Информационная безопасность
[RU] switch to English


Многочисленные уязвимости в HP System Management Homepage
дополнено с 26 апреля 2010 г.
Опубликовано:20 мая 2010 г.
Источник:
SecurityVulns ID:10790
Тип:удаленная
Уровень опасности:
5/10
Описание:Межсайтовый скриптинг, DoS, выполнение кода, несанкционированный доступ.
Затронутые продукты:HP : HP System Management Homepage 6.0
CVE:CVE-2010-1034 (Unspecified vulnerability in HP System Management Homepage (SMH) 6.0 before 6.0.0-95 on Linux, and 6.0 before 6.0.0.96 on Windows, allows remote authenticated users to obtain sensitive information, modify data, and cause a denial of service via unknown vectors.)
 CVE-2009-3555 (The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.)
 CVE-2009-1387 (The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug.")
 CVE-2009-1386 (ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.)
 CVE-2009-1379 (Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.)
 CVE-2009-1378 (Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak.")
 CVE-2009-1377 (The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug.")
 CVE-2008-5814 (Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier, when display_errors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208.)
 CVE-2008-5557 (Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.)
 CVE-2008-4226 (Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.)
 CVE-2008-1468 (Cross-site scripting (XSS) vulnerability in namazu.cgi in Namazu before 2.0.18 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input, related to failure to set the charset, a different vector than CVE-2004-1318 and CVE-2001-1350. NOTE: some of these details are obtained from third party information.)
Оригинальный текстdocumentHP, [security bulletin] HPSBMA02534 SSRT090180 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Unauthorized Information Disclosure, Unauthorized Data Modification, Denial of Service (DoS) (20.05.2010)
 documentHP, [security bulletin] HPSBMA02492 SSRT100079 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Cross Site Scripting (XSS), Denial of Service (DoS), Execution of Arbitrary Code, Unauthorized Access (26.04.2010)

Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)
Опубликовано:20 мая 2010 г.
Источник:
SecurityVulns ID:10848
Тип:удаленная
Уровень опасности:
5/10
Описание:Инъекции PHP, инъекции SQL, обратный путь в каталогах, межсайтовый скриптинг, модификация файлов, утечка информации и т.д.
Затронутые продукты:NPDS : REvolution 10.02
 GAUCHO : Resin Professional 3.1
 JOOMLA : JComments 2.1
Оригинальный текстdocumentHigh-Tech Bridge Security Research, XSS vulnerability in JComments, Joomla (20.05.2010)
 documentHigh-Tech Bridge Security Research, XSS vulnerability in NPDS REvolution (20.05.2010)
 documentHigh-Tech Bridge Security Research, Stored XSS vulnerability in NPDS REvolution (20.05.2010)
 documentxuanmumu_(at)_gmail.com, Caucho Technology Resin digest.php Cross Site Scripting Vulnerability (20.05.2010)

DoS против libpurple / Pidgin
Опубликовано:20 мая 2010 г.
Источник:
SecurityVulns ID:10849
Тип:удаленная
Уровень опасности:
5/10
Описание:Отказ при разборе сообщений emoticon по протоколу MSN.
Затронутые продукты:PIDGIN : Pidgin 2.7
CVE:CVE-2010-1624 (The msn_emoticon_msg function in slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.7.0 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a custom emoticon in a malformed SLP message.)
Оригинальный текстdocumentMANDRIVA, [ MDVSA-2010:097 ] pidgin (20.05.2010)

Удаление таблиц в MySQL
Опубликовано:20 мая 2010 г.
Источник:
SecurityVulns ID:10850
Тип:локальная
Уровень опасности:
4/10
Описание:При определенных условиях, при удалении (DROP) одной таблицы MyISAM может быть удалены файлы относящиеся к другой таблице.
Затронутые продукты:ORACLE : MySQL 5.0
CVE:CVE-2010-1626 (MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.)
Оригинальный текстdocumentMANDRIVA, [ MDVSA-2010:101 ] mysql (20.05.2010)

Многочисленные уязвимости безопасности в HP Performance Manager
Опубликовано:20 мая 2010 г.
Источник:
SecurityVulns ID:10852
Тип:удаленная
Уровень опасности:
5/10
Описание:Несанкционированный доступ, межсайтовый скриптинг, DoS.
Затронутые продукты:HP : HP Performance Manager 8.20
CVE:CVE-2009-3548 (The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.)
 CVE-2009-2902 (Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.)
 CVE-2009-2901 (The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.)
 CVE-2009-2693 (Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.)
 CVE-2009-0783 (Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.)
 CVE-2009-0781 (Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML.")
 CVE-2009-0580 (Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.)
 CVE-2009-0033 (Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.)
 CVE-2008-5515 (Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.)
Оригинальный текстdocumentHP, [security bulletin] HPSBMA02535 SSRT100029 rev.1 - HP Performance Manager, Remote Unauthorized Access, Cross Site Scripting (XSS), Denial of Service (DoS) (20.05.2010)

DoS против браузеров
дополнено с 20 мая 2010 г.
Опубликовано:7 июня 2010 г.
Источник:
SecurityVulns ID:10851
Тип:удаленная
Уровень опасности:
5/10
Описание:При открытии фрейма с URL mailto:, news:, nntp: и др. открывается окно почтовой программы.
Затронутые продукты:MICROSOFT : Windows 2000 Server
 MICROSOFT : Windows 2000 Professional
 MICROSOFT : Windows XP
 MICROSOFT : Windows 2003 Server
 MICROSOFT : Windows Vista
 MICROSOFT : Windows 2008 Server
 MOZILLA : SeaMonkey 2.0
 OPERA : Opera 9.52
 MOZILLA : Firefox 3.5
 MICROSOFT : Windows 7
 MOZILLA : Firefox 3.6
Оригинальный текстdocumentMustLive, DoS attacks on email clients via protocol handlers (07.06.2010)
 documentMustLive, DoS vulnerabilities in Firefox, Internet Explorer, Chrome and Opera (03.06.2010)
 documentMustLive, DoS vulnerabilities in Firefox, Internet Explorer, Chrome and Opera (28.05.2010)
 documentMustLive, DoS уязвимости в Firefox, Internet Explorer, Chrome и Opera (28.05.2010)
 documentMustLive, DoS vulnerabilities in Firefox, Internet Explorer, Chrome, Opera and other browsers (20.05.2010)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород