Weekly Vulnerabilities Reports > May 3 to 9, 2004
Overview
40 new vulnerabilities reported during this period, including 10 critical vulnerabilities and 6 high severity vulnerabilities. This weekly summary report vulnerabilities in 39 products from 37 vendors including Apple, Openbsd, Francisco Burzi, Adam Webb, and Microsoft. Vulnerabilities are notably categorized as "Improper Restriction of Operations within the Bounds of a Memory Buffer", "NULL Pointer Dereference", "Improper Locking", and "Path Traversal".
- 30 reported vulnerabilities are remotely exploitables.
- 1 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
- 40 reported vulnerabilities are exploitable by an anonymous user.
- Apple has the most reported vulnerabilities, with 3 reported vulnerabilities.
- Ecartis has the most reported critical vulnerabilities, with 2 reported vulnerabilities.
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
EXPLOITABLE
EXPLOITABLE
AVAILABLE
ANONYMOUSLY
WEB APPLICATION
Vulnerability Details
The following table list reported vulnerabilities for the period covered by this report:
10 Critical Vulnerabilities
| DATE | CVE | VENDOR | VULNERABILITY | CVSS |
|---|---|---|---|---|
| 2004-05-06 | CVE-2004-2004 | Suse | Unspecified vulnerability in Suse Linux 9.1 The Live CD in SUSE LINUX 9.1 Personal edition is configured without a password for root, which allows remote attackers to gain privileges via SSH. | 10.0 |
| 2004-05-04 | CVE-2004-1993 | Omail | Remote Command Execution Variant vulnerability in Omail Webmail 0.97.3/0.98.3/0.98.5 The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell metacharacters such as "`" (backticks) in the password. | 10.0 |
| 2004-05-04 | CVE-2004-0386 | Mplayer Gentoo Mandrakesoft | Remote HTTP Header Buffer Overflow vulnerability in MPlayer Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute arbitrary code via a long Location header. | 10.0 |
| 2004-05-04 | CVE-2004-0380 | Microsoft | Unspecified vulnerability in Microsoft Outlook Express 5.5/6.0 The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." | 10.0 |
| 2004-05-04 | CVE-2004-0377 | Activestate Larry Wall | Buffer overflow in the win32_stat function for (1) ActiveState's ActivePerl and (2) Larry Wall's Perl before 5.8.3 allows local or remote attackers to execute arbitrary commands via filenames that end in a backslash character. | 10.0 |
| 2004-05-04 | CVE-2004-0368 | Open Group XI Graphics IBM | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet. | 10.0 |
| 2004-05-04 | CVE-2004-0220 | Openbsd | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Openbsd isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite. | 10.0 |
| 2004-05-04 | CVE-2003-0782 | Ecartis | Unspecified vulnerability in Ecartis 1.0.0 Multiple buffer overflows in ecartis before 1.0.0 allow attackers to cause a denial of service and possibly execute arbitrary code. | 10.0 |
| 2004-05-04 | CVE-2003-0781 | Ecartis | Unspecified vulnerability in Ecartis 1.0.0 Unknown vulnerability in ecartis before 1.0.0 does not properly validate user input, which allows attackers to obtain mailing list passwords. | 10.0 |
| 2004-05-04 | CVE-2003-0648 | FTE Debian | Local Unspecified Buffer Overflow vulnerability in FTE Multiple buffer overflows in vfte, based on FTE, before 0.50, allow local users to execute arbitrary code. | 10.0 |
6 High Vulnerabilities
| DATE | CVE | VENDOR | VULNERABILITY | CVSS |
|---|---|---|---|---|
| 2004-05-06 | CVE-2004-2003 | Delegate | Remote Stack Based Buffer Overflow vulnerability in DeleGate SSLway Filter Buffer overflow in the ssl_prcert function in the SSLway filter (sslway.c) for DeleGate 8.9.2 and earlier allows remote attackers to execute arbitrary code via a certificate with a long (1) subject or (2) issuer name field. | 7.5 |
| 2004-05-05 | CVE-2004-2000 | Francisco Burzi | SQL Injection vulnerability in PHP-Nuke Modules.php SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) orderby or (2) sid parameters to modules.php. | 7.5 |
| 2004-05-04 | CVE-2004-0365 | Ethereal | NULL Pointer Dereference vulnerability in Ethereal The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference. | 7.5 |
| 2004-05-04 | CVE-2004-0174 | Apache | Improper Locking vulnerability in Apache Http Server Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket." | 7.5 |
| 2004-05-04 | CVE-2004-0383 | Apple | Unspecified vulnerability in Apple mac OS X 10.2.8/10.3.3 Unknown vulnerability in Mail for Mac OS X 10.3.3 and 10.2.8, with unknown impact, related to "the handling of HTML-formatted email." | 7.2 |
| 2004-05-04 | CVE-2004-0382 | Apple | Unspecified vulnerability in Apple mac OS X 10.2.8/10.3.3 Unknown vulnerability in the CUPS printing system in Mac OS X 10.3.3 and Mac OS X 10.2.8 with unknown impact, possibly related to a configuration file setting. | 7.2 |
21 Medium Vulnerabilities
| DATE | CVE | VENDOR | VULNERABILITY | CVSS |
|---|---|---|---|---|
| 2004-05-04 | CVE-2004-0379 | Microsoft | Unspecified vulnerability in Microsoft Sharepoint Portal Server 2001 Multiple cross-site scripting (XSS) vulnerabilities in Microsoft SharePoint Portal Server 2001 allow remote attackers to process arbitrary web content and steal cookies via certain server scripts. | 6.8 |
| 2004-05-04 | CVE-2004-0374 | Interchange Development Group | Remote Information Disclosure vulnerability in Interchange Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information via an HTTP request ending with the "__SQLUSER__" string. | 6.4 |
| 2004-05-06 | CVE-2004-2005 | Qualcomm | Buffer Overrun vulnerability in Qualcomm Eudora Embedded Hyperlink Buffer overflow in Eudora for Windows 5.2.1, 6.0.3, and 6.1 allows remote attackers to execute arbitrary code via an e-mail with (1) a link to a long URL to the C drive or (2) a long attachment name. | 5.1 |
| 2004-05-08 | CVE-2004-2009 | Adam Webb | NukeJokes 1.7 and 2 Beta allows remote attackers to obtain the full path of the server via (1) a direct call to mainfunctions.php, (2) an invalid jokeid parameter in a JokeView function or (3) an invalid cat parameter in a CatView function, which reveals the path in a PHP error message. | 5.0 |
| 2004-05-05 | CVE-2004-2002 | SGI | UDP Denial Of Service vulnerability in SGI IRIX Unknown vulnerability in SGI IRIX 6.5 through 6.5.22m allows remote attackers to cause a denial of service via a certain UDP packet. | 5.0 |
| 2004-05-05 | CVE-2004-1998 | Francisco Burzi | Information Disclosure vulnerability in PHP-Nuke The Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to gain sensitive information via an invalid show parameter to modules.php, which reveals the full path in a PHP error message. | 5.0 |
| 2004-05-05 | CVE-2004-1994 | E Zone Media INC | Authentication Bypass vulnerability in E-Zone Media Inc. Fusetalk 2.0/3.0/4.0 FuseTalk 4.0 allows remote attackers to ban other users via a direct request to banning.cfm. | 5.0 |
| 2004-05-04 | CVE-2004-0376 | Oftpd | Denial Of Service vulnerability in OFTPD Port Argument oftpd 0.3.6 and earlier allows remote attackers to cause a denial of service (crash) via a PORT command with a large value. | 5.0 |
| 2004-05-04 | CVE-2004-0371 | KTH | Unspecified vulnerability in KTH Heimdal Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the cross-realm trust path. | 5.0 |
| 2004-05-04 | CVE-2004-0219 | Openbsd | Unspecified vulnerability in Openbsd isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload, as demonstrated by the Striker ISAKMP Protocol Test Suite. | 5.0 |
| 2004-05-04 | CVE-2004-0218 | Openbsd | Denial Of Service vulnerability in OpenBSD ISAKMPD Zero Payload Length isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload, as demonstrated by the Striker ISAKMP Protocol Test Suite. | 5.0 |
| 2004-05-03 | CVE-2004-1991 | Aldostools | Path Traversal vulnerability in Aldostools Aldo'S web Server 1.5 Directory traversal vulnerability in Aldo's Web Server (aweb) 1.5 allows remote attackers to view arbitrary files via a .. | 5.0 |
| 2004-05-03 | CVE-2004-0428 | Apple | Large Input vulnerability in Apple Mac OS X CoreFoundation Unknown vulnerability in CoreFoundation in Mac OS X 10.3.3 and Mac OS X 10.3.3 Server, related to "the handling of an environment variable," has unknown attack vectors and unknown impact. | 5.0 |
| 2004-05-08 | CVE-2004-2008 | Adam Webb | Input Validation vulnerability in Adam Webb NukeJokes Module For PHP-Nuke SQL injection vulnerability in modules.php in NukeJokes 1.7 and 2 Beta allows remote attackers to execute arbitrary SQL via the jokeid parameter. | 4.6 |
| 2004-05-07 | CVE-2004-2006 | Trend Micro | Unspecified vulnerability in Trend Micro Officescan Trend Micro OfficeScan 3.0 - 6.0 has default permissions of "Everyone Full Control" on the installation directory and registry keys, which allows local users to disable virus protection. | 4.6 |
| 2004-05-05 | CVE-2004-2001 | SGI | Unspecified vulnerability in SGI Irix ifconfig "-arp" in SGI IRIX 6.5 through 6.5.22m does not properly disable ARP requests from being sent or received. | 4.6 |
| 2004-05-05 | CVE-2004-1997 | Kolab Openpkg | Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be installed world-readable, which allows local users to gain privileges. | 4.6 |
| 2004-05-04 | CVE-2004-0149 | Xboing | Local Buffer Overflow vulnerability in Xboing 2.4 Multiple buffer overflows in xboing before 2.4 allow local users to gain privileges. | 4.6 |
| 2004-05-08 | CVE-2004-2007 | Adam Webb | Input Validation vulnerability in Adam Webb NukeJokes Module For PHP-Nuke Cross-site scripting (XSS) vulnerability in modules.php in NukeJokes 1.7 and 2 Beta allows remote attackers to inject arbitrary HTML or web script via the (1) cat parameter in a CatView function or (2) jokeid parameter in a JokeView function. | 4.3 |
| 2004-05-05 | CVE-2004-1999 | Francisco Burzi | Cross-Site Scripting vulnerability in PHP-Nuke Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the (1) ttitle or (2) sid parameters to modules.php. | 4.3 |
| 2004-05-05 | CVE-2004-1996 | Simple Machines | HTML Injection vulnerability in Simple Machines SMF 1.0Beta4.1/1.0Beta4P/1.0Beta5P Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.0 allows remote attackers to inject arbitrary web script via the size tag. | 4.3 |
3 Low Vulnerabilities
| DATE | CVE | VENDOR | VULNERABILITY | CVSS |
|---|---|---|---|---|
| 2004-05-04 | CVE-2004-0381 | Mysql Oracle | mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file. | 2.1 |
| 2004-05-04 | CVE-2004-0370 | Freebsd | Local Memory Disclosure vulnerability in Freebsd 5.2 The setsockopt call in the KAME Project IPv6 implementation, as used in FreeBSD 5.2, does not properly handle certain IPv6 socket options, which could allow attackers to read kernel memory and cause a system panic. | 2.1 |
| 2004-05-04 | CVE-2003-0618 | Perl Debian | Information Disclosure vulnerability in Suidperl Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions. | 2.1 |