 CVE-2010-0527 (Integer overflow in Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image.)
 CVE-2010-0526 (Heap-based buffer overflow in QuickTimeMPEG.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted genl atom in a QuickTime movie file with MPEG encoding, which is not properly handled during decompression.)
 CVE-2010-0526 (Heap-based buffer overflow in QuickTimeMPEG.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted genl atom in a QuickTime movie file with MPEG encoding, which is not properly handled during decompression.)
 CVE-2010-0520 (Heap-based buffer overflow in QuickTimeAuthoring.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLC file, related to crafted DELTA_FLI chunks and untrusted length values in a .fli file, which are not properly handled during decompression.)
 CVE-2010-0520 (Heap-based buffer overflow in QuickTimeAuthoring.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLC file, related to crafted DELTA_FLI chunks and untrusted length values in a .fli file, which are not properly handled during decompression.)
 CVE-2010-0519 (Integer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a FlashPix image with a malformed SubImage Header Stream containing a NumberOfTiles field with a large value.)
 CVE-2010-0517 (Heap-based buffer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with M-JPEG encoding, which causes QuickTime to calculate a buffer size using height and width fields, but to use a different field to control the length of a copy operation.)
 CVE-2010-0516 (Heap-based buffer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with RLE encoding, which triggers memory corruption when the length of decompressed data exceeds that of the allocated heap chunk.)
 CVE-2010-0062 (Heap-based buffer overflow in quicktime.qts in CoreMedia and QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed .3g2 movie file with H.263 encoding that triggers an incorrect buffer length calculation.)
 CVE-2010-0060 (CoreAudio in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted audio content with QDMC encoding.)
 CVE-2010-0059 (CoreAudio in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted audio content with QDM2 encoding, which triggers a buffer overflow due to inconsistent length fields, related to QDCA.)
 CVE-2010-0040 (Integer overflow in ColorSync in Apple Safari before 4.0.5 on Windows, and iTunes before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with a crafted color profile that triggers a heap-based buffer overflow.)
 CVE-2009-2837 (Heap-based buffer overflow in QuickDraw Manager in Apple Mac OS X before 10.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image.)
Оригинальный текстdocumentZDI, ZDI-10-068: Apple QuickTime H.263 Array Index Parsing Remote Code Execution Vulnerability (12.04.2010)
 documentZDI, ZDI-10-067: Apple QuickTime Pict BkPixPat Remote Code Execution Vulnerability (07.04.2010)
 documentZDI, ZDI-10-045: Apple QuickTime MPEG-1 genl Atom Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-044: Apple QuickTime FLI LinePacket Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-043: Apple QuickTime FlashPix NumberOfTiles Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-042: Apple QuickTime MediaVideo Compressor Name Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-041: Apple QuickTime QDM2/QDCA Atom Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-040: Apple QuickTime RLE Bit Depth Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-038: Apple QuickTime QDMC/QDM2 Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-037: Apple QuickTime MJPEG Sample Dimensions Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-036: Apple QuickTime H.263 PictureHeader Remote Code Execution Vulnerability (05.04.2010)
 documentZDI, ZDI-10-035: Apple QuickTime genl Atom Remote Code Execution Vulnerability (05.04.2010)
 documentVUPEN Security Research, VUPEN Security Research - Apple iTunes ColorSync Profile Integer Overflow Vulnerability (05.04.2010)
 documentVUPEN Security Research, VUPEN Security Research - Apple Quicktime PICT Processing Integer Overflow Vulnerability (05.04.2010)
 documentVUPEN Security Research, VUPEN Security Research - Apple Quicktime FLC Encoded Movie Heap Overflow Vulnerability (05.04.2010)
 documentVUPEN Security Research, VUPEN Security Research - Apple Quicktime PICT Handling Heap Overflow Vulnerability (05.04.2010)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород