Weekly Vulnerabilities Reports > July 25 to 31, 2005

Overview

44 new vulnerabilities reported during this period, including 1 critical vulnerabilities and 15 high severity vulnerabilities. This weekly summary report vulnerabilities in 45 products from 35 vendors including Oracle, PHP Surveyor, EKG, GNU, and KDE. Vulnerabilities are notably categorized as "Path Traversal", "Resource Management Errors", "Numeric Errors", "Improper Restriction of Operations within the Bounds of a Memory Buffer", and "OS Command Injection".

  • 39 reported vulnerabilities are remotely exploitables.
  • 3 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 44 reported vulnerabilities are exploitable by an anonymous user.
  • Oracle has the most reported vulnerabilities, with 4 reported vulnerabilities.
  • VIM Development Group has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

1 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-07-26 CVE-2005-2368 VIM Development Group OS Command Injection vulnerability in VIM Development Group VIM

vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand commands of a foldexpr expression for calculating fold levels.

9.3

15 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-07-27 CVE-2005-2404 Sendcard SQL Injection vulnerability in Sendcard 3.2.3

SQL injection vulnerability in sendcard.php in Sendcard 3.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.

7.5
2005-07-27 CVE-2005-2400 Phpfinance Authentication Bypass vulnerability in PHPfinance 0.3

The inc.login.php scripts in PHPFinance 0.3 allows remote attackers to bypass the login and gain privileges.

7.5
2005-07-27 CVE-2005-2399 PHP Surveyor SQL Injection vulnerability in PHP Surveyor PHP Surveyor 0.98

PHP Surveyor 0.98 allows remote attackers to trigger SQL errors via missing parameters to (1) browse.php, (2) export.php, (3) conditions.php, or (4) spss.php.

7.5
2005-07-27 CVE-2005-2398 PHP Surveyor SQL Injection vulnerability in PHP Surveyor PHP Surveyor 0.98

Multiple SQL injection vulnerabilities in PHP Surveyor 0.98 allows remote attackers to execute arbitrary SQL commands via (1) the sid, start, and id parameters to browse.php, the sid parameter to (2) dataentry.php, (3) export.php, (4) admin.php, (5) conditions.php, (6) spss.php, (7) deletesurvey.php, (8) dumpsurvey.php, or (9) statistics.php, or the lid parameter to (10) labels.php or (11) dumplabel.php.

7.5
2005-07-27 CVE-2005-2387 Goodtech Systems Remote Buffer Overflow vulnerability in Goodtech Systems Goodtech Smtp Server 5.16

Multiple stack-based buffer overflows in GoodTech SMTP server 5.16 allow remote attackers to execute arbitrary code via (1) a RCPT TO command with a long DNS name, or (2) a large number of RCPT TO commands with a long e-mail name arugment in the last command.

7.5
2005-07-27 CVE-2005-2385 Alwil Remote Security vulnerability in Alwil Avast Antivirus 4.6.460/4.6.665

Buffer overflow in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/Professional Edition 4.6.665 and Server Edition 4.6.460, allows remote attackers to execute arbitrary code via an ACE archive containing a long filename.

7.5
2005-07-26 CVE-2005-2383 Phpnews SQL Injection vulnerability in PHPnews 1.2.5

SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request.

7.5
2005-07-26 CVE-2005-2374 Belkin Remote Security vulnerability in Belkin 54G Wireless Router

Belkin 54g wireless routers do not properly set an administrative password, which allows remote attackers to gain access via the (1) Telnet or (2) web administration interfaces.

7.5
2005-07-26 CVE-2005-2369 EKG Memory Alignment Remote Denial of Service vulnerability in EKG Libgadu

Multiple integer signedness errors in libgadu, as used in ekg before 1.6rc2 and other packages, may allow remote attackers to cause a denial of service or execute arbitrary code.

7.5
2005-07-26 CVE-2005-1852 EKG
KDE
Centericq
Kadu
Numeric Errors vulnerability in multiple products

Multiple integer overflows in libgadu, as used in Kopete in KDE 3.2.3 to 3.4.1, ekg before 1.6rc3, GNU Gadu, CenterICQ, Kadu, and other packages, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an incoming message.

7.5
2005-07-27 CVE-2005-2388 Microsoft USB Driver Buffer Overflow vulnerability in Microsoft Windows

Buffer overflow in a certain USB driver, as used on Microsoft Windows, allows attackers to execute arbitrary code.

7.2
2005-07-26 CVE-2005-2382 Oray Local Privilege Escalation vulnerability in Oray Peanuthull 3.0.1.0

Oray PeanutHull 3.0.1.0 and earlier does not properly drop SYSTEM privileges when launched from the system tray, which allows local users to gain privileges by accessing the Help functionality.

7.2
2005-07-26 CVE-2005-2373 Whitsoft Development Local Security vulnerability in Slimftpd 3.15/3.16

Buffer overflow in SlimFTPd 3.15 and 3.16 allows remote authenticated users to execute arbitrary code via a long directory name to (1) LIST, (2) DELE or (3) RNFR commands.

7.2
2005-07-26 CVE-2005-2372 Oracle Local Security vulnerability in Forms And Reports

Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.

7.2
2005-07-26 CVE-2005-2218 Freebsd Unspecified vulnerability in Freebsd

The device file system (devfs) in FreeBSD 5.x does not properly check parameters of the node type when creating a device node, which makes hidden devices available to attackers, who can then bypass restrictions on a jailed process.

7.2

28 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-07-27 CVE-2005-2390 Proftpd Project Unspecified vulnerability in Proftpd Project Proftpd

Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain sensitive information via (1) certain inputs to the shutdown message from ftpshut, or (2) the SQLShowInfo mod_sql directive.

6.4
2005-07-27 CVE-2005-2403 Realchat Unspecified vulnerability in Realchat 3.5.1B

The login protocol in RealChat 3.5.1b does not use authentication, which allows remote attackers to log on as other users by sniffing the beginning of a chat session and replaying it via a modified username.

5.0
2005-07-27 CVE-2005-2401 PHP Fusion Unspecified vulnerability in PHP Fusion PHP Fusion

PHP-Fusion allows remote attackers to inject arbitrary Cascading Style Sheets (CSS) via the BBCode color tag.

5.0
2005-07-27 CVE-2005-2395 Mozilla Authentication Mechanism vulnerability in Multiple Browser Weak

Mozilla Firefox 1.0.4 and 1.0.5 does not choose the challenge with the strongest authentication scheme available as required by RFC2617, which might cause credentials to be sent in plaintext even if an encrypted channel is available.

5.0
2005-07-27 CVE-2005-2394 Cutephp Remote Security vulnerability in Cutephp Cutenews 1.3.6

show_news.php in CuteNews 1.3.6 allows remote attackers to obtain the full path of the server via an invalid archive parameter.

5.0
2005-07-27 CVE-2005-2391 3Com Information Disclosure Vulnerabilit in OfficeConnect Wireless11g Access Point 3CRWE454G72

Unknown vulnerability in 3Com OfficeConnect Wireless 11g Access Point before 1.03.12 allows remote attackers to obtain sensitive information via the web interface.

5.0
2005-07-27 CVE-2005-2389 Symantec Veritas Denial-Of-Service vulnerability in Symantec Veritas Netbackup Enterprise Server and Netbackup Server

NDMP server in Veritas NetBackup 5.1 allows attackers to cause a denial of service via a CONFIG message with an out-of-range timestamp, which triggers a null dereference.

5.0
2005-07-27 CVE-2005-2384 Alwil Directory Traversal vulnerability in Alwil Avast Antivirus 4.6.460/4.6.665

Directory traversal vulnerability in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/Professional Edition 4.6.665 and Server Edition 4.6.460, allows remote attackers to write arbitrary files via an ACE archive containing filenames with (1) ..

5.0
2005-07-27 CVE-2005-2335 Fetchmail Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Fetchmail

Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses.

5.0
2005-07-26 CVE-2005-2381 PHP Surveyor Information Disclosure vulnerability in PHP Surveyor PHP Surveyor 0.98

PHP Surveyor 0.98 allows remote attackers to obtain sensitive information via a direct request to (1) question.php, (2) survey.php, or (3) group.php in the root directory, a direct request to (4) database.php, (5) sessioncontrol.php, (6) html.php, (7) sessioncontrol.php, an invalid (8) qid parameter to dumpquestion.php, or an invalid lid parameter to (9) labels.php or (10) dumplabel.php, which reveal the path in an error message.

5.0
2005-07-26 CVE-2005-2380 PHP Surveyor Cross-Site Scripting vulnerability in PHP Surveyor PHP Surveyor 0.98

Multiple cross-site scripting vulnerabilities in PHP Surveyor 0.98 allow remote attackers to inject arbitrary web script or HTML via the (1) sid, (2) start, and (3) id parameters to browse.php, or the sid parameter to (4) dataentry.php or (5) export.php.

5.0
2005-07-26 CVE-2005-2378 Oracle Path Traversal vulnerability in Oracle Reports

Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet.

5.0
2005-07-26 CVE-2005-2377 Mandrakesoft Denial-Of-Service vulnerability in Mandrakesoft Mandrake Linux and Mandrake Linux Corporate Server

nss_ldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of service (crond and other application crash) if they can cause an LDAP server to become unavailable.

5.0
2005-07-26 CVE-2005-2376 Codemasters Denial-Of-Service vulnerability in Toca Race Driver

Buffer overflow in Race Driver 1.20 and earlier allows remote attackers to cause a denial of service (application crash) via a long (1) nickname or (2) chat message.

5.0
2005-07-26 CVE-2005-2375 Codemasters Denial-Of-Service vulnerability in Toca Race Driver

Format string vulnerability in Race Driver 1.20 and earlier allows remote attackers to cause a denial of service (application crash) via format string specifiers in a (1) nickname or (2) chat message.

5.0
2005-07-26 CVE-2005-2371 Oracle Path Traversal vulnerability in Oracle Reports

Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path sequences in the desname parameter.

5.0
2005-07-26 CVE-2005-2370 EKG
ROB Flynn
Resource Management Errors vulnerability in multiple products

Multiple "memory alignment errors" in libgadu, as used in ekg before 1.6rc2, Gaim before 1.5.0, and other packages, allows remote attackers to cause a denial of service (bus error) on certain architectures such as SPARC via an incoming message.

5.0
2005-07-26 CVE-2005-1920 KDE Unspecified vulnerability in KDE

The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were set on the original file, which could allow local users and possibly remote attackers to obtain sensitive information.

5.0
2005-07-26 CVE-2005-1849 GNU Buffer Overflow vulnerability in GNU Zlib 1.2.2

inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes a large dynamic tree to be produced.

5.0
2005-07-26 CVE-2005-1691 SAP Unspecified vulnerability in SAP R 3

Directory traversal vulnerability in Internet Graphics Server in SAP before 6.40 Patch 11 allows remote attackers to read arbitrary files via ".." sequences in an HTTP GET request.

5.0
2005-07-27 CVE-2005-2402 Phpsitesearch Cross-Site Scripting vulnerability in PHPsitesearch 1.7.7D

Cross-site scripting (XSS) vulnerability in search.php in PHPSiteSearch 1.7.7d allows remote attackers to inject arbitrary web script or HTML via the query parameter.

4.3
2005-07-27 CVE-2005-2397 GNU Cross-Site Scripting vulnerability in GNU PHPbook 1.46

Cross-site scripting (XSS) vulnerability in guestbook.php in phpBook 1.46 allows remote attackers to inject arbitrary web script or HTML via the admin parameter.

4.3
2005-07-27 CVE-2005-2396 Mediawiki Remote Cross-Site Scripting vulnerability in MediaWiki

Cross-site scripting (XSS) vulnerability in MediaWiki 1.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the page move template.

4.3
2005-07-27 CVE-2005-2393 Cutephp Cross-Site Scripting vulnerability in Cutephp Cutenews 1.3.6

Cross-site scripting (XSS) vulnerability in CuteNews 1.3.6 allows remote attackers to inject arbitrary web script or HTML via (1) the lastusername parameter to index.php or (2) selected_search_arch parameter to search.php.

4.3
2005-07-27 CVE-2005-2392 Cmsmadesimple Cross-Site Scripting vulnerability in CMSimple Index.PHP Search

Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function.

4.3
2005-07-27 CVE-2005-2386 Elemental Software Cross-Site Scripting vulnerability in Elemental Software Cartwiz 1.10/1.20

Cross-site scripting (XSS) vulnerability in viewCart.asp in CartWIZ 1.20 allows remote attackers to inject arbitrary web script or HTML via the message parameter.

4.3
2005-07-26 CVE-2005-2379 Oracle Cross-Site Scripting vulnerability in Oracle Reports 9.0.2

Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv, (2) test parameter to parsequery, or (3) delimiter or (4) CELLWRAPPER parameter to rwservlet.

4.3
2005-07-26 CVE-2005-2276 Novell HTML Injection vulnerability in Novell Groupwise Webaccess 6.0/6.5

Cross-site scripting (XSS) vulnerability in Novell Groupwise WebAccess 6.5 before July 11, 2005 allows remote attackers to inject arbitrary web script or HTML via an e-mail message with an encoded javascript URI (e.g.

4.3

0 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS