Summary of Security Items from November 3 through November 9, 2004

UNIX / Linux Operating Systems Only

Vendor & Software Name

Vulnerability – Impact

Patches – Workarounds

Attacks Scripts

Common Name

Risk

Source

Alvaro Lopez Ortega

Cherokee HTTPD 0.1, 0.1.5, 0.1.6, 0.2, 0.2.5-0.2.7, 0.4.6-0.4.8, 0.4.17

A format string vulnerability exists in the ‘cherokee_logger_ncsa_write_string()’ function due to insufficient sanitization, which could let a remote malicious user execute arbitrary code.

Update available at: ftp://alobbs.com/cherokee/0.4/0.4.17/

cherokee-0.4.17.1.tar.gz

Gentoo: http://security.gentoo.org/glsa/glsa-200411-02.xml

We are not aware of any exploits for this vulnerability.

Cherokee HTTPD Auth_Pam Authentication Remote Format String

High

Gentoo Linux Security Advisory, GLSA 200411-02, November 1, 2004

Apache

Software Foundation

A remote Denial of Service vulnerability exists when a malicious user submits multiple specially crafted HTTP GET requests that contain spaces.

No workaround or patch available at time of publishing.

A Proof of Concept exploit has been published.

Low

SecurityTracker Alert ID, 1012083, November 4, 2004

Apache Software Foundation

Apache 2.0.35-2.0.52

A vulnerability exists when the ‘SSLCipherSuite’ directive is used in a directory or location context to require a restricted set of cipher suites, which could let a remote malicious user bypass security policies and obtain sensitive information.

OpenPKG: href=”http://www.cisa.gov/ftp://ftp.openpkg.org/release/”>ftp://ftp.openpkg.org/release/

Gentoo: href=”http://security.gentoo.org/glsa/glsa-200410-21.xml”>http://security.gentoo.org/glsa/glsa-200410-21.xml

Slackware: href=”http://www.cisa.gov/ftp://ftp.slackware.com/pub/slackware/”>ftp://ftp.slackware.com/pub/slackware/

Conectiva: ftp://atualizacoes.conectiva.com.br/

Mandrake:

http://www.mandrakesoft.com/security/advisories

Medium

OpenPKG Security Advisory, OpenPKG-SA-2004.044, October 15, 2004

Gentoo Linux Security Advisory, GLSA 200410-21, October 22, 2004

Slackware Security Advisory, SSA:2004-299-01, October 26, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:122, November 2, 2004

Conectiva Linux Security Announcement, CLA-2004:885, November 4, 2004

Apache Software Foundation

Conectiva

Gentoo

HP

Immunix

Mandrake OpenBSD

OpenPKG

RedHat

SGI

Trustix

Apache 1.3.26‑1.3.29, 1.3.31;

OpenBSD –current, 3.4, 3.5

A buffer overflow vulnerability exists in Apache mod_proxy when a ‘ContentLength:’ header is submitted that contains a large negative value, which could let a remote malicious user cause a Denial of Service and possibly execute arbitrary code.

Patches available at: http://marc.theaimsgroup.com/

?l=apache-httpd-dev&m=108687304202140&q=p3

OpenBSD: ftp://ftp.openbsd.org/pub/OpenBSD/patches/

OpenPKG: ftp://ftp.openpkg.org/release/2.0/

UPD/apache-1.3.29-2.0.3.src.rpm

Gentoo: http://security.gentoo.org/glsa/glsa-200406-16.xml

Mandrake: http://www.mandrakesoft.com/security/advisories

SGI: ftp://patches.sgi.com/support/free/security/

Fedora Legacy: http://download.fedoralegacy.org/redhat/

Slackware: ftp://ftp.slackware.com/pub/slackware/

Trustix: http://http.trustix.org/pub/trustix/updates/

Currently we are not aware of any exploits for this vulnerability.

SecurityTracker Alert, 1010462, June 10, 2004

Gentoo Linux Security Advisory, GLSA 200406-16, June 22, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:065, June 29, 2004

OpenPKG Security Advisory, OpenPKG-SA-2004.029, June 11, 2004

SGI Security Advisory, 20040605-01-U, June 21, 2004

Fedora Legacy Update Advisory, FLSA:1737, October 14, 2004

US-Cert Vulnerability Note VU#541310, October 19, 2004

Slackware Security Advisory, SSA:2004-299-01, October 26, 2004

Trustix Secure Linux Security Advisory, TSLSA-2004-0056, November 5, 2004

Apache Software Foundation

Apache 1.3, 1.3.1, 1.3.3, 1.3.4, 1.3.46, 1.3.7 -dev, 1.3.9, 1.3.11, 1.3.12, 1.3.14, 1.3.17-1.3.20, 1.3.22-1.3.29, 1.3.31

A buffer overflow vulnerability exists in the ‘get_tag()’ function, which could let a malicious user execute arbitrary code.

Gentoo:

http://security.gentoo.org/glsa/glsa-200411-03.xml

Slackware: ftp://ftp.slackware.com/pub/slackware/s

Trustix: http://http.trustix.org/pub/trustix/updates/

Exploit scripts have been published.

High

SecurityFocus, October 20, 2004

Slackware Security Advisory, SA:2004-305-01, November 1, 2004

Gentoo Linux Security Advisory, GLSA 200411-03, November 2, 2004

Trustix Secure Linux Security Advisory, TSLSA-2004-0056, November 5, 2004

Astaro

Astaro Security Linux 4

Several vulnerabilities exist: a vulnerability exists in the PPTP server, which could let a remote malicious user obtain sensitive information; and a vulnerability exists because the firewall incorrectly responds to ‘SYN-FIN’ packets, which could let a remote malicious user obtain sensitive information.

The vendor has issued a new version (4.024), available via Up2Date.

Currently we are not aware of any exploits for these vulnerabilities.

Astaro Security Linux System Information Disclosures

Medium

Secunia Advisory,

SA13089, November 4, 2004

Caolan McNamara & Dom Lachowicz

wvWare version 0.7.4, 0.7.5, 0.7.6 and 1.0.0

A buffer overflow vulnerability exists in the ‘strcat()’ function call due to the insecure bounds checking, which could let a remote malicious user execute arbitrary code.

Updates available at: href=”http://www.abisource.com/bonsai/cvsview2.cgi?diff_mode=context&whitespace_mode =show&root=/cvsroot&subdir=wv&command=DIFF_FRAMESET&root=/cvsroot&file=field.c&rev1=1.19&rev2=1.20″>http://www.abisource.com/bonsai/

cvsview2.cgi?diff_mode=context&whitespace_mode=show&

root=/cvsroot&subdir=wv&command=DIFF_FRAMESET&root

=/cvsroot&file=field.c&rev1=1.19&rev2=1.20

Fedora: href=”http://download.fedora.redhat.com/pub/fedora/linux/core/updates/”>http://download.fedora.redhat.com/pub/fedora/linux/core/updates/

Gentoo: href=”http://security.gentoo.org/glsa/glsa-200407-11.xml”>http://security.gentoo.org/glsa/glsa-200407-11.xml

Mandrake: href=”http://www.mandrakesecure.net/en/ftp.php”>http://www.mandrakesecure.net/en/ftp.php

Conectiva: href=”http://www.cisa.gov/ftp://atualizacoes.conectiva.com.br/”>ftp://atualizacoes.conectiva.com.br/

Debian: href=”http://security.debian.org/pool/updates/main/w/wv/”>http://security.debian.org/pool/updates/main/w/wv/

A Proof of Concept exploit has been published.

High

Securiteam, July 11, 2004

iDEFENSE Security Advisory, July 9, 2004

Conectiva Linux Security Announcement, CLA-2004:863, September 10, 2004

Debian Security Advisory, DSA 550-1, September 20, 2004

Debian Security Advisory, DSA 579-1, November 1, 2004

Eric S. Raymond

Email Filter 0.9 .0.5, 0.9 .0.4, 0.9 .0.3, 0.92, 0.92.4, 0.92.6, 0.92.7

A remote Denial of Service vulnerability exists in ‘quoted-printable decoder’ due to a failure to handle malformed email headers.

Upgrades available at:

http://sourceforge.net/project/showfiles.php?group_id=62265

There is no exploit code required; however, a Proof of Concept exploit has been published.

Low

Securiteam, November 3, 2004

Gaim

  Gentoo

Multiple vulnerabilities were reported in Gaim in the processing of the MSN protocol. A remote user may be able to execute arbitrary code on the target system. Several remotely exploitable buffer overflows were reported in the MSN protocol parsing functions.

Gentoo: href=”http://security.gentoo.org/glsa/glsa-200408-12.xml”>http://security.gentoo.org/glsa/glsa-200408-12.xml

SuSE: href=”http://www.suse.de/de/security/2004_25_gaim.html”>http://www.suse.de/de/security/2004_25_gaim.html

Mandrake: href=”http://www.mandrakesecure.net/en/ftp.php”>http://www.mandrakesecure.net/en/ftp.php

Fedora Legacy: href=”http://download.fedoralegacy.org/redhat/”>http://download.fedoralegacy.org/redhat/

Conectiva: ftp://atualizacoes.conectiva.com.br/

We are not aware of any exploits for this vulnerability.

Gaim Buffer Overflows in Processing MSN Protocol

High

SecurityTracker, 1010872, August 5, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:081, August 13, 2004

Slackware Security Advisory, SSA:2004-239-01, August 26, 2004

Fedora Legacy Update Advisory, FLSA:1237, October 16, 2004

Conectiva Linux Security Announcement, CLA-2004:885, November 4, 2004

GD Graphics Library

gdlib 2.0.23, 2.0.26-2.0.28

A vulnerability exists in the ‘gdImageCreateFromPngCtx()’ function when processing PNG images due to insufficient sanity checking on size values, which could let a remote malicious user execute arbitrary code.

OpenPKG: ftp://ftp.openpkg.org/release/

Ubuntu:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/

Gentoo:

http://security.gentoo.org/glsa/glsa-200411-08.xml

An exploit script has been published.

High

Secunia Advisory,

SA12996, October 28, 2004

Gentoo Linux Security Advisory, GLSA 200411-08, November 3, 2004

Gentoo

Linux 0.2.0_pre10 & prior versions

A vulnerability exists in the ‘qpkg’ Gentoolkit due to the insecure creation of temporary files, which could let a malicious user obtain elevated privileges.

Update available at:

http://security.gentoo.org/glsa/glsa-200411-13.xml

Currently we are not aware of any exploits for this vulnerability.

Gentoo Gentoolkit ‘qpkg’ Elevated Privileges

Medium/ High

(High if root access can be obtained)

Gentoo Linux Security Advisory GLSA 200411-13:01, November 7, 2004

Gentoo

Linux 2.0.51-r2 & prior versions

A vulnerability exists in ‘dispatch_conf’ due to the insecure creation of temporary files, which could let a malicious user obtain elevated privileges.

Update available at:

http://security.gentoo.org/glsa/glsa-200411-13.xml

Currently we are not aware of any exploits for this vulnerability.

Gentoo Portage ‘dispatch-conf’ Elevated Privileges

Gentoo Linux Security Advisory GLSA 200411-13:01, November 7, 2004

GNU

groff 1.19

A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files.

Trustix: ftp://ftp.trustix.org/pub/trustix/updates/

Ubuntu: http://security.ubuntu.com/ubuntu/

pool/main/g/groff/

Gentoo:

http://security.gentoo.org/glsa/glsa-200411-15.xml

There is no exploit code required.

Medium

Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004

Ubuntu Security Notice USN-13-1, November 1, 2004

Gentoo Linux Security Advisory, GLSA 200411-15, November 8, 2 004

Haserl

Haserl 0.4-0.4.2, 0.5, 0.5.1

A vulnerability exists due to a design error that allows the manipulation of environment variables, which could let a remote malicious user manipulate information.

Upgrades available at:

http://prdownloads.sourceforge.net/haserl/

haserl-0.6.0.tar.gz?download

There is no exploit code required.

Haserl Environment Variable Manipulation

Medium

Secunia Advisory,

SA13031, November 1, 2004

Hewlett Packard Company

OpenView Operations for HP-UX 6.0, 7.0, 8.0, OpenView Operations for Solaris 6.0, 7.0, 8.0

A vulnerability exists which could let a remote authenticated malicious user obtain elevated privileges.

Patches available at: http://itrc.hp.com

We are not aware of any exploits for this vulnerability.

HP OpenView Operations Remote Privilege Escalation

Medium

HP Security Bulletin,

HPSBMA01092, November 2, 2004

ImageMagick

ImageMagick 5.3.3, 5.4.3, 5.4.4.5, 5.4.7, 5.4.8 .2-1.1.0, 5.4.8,

5.5.3 .2-1.2.0, 5.5.6 .0-20030409, 5.5.7, 6.0, 6.0.1, 6.0.3-6.0.8

A buffer overflow vulnerability exists in the ‘EXIF’ parsing routine due to a boundary error, which could let a remote malicious user execute arbitrary code.

Upgrades available at:

http://sourceforge.net/project/showfiles.php?group_id=24099

Redhat: http://rhn.redhat.com/errata/RHSA-2004-480.html

Ubuntu: http://security.ubuntu.com/ubuntu/pool/main/

i/imagemagick/

Gentoo:

http://security.gentoo.org/glsa/glsa-200411-11.xml

We are not aware of any exploits for this vulnerability.

High

SecurityTracker Alert ID, 1011946, October 26, 2004

Gentoo Linux Security Advisory, GLSA 200411-11:01, November 6, 2004

Info-ZIP

Zip 2.3

A buffer overflow vulnerability exists due to a boundary error when doing recursive compression of directories with ‘zip,’ which could let a remote malicious user execute arbitrary code.

Ubuntu:

http://security.ubuntu.com/ubuntu/pool/main/z/zip/

We are not aware of any exploits for this vulnerability.

High

Bugtraq, November 3, 2004

Ubuntu Security Notice, USN-18-1, November 5, 2004

ISC

DHCPD 2.0.pl5

A format string vulnerability exists because user-supplied data is logged in an unsafe fashion, which could let a remote malicious user execute arbitrary code.

Upgrades available at:

http://security.debian.org/pool/updates/main/d/dhcp/

We are not aware of any exploits for this vulnerability.

High

Debian Security Advisory, DSA 584-1, November 4, 2004

Larry Wall

Perl 5.8.3

A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files.

Trustix: ftp://ftp.trustix.org/pub/trustix/updates/

Ubuntu:

http://security.ubuntu.com/ubuntu/pool/main/p/perl/

There is no exploit code required.

Medium

Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004

Ubuntu Security Notice, USN-16-1, November 3, 2004

libtiff.org

LibTIFF 3.6.1

Several buffer overflow vulnerabilities exist: a vulnerability exists because a specially crafted image file can be created, which could let a remote malicious user cause a Denial of Service or execute arbitrary code; a remote Denial of Service vulnerability exists in ‘libtiff/tif_dirread.c’ due to a division by zero error; and a vulnerability exists in the ‘tif_next.c,’ ‘tif_thunder.c,’ and ‘tif_luv.c’ RLE decoding routines, which could let a remote malicious user execute arbitrary code.

Debian:

href=”http://security.debian.org/pool/updates/main/t/tiff/”>http://security.debian.org/pool/updates/main/t/tiff/

Gentoo: href=” http://security.gentoo.org/glsa/glsa-200410-11.xml”>http://security.gentoo.org/glsa/glsa-200410-11.xml

OpenPKG: href=”http://www.cisa.gov/ftp://ftp.openpkg.org/release/”>ftp://ftp.openpkg.org/release/

Trustix: href=”http://www.cisa.gov/ftp://ftp.trustix.org/pub/trustix/updates/”>ftp://ftp.trustix.org/pub/trustix/updates/

Mandrake: href=”http://www.mandrakesecure.net/en/ftp.php”>http://www.mandrakesecure.net/en/ftp.php

SuSE: href=”http://www.cisa.gov/ftp://ftp.suse.com/pub/suse/”>ftp://ftp.suse.com/pub/suse/

RedHat: href=”http://rhn.redhat.com/errata/RHSA-2004-577.html”>http://rhn.redhat.com/errata/RHSA-2004-577.html

Slackware:

ftp://ftp.slackware.com/pub/slackware/

Gentoo Linux Security Advisory, GLSA 200410-11, October 13, 2004

OpenPKG Security Advisory, OpenPKG-SA-2004.043, October 14, 2004

Debian Security Advisory, DSA 567-1, October 15, 2004

Trustix Secure Linux Security Advisory, TSLSA-2004-0054, October 15, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:109 & MDKSA-2004:111, October 20 & 21, 2004

SuSE Security Announcement, SUSE-SA:2004:038, October 22, 2004

RedHat Security Advisory, RHSA-2004:577-16, October 22, 2004

Slackware Security Advisory, SSA:2004-305-02, November 1, 2004

Multiple Vendors

Debian Linux 3.0, sparc, s/390, ppc, mipsel, mips, m68k, 0 ia-64, ia-32, hppa, arm, alpha; Linux kernel 2.0.2, 2.4-2.4.26, 2.6-2.6.9

A vulnerability exists in ‘iptables.c’ and ‘ip6tables.c’ due to a failure to load the required modules, which could lead to a false sense of security because firewall rules may not always be loaded.

Debian:

http://security.debian.org/pool/updates/main/i/iptables/i

Mandrake: href=”http://www.mandrakesecure.net/en/ftp.php”>http://www.mandrakesecure.net/en/ftp.php

There is no exploit code required.

Medium

Debian Security Advisory, DSA 580-1 , November 1, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:125, November 4, 2004

Multiple Vendors

Debian

Mandrake

OpenPKG

RedHat

SGI

Slackware

Trustix

Debian Linux 3.0, s/390, ppc, mipsel, mips, m68k, ia‑64, ia‑32, hppa, arm, alpha; rsync 2.3.1, 2.3.2 -1.3, 2.3.2 -1.2, sparc, PPC, m68k, intel, ARM, alpha, 2.3.2, 2.4.0, 2.4.1, 2.4.3‑ 2.4.6, 2.4.8, 2.5.0‑ 2.5.7, 2.6

A vulnerability exists due to insufficient sanitization of user-supplied path values, which could let a remote malicious user modify system information or obtain unauthorized access.

Debian: http://security.debian.org/pool/updates/main/r/rsync

Mandrake: http://www.mandrakesecure.net/en/ftp.php

Rsync: http://rsync.samba.org/ftp/rsync/rsync-2.6.1.tar.gz

Slackware: ftp://ftp.slackware.com/pub/slackware/

Trustix: http://www.trustix.org/errata/misc/2004/

TSL-2004-0024-rsync.asc.txt

OpenPKG: ftp://ftp.openpkg.org/release/

RedHat: http://rhn.redhat.com/errata/RHSA-2004-192.html

SGI: ftp://patches.sgi.com/support/free/security/

patches/ProPack/2.4/

Apple:

http://www.apple.com/support/security/security_updates.html

Fedora Legacy: http://download.fedoralegacy.org/redhat/

Conectiva: ftp://atualizacoes.conectiva.com.br/

Currently we are not aware of any exploits for this vulnerability.

Medium

Debian Security Advisory, DSA 499-1, May 2, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:042, May 11, 2004

OpenPKG Security Advisory , OpenPKG-SA-2004.025, May 21, 2004

RedHat Security Advisory, RHSA-2004:192-06, May 19, 2004

SGI Security Advisories, 20040508-01-U & 20040509-01, May 28, 2004

Slackware Security Advisory, SSA:2004-124-01, May 3, 2004

Trustix Secure Linux Security Advisory, 2004-0024, April 30, 2004

Fedora Legacy Update Advisory, FLSA:2003, September 30, 2004

Conectiva Linux Security Announcement, CLA-2004:881, November 1, 2004

A vulnerability exists in rsync when running in daemon mode with chroot disabled. A remote user may be able read or write files on the target system that are located outside of the module’s path. A remote user can supply a specially crafted path to cause the path cleaning function to generate an absolute filename instead of a relative one. The flaw resides in the sanitize_path() function.

Updates and patches are available at: href=”http://rsync.samba.org/”>http://rsync.samba.org/

SuSE: href=”http://www.suse.de/de/security/2004_26_rsync.html”>http://www.suse.de/de/security/2004_26_rsync.html

Debian: href=”http://www.debian.org/security/2004/dsa-538″>http://www.debian.org/security/2004/dsa-538

Trustix: href=”http://www.trustix.net/errata/2004/0042/”>http://www.trustix.net/errata/2004/0042/

Fedora:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/

Mandrake: http://www.mandrakesecure.net/en/ftp.php

OpenPKG: ftp://ftp.openpkg.org/release/2.0/UPD/

Tinysofa:

http://http.tinysofa.org/pub/tinysofa/updates/

server-2.0/i386/tinysofa/rpms.updates/

rsync-2.6.2-2ts.i386.rpm

TurboLinux: ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/

Fedora Legacy: http://download.fedoralegacy.org/redhat/

Conectiva: ftp://atualizacoes.conectiva.com.br/

We are not aware of any exploits for this vulnerability.

High

SecurityTracker 1010940, August 12, 2004

rsync August 2004 Security Advisory

SecurityFocus, September 1, 2004

Fedora Legacy Update Advisory, FLSA:2003, September 30, 2004

Conectiva Linux Security Announcement, CLA-2004:881, November 1, 2004

Multiple Vendors

Gentoo Linux, 1.4; Rob Flynn Gaim 0.10 x, 0.10.3, 0.50-0.75, 0.78, 0.82, 0.82.1, 1.0, 1.0.1; Slackware Linux -current, 9.0, 9.1, 10.0

A buffer overflow vulnerability exists in the processing of MSNSLP messages due to insufficient verification, which could let a remote malicious user execute arbitrary code.

Gentoo: href=”http://security.gentoo.org/glsa/glsa-200410-23.xml”>http://security.gentoo.org/glsa/glsa-200410-23.xml

Rob Flynn: href=”http://prdownloads.sourceforge.net/gaim/gaim-1.0.2.tar.gz?download”>http://prdownloads.sourceforge.net/gaim/

gaim-1.0.2.tar.gz?download

RedHat: href=”http://www.cisa.gov/ftp://updates.redhat.com”>ftp://updates.redhat.com

Ubuntu:http://security.ubuntu.com/ubuntu/

pool/main/g/gaim/

Mandrake:

http://www.mandrakesoft.com/security/advisories

We are not aware of any exploits for this vulnerability.

High

Gentoo Linux Security Advisory, GLSA 200410-23, October 25, 2004

RedHat Security Advisory, RHSA-2004:604-01, October 20, 2004

Slackware Security Advisory, SSA:2004-296-01, October 22, 2004

Ubuntu Security Notice, USN-8-1 October 27, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:117, November 1, 2004

Multiple Vendors

Linux kernel 2.6 -test1-test11, 2.6-l 2.6.8; SuSE Linux 9.1

A remote Denial of Service vulnerability exists in the iptables logging rules due to an integer underflow.

Update available at: href=” http://kernel.org/”>http://kernel.org/

SuSE: href=”http://www.cisa.gov/ftp://ftp.suse.com/pub/suse/”>ftp://ftp.suse.com/pub/suse/

A Proof of Concept exploit script has been published.

Low

SuSE Security Announcement, SUSE-SA:2004:037, October 20, 2004

Packetstorm, November 5, 2004

Multiple Vendors

A vulnerability exists in the foomatic-rip print filter due to insufficient validation of command-lines and environment variables, which could let a remote malicious user execute arbitrary commands.

Mandrake: href=”http://www.mandrakesecure.net/en/ftp.php”>http://www.mandrakesecure.net/en/ftp.php

SuSE: href=”http://www.cisa.gov/ftp://ftp.suse.com/pub/suse”>ftp://ftp.suse.com/pub/suse

Trustix: href=”http://www.cisa.gov/ftp://ftp.trustix.org/pub/trustix/updates/”>ftp://ftp.trustix.org/pub/trustix/updates/

Fedora: http://download.fedora.redhat.com/pub

/fedora/linux/core/updates/2/

Gentoo: http://security.gentoo.org/glsa/glsa-200409-24.xml

Sun: http://sunsolve.sun.com/search/document.do

?assetkey=1-26-57646-1&searchclause=

Conectiva: ftp://atualizacoes.conectiva.com.br/

Fedora Legacy: http://download.fedoralegacy.org/fedora/1/updates/

We are not aware of any exploits for this vulnerability.

High

Secunia Advisory, SA12557, September 16, 2004

Fedora Update Notification,

FEDORA-2004-303, September 21, 2004

Gentoo Linux Security Advisory, GLSA 200409-24, September 17, 2004

Sun(sm) Alert Notification, 57646, October 7, 2004

Conectiva Linux Security Announcement, CLA-2004:880, October 26, 2004

Fedora Legacy Update Advisory, FLSA:2076, November 5, 2004

Multiple Vendors

LVM Logical Volume Management Utilities 1.0.4, 1.0.7, 1.0.8

A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files.

Trustix: ftp://ftp.trustix.org/pub/trustix/updates/

Ubuntu:

http://security.ubuntu.com/ubuntu/pool/main/l/lvm10/

Debian:

http://security.debian.org/pool/updates/main/l/lvm10/

There is no exploit code required.

Medium

Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004

Ubuntu Security Notice, USN-15-1, November 1, 2004

Debian Security Advisory, DSA 583-1, November 3, 2004

Multiple Vendors

Multiple vulnerabilities exist: a stack overflow vulnerability exists in ‘xpmParseColors()’ in ‘parse.c’ when a specially crafted XPMv1 and XPMv2/3 file is submitted, which could let a remote malicious user execute arbitrary code; a stack overflow vulnerability exists in the ‘ParseAndPutPixels()’ function in -create.c’ when reading pixel values, which could let a remote malicious user execute arbitrary code; and an integer overflow vulnerability exists in the colorTable allocation in ‘xpmParseColors()’ in ‘parse.c,’ which could let a remote malicious user execute arbitrary code.

Debian: href=”http://security.debian.org/pool/updates/main/i/imlib/”>http://security.debian.org/pool/updates/main/i/imlib/

Mandrake: href=”http://www.mandrakesecure.net/en/ftp.php”

target=_blank>http://www.mandrakesecure.net/en/ftp.php

OpenBSD:

href=”http://www.cisa.gov/ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/”>ftp://ftp.OpenBSD.org/pub/OpenBSD/patches/

SuSE: href=”http://www.cisa.gov/ftp://ftp.suse.com/pub/suse/”>ftp://ftp.suse.com/pub/suse/

X.org: http://x.org/X11R6.8.1/

Gentoo: href=”http://security.gentoo.org/glsa/glsa-200409-34.xml”>http://security.gentoo.org/glsa/glsa-200409-34.xml

IBM: href=”http://www-912.ibm.com/eserver/support/fixes/fcgui.jsp”>http://www-912.ibm.com/eserver/support/fixes/fcgui.jsp

RedHat: href=”http://rhn.redhat.com/errata/RHSA-2004-478.html”>http://rhn.redhat.com/errata/RHSA-2004-478.html

Mandrake:

http://www.mandrakesoft.com/security/advisories

Proofs of Concept exploits have been published.

High

X.Org Foundation Security Advisory, September 16, 2004

US-CERT Vulnerability Notes, VU#537878 & VU#882750, September 30, 2004

SecurityFocus, October 4, 2004

SecurityFocus, October 18, 2004

Sun(sm) Alert Notification, 5765, October 18, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:124, November 2, 2004

MySQL AB

MySQL 3.20 .x, 3.20.32 a, 3.21 .x, 3.22 .x, 3.22.26-3.22.30, 3.22.32, 3.23 .x, 3.23.2-3.23.5, 3.23.8-3.23.10, 3.23.22-3.23.34, 3.23.36-3.23.56, 3.23.58, 4.0.0-4.0.15, 4.0.18, 4.0.20, 4.1 .0-alpha, 4.1 .0-0, 4.1.2 -alpha, 4.1.3 -beta, 4.1.3 -0, 5.0 .0-alpha, 5.0 .0-0

A buffer overflow vulnerability exists in the ‘mysql_real_connect’ function due to insufficient boundary checking, which could let a remote malicious user cause a Denial of Service and possibly execute arbitrary code. Note: Computers using glibc on Linux and BSD platforms may not be vulnerable to this issue.

Debian: http://security.debian.org/pool/updates/main/m/mysql/

Trustix: http://http.trustix.org/pub/trustix/updates/

OpenPKG: ftp://ftp.openpkg.org/release/

Mandrake:

http://www.mandrakesoft.com/security/advisories

We are not aware of any exploits for this vulnerability.

Secunia Advisory,

SA12305, August 20, 2004

Debian Security Advisory, DSA 562-1, October 11, 2004

Trustix Secure Linux Security Advisory, TSLSA-2004-0054, October 15, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:119, November 1, 2004

MySQL AB

MySQL 3.23.49, 4.0.20

A vulnerability exists in the ‘mysqlhotcopy’ script due to predictable files names of temporary files, which could let a malicious user obtain elevated privileges.

Debian: href=”http://security.debian.org/pool/updates/main/m/”>http://security.debian.org/pool/updates/main/m/

Gentoo: href=”http://security.gentoo.org/glsa/glsa-200409-02.xml”>http://security.gentoo.org/glsa/glsa-200409-02.xml

SuSE: href=”http://www.cisa.gov/ftp://ftp.suse.com/pub/suse/”>ftp://ftp.suse.com/pub/suse/

RedHat: href=”http://rhn.redhat.com/errata/RHSA-2004-569.html”>http://rhn.redhat.com/errata/RHSA-2004-569.html

OpenPKG: ftp://ftp.openpkg.org/release/

Mandrake:

http://www.mandrakesoft.com/security/advisories

There is no exploit code required.

Medium

Debian Security Advisory, DSA 540-1, August 18, 2004

Gentoo Linux Security Advisory GLSA 200409-02, September 1, 2004

SUSE Security Announcement, SUSE-SA:2004:030, September 6, 2004

RedHat Security Advisory, ,RHSA-2004:569-16, October 20, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:119, November 1, 2004

MySQL AB

MySQL 3.x, 4.x

Two vulnerabilities exist: a vulnerability exists due to an error in ‘ALTER TABLE … RENAME’ operations because the ‘CREATE/INSERT’ rights of old tables are checked, which potentially could let a remote malicious user bypass security restrictions; and a remote Denial of Service vulnerability exists when multiple threads issue ‘alter’ commands against ‘merge’ tables to modify the ‘union.’

Updates available at: http://dev.mysql.com/downloads/mysql/

Debian: http://security.debian.org/pool/updates/main/m/mysql

Trustix: http://http.trustix.org/pub/trustix/updates/

Mandrake:

http://www.mandrakesoft.com/security/advisories

We are not aware of any exploits for these vulnerabilities.

Secunia Advisory, SA12783, October 11, 2004

Trustix Secure Linux Security Advisory, TSLSA-2004-0054, October 15, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:119, November 1, 2004

Netatalk

Netatalk Open Source Apple File Share Protocol Suite 1.5 pre6, 1.6.1, 1.6.4

A vulnerability exists due to the insecure creation of temporary files, which could possibly let a malicious user overwrite arbitrary files.

Trustix: ftp://ftp.trustix.org/pub/trustix/updates/

Gentoo: http://security.gentoo.org/glsa/glsa-200410-25.xml

Mandrake:

http://www.mandrakesoft.com/security/advisories

There is no exploit code required.

Medium

Trustix Secure Linux Bugfix Advisory, TSL-2004-0050, September 30, 2004

Gentoo Linux Security Advisory GLSA 200410-25, October 25, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:121, November 2, 2004

PostgreSQL

PostgreSQL 7.0.2, 7.0.3, 7.1-7.1.3, 7.2-7.2.4, 7.3-7.3.4, 7.4, 7.4.3, 7.4.5

A vulnerability exists in the RPM initialization script. The impact was not specified.

No workaround or patch available at time of publishing.

We are not aware of any exploits for this vulnerability.

PostgreSQL Unspecified RPM Initialization Script

Not Specified

SecurityFocus, November 1, 2004

proxytunnel

proxytunnel 1.0.6, 1.1.3, 1.2.0, 1.2.2

A format string vulnerability exists in the ‘message()’ function in ‘messages.c’ when running in daemon mode, which could let a remote malicious user execute arbitrary code.

Upgrade available at:

http://sourceforge.net/project/showfiles.php?group_id=39840

Gentoo: http://security.gentoo.org/glsa/glsa-200411-07.xml

We are not aware of any exploits for this vulnerability.

Proxytunnel Remote Format String

High

Gentoo Linux Security Advisory, GLSA 200411-07, November 3, 2004

Qwikmail

Qwikmail 0.3

A vulnerability exists due to a format string error in ‘qwik-smtpd.c,’ which could let a remote malicious user execute arbitrary code.

Patch available at: http://qwikmail.sourceforge.net/

smtpd/qwik-smtpd-0.3.patch

An exploit script has been published.

QwikMail Format String

High

Secunia Advisory,

SA13037, November 1, 2004

Packetstorm, November 10, 2004

Rob Flynn

Gaim 0.10 x, 0.10.3, 0.50-0.75

Multiple vulnerabilities exist which could let a remote malicious user execute arbitrary code or cause a Denial of Service: a vulnerability exists during the installation of a smiley theme; a heap overflow vulnerability exists when processing data from a groupware server; a buffer overflow vulnerability exists in the URI parsing utility; a buffer overflow vulnerability exists when performing a DNS query to obtain a hostname when signing on to zephyr; a buffer overflow vulnerability exists when processing Rich Text Format (RTF) messages; and a buffer overflow vulnerability exists in the ‘content-length’ header when an excessive value is submitted.

Fedora: href=”http://download.fedora.redhat.com/pub/fedora/linux/core/updates/”>

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/

Gentoo: href=”http://security.gentoo.org/glsa/glsa-200408-27.xml”>http://security.gentoo.org/glsa/glsa-200408-27.xml

Fedora Legacy: href=”http://download.fedoralegacy.org/redhat/”>http://download.fedoralegacy.org/redhat/

Mandrake: href=”http://www.mandrakesecure.net/en/ftp.php”>http://www.mandrakesecure.net/en/ftp.php

Conectiva: ftp://atualizacoes.conectiva.com.br/

SecurityFocus, August 26, 2004

Fedora Legacy Update Advisory, FLSA:1237, October 16, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:110, October 21, 2004

Conectiva Linux Security Announcement, CLA-2004:884, November 4, 2004

Sophos

MailMonitor for SMTP 2.1

A vulnerability exists when handling malformed email messages. The impact was not specified.

Updates available at: http://www.sophos.com/sophos/products

/full/mmsmtp-linux-update.tar.gz

http://www.sophos.com/sophos/products/full/

mmsmtp-solaris-update.tar.Z

We are not aware of any exploits for this vulnerability.

Sophos MailMonitor SMTP Email Handling

Not Specified

Sophos Support Knowledgebase Article, November 5, 2004

SpamAssassin

SpamAssassin 3.0.1

A remote Denial of Service vulnerability exists when a malicious user submits a specially crafted email message that contains several domain addresses in the email body.

No workaround or patch available at time of publishing.

A Proof of Concept exploit has been published.

SpamAssassin Remote Denial of Service

Low

SecurityTracker Alert ID, 1012071, November 3, 2004

Squid-cache.org Debian

Fedora

Gentoo

Mandrake

OpenPKG

RedHat

SGI

SuSE

Tinysofa

Trustix

Squid Web Proxy Cache 2.0 PATCH2, 2.1 PATCH2, 2.3 STABLE5, 2.4 STABLE7, 2.4. 2.5 STABLE5, STABLE4, STABLE3, STABLE1

A buffer overflow vulnerability exists in ‘helpers/ntlm_auth/SMB/libntlmssp.c’ in the ‘ntlm_check_auth()’ function due to insufficient validation, which could let a remote malicious user execute arbitrary code.

Patches available at: http://www.squid-cache.org/~wessels/patch/libntlmssp.c.patch

Fedora:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/

Gentoo: http://security.gentoo.org/glsa/glsa-200406-13.xml

Mandrake: http://www.mandrakesoft.com/security/advisories

RedHat: http://rhn.redhat.com/errata/RHSA-2004-242.html

SGI: ftp://patches.sgi.com/support/free/security/advisories/

SuSE: ftp://ftp.suse.com/pub/suse/

Trustix: http://http.trustix.org/pub/trustix/updates/

Conectiva: ftp://atualizacoes.conectiva.com.br/

Exploit script has been published.

High

Fedora Update Notifications, FEDORA-2004-163 & 164, June 9, 2004

Gentoo Linux Security Advisory, GLSA 200406-13, June 17, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:059, June 9, 2004

RedHat Security Advisory, RHSA-2004:242-06, June 9, 2004

SGI Security Advisory, 20040604-01-U, June 21, 2004

SUSE Security Announcement, SuSE-SA:2004:016, June 9, 2004

Tinysofa Security Advisory, TSSA-2004-010, June 9, 2004

Trustix Secure Linux Security Advisory, TSLSA-2004-0033, June 10, 2004

Conectiva Linux Security Announcement, CLA-2004:882, November 3, 2004

Squid-cache.org

Squid 2.5-STABLE6, 3.0-PRE3-20040702; when compiled with SNMP support

A remote Denial of Service vulnerability exists in the ‘asn_parse_header()’ function in ‘snmplib/asn1.c’ due to an input validation error when handling certain negative length fields.

Updates available at: href=” http://www.squid-cache.org/”>http://www.squid-cache.org/

Fedora: href=”http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/”>http://download.fedora.redhat.com/pub/

fedora/linux/core/updates/2/

Gentoo: href=”http://security.gentoo.org/glsa/glsa-200410-15.xml”>http://security.gentoo.org/glsa/glsa-200410-15.xml

Trustix: href=”http://http.trustix.org/pub/trustix/updates/”>http://http.trustix.org/pub/trustix/updates/

RedHat: href=”http://rhn.redhat.com/errata/RHSA-2004-591.html”>http://rhn.redhat.com/errata/RHSA-2004-591.html

Mandrake: href=”http://www.mandrakesecure.net/en/ftp.php”>http://www.mandrakesecure.net/en/ftp.php

Debian: http://security.debian.org/pool/updates/main/s/squid/

OpenPKG: ftp://ftp.openpkg.org/release/

Conectiva:

ftp://atualizacoes.conectiva.com.br/

Ubuntu:

http://security.ubuntu.com/ubuntu/pool/main/s/squid/

Low

iDEFENSE Security Advisory, October 11, 2004

Trustix Secure Linux Security Advisory, TSLSA-2004-0054, October 15, 2004

Gentoo Linux Security Advisory, GLSA 200410-15, October 18, 2004

RedHat Security Advisory, RHSA-2004:591-04, October 20, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:112, October 21, 2004

Debian Security Advisory, DSA 576-1, October 29, 2004

OpenPKG Security Advisory, OpenPKG-SA-2004.048, October 29, 2004

Conectiva Linux Security Announcement, CLA-2004:882, November 3, 2004

Ubuntu Security Notice, USN-19-1, November 6, 2004

Squid-cache.org

Squid Web Proxy Cache 2.0 PATCH2, 2.1 PATCH2, 2.3 STABLE5, 2.4, STABLE7, 2.5 STABLE1-STABLE6, Squid Web Proxy Cache 3.0 PRE1-PRE3

A remote Denial of Service vulnerability exists in ‘lib/ntlmauth.c’ due to insufficient validation of negative values in the ‘ntlm_fetch_string()’ function.

Patches available at: href=”http://www1.uk.squid-cache.org/squid/Versions/v2/2.5/bugs/squid-2.5.STABLE6-ntlm_fetch_string.patch”>http://www1.uk.squid-cache.org/squid/Versions

/v2/2.5/bugs/squid-2.5.STABLE6-ntlm_fetch_string.patch

Gentoo: href=”http://security.gentoo.org/glsa/glsa-200409-04.xml”>http://security.gentoo.org/glsa/glsa-200409-04.xml

Mandrake: href=”http://www.mandrakesecure.net/en/ftp.php”>http://www.mandrakesecure.net/en/ftp.php

Trustix: href=”http://http.trustix.org/pub/trustix/updates/”>http://http.trustix.org/pub/trustix/updates/

RedHat: http://rhn.redhat.com/errata/RHSA-2004-462.html

TurboLinux:

ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/

Conectiva: ftp://atualizacoes.conectiva.com.br/

Ubuntu:

http://security.ubuntu.com/ubuntu/pool/main/s/squid/

Low

Secunia Advisory, SA12444, September 3, 2004

Mandrakelinux Security Update Advisory, MDKSA-2004:093, September 15, 2004

Trustix Secure Linux Security Advisory, TSLSA-2004-0047, September 16, 2004

RedHat Security Advisory, RHSA-2004:462-10, September 30, 2004

Turbolinux Security Announcement, October 5, 2004

Conectiva Linux Security Announcement, CLA-2004:882, November 3, 2004

Ubuntu Security Notice, USN-19-1, November 6, 2004

Subversion

Subversion 1.0-1.0.7, 1.1 .0 rc1-rc3

A vulnerability exists in the ‘mod_authz_svn’ module due to insufficient restricted access to metadata on unreadable paths, which could let a remote malicious user obtain sensitive information.

Update available at:

http://subversion.tigris.org/tarballs/subversion-1.0.8.tar.gz

Fedora:

http://download.fedora.redhat.com/pub/

fedora/linux/core/updates/2/

Gentoo: http://security.gentoo.org/glsa/glsa-200409-35.xml

Conectiva: ftp://atualizacoes.conectiva.com.br/10/

There is no exploit code required.

Medium

SecurityTracker Alert ID, 1011390, September 23, 2004

Gentoo Linux Security Advisory, GLSA 200409-35, September 29, 2004

Conectiva Linux Security Announcement, CLA-2004:883, November 4, 2004

Technote

Technote

A vulnerability exists in the ‘main.cgi’ script due to insufficient validation of user-supplied input in the ‘filename’ parameter, which could let a remote malicious user execute arbitrary commands.

No workaround or patch available at time of publishing.

A Proof of Concept exploit has been published.

Technote ‘main.cgi’ Input Validation

High

SecurityTracker Alert I,: 1012117, November 8, 2004

Tomasz Kloczko

Shadow 4.0-4.0.4

A vulnerability exists in the in the ‘chfn’ and ‘chsh’ utilities due to insufficient sanitization of user-supplied input, which could let a remote malicious user bypass authentication.

Upgrades available at :

ftp://ftp.pld.org.pl/software/shadow/shadow-4.0.5.tar.gz

Gentoo:

http://security.gentoo.org/glsa/glsa-200411-09.xml

We are not aware of any exploits for this vulnerability.

Shadow Authentication Bypass

Medium

SecurityFocus, October 28, 2004

Gentoo Linux Security Advisory, GLSA 200411-09, November 4, 2004

xmlsoft.org

Libxml2 2.6.12-2.6.14

Multiple buffer overflow vulnerabilities exist: a vulnerability exists in the ‘xmlNanoFTPScanURL()’ function in ‘nanoftp.c’ due to a boundary error, which could let a remote malicious user execute arbitrary code; a vulnerability exists in the ‘xmlNanoFTPScanProxy()’ function in ‘nanoftp.c,’ which could let a remote malicious user execute arbitrary code; and a vulnerability exists in the handling of DNS replies due to various boundary errors, which could let a remote malicious user execute arbitrary code.

Upgrades available at:

http://xmlsoft.org/sources/libxml2-2.6.15.tar.gz

OpenPKG:

ftp://ftp.openpkg.org/release/

Trustix: ftp://ftp.trustix.org/pub/trustix/updates/

Fedora: http://download.fedora.redhat.com/pub/

fedora/linux/core/updates/2/

Gentoo:

http://security.gentoo.org/glsa/glsa-200411-05.xml

Mandrake: http://www.mandrakesoft.com/security/advisories

OpenPKG: ftp://ftp.openpkg.org/release/

Trustix:

http://www.trustix.org/errata/2004/0055/

Ubuntu:

http://security.ubuntu.com/ubuntu/

pool/main/libx/libxml2/

An exploit script has been published.

High

SecurityTracker Alert I, : 1011941, October 28, 2004

Fedora Update Notification,

FEDORA-2004-353, November 2, 2004

Gentoo Linux Security Advisory, GLSA 200411-05, November 2,2 004

Mandrakelinux Security Update Advisory, MDKSA-2004:127, November 4, 2004

OpenPKG Security Advisory, OpenPKG-SA-2004.050, November 1, 2004

Trustix Secure Linux Security Advisory, TSLSA-2004-0055, November 1, 2004

Ubuntu Security Notice, USN-10-1, November 1, 2004

ychat.org

yChat 0.1-0.6

A remote Denial of Service vulnerability exists due to some security issues when processing HTTP connections.

Upgrades available at:

http://ftp.buetow.org/pub/yChat/CPP-yChat/ychat-0.7.tar.bz2

We are not aware of any exploits for this vulnerability.

yChat HTTP Remote Denial of Service

Low

SecurityTracker Alert ID, 1012043, November 2, 2004

Yukihiro Matsumoto

Ruby 1.8.x

A remote Denial of Service vulnerability exists due to an input validation error in

‘cgi.rb.’

Debian: http://security.debian.org/pool/updates/main/r/ruby

Mandrake: http://www.mandrakesoft.com/security/advisories

Currently we are not aware of any exploits for this vulnerability.

Low

Secunia Advisory,

SA13123, November 8, 2004

Zile

Zile Text Editor 1.4, 1.5-1.5.3, 1.6-1.6.2, 1.7 b1-b3

Several potential buffer overflows exist, which could possibly let a remote malicious user execute arbitrary code.

Upgrades available at:

http://prdownloads.sourceforge.net/zile/

zile-2.0-a1.tar.gz?download

We are not aware of any exploits for these vulnerabilities.

Zile Buffer Overflows

High

SecurityTracker Alert ID, 1012080, November 4, 2004

Multiple Operating Systems – Windows / UNIX / Linux / Other

Vendor & Software Name

Vulnerability – Impact

Patches – Workarounds

Attacks Scripts

Common Name

Risk

Source

Brandon Tallent

AntiBoard 0.7.3

An input validation vulnerability exists due to insufficient sanitization of user-supplied input prior to including it in an SQL query, which could let a remote malicious user execute arbitrary SQL commands.

No workaround or patch available at time of publishing.

There is no exploit code required.

AntiBoard Input Validation

High

SecurityTracker Alert ID, 1012076, November 4, 2004

Cisco Systems

IOS R12.x, 12.x

A remote Denial of Service vulnerability exists when a malicious user submits a specially crafted TCP connection to a telnet or reverse telnet port.

We are not aware of any exploits for this vulnerability.

Cisco IOS Telnet Service Remote Denial of Service

Low

Cisco Security Advisory, cisco-sa-20040827, August 27, 2004

US-CERT Vulnerability Note VU#384230

Cisco Security Advisory, 61671 Rev 2.2, October 20, 2004

Cisco Security Advisory, 61671 Rev 2.3, October 31, 2004

eGroupWare.org

eGroupWare prior to 1.0.00.006

A Directory Traversal vulnerability exists in ‘JiNN’ due to insufficient validation of user-supplied input, which could let a remote malicious user obtain sensitive information.

Update available at:

http://sourceforge.net/project/showfiles.php?group_id=78745

We are not aware of any exploits for this vulnerability.

eGroupWare JiNN Directory Traversal

Medium

Secunia Advisory,

SA13110, November 8, 2004

Gallery Project

Gallery 1.4 -pl1&pl2, 1.4, 1.4.1, 1.4.2, 1.4.3 -pl1 & pl2; Gentoo Linux

A Cross-Site Scripting vulnerability exists in several files, including ‘view_photo.php,’ ‘index.php,’ and ‘init.php’ due to insufficient input validation, which could let a remote malicious user execute arbitrary HTML and script code.

Upgrades available at:

http://sourceforge.net/project/showfiles.php?group_id=7130

Gentoo: http://security.gentoo.org/glsa/glsa-200411-10.xml

There is no exploit code required.

Gallery Cross-Site Scripting

High

Gentoo Linux Security Advisory, GLSA 200411-10:01, November 6, 2004

gallery.devrandom.

org.uk

FsPHPGallery 0.2, 0.3.1, 1.0.1, 1.1

Multiple vulnerabilities exist: a Denial of Service vulnerability exists due to an input validation error when resizing images; and a vulnerability exists in ‘index.php’ due to insufficient verification of input passed to the ‘dir’ parameter, which could let a malicious user obtain sensitive information.

Upgrades available at:

http://gallery.devrandom.org.uk/releases/fsphpgallery-1.2.tar.gz

There is no exploit code required.

FsPHPGallery Multiple Input Validation

Secunia Advisory,

SA13074, November 3, 2004

Gbook MX

Gbook MX 2.0, 3.0, 4.1

Multiple unspecified SQL injection vulnerabilities exist due to insufficient sanitization of user-supplied input prior to including it in SQL queries, which could let a remote malicious user compromise the application, disclosure or modify data, or permit the exploitation of vulnerabilities in the underlying database implementation.

Upgrades available at:

http://sourceforge.net/project/showfiles.php?group_

id=80296&package_id=123432&release_id=279828

We are not aware of any exploits for these vulnerabilities.

Gbook MX Multiple Unspecified SQL Injection

Medium

SecurityFocus, November 3, 2004

Goollery

Goollery 0.3

Multiple Cross-Site Scripting vulnerabilities due to insufficient sanitization of user-supplied input, exists which could let a remote malicious user execute arbitrary HTML and script code.

No workaround or patch available at time of publishing.

A Proof of Concept exploit has been published.

Goollery Multiple Cross-Site Scripting

High

SecurityFocus, November 2, 2004

Moodle

moodle 1.1.1, 1.2, 1.2.1, 1.3-1.3.4, 1.4.1, 1.4.2

A vulnerability exists in the ‘glossary’ module due to insufficient verification of user-supplied input, which could let a remote malicious user execute arbitrary SQL code.

Update available at: http://moodle.org/download/

There is no exploit code required.

Moodle Remote Glossary Module SQL Injection

High

Secunia Advisory,

SA13091, November 5, 2004

Multiple Vendors

Archive::Zip 1.13,

F-Secure Anti-Virus for Microsoft Exchange 6.30, 6.30 SR1, and 6.31,

Computer Associates,

Eset,

Kaspersky,

McAfee,

Sophos,

RAV

Remote exploitation of an exceptional condition error in multiple vendors’ anti-virus software allows malicious users to bypass security protections by evading virus detection. The problem specifically exists in the parsing of .zip archive headers. This vulnerability affects multiple anti-virus vendors including McAfee, Computer Associates, Kaspersky, Sophos, Eset and RAV.

Instructions for Computer Associates, Eset, Kaspersky, McAfee, Sophos, and RAV are available at: http://www.idefense.com/application/poi/display?id

=153&type=vulnerabilities&flashstatus=true

Gentoo:

http://security.gentoo.org/glsa/glsa-200410-31.xml

Mandrakelinux 10.1 and Mandrakelinux 10.1/X86_64: http://www.mandrakesoft.com/security/advisories

A fix for F-Secure is available at::

ftp://ftp.f-secure.com/support/

hotfix/fsav-mse/fsavmse63x-02.zip

Proofs of Concept exploits have been published.

High

iDEFENSE Security Advisory, October 18, 2004

Secunia Advisory ID: SA13038, November 1, 2004

SecurityFocus, Bugtraq ID: 11448, November 2, 2004

SecurityTracker Alert ID: 1012057, November 3, 2004

Multiple Vendors

Microsoft Internet Explorer 6, Microsoft Outlook Express 6,

Apple Safari 1.2.3 (v125.9)

Multiple web browsers do not properly display the location of HTML documents in the status bar. An attacker could exploit this behavior to mislead users into revealing sensitive information.

This vulnerability was confirmed in Internet Explorer SP1 but not SP2.

A Proof of Concept exploit has been published.

Multiple Web Browsers TABLE Elements Interpretation

Medium

Secunia Advisory, SA13015, October 29, 2004

US-CERT Vulnerability Notes VU#925430 & VU#702086, November 4, 2004

Multiple Vendors

Microsoft Internet Explorer 6.0

Apple Safari 1.2.3 (v125.9)

Multiple browsers are prone to a remote Denial of Service vulnerability. The issue presents itself due to a malfunction that occurs when certain font tags are encountered and rendered. When a page that contains the malicious HTML code is viewed, the browser will crash.

No workaround or patch available at time of publishing.

A Proof of Concept exploit has been published.

Low

SecurityFocus Bugtraq ID, 11536, October 26, 2004

US-CERT, Vulnerability Note VU#925430, November 4, 2004

NetGear

ProSafe Dual Band Wireless VPN Firewall FWAG114

A vulnerability exists because a default community string is used for SNMP, which could let a remote malicious user obtain sensitive information.

No workaround or patch available at time of publishing.

There is no exploit code required.

NetGear ProSafe Dual Band Wireless VPN Firewall Default SNMP Community String

Medium

SecurityFocus, November 2, 2004

paystream.sourceforge.

net

AudienceConnect SecureEditor

A vulnerability exists in the IP address-based access control feature, which could let a remote unauthorized malicious user obtain access.

Update available at:

http://sourceforge.net/project/showfiles.php?grou

p_id=98629&package_id=132849

We are not aware of any exploits for this vulnerability.

AudienceConnect SecureEditor Unauthorized Access

Medium

SecurityTracker Alert ID, 1012066, November 3, 2004

Pierre Chifflier

wzdftpd prior to 0.4.3

A remote Denial of Service vulnerability exists because ident connections are not properly closed.

Update available at:

http://sourceforge.net/project/showfiles.php?group_id=78247

We are not aware of any exploits for this vulnerability.

Pierre Chifflier wzdftpd ident Processing Remote Denial of Service

Low

SecurityTracker Alert ID, 1012078, November 4, 2004

Sun Microsystems, Inc.

Java System Application Server 7.0 Standard Edition, Platform Edition, 7.0 2004Q2, Java System Web Server 6.0, SP1-SP7, 6.1, SP1

A remote Denial of Service vulnerability exists due to a failure to process malformed client certificates.

Patches available at:

http://wwws.sun.com/software/download/products/

There is no exploit code required.

Sun Java System Web & Application Servers Remote Denial of Service

Low

Sun(sm) Alert Notification, 57669, November 2, 2004

Sun Microsystems, Inc.

Java System Application Server 7.0 Standard Edition, Platform Edition, 7.0 2004Q2

A vulnerability exists in the processing of HTTP TRACE requests, which could let a remote malicious user obtain sensitive information.

Workaround available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-26-57670-1

There is no exploit code required.

Sun Java System Application Server HTTP TRACE Information Disclosure

Medium

Sun(sm) Alert Notification, 57670, November 2, 2004