The most trusted source for computer security training, certification and research.

@RISK: The Consensus Security Vulnerability Alert

Volume: VIII, Issue: 20
May 14, 2009

SANS Newsletters Home

This week's news: A critical vulnerability in Microsoft PowerPoint and numerous critical vulnerabilities in Apple Mac OS/X and Safari all can lead to remote execution (making systems into zombies).

@RISK is the SANS community's consensus bulletin summarizing the most important vulnerabilities and exploits identified during the past week and providing guidance on appropriate actions to protect your systems (PART I). It also includes a comprehensive list of all new vulnerabilities discovered in the past week (PART II).

Summary of the vulnerabilities reported this week:

    • Category
    • # of Updates & Vulnerabilities
    • Platform Number of Updates and Vulnerabilities
    • - ------------------------ -------------------------------------
    • Microsoft Office
    • 13 (#1)
    • Third Party Windows Apps
    • 10
    • Mac Os
    • 1 (#2)
    • Linux
    • 2
    • Cross Platform
    • 13 (#3, #4)
    • Web Application - Cross Site Scripting
    • 5
    • Web Application - SQL Injection
    • 12
    • Web Application
    • 24

******************** Sponsored By Sourcefire, Inc. **********************

Your Network Security Isn't Good Enough Anymore

Today's threats-and networks-are dynamic. Unfortunately most network security systems are not.

Join Martin Roesch, Founder and CTO of Sourcefire(r) and Creator of Snort®, in a series of seminars, as he shows why network security must include full network visibility, relevant context, and automated impact assessment to be effective.

More information http://www.sans.org/info/43543

*************************************************************************

TRAINING UPDATE - - SANSFIRE in Baltimore 6/13-6/20 (24 long courses, 12 short courses) http://www.sans.org/sansfire09/event.php - - New Orleans 5/5-5/10 (6 courses) http://www.sans.org/securityeast09/event.php - -- Plus San Diego, Amsterdam and more, too. See www.sans.org - - Looking for training in your own community? http://sans.org/community/ For a list of all upcoming events, on-line and live: www.sans.org

*************************************************************************

Table Of Contents
Part II -- Comprehensive List of Newly Discovered Vulnerabilities from Qualys (www.qualys.com)
Microsoft Office
Third Party Windows Apps
Mac Os
Linux
Cross Platform
Web Application - Cross Site Scripting
Web Application - SQL Injection
Web Application

************************* Sponsored Link: ****************************

1) Zscaler EDUCATIONAL WEBCAST: Keynote by GARTNER'S Peter Firstbrook, "Newer Threats and Newer Defenses against Web 2.0" http://www.sans.org/info/43548

*************************************************************************

PART I Critical Vulnerabilities

Part I for this issue has been compiled by Rob King at TippingPoint, a division of 3Com, as a by-product of that company's continuous effort to ensure that its intrusion prevention products effectively block exploits using known vulnerabilities. TippingPoint's analysis is complemented by input from a council of security managers from twelve large organizations who confidentially share with SANS the specific actions they have taken to protect their systems. A detailed description of the process may be found at http://www.sans.org/newsletters/cva/#process

Widely Deployed Software
  • (3) CRITICAL: Apple Safari Multiple Vulnerabilities
  • Affected:
    • Apple Safari versions prior to 3.2.3
    • Apple Safari 4 Beta versions prior to 5528.17

  • Description: Safari is Apple's web browser for Apple Mac OS X and Microsoft Windows. It contains multiple vulnerabilities in its handling of a variety of web page and scripting constructs. A specially crafted web page or script could trigger one of these vulnerabilities, leading to a variety of exploitable conditions. Successfully exploiting one of these vulnerabilities would allow an attacker to execute arbitrary code with the privileges of the current user. As portions of Safari are open source, full technical details for these vulnerabilities are publicly available via source code analysis.

  • Status: Vendor confirmed, updates available.

  • References:
Part II: Weekly Comprehensive List of Newly Discovered Vulnerabilities
Week 20, 2009

This list is compiled by Qualys ( www.qualys.com ) as part of that company's ongoing effort to ensure its vulnerability management web service tests for all known vulnerabilities that can be scanned. As of this week Qualys scans for 5549 unique vulnerabilities. For this special SANS community listing, Qualys also includes vulnerabilities that cannot be scanned remotely.

  • 09.20.1 - CVE: CVE-2009-0222
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Sound Data (CVE-2009-0222) Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code execution issue. This issue is caused by an error that occurs when the application parses PowerPoint 4.0 files. Specifically, memory may become corrupted when handling sound data included in a specially crafted ".ppt" file.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx
  • 09.20.2 - CVE: CVE-2009-0220
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Paragraph Data Remote Code Execution
  • Description: Microsoft PowerPoint is prone to a remote code execution vulnerability. This issue is caused by an error that occurs when the application parses PowerPoint 4.0 files. Specifically, memory may become corrupted when handling paragraph data included in a specially crafted ".ppt" file. Ref: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=790
  • 09.20.3 - CVE: CVE-2009-0223
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Sound Data (CVE-2009-0223) Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code execution issue. This issue is caused by an error that occurs when the application parses PowerPoint 4.0 files. Specifically, memory may become corrupted when handling sound data included in a specially crafted ".ppt" file.
  • Ref: http://www.securityfocus.com/archive/1/503457
  • 09.20.4 - CVE: CVE-2009-0221
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Invalid Record Type Integer Overflow
  • Description: Microsoft PowerPoint is exposed to an integer overflow issue. This issue occurs when handling PowerPoint files containing an invalid record type. An attacker could exploit this issue by enticing a victim to open a malicious PowerPoint file.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx
  • 09.20.5 - CVE: CVE-2009-1128
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Sound Data (CVE-2009-1128) Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code execution issue caused by an error when the application parses PowerPoint 95-formatted files. Specifically, the application's memory becomes corrupted when handling maliciously constructed sound data included in a ".ppt" file. Ref: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=792
  • 09.20.6 - CVE: CVE-2009-1129
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Sound Data (CVE-2009-1129) Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code execution issue caused by an error when the application parses PowerPoint 95-formatted files. Specifically, the application's memory becomes corrupted when handling maliciously constructed sound data included in a ".ppt" file.
  • Ref: http://www.securityfocus.com/archive/1/503460
  • 09.20.7 - CVE: CVE-2009-1130
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Notes Container Heap Memory Corruption Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code execution issue caused by an error when the application parses PowerPoint data files. Specifically, heap memory becomes corrupted when the application handles maliciously constructed 'Notes containers' included in a ".ppt" file. This may overwrite a function pointer that is later used by the "mso.dll" library.
  • Ref: http://www.securityfocus.com/archive/1/503454
  • 09.20.8 - CVE: CVE-2009-1131
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Data Out of Bounds Remote Stack Buffer Overflow Vulnerabilities
  • Description: Microsoft PowerPoint is exposed to multiple remote stack-based buffer overflow issues caused by errors when the application parses PowerPoint data files. Specifically, the application's memory becomes corrupted when handling excessive data included in a ".ppt" file.
  • Ref: http://www.securityfocus.com/archive/1/503451
  • 09.20.9 - CVE: CVE-2009-1137
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Sound Data (CVE-2009-1137) Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code execution issue caused by an error when the application parses PowerPoint 4.0-formatted files. Specifically, the application's memory becomes corrupted when handling maliciously constructed sound data included in a ".ppt" file.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx
  • 09.20.10 - CVE: CVE-2009-0224
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Invalid Record Type Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code execution issue caused by an error that can occur when the application parses PowerPoint files. Specifically, memory can become corrupted when handling specially crafted ".ppt" files that contain an invalid record type.
  • Ref: http://www.securityfocus.com/archive/1/503470
  • 09.20.11 - CVE: CVE-2009-0225
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Sound Data (CVE-2009-0225) Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code execution issue caused by an error that occurs when the application parses PowerPoint 95-formatted files. Specifically, memory may become corrupted when handling sound data included in a specially crafted ".ppt" file.
  • Ref: http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx
  • 09.20.12 - CVE: CVE-2009-0226
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Sound Data (CVE-2009-0226) Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code-execution issue. This issue is caused by an error that occurs when the application parses PowerPoint 4.0 files. Specifically, memory may become corrupted when handling sound data included in a specially crafted ".ppt" file.
  • Ref: http://www.securityfocus.com/archive/1/503458
  • 09.20.13 - CVE: CVE-2009-0227
  • Platform: Microsoft Office
  • Title: Microsoft PowerPoint Sound Data (CVE-2009-0227) Remote Code Execution
  • Description: Microsoft PowerPoint is exposed to a remote code execution issue that occurs when the application parses PowerPoint 4.0 files. Specifically, memory may become corrupted when handling sound data included in a specially crafted ".ppt" file.
  • Ref: http://www.securityfocus.com/archive/1/503456
  • 09.20.14 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: Multiple Mini-stream Software Products ".ram" File Remote Stack Buffer Overflow
  • Description: Mini-stream Software provides multimedia applications for Microsoft Windows platforms. Multiple Mini-stream Software products are exposed to a remote stack-based buffer overflow issue because they fail to perform adequate checks on user-supplied input. Specifically, this issue occurs when opening a ".ram" file that contains an excessively long "rtsp://" URI string. RM-MP3 Converter version 3.0.0.7, Ripper version 3.0.1.1, ASX to MP3 Converter version 3.0.0.7 and RM Downloader version 3.0.0.9 is affected.
  • Ref: http://www.securityfocus.com/bid/34860
  • 09.20.15 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: Sorinara Soritong MP3 Player ".m3u" File Remote Stack Buffer Overflow
  • Description: Soritong MP3 Player is a multimedia player available for Microsoft Windows. The application is exposed to a remote stack-based buffer overflow issue because it fails to perform adequate checks on user-supplied input. Specifically, this issue occurs when opening an ".m3u" playlist file that contains excessive data. Soritong MP3 Player version 1.0 is affected.
  • Ref: http://www.securityfocus.com/bid/34863
  • 09.20.16 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: BaoFeng Storm ActiveX Control "SetAttributeValue()" Buffer Overflow
  • Description: BaoFeng Storm is a multimedia player. The ActiveX control is exposed to a buffer overflow issue because it fails to perform adequate boundary checks on user-supplied input. An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer).
  • Ref: http://www.cisrt.org/enblog/read.php?245
  • 09.20.17 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: Chinagames ActiveX Control "CreateChinagames()" Buffer Overflow
  • Description: Chinagames is an online game center. The ActiveX control is exposed to a stack-based buffer overflow issue because it fails to perform adequate boundary checks on user-supplied input. An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer).
  • Ref: http://www.cisrt.org/enblog/read.php?245
  • 09.20.18 - CVE: CVE-2009-0194
  • Platform: Third Party Windows Apps
  • Title: Garmin Communicator Plugin "npGarmin.dll" Security Bypass
  • Description: Garmin Communicator Plugin is a browser plugin for sending and retrieving data from Garmin GPS devices. The application is exposed to a security-bypass issue caused by a synchronization error in "npGarmin.dll". Garmin Communicator Plugin version 2.6.4.0 is affected.
  • Ref: http://www.securityfocus.com/archive/1/503319
  • 09.20.19 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: URUWorks ViPlay3 ".vpl" File Remote Buffer Overflow
  • Description: ViPlay3 is a multimedia player available for Microsoft Windows. The application is exposed to a remote buffer overflow issue because it fails to perform adequate checks on user-supplied input. ViPlay versions 3 3.0 and earlier are affected.
  • Ref: http://www.securityfocus.com/bid/34877
  • 09.20.20 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: Dafolo DafoloControl ActiveX Control Multiple Remote Buffer Overflow Vulnerabilities
  • Description: DafoloControl is an ActiveX control. The control is exposed to multiple remote buffer overflow issues because it fails to perform adequate boundary checks on user-supplied data. Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). DafoloControl ActiveX control version 1.108.6.195 is affected.
  • Ref: http://www.securityfocus.com/bid/34900
  • 09.20.21 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: Mereo Remote File Disclosure
  • Description: Mereo is an HTTP server available for Microsoft Windows. The application is exposed to a file disclosure vulnerability because it fails to properly validate user-supplied input. An attacker can request an arbitrary local file via TCP port 80. Mereo version 1.8.0 is affected.
  • Ref: http://www.securityfocus.com/bid/34902
  • 09.20.22 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: CycloMedia CycloScopeLite ActiveX Control Multiple Memory Corruption Vulnerabilities
  • Description: CycloMedia CycloScopeLite is an ActiveX control. The application is exposed to multiple memory corruption issues that affect the "CM_ADOConnection.dll", "CM_AddressInfoDBC.dll", and "CM_RecordingLocationDBC.dll" files when processing the "ReturnConnection()" method and can be exploited to dereference an invalid object. CycloMedia CycloScopeLite version 2.50.3.0 is affected.
  • Ref: http://www.securityfocus.com/bid/34912
  • 09.20.23 - CVE: Not Available
  • Platform: Third Party Windows Apps
  • Title: CastRipper ".m3u" File Remote Stack Buffer Overflow
  • Description: CastRipper is an audio stream ripper/grabber available for Microsoft Windows. The application is exposed to a remote stack-based buffer overflow issue because it fails to perform adequate checks on user-supplied input. Specifically, this issue occurs when opening a ".m3u" playlist file that contains excessive data. CastRipper version 2.50.70 is affected.
  • Ref: http://www.securityfocus.com/bid/34915
  • 09.20.24 - CVE: CVE-2009-0154, CVE-2009-0144, CVE-2009-0157,CVE-2009-0145, CVE-2009-0155, CVE-2009-0150, CVE-2009-0149,CVE-2009-0942, CVE-2009-0943, CVE-2009-0152, CVE-2009-0153,CVE-2009-1517, CVE-2009-0156, CVE-2009-0160, CVE-2009-0010,CVE-2009-0944, CVE-2009-0158,
  • Platform: Mac Os
  • Title: Apple Mac OS X 2009-002 Multiple Security Vulnerabilities
  • Description: Apple Mac OS X is exposed to multiple security issues that have been addressed in Security Update 2009-002. The security update addresses new vulnerabilities that affect Apple Type Services, CFNetwork, CoreGraphics, Disk Images, Help Viewer, iChat, ICU, Kernel, Launch Services, QuickDraw Manager, and Spotlight components of Mac OS X.
  • Ref: http://www.securityfocus.com/bid/34926
  • 09.20.25 - CVE: Not Available
  • Platform: Linux
  • Title: coccinelle Insecure Temporary File Creation
  • Description: coccinelle is a framework for the Linux device driver evolution. The application creates temporary files in an insecure manner. This issue occur when creating result files in the "/tmp" directory. coccinelle Versions prior to 0.1.7 are affected.
  • Ref: http://www.directadmin.com/features.php?id=968
  • 09.20.26 - CVE: Not Available
  • Platform: Linux
  • Title: GNOME Evolution "~/.evolution/mail/local" File Permission
  • Description: GNOME Evolution is an email, address book, and calendar application for users of the GNOME desktop. The application is exposed to a file permission security issue. Specifically, local mail folders under the "~/.evolution/mail/local" path have a "0755" mode, which permits local attackers to read local email messages. GNOME Evolution version 2.24.5 is affected.
  • Ref: https://bugzilla.redhat.com/show_bug.cgi?id=498648
  • 09.20.27 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Multiple F-Secure Products RAR/ZIP Files Scan Evasion
  • Description: F-Secure develops antivirus, antispyware, and firewalling products. Multiple F-Secure products are exposed to an issue that may allow certain compressed archives to bypass the scan engine. The vulnerability occurs because the software fails to properly inspect specially crafted "RAR" and "ZIP" archive files. Ref: http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2009-1.html
  • 09.20.28 - CVE: CVE-2009-1441, CVE-2009-1442
  • Platform: Cross Platform
  • Title: Google Chrome Multiple Security Vulnerabilities
  • Description: Google Chrome is a web browser for Microsoft Windows. The application is exposed to multiple issues. An attacker can exploit these issues to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial of service condition. Google Chrome versions prior to 1.0.154.64 are affected.
  • Ref: http://code.google.com/p/chromium/issues/detail?id=10869
  • 09.20.29 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Sorinara Streaming Audio Player ".pla" File Remote Stack Buffer Overflow
  • Description: Sorinara Streaming Audio Player is a multimedia player available for Microsoft Windows. The application is exposed to a remote stack-based buffer overflow issue because it fails to perform adequate checks on user-supplied input. Specifically, this issue occurs when opening an extended ".pla" file that contains excessive data. Sorinara Streaming Audio Player version 0.9 is affected.
  • Ref: http://www.securityfocus.com/bid/34861
  • 09.20.30 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Multiple Mini-stream Software Products ".asx" File Remote Stack Buffer Overflow
  • Description: Mini-stream Software provides multimedia applications for Microsoft Windows platforms. Multiple Mini-stream Software products are exposed to a remote stack-based buffer overflow issue because they fail to perform adequate checks on user-supplied input. The vulnerability occurs when handling ".asx" files. RM-MP3 Converter version 3.0.0.7, Ripper version 3.0.1.1 and ASX to MP3 Converter version 3.0.0.7 is affected.
  • Ref: http://www.securityfocus.com/bid/34860
  • 09.20.31 - CVE: CVE-2009-1194
  • Platform: Cross Platform
  • Title: Pango "pango_glyph_string_set_size()" Integer Overflow
  • Description: Pango is a library for laying out and rendering text. Pango is exposed to an integer overflow issue because it fails to perform adequate boundary checks on user-supplied data before using them to allocate memory buffers. This issue is due to a multiplication error in the "pango_glyph_string_set_size()" function, which may result in a heap-overflow. Pango versions prior to 1.2.4 are affected.
  • Ref: http://www.ocert.org/advisories/ocert-2009-001.html
  • 09.20.32 - CVE: Not Available
  • Platform: Cross Platform
  • Title: PHP "mb_ereg_replace()" String Evaluation
  • Description: PHP is a general-purpose scripting language that is especially suited for web development and can be embedded into HTML. The "mb_ereg_replace()" function is for regular-expression replacement with multibyte support. The "mb_ereg_replace()" function of PHP is exposed to an issue that can result in the improper evaluation of user-supplied input.
  • Ref: http://www.milw0rm.com/exploits/8641
  • 09.20.33 - CVE: Not Available
  • Platform: Cross Platform
  • Title: SF OpenSC "pkcs11-tool" Inseure Key Generation Vulnerability
  • Description: OpenSC is an application for managing smartcards; it is available for Linux, Mac OS X, and Windows. OpenSC is exposed to a security issue that may result in users generating an insecure RSA public key. This issue is due to a design error in the "pkcs11-tool" module. OpenSC version 0.11.7 and the SVN trunk are affected. Ref: http://www.opensc-project.org/pipermail/opensc-announce/2009-May/000025.html
  • 09.20.34 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Multiple F-PROT Products CAB File Scan Evasion
  • Description: F-PROT develops a range of antivirus products. Multiple F-PROT products are exposed to an issue that may allow certain compressed archives to bypass the scan engine. The issue occurs because the software fails to properly inspect specially crafted ".CAB" files.
  • Ref: http://blog.zoller.lu/2009/04/advisory-f-prot-frisk-cab-bypass.html
  • 09.20.35 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Microchip MPLAB IDE ".mcp" File Handling Remote Buffer Overflow
  • Description: MPLAB IDE is an Integrated Development Environment for applications employing Microchip chipsets. The application is exposed to a remote buffer overflow issue because it fails to perform adequate checks on user-supplied input. Specifically, this issue occurs when handling a ".mcp" file that contains excessive data in fields such as "[FILE_INFO]" and "[CAT_FILTERS]". MPLAB IDE version 8.30 is affected.
  • Ref: http://www.securityfocus.com/archive/1/503400
  • 09.20.36 - CVE: Not Available
  • Platform: Cross Platform
  • Title: TYPSoft FTP Server "ABORT" Command Remote Denial of Service
  • Description: TYPSoft FTP Server is an FTP server for Microsoft Windows. The application is exposed to a denial of service issue when handling a malformed "ABORT" command. TYPSoft FTP Server version 1.11 is affected.
  • Ref: http://www.securityfocus.com/bid/34901
  • 09.20.37 - CVE: CVE-2009-1464, CVE-2009-1465, CVE-2009-1466
  • Platform: Cross Platform
  • Title: A-A-S Application Access Server Multiple Vulnerabilities
  • Description: A-A-S Application Access Server is an application that allows remote computer administration. The application is exposed to multiple issues. Attackers can exploit these issues to run privileged commands on the affected computer and gain unauthorized administrative access to the affected application and the underlying system. A-A-S Application Access Server version 2.0.48 is affected.
  • Ref: http://www.syhunt.com/?section=resources.advisories&id=aas-multiple
  • 09.20.38 - CVE: CVE-2009-0945
  • Platform: Cross Platform
  • Title: Apple Safari WebKit SVGList Objects Remote Memory Corruption Vulnerabilities
  • Description: WebKit is a browser framework used in the Apple Safari browser and other applications. Safari is exposed to a remote memory corruption issue that resides in WebKit. Specifically, the application fails to handle specially crafted SVGList objects.
  • Ref: http://www.securityfocus.com/bid/34924
  • 09.20.39 - CVE: CVE-2009-0162
  • Platform: Cross Platform
  • Title: Apple Safari "feed:" URI Multiple Input Validation Vulnerabilities
  • Description: Apple Safari is a browser for multiple operating platforms. Safari is exposed to multiple input validation issues that occur because of the application's handling of "feed:" URIs. Apple Safari versions prior to Safari 3.2.3 are affected.
  • Ref: http://www.securityfocus.com/bid/34925
  • 09.20.40 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: Verlihub Control Panel Multiple Cross-Site Scripting Vulnerabilities
  • Description: Verlihub Control Panel is a web-based administration panel for Verlihub. The application is exposed to multiple cross-site scripting issues because it fails to properly sanitize user-supplied input to the "index.html" script and the "nick" parameter of the "index.php" script. Verlihub Control Panel version 1.7e is affected.
  • Ref: http://www.securityfocus.com/bid/34856
  • 09.20.41 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: Claroline "claroline/linker/notfound.php" Cross-Site Scripting
  • Description: Claroline is an e-learning content manager implemented in PHP. The application is exposed to a cross-site scripting issue because it fails to properly handle user-supplied input to the "Referer" header parameter of the "claroline/linker/notfound.php" script. Claroline version 1.8.11 is affected. Ref: http://forum.claroline.net/viewtopic.php?f=69&t=16193&p=42102#p42099
  • 09.20.42 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: Sun GlassFish Enterprise and Sun Java System Application Server Cross-Site Scripting Vulnerabilities
  • Description: Sun GlassFish Enterprise Server and Sun Java System Application Server are web application frameworks. The applications are exposed to multiple cross-site scripting issues because they fail to sufficiently sanitize user-supplied data. Sun GlassFish Enterprise Server version 2.1 and Sun Java System Application Server Platform Edition version 9.1 are affected.
  • Ref: http://sunsolve.sun.com/search/document.do?assetkey=1-66-258528-1
  • 09.20.43 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: Microsoft Internet Explorer UTF-7 Cross-Site Scripting
  • Description: Microsoft Internet Explorer is exposed to a cross-site scripting issue that occurs because the application fails to properly sanitize UTF-7 characters. An attacker can exploit this issue by tricking a victim into viewing a malicious web page. Microsoft Internet Explorer 8 is affected.
  • Ref: http://www.securityfocus.com/archive/1/503440
  • 09.20.44 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: Open Virtual Desktop Multiple Cross Site Scripting Vulnerabilities
  • Description: Open Virtual Desktop is an open source virtual desktop and an application delivery solution. The application is exposed to multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied data. Open Virtual Desktop version 1.0 is affected.
  • Ref: http://www.securityfocus.com/bid/34927
  • 09.20.45 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: Almond Classifieds Component for Joomla! "id" Parameter SQL Injection
  • Description: Almond Classifieds Component for Joomla! is a plugin for the Joomla! content manager. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "id" parameter of the "com_aclassf" component before using it an SQL query. Almond Classifieds Component for Joomla! version 5.6.2 is affected.
  • Ref: http://www.securityfocus.com/bid/34843
  • 09.20.46 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: SilverStripe "AjaxUniqueTextField" Parameter SQL Injection
  • Description: SilverStripe is a PHP-based content manager. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data related to the "AjaxUniqueTextField". SilverStripe versions prior to 2.3.3-rc2 are affected.
  • Ref: http://www.securityfocus.com/bid/34852
  • 09.20.47 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: webSPELL "getlang.php" SQL Injection
  • Description: WebSPELL is a gaming CMS implemented in PHP. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "page" parameter of the "getlang.php" script. webSPELL versions prior to 4.2.0f are affected.
  • Ref: http://www.securityfocus.com/bid/34862
  • 09.20.48 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: ST-Gallery "example.php" Multiple SQL Injection Vulnerabilities
  • Description: ST-Gallery is a web-based gallery application. The application is exposed to multiple SQL injection issues because it fails to sufficiently sanitize user-supplied data to the "gallery_category", and "gallery_show" parameters of the "example.php" script before using it in an SQL query. ST-Gallery version 0.1 alpha is affected.
  • Ref: http://www.securityfocus.com/archive/1/503332
  • 09.20.49 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: Recipe Script "admin/index.php" Multiple SQL Injection Vulnerabilities
  • Description: Recipe Script is a web-based application. The application is exposed to multiple SQL injection issues because it fails to sufficiently sanitize user-supplied data to the "Username" and "Password" textboxes when logging in to the application through the "admin/index.php" script.
  • Ref: http://www.securityfocus.com/bid/34885
  • 09.20.50 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: Realty Web-Base "admin/admin.php" Multiple SQL Injection Vulnerabilities
  • Description: Realty Web-Base is a web-based application implemented in PHP. The application is exposed to multiple SQL injection issues because it fails to sufficiently sanitize user-supplied data to the "User" and "Password" textboxes when logging in to the application through the "admin/admin.php" script.
  • Ref: http://www.securityfocus.com/bid/34886
  • 09.20.51 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: RTWebalbum "AlbumId" Parameter SQL Injection
  • Description: RTWebalbum is a web-based photo album application. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "AlbumId" parameter of the "index.php" script before using it in an SQL query. RTWebalbum version 1.0.462 is affected.
  • Ref: http://www.securityfocus.com/archive/1/503374
  • 09.20.52 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: LuxBum "manager.php" Multiple SQL Injection Vulnerabilities
  • Description: LuxBum is a web-based application for sharing photos and videos. The application is exposed to multiple SQL injection issues because it fails to sufficiently sanitize user-supplied data to the "Username" and "Password" parameters when logging in to the application through the "manager.php" script. LuxBum version 0.5.5/stable is affected.
  • Ref: http://www.securityfocus.com/bid/34889
  • 09.20.53 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: b2evolution Starrating Plugin Multiple SQL Injection Vulnerabilities
  • Description: Starrating is a plugin for b2evolution. The application is exposed to multiple SQL injection issues because it fails to sufficiently sanitize user-supplied data to unspecified parameters. Starrating versions prior to 0.7.7 are affected.
  • Ref: http://www.securityfocus.com/bid/34899
  • 09.20.54 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: MicroTopic "rating" Parameter SQL Injection
  • Description: MicroTopic is a web-based application implemented in PHP. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "rating" parameter of the "index.php" script before using it in an SQL query. MicroTopic versions prior to 1.01 are affected.
  • Ref: http://www.securityfocus.com/bid/34908
  • 09.20.55 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: BigACE "username" Parameter SQL Injection
  • Description: BigACE is a content manager. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "username" parameter of the "index.php" script. BigACE versions prior to 2.6 are affected.
  • Ref: http://www.securityfocus.com/archive/1/503448
  • 09.20.56 - CVE: CVE-2008-6780
  • Platform: Web Application - SQL Injection
  • Title: SFS EZ Affiliate "cat_id" Parameter SQL Injection
  • Description: SFS EZ Affiliate is a web-based application. The application is exposed to an SQL-injection issue because it fails to sufficiently sanitize user-supplied data to the "cat_id" parameter of the "directory.php" script before using it in an SQL query.
  • Ref: http://www.securityfocus.com/bid/34923
  • 09.20.57 - CVE: CVE-2008-6752
  • Platform: Web Application
  • Title: ReVou "adminlogin/password.php" Remote Password Change
  • Description: ReVou is a microblogging application. The application is exposed to an issue that may permit attackers to change the password of arbitrary administrator users. The issue occurs because the application fails to validate the session before changing passwords.
  • Ref: http://www.securityfocus.com/bid/34851
  • 09.20.58 - CVE: Not Available
  • Platform: Web Application
  • Title: Kayako SupportSuite Ticket Notes HTML Injection
  • Description: Kayako SupportSuite is a web-based support suite. The application is exposed to an HTML injection issue because it fails to sufficiently sanitize user-supplied input. Specifically, this issue affects data submitted in the "Ticket Notes" field of newly created support tickets. SupportSuite version 3.04.10 is affected.
  • Ref: http://www.securityfocus.com/archive/1/503311
  • 09.20.59 - CVE: CVE-2009-1461
  • Platform: Web Application
  • Title: razorCMS "Create New Page" Form HTML Injection
  • Description: razorCMS is a PHP-based content manager. The application is exposed to an HTML-injection issue because it fails to sufficiently sanitize user-supplied input. Specifically, this issue affects data submitted in the "Page Title" field of the "Create New Page" form. razorCMS version 0.3 RC2 is affected.
  • Ref: http://marc.info/?l=full-disclosure&m=123998062108561&w=2
  • 09.20.60 - CVE: Not Available
  • Platform: Web Application
  • Title: FreePBX Multiple Cross-Site Scripting and Information Disclosure Vulnerabilities
  • Description: FreePBX is a web-based configuration tool for the open-source Asterisk PBX. The application is prone to multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied input. The application is also exposed to an information disclosure issue that may allow remote attackers to enumerate valid usernames. This issue arises because the application returns different error messages depending on valid or invalid usernames supplied in unsuccessful login attempts. FreePBX versions 2.4, 2.5 and trunk are affected.
  • Ref: http://www.securityfocus.com/bid/34857
  • 09.20.61 - CVE: Not Available
  • Platform: Web Application
  • Title: Techno Dreams Job Career Package Cookie Authentication Bypass
  • Description: Techno Dreams Job Career Package is an ASP-based web application. The application is exposed to an authentication bypass issue because it fails to adequately verify user-supplied input used for cookie-based authentication. Job Career Package version 3.0 is affected.
  • Ref: http://www.securityfocus.com/bid/34865
  • 09.20.62 - CVE: Not Available
  • Platform: Web Application
  • Title: TCPDB "user/index.php" Authentication Bypass
  • Description: TCPDB is a PHP-based application for tracking IP addresses and hosts. The application is exposed to an issue that lets attackers add an administrative user because it fails to adequately secure access to administrative functions of the "user/index.php" script. TCPDB version 3.8 is affected.
  • Ref: http://www.securityfocus.com/bid/34866
  • 09.20.63 - CVE: Not Available
  • Platform: Web Application
  • Title: VideoScript.us YouTube Video Script "admin/index.php" Multiple SQL Injection Vulnerabilities
  • Description: VideoScript.us YouTube Video Script is a web-based application. The application is exposed to multiple SQL injection vulnerabilities because it fails to sufficiently sanitize user-supplied data to the "Username" and "Password" textboxes when logging in to the application through the "admin/index.php" script.
  • Ref: http://www.securityfocus.com/bid/34868
  • 09.20.64 - CVE: Not Available
  • Platform: Web Application
  • Title: Simple Customer "profile.php" Remote Password Change
  • Description: Simple Customer is a PHP-based client tracking application. The application is exposed to an issue that may permit attackers to change the password of arbitrary administrator users. Attackers may exploit this issue by submitting an HTTP POST request containing malicious data to the "profile.php" script. Simple Customer version 1.3 is affected.
  • Ref: http://www.securityfocus.com/bid/34872
  • 09.20.65 - CVE: Not Available
  • Platform: Web Application
  • Title: JobScript "changepassword.php" Remote Password Change
  • Description: JobScript is a PHP-based job board application. The application is exposed to an issue that may permit attackers to change the password of arbitrary administrator users. Attackers may exploit this issue by submitting an HTTP POST request containing malicious data to the "changepassword.php" script. JobScript version 2.0 is affected.
  • Ref: http://www.securityfocus.com/bid/34874
  • 09.20.66 - CVE: Not Available
  • Platform: Web Application
  • Title: Battle Blog "uploadform.asp" Arbitrary File Upload
  • Description: Battle Blog is an ASP-based blogging application. The application is exposed to an issue that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input before uploading files via the "blog/admin/uploadform.asp". Battle Blog version 1.25 is affected.
  • Ref: http://www.securityfocus.com/bid/34887
  • 09.20.67 - CVE: Not Available
  • Platform: Web Application
  • Title: MagpieRSS Cross Site Scripting and HTML Injection Vulnerabilities
  • Description: MagpieRSS is a PHP-based RSS reader. The application is exposed to cross-site scripting and HTML-injection issues because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. MagpieRSS version 0.72 is affected.
  • Ref: http://lampsecurity.org/magpierss-vulnerability
  • 09.20.68 - CVE: Not Available
  • Platform: Web Application
  • Title: TinyWebGallery "/admin/_include/init.php" Local File Include
  • Description: TinyWebGallery is a web-based chat application implemented in PHP. The application is exposed to a local file include issue because it fails to properly sanitize user-supplied input to the "lang" parameter of the "/admin/_include/init.php" script. TinyWebGallery version 1.7.6 is affected.
  • Ref: http://www.tinywebgallery.com/forum/viewtopic.php?t=1653
  • 09.20.69 - CVE: Not Available
  • Platform: Web Application
  • Title: Drupal Taxonomy Vocabulary "Help text" HTML Injection
  • Description: Taxonomy is a PHP-based Drupal component used to organize content. It is part of Drupal Core, and is enabled by default. The application is exposed to an HTML-injection issue because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Drupal version 5.17 is affected.
  • Ref: http://lampsecurity.org/drupal-taxonomy-vulnerability
  • 09.20.70 - CVE: Not Available
  • Platform: Web Application
  • Title: SKIP Unspecified SQL Injection and Cross-Site Scripting Vulnerabilities
  • Description: SKIP is a web-based application. The application is exposed to an SQL injection issue and a cross-site scripting issue because it fails to sufficiently sanitize user-supplied data to unspecified parameters. SKIP versions prior to 1.0.3 are affected.
  • Ref: http://www.securityfocus.com/bid/34898
  • 09.20.71 - CVE: Not Available
  • Platform: Web Application
  • Title: AjaxTerm "ajaxterm.js" Session Hijacking
  • Description: AjaxTerm is an open-source web-based terminal application. AjaxTerm is exposed to a session-hijacking issue that occurs because the application generates session IDs based on the "Math.random()" JavaScript function, which fails to provide sufficient entropy. This error occurs in the "ajaxterm.js" script file. AjaxTerm version 0.10 is affected.
  • Ref: http://www.securityfocus.com/bid/34903
  • 09.20.72 - CVE: Not Available
  • Platform: Web Application
  • Title: openWYSIWYG "addons/imagelibrary/select_image.php" Directory Traversal
  • Description: openWYSIWYG is a web-based editor implemented in PHP. The application is exposed to a directory traversal issue because it fails to sufficiently sanitize user-supplied input to the "dir" parameter of the "addons/imagelibrary/select_image.php" script. openWYSIWYG version 1.4.7 is affected.
  • Ref: http://www.securityfocus.com/bid/34904
  • 09.20.73 - CVE: Not Available
  • Platform: Web Application
  • Title: Dacio's Image Gallery Multiple Remote Vulnerabilities
  • Description: Dacio's Image Gallery is a PHP-based web application. The application is exposed to multiple remote issues. Attackers can exploit these issues to upload and execute arbitrary script code on an affected computer with the privileges of the web server process, view arbitrary local files, or gain unauthorized access to the affected application. Dacio's Image Gallery version 1.6 is affected.
  • Ref: http://www.securityfocus.com/bid/34906
  • 09.20.74 - CVE: Not Available
  • Platform: Web Application
  • Title: EasyPHP "lang" Parameter Arbitrary File Overwrite
  • Description: EasyPHP is an application bundle providing an Apache web server, a MySQL database, phpMyAdmin, and other tools. It is available for Microsoft Windows platforms. EasyPHP is exposed to an issue that could permit an attacker to overwrite arbitrary files within the context of the webserver process. This issue occurs because the application fails to sanitize user-supplied input to the "lang" parameter of the "i18n.inc" script. EasyPHP version 2.0 is affected.
  • Ref: http://www.securityfocus.com/bid/34908
  • 09.20.75 - CVE: Not Available
  • Platform: Web Application
  • Title: Php Recommend "admin.php" Multiple Remote Vulnerabilities
  • Description: Php Recommend is a web application implemented in PHP. The application is exposed to the multiple remote issues. Attackers may exploit these issues to gain unauthorized access to the affected application, or to inject and execute arbitrary malicious PHP code in the context of the webserver process. Php Recommend version 1.3 is affected.
  • Ref: http://www.securityfocus.com/bid/34909
  • 09.20.76 - CVE: Not Available
  • Platform: Web Application
  • Title: Bitweaver Multiple Input Validation Vulnerabilities
  • Description: Bitweaver is a web application framework and content manager. Bitweaver is exposed to multiple input-validation issues because the application fails to sufficiently sanitize user-supplied. Bitweaver versions 2.6 and earlier are affected.
  • Ref: http://www.securityfocus.com/bid/34910
  • 09.20.77 - CVE: Not Available
  • Platform: Web Application
  • Title: openWYSIWYG "addons/imagelibrary/insert_image.php" Arbitrary File Upload
  • Description: openWYSIWYG is a web-based editor implemented in PHP. The application is exposed to an issue that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input in the form of file names with double extensions when uploading files via "addons/imagelibrary/insert_image.php". openWYSIWYG version 1.4.7 is affected.
  • Ref: http://www.securityfocus.com/bid/34913
  • 09.20.78 - CVE: Not Available
  • Platform: Web Application
  • Title: Smarty Template Engine "function.math.php" Security Bypass
  • Description: Smarty Template Engine is a template-based content manager. Smarty Template Engine is exposed to a security bypass issue because it fails to adequately sanitize user-supplied input. This issue occurs because the "smarty_function_math()" function in the "libs/plugins/function.math.php" source file does not properly sanitize input before using it in an "eval()" system call. Smarty Template Engine version 2.6.22 for Windows is affected.
  • Ref: http://www.securityfocus.com/bid/34918
  • 09.20.79 - CVE: CVE-2009-1578, CVE-2009-1579, CVE-2009-1580,CVE-2009-1581
  • Platform: Web Application
  • Title: SquirrelMail Prior to 1.4.18 Multiple Vulnerabilities
  • Description: SquirrelMail is a web-based email client. The application is exposed to multiple issues. Attackers may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user, to hijack the session of a valid user, or to inject and execute arbitrary PHP code in the context of the webserver process. SquirrelMail versions prior to 1.4.18 are affected.
  • Ref: http://www.squirrelmail.org/security/issue/2009-05-10
  • 09.20.80 - CVE: Not Available
  • Platform: Web Application
  • Title: Dokeos Multiple Remote Input Validation Vulnerabilities
  • Description: Dokeos is a PHP-based application for online learning. Since it fails to adequately sanitize user-supplied input, Dokeos is exposed to multiple input validation issues including SQL injection, HTML injection, cross-site scripting and cross-site request forgery issues. Dokeos version 1.8.5 is affected.
  • Ref: http://holisticinfosec.org/content/view/112/45/

(c) 2009. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only. In some cases, copyright for material in this newsletter may be held by a party other than Qualys (as indicated herein) and permission to use such material must be requested from the copyright owner.

Subscriptions: @RISK is distributed free of charge by the SANS Institute to people responsible for managing and securing information systems and networks. You may forward this newsletter to others with such responsibility inside or outside your organization.

The SANS Security Windows track was the best training course I've ever had, far surpassing my already high expectations. Seriously!
-Derek Lidbom, Trone

AUD429@SANS 2010-sky

Contact us: (301) 654-SANS(7267)
Monday - Friday 9am-8pm EST/EDT