Weekly Vulnerabilities Reports > February 1 to 7, 2010

Overview

58 new vulnerabilities reported during this period, including 1 critical vulnerabilities and 11 high severity vulnerabilities. This weekly summary report vulnerabilities in 65 products from 36 vendors including SUN, IBM, Geopp, Microsoft, and Debian. Vulnerabilities are notably categorized as "Cross-site Scripting", "Improper Input Validation", "Permissions, Privileges, and Access Controls", "Numeric Errors", and "Information Exposure".

  • 50 reported vulnerabilities are remotely exploitables.
  • 2 reported vulnerabilities have public exploit available.
  • 22 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 49 reported vulnerabilities are exploitable by an anonymous user.
  • SUN has the most reported vulnerabilities, with 6 reported vulnerabilities.
  • Microsoft has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

1 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2010-02-04 CVE-2010-0555 Microsoft Security Bypass vulnerability in Windows Vista

Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving the product's use of text/html as the default content type for files that are encountered after a redirection, aka the URLMON sniffing vulnerability, a variant of CVE-2009-1140 and related to CVE-2008-1448.

9.3

11 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2010-02-05 CVE-2010-0559 SUN Configuration vulnerability in SUN Opensolaris

The default configuration of Oracle OpenSolaris snv_91 through snv_131 allows attackers to have an unspecified impact via vectors related to using kclient to join a Windows Active Directory domain.

7.5
2010-02-05 CVE-2010-0558 SUN Configuration vulnerability in SUN Opensolaris

The default configuration of Oracle OpenSolaris snv_77 through snv_131 allows attackers to have an unspecified impact via vectors related to using smbadm to join a Windows Active Directory domain.

7.5
2010-02-05 CVE-2010-0557 IBM Credentials Management vulnerability in IBM Cognos Express 9.0

IBM Cognos Express 9.0 allows attackers to obtain unspecified access to the Tomcat Manager component, and cause a denial of service, by leveraging hardcoded credentials.

7.5
2010-02-04 CVE-2010-0554 Geopp Improper Authentication vulnerability in Geopp Geo++ Gncaster 1.4.0.0

The HTTP Authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier uses the same nonce for all authentication, which allows remote attackers to hijack web sessions or bypass authentication via a replay attack.

7.5
2010-02-04 CVE-2010-0552 Geopp Improper Input Validation vulnerability in Geopp Geo++ Gncaster 1.4.0.0

Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via multiple requests for a non-existent file using a long URI.

7.5
2010-02-03 CVE-2010-0304 Wireshark Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Wireshark

Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.

7.5
2010-02-02 CVE-2010-0471 Enanocms SQL Injection vulnerability in Enanocms

SQL injection vulnerability in the comment submission interface (includes/comment.php) in Enano CMS before 1.0.6pl1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.

7.5
2010-02-02 CVE-2010-0469 Files2Links SQL Injection vulnerability in Files2Links F2L 3000 Appliance 4.0.0

SQL injection vulnerability in Files2Links F2L 3000 appliance 4.0.0, and possibly other versions and models, allows remote attackers to execute arbitrary SQL commands via unspecified parameters to the login page.

7.5
2010-02-02 CVE-2009-4015 Debian SQL Injection vulnerability in Debian Lintian

Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.

7.5
2010-02-02 CVE-2009-4014 Debian USE of Externally-Controlled Format String vulnerability in Debian Lintian

Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.

7.5
2010-02-02 CVE-2009-4013 Debian Path Traversal vulnerability in Debian Lintian

Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.

7.5

41 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2010-02-04 CVE-2010-0301 Maildrop Permissions, Privileges, and Access Controls vulnerability in Maildrop

main.C in maildrop 2.3.0 and earlier, when run by root with the -d option, uses the gid of root for execution of the .mailfilter file in a user's home directory, which allows local users to gain privileges via a crafted file.

6.9
2010-02-04 CVE-2010-0443 HP Permissions, Privileges, and Access Controls vulnerability in HP Openvms RMS Vms83Armsv1000/Vms83Aupdatev1100

Unspecified vulnerability in Record Management Services (RMS) before VMS83A_RMS-V1100 for HP OpenVMS on the Alpha platform allows local users to gain privileges via unknown vectors.

6.8
2010-02-04 CVE-2009-4016 Ircd Hybrid
Ircd Ratbox
Oftc
Numeric Errors vulnerability in multiple products

Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.

6.8
2010-02-02 CVE-2010-0010 Apache Numeric Errors vulnerability in Apache Http Server

Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.

6.8
2010-02-04 CVE-2010-0553 Geopp Buffer Errors vulnerability in Geopp Geo++ Gncaster 1.4.0.0

Geo++ GNCASTER 1.4.0.7 and earlier allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long NMEA data sentence.

6.5
2010-02-02 CVE-2010-0442 Postgresql Numeric Errors vulnerability in Postgresql 8.0.23/8.1.11/8.3.8

The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."

6.5
2010-02-03 CVE-2009-4184 HP Privilege Escalation vulnerability in HP Enterprise Cluster Master Toolkit B.05.00

Unspecified vulnerability in HP Enterprise Cluster Master Toolkit (ECMT) B.05.00 on HP-UX B.11.23 (11i v2) and HP-UX B.11.31 (11i v3) allows local users to gain access to an Oracle or Sybase database via unknown vectors.

6.2
2010-02-04 CVE-2009-2750 IBM Configuration vulnerability in IBM Websphere Service Registry and Repository 6.3.0/6.3.0.1

IBM WebSphere Service Registry and Repository (WSRR) 6.3.0 before FP2 does not have the intended configuration properties, which allows remote authenticated users to obtain unspecified data access via a property query.

5.5
2010-02-05 CVE-2003-1587 Iplanet Cross-Site Scripting vulnerability in Iplanet Loganpro

Cross-site scripting (XSS) vulnerability in LoganPro allows remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header.

5.0
2010-02-04 CVE-2010-0551 Geopp Information Exposure vulnerability in Geopp Geo++ Gncaster 1.4.0.0

HTTP authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to read authentication headers of other users via a large request with an incorrect authentication attempt, which includes sensitive memory in the response.

5.0
2010-02-04 CVE-2010-0549 Xerox Information Exposure vulnerability in Xerox products

Unspecified vulnerability in the Network Controller in Xerox WorkCentre 6400 System Software 060.070.109.11407 through 060.070.109.29510, and Net Controller 060.079.11410 through 060.079.29310, allows remote attackers to access "directory structure" via a crafted PostScript file, aka "Unauthorized Directory Structure Access Vulnerability."

5.0
2010-02-04 CVE-2010-0548 Xerox Information Exposure vulnerability in Xerox products

Multiple unspecified vulnerabilities in the Network Controller and Web Server in Xerox WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, and 5687 allow remote attackers to (1) access mailboxes via unknown vectors that bypass Scan to Mailbox authorization or (2) read device configuration information via via unknown vectors that bypass web server authorization.

5.0
2010-02-04 CVE-2010-0441 Asterisk Improper Input Validation vulnerability in Asterisk

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service (daemon crash) via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is (1) missing, (2) modified to contain a negative number, or (3) modified to contain a large number.

5.0
2010-02-04 CVE-2010-0303 Dinko Korunic Improper Input Validation vulnerability in Dinko Korunic Hybserv2 1.9.2/1.9.3/1.9.4

mystring.c in hybserv in IRCD-Hybrid (aka Hybrid2 IRC Services) 1.9.2 through 1.9.4 allows remote attackers to cause a denial of service (daemon crash) via a ":help \t" private message to the MemoServ service.

5.0
2010-02-04 CVE-2010-0300 Ircd Ratbox Unspecified vulnerability in Ircd-Ratbox

cache.c in ircd-ratbox before 2.2.9 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a HELP command.

5.0
2010-02-03 CVE-2010-0496 Freebit
Apple
Improper Input Validation vulnerability in Freebit Serversman 3.1.5

FreeBit ServersMan 3.1.5 on Apple iPhone OS 3.1.2, and iPhone OS for iPod touch, allows remote attackers to cause a denial of service (daemon crash) via a HEAD request for the / URI.

5.0
2010-02-03 CVE-2010-0305 Process ONE Improper Input Validation vulnerability in Process-One Ejabberd

ejabberd_c2s.erl in ejabberd before 2.1.3 allows remote attackers to cause a denial of service (daemon crash) via a large number of c2s (aka client2server) messages that trigger a queue overload.

5.0
2010-02-03 CVE-2010-0295 Lighttpd Resource Management Errors vulnerability in Lighttpd

lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.

5.0
2010-02-03 CVE-2009-3387 Mozilla Permissions, Privileges, and Access Controls vulnerability in Mozilla Bugzilla

Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.

5.0
2010-02-03 CVE-2010-0185 Adobe Permissions, Privileges, and Access Controls vulnerability in Adobe Coldfusion 9.0

The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL.

5.0
2010-02-02 CVE-2010-0472 IBM Remote Denial of Service vulnerability in IBM DB2 9.7.0.1

kuddb2 in Tivoli Monitoring for DB2, as distributed in IBM DB2 9.7 FP1 on Linux, allows remote attackers to cause a denial of service (daemon crash) via a certain byte sequence.

5.0
2010-02-02 CVE-2010-0467 Chillcreations
Joomla
Path Traversal vulnerability in Chillcreations COM Ccnewsletter 1.0.5

Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a ..

5.0
2010-02-03 CVE-2010-0453 SUN Improper Input Validation vulnerability in SUN Opensolaris and Solaris

The ucode_ioctl function in intel/io/ucode_drv.c in Sun Solaris 10 and OpenSolaris snv_69 through snv_133, when running on x86 architectures, allows local users to cause a denial of service (panic) via a request with a 0 size value to the UCODE_GET_VERSION IOCTL, which triggers a NULL pointer dereference in the ucode_get_rev function, related to retrieval of the microcode revision.

4.9
2010-02-03 CVE-2010-0038 Apple Resource Management Errors vulnerability in Apple Iphone OS

Recovery Mode in Apple iPhone OS 1.0 through 3.1.2, and iPhone OS for iPod touch 1.1 through 3.1.2, allows physically proximate attackers to bypass device locking, and read or modify arbitrary data, via a USB control message that triggers memory corruption.

4.6
2010-02-05 CVE-2009-4185 HP Cross-Site Scripting vulnerability in HP System Management Homepage

Cross-site scripting (XSS) vulnerability in proxy/smhui/getuiinfo in HP System Management Homepage (SMH) before 6.0 allows remote attackers to inject arbitrary web script or HTML via the servercert parameter.

4.3
2010-02-05 CVE-2009-2751 IBM Cryptographic Issues vulnerability in IBM Websphere Commerce 7.0

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors.

4.3
2010-02-05 CVE-2003-1586 Iplanet Cross-Site Scripting vulnerability in Iplanet Webexpert

Cross-site scripting (XSS) vulnerability in WebExpert allows remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header.

4.3
2010-02-05 CVE-2003-1585 Alentum Cross-Site Scripting vulnerability in Alentum Weblog Expert

Cross-site scripting (XSS) vulnerability in WebLogExpert allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

4.3
2010-02-05 CVE-2003-1584 Surfstats Cross-Site Scripting vulnerability in Surfstats

Cross-site scripting (XSS) vulnerability in SurfStats allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

4.3
2010-02-05 CVE-2003-1583 Webtrends Cross-Site Scripting vulnerability in Webtrends LOG Analyzer

Cross-site scripting (XSS) vulnerability in WebTrends allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

4.3
2010-02-05 CVE-2003-1580 Apache Numeric Errors vulnerability in Apache Http Server 2.0.44

The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

4.3
2010-02-05 CVE-2003-1579 SUN
Microsoft
Numeric Errors vulnerability in SUN ONE web Server 6.0

Sun ONE (aka iPlanet) Web Server 6 on Windows, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

4.3
2010-02-05 CVE-2003-1578 SUN Unspecified vulnerability in SUN ONE web Server 4.1/6.0

Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to hide HTTP requests from the log-preview functionality by accompanying the requests with crafted DNS responses specifying a domain name beginning with a "format=" substring, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

4.3
2010-02-04 CVE-2010-0255 Microsoft Permissions, Privileges, and Access Controls vulnerability in Microsoft IE

Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving JavaScript exploit code that constructs a reference to a file://127.0.0.1 URL, aka the dynamic OBJECT tag vulnerability, as demonstrated by obtaining the data from an index.dat file, a variant of CVE-2009-1140 and related to CVE-2008-1448.

4.3
2010-02-03 CVE-2009-3989 Mozilla Permissions, Privileges, and Access Controls vulnerability in Mozilla Bugzilla

Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.

4.3
2010-02-03 CVE-2010-0440 Cisco Cross-Site Scripting vulnerability in Cisco products

Cross-site scripting (XSS) vulnerability in +CSCOT+/translation in Cisco Secure Desktop 3.4.2048, and other versions before 3.5; as used in Cisco ASA appliance before 8.2(1), 8.1(2.7), and 8.0(5); allows remote attackers to inject arbitrary web script or HTML via a crafted POST parameter, which is not properly handled by an eval statement in binary/mainv.js that writes to start.html.

4.3
2010-02-02 CVE-2010-0470 Comtrend Cross-Site Scripting vulnerability in Comtrend Ct-507It Adsl Router

Cross-site scripting (XSS) vulnerability in scvrtsrv.cmd in Comtrend CT-507IT ADSL Router allows remote attackers to inject arbitrary web script or HTML via the srvName parameter.

4.3
2010-02-02 CVE-2010-0468 Paperthin Cross-Site Scripting vulnerability in Paperthin Commonspot Content Server

Cross-site scripting (XSS) vulnerability in utilities/longproc.cfm in PaperThin CommonSpot Content Server allows remote attackers to inject arbitrary web script or HTML via the url parameter.

4.3
2010-02-02 CVE-2009-3035 Symantec Credentials Management vulnerability in Symantec Altiris Notification Server 6.0

The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.

4.3
2010-02-04 CVE-2010-0550 Geopp Improper Authentication vulnerability in Geopp Geo++ Gncaster 1.4.0.0

admin.htm in Geo++ GNCASTER 1.4.0.7 and earlier does not properly enforce HTTP Digest Authentication, which allows remote authenticated users to use HTTP Basic Authentication, bypassing intended server policy.

4.0
2010-02-03 CVE-2010-0308 Squid Cache Improper Input Validation vulnerability in Squid-Cache Squid

lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.

4.0

5 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2010-02-05 CVE-2003-1582 Microsoft Cross-Site Scripting vulnerability in Microsoft Internet Information Server 6.0

Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

2.6
2010-02-05 CVE-2003-1581 Apache Cross-Site Scripting vulnerability in Apache Http Server 2.0.44

The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

2.6
2010-02-05 CVE-2003-1577 SUN Cross-Site Scripting vulnerability in SUN ONE web Server 4.1/6.0

Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files, and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer, via an HTTP request in conjunction with a crafted DNS response, related to an "Inverse Lookup Log Corruption (ILLC)" issue, a different vulnerability than CVE-2002-1315 and CVE-2002-1316.

2.6
2010-02-04 CVE-2010-0547 Samba Improper Input Validation vulnerability in Samba

client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.

2.1
2010-02-05 CVE-2009-2752 IBM Cryptographic Issues vulnerability in IBM Websphere Commerce 7.0

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms.

1.5