Weekly Vulnerabilities Reports > March 24 to 30, 2003

Overview

14 new vulnerabilities reported during this period, including 1 critical vulnerabilities and 8 high severity vulnerabilities. This weekly summary report vulnerabilities in 28 products from 17 vendors including MIT, Ximian, Microsoft, SUN, and IBM. Vulnerabilities are notably categorized as .

13 reported vulnerabilities are remotely exploitables.
13 reported vulnerabilities are exploitable by an anonymous user.
MIT has the most reported vulnerabilities, with 3 reported vulnerabilities.
Oracle has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES

CRITICAL RISK
VULNERABILITIES

HIGH RISK
VULNERABILITIES

MEDIUM RISK
VULNERABILITIES

LOW RISK
VULNERABILITIES

REMOTELY
EXPLOITABLE

LOCALLY
EXPLOITABLE

EXPLOIT
AVAILABLE

EXPLOITABLE
ANONYMOUSLY

AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

1 Critical Vulnerabilities

DATE	CVE	VENDOR	VULNERABILITY	CVSS
2003-03-24	CVE-2003-0150	Oracle	Privilege Escalation vulnerability in MySQL mysqld MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.	9.0

Expand/Hide

8 High Vulnerabilities

DATE	CVE	VENDOR	VULNERABILITY	CVSS
2003-03-25	CVE-2003-0028	GNU MIT Openafs SGI Cray Freebsd HP IBM Openbsd SUN	Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.	7.5
2003-03-24	CVE-2003-0151	BEA	Unspecified vulnerability in BEA Weblogic Server BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions, which allows remote attackers to read arbitrary files or execute arbitrary code.	7.5
2003-03-24	CVE-2003-0140	Mutt	Remote Folder Buffer Overrun vulnerability in Mutt UTF-7 Internationalized Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a crafted folder.	7.5
2003-03-24	CVE-2003-0139	MIT	Remote Security vulnerability in MIT Kerberos 4 Certain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for unauthorized principals using a cut-and-paste attack and "ticket splicing."	7.5
2003-03-24	CVE-2003-0138	MIT	Unspecified vulnerability in MIT Kerberos 4 Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack.	7.5
2003-03-24	CVE-2003-0131	Openssl	Unspecified vulnerability in Openssl The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."	7.5
2003-03-24	CVE-2003-0010	Microsoft	Heap Overflow vulnerability in Microsoft Windows Script Engine JScript.DLL Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.	7.5
2003-03-28	CVE-2003-1074	SUN	Local Privilege Elevation vulnerability in SUN Solaris 9.0 Unknown vulnerability in newtask for Solaris 9 allows local users to gain root privileges.	7.2

Expand/Hide

5 Medium Vulnerabilities

DATE	CVE	VENDOR	VULNERABILITY	CVSS
2003-03-24	CVE-2003-0156	Cross Referencer	Unspecified vulnerability in Cross Referencer LXR Directory traversal vulnerability in Cross-Referencing Linux (LXR) allows remote attackers to read arbitrary files via ..	5.0
2003-03-24	CVE-2003-0130	Ximian	Unspecified vulnerability in Ximian Evolution The handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allows remote attackers to inject arbitrary data and HTML via a MIME Content-ID header in a MIME-encoded image.	5.0
2003-03-24	CVE-2003-0129	Ximian	Denial of Service vulnerability in Ximian Evolution UUEncoding Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (memory consumption) via a mail message that is uuencoded multiple times.	5.0
2003-03-24	CVE-2003-0128	Ximian	Unspecified vulnerability in Ximian Evolution The try_uudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malicious uuencoded (UUE) header, possibly triggering a heap-based buffer overflow.	5.0
2003-03-24	CVE-2003-0011	Microsoft	Denial of Service vulnerability in Microsoft ISA Server 2000 Unknown vulnerability in the DNS intrusion detection application filter for Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service (blocked traffic to DNS servers) via a certain type of incoming DNS request that is not properly handled.	5.0

Expand/Hide

0 Low Vulnerabilities

DATE	CVE	VENDOR	VULNERABILITY	CVSS