Информационная безопасность
[RU] switch to English


Многочисленные уязвимости безопасности в Microsoft Windows
Опубликовано:12 октября 2011 г.
Источник:
SecurityVulns ID:11962
Тип:удаленная
Уровень опасности:
7/10
Описание:Небезопасная загрузка DLL в Active Accessibility и Media Center, многочисленные уязвимости в Win32k, переполнение буфера в библиотеке обработки шрифтов, повышение привилегий в AFD.
Затронутые продукты:MICROSOFT : Windows XP
 MICROSOFT : Windows 2003 Server
 MICROSOFT : Windows Vista
 MICROSOFT : Windows 2008 Server
 MICROSOFT : Windows 7
CVE:CVE-2011-2011 (Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, aka "Win32k Use After Free Vulnerability.")
 CVE-2011-2009 (Untrusted search path vulnerability in Windows Media Center in Microsoft Windows Vista SP2 and Windows 7 Gold and SP1, and Windows Media Center TV Pack for Windows Vista, allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Media Center Insecure Library Loading Vulnerability.")
 CVE-2011-2005 (afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability.")
 CVE-2011-2003 (Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted .fon file, aka "Font Library File Buffer Overrun Vulnerability.")
 CVE-2011-2002 (win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle TrueType fonts, which allows local users to cause a denial of service (system hang) via a crafted font file, aka "Win32k TrueType Font Type Translation Vulnerability.")
 CVE-2011-1985 (win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a crafted application, aka "Win32k Null Pointer De-reference Vulnerability.")
 CVE-2011-1253 (Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.0.60831, does not properly restrict inheritance, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Class Inheritance Vulnerability.")
 CVE-2011-1247 (Untrusted search path vulnerability in the Microsoft Active Accessibility component in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Active Accessibility Insecure Library Loading Vulnerability.")
Файлы:Microsoft Security Bulletin MS11-075 - Important Vulnerability in Microsoft Active Accessibility Could Allow Remote Code Execution (2623699)
 Microsoft Security Bulletin MS11-076 - Important Vulnerability in Windows Media Center Could Allow Remote Code Execution (2604926)
 Microsoft Security Bulletin MS11-077 - Important Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2567053)
 Microsoft Security Bulletin MS11-080 - Important Vulnerability in Ancillary Function Driver Could Allow Elevation of Privilege (2592799)

Выполнение кода в Microsoft .Net / Silverlight
Опубликовано:12 октября 2011 г.
Источник:
SecurityVulns ID:11963
Тип:библиотека
Уровень опасности:
6/10
Описание:Возможен выход из огрниченной среды.
Затронутые продукты:MICROSOFT : Windows XP
 MICROSOFT : Windows 2003 Server
 MICROSOFT : Windows Vista
 MICROSOFT : Windows 2008 Server
 MICROSOFT : Windows 7
CVE:CVE-2011-1253 (Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.0.60831, does not properly restrict inheritance, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Class Inheritance Vulnerability.")
Файлы:Microsoft Security Bulletin MS11-078 - Critical Vulnerability in .NET Framework and Microsoft Silverlight Could Allow Remote Code Execution (2604930)

DoS против Microsoft Host Integration Server
Опубликовано:12 октября 2011 г.
Источник:
SecurityVulns ID:11966
Тип:удаленная
Уровень опасности:
5/10
Описание:Обращение по неинициализированному указателю, вечный цикл.
CVE:CVE-2011-2008 (Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Access of Unallocated Memory DoS Vulnerability.")
 CVE-2011-2007 (Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Endless Loop DoS in snabase.exe Vulnerability.")
Файлы:Microsoft Security Bulletin MS11-082 - Important Vulnerabilities in Host Integration Server Could Allow Denial of Service (2607670)

Многочисленные уязвимости безопасности в PHP
Опубликовано:12 октября 2011 г.
Источник:
SecurityVulns ID:11967
Тип:библиотека
Уровень опасности:
7/10
Описание:Повреждения памяти в различных функциях.
Затронутые продукты:PHP : PHP 5.3
CVE:CVE-2011-3268 (Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483.)
 CVE-2011-3267 (PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors.)
 CVE-2011-3189 (The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.)
 CVE-2011-3182 (PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function.)
Оригинальный текстdocumentGENTOO, [ GLSA 201110-06 ] PHP: Multiple vulnerabilities (12.10.2011)

Многочисленные уязвимости безопасности в Microsoft Forefront Unified Access Gateway
дополнено с 12 октября 2011 г.
Опубликовано:16 октября 2011 г.
Источник:
SecurityVulns ID:11964
Тип:удаленная
Уровень опасности:
6/10
Описание:Выполнение кода, межсайтовый скриптинг, DoS.
Затронутые продукты:MICROSOFT : Forefront Unified Access Gateway 2010
CVE:CVE-2011-1969 (Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 provides the MicrosoftClient.jar file containing a signed Java applet, which allows remote attackers to execute arbitrary code on client machines via unspecified vectors, aka "Poisoned Cup of Code Execution Vulnerability.")
 CVE-2011-1895 (CRLF injection vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via unspecified vectors, aka "ExcelTable Response Splitting XSS Vulnerability.")
Оригинальный текстdocumentSEC Consult Vulnerability Lab, SEC Consult SA-20111012-0 :: Client-side remote file upload & command execution in Microsoft Forefront UAG Remote Access Agent (CVE-2011-1969) (16.10.2011)
Файлы:Microsoft Security Bulletin MS11-079 - Important Vulnerabilities in Microsoft Forefront Unified Access Gateway Could Cause Remote Code Execution

Многочисленные уязвимости безопасности в Microsoft Internet Explorer
дополнено с 12 октября 2011 г.
Опубликовано:24 октября 2011 г.
Источник:
SecurityVulns ID:11965
Тип:клиент
Уровень опасности:
8/10
Описание:Многочисленные повреждения памяти с возможностью выполнения кода.
Затронутые продукты:MICROSOFT : Windows XP
 MICROSOFT : Windows 2003 Server
 MICROSOFT : Windows Vista
 MICROSOFT : Windows 2008 Server
 MICROSOFT : Windows 7
CVE:CVE-2011-2001 (Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an attempted access to a virtual function table after corruption of this table has occurred, aka "Virtual Function Table Corruption Remote Code Execution Vulnerability.")
 CVE-2011-2000 (Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Body Element Remote Code Execution Vulnerability.")
 CVE-2011-1999 (Microsoft Internet Explorer 8 does not properly allocate and access memory, which allows remote attackers to execute arbitrary code via vectors involving a "dereferenced memory address," aka "Select Element Remote Code Execution Vulnerability.")
 CVE-2011-1998 (Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly initialized, aka "Jscript9.dll Remote Code Execution Vulnerability.")
 CVE-2011-1997 (Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnLoad Event Remote Code Execution Vulnerability.")
 CVE-2011-1996 (Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Option Element Remote Code Execution Vulnerability.")
 CVE-2011-1995 (Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly initialized, aka "OLEAuto32.dll Remote Code Execution Vulnerability.")
 CVE-2011-1993 (Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Scroll Event Remote Code Execution Vulnerability.")
Оригинальный текстdocumentVUPEN Security Research, VUPEN Security Research - Microsoft Internet Explorer "X-UA-COMPATIBLE" Use-after-free Vulnerability (23.10.2011)
 documentZDI, ZDI-11-287 : Internet Explorer Select Element Cache Remote Code Execution Vulnerability (20.10.2011)
 documentZDI, ZDI-11-288 : Microsoft Internet Explorer Select Element Insufficient,Type Checking Remote Code Execution Vulnerability (20.10.2011)
 documentZDI, ZDI-11-289 : Microsoft Internet Explorer swapNode Handling Remote Code,Execution Vulnerability (20.10.2011)
 documentZDI, ZDI-11-290 : Microsoft Internet Explorer SetExpandedClipRect Remote,Code Execution Vulnerability (20.10.2011)
 documentIDEFENSE, iDefense Security Advisory 10.11.11: Microsoft Internet Explorer Object Handling Memory Corruption Vulnerability (16.10.2011)
 documentifsecure_(at)_gmail.com, Two Remote Code Execution Vulnerabilities in Internet Explorer (16.10.2011)
Файлы:Microsoft Security Bulletin MS11-081 - Critical Cumulative Security Update for Internet Explorer (2586448)

Несанкционированный доступ ко внутренней сети через Apache mod_proxy
дополнено с 12 октября 2011 г.
Опубликовано:11 января 2012 г.
Источник:
SecurityVulns ID:11968
Тип:удаленная
Уровень опасности:
6/10
Описание:Некорректно обрабатываются URI со знаком @
Затронутые продукты:APACHE : Apache 1.3
 APACHE : Apache 2.0
 APACHE : Apache 2.2
CVE:CVE-2011-4317 (The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.)
 CVE-2011-3368 (The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.)
Оригинальный текстdocumentMANDRIVA, [ MDVSA-2011:144 ] apache (12.10.2011)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород