Weekly Vulnerabilities Reports > May 30 to June 5, 2005

Overview

58 new vulnerabilities reported during this period, including 1 critical vulnerabilities and 27 high severity vulnerabilities. This weekly summary report vulnerabilities in 125 products from 51 vendors including Microsoft, Mybulletinboard, Nextweb, Qualiteam, and Invision Power Services. Vulnerabilities are notably categorized as "Improper Restriction of Operations within the Bounds of a Memory Buffer", "Resource Management Errors", "Cross-site Scripting", and "Path Traversal".

  • 51 reported vulnerabilities are remotely exploitables.
  • 2 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 58 reported vulnerabilities are exploitable by an anonymous user.
  • Microsoft has the most reported vulnerabilities, with 6 reported vulnerabilities.
  • Futuresoft has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

1 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-06-01 CVE-2005-1812 Futuresoft Buffer Errors vulnerability in Futuresoft Tftp Server 2000 1.0.0.1

Multiple stack-based buffer overflows in FutureSoft TFTP Server Evaluation Version 1.0.0.1 allow remote attackers to execute arbitrary code via a long (1) filename or (2) transfer mode string in a Read Request (RRQ) or Write Request (WRQ) packet.

10.0

27 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-06-01 CVE-2005-1813 Futuresoft Path Traversal vulnerability in Futuresoft Tftp Server 2000 1.0.0.1

Directory traversal vulnerability in FutureSoft TFTP Server Evaluation Version 1.0.0.1 allows remote attackers to read arbitrary files via a TFTP GET request containing (1) "../" (dot dot slash) or (2) "..\" (dot dot backslash) sequences.

7.8
2005-06-05 CVE-2005-1910 Wwweb Concepts SQL-Injection vulnerability in Wwweb Concepts Events System 1.0

SQL injection vulnerability in login.asp for WWWeb Concepts Events System 1.0 allows remote attackers to execute arbitrary SQL commands via the password.

7.5
2005-06-03 CVE-2005-1872 IBM Remote Security vulnerability in IBM Websphere Application Server 5.0

Buffer overflow in the administrative console in IBM WebSphere Application Server 5.x, when the global security option is enabled, allows remote attackers to execute arbitrary code.

7.5
2005-06-02 CVE-2005-1906 Livingmailing SQL-Injection vulnerability in Livingmailing 1.3

SQL injection vulnerability in login.asp in livingmailing 1.3 allows remote attackers to execute arbitrary SQL commands via the password.

7.5
2005-06-02 CVE-2005-1875 Exhibit Engine SQL Injection vulnerability in Exhibit Engine List.php

Multiple SQL injection vulnerabilities in list.php in Exhibit Engine (EE) 1.22 allow remote attackers to execute arbitrary SQL commands via the (1) search_row, (2) sort_row, (3) order or (4) perpage parameter.

7.5
2005-06-02 CVE-2005-1839 Liberum SQL-Injection vulnerability in Liberum Help Desk 0.97.3

Multiple SQL injection vulnerabilities in Doug Luxem Liberum Help Desk 0.97.3 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.asp or (2) print.asp or (3) edit parameter to register.asp.

7.5
2005-06-02 CVE-2005-1824 GNU Unspecified vulnerability in GNU Mailutils 1.0.6.1.1

The sql_escape_string function in auth/sql.c for the mailutils SQL authentication module does not properly quote the "\" (backslash) character, which is used as an escape character and makes the module vulnerable to SQL injection attacks.

7.5
2005-06-01 CVE-2005-1837 Fortinet Remote Security vulnerability in Fortinet Firewall

Fortinet firewall running FortiOS 2.x contains a hardcoded username with the password set to the serial number, which allows local users with console access to gain privileges.

7.5
2005-06-01 CVE-2005-1834 Nextweb SQL-Injection vulnerability in Nextweb %28I%29Site

SQL injection vulnerability in login.asp in NEXTWEB (i)Site allows remote attackers to execute arbitrary SQL commands and bypass authentication via the password field.

7.5
2005-06-01 CVE-2005-1822 Qualiteam SQL Injection and Cross-Site Scripting vulnerability in Qualiteam X-Cart 4.0.8

Multiple SQL injection vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) printable parameter to home.php, (3) productid or (4) mode parameter to product.php, (5) id parameter to error_message.php, (6) section parameter to help.php, (7) mode parameter to orders.php, (8) mode parameter to register.php, (9) mode parameter to search.php, or the (10) gcid or (11) gcindex parameter to giftcert.php.

7.5
2005-06-01 CVE-2005-1821 Powerscripts ORG Remote File Include vulnerability in Powerscripts.Org Powerdownload 3.0.2/3.0.3

PHP remote file inclusion vulnerability in pdl_header.inc.php in PowerDownload 3.0.2 and 3.0.3 allows remote attackers to execute arbitrary PHP code via the incdir parameter to downloads.php.

7.5
2005-06-01 CVE-2005-1820 Zeroboard Remote Command Execution vulnerability in Zeroboard Preg_replace

zboard.php in Zeroboard version 4.1pl2 to 4.1pl5 allows remote attackers to execute arbitrary PHP code via improper quoting when using the preg_replace function.

7.5
2005-06-01 CVE-2005-1818 Newlife Blogger SQL Injection vulnerability in NewLife Blogger

Multiple SQL injection vulnerabilities in NewLife Blogger before 3.3.1 allow remote attackers to execute arbitrary SQL commands via unknown attack vectors.

7.5
2005-06-01 CVE-2005-1814 Newmad Technologies Remote Buffer Overflow vulnerability in Newmad Technologies Picowebserver 1.0

Stack-based buffer overflow in PicoWebServer 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long URL.

7.5
2005-06-01 CVE-2005-1810 Wordpress SQL Injection vulnerability in Wordpress 1.5.1

SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $cat_ID variable, as demonstrated using the cat parameter to index.php.

7.5
2005-06-01 CVE-2005-1788 Hosting Controller Unspecified vulnerability in Hosting Controller Hosting Controller 6.1Hotfix2.0

SQL injection vulnerability in resellerresources.asp in Hosting Controller 6.1 Hotfix 2.0 allows remote attackers to execute arbitrary SQL commands via the jresourceid parameter.

7.5
2005-05-31 CVE-2005-1833 Mybulletinboard SQL-Injection vulnerability in MyBulletinBoard

Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to calendar.php, (2) idsql parameter to online.php, (3) usersearch parameter to memberlist.php, (4) pid parameter to editpost.php, (5) fid parameter to forumdisplay.php, (6) tid parameter to newreply.php, (7) sid parameter to search.php, (8) tid or (9) pid parameter to showthread.php, (10) tid parameter to usercp2.php, (11) tid parameter to printthread.php, or (12) pid parameter to reputation.php.

7.5
2005-05-31 CVE-2005-1796 Ettercap Remote Format String vulnerability in Ettercap

Format string vulnerability in the curses_msg function in the Ncurses interface (ec_curses.c) for Ettercap before 0.7.3 allows remote attackers to execute arbitrary code.

7.5
2005-05-31 CVE-2005-1785 Zongg SQL Injection vulnerability in Zongg V1.2

SQL injection vulnerability in ad/login.asp in ZonGG 1.2 allows remote attackers to execute arbitrary SQL commands via the password parameter.

7.5
2005-05-31 CVE-2005-1780 Dotnetindex Unspecified vulnerability in Dotnetindex Active News Manager 2

SQL injection vulnerability in admin/login.asp in Active News Manager allows remote attackers to execute arbitrary SQL commands via the password.

7.5
2005-05-31 CVE-2005-1779 Maxwebportal Unspecified vulnerability in Maxwebportal

SQL injection vulnerability in password.asp in MaxWebPortal 1.35, 1.36, 2.0, and 20050418 Next allows remote attackers to execute arbitrary SQL commands via the memKey parameter.

7.5
2005-05-31 CVE-2005-1777 Postnuke Software Foundation Unspecified vulnerability in Postnuke Software Foundation Postnuke 0.750

SQL injection vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to execute arbitrary SQL commands via the start parameter.

7.5
2005-05-31 CVE-2005-1776 Cnedra Unspecified vulnerability in Cnedra

Buffer overflow in the READ_TCP_STRING function in game_message_functions.cpp in the network plugin for C'Nedra 0.4.0 and earlier allows remote attackers to execute arbitrary code via a long text string.

7.5
2005-05-31 CVE-2005-1773 Lsoft Multiple Unspecified vulnerability in L-Soft Listserv 1.8D/1.8E/14.3

Multiple unknown vulnerabilities in L-Soft LISTSERV 14.3, 1.8e, and 1.8d allow remote attackers to execute arbitrary code or cause a denial of service.

7.5
2005-05-31 CVE-2005-1771 HP Unknown vulnerability in HP-UX trusted systems B.11.00 through B.11.23 allows remote attackers to gain unauthorized access, possibly involving remshd and/or telnet -t.
7.5
2005-05-31 CVE-2005-1831 Todd Miller Unspecified vulnerability in Todd Miller Sudo 1.6.8P7

** DISPUTED ** Sudo 1.6.8p7 on SuSE Linux 9.3, and possibly other Linux distributions, allows local users to gain privileges by using sudo to call su, then entering a blank password and hitting CTRL-C.

7.2
2005-05-31 CVE-2005-1770 Alwil Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Alwil Avast Antivirus

Buffer overflow in the Aavmker4 device driver in Avast! Antivirus 4.6 and possibly other versions allows local users to cause a denial of service (system crash) and possibly execute arbitrary code via certain signals combined with crafted input.

7.2

23 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-06-01 CVE-2005-1794 Microsoft Remote Desktop Protocol Server Private Key Disclosure vulnerability in Microsoft products

Microsoft Terminal Server using Remote Desktop Protocol (RDP) 5.2 stores an RSA private key in mstlsapi.dll and uses it to sign a certificate, which allows remote attackers to spoof public keys of legitimate servers and conduct man-in-the-middle attacks.

6.4
2005-06-02 CVE-2005-1840 Phpcms Directory Traversal vulnerability in phpCMS

Directory traversal vulnerability in class.layout_phpcms.php in phpCMS 1.2.x before 1.2.1pl2 allows remote attackers to read or include arbitrary files, as demonstrated using a ..

5.0
2005-06-02 CVE-2005-1838 Liberum Cross-Site Scripting vulnerability in Liberum Help Desk 0.97.3

Multiple cross-site scripting vulnerabilities in castnewPost.asp in Liberum Help Desk 0.97.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Email, (2) Title, or (3) Description fields.

5.0
2005-06-01 CVE-2005-1836 Nextweb Denial-Of-Service vulnerability in Nextweb (i)Site

NEXTWEB (i)Site allows remote attackers to cause a denial of service (error 500) via a crafted HTTP request, possibly involving wildcard requests for .jsp files.

5.0
2005-06-01 CVE-2005-1835 Nextweb Unspecified vulnerability in Nextweb (I)Site

NEXTWEB (i)Site stores databases under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to databases/Users.mdb.

5.0
2005-06-01 CVE-2005-1817 Invision Power Services Unspecified vulnerability in Invision Power Services Invision Board

Invision Power Board (IPB) 1.0 through 1.3 allows remote attackers to edit arbitrary forum posts via a direct request to index.php with modified parameters.

5.0
2005-06-01 CVE-2005-1815 Hummingbird Stack Overflow vulnerability in Hummingbird Connectivity 10.0/7.1/9.0

Multiple buffer overflows in Hummingbird Connectivity inetD 10.0.0.1 and 9.0.0.4 allows attackers to cause a denial of service and possibly execute arbitrary code via (1) an FTP command with a long argument to FTPD (ftpdw.exe) or (2) a large amount of data to LPD (Lpdw.exe).

5.0
2005-06-01 CVE-2005-1809 Sony Unspecified vulnerability in Sony P900 Firmware

Sony Ericsson P900 Beamer allows remote attackers to cause a denial of service (panic) via an obexftp session with a long filename in an OBEX File Transfer or OBEX Object Push.

5.0
2005-06-01 CVE-2005-1792 Microsoft Denial of Service vulnerability in Microsoft Windows XP Windows Management Instrumentation

Memory leak in Windows Management Instrumentation (WMI) service allows attackers to cause a denial of service (memory consumption and crash) by creating security contexts more quickly than they can be cleared from the RPC cache.

5.0
2005-05-31 CVE-2005-1907 Microsoft Denial Of Service vulnerability in Microsoft ISA Server 2000

The ISA Firewall service in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service (Wspsrv.exe crash) via a large amount of SecureNAT network traffic.

5.0
2005-05-31 CVE-2005-1783 W M R Simpson Remote Security vulnerability in W.M.R. Simpson Bookreview Beta1.0

BookReview beta 1.0 allows remote attackers to obtain the path of the web server via certain parameters to search.htm, possibly due to a search[string] parameter with a missing value or an incorrect submit[type] value, which reveals the path in the resulting error message.

5.0
2005-05-31 CVE-2005-1781 Mailenable Denial-Of-Service vulnerability in MailEnable Professional

Unknown vulnerability in SMTP authentication for MailEnable allows remote attackers to cause a denial of service (crash).

5.0
2005-05-31 CVE-2005-1775 Atari Buffer Errors vulnerability in Atari Terminator 3 WAR of the Machines 1.16

Terminator 3: War of the Machines 1.16 and earlier allows remote attackers to cause a denial of service (application crash) via a large nickname.

5.0
2005-05-31 CVE-2005-1772 Atari Denial-Of-Service vulnerability in Terminator 3 War Of The Machines

Buffer overflow in the client cd-key hash in Terminator 3: War of the Machines 1.16 and earlier allows remote attackers to cause a denial of service (application crash) via a long client cd-key hash value, a different vulnerability than CVE-2005-1556.

5.0
2005-05-31 CVE-2005-0356 Cisco
Hitachi
Nortel
Freebsd
Microsoft
Openbsd
Alaxala
Yamaha
F5
Remote Denial Of Service vulnerability in Multiple Vendor TCP Timestamp PAWS

Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.

5.0
2005-05-30 CVE-2005-1808 Firefly Studios Denial-Of-Service vulnerability in Firefly Studios Stronghold 2 1.2

Firefly Studios Stronghold 2 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a packet with a large size value for the nickname, which causes a memory allocation failure and generates an exception.

5.0
2005-06-01 CVE-2005-1816 Invision Power Services Privilege Escalation vulnerability in Invision Power Board

Invision Power Board (IPB) 1.0 through 2.0.4 allows non-root admins to add themselves or other users to the root admin group via the "Move users in this group to" screen.

4.6
2005-06-01 CVE-2005-1823 Qualiteam SQL Injection and Cross-Site Scripting vulnerability in Qualiteam X-Cart 4.0.8

Multiple cross-site scripting (XSS) vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) cat or (2) printable parameter to home.php, (3) productid or (4) mode parameter to product.php, (5) id parameter to error_message.php, (6) section parameter to help.php, (7) mode parameter to orders.php, (8) mode parameter to register.php, (9) mode parameter to search.php, or the (10) gcid or (11) gcindex parameter to giftcert.php.

4.3
2005-06-01 CVE-2005-1819 Nikosoft Unspecified vulnerability in Nikosoft Webmail

Cross-site scripting (XSS) vulnerability in NikoSoft WebMail before 0.11.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

4.3
2005-06-01 CVE-2005-1811 Mybulletinboard HTML Injection vulnerability in Mybulletinboard 1.0Rc4

Cross-site scripting (XSS) vulnerability in usercp.php for MyBulletinBoard (MyBB) allows remote attackers to inject arbitrary web script or HTML via the website field in a user profile.

4.3
2005-05-31 CVE-2005-1866 Vincent HOR Cross-Site Scripting vulnerability in Vincent HOR Calendarix Advanced 1.5

Cross-site scripting (XSS) vulnerability in calendar.php in Calendarix Advanced 1.5 allows remote attackers to inject arbitrary web script or HTML via the year parameter.

4.3
2005-05-31 CVE-2005-1832 Mybulletinboard Cross-Site Scripting vulnerability in MyBulletinBoard

Multiple cross-site scripting (XSS) vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 and earlier allow remote attackers to execute arbitrary web script or HTML via the (1) forums, (2) version, or (3) limit parameter to misc.php, (4) page or (5) datecut parameter to forumdisplay.php, (6) username, (7) email, or (8) email2 parameter to member.php, (9) page or (10) usersearch parameter to memberlist.php, (11) pid or (12) tid parameter to showthread.php, or (13) tid parameter to printthread.php.

4.3
2005-05-31 CVE-2005-1799 Freestyle HTML Injection vulnerability in Freestyle Wiki and Wikilite

Cross-site scripting (XSS) vulnerability in FreeStyle Wiki 3.5.7 and WikiLite (FSWikiLite) .10 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

4.3

7 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-06-01 CVE-2005-1793 Microsoft Denial-Of-Service vulnerability in Windows 98SE

User32.DLL in Microsoft Windows 98SE, and possibly other operating systems, allows local and remote attackers to cause a denial of service (crash) via an icon (.ico) bitmap file with large width and height values.

2.6
2005-06-01 CVE-2005-1790 Microsoft Resource Management Errors vulnerability in Microsoft Internet Explorer 6.0.2800.1106/6.0.2900.2180

Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."

2.6
2005-05-31 CVE-2005-1778 Postnuke Software Foundation Cross-Site Scripting vulnerability in Postnuke Software Foundation Postnuke 0.750

Cross-site scripting (XSS) vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to inject arbitrary web script or HTML via the start parameter.

2.6
2005-06-03 CVE-2005-1858 Fuse Local Information Disclosure vulnerability in FUSE

FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.

2.1
2005-06-02 CVE-2005-1903 E Post Corporation Local Security vulnerability in SPA-PRO Mail

Buffer overflow in the IMAP service for SPA-PRO Mail @Solomon 4.00 allows remote authenticated users to execute arbitrary code via a long CREATE command.

2.1
2005-05-31 CVE-2005-1774 Davfs2 Local Security vulnerability in Davfs2 0.2.3

WEB-DAV Linux File System (davfs2) 0.2.3 does not properly enforce Unix permissions, which allows local users to write arbitrary files on a davfs2 mounted filesystem.

2.1
2005-05-31 CVE-2005-1765 Linux Local Denial of Service vulnerability in Linux Kernel 2.6.10/2.6.8.1

syscall in the Linux kernel 2.6.8.1 and 2.6.10 for the AMD64 platform, when running in 32-bit compatibility mode, allows local users to cause a denial of service (kernel hang) via crafted arguments.

2.1