Информационная безопасность
[RU] switch to English


Многочисленные уязвимости в TrendMicro ServerProtect
дополнено с 21 февраля 2007 г.
Опубликовано:21 февраля 2007 г.
Источник:
SecurityVulns ID:7270
Тип:удаленная
Уровень опасности:
6/10
Описание:Несколько переполнений буфера стековой памяти в службах основанных на RPC (TCP/5168).
Затронутые продукты:TM : ServerProtect 5.58
 TM : ServerProtect 5.61
 TM : ServerProtect 5.62
CVE:CVE-2007-1070 (Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll that trigger overflows when calling the (1) CMON_NetTestConnection, (2) CMON_ActiveUpdate, and (3) CMON_ActiveRollback functions in (a) StCommon.dll, and (4) ENG_SetRealTimeScanConfigInfo and (5) ENG_SendEMail functions in (b) eng50.dll.)
Оригинальный текстdocument3COM, TSRT-07-02: Trend Micro ServerProtect eng50.dll Stack Overflow Vulnerabilities (21.02.2007)
 document3COM, TSRT-07-01: Trend Micro ServerProtect StCommon.dll Stack Overflow Vulnerabilities (21.02.2007)

Ошибка форматной строки в Qwikmail Qwik-smtpd (format string)
Опубликовано:21 февраля 2007 г.
Источник:
SecurityVulns ID:7272
Тип:удаленная
Уровень опасности:
6/10
Описание:Ошибка форматной строки (команда HELO, имя хоста) при ведении журнала в файл.
Затронутые продукты:QWIKMAIL : qwik-smtpd 0.3
Оригинальный текстdocumentH0tTurk, qwik-smtpd format string (21.02.2007)

Проблема символьных линков в gnucash (symbolic links)
Опубликовано:21 февраля 2007 г.
Источник:
SecurityVulns ID:7273
Тип:локальная
Уровень опасности:
5/10
Описание:Проблема символьных линков при создании временных файлов.
Затронутые продукты:GNU : gnucash 2.0
CVE:CVE-2007-0007 (gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.)
Оригинальный текстdocumentMANDRIVA, [ MDKSA-2007:046 ] - Updated gnucash packages fix temp file issues. (21.02.2007)

Несанкционированный доступ к IP-телефонам Cisco (unauthorized access)
Опубликовано:21 февраля 2007 г.
Источник:
SecurityVulns ID:7275
Тип:удаленная
Уровень опасности:
7/10
Описание:Возможен доступ к административному веб-интерфейсу без пароля. Имеется неотключаемая встроенная учетная запись, доступная по SSH.
Затронутые продукты:CISCO : Cisco Unified IP Conference Station 7935
 CISCO : Cisco Unified IP Conference Station 7936
 CISCO : Cisco Unified IP Phone 7906G
 CISCO : Cisco Unified IP Phone 7911G
 CISCO : Cisco Unified IP Phone 7941G
 CISCO : Cisco Unified IP Phone 7961G
 CISCO : Cisco Unified IP Phone 7970G
 CISCO : Cisco Unified IP Phone 7971G
CVE:CVE-2007-1072 (The command line interface (CLI) in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier allows local users to obtain privileges or cause a denial of service via unspecified vectors. NOTE: this issue can be leveraged remotely via CVE-2007-1063.)
 CVE-2007-1063 (The SSH server in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier, uses a hard-coded username and password, which allows remote attackers to access the device.)
 CVE-2007-1062 (The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time)
Оригинальный текстdocumentCISCO, Cisco Security Advisory: Cisco Unified IP Conference Station and IP Phone Vulnerabilities (21.02.2007)

DoS против игр Simbin
Опубликовано:21 февраля 2007 г.
Источник:
SecurityVulns ID:7277
Тип:удаленная
Уровень опасности:
5/10
Описание:Пустой UDP-пакет в порт UDP/48942 или UDP/34297 приводит к отключению всех игроков от игрового сервера.
Затронутые продукты:SIMBIN : GTR - FIA GT Racing Game 1.5
 SIMBIN : GT Legends 1.1
 SIMBIN : GTR 2 1.1
 SIMBIN : RACE - The WTCC Game 1.0
CVE:CVE-2007-1170 (SimBin GTR - FIA GT Racing Game 1.5.0.0 and earlier, GT Legends 1.1.0.0 and earlier, GTR 2 1.1 and earlier, and RACE - The WTCC Game 1.0 and earlier allow remote attackers to cause a denial of service (client disconnection) via an empty UDP packet to the server port.)
Оригинальный текстdocumentLuigi Auriemma, Players disconnection in Simbin racing games (21.02.2007)
Файлы:UDP packet generator

Переполнение буфера в ActiveX TrenMicro Office Scan (buffer overflow)
Опубликовано:21 февраля 2007 г.
Источник:
SecurityVulns ID:7278
Тип:клиент
Уровень опасности:
6/10
Описание:Переполнение буфера в ActiveX SetupINICtrl.
Затронутые продукты:TM : OfficeScan 7.3
 TM : OfficeScan 7.0
 TM : Trend Micro Client Security 3.0
 TM : Trend Micro Server Security 3.0
 TM : Trend Micro Messaging Security 3.0
CVE:CVE-2007-0325 (Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll, as used in OfficeScan 7.0 before Build 1344, OfficeScan 7.3 before Build 1241, and Client / Server / Messaging Security 3.0 before Build 1197, allow remote attackers to execute arbitrary code via a crafted HTML document.)

Ежедневная сводка ошибок в Web-приложениях (PHP, ASP, JSP, CGI, Perl )
дополнено с 21 февраля 2007 г.
Опубликовано:21 февраля 2007 г.
Источник:
SecurityVulns ID:7271
Тип:удаленная
Уровень опасности:
5/10
Описание:Инъекции PHP, инъекции SQL, обратный путь в каталогах, межсайтовый скриптинг, утечка информации и т.д.
Затронутые продукты:NABOCORP : Nabopoll 1.2
 PHPXMMS : phpXmms 1.0
 PHPNUKE : PHP-Nuke 8.0
 CALLCENTERSOFTWA : Call Center Software 0.93
 DRUPAL : getID3 1.7
 DRUPAL : Secure site 4.7 Drupal module
 PHPMYFAQ : phpmyfaq 1.6
 DRUPAL : Image Pager 4.7 Drupal module
CVE:CVE-2007-1166 (SQL injection vulnerability in result.php in Nabopoll 1.2 allows remote attackers to execute arbitrary SQL commands via the surv parameter.)
 CVE-2007-1161 (Cross-site scripting (XSS) vulnerability in call_entry.php in Call Center Software 0,93 allows remote attackers to inject arbitrary web script or HTML via the problem_desc parameter, as demonstrated by the ONLOAD attribute of a BODY element.)
 CVE-2007-1061 (SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header (HTTP_REFERER variable).)
 CVE-2007-1053 (** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in phpXmms 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the tcmdp parameter to (1) phpxmmsb.php or (2) phpxmmst.php. NOTE: this issue has been disputed by a reliable third party, stating that the tcmdp variable is initialized by config.php.)
 CVE-2007-1035 (Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors.)
 CVE-2007-1033 (Unspecified vulnerability in the Secure site 4.7.x-1.x-dev and 5.x-1.x-dev module for Drupal allows remote attackers to bypass access restrictions via a crafted URL.)
 CVE-2007-1032 (Unspecified vulnerability in phpMyFAQ 1.6.9 and earlier, when register_globals is enabled, allows remote attackers to "gain the privilege for uploading files on the server.")
 CVE-2007-1028 (Cross-site scripting (XSS) vulnerability in the Barry Jaspan Image Pager 4.7.x-1.x-dev and 5.x-1.x-dev before 2007-02-08 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to HTML entities and the IMG element.)
Оригинальный текстdocumentCorryL, [Full-disclosure] Call Center Software - Remote Xss Post Exploit - (21.02.2007)
 documentkrasza_(at)_gmail.com, [Full-disclosure] Blind sql injection attack in INSERT syntax on PHP-nuke <=8.0 Final (21.02.2007)
 documents0cratex_(at)_hotmail.com, Nabopoll Blind SQL Injection vulnerabilies (21.02.2007)
 documentcrazy_king_(at)_eno7.org, AdMentor Script Remote SQL injection Exploit (21.02.2007)
 documentilkerKandemir_(at)_mynet.com, phpXmms 1.0 (tcmdp) Remote File Include Vulnerabilities (21.02.2007)
Файлы:Nabopoll SQL Injection -- Proof of Concept Exploit
 Call Center Software - Remote Xss Post Exploit
 0day exploit for PHP-nuke <=8.0 Final Blind sql injection attack in INSERT syntax version for mysql >= 4.0.24, using 'brute force'
 0day exploit for PHP-nuke <=8.0 Final Blind sql injection attack in INSERT syntax version for every base(PostgreSQL,mssql...) except MySQL base
 0day exploit for PHP-nuke <=8.0 Final Blind sql injection attack in INSERT syntax version, when 'HTTP Referers' block is on

Ошибка форматной строки в gnomemeeting / ekiga
Опубликовано:21 февраля 2007 г.
Источник:
SecurityVulns ID:7274
Тип:удаленная
Уровень опасности:
6/10
Описание:Ошибка форматной строки при журналировании определенных сообщений.
Затронутые продукты:GNOME : gnomemeeting 0.98
 GNOME : gnomemeeting 1.0
 EKIGA : Ekiga 2.0
CVE:CVE-2007-1007 (Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the name, which is not properly handled in a call to the gnomemeeting_log_insert function.)
 CVE-2007-1006 (Multiple format string vulnerabilities in the gm_main_window_flash_message function in Ekiga before 2.0.5 allow attackers to cause a denial of service and possibly execute arbitrary code via a crafted Q.931 SETUP packet.)
 CVE-2007-0999 (Format string vulnerability in Ekiga 2.0.3, and probably other versions, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2007-1006.)
Оригинальный текстdocumentMANDRIVA, [ MDKSA-2007:045 ] - Updated gnomemeeting packages fix string vulnerabilities (21.02.2007)

Многочисленные уязвимости в Cisco 802.1X Supplicant (multiple bugs)
Опубликовано:21 февраля 2007 г.
Источник:
SecurityVulns ID:7276
Тип:локальная
Уровень опасности:
5/10
Описание:Многочисленные повышение привилегий. Утечка парольной информации через файлы журналов.
Затронутые продукты:CISCO : Cisco Security Agent 5.0
 CISCO : Cisco Security Agent 5.1
 CISCO : Cisco Secure Services Client 4.0
 CISCO : Cisco Trust Agent 2.1
CVE:CVE-2007-1068 (The (1) TTLS CHAP, (2) TTLS MSCHAP, (3) TTLS MSCHAPv2, (4) TTLS PAP, (5) MD5, (6) GTC, (7) LEAP, (8) PEAP MSCHAPv2, (9) PEAP GTC, and (10) FAST authentication methods in Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client store transmitted authentication credentials in plaintext log files, which allows local users to obtain sensitive information by reading these files, aka CSCsg34423.)
 CVE-2007-1067 (Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client do not properly parse commands, which allows local users to gain privileges via unspecified vectors, aka CSCsh30624.)
 CVE-2007-1066 (Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client use an insecure default Discretionary Access Control Lists (DACL) for the connection client GUI, which allows local users to gain privileges by injecting "a thread under ConnectionClient.exe," aka CSCsg20558.)
 CVE-2007-1065 (Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client allows local users to gain SYSTEM privileges via unspecified vectors in the supplicant, aka CSCsf15836.)
 CVE-2007-1064 (Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client do not drop privileges when the help facility in the supplicant GUI is invoked, which allows local users to gain privileges, aka CSCsf14120.)
Оригинальный текстdocumentCISCO, Cisco Security Advisory: Multiple Vulnerabilities in 802.1X Supplicant (21.02.2007)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород