Weekly Vulnerabilities Reports > September 23 to 29, 2002

Overview

40 new vulnerabilities reported during this period, including 1 critical vulnerabilities and 26 high severity vulnerabilities. This weekly summary report vulnerabilities in 38 products from 24 vendors including Microsoft, Caldera, PHP, Freebsd, and Apache. Vulnerabilities are notably categorized as .

  • 33 reported vulnerabilities are remotely exploitables.
  • 1 reported vulnerabilities have public exploit available.
  • 40 reported vulnerabilities are exploitable by an anonymous user.
  • Microsoft has the most reported vulnerabilities, with 19 reported vulnerabilities.
  • Caldera has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

1 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-09-24 CVE-2002-0988 Caldera Buffer Overflow vulnerability in Caldera Openunix and Unixware

Buffer overflow in X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1, possibly related to XBM/xkbcomp capabilities.

10.0

26 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-09-24 CVE-2002-1123 Microsoft Remote Buffer Overflow vulnerability in Microsoft Data Engine and SQL Server

Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow.

7.5
2002-09-24 CVE-2002-1122 ISS Buffer Overflow vulnerability in ISS Internet Scanner 6.2.1

Buffer overflow in the parsing mechanism for ISS Internet Scanner 6.2.1, when using the license banner HTTP check, allows remote attackers to execute arbitrary code via a long web server response.

7.5
2002-09-24 CVE-2002-1121 GFI
Network Associates
Roaring Penguin
Trend Micro
SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3) the default configuration of MIMEDefang before 2.21, and possibly other products, do not detect fragmented emails as defined in RFC2046 ("Message Fragmentation and Reassembly") and supported in such products as Outlook Express, which allows remote attackers to bypass content filtering, including virus checking, via fragmented emails of the message/partial content type.
7.5
2002-09-24 CVE-2002-1120 Savant Buffer Overflow vulnerability in Savant Webserver

Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.

7.5
2002-09-24 CVE-2002-0989 ROB Flynn Unspecified vulnerability in ROB Flynn Gaim

The URL handler in the manual browser option for Gaim before 0.59.1 allows remote attackers to execute arbitrary script via shell metacharacters in a link.

7.5
2002-09-24 CVE-2002-0985 PHP Unspecified vulnerability in PHP

Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g.

7.5
2002-09-24 CVE-2002-0984 Light Unspecified vulnerability in Light 2.7.30P4/2.8Pre9

The IRC script included in Light 2.7.x before 2.7.30p5, and 2.8.x before 2.8pre10, running EPIC allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code.

7.5
2002-09-24 CVE-2002-0982 Microsoft Remote Security vulnerability in Microsoft SQL Server 2000

Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MScopyscript stored procedure.

7.5
2002-09-24 CVE-2002-0980 Microsoft Unspecified vulnerability in Microsoft Internet Explorer 5.5/6.0

The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows remote attackers to execute arbitrary code by injecting it into the error message, then referring to the error message file via a mhtml: URL.

7.5
2002-09-24 CVE-2002-0979 Microsoft Unspecified vulnerability in Microsoft Virtual Machine

The Java logging feature for the Java Virtual Machine in Internet Explorer writes output from functions such as System.out.println to a known pathname, which can be used to execute arbitrary code.

7.5
2002-09-24 CVE-2002-0977 Microsoft Unspecified vulnerability in Microsoft File Transfer Manager

Buffer overflow in Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to execute arbitrary code via a long TS value.

7.5
2002-09-24 CVE-2002-0975 Microsoft Remote Buffer Overflow vulnerability in Microsoft DirectX Files Viewer ActiveX Control

Buffer overflow in Microsoft DirectX Files Viewer ActiveX control (xweb.ocx) 2.0.6.15 and earlier allows remote attackers to execute arbitrary via a long File parameter.

7.5
2002-09-24 CVE-2002-0970 KDE Unspecified vulnerability in KDE and Konqueror

The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.

7.5
2002-09-24 CVE-2002-0861 Microsoft Information Disclosure vulnerability in Microsoft Office web Components and Project

Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the "Allow paste operations via script" setting, even when it is disabled, via the (1) Copy method of the Cell object or (2) the Paste method of the Range object.

7.5
2002-09-24 CVE-2002-0834 Ethereal Group Denial-Of-Service vulnerability in Ethereal

Buffer overflow in the ISIS dissector for Ethereal 0.9.5 and earlier allows remote attackers to cause a denial of service or execute arbitrary code via malformed packets.

7.5
2002-09-24 CVE-2002-0727 Microsoft Unspecified vulnerability in Microsoft Office web Components and Project

The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands via the setTimeout method.

7.5
2002-09-24 CVE-2002-0726 Microsoft Buffer Overflow vulnerability in Microsoft TSAC ActiveX Control

Buffer overflow in Microsoft Terminal Services Advanced Client (TSAC) ActiveX control allows remote attackers to execute arbitrary code via a long server name field.

7.5
2002-09-24 CVE-2002-0724 Microsoft Unspecified vulnerability in Microsoft Windows 2000, Windows NT and Windows XP

Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of service (crash) via a SMB_COM_TRANSACTION packet with a request for the (1) NetShareEnum, (2) NetServerEnum2, or (3) NetServerEnum3, aka "Unchecked Buffer in Network Share Provider Can Lead to Denial of Service".

7.5
2002-09-24 CVE-2002-0723 Microsoft Unspecified vulnerability in Microsoft Internet Explorer 5.5/6.0

Microsoft Internet Explorer 5.5 and 6.0 does not properly verify the domain of a frame within a browser window, which allows remote attackers to read client files or invoke executable objects via the Object tag, aka "Cross Domain Verification in Object Tag."

7.5
2002-09-24 CVE-2002-0722 Microsoft Unspecified vulnerability in Microsoft Internet Explorer 5.01/5.5/6.0

Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to misrepresent the source of a file in the File Download dialogue box to trick users into thinking that the file type is safe to download, aka "File Origin Spoofing."

7.5
2002-09-24 CVE-2002-0691 Microsoft Unspecified vulnerability in Microsoft Internet Explorer 5.01/5.5

Microsoft Internet Explorer 5.01 and 5.5 allows remote attackers to execute scripts in the Local Computer zone via a URL that references a local HTML resource file, a variant of "Cross-Site Scripting in Local HTML Resource" as identified by CAN-2002-0189.

7.5
2002-09-24 CVE-2002-0647 Microsoft Unspecified vulnerability in Microsoft Internet Explorer 5.01/5.5/6.0

Buffer overflow in a legacy ActiveX control used to display specially formatted text in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code, aka "Buffer Overrun in Legacy Text Formatting ActiveX Control".

7.5
2002-09-24 CVE-2002-0376 Apple Buffer Overrun vulnerability in Apple Quicktime 5.0.2

Buffer overflow in Apple QuickTime 5.0 ActiveX component allows remote attackers to execute arbitrary code via a long pluginspage field.

7.5
2002-09-24 CVE-2002-1124 Purity Local Buffer Overflow vulnerability in Purity 1.14/1.15/1.9

Multiple buffer overflows in purity 1-16 allow local users to gain privileges and modify high scores tables.

7.2
2002-09-24 CVE-2002-0987 Caldera Unspecified vulnerability in Caldera Openunix and Unixware

X server (Xsco) in OpenUNIX 8.0.0 and UnixWare 7.1.1 does not drop privileges before calling programs such as xkbcomp using popen, which could allow local users to gain privileges.

7.2
2002-09-24 CVE-2002-0981 Caldera Buffer Overflow vulnerability in Caldera Openunix and Unixware

Buffer overflow in ndcfg command for UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to execute arbitrary code via a long command line.

7.2

11 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-09-24 CVE-2002-0976 Microsoft Unspecified vulnerability in Microsoft Internet Explorer

Internet Explorer 4.0 and later allows remote attackers to read arbitrary files via a web page that accesses a legacy XML Datasource applet (com.ms.xml.dso.XMLDSO.class) and modifies the base URL to point to the local system, which is trusted by the applet.

6.4
2002-09-25 CVE-2002-1593 Apache Unspecified vulnerability in Apache Http Server

mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.

5.0
2002-09-24 CVE-2002-0986 PHP Unspecified vulnerability in PHP

The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."

5.0
2002-09-24 CVE-2002-0983 Irssi Denial Of Service vulnerability in Irssi 0.8.4

IRC client irssi in irssi-text before 0.8.4 allows remote attackers to cause a denial of service (crash) via an IRC channel that has a long topic followed by a certain string, possibly triggering a buffer overflow.

5.0
2002-09-24 CVE-2002-0978 Microsoft Remote Security vulnerability in File Transfer Manager

Microsoft File Transfer Manager (FTM) ActiveX control before 4.0 allows remote attackers to upload or download arbitrary files to arbitrary locations via a man-in-the-middle attack with modified TGT and TGN parameters in a call to the "Persist" function.

5.0
2002-09-24 CVE-2002-0974 Microsoft Unspecified vulnerability in Microsoft Windows XP

Help and Support Center for Windows XP allows remote attackers to delete arbitrary files via a link to the hcp: protocol that accesses uplddrvinfo.htm.

5.0
2002-09-24 CVE-2002-0860 Microsoft Local File Read vulnerability in Microsoft Office web Components and Project

The LoadText method in the spreadsheet component in Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to read arbitrary files through Internet Explorer via a URL that redirects to the target file.

5.0
2002-09-24 CVE-2002-0648 Microsoft Unspecified vulnerability in Microsoft Internet Explorer 5.01/5.5/6.0

The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file.

5.0
2002-09-24 CVE-2002-0973 Freebsd Buffer Overflow vulnerability in FreeBSD System Call Signed Integer

Integer signedness error in several system calls for FreeBSD 4.6.1 RELEASE-p10 and earlier may allow attackers to access sensitive kernel memory via large negative values to the (1) accept, (2) getsockname, and (3) getpeername system calls, and the (4) vesa FBIO_GETPALETTE ioctl.

4.6
2002-09-24 CVE-2002-0972 Postgresql Unspecified vulnerability in Postgresql

Buffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of service and possibly execute arbitrary code via long arguments to the functions (1) lpad or (2) rpad.

4.6
2002-09-24 CVE-2002-0971 ATT
Tightvnc
Tridia
Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dialogue box.
4.6

2 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2002-09-24 CVE-2002-1126 Galeon
Mozilla
Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunload handler.
2.6
2002-09-24 CVE-2002-1125 Freebsd Unspecified vulnerability in Freebsd

FreeBSD port programs that use libkvm for FreeBSD 4.6.2-RELEASE and earlier, including (1) asmon, (2) ascpu, (3) bubblemon, (4) wmmon, and (5) wmnet2, leave open file descriptors for /dev/mem and /dev/kmem, which allows local users to read kernel memory.

2.1