VARIoT IoT vulnerabilities database

Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to overwrite or create arbitrary files via a ..\ (dot dot backslash) in the RNTO command. Serv-U is prone to a directory traversal vulnerability. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Serv-U File Renaming Directory Traversal and STOU Denial of Service SECUNIA ADVISORY ID: SA32150 VERIFY ADVISORY: http://secunia.com/advisories/32150/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: Serv-U File Server 7.x http://secunia.com/advisories/product/19573/ DESCRIPTION: dmnt has discovered two vulnerabilities in Serv-U, which can be exploited by malicious users to cause a DoS (Denial of Service) or compromise a vulnerable system. 1) An error in the handling of the "STOU" FTP command can be exploited to exhaust available CPU resources via a specially crafted argument (e.g. "CON:1"). The vulnerabilities are confirmed in version 7.3.0.0. Other versions may also be affected. SOLUTION: Restrict access to the FTP service. PROVIDED AND/OR DISCOVERED BY: dmnt ORIGINAL ADVISORY: http://milw0rm.com/exploits/6660 http://milw0rm.com/exploits/6661 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail. Apple Mail is prone to a weakness in its implementation of S/MIME encryption. An attacker with access to an IMAP or Exchange email server may be able to take advantage of this issue to obtain sensitive information. Mail 3.5 (929.4/929.2) is vulnerable; other versions may also be affected. Apple Mail is the mail client installed by default in Mac OS X machines. According to the standard, using S/MIME means that no one else can view the encrypted mail except the recipient and sender of the mail, and the Store draft messages on the server option stores the mail in plain text before sending it, which makes it possible Cause security misleading and information leakage

Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted stou command, probably related to MS-DOS device names, as demonstrated using "con:1". Serv-U FTP server is prone to a denial of service vulnerability. An attacker can exploit this vulnerability to cause the server to crash, effectively denying service to legitimate users. Serv-U FTP server 7.2.0.1 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Serv-U File Renaming Directory Traversal and STOU Denial of Service SECUNIA ADVISORY ID: SA32150 VERIFY ADVISORY: http://secunia.com/advisories/32150/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: Serv-U File Server 7.x http://secunia.com/advisories/product/19573/ DESCRIPTION: dmnt has discovered two vulnerabilities in Serv-U, which can be exploited by malicious users to cause a DoS (Denial of Service) or compromise a vulnerable system. 1) An error in the handling of the "STOU" FTP command can be exploited to exhaust available CPU resources via a specially crafted argument (e.g. "CON:1"). 2) An input validation error in the FTP service when renaming files can be exploited to overwrite or create arbitrary files with user-supplied content via directory traversal attacks. The vulnerabilities are confirmed in version 7.3.0.0. PROVIDED AND/OR DISCOVERED BY: dmnt ORIGINAL ADVISORY: http://milw0rm.com/exploits/6660 http://milw0rm.com/exploits/6661 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Cross-site scripting (XSS) vulnerability in the ICAP patience page in Blue Coat Security Gateway OS (SGOS) 4.2 before 4.2.9, 5.2 before 5.2.5, and 5.3 before 5.3.1.7 allows remote attackers to inject arbitrary web script or HTML via the URL. Blue Coat WebFilter is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the vulnerable application. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Blue Coat WebFilter 4.2, 5.2, and 5.3 are vulnerable. Input passed via the URL is not properly sanitised by the ICAP Patience Page before being returned to the user. The vulnerability affects SGOS versions 4.2, 5.2, and 5.3. SOLUTION: The vendor recommends customizing the settings of the ICAP Patience Page in order to avoid printing the URL. Please see the vendor's advisory for more information. PROVIDED AND/OR DISCOVERED BY: Juan Pablo Lopez Yacubian ORIGINAL ADVISORY: Blue Coat: http://www.bluecoat.com/support/securityadvisories/icap_patience ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB). A vulnerability in some implementations of the IPv6 Neighbor Discovery Protocol may allow a nearby attacker to intercept traffic or cause congested links to become overloaded. This false information can modify the Forward Information Base (FIB). Operating systems affected by the vulnerability: Wind River Systems VxWorks 6.4 Wind River Systems VxWorks 5 OpenBSD OpenBSD 4.4 OpenBSD OpenBSD 4.3 OpenBSD OpenBSD 4.2 NetBSD NetBSD 3.0.2 NetBSD NetBSD 3.0.1 NetBSD NetBSD Current NetBSD NetBSD 4.0 NetBSD NetBSD 3.1_RC3 NetBSD NetBSD 3.1 NetBSD NetBSD 3.1 NetBSD NetBSD 3,1_RC1 Navision Financials Server 3.0 MidnightBSD MidnightBSD 0.2.1 MidnightBSD MidnightBSD 0.1.1 MidnightBSD MidnightBSD 0.3 MidnightBSD MidnightBSD 0.1 Juniper Networks WXC Series 0 Juniper Networks WX Series 0 Juniper Networks Session and Resource Control Appliance 2.0 Juniper Networks Session and Resource Control Appliance 1. ---------------------------------------------------------------------- Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more: http://secunia.com/advisories/business_solutions/ ---------------------------------------------------------------------- TITLE: HP-UX IPv6 Neighbor Discovery Protocol Neighbor Solicitation Vulnerability SECUNIA ADVISORY ID: SA33787 VERIFY ADVISORY: http://secunia.com/advisories/33787/ CRITICAL: Less critical IMPACT: Spoofing, Exposure of sensitive information, DoS WHERE: >From local network OPERATING SYSTEM: HP-UX 11.x http://secunia.com/advisories/product/138/ DESCRIPTION: A vulnerability has been reported in HP-UX, which can be exploited by malicious people to conduct spoofing attacks, disclose potentially sensitive information, or to cause a DoS (Denial of Service). This is related to: SA32112 The vulnerability is reported in HP-UX B.11.11, B.11.23, and B.11.31 running IPv6. SOLUTION: Apply patches. HP-UX B.11.11: Install patch PHNE_37898 or subsequent. HP-UX B.11.23: Install patch PHNE_37897 or subsequent. HP-UX B.11.31: Install patch PHNE_38680 or subsequent. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: HPSBUX02407 SSRT080107: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01662367 OTHER REFERENCES: SA32112: http://secunia.com/advisories/32112/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Vendor affected: TP-Link (http://tp-link.com) Products affected: * All TP-Link VxWorks-based devices (confirmed by vendor) * All "2-series" switches (confirmed by vendor) * TL-SG2008 semi-managed switch (confirmed by vendor) * TL-SG2216 semi-managed switch (confirmed by vendor) * TL-SG2424 semi-managed switch (confirmed by vendor) * TL-SG2424P semi-managed switch (confirmed by vendor) * TL-SG2452 semi-managed switch (confirmed by vendor) Vulnerabilities: * All previously-reported VxWorks vulnerabilities from 6.6.0 on; at the very least: * CVE-2013-0716 (confirmed by vendor) * CVE-2013-0715 (confirmed by vendor) * CVE-2013-0714 (confirmed by vendor) * CVE-2013-0713 (confirmed by vendor) * CVE-2013-0712 (confirmed by vendor) * CVE-2013-0711 (confirmed by vendor) * CVE-2010-2967 (confirmed by vendor) * CVE-2010-2966 (confirmed by vendor) * CVE-2008-2476 (confirmed by vendor) * SSLv2 is available and cannot be disabled unless HTTPS is completely disabled (allows downgrade attacks) (confirmed by vendor) * SSL (v2, v3) offers insecure cipher suites and HMACs which cannot be disabled (allows downgrade attacks) (confirmed by vendor) Design flaws: * Telnet is available and cannot be disabled (confirmed by vendor) * SSHv1 enabled by default if SSH is enabled (confirmed by vendor) Vendor response: TP-Link are not convinced that these flaws should be repaired. TP-Link's Internet presence -- or at least DNS -- is available only intermittently. Most emails bounced. Lost contact with vendor, but did confirm that development lead is now on holiday and will not return for at least a week. Initial vendor reaction was to recommend purchase of "3-series" switches. Vendor did not offer reasons why "3-series" switches would be more secure, apart from lack of telnet service. Vendor confirmed that no development time can be allocated to securing "2-series" product and all focus has shifted to newer products. (TL-SG2008 first product availability July 2014...) Vendor deeply confused about security of DES/3DES, MD5, claimed that all security is relative. ("...[E]ven SHA-1 can be cracked, they just have different security level.") Fix availability: None. Work-arounds advised: None possible. Remove products from network. Corrected: 2008-10-01 00:32:59 UTC (RELENG_7, 7.1-PRERELEASE) 2008-10-01 00:32:59 UTC (RELENG_7_0, 7.0-RELEASE-p5) 2008-10-01 00:32:59 UTC (RELENG_6, 6.4-PRERELEASE) 2008-10-01 00:32:59 UTC (RELENG_6_3, 6.3-RELEASE-p5) CVE Name: CVE-2008-2476 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://security.FreeBSD.org/>. I. Background IPv6 nodes use the Neighbor Discovery protocol to determine the link-layer address of other nodes, find routers, and maintain reachability information. The Neighbor Discovery protocol uses Neighbor Solicitation (ICMPv6 type 135) to query target nodes for their link-layer addresses. II. Problem Description IPv6 routers may allow "on-link" IPv6 nodes to create and update the router's neighbor cache and forwarding information. A malicious IPv6 node sharing a common router but on a different physical segment from another node may be able to spoof Neighbor Discovery messages, allowing it to update router information for the victim node. III. Impact An attacker on a different physical network connected to the same IPv6 router as another node could redirect IPv6 traffic intended for that node. IV. Workaround Firewall packet filters can be used to filter incoming Neighbor Solicitation messages but may interfere with normal IPv6 operation if not configured carefully. Reverse path forwarding checks could be used to make gateways, such as routers or firewalls, drop Neighbor Solicitation messages from nodes with unexpected source addresses on a particular interface. V. Solution NOTE WELL: The solution described below causes IPv6 Neighbor Discovery Neighbor Solicitation messages from non-neighbors to be ignored. This can be re-enabled if required by setting the newly added net.inet6.icmp6.nd6_onlink_ns_rfc4861 sysctl to a non-zero value. Perform one of the following: 1) Upgrade your vulnerable system to 6-STABLE, or 7-STABLE, or to the RELENG_7_0, or RELENG_6_3 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 6.3 and 7.0 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 6.3] # fetch http://security.FreeBSD.org/patches/SA-08:10/nd6-6.patch # fetch http://security.FreeBSD.org/patches/SA-08:10/nd6-6.patch.asc [FreeBSD 7.0] # fetch http://security.FreeBSD.org/patches/SA-08:10/nd6-7.patch # fetch http://security.FreeBSD.org/patches/SA-08:10/nd6-7.patch.asc b) Apply the patch. # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in <URL:http://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_6 src/sys/netinet6/in6.h 1.36.2.10 src/sys/netinet6/in6_proto.c 1.32.2.10 src/sys/netinet6/nd6.h 1.19.2.4 src/sys/netinet6/nd6_nbr.c 1.29.2.11 RELENG_6_3 src/UPDATING 1.416.2.37.2.10 src/sys/conf/newvers.sh 1.69.2.15.2.9 src/sys/netinet6/in6.h 1.36.2.8.2.1 src/sys/netinet6/in6_proto.c 1.32.2.8.2.1 src/sys/netinet6/nd6.h 1.19.2.2.6.1 src/sys/netinet6/nd6_nbr.c 1.29.2.9.2.1 RELENG_7 src/sys/netinet6/in6.h 1.51.2.2 src/sys/netinet6/in6_proto.c 1.46.2.3 src/sys/netinet6/nd6.h 1.21.2.2 src/sys/netinet6/nd6_nbr.c 1.47.2.3 RELENG_7_0 src/UPDATING 1.507.2.3.2.9 src/sys/conf/newvers.sh 1.72.2.5.2.9 src/sys/netinet6/in6.h 1.51.4.1 src/sys/netinet6/in6_proto.c 1.46.4.1 src/sys/netinet6/nd6.h 1.21.4.1 src/sys/netinet6/nd6_nbr.c 1.47.4.1 - ------------------------------------------------------------------------- VII. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01662367 Version: 1 HPSBUX02407 SSRT080107 rev.1 - HP-UX Running IPv6, Remote Denial of Service (DoS) and Unauthorized Access NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2009-02-02 Last Updated: 2009-02-02 Potential Security Impact: Remote Denial of Service (DoS) and unauthorized access Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP-UX running IPv6. This vulnerability could be exploited remotely resulting in a Denial of Service (DoS) and unauthorized access. References: CVE-2008-2476, CVE-2008-4404 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.11, B.11.23, B.11.31 running IPv6 BACKGROUND CVSS 2.0 Base Metrics =============================================== Reference Base Vector Base Score CVE-2008-2476 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2008-4404 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 =============================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002. RESOLUTION HP has provided the following software patches to resolve the vulnerabilities. The patches are available for download from: http://itrc.hp.com HP-UX Release - B.11.11 (11i v1) Patch ID - PHNE_37898 HP-UX Release - B.11.23 (11i v2) Patch ID - PHNE_37897 HP-UX Release - B.11.31 (11i v3) Patch ID - PHNE_38680 MANUAL ACTIONS: No PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.11 ============= Networking.NET-KRN Networking.NET-PRG Networking.NET-RUN Networking.NET-RUN-64 OS-Core.CORE-KRN ProgSupport.C-INC Networking.NET2-KRN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS-ADMIN Networking.NET2-KRN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS-ADMIN action: install patch PHNE_37898 or subsequent URL: http://itrc.hp.com HP-UX B.11.23 ============= Networking.NET-PRG Networking.NET-RUN ProgSupport.C-INC Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN action: install patch PHNE_37897 or subsequent URL: http://itrc.hp.com HP-UX B.11.31 ============= Networking.NET-RUN ProgSupport.C-INC Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN action: install patch PHNE_38680 or subsequent URL: http://itrc.hp.com END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 2 February 2009 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For further information, contact normal HP Services support channel. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches - check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems - verify your operating system selections are checked and save. To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections. To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do * The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." \xa9Copyright 2009 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBSYdFsuAfOvwtKn1ZEQK0VACeIKetdQfBDsssaZYXnerHz8AEwzEAn2iy saLPK+/sw3/02JA+b0HuzPfv =HTAW -----END PGP SIGNATURE-----

The IPv6 Neighbor Discovery Protocol (NDP) implementation on IBM zSeries servers does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB), a related issue to CVE-2008-2476. A vulnerability in some implementations of the IPv6 Neighbor Discovery Protocol may allow a nearby attacker to intercept traffic or cause congested links to become overloaded. ---------------------------------------------------------------------- Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more: http://secunia.com/advisories/business_solutions/ ---------------------------------------------------------------------- TITLE: HP-UX IPv6 Neighbor Discovery Protocol Neighbor Solicitation Vulnerability SECUNIA ADVISORY ID: SA33787 VERIFY ADVISORY: http://secunia.com/advisories/33787/ CRITICAL: Less critical IMPACT: Spoofing, Exposure of sensitive information, DoS WHERE: >From local network OPERATING SYSTEM: HP-UX 11.x http://secunia.com/advisories/product/138/ DESCRIPTION: A vulnerability has been reported in HP-UX, which can be exploited by malicious people to conduct spoofing attacks, disclose potentially sensitive information, or to cause a DoS (Denial of Service). This is related to: SA32112 The vulnerability is reported in HP-UX B.11.11, B.11.23, and B.11.31 running IPv6. SOLUTION: Apply patches. HP-UX B.11.11: Install patch PHNE_37898 or subsequent. HP-UX B.11.23: Install patch PHNE_37897 or subsequent. HP-UX B.11.31: Install patch PHNE_38680 or subsequent. For more information: SA32112 2) An unspecified error exists in the handling of PPPoE discovery packets. which can be exploited to cause an out-of-bounds memory access error by sending a specially crafted PPPoE discovery packet. 3) An error exists in the handling of incoming ICMPv6 "Packet Too Big" messages, which can be exploited to shutdown the device. This is related to: SA31745 SOLUTION: Update to firmware version 7.4.1. Fixed versions: 2008-10-01 00:32:59 UTC (RELENG_7, 7.1-PRERELEASE) 2008-10-01 00:32:59 UTC (RELENG_7_0, 7.0-RELEASE-p5) 2008-10-01 00:32:59 UTC (RELENG_6, 6.4-PRERELEASE) 2008-10-01 00:32:59 UTC (RELENG_6_3, 6.3-RELEASE-p5) Patch for FreeBSD 6.3: http://security.FreeBSD.org/patches/SA-08:10/nd6-6.patch http://security.FreeBSD.org/patches/SA-08:10/nd6-6.patch.asc Patch for FreeBSD 7.0: http://security.FreeBSD.org/patches/SA-08:10/nd6-7.patch http://security.FreeBSD.org/patches/SA-08:10/nd6-7.patch.asc PROVIDED AND/OR DISCOVERED BY: The vendor credits David Miles. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01662367 Version: 1 HPSBUX02407 SSRT080107 rev.1 - HP-UX Running IPv6, Remote Denial of Service (DoS) and Unauthorized Access NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2009-02-02 Last Updated: 2009-02-02 Potential Security Impact: Remote Denial of Service (DoS) and unauthorized access Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP-UX running IPv6. This vulnerability could be exploited remotely resulting in a Denial of Service (DoS) and unauthorized access. References: CVE-2008-2476, CVE-2008-4404 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.11, B.11.23, B.11.31 running IPv6 BACKGROUND CVSS 2.0 Base Metrics =============================================== Reference Base Vector Base Score CVE-2008-2476 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2008-4404 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 =============================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002. RESOLUTION HP has provided the following software patches to resolve the vulnerabilities. The patches are available for download from: http://itrc.hp.com HP-UX Release - B.11.11 (11i v1) Patch ID - PHNE_37898 HP-UX Release - B.11.23 (11i v2) Patch ID - PHNE_37897 HP-UX Release - B.11.31 (11i v3) Patch ID - PHNE_38680 MANUAL ACTIONS: No PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.11 ============= Networking.NET-KRN Networking.NET-PRG Networking.NET-RUN Networking.NET-RUN-64 OS-Core.CORE-KRN ProgSupport.C-INC Networking.NET2-KRN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS-ADMIN Networking.NET2-KRN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS-ADMIN action: install patch PHNE_37898 or subsequent URL: http://itrc.hp.com HP-UX B.11.23 ============= Networking.NET-PRG Networking.NET-RUN ProgSupport.C-INC Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN action: install patch PHNE_37897 or subsequent URL: http://itrc.hp.com HP-UX B.11.31 ============= Networking.NET-RUN ProgSupport.C-INC Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN Networking.NET-RUN-64 Networking.NET2-KRN Networking.NET2-RUN Networking.NMS2-KRN OS-Core.CORE2-KRN OS-Core.SYS2-ADMIN action: install patch PHNE_38680 or subsequent URL: http://itrc.hp.com END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 2 February 2009 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For further information, contact normal HP Services support channel. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches - check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems - verify your operating system selections are checked and save. To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections. To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do * The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." \xa9Copyright 2009 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBSYdFsuAfOvwtKn1ZEQK0VACeIKetdQfBDsssaZYXnerHz8AEwzEAn2iy saLPK+/sw3/02JA+b0HuzPfv =HTAW -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Juniper Products Neighbor Discovery Protocol Neighbor Solicitation Vulnerability SECUNIA ADVISORY ID: SA32116 VERIFY ADVISORY: http://secunia.com/advisories/32116/ CRITICAL: Less critical IMPACT: Manipulation of data WHERE: >From local network OPERATING SYSTEM: Juniper IVE OS Software 1.x http://secunia.com/advisories/product/11660/ Juniper IVE OS Software 2.x http://secunia.com/advisories/product/11661/ Juniper IVE OS Software 3.x http://secunia.com/advisories/product/11662/ Juniper IVE OS Software 5.x http://secunia.com/advisories/product/6644/ Juniper IVE OS Software 4.x http://secunia.com/advisories/product/6645/ Juniper IVE OS Software 6.x http://secunia.com/advisories/product/18562/ Juniper Networks DXOS 5.x http://secunia.com/advisories/product/11183/ Juniper Networks IDP 4.x http://secunia.com/advisories/product/11181/ Juniper Networks Infranet Controller 4000 http://secunia.com/advisories/product/11167/ Juniper Networks WXC Series http://secunia.com/advisories/product/11164/ Juniper Networks WX Series http://secunia.com/advisories/product/11163/ Juniper Networks Session and Resource Control (SRC) 2.x http://secunia.com/advisories/product/19036/ Juniper Networks Secure Access 6000 SP http://secunia.com/advisories/product/13184/ Juniper Networks Secure Access 4000 (NetScreen-SA 3000 Series) http://secunia.com/advisories/product/3141/ Juniper Networks Secure Access 2000 http://secunia.com/advisories/product/11165/ Juniper Networks Infranet Controller 6000 http://secunia.com/advisories/product/11168/ Juniper Networks Secure Access 6000 (NetScreen-SA 5000 Series) http://secunia.com/advisories/product/3132/ Juniper Networks Secure Access 700 http://secunia.com/advisories/product/11166/ Juniper Networks Session and Resource Control (SRC) 1.x http://secunia.com/advisories/product/19034/ DESCRIPTION: A vulnerability has been reported in multiple Juniper Networks products, which can be exploited by malicious people to manipulate the router's neighbor cache. This can be exploited to add a fake entry to the router's neighbor cache via a neighbor solicitation request containing a spoofed IPv6 address. Successful exploitation may allow the interception or disruption of network traffic, but requires that the IPv6 nodes involved in the attack are using the same router. NOTE: The vendor has not published a publicly available advisory and has also refused to provide a list of the affected products or patches as information about vulnerabilities is provided to registered customers only. It is therefore unclear if only a subset of the products reported as vulnerable in this advisory are affected. SOLUTION: It is currently unclear whether fixes are available. PROVIDED AND/OR DISCOVERED BY: US-CERT credits David Miles. ORIGINAL ADVISORY: Juniper (login required): https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view US-CERT: http://www.kb.cert.org/vuls/id/MAPG-7H2RZU OTHER REFERENCES: US-CERT VU#472363: http://www.kb.cert.org/vuls/id/472363 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. Part of the Transmission Control Protocol (TCP) specification (RFC 1122) allows a receiver to advertise a zero byte window, instructing the sender to maintain the connection but not send additional TCP payload data. The sender should then probe the receiver to check if the receiver is ready to accept data. Narrow interpretation of this part of the specification can create a denial-of-service vulnerability. By advertising a zero receive window and acknowledging probes, a malicious receiver can cause a sender to consume resources (TCP state, buffers, and application memory), preventing the targeted service or system from handling legitimate connections. Transmission Control Protocol (TCP) Multiple implementations of service disruption (DoS) Vulnerabilities exist. RFC793 It is prescribed by Transmission Control Protocol (TCP) Implementation of service disruption due to misuse of available resources after connection establishment (DoS) Vulnerabilities exist.Service operation disrupted by a remote third party (DoS) There is a possibility of being attacked. The core TCP/IP protocol is prone to multiple remote denial-of-service vulnerabilities. The issues are tracked by Cisco Bug IDs CSCsv04836, CSCsv07712, CSCsv66169, CSCsv02768, CSCsv08325, and CSCsv08579. These issues are reported to affect multiple vendors' implementations of the TCP/IP stack. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Windows 2000 TCP/IP Window Size Denial of Service Vulnerabilities SECUNIA ADVISORY ID: SA36597 VERIFY ADVISORY: http://secunia.com/advisories/36597/ DESCRIPTION: Two vulnerabilities have been reported in Microsoft Windows 2000, which can be exploited by malicious people to cause a DoS (Denial of Service). 1) An error in the TCP/IP processing can be exploited to cause a system to stop responding to new requests by flooding it using specially crafted packets with a TCP receive window size set to a very small value or zero. 2) An error in the TCP/IP processing can be exploited to cause connections to hang indefinitely in a FIN-WAIT-1 or FIN-WAIT-2 state. This can be exploited to cause a system to stop responding to new requests by flooding it using specially crafted packets with a TCP receive window size set to a very small value or zero. SOLUTION: According to the vendor, no patches will be made available as it would require re-architecting a significant amount of the OS. PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Jack C. Louis, Outpost24. 2) The vendor credits Felix Lindner, Recurity Labs. ORIGINAL ADVISORY: MS09-048 (KB967723): http://www.microsoft.com/technet/security/Bulletin/MS09-048.mspx ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01923093 Version: 1 HPSBMI02473 SSRT080138 rev.1 - Cisco Catalyst Blade Switch 3020/3120, Remote Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2009-11-17 Last Updated: 2009-11-17 Potential Security Impact: Remote execution of arbitrary code, Denial of Service (DoS) Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential vulnerability has been identified with the Cisco Catalyst Blade Switch 3020/3021. The vulnerability could be exploited remotely to create a Denial of Service (DoS). References: CVE-2008-4609, Cisco Security Advisory: TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products(cisco-sa-20090908-tcp24) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Cisco Catalyst Blade Switch 3020 for c-Class BladeSystem running firmware earlier than v12.2(50) Cisco Catalyst Blade Switch 3120G and Cisco Catalyst Blade Switch 3120X for HP running firmware earlier than v12.2(50) BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2008-4609 (AV:N/AC:M/Au:N/C:N/I:N/A:C) 7.1 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided firmware updates to resolve this vulnerability. Product Firmware Version Cisco Catalyst Blade Switch 3020 for c-Class BladeSystem 12.2(50) SE1 or subsequent Cisco Catalyst Blade Switch 3120G and Cisco Catalyst Blade Switch 3120X for HP 12.2(50) SE1 or subsequent To Locate the Firmware Update Browse to http://www.hp.com and do the following: Select "Support & Drivers" In Step 1 select "Download drivers and software (and firmware)" In Step 2 enter "Cisco Catalyst Blade Switch" Click on "Go" Select the desired product Select the desired Windows operating system Click on "Firmware - Blade Infrastructure" PRODUCT SPECIFIC INFORMATION None HISTORY Version:1 (rev.1) - 17 November 2009 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For further information, contact normal HP Services support channel. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches -check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems -verify your operating system selections are checked and save. To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections. To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do * The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." Copyright 2009 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAksEDAMACgkQ4B86/C0qfVm87gCgliWdpIKldzOKHRvJA5r9gR4Z ge0AoMu3ueCbIB4y3HUmT/jReUzE4jym =uBei -----END PGP SIGNATURE-----

Cross-site scripting (XSS) vulnerability in Juniper NetScreen ScreenOS before 5.4r10, 6.0r6, and 6.1r2 allows remote attackers to inject arbitrary web script or HTML via the user name parameter to the (1) web interface login page or the (2) telnet login page. ScreenOS is prone to an HTML-injection vulnerability because its administrative web interface fails to sufficiently sanitize user-supplied input data. Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. The issue affects ScreenOS 5.4.0r9.0. Juniper NetScreen ScreenOS is the core operating system of NetScreen firewall and other network products. Juniper NetScreen ScreenOS versions earlier than 5.4r10, 6.0r6 and 6.1r2 have a cross-site scripting vulnerability. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Juniper NetScreen ScreenOS Script Insertion Vulnerability SECUNIA ADVISORY ID: SA32078 VERIFY ADVISORY: http://secunia.com/advisories/32078/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting WHERE: >From remote OPERATING SYSTEM: NetScreen ScreenOS 5.x http://secunia.com/advisories/product/2569/ NetScreen ScreenOS 6.x http://secunia.com/advisories/product/18925/ DESCRIPTION: A vulnerability has been reported in Juniper NetScreen ScreenOS, which can be exploited by malicious people to conduct script insertion attacks. This can be exploited to insert arbitrary HTML and script code, which will be executed in another user's browser session in context of the web interface when the event logs are viewed. The vulnerability is reported in version 5.4.0r9.0 and reportedly also affects versions prior to 6.0r6 and 6.1r2. SOLUTION: Update to version 5.4r10, 6.0r6, or 6.1r2. PROVIDED AND/OR DISCOVERED BY: Deral Heiland, Layered Defense ORIGINAL ADVISORY: Layered Defense: http://www.layereddefense.com/netscreen01oct.html Juniper (login required): https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-009&viewMode=view ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The default configuration of Java 1.5 on Apple Mac OS X 10.5.4 and 10.5.5 contains a jurisdiction policy that limits Java Cryptography Extension (JCE) key sizes to 128 bits, which makes it easier for attackers to decrypt ciphertext produced by JCE. Mac OS X is prone to a remote security vulnerability

A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash) via a long string in the second argument to the GetObject method. NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect. IIS is prone to a denial-of-service vulnerability

A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to the SetPassword method. NOTE: this issue could not be reproduced by a reliable third party. In addition, the original researcher is unreliable. Therefore the original disclosure is probably erroneous

Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a user directory under images/photos/upload. The issue occurs because the application fails to sanitize user-supplied input. Camera Life 2.6.2b4 is vulnerable; other versions may also be affected

The Cisco Linksys WRT350N with firmware 1.0.3.7 has "admin" as its default password for the "admin" account, which makes it easier for remote attackers to obtain access. Provided by Cisco Systems Cisco Linksys WRT350N Contains a default password vulnerability. Linksys Wrt350n is prone to a remote security vulnerability

Stack-based buffer overflow in RealFlex Technologies Ltd. RealWin Server 2.0, as distributed by DATAC, allows remote attackers to execute arbitrary code via a crafted FC_INFOTAG/SET_CONTROL packet. RealFlex RealWin demo version contains a vulnerability in the way "FC_INFOTAG/SET_CONTROL" packets are processed. DATAC RealWin Is FC_INFOTAG/SET_CONTROL A buffer overflow vulnerability exists due to improper handling of packets. DATAC RealWin Is Human Machine Interface With components, Microsoft Windows2000/XP Work on SCADA Server software. RealWin Is Crafted FC_INFOTAG/SET_CONTROL A buffer overflow vulnerability exists due to improper handling of packets.Arbitrary code execution or denial of service by a remote third party (DoS) There is a possibility of being attacked. DATAC RealWin SCADA server is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. This may facilitate the complete compromise of affected computers. Failed exploit attempts may result in a denial-of-service condition. RealWin SCADA server 2.0 is affected; other versions may also be vulnerable. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: RealWin INFOTAG/SET_CONTROL Packet Processing Buffer Overflow SECUNIA ADVISORY ID: SA32055 VERIFY ADVISORY: http://secunia.com/advisories/32055/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: RealWin 2.x http://secunia.com/advisories/product/19990/ DESCRIPTION: Ruben Santamarta has discovered a vulnerability in RealWin, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error in the processing of TCP packets received on port 910 by default. SOLUTION: Restrict network access to trusted users only. PROVIDED AND/OR DISCOVERED BY: Ruben Santamarta, Reversemode ORIGINAL ADVISORY: http://reversemode.com/index.php?option=com_content&task=view&id=55&Itemid=1 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

RealWin is a data acquisition and monitoring control system (SCADA) server product running on the Windows platform.  If a remote attacker sends a specially crafted FC_INFOTAG / SET_CONTROL message to the RealWin server, it can trigger a stack overflow and cause arbitrary code execution. The RealWin server uses a proprietary protocol to accept connections from FlewWin clients and can exploit this vulnerability without having valid credentials

TrueVector in Check Point ZoneAlarm 8.0.020.000, with vsmon.exe running, allows remote HTTP proxies to cause a denial of service (crash) and disable the HIDS module via a crafted response. ZoneAlarm Internet Security Suite is prone to a remote denial-of-service vulnerability that occurs in the TrueVector component when connecting to a malicious HTTP proxy. ZoneAlarm Internet Security Suite 8.0.020 is vulnerable; other versions may also be affected

Cisco IOS 12.0 through 12.4 on Cisco 10000, uBR10012 and uBR7200 series devices handles external UDP packets that are sent to 127.0.0.0/8 addresses intended for IPC communication within the device, which allows remote attackers to cause a denial of service (device or linecard reload) via crafted UDP packets, a different vulnerability than CVE-2008-3805. Provided by Cisco Systems Cisco IOS The denial of service (DoS) There are vulnerabilities. This vulnerability is CVE-2008-3805 This is a different vulnerability.See the "Summary" for the impact of this vulnerability. Ios is prone to a denial-of-service vulnerability. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA31990 VERIFY ADVISORY: http://secunia.com/advisories/31990/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information, DoS, System access WHERE: >From remote OPERATING SYSTEM: Cisco IOS R12.x http://secunia.com/advisories/product/50/ Cisco IOS 12.x http://secunia.com/advisories/product/182/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious people to disclose sensitive information, cause a DoS (Denial of Service), or to compromise a vulnerable system. 1) An unspecified error exists in the processing of SSL packets during the termination of an SSL session, which can potentially be exploited to crash an affected system. 2) Two unspecified errors exist within the processing of Protocol Independent Multicast (PIM) packets, which can be exploited to cause an affected device to reload. 3) Unspecified errors within the processing of segmented Skinny Call Control Protocol (SCCP) messages can be exploited to cause a Cisco IOS device to reload. Successful exploitation requires that the device is configured with Network Address Translation (NAT) SCCP Fragmentation Support. 4) A memory leak in the processing of Session Initiation Protocol (SIP) messages can be exploited to cause a DoS for all voice services. 5) Multiple unspecified errors exist in the processing of SIP messages, which can be exploited to cause a reload of an affected device. 6) An unspecified error in the IOS Intrusion Prevention System (IPS) feature when processing certain IPS signatures that use the SERVICE.DNS engine can be exploited to cause a DoS via specially crafted network traffic. 7) A security issue exists in the processing of extended communities with Multi Protocol Label Switching (MPLS) Virtual Private Networks (VPN), which can lead to traffic leaking from one MPLS VPN to another. This security issue does not affect Cisco IOS releases based on 12.1. NOTE: This security issue was introduced with CSCee83237. Cisco IOS images that do not include CSCee83237 are reportedly not affected. 8) An unspecified error within the Multi Protocol Label Switching (MPLS) Forwarding Infrastructure (MFI) can be exploited to cause a DoS via specially crafted network packets. Successful exploitation requires access to the MPLS network. 9) An unspecified error within the Application Inspection Control (AIC) can be exploited to cause a reload of an affected device via specially crafted HTTP packets. 10) An unspecified error in the processing of Layer 2 Tunneling Protocol (L2TP) packets can be exploited to cause an affected device to reload via a specially crafted L2TP packets. Successful exploitation requires that the L2TP mgmt daemon process is running. This process may be enabled e.g. via Layer 2 virtual private networks (L2VPN), Layer 2 Tunnel Protocol Version 3 (L2TPv3), Stack Group Bidding Protocol (SGBP), or Cisco Virtual Private Dial-Up Networks (VPDN). 11) An unspecified error exists in the processing of IPC messages. This vulnerability is reported in Cisco 10000, uBR10012, and uBR7200 series devices. 12) A security issue is caused due to the device automatically enabling SNMP with a default community string, which can be exploited to gain control an affected system. Successful exploitation requires that a device is configured for linecard redundancy. SOLUTION: Update to the fixed version (please see the vendor's advisories for details). PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosips.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-vpn.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-mfi.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosfw.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-ipc.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-ubr.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Buffer overflow in x87 before 3.5.5 in ABB Process Communication Unit 400 (PCU400) 4.4 through 4.6 allows remote attackers to execute arbitrary code via a crafted packet using the (1) IEC60870-5-101 or (2) IEC60870-5-104 communication protocol to the X87 web interface. ABB PCU400 contains a vulnerability which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. ABB Made by company PCU400 Contains a buffer overflow vulnerability. ABB Provided by the company PCU400 Application server IEC-870-5-104 Use protocol RTU(Remote Terminal Unit) When SCADA A gateway device that communicates between servers. The PCU400 'x87' executable version 3.5.5 is vulnerable; other versions may also be affected. Background ----------------- Vendor product information: PCU400 is the modern product when implementing an effective data acquisition network in SCADA-based systems PCU400, Process Communication Unit 400 forms the communication interface to the network of remote terminal units (RTUs) together with the RCS Application Software located in the application server of a Network Manager SCADA system. The PCU400 can be used as a SCADA front-end, communication gateway for Substation Automation systems or as a standalone protocol converter. Two parts define the Data Acquisition system: * RCS Application, a software package running in the Application Server * PCU400, a front-end converter that implements the protocols and connects the physical lines PCU 400 can be used in a variety of configurations to cater for different network topologies and different levels of fault tolerance in the system. The alternatives include single or redundant PCU 400 units. Description ---------------- A buffer overflow exists in the component that handles IEC60870-5-101 and IEC60870-5-104 communication protocols. The description of the vulnerability is intentionally limited as this software controls critical national infrastructure. Impact ---------- An attacker can compromise the server which runs PCU400, which acts as the FEP server of the ABB SCADA system. This vulnerability is another method to carry out the "field to control center" attack vector mentioned in C4's S4 2008 paper "Control System Attack Vectors and Examples: Field Site and Corporate Network", which will allow the attacker to control other RTUs connected to that FEP. In addition, an attacker can use his control over the FEP server to insert a generic electric grid malware as specified in our SysScan08 presentation, in order to cause harm to the grid. Both documents are available at http://www.c4-security.com/index-5.html . Workaround/Fix ----------------------- The vendor issued a hotfix to resolve this vulnerability. Additional Information ------------------------------- For additional information please contact us at info_at_c4-security.com. Note that we will respond only to verified utility personnel and governmental agencies. The CVE identifier assigned to this vulnerability by CERT is CVE-2008-2474 Credit -------- This vulnerability was discovered and exploited by Idan Ofrat of C4. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: ABB PCU400 X87 Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA32047 VERIFY ADVISORY: http://secunia.com/advisories/32047/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From local network SOFTWARE: ABB PCU 400 http://secunia.com/advisories/product/19970/ DESCRIPTION: A vulnerability has been reported in ABB PCU400, which can potentially be exploited by malicious people to compromise a vulnerable system. PROVIDED AND/OR DISCOVERED BY: Idan Ofrat of C4 Security ORIGINAL ADVISORY: C4 Security: http://archives.neohapsis.com/archives/bugtraq/2008-09/0283.html OTHER REFERENCES: US-CERT VU#343971: http://www.kb.cert.org/vuls/id/343971 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Java on Apple Mac OS X 10.5.4 and 10.5.5 does not prevent applets from accessing file:// URLs, which allows remote attackers to execute arbitrary programs. An attacker can exploit this issue by enticing an unsuspecting victim to visit a malicious webpage containing crafted Java applets. Successfully exploiting this issue will allow attackers to run arbitrary code by launching arbitrary executables within the context of the affected application. This issue affects Mac OS X 10.5.5 (and prior versions) and Mac OS X Server 10.5.5 (and prior versions). ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Mac OS X Java Multiple Vulnerabilities SECUNIA ADVISORY ID: SA32018 VERIFY ADVISORY: http://secunia.com/advisories/32018/ CRITICAL: Highly critical IMPACT: Security Bypass, Exposure of system information, Exposure of sensitive information, DoS, System access WHERE: >From remote OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/advisories/product/96/ DESCRIPTION: Some vulnerabilities have been reported and acknowledged in Java for Mac OS X, which can be exploited by malicious people to cause a DoS (Denial of Service), to bypass certain security restrictions, disclose system information or potentially sensitive information, or to compromise a vulnerable system. 1) An error leading to the use of an uninitialized variable exists in the hash-based Message Authentication Code (HMAC) provider. 2) An error in the Java plug-in within the handling of "file://" URLs can be exploited to launch local files when a user visits a web page containing a specially crafted java applet. 3) Some vulnerabilities in Java 1.4.2_16 and Java 1.5.0_13 can be exploited by malicious people to cause a DoS (Denial of Service), to bypass certain security restrictions, disclose system information or potentially sensitive information, or to compromise a vulnerable system. 2) The vendor credits Nitesh Dhanjani and Billy Rios. ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3179 http://support.apple.com/kb/HT3178 OTHER REFERENCES: SA28115 http://secunia.com/advisories/28115/ SA29239: http://secunia.com/advisories/29239/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized variable, which allows remote attackers to execute arbitrary code via a crafted applet, related to an "error checking issue.". Successful exploits will allow an attacker to run arbitrary code in the context of the affected software. Failed exploit attempts may result in denial-of-service conditions. This issue affects the following: Mac OS X 10.5.5 (and prior versions) Mac OS X Server 10.5.5 (and prior versions) Mac OS X 10.4.11 (and prior versions) Mac OS X Server 10.4.11 (and prior versions). It is related to a "false detection vulnerability". ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Mac OS X Java Multiple Vulnerabilities SECUNIA ADVISORY ID: SA32018 VERIFY ADVISORY: http://secunia.com/advisories/32018/ CRITICAL: Highly critical IMPACT: Security Bypass, Exposure of system information, Exposure of sensitive information, DoS, System access WHERE: >From remote OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/advisories/product/96/ DESCRIPTION: Some vulnerabilities have been reported and acknowledged in Java for Mac OS X, which can be exploited by malicious people to cause a DoS (Denial of Service), to bypass certain security restrictions, disclose system information or potentially sensitive information, or to compromise a vulnerable system. 2) An error in the Java plug-in within the handling of "file://" URLs can be exploited to launch local files when a user visits a web page containing a specially crafted java applet. 3) Some vulnerabilities in Java 1.4.2_16 and Java 1.5.0_13 can be exploited by malicious people to cause a DoS (Denial of Service), to bypass certain security restrictions, disclose system information or potentially sensitive information, or to compromise a vulnerable system. For more information: SA29239 SA31010 SOLUTION: -- Java for Mac OS X 10.4 -- Update to Release 7: http://www.apple.com/support/downloads/javaformacosx104release7.html -- Java for Mac OS X 10.5 -- Apply Update 2: http://www.apple.com/support/downloads/javaformacosx105update2.html PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Radim Marek. 2) The vendor credits Nitesh Dhanjani and Billy Rios. ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3179 http://support.apple.com/kb/HT3178 OTHER REFERENCES: SA28115 http://secunia.com/advisories/28115/ SA29239: http://secunia.com/advisories/29239/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------