Weekly Vulnerabilities Reports > May 3 to 9, 2004

Overview

48 new vulnerabilities reported during this period, including 10 critical vulnerabilities and 5 high severity vulnerabilities. This weekly summary report vulnerabilities in 42 products from 40 vendors including Openbsd, Apple, Ethereal Group, Francisco Burzi, and Adam Webb. Vulnerabilities are notably categorized as "Improper Restriction of Operations within the Bounds of a Memory Buffer", and "Path Traversal".

  • 38 reported vulnerabilities are remotely exploitables.
  • 1 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 48 reported vulnerabilities are exploitable by an anonymous user.
  • Openbsd has the most reported vulnerabilities, with 5 reported vulnerabilities.
  • Ecartis has the most reported critical vulnerabilities, with 2 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

10 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2004-05-06 CVE-2004-2004 Suse Unspecified vulnerability in Suse Linux 9.1

The Live CD in SUSE LINUX 9.1 Personal edition is configured without a password for root, which allows remote attackers to gain privileges via SSH.

10.0
2004-05-04 CVE-2004-1993 Omail Remote Command Execution Variant vulnerability in Omail Webmail 0.97.3/0.98.3/0.98.5

The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell metacharacters such as "`" (backticks) in the password.

10.0
2004-05-04 CVE-2004-0386 Mplayer
Gentoo
Mandrakesoft
Remote HTTP Header Buffer Overflow vulnerability in MPlayer

Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute arbitrary code via a long Location header.

10.0
2004-05-04 CVE-2004-0380 Microsoft Unspecified vulnerability in Microsoft Outlook Express 5.5/6.0

The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."

10.0
2004-05-04 CVE-2004-0377 Activestate
Larry Wall
Buffer overflow in the win32_stat function for (1) ActiveState's ActivePerl and (2) Larry Wall's Perl before 5.8.3 allows local or remote attackers to execute arbitrary commands via filenames that end in a backslash character.
10.0
2004-05-04 CVE-2004-0368 Open Group
XI Graphics
IBM
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet.

10.0
2004-05-04 CVE-2004-0220 Openbsd Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Openbsd

isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite.

10.0
2004-05-04 CVE-2003-0782 Ecartis Unspecified vulnerability in Ecartis 1.0.0

Multiple buffer overflows in ecartis before 1.0.0 allow attackers to cause a denial of service and possibly execute arbitrary code.

10.0
2004-05-04 CVE-2003-0781 Ecartis Unspecified vulnerability in Ecartis 1.0.0

Unknown vulnerability in ecartis before 1.0.0 does not properly validate user input, which allows attackers to obtain mailing list passwords.

10.0
2004-05-04 CVE-2003-0648 FTE
Debian
Local Unspecified Buffer Overflow vulnerability in FTE

Multiple buffer overflows in vfte, based on FTE, before 0.50, allow local users to execute arbitrary code.

10.0

5 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2004-05-06 CVE-2004-2003 Delegate Remote Stack Based Buffer Overflow vulnerability in DeleGate SSLway Filter

Buffer overflow in the ssl_prcert function in the SSLway filter (sslway.c) for DeleGate 8.9.2 and earlier allows remote attackers to execute arbitrary code via a certificate with a long (1) subject or (2) issuer name field.

7.5
2004-05-05 CVE-2004-2000 Francisco Burzi SQL Injection vulnerability in PHP-Nuke Modules.php

SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) orderby or (2) sid parameters to modules.php.

7.5
2004-05-04 CVE-2004-0366 Leon J Breedt Remote SQL Injection vulnerability in Leon J Breedt Pam-PGSQL

SQL injection vulnerability in the libpam-pgsql library before 0.5.2 allows attackers to execute arbitrary SQL statements.

7.5
2004-05-04 CVE-2004-0383 Apple Unspecified vulnerability in Apple mac OS X 10.2.8/10.3.3

Unknown vulnerability in Mail for Mac OS X 10.3.3 and 10.2.8, with unknown impact, related to "the handling of HTML-formatted email."

7.2
2004-05-04 CVE-2004-0382 Apple Unspecified vulnerability in Apple mac OS X 10.2.8/10.3.3

Unknown vulnerability in the CUPS printing system in Mac OS X 10.3.3 and Mac OS X 10.2.8 with unknown impact, possibly related to a configuration file setting.

7.2

30 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2004-05-04 CVE-2004-0379 Microsoft Unspecified vulnerability in Microsoft Sharepoint Portal Server 2001

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft SharePoint Portal Server 2001 allow remote attackers to process arbitrary web content and steal cookies via certain server scripts.

6.8
2004-05-04 CVE-2004-0374 Interchange Development Group Remote Information Disclosure vulnerability in Interchange

Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information via an HTTP request ending with the "__SQLUSER__" string.

6.4
2004-05-06 CVE-2004-2005 Qualcomm Buffer Overrun vulnerability in Qualcomm Eudora Embedded Hyperlink

Buffer overflow in Eudora for Windows 5.2.1, 6.0.3, and 6.1 allows remote attackers to execute arbitrary code via an e-mail with (1) a link to a long URL to the C drive or (2) a long attachment name.

5.1
2004-05-08 CVE-2004-2009 Adam Webb NukeJokes 1.7 and 2 Beta allows remote attackers to obtain the full path of the server via (1) a direct call to mainfunctions.php, (2) an invalid jokeid parameter in a JokeView function or (3) an invalid cat parameter in a CatView function, which reveals the path in a PHP error message.
5.0
2004-05-05 CVE-2004-2002 SGI UDP Denial Of Service vulnerability in SGI IRIX

Unknown vulnerability in SGI IRIX 6.5 through 6.5.22m allows remote attackers to cause a denial of service via a certain UDP packet.

5.0
2004-05-05 CVE-2004-1998 Francisco Burzi Information Disclosure vulnerability in PHP-Nuke

The Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to gain sensitive information via an invalid show parameter to modules.php, which reveals the full path in a PHP error message.

5.0
2004-05-05 CVE-2004-1994 E Zone Media INC Authentication Bypass vulnerability in E-Zone Media Inc. Fusetalk 2.0/3.0/4.0

FuseTalk 4.0 allows remote attackers to ban other users via a direct request to banning.cfm.

5.0
2004-05-04 CVE-2004-0376 Oftpd Denial Of Service vulnerability in OFTPD Port Argument

oftpd 0.3.6 and earlier allows remote attackers to cause a denial of service (crash) via a PORT command with a large value.

5.0
2004-05-04 CVE-2004-0371 KTH Unspecified vulnerability in KTH Heimdal

Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the cross-realm trust path.

5.0
2004-05-04 CVE-2004-0367 Ethereal Group Unspecified vulnerability in Ethereal Group Ethereal

Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector.

5.0
2004-05-04 CVE-2004-0365 Ethereal Group Unspecified vulnerability in Ethereal Group Ethereal

The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.

5.0
2004-05-04 CVE-2004-0222 Openbsd Denial Of Service vulnerability in OpenBSD ISAKMPD Memory Leak

Multiple memory leaks in isakmpd in OpenBSD 3.4 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via certain ISAKMP packets, as demonstrated by the Striker ISAKMP Protocol Test Suite.

5.0
2004-05-04 CVE-2004-0221 Openbsd Unspecified vulnerability in Openbsd

isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a delete payload containing a large number of SPIs, which triggers an out-of-bounds read error, as demonstrated by the Striker ISAKMP Protocol Test Suite.

5.0
2004-05-04 CVE-2004-0219 Openbsd Unspecified vulnerability in Openbsd

isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.

5.0
2004-05-04 CVE-2004-0218 Openbsd Denial Of Service vulnerability in OpenBSD ISAKMPD Zero Payload Length

isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.

5.0
2004-05-04 CVE-2004-0184 LBL Unspecified vulnerability in LBL Tcpdump

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

5.0
2004-05-04 CVE-2004-0183 LBL Buffer Overrun vulnerability in TCPDump ISAKMP Delete Payload

TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPI's, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

5.0
2004-05-04 CVE-2004-0176 Ethereal Group Unspecified vulnerability in Ethereal Group Ethereal

Multiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) NetFlow, (2) IGAP, (3) EIGRP, (4) PGM, (5) IrDA, (6) BGP, (7) ISUP, or (8) TCAP dissectors.

5.0
2004-05-04 CVE-2004-0174 Apache Denial Of Service vulnerability in Apache Connection Blocking

Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."

5.0
2004-05-03 CVE-2004-1991 Aldostools Path Traversal vulnerability in Aldostools Aldo'S web Server 1.5

Directory traversal vulnerability in Aldo's Web Server (aweb) 1.5 allows remote attackers to view arbitrary files via a ..

5.0
2004-05-03 CVE-2004-1982 Yabb Unspecified vulnerability in Yabb 1Goldsp1/1Goldsp1.2

Post.pl in YaBB 1 Gold SP 1.2 allows remote attackers to modify records in the board's .txt file via carriage return characters in the subject field.

5.0
2004-05-03 CVE-2004-0428 Apple Large Input vulnerability in Apple Mac OS X CoreFoundation

Unknown vulnerability in CoreFoundation in Mac OS X 10.3.3 and Mac OS X 10.3.3 Server, related to "the handling of an environment variable," has unknown attack vectors and unknown impact.

5.0
2004-05-08 CVE-2004-2008 Adam Webb Input Validation vulnerability in Adam Webb NukeJokes Module For PHP-Nuke

SQL injection vulnerability in modules.php in NukeJokes 1.7 and 2 Beta allows remote attackers to execute arbitrary SQL via the jokeid parameter.

4.6
2004-05-07 CVE-2004-2006 Trend Micro Unspecified vulnerability in Trend Micro Officescan

Trend Micro OfficeScan 3.0 - 6.0 has default permissions of "Everyone Full Control" on the installation directory and registry keys, which allows local users to disable virus protection.

4.6
2004-05-05 CVE-2004-2001 SGI Unspecified vulnerability in SGI Irix

ifconfig "-arp" in SGI IRIX 6.5 through 6.5.22m does not properly disable ARP requests from being sent or received.

4.6
2004-05-05 CVE-2004-1997 Kolab
Openpkg
Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be installed world-readable, which allows local users to gain privileges.
4.6
2004-05-04 CVE-2004-0149 Xboing Local Buffer Overflow vulnerability in Xboing 2.4

Multiple buffer overflows in xboing before 2.4 allow local users to gain privileges.

4.6
2004-05-08 CVE-2004-2007 Adam Webb Input Validation vulnerability in Adam Webb NukeJokes Module For PHP-Nuke

Cross-site scripting (XSS) vulnerability in modules.php in NukeJokes 1.7 and 2 Beta allows remote attackers to inject arbitrary HTML or web script via the (1) cat parameter in a CatView function or (2) jokeid parameter in a JokeView function.

4.3
2004-05-05 CVE-2004-1999 Francisco Burzi Cross-Site Scripting vulnerability in PHP-Nuke

Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the (1) ttitle or (2) sid parameters to modules.php.

4.3
2004-05-05 CVE-2004-1996 Simple Machines HTML Injection vulnerability in Simple Machines SMF 1.0Beta4.1/1.0Beta4P/1.0Beta5P

Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.0 allows remote attackers to inject arbitrary web script via the size tag.

4.3

3 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2004-05-04 CVE-2004-0381 Mysql
Oracle
mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file.
2.1
2004-05-04 CVE-2004-0370 Freebsd Local Memory Disclosure vulnerability in Freebsd 5.2

The setsockopt call in the KAME Project IPv6 implementation, as used in FreeBSD 5.2, does not properly handle certain IPv6 socket options, which could allow attackers to read kernel memory and cause a system panic.

2.1
2004-05-04 CVE-2003-0618 Perl
Debian
Information Disclosure vulnerability in Suidperl

Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.

2.1