LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Closed Thread
 
Search this Thread
Old 12-22-2004, 05:32 PM   #1
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
LQ Security Report - December 22nd 2004


December 21st 2004
50 issues handled (SF)
1. Opera Web Browser Download Dialogue Box File Name Spoofing V...
2. Citadel/UX Network Data Logging Remote Format String Vulnera...
3. PhpDig Unspecified Remote Vulnerability
4. SugarSales Multiple Remote Vulnerabilities
5. SQLgrey Postfix Greylisting Service Unspecified SQL Injectio...
6. Opera Web Browser KDE KFMCLIENT Remote Command Execution Vul...
7. Linux NFS 64-Bit Architecture Remote Buffer Overflow Vulnera...
8. ZGV Image Viewer Animated GIF Remote Memory Corruption Vulne...
9. Linux Kernel IGMP Multiple Vulnerabilities
10. Sun Java System Web And Application Server Remote Session Di...
11. Linux Kernel SCM_SEND Local Denial of Service Vulnerability
12. Adobe Acrobat Reader Email Message Remote Buffer Overflow Vu...
13. Linux Kernel Local DRM Denial Of Service Vulnerability
14. Linux Kernel PROC Filesystem Local Information Disclosure Vu...
15. Linux Kernel Sys32_NI_Syscall/Sys32_VM86_Warning Local Buffe...
16. Linux Kernel Sock_DGram_SendMsg Local Denial Of Service Vuln...
17. Vim Modelines Arbitrary Command Execution Variant Vulnerabil...
18. Novell NetMail Multiple Remote Vulnerabilities
19. Ethereal Multiple Unspecified Denial of Service and Potentia...
20. Linux Kernel Multiple Local Vulnerabilities
21. ChBg Scenario File Overflow Vulnerability
22. MPG123 Find Next File Remote Client-Side Buffer Overflow Vul...
23. IglooFTP Server Response Download Filename File Corruption V...
24. IglooFTP File Upload Insecure Temporary File Vulnerability
25. MPlayer MMST Get_Header Remote Client-Side Buffer Overflow V...
26. PHP Multiple Local And Remote Vulnerabilities
27. TNFTP FTP Client Directory Traversal Vulnerability
28. Xine-Lib Remote Client-Side Buffer Overflow Vulnerability
29. Samba Directory Access Control List Remote Integer Overflow ...
30. Yanf HTTP Response Buffer Overflow Vulnerability
31. JPegToAvi File List Buffer Overflow Vulnerability
32. Vilistextum HTML Attribute Parsing Buffer Overflow Vulnerabi...
33. 2Fax Tab Expansion Buffer Overflow Vulnerability
34. PHP Multiple Remote Vulnerabilities
35. MPlayer And Xine-Lib Multiple Remote Client-Side Buffer Over...
36. QwikMail HELO Command Buffer Overflow Vulnerability
37. NASM Error Preprocessor Directive Buffer Overflow Vulnerabil...
38. PHP JPEG Image Buffer Overflow Vulnerability
39. NetBSD Multiple Local Unspecified Binary Compatibility Layer...
40. YAMT ID3 Tag Sort Command Execution Vulnerability
41. O3Read HTML Parser Buffer Overflow Vulnerability
42. HTML2HDML File Conversion Buffer Overflow Vulnerability
43. Easy Software Products LPPassWd CUPS Password File Truncatio...
44. Easy Software Products LPPassWd Resource Limit Denial Of Ser...
45. ASP2PHP Preparse Token Variable Buffer Overflow Vulnerabilit...
46. ASP2PHP Preparse Temp Variable Buffer Overflow Vulnerability
47. UML_Utilities UML_Net Slip Network Interface Denial Of Servi...
48. ABC2MTEX Process ABC Key Field Buffer Overflow Vulnerability
49. ABCPP Directive Handler Buffer Overflow Vulnerability
50. ABC2PS/JCABC2PS Voice Field Buffer Overflow Vulnerability
 
Old 12-22-2004, 06:06 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Original Poster
Rep: Reputation: 57
December 21st 2004 (SF) - Part A

Security Focus

1. Opera Web Browser Download Dialogue Box File Name Spoofing V...
BugTraq ID: 11883
Remote: Yes
Date Published: Dec 11 2004
Relevant URL: http://www.securityfocus.com/bid/11883
Summary:
A download dialogue box file name spoofing vulnerability affects Opera. This issue is due to a design error that facilitates the spoofing of file names. The problem presents itself when an unsuspecting user attempts to download a file from a malicious site. The malicious web site may respond with HTTP header data that is sufficient to trigger the issue. As a result of this attack, the requested filename and file type may be misrepresented in a file download dialog, making it possible for an attacker to make a potentially malicious file seem innocuous.

2. Citadel/UX Network Data Logging Remote Format String Vulnera...
BugTraq ID: 11885
Remote: Yes
Date Published: Dec 13 2004
Relevant URL: http://www.securityfocus.com/bid/11885
Summary:
A remote format string vulnerability reportedly affects the network data logging functionality of Citadel/UX. This issue is due to a failure of the application to properly sanitize user-supplied input prior to passing it as the format specifier to a formatted printing function. A remote attacker may leverage this issue to write to arbitrary process memory, facilitating code execution. Any code execution would take place with superuser privileges.

3. PhpDig Unspecified Remote Vulnerability
BugTraq ID: 11889
Remote: Yes
Date Published: Dec 13 2004
Relevant URL: http://www.securityfocus.com/bid/11889
Summary:
PhpDig is reported prone to a security vulnerability. The details of this vulnerability are unspecified. It is conjectured that this vulnerability may be exploited by a remote attacker to compromise a computer that is hosting the vulnerable software. This BID will be updated as soon as further details are available.

4. SugarSales Multiple Remote Vulnerabilities
BugTraq ID: 11896
Remote: Yes
Date Published: Dec 13 2004
Relevant URL: http://www.securityfocus.com/bid/11896
Summary:
Multiple remote vulnerabilities are reported to exist in SugarSales. The first reported issue is an SQL injection vulnerability. This vulnerability is due to a lack of proper input-validation by the application, prior to utilizing attacker-supplied data in and SQL query. This vulnerability is reported to exist in versions prior to 2.0.1a. The next issue is reportedly a directory traversal vulnerability. This vulnerability is also due to a lack of proper input-validation by the application. The last reported issue is a remote denial of service and information disclosure vulnerability. The directory traversal and installation script vulnerabilities reportedly exist in all current versions of SugarSales. These vulnerabilities may be related to the issues disclosed in BID 11740.

5. SQLgrey Postfix Greylisting Service Unspecified SQL Injectio...
BugTraq ID: 11898
Remote: Yes
Date Published: Dec 13 2004
Relevant URL: http://www.securityfocus.com/bid/11898
Summary:
SQLgrey Postfix Greylisting Service is prone to an unspecified SQL injection vulnerability. This issue is reportedly due to insufficient sanitization of SQL syntax from fields in email processed by the software. The issue could be exploited to influence SQL queries, potentially allowing for compromise of the software or other attacks that impact database security. This issue was reportedly missed by the vendor when they fixed the issue described in BID 11633.

6. Opera Web Browser KDE KFMCLIENT Remote Command Execution Vul...
BugTraq ID: 11901
Remote: Yes
Date Published: Dec 13 2004
Relevant URL: http://www.securityfocus.com/bid/11901
Summary:
It is reported that Opera for Linux is susceptible to a remote command execution vulnerability. This issue is due to a default configuration setting in Opera that utilizes the KDE 'kfmclient' utility to open unknown content. Exploitation of this issue allows attacker-supplied commands to be executed in the context of the user running Opera. Version 7.54 of Opera for Linux with KDE version 3.2.3 is reported vulnerable to this issue. Other versions may also be affected.

7. Linux NFS 64-Bit Architecture Remote Buffer Overflow Vulnera...
BugTraq ID: 11911
Remote: Yes
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11911
Summary:
A remote buffer overflow reportedly affects the disk quota functionality of the Linux NFS utilities. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers. An attacker may leverage this issue to execute arbitrary on an affected computer with superuser privileges. This may be exploited to gain unauthorized access or privilege escalation.

8. ZGV Image Viewer Animated GIF Remote Memory Corruption Vulne...
BugTraq ID: 11915
Remote: Yes
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11915
Summary:
A remote memory corruption vulnerability affects the animated GIF functionality of zgv. It should be noted that although it is likely that xzgv is also vulnerable to this issue, this has not been confirmed. The underlying issue causing this vulnerability is unknown, although it is likely due to a failure of the application to handle malformed image files. The full impact of this issue is currently unknown, however this issue can be leveraged to cause the affected application to crash. It is possible, however unconfirmed, that this issue may be leveraged to execute arbitrary code.

9. Linux Kernel IGMP Multiple Vulnerabilities
BugTraq ID: 11917
Remote: Yes
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11917
Summary:
Linux kernel IGMP functionality is reported prone to multiple vulnerabilities. These issues can allow local attackers to carry out denial of service and privilege escalation attacks. Remote attackers may also cause denial of service conditions in vulnerable computers. The first issue exists in the 'ip_mc_source()' function and may allow local attackers to cause a denial of service condition or gain elevated privileges. The second issue is related to the first issue and may allow an attacker to disclose sensitive kernel memory. The third vulnerability exists in the IGMP/IP networking module and may allow remote attackers to cause a denial of service condition in a vulnerable computer.

10. Sun Java System Web And Application Server Remote Session Di...
BugTraq ID: 11918
Remote: Yes
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11918
Summary:
A remote session disclosure vulnerability affects the Sun Java System Web and Application Servers. This issue is due to a design error that may cause sessions IDs to be revealed. This issue may be exploited to steal session IDs from unsuspecting users and gain access to their current sessions. Reportedly only sessions that do not require authentication are affected by this issue.

11. Linux Kernel SCM_SEND Local Denial of Service Vulnerability
BugTraq ID: 11921
Remote: No
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11921
Summary:
Linux kernel is reported prone to a local denial of service vulnerability. This issue presents itself in the SCM logical sub layer of the socket API. An unprivileged application can craft a malformed auxiliary message and send it to a socket, which results in the kernel invoking '__scm_send()' in a manner that leads to a crash. This issue can allow local attackers to cause a denial of service condition on a vulnerable computer. It is not confirmed if this vulnerability can be leveraged to gain elevated privileges.

12. Adobe Acrobat Reader Email Message Remote Buffer Overflow Vu...
BugTraq ID: 11923
Remote: Yes
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11923
Summary:
A remote buffer overflow vulnerability reportedly affects the email message checking functionality in Adobe Acrobat Reader for Unix. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers. An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation. It should be noted that this issue only affects Adobe Acrobat Reader for the Unix platform.

13. Linux Kernel Local DRM Denial Of Service Vulnerability
BugTraq ID: 11936
Remote: No
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11936
Summary:
It is reported that the DRM module in the Linux kernel is susceptible to a local denial of service vulnerability. This vulnerability likely results in the corruption of video memory, crashing the X server. It is also reported that malicious users may be able to modify the video output. Further details are unavailable at this time. This BID will be updated as further analysis is completed.

14. Linux Kernel PROC Filesystem Local Information Disclosure Vu...
BugTraq ID: 11937
Remote: No
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11937
Summary:
It is reported that the Linux kernel /proc filesystem is susceptible to an information disclosure vulnerability. This issue is due to a race-condition allowing unauthorized access to potentially sensitive process information. This vulnerability may allow malicious local users to gain access to potentially sensitive environment variables in other users processes. As some programs pass passwords and other sensitive information in environment variables, this may aid a malicious user in further attacks. Further details are unavailable at this time. This BID will be updated as further analysis is completed.

15. Linux Kernel Sys32_NI_Syscall/Sys32_VM86_Warning Local Buffe...
BugTraq ID: 11938
Remote: No
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11938
Summary:
The Linux kernel for 64-Bit architectures is reported prone to a local buffer overflow vulnerability. This vulnerability exists in 'sys32_ni_syscall()' and 'sys32_vm86_warning()' as a result of an unbounded copy of a 16 byte string into an 8 byte buffer using the strcpy() function. Immediate consequences of exploitation of this vulnerability could be a kernel panic; this could be used to deny service to legitimate users. It is not currently known whether this vulnerability may be leveraged to provide for execution of arbitrary code.

16. Linux Kernel Sock_DGram_SendMsg Local Denial Of Service Vuln...
BugTraq ID: 11939
Remote: No
Date Published: Dec 14 2004
Relevant URL: http://www.securityfocus.com/bid/11939
Summary:
The Linux kernel is reported to be prone to a local denial of service vulnerability. This vulnerability is reported to exist when 'CONFIG_SECURITY_NETWORK=y' and 'CONFIG_SECURITY_SELINUX=y' options are set in the Linux kernel. A local attacker may exploit this vulnerability to trigger a kernel panic and effectively deny service to legitimate users.

17. Vim Modelines Arbitrary Command Execution Variant Vulnerabil...
BugTraq ID: 11941
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11941
Summary:
Vim modelines is prone to a vulnerability that may permit execution of arbitrary commands. Reportedly, certain modelines options expose this issue. Exploitation could occur when a malicious file is opened in the editor and would occur in the context of the user opening the file. This issue is similar to BID 6384.

18. Novell NetMail Multiple Remote Vulnerabilities
BugTraq ID: 11942
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11942
Summary:
Multiple remote vulnerabilities reportedly affect Novell NetMail. These vulnerabilities are due to multiple issues including failure to verify string length before copying them into static process buffers, failure to handle malformed input, and various design errors. The first issue reported is a buffer overflow vulnerability in the IMAP functionality of the affected application. The second issue is a failure of the application to properly integrate with Symantec antivirus software. Finally a number of issues reported may facilitate denial of service attacks, although these are not confirmed. An attacker may leverage these issues to execute arbitrary code on the affected computer, facilitating system compromise, anti-virus screening bypass, facilitating a false sense of security, and potentially carry out denial of service attacks.

19. Ethereal Multiple Unspecified Denial of Service and Potentia...
BugTraq ID: 11943
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11943
Summary:
Ethereal 0.10.8 has been released to address multiple vulnerabilities. These vulnerabilities are reported to cause denial of service conditions in the application, however, it is reported that some issues may allow for arbitrary code execution. The following specific issues were specified: A denial of service vulnerability presents itself in the DICOM dissector. The application suffers from a denial of service vulnerability when handling a malformed RTP timestamp. It is reported that the HTTP dissector may allow a remote attacker to access memory that was previously freed. Another denial of service issues affecting the application arises when Ethereal processes a specially crafted SMB packet. This BID will be updated as more information becomes available.

20. Linux Kernel Multiple Local Vulnerabilities
BugTraq ID: 11956
Remote: No
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11956
Summary:
The Linux kernel is reported prone to multiple local vulnerabilities. The following individual issues are reported: An integer overflow is reported to exist in 'ip_options_get()' of the 'ip_options.c' kernel source file, this vulnerability is only reported to exist in the 2.6 kernel tree. Although unconfirmed, due to the nature of this vulnerability it is conjectured that this issue may be further leveraged to provide for arbitrary code execution with ring 0 privileges. A local attacker may exploit this vulnerability to deny service to legitimate users. Other attacks are also likely possible. A second integer overflow vulnerability is reported to exist in the 'vc_resize()' function of the Linux kernel, this vulnerability is reported to exist in the 2.6 and 2.4 kernel trees. Although unconfirmed, due to the nature of this vulnerability it is conjectured that this issue may be further leveraged to provide for arbitrary code execution with ring 0 privileges. A local attacker may exploit this vulnerability to deny service to legitimate users. Other attacks are also likely possible. A third vulnerability, a memory leak, is reported to exist in 'ip_options_get()' of the 'ip_options.c' kernel source file, this vulnerability is reported to exist in the 2.6, and 2.4 kernel tree. A local attacker may exploit this vulnerability to consume kernel heap memory resources and in doing so may impact system performance ultimately resulting in a denial of service to legitimate users.

21. ChBg Scenario File Overflow Vulnerability
BugTraq ID: 11957
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11957
Summary:
ChBg is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain superuser privileges on a vulnerable computer. An attacker can exploit this issue by crafting a malicious scenario file. A scenario is a file containing a list of pictures to display. If a user obtains this file and processes it through ChBg, the attacker-supplied instructions may be executed on the vulnerable computer. ChBg 1.5 is reported prone to this vulnerability. It is likely that other versions are affected as well.

22. MPG123 Find Next File Remote Client-Side Buffer Overflow Vul...
BugTraq ID: 11958
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11958
Summary:
A remote client-side buffer overflow vulnerability affects mpg123. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers. An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

23. IglooFTP Server Response Download Filename File Corruption V...
BugTraq ID: 11960
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11960
Summary:
IglooFTP does not properly sanitize server-supplied filenames during downloads, potentially allowing for files to be created or overwritten in the context of the client user. This issue is reported to occur when the FTP client is used to recursively download files from a remote FTP server. This issue reportedly exists in UNIX/Linux based versions of IglooFTP. It is not known if Windows versions are affected.

24. IglooFTP File Upload Insecure Temporary File Vulnerability
BugTraq ID: 11961
Remote: No
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11961
Summary:
IglooFTP creates temporary files in an insecure manner. This issue is reported to occur when the client is uploading files to a remote server. An attacker could abuse this issue through symbolic link attacks that corrupt files owned by the user, most likely resulting in a loss of data. This issue reportedly exists in UNIX/Linux based versions of IglooFTP. It is not known if Windows versions are affected.

25. MPlayer MMST Get_Header Remote Client-Side Buffer Overflow V...
BugTraq ID: 11962
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11962
Summary:
A remote, client-side buffer overflow vulnerability reportedly affects MPlayer. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers. An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.
 
Old 12-22-2004, 06:08 PM   #3
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Original Poster
Rep: Reputation: 57
December 21st 2004 (SF) - Part B

26. PHP Multiple Local And Remote Vulnerabilities
BugTraq ID: 11964
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11964
Summary:
PHP4 and PHP5 are reported prone to multiple local and remote vulnerabilities that may lead to code execution within the context of the vulnerable process. The following specific issues are reported: A heap-based buffer overflow is reported to affect the PHP 'pack()' function call. An attacker that has the ability to make the PHP interpreter run a malicious script may exploit this condition to execute arbitrary instructions in the context of the vulnerable process. A heap-based memory disclosure vulnerability is reported to affect the PHP 'unpack()' function call. An attacker that has the ability to make the PHP interpreter run a malicious script may exploit this condition to reveal portions of the process heap. PHP safe_mode_exec_dir is reported prone to an access control bypass vulnerability. A local attacker that can manipulate the directory name from which the PHP script is called, may bypass 'safe_mode_exec_dir' restrictions by placing shell metacharacters and restricted commands into the directory name of the current directory. PHP safe_mode is reported prone to an access control bypass vulnerability. An attacker that has the ability to make the PHP interpreter run a malicious script may exploit this condition to execute commands that are otherwise restricted by PHP safe_mode. PHP is reported prone to a 'realpath()' path truncation vulnerability. The vulnerability exists due to a lack of sanitization as to whether a path has been silently truncated by the libc realpath() function or not. This may lead to remote file include vulnerabilities in some cases. The PHP function 'unserialize()' is reported prone to a memory corruption vulnerability. This corruption may be leveraged by a remote attacker that has the ability to make the PHP interpreter run a malicious script to execute arbitrary code in the context of the vulnerable process. The PHP function 'unserialize()' is also reported prone to an information disclosure vulnerability. This issue may be leveraged by a remote attacker to disclose the contents of heap memory. This may allow them to gain access to potentially sensitive information, such as database credentials. Finally, the PHP function 'unserialize()', is reported prone to an additional vulnerability. It is reported that previous versions of this function allow a malicious programmer to set references to entries of a variable hash that have already been freed. This can lead to remote memory corruption.

27. TNFTP FTP Client Directory Traversal Vulnerability
BugTraq ID: 11965
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11965
Summary:
The tnftp FTP client is reported susceptible to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input data. This vulnerability results in the ability of the attacker controlling a malicious remote server being able to write to arbitrary locations on the client's computer with the privileges of the user invoking the vulnerable FTP client. Depending on the particular configuration of the vulnerable FTP client, new files may be created, files may be overwritten, or appended to. Depending on the configuration, this may also occur without confirmation.

28. Xine-Lib Remote Client-Side Buffer Overflow Vulnerability
BugTraq ID: 11969
Remote: Yes
Date Published: Dec 16 2004
Relevant URL: http://www.securityfocus.com/bid/11969
Summary:
It is reported that the xine media library is affected by a remote buffer overflow vulnerability. This issue can allow a remote attacker to gain unauthorized access to a vulnerable computer. The overflow condition presents itself in the 'demux_aiff.c' file.

29. Samba Directory Access Control List Remote Integer Overflow ...
BugTraq ID: 11973
Remote: Yes
Date Published: Dec 16 2004
Relevant URL: http://www.securityfocus.com/bid/11973
Summary:
A remotely exploitable integer overflow vulnerability affects the directory access control list (DACL) processing functionality of Samba. This issue is due to a failure of the application to properly perform sanity checking on calculated data sizes prior to copying data into static process buffers. An attacker with access to an SMB share may leverage this issue to overwrite the heap of the affected process, facilitating code execution with superuser privileges.

30. Yanf HTTP Response Buffer Overflow Vulnerability
BugTraq ID: 11975
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11975
Summary:
Yanf is prone to a buffer overflow vulnerability. This issue is exposed when the client reads data from a remote HTTP server. If this issue is successfully exploited, it could allow for execution of arbitrary code in the context of the user running the client.

31. JPegToAvi File List Buffer Overflow Vulnerability
BugTraq ID: 11976
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11976
Summary:
jpegtoavi is prone to a buffer overflow. This issue is exposed when the software handles a malformed file list. As the list originates from an external or untrusted source, this issue is considered remote in nature. If this vulnerability is successfully exploited, it will result in execution of arbitrary code in the context of the user running the application.

32. Vilistextum HTML Attribute Parsing Buffer Overflow Vulnerabi...
BugTraq ID: 11979
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11979
Summary:
Vilistextum is prone to a buffer overflow vulnerability. This issue is exposed when the application parses HTML attributes while converting an HTML file to text/ASCII. Since HTML files will likely originate from an external or untrusted source, this issue should be considered remote in nature. Successful exploitation will allow for execution of arbitrary code in the context of the user running the application.

33. 2Fax Tab Expansion Buffer Overflow Vulnerability
BugTraq ID: 11980
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11980
Summary:
2fax is prone to a buffer overflow vulnerability. This issue is exposed when the software performs tab expansion operations while converting files. Since files may originate from an external or untrusted source, this issue is considered remote in nature. Successful exploitation will result in execution of arbitrary code in the context of the user running the application.

34. PHP Multiple Remote Vulnerabilities
BugTraq ID: 11981
Remote: Yes
Date Published: Dec 16 2004
Relevant URL: http://www.securityfocus.com/bid/11981
Summary:
PHP4 and PHP5 are reported prone to multiple remotely exploitable vulnerabilities. These issue result from insufficient sanitization of user-supplied data. A remote attacker may carry out directory traversal attacks to disclose arbitrary files and upload files to arbitrary locations. It is reported that these vulnerabilities may only be exploited on Windows.

35. MPlayer And Xine-Lib Multiple Remote Client-Side Buffer Over...
BugTraq ID: 11987
Remote: Yes
Date Published: Dec 16 2004
Relevant URL: http://www.securityfocus.com/bid/11987
Summary:
Multiple remote, client side buffer overflow vulnerabilities reportedly affect xine-lib and MPlayer. These issues are due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers. An attacker may exploit these issues to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

36. QwikMail HELO Command Buffer Overflow Vulnerability
BugTraq ID: 11989
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11989
Summary:
QwikMail (qwik-smtpd) is reported prone to a remotely exploitable buffer overflow vulnerability. The issue is due to insufficient bounds checking of client-supplied SMTP HELO request data. This issue could theoretically be exploited to execute arbitrary code. Due to the memory layout, it is also reportedly possible to overwrite an adjacent buffer in a manner that will allow a remote attacker to abuse the server as an unauthorized mail relay.

37. NASM Error Preprocessor Directive Buffer Overflow Vulnerabil...
BugTraq ID: 11991
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11991
Summary:
NASM is prone to a buffer overflow. This condition is exposed when the application attempts to assemble a source file that contains malformed '%error' preprocessor directive arguments. Since the source file may originate from an external or untrusted source, this vulnerability is considered remote in nature(?). Successful exploitation will permit arbitrary code execution with the privileges of the user running the application.

38. PHP JPEG Image Buffer Overflow Vulnerability
BugTraq ID: 11992
Remote: Yes
Date Published: Dec 16 2004
Relevant URL: http://www.securityfocus.com/bid/11992
Summary:
It is reported that PHP is susceptible to a buffer overflow vulnerability in handling JPEG images. This issue is due to a failure of the application to properly bounds check user-supplied image data prior to copying it into a fixed-size memory buffer. This vulnerability allows remote attackers to alter the proper flow of execution of the application, potentially resulting in the execution of attacker-supplied machine code in the context of the web server executing the PHP interpreter.

39. NetBSD Multiple Local Unspecified Binary Compatibility Layer...
BugTraq ID: 11996
Remote: No
Date Published: Dec 16 2004
Relevant URL: http://www.securityfocus.com/bid/11996
Summary:
It is reported that NetBSD is susceptible to multiple unspecified local vulnerabilities in its binary compatibility layer. It is reported that many, if not all of the compatibility types are affected by these vulnerabilities. The system call translation functions reportedly execute unsafe operations with the user-supplied system call arguments. This BID will be updated as further information is disclosed, and as further analysis is performed. These vulnerabilities affect computers running NetBSD that have any 'COMPAT_*' options defined in the running kernel. These vulnerabilities allow local users to crash the kernel, denying service to legitimate users. It is also conjectured that some of these issues may allow for code execution in kernel-space, leading to privilege escalation.

40. YAMT ID3 Tag Sort Command Execution Vulnerability
BugTraq ID: 11999
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/11999
Summary:
YAMT (Yet Another MP3 Tool) is prone to a vulnerability that may allow attackers to execute arbitrary commands. This issue is exposed when the program attempts to sort ID3 tags. As this data may originate from an external or untrusted source, this issue is considered remote in nature.Successful exploitation will allow an attacker to execute arbitrary commands when the software processes an MP3 that contains malicious ID3 tag data. This will occur in the context of the user running the application.

41. O3Read HTML Parser Buffer Overflow Vulnerability
BugTraq ID: 12000
Remote: Yes
Date Published: Dec 17 2004
Relevant URL: http://www.securityfocus.com/bid/12000
Summary:
o3read is prone to a buffer overflow vulnerability. This issue is exposed when the program parses HTML content during file format conversion. This issue is considered to be remote in nature since it is possible that files may originate from an external or untrusted source. Successful exploitation will result in code execution with the privileges of the user running the application.

42. HTML2HDML File Conversion Buffer Overflow Vulnerability
BugTraq ID: 12003
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/12003
Summary:
html2hdml is prone to a buffer overflow vulnerability. This issue is exposed when converting HTML files to HDML (Handheld Device Markup Language). Since HTML files may originate from an external or untrusted source, this vulnerability is considered remote in nature. Successful exploitation may result in execution of arbitrary code in the context of the user running the application.

43. Easy Software Products LPPassWd CUPS Password File Truncatio...
BugTraq ID: 12004
Remote: No
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/12004
Summary:
Easy Software Products lppasswd is prone to a vulnerability that may let local attackers truncate the CUPS password file. This issue occurs because the program ignores write errors. If a local attacker can fill up the drive or otherwise trigger a write error, it is possible that the operation of writing to the CUPS password file may be aborted. The end result is that the CUPS password file may be truncated, likely causing a denial of service condition.

44. Easy Software Products LPPassWd Resource Limit Denial Of Ser...
BugTraq ID: 12005
Remote: No
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/12005
Summary:
Easy Software Products lppasswd is prone to a locally exploitable denial of service vulnerability. This issue occurs when the program attempts to write a file to the system that will exceed any file size resource limits in place. This presents a vulnerability since an unprivileged user with CUPS credentials may set these resource limits and then invoke the application. This will create an empty '/usr/local/etc/cups/passwd.new' file. If this file is present, then future invocations of lppasswd will fail. Successful exploitation will prevent users from changing their CUPS passwords with lppasswd.

45. ASP2PHP Preparse Token Variable Buffer Overflow Vulnerabilit...
BugTraq ID: 12014
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/12014
Summary:
asp2php is prone to a buffer overflow vulnerability. This issue is exposed when the application is used to convert an ASP file to PHP. The particular issue is related to parsing of tokens in ASP files. Since ASP files may originate from an external or untrusted source, this vulnerability is considered to be remote in nature. Successful exploitation would allow for execution of arbitrary code in the context of the user running the application. This issue is reportedly distinct from BID 12015 (ASP2PHP Preparse Temp Variable Buffer Overflow Vulnerability). The differences that distinguish these issues are two separate vulnerabilities have not been determined at this time, other than that the overrun occurs in a different destination buffer.

46. ASP2PHP Preparse Temp Variable Buffer Overflow Vulnerability
BugTraq ID: 12015
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/12015
Summary:
asp2php is prone to a buffer overflow vulnerability. This issue is exposed when the application is used to convert an ASP file to PHP. The particular issue is related to parsing of tokens in ASP files. Since ASP files may originate from an external or untrusted source, this vulnerability is considered to be remote in nature. Successful exploitation would allow for execution of arbitrary code in the context of the user running the application. This issue is reportedly distinct from BID 12014 (ASP2PHP Preparse Token Buffer Overflow Vulnerability). The differences that distinguish these issues are two separate vulnerabilities have not been determined at this time, other than that the overrun occurs in a different destination buffer.

47. UML_Utilities UML_Net Slip Network Interface Denial Of Servi...
BugTraq ID: 12016
Remote: No
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/12016
Summary:
The uml_utilites uml_net application may permit unprivileged malicious local users to shut down the slip network interface. This is due to the program being installed setuid root by default. This vulnerability could be exploited to deny network services over slip on an affected computer.

48. ABC2MTEX Process ABC Key Field Buffer Overflow Vulnerability
BugTraq ID: 12018
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/12018
Summary:
abc2mtex is prone to a buffer overflow vulnerability. This issue is exposed when the program is used to convert ABC music notation files to MTEX format. In particular, the issue is due to insufficient bounds checking of key data in ABC notation files. Since the ABC files may originate from an external or untrusted source, this issue is considered remote in nature. Successful exploitation will result in execution of arbitrary code in the context of the user running the application.

49. ABCPP Directive Handler Buffer Overflow Vulnerability
BugTraq ID: 12021
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/12021
Summary:
abcpp is prone to a buffer overflow vulnerability. This issue is exposed when the program is used to handle directives in ABC music notation files. Since the ABC files may originate from an external or untrusted source, this issue is considered remote in nature. Successful exploitation will result in execution of arbitrary code in the context of the user running the application.

50. ABC2PS/JCABC2PS Voice Field Buffer Overflow Vulnerability
BugTraq ID: 12024
Remote: Yes
Date Published: Dec 15 2004
Relevant URL: http://www.securityfocus.com/bid/12024
Summary:
abc2ps and jcabc2ps are prone to a buffer overflow vulnerability. This issue is exposed when the program is used to process the voice field in ABC music notation files. Since the ABC files may originate from an external or untrusted source, this issue is considered remote in nature. Successful exploitation will result in execution of arbitrary code in the context of the user running the application.
 
  


Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
LQ Security Report - December 31st 2004 Capt_Caveman Linux - Security 3 12-31-2004 02:58 PM
LQ Security Report - December 11th 2004 unSpawn Linux - Security 3 12-11-2004 07:10 AM
LQ Security Report - June 27 2004 Capt_Caveman Linux - Security 3 06-27-2004 02:37 AM
LQ Security Report May 28th 2004 Capt_Caveman Linux - Security 4 05-28-2004 02:26 PM
LQ Security Report - May 22nd 2004 Capt_Caveman Linux - Security 3 05-22-2004 03:41 AM


All times are GMT -5. The time now is 02:50 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration