Weekly Vulnerabilities Reports > March 29 to April 4, 2004

Overview

31 new vulnerabilities reported during this period, including 3 critical vulnerabilities and 10 high severity vulnerabilities. This weekly summary report vulnerabilities in 23 products from 21 vendors including Apple, SGI, IBM, Apache, and Photopost. Vulnerabilities are notably categorized as and "Cross-site Scripting".

  • 19 reported vulnerabilities are remotely exploitables.
  • 1 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 31 reported vulnerabilities are exploitable by an anonymous user.
  • Apple has the most reported vulnerabilities, with 7 reported vulnerabilities.
  • IBM has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

3 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2004-03-29 CVE-2003-1009 Apple Unspecified vulnerability in Apple mac OS X and mac OS X Server

Directory Services in Apple Mac OS X 10.0.2, 10.0.3, 10.2.8, 10.3.2 and Apple Mac OS X Server 10.2 through 10.3.2 accepts authentication server information from unknown LDAP or NetInfo sources as provided by a malicious DHCP server, which allows remote attackers to gain privileges.

10.0
2004-03-29 CVE-2003-0170 IBM Administrative Access vulnerability in IBM AIX 5.2

Unknown vulnerability in ftpd in IBM AIX 5.2, when configured to use Kerberos 5 for authentication, allows remote attackers to gain privileges via unknown attack vectors.

10.0
2004-03-30 CVE-2004-1875 Cpanel Cross-Site Scripting vulnerability in Cpanel 9.1.0R85

Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html.

9.3

10 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2004-03-29 CVE-2004-1870 Photopost Input Validation vulnerability in All Enthusiast Photopost PHP Pro

Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' passwords via the (1) photo parameter to addfav.php, (2) photo parameter to comments.php, (3) credit parameter to comments.php, (4) cat parameter to index.php, (5) ppuser parameter to showgallery.php, (6) cat parameter to showgallery.php, (7) cat parameter to uploadphoto.php, (8) albumid parameter to useralbums.php, or (9) albumid parameter to useralbums.php.

7.5
2004-03-29 CVE-2004-0194 Adobe Buffer Overflow vulnerability in Adobe Acrobat Reader 5.1

Stack-based buffer overflow in the OutputDebugString function for Adobe Acrobat Reader 5.1 allows remote attackers to execute arbitrary code via a PDF document with XML Forms Data Format (XFDF) data.

7.5
2004-03-29 CVE-2003-0993 Apache Unspecified vulnerability in Apache Http Server

mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.

7.5
2004-03-29 CVE-2003-0796 SGI Unspecified vulnerability in SGI Irix

Unknown vulnerability in rpc.mountd SGI IRIX 6.5.18 through 6.5.22 allows remote attackers to mount from unprivileged ports even with the -n option disabled.

7.5
2004-03-29 CVE-2003-0601 Apple Unspecified vulnerability in Apple mac OS X Server

Workgroup Manager in Apple Mac OS X Server 10.2 through 10.2.6 does not disable a password for a new account before it is saved for the first time, which allows remote attackers to gain unauthorized access via the new account before it is saved.

7.5
2004-03-29 CVE-2003-0444 Gtksee Unspecified vulnerability in Gtksee 0.5/0.5.1

Heap-based buffer overflow in GTKSee 0.5 and 0.5.1 allows remote attackers to execute arbitrary code via a PNG image of certain color depths.

7.5
2004-03-29 CVE-2004-0160 Synaesthesia Unspecified vulnerability in Synaesthesia

Synaesthesia 2.2 and earlier allows local users to execute arbitrary code via a symlink attack on the configuration file.

7.2
2004-03-29 CVE-2003-1018 IBM Local Format String vulnerability in IBM AIX 4.3.3/5.1/5.2

Format string vulnerability in enq command in AIX 4.3, 5.1, and 5.2 allows local users with rintq group privileges to gain privileges via unknown attack vectors.

7.2
2004-03-29 CVE-2003-1011 Apple Local Root Privilege Elevation vulnerability in MacOS X

Apple Mac OS X 10.0 through 10.2.8 allows local users with a USB keyboard to gain unauthorized access by holding down the CTRL and C keys when the system is booting, which crashes the init process and leaves the user in a root shell.

7.2
2004-03-29 CVE-2003-1006 Apple Local Buffer Overflow vulnerability in MacOSX CD9660.Util Probe For Mounting Argument

Buffer overflow in cd9660.util in Apple Mac OS X 10.0 through 10.3.2 and Apple Mac OS X Server 10.0 through 10.3.2 may allow local users to execute arbitrary code via a long command line parameter.

7.2

17 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2004-04-04 CVE-2004-1986 Coppermine
Francisco Burzi
Input Validation vulnerability in Coppermine Photo Gallery

Directory traversal vulnerability in modules.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to read arbitrary files via a ..

5.0
2004-04-02 CVE-2004-1890 SGI Denial Of Service vulnerability in SGI IRIX ftpd

Unknown vulnerability in ftpd in SGI IRIX 6.5.20 through 6.5.23 allows remote attackers to cause a denial of service (hang) via the PORT mode.

5.0
2004-03-30 CVE-2004-1878 Linbit Technologies Remote Authentication Bypass vulnerability in LinBit Technologies LINBOX Officeserver

LINBOX LIN:BOX allows remote attackers to bypass authentication, obtain sensitive information, or gain access via a direct request to admin/user.pl preceded by // (double leading slash).

5.0
2004-03-29 CVE-2004-0113 Apache Unspecified vulnerability in Apache Http Server

Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.

5.0
2004-03-29 CVE-2003-1007 Apple Unspecified vulnerability in Apple MacOS X AppleFileServer

AppleFileServer (AFS) in Apple Mac OS X 10.2.8 and 10.3.2 does not properly handle certain malformed requests, with unknown impact.

5.0
2004-03-29 CVE-2003-0797 SGI Denial of Service vulnerability in SGI rpc.mountd

Unknown vulnerability in rpc.mountd in SGI IRIX 6.5 through 6.5.22 allows remote attackers to cause a denial of service (process death) via unknown attack vectors.

5.0
2004-03-30 CVE-2004-1876 Clam Anti Virus Unspecified vulnerability in Clam Anti-Virus Clamav

The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands via shell metacharacters in a file name.

4.6
2004-03-29 CVE-2004-0158 Lgames Environment Variable Buffer Overflow Vulnerabilites in LGames LBreakout2

Buffer overflow in lbreakout2 allows local users to gain 'games' group privileges via a large HOME environment variable to (1) editor.c, (2) theme.c, (3) manager.c, (4) config.c, (5) game.c, (6) levels.c, or (7) main.c.

4.6
2004-03-29 CVE-2004-0126 Freebsd Unspecified vulnerability in Freebsd 5.1/5.2/5.2.1

The jail_attach system call in FreeBSD 5.1 and 5.2 changes the directory of a calling process even if the process doesn't have permission to change directory, which allows local users to gain read/write privileges to files and directories within another jail.

4.6
2004-03-29 CVE-2003-1010 Apple Local Privilege Escalation vulnerability in Apple MacOS X fs_usage

Unknown vulnerability in fs_usage in Mac OS X 10.2.8 and 10.3.2 and Mac OS X Server 10.2.8 and 10.3.2 allows local users to gain privileges via unknown attack vectors.

4.6
2004-03-29 CVE-2003-1008 Apple Local Security vulnerability in Mac OS X Server

Unknown vulnerability in Mac OS X 10.2.8 and 10.3.2 allows local users to bypass the screen saver login window and write a text clipping to the desktop or another application.

4.6
2004-03-29 CVE-2003-0828 GUS AND Psilord Buffer Overflow vulnerability in GUS and Psilord Freesweep 0.88/0.90

Buffer overflow in freesweep in Debian GNU/Linux 3.0 allows local users to gain "games" group privileges when processing environment variables.

4.6
2004-03-29 CVE-2003-0612 Robert Hyatt Local Buffer Overflow vulnerability in Robert Hyatt Crafty 19.3

Multiple buffer overflows in main.c for Crafty 19.3 allow local users to gain group "games" privileges via long command line arguments to crafty.bin.

4.6
2004-03-29 CVE-2003-0607 Stanley T Shebs Environment Variable Buffer Overflow vulnerability in Stanley T. Shebs Xconq 7.4.1

Buffer overflow in xconq 7.4.1 allows local users to become part of the "games" group via the (1) USER or (2) DISPLAY environment variables.

4.6
2004-03-29 CVE-2004-1874 Alan Ward Input Validation vulnerability in Alan Ward A-Cart 2.0

Multiple cross-site scripting (XSS) vulnerabilities in (1) deliver.asp and (2) billing.asp in A-CART Pro and A-CART 2.0 allow remote attackers to inject arbitrary web script or HTML via the user information forms.

4.3
2004-03-29 CVE-2004-1872 Webct HTML Injection vulnerability in WebCT Campus Edition

Cross-site scripting (XSS) vulnerability in WebCT Campus Edition 4.1.1.5 allows remote attackers to inject arbitrary web script or HTML via the @import URL function in a CSS style tag.

4.3
2004-03-29 CVE-2004-1871 Photopost Input Validation vulnerability in All Enthusiast Photopost PHP Pro

Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ppuser, (2) password, (3) stype, (4) perpage, (5) sort, (6) page, (7) si, or (8) cat parameters to showmembers.php, or the (9) photo name, (10) photo description, (11) album name, or (12) album description fields.

4.3

1 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2004-03-30 CVE-2004-1877 Oracle Authentication Credential Disclosure vulnerability in Oracle Application Server and Http Server

The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password.

2.6