VARIoT IoT vulnerabilities database

Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 image. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists during the parsing of malformed Jpen2000 image files. A field is read directly from the file and used to allocate memory for a structure. If the value read is smaller then the expected structure size then a memory corruption will occur which can be leveraged by an attacker to execute arbitrary code under the context of the current user. Apple QuickTime is prone to a heap-based buffer-overflow vulnerability. A remote attacker can exploit this issue by enticing an unsuspecting user to open a specially crafted file. Failed exploit attempts likely result in denial-of-service conditions. This issue affects Apple QuickTime running on Microsoft Windows Vista, Windows XP SP3, and Mac OS X. Versions of QuickTime prior to 7.6.2 have multiple security vulnerabilities that allow users to cause a denial of service or completely compromise a user's system through malformed media files. ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. Click here to learn more about our commercial solutions: http://secunia.com/advisories/business_solutions/ Click here to trial our solutions: http://secunia.com/advisories/try_vi/ ---------------------------------------------------------------------- TITLE: Apple QuickTime PICT Parsing Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA35091 VERIFY ADVISORY: http://secunia.com/advisories/35091/ DESCRIPTION: A vulnerability has been reported in Apple QuickTime, which can be exploited by malicious people to compromise a user's system The vulnerability is caused due to an error in the processing of "0x77" tags within PICT images, which can be exploited to cause a heap-based buffer overflow when the user opens a specially crafted PICT image or visits a malicious web site. This is related to vulnerability #30 in: SA35074 SOLUTION: Do not browse untrusted web sites. Do not open files from untrusted sources. PROVIDED AND/OR DISCOVERED BY: Damian Put and Sebastian Apelt, reported via ZDI. ORIGINAL ADVISORY: http://www.zerodayinitiative.com/advisories/ZDI-09-021/ OTHER REFERENCES: SA35074: http://secunia.com/advisories/35074/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . ZDI-09-029: Apple QuickTime Jpeg2000 Marker Size Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-029 June 2, 2009 -- CVE ID: CVE-2009-0957 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 8153. -- Vendor Response: Apple has issued an update to correct this vulnerability. More details can be found at: http://support.apple.com/kb/HT3591 -- Disclosure Timeline: 2009-04-28 - Vulnerability reported to vendor 2009-06-02 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by: * Damian Put -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/

Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie composed of a Sorenson 3 video file. Apple QuickTime is prone to a memory-corruption vulnerability. A remote attacker can exploit this issue by enticing an unsuspecting user to open a specially crafted file. Successful exploits will allow the attacker to execute arbitrary code in the context of the user running the application. Failed exploit attempts likely result in denial-of-service conditions. This issue affects Apple QuickTime running on Microsoft Windows Vista, Windows XP SP3, and Mac OS X. ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. Click here to learn more about our commercial solutions: http://secunia.com/advisories/business_solutions/ Click here to trial our solutions: http://secunia.com/advisories/try_vi/ ---------------------------------------------------------------------- TITLE: Apple QuickTime PICT Parsing Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA35091 VERIFY ADVISORY: http://secunia.com/advisories/35091/ DESCRIPTION: A vulnerability has been reported in Apple QuickTime, which can be exploited by malicious people to compromise a user's system The vulnerability is caused due to an error in the processing of "0x77" tags within PICT images, which can be exploited to cause a heap-based buffer overflow when the user opens a specially crafted PICT image or visits a malicious web site. This is related to vulnerability #30 in: SA35074 SOLUTION: Do not browse untrusted web sites. Do not open files from untrusted sources. PROVIDED AND/OR DISCOVERED BY: Damian Put and Sebastian Apelt, reported via ZDI. ORIGINAL ADVISORY: http://www.zerodayinitiative.com/advisories/ZDI-09-021/ OTHER REFERENCES: SA35074: http://secunia.com/advisories/35074/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . ====================================================================== Secunia Research 02/06/2009 - QuickTime Sorenson Video 3 Content Parsing Vulnerability - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Vendor's Description of Software.....................................3 Description of Vulnerability.........................................4 Solution.............................................................5 Time Table...........................................................6 Credits..............................................................7 References...........................................................8 About Secunia........................................................9 Verification........................................................10 ====================================================================== 1) Affected Software * Apple QuickTime 7.60 NOTE: Other versions may also be affected. ====================================================================== 2) Severity Rating: Highly critical Impact: System compromise Where: Remote ====================================================================== 3) Vendor's Description of Software "When you hop aboard QuickTime 7 Player, you\x92re assured of a truly rich multimedia experience.". Product Link: http://www.apple.com/quicktime/player/ ====================================================================== 4) Description of Vulnerability Secunia Research has discovered a vulnerability in QuickTime, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused by an error in the parsing of Sorenson Video 3 content. ====================================================================== 5) Solution Update to version 7.6.2. ====================================================================== 6) Time Table 26/02/2009 - Vendor notified. 02/03/200X - Vendor response. 25/05/2009 - Status update requested. 26/05/2009 - Vendor provides status update. 02/06/2009 - Public disclosure. ====================================================================== 7) Credits Discovered by Carsten Eiram, Secunia Research. ====================================================================== 8) References The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2009-0188 for the vulnerability. Apple: http://support.apple.com/kb/HT3591 ====================================================================== 9) About Secunia Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration: http://secunia.com/advisories/business_solutions/ Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security. http://secunia.com/advisories/ Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general: http://secunia.com/secunia_research/ Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions: http://secunia.com/corporate/jobs/ Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/advisories/mailing_lists/ ====================================================================== 10) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2009-10/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================

Cosminexus Processing Kit for XML and Hitachi Developer's Kit for Java have a vulnerability where UTF-8 output is not properly judged due to deficiency in encoding processing, which may lead to unauthorized access.Unauthorized access may be done exploiting a deficiency in encoding processing. Multiple products from Hitachi are prone to multiple code-execution vulnerabilities. Successfully exploiting these issues would allow the attacker to execute arbitrary code in the context of the currently logged-in user or cause denial-of-service conditions. An attacker can exploit this issue to gain read access to arbitrary memory locations. Information obtained may aid in other attacks. NOTE: This BID is being retired because it is a duplicate of the issue discussed in BID 35589. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Hitachi Products ZIP and UTF-8 Processing Vulnerabilities SECUNIA ADVISORY ID: SA35413 VERIFY ADVISORY: http://secunia.com/advisories/35413/ DESCRIPTION: Some vulnerabilities have been reported in multiple Hitachi products, which can be exploited by malicious people to potentially compromise a vulnerable system. 1) An unspecified error in the processing of ZIP files can be exploited to potentially execute arbitrary code. 2) An unspecified error in the processing of UTF-8 data can be exploited to potentially execute arbitrary code. Please see the vendor's advisory for a full list of affected products. SOLUTION: Update to a fixed version. See vendor advisory for details. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: Hitachi: http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS09-007/index.html http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS09-008/index.html JVN: http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-001544.html http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-001545.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, has a default root password hash, and permits password-based root logins over SSH, which makes it easier for remote attackers to obtain access. Profense Web Application Firewall is prone to a remote security vulnerability

Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "negative model," which allows remote attackers to conduct cross-site scripting (XSS) attacks via a modified end tag of a SCRIPT element. Profense Web Application Firewall is prone to multiple security-bypass vulnerabilities. An attacker can exploit these issues to bypass certain security restrictions and perform various web-application attacks. Versions *prior to* the following are vulnerable: Profense 2.4.4 Profense 2.2.22. 0A (encoded newline) bypasses XSS protection mechanisms and executes arbitrary code within the user's browser session

Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline), as demonstrated by a %0A in a cross-site scripting (XSS) attack URL. Profense Web Application Firewall is prone to multiple security-bypass vulnerabilities. An attacker can exploit these issues to bypass certain security restrictions and perform various web-application attacks. Versions *prior to* the following are vulnerable: Profense 2.4.4 Profense 2.2.22. Remote attackers can include modified SCRIPT element end tags or % in URL requests

Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6 2005Q4 (aka 6.2) and 6.3 allow remote attackers to inject arbitrary web script or HTML via (1) the abperson_displayName parameter to uwc/abs/search.xml in the Add Contact implementation in the Personal Address Book component or (2) the temporaryCalendars parameter to uwc/base/UWCMain. This issue is tracked by Sun Alert ID 258068. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Multiple XSS in Sun Communications Express 1. *Advisory Information* Title: Multiple XSS in Sun Communications Express Advisory ID: CORE-2009-0109 Advisory URL: http://www.coresecurity.com/content/sun-communications-express Date published: 2009-05-20 Date of last update: 2009-05-20 Vendors contacted: Sun Microsystems Release mode: Coordinated release 2. *Vulnerability Information* Class: Cross site scripting (XSS) Remotely Exploitable: Yes Locally Exploitable: No Bugtraq ID: 34154, 34155 CVE Name: CVE-2009-1729 3. 'https://<server>/uwc/abs/search.xml?' 2. For example, an attacker could exploit a XSS vulnerability to steal user cookies (and then impersonate the legitimate user) or fake a page requesting information to the user (i.e. credentials). This vulnerability occurs when user-supplied data is displayed without encoding. 4. *Vulnerable packages* 4.1. *SPARC Platform* . 4.2. *x86 Platform* . 4.3. *Linux* . 5. *Non-vulnerable packages* . 6. 7. *Credits* These vulnerabilities were discovered by the SCS team from Core Security Technologies. 8. *Technical Description / Proof of Concept Code* Cross-Site Scripting (commonly referred to as XSS) attacks are the result of improper encoding or filtering of input obtained from untrusted sources. The injected code then takes advantage of the trust given by the user to the vulnerable site. These attacks are usually targeted at all users of a web application rather than at the application itself (although one could say that the users are affected because of a vulnerability of the web application). The term 'cross-site scripting' is also sometimes used in a broader-sense referring to different types of attacks involving script injection into the client. For additional information, please look at the references [2], [3], [4], [5] and [6]. 8.1. Although the affected URL is originally accessed through a POST request, this vulnerability can be exploited both with a GET and with a POST request. Using the following variables: /----------- abperson_displayName - -----------/ The contents of the variables previously mentioned are not being encoded at the time of using them in HTML output, therefore allowing an attacker who controls their content to insert javascript code. The following code is a proof of concept of this flaw: /----------- https://<server>/uwc/abs/search.xml?bookid=e11e46531a8a0&j_encoding=UTF-8&uiaction=quickaddcontact&entryid=&valueseparator=%3B&prefix=abperson_&stopalreadyselected=1&isselchanged=0&idstoadd=&selectedbookid=&type=abperson%2Cgroup&wcfg_groupview=&wcfg_searchmode=&stopsearch=1&expandgroup=&expandselectedgroup=&expandonmissing=&nextview=&bookid=e11e46531a8a0&actionbookid=e11e46531a8a0&searchid=7&filter=entry%2Fdisplayname%3D*&firstentry=0&sortby=%2Bentry%2Fdisplayname&curbookid=e11e46531a8a0&searchelem=0&searchby=contains&searchstring=Search+for&searchbookid=e11e46531a8a0&abperson_givenName=aa&abperson_sn=aa&abperson_piEmail1=a%40a.com&abperson_piEmail1Type=work&abperson_piPhone1=11&abperson_piPhone1Type=work&quickaddprefix=abperson_&abperson_displayName=%3Cscript%3Ealert%28%27xss2%27%29%3C%2Fscript%3E%2C+%3Cscript%3Ealert%28%27xss1%27%29%3C%2Fscript%3E&abperson_entrytype=abperson&abperson_memberOfPIBook=e11e46531a8a0 - -----------/ 8.2. *Vulnerability #2 - XSS (BID 34155, CVE-2009-1729)* Cross-site scripting vulnerabilities were found in the following file/url: /----------- http://<server>/uwc/base/UWCMain - -----------/ The contents of the url are not being encoded at the time of using them in HTML output, therefore allowing an attacker who controls their content to insert javascript code. This vulnerability can be exploited through a GET request, and the user does not need to be logged into the web application. This makes this cross-site scripting vulnerability perfect to be used by attackers on email-based attacks. An attacker can send via email a link to a 'calendar' and 'exploit' the victim. The following code is a proof of concept of this flaw: /----------- http://<server>/uwc/base/UWCMain?anon=true&calid=test@test.com&caltype=temporaryCalids&date=20081223T143836Z&category=All&viewctx=day&temporaryCalendars=test@test.com%27;alert(%27hello%27);a=%27 - -----------/ 9. *Report Timeline* . 2009-01-09: Core Security Technologies notifies Sun Security Coordination Team of the vulnerability, setting the estimated publication date of the advisory to Feb 2nd. Technical details are sent to Communications Express team. 2009-01-09: The vendor acknowledges reception of the report and asks Core to postpone publication of the security advisory in order to have enough time to investigate and fix the bugs. Vendor requests GPG key of Core's security Advisories team. 2009-01-12: Core agrees to postpone the advisory publication but asks the vendor for a feedback of their engineering team as soon as possible in order to coordinate the release date of fixes and security advisories. 2009-01-21: Core asks the vendor an estimated date for the release of patches and fixes. 2009-01-21: Sun Security Coordination Team notifies Core that the vendor's engineering team is hoping to have patches released sometime near the end of February or the beginning of March. The time-frame is tentative due to the vendor's QA testing process that includes testing of all patches which may include fixes to bugs unrelated to those reported by Core. 2009-02-06: Core re-schedules the advisory publication date to Feb 25th. Updated timeline sent to the vendor requesting confirmation that patches will be released by then. 2009-02-16: The vendor asks Core to delay the advisory publication until the end of March, in order to finish a rigorous process of internal testing. 2009-02-16: Core re-schedules the advisory publication date to March 30th. Core indicates that it would appreciate further technical details about the flaws from the vendors engineering team. 2009-02-17: Vendor acknowledges previous email. 2009-03-17: Core reminds the vendor that the publication of the advisory is scheduled for March 30th. Core also requests updated information about the development and release of fixed versions. 2009-03-23: Vendor confirms that it is on track to have the fix ready for publication at the end of this month, March 30th, and provides a list of affected products and versions. 2009-03-24: Vendor states that there was a confusion on his end, and that patches are scheduled to complete testing and to be published on 22nd April 2009. Vendor requests Core to delay publication of its advisory. 2009-03-25: Core confirms that the advisory publication is rescheduled to April 22nd. 2009-04-08: Sun engineering team informs that they have a fix for other flaw reported by Core [7]. This fix is currently undergoing Sun standard testing, and vendor expect to be ready to publish the patch on Monday 20th April 2009. 2009-04-16: Sun engineering team confirms they are still planning to release the fix for [7] on 20th April 2009. Core requires an estimated date for the release of patches and fixes. 2009-04-20: Sun engineering team informs that the issue which affects Communications Express is planned for publication later in the week. The vendor will get back to Core with a more final date once they have confirmed the details. 2009-04-22: Sun engineering team informs that the fix related to Communications Express is currently undergoing internal testing and they expect to be ready to publish the fixes and the sun alert on 6th May 2009. 2009-04-29: Core re-schedules the advisory publication date to 6th May 2009, asks Sun for an URL of the corresponding Sun alert and a list of non-vulnerable packages. 2009-05-05: Sun engineering team informs that they are experiencing some difficulties related to the final release stages of the fix for this bug. The vendor will not be ready to go public with this fix tomorrow. 2009-05-05: Core responds that it is possible to postpone the publication of the advisory, but asks Sun engineering team for an estimated date to reach the final release of the fix as soon as possible. 2009-05-08: Sun engineering team informs they are still experiencing some delays with the final stages of this release process and asks to delay the publication of the advisory. 2009-05-18: Sun engineering team confirms that they have resolved the outstanding issues related to this vulnerability and they expect to be ready to publish the fixes on Wednesday 20th May. 2009-05-18: Core re-schedules the advisory publication date to 20th May. 2009-05-20: The advisory CORE-2009-0109 is published. 10. *References* [1] http://www.sun.com/software/products/calendar_srvr/comms_express/index.xml [2] HTML Code Injection and Cross-Site Scripting http://www.technicalinfo.net/papers/CSS.html. [3] The Cross-Site Scripting FAQ (XSS) http://www.cgisecurity.com/articles/xss-faq.shtml [4] How to prevent Cross-Site Scripting Security Issues http://support.microsoft.com/default.aspx?scid=KB;en-us;q252985 [5] How to review ASP Code for CSSI Vulnerability http://support.microsoft.com/default.aspx?scid=kb;EN-US;253119 [6] How to review Visual InterDev Generated Code for CSSI Vulnerability http://support.microsoft.com/default.aspx?scid=kb;EN-US;253120 [7] HTTP Response Splitting vulnerability in Sun Delegated Administrator - - http://www.coresecurity.com/content/sun-delegated-administrator 11. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://www.coresecurity.com/corelabs. 12. *About Core Security Technologies* Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide develop and maintain a proactive process for securing their networks. The company's flagship product, CORE IMPACT, is the most comprehensive product for performing enterprise security assurance testing. CORE IMPACT evaluates network, endpoint and end-user vulnerabilities and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core Security Technologies augments its leading technology solution with world-class security consulting services, including penetration testing and software security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2009 Core Security Technologies and (c) 2009 CoreLabs, and may be distributed freely provided that no fee is charged for this distribution and proper credit is given. 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFKFEWVyNibggitWa0RAqSuAKCRr0zxGIvhYRVD92VLI7W1pJezQwCfVvSO SNbJmS6GjYkZPyIfI3+JIpw= =wOZe -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. Various input is not properly sanitised before being returned to users. SOLUTION: Apply patches. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, Unified Provisioning Manager, and other products, allows remote attackers to access arbitrary files via unspecified vectors. Multiple products provided by Cisco Systems contain a directory traversal vulnerablility. Multiple Cisco Systems products are vulnerable to directory traversal due to an issue in CiscoWorks Common Services. Jun Okada of NTT DATA SECURITY CORPORATION reported this vulnerability to IPA. JPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.A remote attacker could view or alter files on the target server. CiscoWorks Common Services TFTP Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to upload and download arbitrary files outside of the TFTP server root directory. This may result in a denial-of-service condition or lead to a complete compromise of the affected computer. This issue is tracked by Cisco Bug ID CSCsx07107. Cisco has released free software updates that address this vulnerability. A workaround that mitigates this vulnerability is available. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090520-cw.shtml. The TFTP service is enabled by default. To verify that the TFTP service is running connect to the CiscoWorks interface and choose "Start > Settings > Control Panel > Administrative Tools > Services" to access the "Services" window. The name of the service is "CWCS tftp service". No other Cisco products are currently known to be affected by this vulnerability. CiscoWorks is a family of products based on Internet standards for managing networks and devices. Vulnerability Scoring Details +---------------------------- Cisco has provided scores for the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at: http://intellishield.cisco.com/security/alertmanager/cvss * CSM: TFTP service allows directory traversal (CSCsx07107) CVSS Base Score - 10.0 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - Complete Integrity Impact - Complete Availability Impact - Complete CVSS Temporal Score - 8.7 Exploitability - High Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== A successful exploitation of this vulnerability may allow an attacker unauthorized access to view or modify application and host operating system files. Software Versions and Fixes =========================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. This vulnerability has been corrected in the following CiscoWorks Common Services software patch: cwcs3.x-win-CSCsx07107-0.zip The CiscoWorks Common Services patch can be downloaded from the following link: http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Workarounds =========== To mitigate this vulnerability, administrators can disable TFTP services by completing the following steps: Step 1. Choose "Start > Settings > Control Panel > Administrative Tools > Services" to access the Services window. Step 2. Right-click "CWCS tftp service" and select "Properties". Step 3. Set the "Startup Type" to "Disabled". Step 4. Click the "Stop" button to stop the TFTP service. Note: Disabling TFTP services may impact the functionality of some of the CiscoWorks components. Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory, which is available at the following link: http://www.cisco.com/warp/public/707/cisco-amb-20090520-cw.shtml. Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was found during the resolution of customer service requests. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20090520-cw.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +------------------------------------------------------------+ | Revision 1.0 | 2009-May-20 | Initial public release | +------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. +-------------------------------------------------------------------- Copyright 2008-2009 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- Updated: May 20, 2009 Document ID: 110143 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkoUF9wACgkQ86n/Gc8U/uD6vwCfR19hcS8fBuvDrshKYSc9zbsM Yp8AoJj60tLS7dMKkYcRcgJLreh3dl8A =yjnP -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. Click here to learn more about our commercial solutions: http://secunia.com/advisories/business_solutions/ Click here to trial our solutions: http://secunia.com/advisories/try_vi/ ---------------------------------------------------------------------- TITLE: CiscoWorks TFTP Directory Traversal Vulnerability SECUNIA ADVISORY ID: SA35179 VERIFY ADVISORY: http://secunia.com/advisories/35179/ DESCRIPTION: A vulnerability has been reported in various Cisco products, which can be exploited by malicious people to disclose sensitive information or compromise a vulnerable system. http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one PROVIDED AND/OR DISCOVERED BY: Reported to the vendor by a customer. ORIGINAL ADVISORY: http://www.cisco.com/warp/public/707/cisco-sa-20090520-cw.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090520-cw.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor

Multiple cross-site scripting (XSS) vulnerabilities in resin-admin/digest.php in Caucho Technology Resin Professional 3.1.5, 3.1.10, 4.0.6, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) digest_realm or (2) digest_username parameters. NOTE: some of these details are obtained from third party information. Resin is a web server developed by Caucho Technology. The input to the \"digest_username\" and \"digest_realm\" parameters passed to the resin-admin/digest.php script lacks sufficient filtering before returning to the user, and the attacker can execute arbitrary HTML and script code on the target user's browser. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Resin Professional 3.1.5 is affected; other versions may also be affected. ---------------------------------------------------------------------- Stay Compliant Alerts, Technical Descriptions, PoC, Links to patches, CVSS, CVE, Changelogs, Alternative Remediation Strategies, and much more provided in the Secunia Vulnerability Intelligence solutions Free Trial http://secunia.com/products/corporate/evm/trial/ ---------------------------------------------------------------------- TITLE: Caucho Resin Two Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA39839 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/39839/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=39839 RELEASE DATE: 2010-05-21 DISCUSS ADVISORY: http://secunia.com/advisories/39839/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/39839/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=39839 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Two vulnerabilities have been discovered in Caucho Resin, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the "digest_username" and "digest_realm" parameters in resin-admin/digest.php is not properly sanitised before being returned to the user. The vulnerabilities are confirmed in version 3.1.10 and 4.0.6. SOLUTION: Edit the source code to ensure that input is properly sanitised. PROVIDED AND/OR DISCOVERED BY: flyh4t ORIGINAL ADVISORY: http://packetstormsecurity.org/1005-exploits/cauchoresin312-xss.txt OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Multiple heap-based buffer overflows in the D-Link MPEG4 Viewer ActiveX Control (csviewer.ocx) 2.11.918.2006 allow remote attackers to execute arbitrary code via a long argument to the (1) SetFilePath and (2) SetClientCookie methods. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Failed exploit attempts likely result in denial-of-service conditions. MPEG4 Viewer 2.11.918.2006 is vulnerable; other versions may also be affected. D-Link MPEG4 Viewer is an ActiveX control installed on the D-Link webcam client. The D-Link MPEG4 Viewer ActiveX control did not properly validate input passed to the SetFilePath() and SetClientCookie() methods. If a user is tricked into visiting a malicious webpage and sends a super-long input parameter to the above method, a heap overflow can be triggered, resulting in the execution of arbitrary instructions. ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. The vulnerabilities are confirmed in version 2.11.918.2006. SOLUTION: Set the kill-bit for the affected ActiveX control. PROVIDED AND/OR DISCOVERED BY: 0x29A ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable. Linksys WAG54G2 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Linksys WAG54G2 is an ADSL all-in-one with integrated modem and router. The Linksys WAG54G2 router provides a management console that is accessible only to LAN users by default. Since the special characters such as \";\", \"&\", \"|\", \"``\", \"%a0\" in the user request are not correctly filtered, the user can inject and execute the malicious request after logging in to the console. Any shell command. If the user does not change the default management password, the external network user can also exploit the vulnerability remotely by using the cross-site request forgery attack. Linksys WAG54G2 router is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data. Remote attackers can exploit this issue to execute arbitrary shell commands with superuser privileges. This may facilitate a complete compromise of the affected device. Linksys WAG54G2 with firmware V1.00.10 is affected; other versions may also be vulnerable. UPDATE (May 29, 2009): The reporter indicates that this issue may not be remotely exploitable if the administrator credentials have been changed from the default values

D-Link MPEG4 Viewer is an ActiveX control installed on the D-Link webcam client.  The D-Link MPEG4 Viewer ActiveX control does not correctly validate the input passed to the SetFilePath () and SetClientCookie () methods. If a user is tricked into visiting a malicious webpage and transmitting long input parameters to the above method, a heap overflow can be triggered, causing arbitrary instructions to be executed.

The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122. Microsoft Internet Information Service (IIS) is prone to multiple authentication-bypass vulnerabilities because the application fails to properly enforce access restrictions on certain requests to password-protected WebDAV folders. An attacker can exploit these issues to gain unauthorized access to protected WebDAV resources, which may lead to other attacks. This issue affects IIS 5.0, 5.1, and 6.0. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA09-160A Microsoft Updates for Multiple Vulnerabilities Original release date: June 09, 2009 Last revised: -- Source: US-CERT Systems Affected * Microsoft Windows * Microsoft Office * Microsoft Internet Explorer Overview Microsoft has released updates that address vulnerabilities in Microsoft Windows, Office, and Internet Explorer. I. Description As part of the Microsoft Security Bulletin Summary for June 2009, Microsoft released updates to address vulnerabilities that affect Microsoft Windows, Office, and Internet Explorer. II. Impact A remote, unauthenticated attacker could execute arbitrary code, gain elevated privileges, or cause a vulnerable application to crash. III. Solution Microsoft has provided updates for these vulnerabilities in the Microsoft Security Bulletin Summary for June 2009. The security bulletin describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. Administrators should consider using an automated update distribution system such as Windows Server Update Services (WSUS). IV. References * Microsoft Security Bulletin Summary for June 2009 - <http://www.microsoft.com/technet/security/bulletin/ms09-jun.mspx> * Microsoft Windows Server Update Services - <http://technet.microsoft.com/en-us/wsus/default.aspx> * US-CERT Vulnerability Notes for Microsoft June 2009 updates - <http://www.kb.cert.org/vuls/byid?searchview&query=ms09-jun> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA09-160A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA09-160A Feedback VU#983731" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History June 09, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSi7EY3IHljM+H4irAQKpUwgAqcYG1SVf4dPt7wevUx9UIKyw/RWG/wCI +ns9UEmk4Pbdu8Tj+snDsNxxOnvdUGnWzfbuBFrzexr+u3zY0BgvBQ50eaYnYyVn Iv9yxxxKfdvQEQIiPi/5gWl05k4axYdSjEYLZqNkQIj1VvqJOhCWaHKPsJZykdZq ZZLd8aFxxM7fj0RrKeorXGiApw45kP9a133EN7NRf8CvYsNKnUTMYVPC2bTaq0Jb HCjjEOwBWaP6YjqQ1laVslCHzOVpFzQnkl+IKBsoDAu1397KjwobIR340YyW6K4g ckdod5TwdG77KOcNZHAp+uQMffGOaCfqj/MFk7qEYxN7/0gJXuB8mQ== =9e4w -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. The vulnerability is caused due to an error when handling WebDAV requests for directories requiring authentication. This can be exploited to bypass access restrictions and e.g. download files from protected folders by issuing an HTTP GET request containing Unicode characters and a "Translate: f" HTTP header. Successful exploitation may allow uploading arbitrary files to protected WebDAV folders. The vulnerability is confirmed in Microsoft IIS 5.1 on a fully patched Windows XP SP3 and reported in version 6.0. Other versions may also be affected. SOLUTION: Do not store sensitive files inside the webroot. Disable WebDAV support. PROVIDED AND/OR DISCOVERED BY: Nikolaos Rangos (Kingcope) ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-1535. Reason: This candidate is a duplicate of CVE-2009-1535. Notes: All CVE users should reference CVE-2009-1535 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Microsoft Internet Information Service (IIS) is prone to multiple authentication-bypass vulnerabilities because the application fails to properly enforce access restrictions on certain requests to password-protected WebDAV folders. An attacker can exploit these issues to gain unauthorized access to protected WebDAV resources, which may lead to other attacks. This issue affects IIS 5.0, 5.1, and 6.0

D-Link DIR-628 router is prone to a security-bypass weakness. Successful exploits will allow an attacker to authenticate without providing the right code for CAPTCHA. This may lead to other attacks. Note that to authenticate, a user is required to provide a valid MD5 hash of the password.

Unspecified vulnerability in the dpwinsup module (dpwinsup.dll) for dpwingad (dpwingad.exe) in HP Data Protector Express and Express SSE 3.x before build 47065, and Express and Express SSE 4.x before build 46537, allows remote attackers to cause a denial of service (application crash) or read portions of memory via one or more crafted packets. HP Data Protector Express is prone to a privilege-escalation vulnerability. Attackers can exploit this issue to execute arbitrary code with escalated privileges or cause denial-of-service conditions. Successfully exploiting this issue may result in the complete compromise of affected computers. UPDATE (June 23, 2009): This issue was originally reported as a local vulnerability. Additional reports indicate that remote attacks are possible. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01697543 Version: 1 HPSBMA02417 SSRT090031 rev.1 - HP Data Protector Express and HP Data Protector Express Single Server Edition (SSE), Local Denial of Service (DoS), Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. References: CVE-2009-0714 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Note: The supported versions of Microsoft Windows, Linux, and Novell NetWare are listed below. Note: Users can identify the build number by clicking on 'Help' and then 'About'. BACKGROUND CVSS 2.0 Base Metrics =============================================== Reference Base Vector Base Score CVE-2009-0714 (AV:L/AC:L/Au:S/C:P/I:C/A:C) 6.4 =============================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002. The Hewlett-Packard Company thanks Abhisek Datta of iViZ Security Research Team for reporting this vulnerability to security-alert@hp.com ========================================================================= HP Data Protector Express 'Hot Fix' (Build 47065) for version 3.5 SP2 is supported on the following: ========================================================================= ===================== Windows Operating Systems ===================== Microsoft Windows Unified Data Storage Server (incl. R2) Microsoft Windows Server 2003 Enterprise / Standard Editions (incl. R2) Microsoft Windows Storage Server 2003 (incl. R2) Microsoft Windows 2000 Server / Advanced Server SP4 Microsoft Windows Small Business Server 2000 SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows Small Business 2003 Server Premium / Standard (incl. R2) Microsoft Windows XP Professional / Home SP2 ================== Linux Operating Systems ================== Red Hat Enterprise Linux (WS/ES/AS) 5 Red Hat Enterprise Linux (WS/ES/AS) 4 Red Hat Enterprise Linux (WS/ES/AS) 3 SuSE Linux Enterprise Server 10 SuSE Linux Enterprise Server 9 =================== Novell Operating Systems =================== NetWare 6.5 SP NetWare 6.0 SP3 ========================================================================= HP Data Protector Express 'Hot Fix' (Build 46537) for version 4.0 SP1 is supported on the following: ========================================================================= ===================== Windows Operating Systems ===================== Windows Server 2008 SP1 (32-bit and X64) Enterprise / Standard / Datacenter / Web Server Editions Windows Server 2003 R2 SP2 (32-bit and X64) Enterprise / Standard Editions Windows Small Business Server 2008 (32-bit and X64) Windows Small Business Server 2003 R2 (32-bit and X64) Windows Unified Data Storage Server 2003 R2 (32-bit and X64) Windows Storage Server 2003 R2 (32-bit and X64) Windows VISTA SP1 (32-bit and X64) Windows XP SP3 (32-bit) =================== Linux Operating Systems =================== Red Hat Enterprise Linux (WS/ES/AS) 5.0 update 1 (32-bit and X64) Red Hat Enterprise Linux (WS/ES/AS) 4.0 update 6 (32-bit and X64) SuSE Linux Enterprise Server 10 update 2 (32-bit and X64) SuSE Linux Enterprise Server 9 update 4 (32-bit and X64) =================== Novell Operating Systems =================== NetWare 6.5 SP5 RESOLUTION HP has provided upgrades to resolve this vulnerability. PRODUCT SPECIFIC INFORMATION None HISTORY Version:1 (rev.1) 13 May 2009 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For further information, contact normal HP Services support channel. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches - check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems - verify your operating system selections are checked and save. To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections. To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do * The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." \xa9Copyright 2009 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBSgwXaOAfOvwtKn1ZEQKmEQCdEKAvOd+gvPXiHx4TnEFtJUxSnYoAoLC1 +nB/DIh/MoQMM+tE7z5UqsAa =gqjb -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. No further information is currently available. PROVIDED AND/OR DISCOVERED BY: The vendor credits Abhisek Datta of iViZ Security Research Team. ORIGINAL ADVISORY: HPSBMA02417 SSRT090031: http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01697543 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7 and Windows allows remote attackers to inject arbitrary web script or HTML via a crafted feed: URL. Apple Safari is prone to multiple input-validation vulnerabilities. An attacker can exploit these issues by enticing an unsuspecting victim to visit a malicious website. Successfully exploiting these issues will allow the attacker to execute arbitrary JavaScript code in the local security zone. This may allow the attacker to obtain sensitive information that can aid in further attacks; other consequences may also occur. These issues affect versions prior to Safari 3.2.3. Safari is the web browser bundled by default in the Apple operating system. I. II. Impact The impacts of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. References * Apple Security Update 2009-002 - <http://support.apple.com/kb/HT3549> * Safari 3.2.3 - <http://support.apple.com/kb/HT3550> * Apple Downloads - <http://support.apple.com/downloads/> * Software Update - <https://support.apple.com/kb/HT1338?viewlocale=en_US> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA09-133A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA09-133A Feedback VU#175188" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 13, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSgsdiHIHljM+H4irAQIsGAf+IykbS/FD1X/R2ooezndAmZjrcT29XnpV HO4DiMlKmqW+dUffk4mdJLVR7y8pwUuP4TbjwncoT39SDR9UoEankv7+Dao/qkM/ Jp0flkEpb5qtcIm9VnuWvpCE31OZZgwBwJ7f2WWzbBLqoZ5FIWAhCcW6E5v6mjVy J+Z4BmHYUIapPLzGzV8+HT6/7LRNpg+mZoldEBUoXXjik8o78v5A7iGyMSXoaBlV vL8N/3GG9a9xecLqbbv5N6ABsncHA9f/GzBnfJUqVHkUM1xnjqmgd7TZikObw+fJ xcgWvmYmoRdCMzM3b1jPqWPDGJDbo0oHZM3J3hKE+opsLe9xChM1qA== =dQ2L -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. Click here to learn more about our commercial solutions: http://secunia.com/advisories/business_solutions/ Click here to trial our solutions: http://secunia.com/advisories/try_vi/ ---------------------------------------------------------------------- TITLE: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities SECUNIA ADVISORY ID: SA35074 VERIFY ADVISORY: http://secunia.com/advisories/35074/ DESCRIPTION: Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities. 1) A vulnerability in Apache when handling FTP proxy requests can be exploited by malicious people to conduct cross-site scripting attacks. For more information: SA31384 2) A boundary error in the handling of Compact Font Format (CFF) fonts in Apple Type Services can be exploited to cause a heap-based buffer overflow when specially crafted document is downloaded or viewed. Successful exploitation allows execution of arbitrary code. 3) A vulnerability in BIND can potentially be exploited by malicious people to conduct spoofing attacks. For more information: SA33404 4) An error in the parsing of Set-Cookie headers in CFNetwork can result in applications using CFNetwork sending sensitive information in unencrypted HTTP requests. 5) An unspecified error in the processing of HTTP headers in CFNetwork can be exploited to cause a heap-based buffer overflow when visiting a malicious web site. Successful exploitation allows execution of arbitrary code. 6) Multiple errors exist in the processing of PDF files in CoreGraphics, which can be exploited to corrupt memory and execute arbitrary code via a specially crafted PDF file. 7) An integer underflow error in the processing of PDF files in CoreGraphics can be exploited to cause a heap-based buffer overflow when specially crafted PDF files is opened. Successful exploitation allows execution of arbitrary code. 8) Multiple vulnerabilities in the processing of JBIG2 streams within PDF files in CoreGraphics can be exploited by malicious people to compromise a user's system. For more information: SA34291 9) Multiple vulnerabilities in cscope can be exploited by malicious people to compromise a user's system. For more information: SA34978: 10) A boundary error in the handling of disk images can be exploited to cause a stack-based buffer overflow when a specially crafted disk image is mounted. 11) Multiple unspecified errors in the handling of disk images can be exploited to cause memory corruptions when a specially crafted disk image is mounted. Successful exploitation of vulnerabilities #10 and #11 allows execution of arbitrary code. 12) Multiple vulnerabilities in enscript can be exploited by malicious people to compromise a vulnerable system. For more information: SA13968 SA32137 13) Multiple vulnerabilities in the Flash Player plugin can be exploited by malicious people to compromise a user's system. For more information: SA34012 14) An error in Help Viewer when loading Cascading Style Sheets referenced in URL parameters can be exploited to invoke arbitrary AppleScript files. 15) A vulnerability exists due to Help Viewer not validating that full paths to HTML documents are within registered help books, which can be exploited to invoke arbitrary AppleScript files. Successful exploitation of vulnerabilities #14 and #15 allows execution of arbitrary code. 16) An error in iChat can result in AIM communication configured for SSL to be sent in plaintext. 17) An error in the handling of certain character encodings in ICU can be exploited to bypass filters on websites that attempt to mitigate cross-site scripting. 18) Some vulnerabilities in IPSec can be exploited by malicious users and malicious people to cause a DoS (Denial of Service). For more information: SA31450 SA31478 19) Multiple vulnerabilities in Kerberos can be exploited by malicious people to potentially disclose sensitive information, cause a DoS (Denial of Service), or potentially compromise a vulnerable system. For more information: SA34347 20) An error in the handling of workqueues within the kernel can be exploited by malicious, local users to cause a DoS or execute arbitrary code with Kernel privileges. 21) An error in Launch Services can cause Finder to repeatedly terminate and relaunch when a specially crafted Mach-O is downloaded. 22) A vulnerability in libxml can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library. For more information: SA31558 23) A vulnerability in Net-SNMP can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA32560 24) A vulnerability in Network Time can be exploited by malicious people to conduct spoofing attacks. For more information: SA33406 25) A vulnerability in Network Time can be exploited by malicious people to potentially compromise a user's system. For more information: SA34608 26) A vulnerability in Networking can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA31745 27) A vulnerability in OpenSSL can be exploited by malicious people to conduct spoofing attacks. For more information: SA33338 28) Some vulnerabilities in PHP can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system, and by malicious, local users to bypass certain security restrictions. For more information: SA32964 29) An unspecified error in QuickDraw Manager can be exploited to cause a memory corruption and potentially execute arbitrary code via a specially crafted PICT image. 30) An integer underflow error in the handling of PICT images in QuickDraw Manager can be exploited to cause a heap-based buffer overflow via a specially crafted PICT file. Successful exploitation allows execution of arbitrary code. 31) Multiple vulnerabilities in ruby can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), and conduct spoofing attacks. For more information: SA31430 SA31602 32) An error in the use of the OpenSSL library in ruby can cause revoked certificates to be accepted. 33) A vulnerability in Safari when handling "feed:" URLs can be exploited to compromise a user's system. For more information: SA35056 34) Multiple unspecified errors in Spotlight can be exploited to cause memory corruptions and execute arbitrary code when a specially crafted Office document is downloaded. 35) An error when invoking the "login" command can result in unexpected high privileges. 36) A boundary error in telnet can be exploited to cause a stack-based buffer overflow when connecting to a server with an overly long canonical name in its DNS address record. For more information: SA35056 38) Multiple vulnerabilities in FreeType can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise applications using the library. For more information: SA20100 SA25350 SA34723 39) A vulnerability in xterm can be exploited by malicious people to compromise a user's system. For more information: SA33318 40) Multiple vulnerabilities in libpng can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise an application using the library. For more information: SA29792 SA33970 SOLUTION: Update to Mac OS X v10.5.7 or apply Security Update 2009-002. Security Update 2009-002 (Server Tiger PPC): http://support.apple.com/downloads/DL819/SecUpdSrvr2009-002PPC.dmg Security Update 2009-002 (Tiger Intel): http://support.apple.com/downloads/DL817/SecUpd2009-002Intel.dmg Security Update 2009-002 (Server Universal): http://support.apple.com/downloads/DL816/SecUpdSrvr2009-002Univ.dmg Mac OS X Server 10.5.7 Update: http://support.apple.com/downloads/DL828/MacOSXServerUpd10.5.7.dmg Mac OS X Server Combo 10.5.7: http://support.apple.com/downloads/DL829/MacOSXServerUpdCombo10.5.7.dmg Security Update 2009-002 (Tiger PPC): http://support.apple.com/downloads/DL818/SecUpd2009-002PPC.dmg Mac OS X 10.5.7 Update: http://support.apple.com/downloads/DL826/MacOSXUpd10.5.7.dmg Mac OS X 10.5.7 Combo Update: http://support.apple.com/downloads/DL827/MacOSXUpdCombo10.5.7.dmg PROVIDED AND/OR DISCOVERED BY: The vendor credits: 2) Charlie Miller of Independent Security Evaluators 4) Andrew Mortensen of the University of Michigan 5) Moritz Jodeit, n.runs AG 7) Barry K. Nathan 8) Alin Rad Pop, Secunia Research and Will Dormann, CERT/CC 10) Tiller Beauchamp, IOActive 14, 15) Brian Mastenbrook 17) Chris Weber of Casaba Security 20) An anonymous researcher working with Verisign iDefense VCP 30) Damian Put and Sebastian Apelt, working with ZDI, and Chris Ries of Carnegie Mellon University Computing Services 38) Tavis Ormandy of the Google Security Team OTHER REFERENCES: SA13968: http://secunia.com/advisories/13968/ SA20100: http://secunia.com/advisories/20100/ SA25350: http://secunia.com/advisories/25350/ SA29792: http://secunia.com/advisories/29792/ SA31384: http://secunia.com/advisories/31384/ SA31430: http://secunia.com/advisories/31430/ SA31450: http://secunia.com/advisories/31450/ SA31478: http://secunia.com/advisories/31478/ SA31558: http://secunia.com/advisories/31558/ SA31602: http://secunia.com/advisories/31602/ SA31745: http://secunia.com/advisories/31745/ SA32137: http://secunia.com/advisories/32137/ SA32560: http://secunia.com/advisories/32560/ SA32964: http://secunia.com/advisories/32964/ SA33318: http://secunia.com/advisories/33318/ SA33338: http://secunia.com/advisories/33338/ SA33404: http://secunia.com/advisories/33404/ SA33406: http://secunia.com/advisories/33406/ SA33970: http://secunia.com/advisories/33970/ SA34012: http://secunia.com/advisories/34012/ SA34291: http://secunia.com/advisories/34291/ SA34347: http://secunia.com/advisories/34347/ SA34608: http://secunia.com/advisories/34608/ SA34723: http://secunia.com/advisories/34723/ SA34978: http://secunia.com/advisories/34978/ SA35056: http://secunia.com/advisories/35056/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Array index error in the xnu (Mach) kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (system shutdown) via unspecified vectors related to workqueues. Apple Mac OS X is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to gain kernel-level privileges, which may lead to a complete compromise of the affected computer. NOTE: This issue was previously covered in BID 34926 (Apple Mac OS X 2009-002 Multiple Security Vulnerabilities), but has been assigned its own record to better document it. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 05.12.09 http://labs.idefense.com/intelligence/vulnerabilities/ May 12, 2009 I. OS X is the tenth major version of Apple's operating system for Macintosh computers and is Unix-based. For more information, see the vendor's site found at the following link. http://www.apple.com/support/leopard/internet/ II. This allows the kernel to schedule events to take place in a task. III. Upon successful exploitation, the attacker could elevate privileges by changing the effective user id to root of an attacker controlled process. Alternatively an attacker could also add or alter kernel code in memory that is commonly referred to as a rootkit. IV. V. WORKAROUND iDefense is currently unaware of any workaround for this issue. VI. VENDOR RESPONSE Apple Inc. has released a patch which addresses this issue. For more information, consult their advisory at the following URL: http://support.apple.com/kb/HT3549 VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-1517 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 03/19/2008 - Initial Contact 03/31/2009 - Attribution Request 04/01/2009 - Attribution Sent 04/01/2009 - CVE Requested 05/12/2009 - Coordinated Public Disclosure IX. CREDIT This vulnerability was reported to iDefense by Neil Kettle (mu-b) of www.digit-labs.org. Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php Free tools, research and upcoming events http://labs.idefense.com/ X. LEGAL NOTICES Copyright \xa9 2009 iDefense, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFKDDt8bjs6HoxIfBkRAvXGAJ95Kgxxt6ovkw8gM387yynMaltRGQCgmW9w zBM997tpgIxs1x/LoVZQMIQ= =C4Kw -----END PGP SIGNATURE----- . I. Impact The impacts of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. These and other updates are available via Software Update or via Apple Downloads. References * Apple Security Update 2009-002 - <http://support.apple.com/kb/HT3549> * Safari 3.2.3 - <http://support.apple.com/kb/HT3550> * Apple Downloads - <http://support.apple.com/downloads/> * Software Update - <https://support.apple.com/kb/HT1338?viewlocale=en_US> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA09-133A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA09-133A Feedback VU#175188" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. 1) A vulnerability in Apache when handling FTP proxy requests can be exploited by malicious people to conduct cross-site scripting attacks. For more information: SA31384 2) A boundary error in the handling of Compact Font Format (CFF) fonts in Apple Type Services can be exploited to cause a heap-based buffer overflow when specially crafted document is downloaded or viewed. Successful exploitation allows execution of arbitrary code. 3) A vulnerability in BIND can potentially be exploited by malicious people to conduct spoofing attacks. For more information: SA33404 4) An error in the parsing of Set-Cookie headers in CFNetwork can result in applications using CFNetwork sending sensitive information in unencrypted HTTP requests. 5) An unspecified error in the processing of HTTP headers in CFNetwork can be exploited to cause a heap-based buffer overflow when visiting a malicious web site. Successful exploitation allows execution of arbitrary code. 6) Multiple errors exist in the processing of PDF files in CoreGraphics, which can be exploited to corrupt memory and execute arbitrary code via a specially crafted PDF file. 7) An integer underflow error in the processing of PDF files in CoreGraphics can be exploited to cause a heap-based buffer overflow when specially crafted PDF files is opened. Successful exploitation allows execution of arbitrary code. 8) Multiple vulnerabilities in the processing of JBIG2 streams within PDF files in CoreGraphics can be exploited by malicious people to compromise a user's system. For more information: SA34291 9) Multiple vulnerabilities in cscope can be exploited by malicious people to compromise a user's system. For more information: SA34978: 10) A boundary error in the handling of disk images can be exploited to cause a stack-based buffer overflow when a specially crafted disk image is mounted. 11) Multiple unspecified errors in the handling of disk images can be exploited to cause memory corruptions when a specially crafted disk image is mounted. Successful exploitation of vulnerabilities #10 and #11 allows execution of arbitrary code. 12) Multiple vulnerabilities in enscript can be exploited by malicious people to compromise a vulnerable system. For more information: SA13968 SA32137 13) Multiple vulnerabilities in the Flash Player plugin can be exploited by malicious people to compromise a user's system. For more information: SA34012 14) An error in Help Viewer when loading Cascading Style Sheets referenced in URL parameters can be exploited to invoke arbitrary AppleScript files. 15) A vulnerability exists due to Help Viewer not validating that full paths to HTML documents are within registered help books, which can be exploited to invoke arbitrary AppleScript files. Successful exploitation of vulnerabilities #14 and #15 allows execution of arbitrary code. 16) An error in iChat can result in AIM communication configured for SSL to be sent in plaintext. 17) An error in the handling of certain character encodings in ICU can be exploited to bypass filters on websites that attempt to mitigate cross-site scripting. 18) Some vulnerabilities in IPSec can be exploited by malicious users and malicious people to cause a DoS (Denial of Service). For more information: SA31450 SA31478 19) Multiple vulnerabilities in Kerberos can be exploited by malicious people to potentially disclose sensitive information, cause a DoS (Denial of Service), or potentially compromise a vulnerable system. For more information: SA34347 20) An error in the handling of workqueues within the kernel can be exploited by malicious, local users to cause a DoS or execute arbitrary code with Kernel privileges. 21) An error in Launch Services can cause Finder to repeatedly terminate and relaunch when a specially crafted Mach-O is downloaded. 22) A vulnerability in libxml can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library. For more information: SA31558 23) A vulnerability in Net-SNMP can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA32560 24) A vulnerability in Network Time can be exploited by malicious people to conduct spoofing attacks. For more information: SA33406 25) A vulnerability in Network Time can be exploited by malicious people to potentially compromise a user's system. For more information: SA34608 26) A vulnerability in Networking can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA31745 27) A vulnerability in OpenSSL can be exploited by malicious people to conduct spoofing attacks. For more information: SA33338 28) Some vulnerabilities in PHP can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system, and by malicious, local users to bypass certain security restrictions. For more information: SA32964 29) An unspecified error in QuickDraw Manager can be exploited to cause a memory corruption and potentially execute arbitrary code via a specially crafted PICT image. 30) An integer underflow error in the handling of PICT images in QuickDraw Manager can be exploited to cause a heap-based buffer overflow via a specially crafted PICT file. Successful exploitation allows execution of arbitrary code. 31) Multiple vulnerabilities in ruby can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), and conduct spoofing attacks. For more information: SA31430 SA31602 32) An error in the use of the OpenSSL library in ruby can cause revoked certificates to be accepted. 33) A vulnerability in Safari when handling "feed:" URLs can be exploited to compromise a user's system. For more information: SA35056 34) Multiple unspecified errors in Spotlight can be exploited to cause memory corruptions and execute arbitrary code when a specially crafted Office document is downloaded. 35) An error when invoking the "login" command can result in unexpected high privileges. 36) A boundary error in telnet can be exploited to cause a stack-based buffer overflow when connecting to a server with an overly long canonical name in its DNS address record. Successful exploitation may allow execution of arbitrary code. 37) A vulnerability in WebKit when handling SVGList objects can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA35056 38) Multiple vulnerabilities in FreeType can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise applications using the library. For more information: SA20100 SA25350 SA34723 39) A vulnerability in xterm can be exploited by malicious people to compromise a user's system. For more information: SA33318 40) Multiple vulnerabilities in libpng can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise an application using the library. For more information: SA29792 SA33970 SOLUTION: Update to Mac OS X v10.5.7 or apply Security Update 2009-002. Security Update 2009-002 (Server Tiger PPC): http://support.apple.com/downloads/DL819/SecUpdSrvr2009-002PPC.dmg Security Update 2009-002 (Tiger Intel): http://support.apple.com/downloads/DL817/SecUpd2009-002Intel.dmg Security Update 2009-002 (Server Universal): http://support.apple.com/downloads/DL816/SecUpdSrvr2009-002Univ.dmg Mac OS X Server 10.5.7 Update: http://support.apple.com/downloads/DL828/MacOSXServerUpd10.5.7.dmg Mac OS X Server Combo 10.5.7: http://support.apple.com/downloads/DL829/MacOSXServerUpdCombo10.5.7.dmg Security Update 2009-002 (Tiger PPC): http://support.apple.com/downloads/DL818/SecUpd2009-002PPC.dmg Mac OS X 10.5.7 Update: http://support.apple.com/downloads/DL826/MacOSXUpd10.5.7.dmg Mac OS X 10.5.7 Combo Update: http://support.apple.com/downloads/DL827/MacOSXUpdCombo10.5.7.dmg PROVIDED AND/OR DISCOVERED BY: The vendor credits: 2) Charlie Miller of Independent Security Evaluators 4) Andrew Mortensen of the University of Michigan 5) Moritz Jodeit, n.runs AG 7) Barry K. Nathan 8) Alin Rad Pop, Secunia Research and Will Dormann, CERT/CC 10) Tiller Beauchamp, IOActive 14, 15) Brian Mastenbrook 17) Chris Weber of Casaba Security 20) An anonymous researcher working with Verisign iDefense VCP 30) Damian Put and Sebastian Apelt, working with ZDI, and Chris Ries of Carnegie Mellon University Computing Services 38) Tavis Ormandy of the Google Security Team OTHER REFERENCES: SA13968: http://secunia.com/advisories/13968/ SA20100: http://secunia.com/advisories/20100/ SA25350: http://secunia.com/advisories/25350/ SA29792: http://secunia.com/advisories/29792/ SA31384: http://secunia.com/advisories/31384/ SA31430: http://secunia.com/advisories/31430/ SA31450: http://secunia.com/advisories/31450/ SA31478: http://secunia.com/advisories/31478/ SA31558: http://secunia.com/advisories/31558/ SA31602: http://secunia.com/advisories/31602/ SA31745: http://secunia.com/advisories/31745/ SA32137: http://secunia.com/advisories/32137/ SA32560: http://secunia.com/advisories/32560/ SA32964: http://secunia.com/advisories/32964/ SA33318: http://secunia.com/advisories/33318/ SA33338: http://secunia.com/advisories/33338/ SA33404: http://secunia.com/advisories/33404/ SA33406: http://secunia.com/advisories/33406/ SA33970: http://secunia.com/advisories/33970/ SA34012: http://secunia.com/advisories/34012/ SA34291: http://secunia.com/advisories/34291/ SA34347: http://secunia.com/advisories/34347/ SA34608: http://secunia.com/advisories/34608/ SA34723: http://secunia.com/advisories/34723/ SA34978: http://secunia.com/advisories/34978/ SA35056: http://secunia.com/advisories/35056/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption. WebKit of insertItemBefore Methods include SVGPathList A vulnerability exists in the execution of arbitrary code due to flaws in the processing of documents with data structures.A third party may execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.The specific flaw exists during the parsing of malformed SVGLists via the SVGPathList data structure, the following lists are affected: SVGTransformList, SVGStringList, SVGNumberList, SVGPathSegList, SVGPointList, SVGLengthList. When a negative index argument is suppled to the insertItemBefore() method, a memory corruption occurs resulting in the ability to execute arbitrary code. WebKit is prone to a remote memory-corruption vulnerability. Failed exploit attempts will result in a denial-of-service condition. The issue also affects the following: Apple Safari prior to 3.2.3 Apple Mac OS X v10.5 through v10.5.6, Apple Mac OS X Server v10.5 through v10.5.6 Google Chrome prior to 1.0.154.65. Safari is the web browser bundled by default in the Apple operating system. There is a memory corruption vulnerability in the processing of SVGList objects in WebKit in Safari. Safari has multiple input validation errors in its handling of the feed: URL, and accessing a malicious feed: URL can lead to arbitrary JavaScript execution. (CVE-2009-1687). (CVE-2009-1690). (CVE-2009-0689). The updated packages have been patched to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2702 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1687 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1725 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1690 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1698 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2537 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0689 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0945 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.1: c08161eacba6cdb1b0ba26babe5f8cc5 2009.1/i586/kdelibs4-core-4.2.4-0.8mdv2009.1.i586.rpm 933468cf4109252dac5119edd958f73d 2009.1/i586/kdelibs4-devel-4.2.4-0.8mdv2009.1.i586.rpm 96703a0ef0baf299647ff27d64cb0680 2009.1/i586/libkde3support4-4.2.4-0.8mdv2009.1.i586.rpm e5f60ba41e5919fa77c313b204e1f712 2009.1/i586/libkdecore5-4.2.4-0.8mdv2009.1.i586.rpm cf8af6e467cd1585c44e1cce01362526 2009.1/i586/libkdefakes5-4.2.4-0.8mdv2009.1.i586.rpm 1c9c04b5f6c0c59d2e5860b077e0c6e3 2009.1/i586/libkdesu5-4.2.4-0.8mdv2009.1.i586.rpm 89fe7c33c7e5bcc23595560ae4664bf6 2009.1/i586/libkdeui5-4.2.4-0.8mdv2009.1.i586.rpm 30b73ef58ac3a45ff86756ad09d0d555 2009.1/i586/libkdnssd4-4.2.4-0.8mdv2009.1.i586.rpm a1f00af00ea7e52d9f187f1fe5ccdfe2 2009.1/i586/libkfile4-4.2.4-0.8mdv2009.1.i586.rpm 553486988b945307ee038cb41dcb76e6 2009.1/i586/libkhtml5-4.2.4-0.8mdv2009.1.i586.rpm 9d9501ff70e709c5ea32b35aa985688a 2009.1/i586/libkimproxy4-4.2.4-0.8mdv2009.1.i586.rpm a2ec3f440eb6cf545abbc63a3d34c1e5 2009.1/i586/libkio5-4.2.4-0.8mdv2009.1.i586.rpm 4168e955b60a5a69d8f1e085b30d0424 2009.1/i586/libkjs4-4.2.4-0.8mdv2009.1.i586.rpm bfcece9c73348c6415c48ec266877908 2009.1/i586/libkjsapi4-4.2.4-0.8mdv2009.1.i586.rpm 228ca7dc2a86fdc868a5937b16a7a08c 2009.1/i586/libkjsembed4-4.2.4-0.8mdv2009.1.i586.rpm f6297ae0630eb6207895df9f2f971eb6 2009.1/i586/libkmediaplayer4-4.2.4-0.8mdv2009.1.i586.rpm cf6113c17858d5e6e3c0e04622f8a66c 2009.1/i586/libknewstuff2_4-4.2.4-0.8mdv2009.1.i586.rpm da55a2f428ad020834f7b91c0023ecf6 2009.1/i586/libknotifyconfig4-4.2.4-0.8mdv2009.1.i586.rpm 9fef466138ff78a3d6d3244998a9ba30 2009.1/i586/libkntlm4-4.2.4-0.8mdv2009.1.i586.rpm 4f7c0ad254ec1990f5dab1c0b959629d 2009.1/i586/libkparts4-4.2.4-0.8mdv2009.1.i586.rpm 8c58d6a9a6ec7fc21f287b2f4c2e9858 2009.1/i586/libkpty4-4.2.4-0.8mdv2009.1.i586.rpm 8ed500d050b95560d7eff6db26fa05ee 2009.1/i586/libkrosscore4-4.2.4-0.8mdv2009.1.i586.rpm 2d8d12d8a7bbfe18f6b04b9807795077 2009.1/i586/libkrossui4-4.2.4-0.8mdv2009.1.i586.rpm 8cc5c226e381b122983440b3440c1476 2009.1/i586/libktexteditor4-4.2.4-0.8mdv2009.1.i586.rpm 3c53941130fb8cc6d12b8cdea488f536 2009.1/i586/libkunittest4-4.2.4-0.8mdv2009.1.i586.rpm 3996bfcff0b2465c39c6ccdb8367f401 2009.1/i586/libkutils4-4.2.4-0.8mdv2009.1.i586.rpm 129a26ab20c792994113b5db00b7f7c4 2009.1/i586/libnepomuk4-4.2.4-0.8mdv2009.1.i586.rpm 0b88090e1cba0db59a3fb85c34e6b726 2009.1/i586/libplasma3-4.2.4-0.8mdv2009.1.i586.rpm 79b484a6c8e20db156fbe130c81e2001 2009.1/i586/libsolid4-4.2.4-0.8mdv2009.1.i586.rpm ddd09e03af15f421b2e38b6f06c0247a 2009.1/i586/libthreadweaver4-4.2.4-0.8mdv2009.1.i586.rpm fe70dc01416cc986d1e19c15a0b5cfa7 2009.1/SRPMS/kdelibs4-4.2.4-0.8mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 89f77418ccda86b51c7d32d011e88e9b 2009.1/x86_64/kdelibs4-core-4.2.4-0.8mdv2009.1.x86_64.rpm d0b009e595350648b12cca1ee094802e 2009.1/x86_64/kdelibs4-devel-4.2.4-0.8mdv2009.1.x86_64.rpm 03db494c356e0b0823ddf697d42c0f50 2009.1/x86_64/lib64kde3support4-4.2.4-0.8mdv2009.1.x86_64.rpm 6d98531ba95a096fd49801f7df452776 2009.1/x86_64/lib64kdecore5-4.2.4-0.8mdv2009.1.x86_64.rpm bf3845f586eeeaafab5e25442f4d8950 2009.1/x86_64/lib64kdefakes5-4.2.4-0.8mdv2009.1.x86_64.rpm b9767fb69262886d60a7844ad6569e27 2009.1/x86_64/lib64kdesu5-4.2.4-0.8mdv2009.1.x86_64.rpm d709c9fb8874c432d1b4e415e9c06858 2009.1/x86_64/lib64kdeui5-4.2.4-0.8mdv2009.1.x86_64.rpm 6d062780a7629eed7e93ab9e66daf633 2009.1/x86_64/lib64kdnssd4-4.2.4-0.8mdv2009.1.x86_64.rpm f39c44bc7572d06921061c0ac5ef78c9 2009.1/x86_64/lib64kfile4-4.2.4-0.8mdv2009.1.x86_64.rpm 90f8ecd4967830ebff3b81732162fe33 2009.1/x86_64/lib64khtml5-4.2.4-0.8mdv2009.1.x86_64.rpm 005d7de69a0063a8dc396b9dffdf20ed 2009.1/x86_64/lib64kimproxy4-4.2.4-0.8mdv2009.1.x86_64.rpm 3924d83bf43990f7a7ba5d2eea29ef5d 2009.1/x86_64/lib64kio5-4.2.4-0.8mdv2009.1.x86_64.rpm 9124f0ce5f1643e4310ef0bfc5fda970 2009.1/x86_64/lib64kjs4-4.2.4-0.8mdv2009.1.x86_64.rpm 573504d0c305e757b3c163b9132264e4 2009.1/x86_64/lib64kjsapi4-4.2.4-0.8mdv2009.1.x86_64.rpm 917e5b175a3a5480e848dee6201e99d9 2009.1/x86_64/lib64kjsembed4-4.2.4-0.8mdv2009.1.x86_64.rpm 604cce29c11b2452b2744ff72e248b7c 2009.1/x86_64/lib64kmediaplayer4-4.2.4-0.8mdv2009.1.x86_64.rpm bd75d3e4feaa98a3659ae5d113fe45f6 2009.1/x86_64/lib64knewstuff2_4-4.2.4-0.8mdv2009.1.x86_64.rpm 0a7d48b91c673f5908ce2d47a77746e2 2009.1/x86_64/lib64knotifyconfig4-4.2.4-0.8mdv2009.1.x86_64.rpm a91967cfec8b470cc7520ac17590d41b 2009.1/x86_64/lib64kntlm4-4.2.4-0.8mdv2009.1.x86_64.rpm 0159bb033c507f20fb8bd77a7a8be43a 2009.1/x86_64/lib64kparts4-4.2.4-0.8mdv2009.1.x86_64.rpm a062d0124cdea9dfcafb82ed2c5dfd54 2009.1/x86_64/lib64kpty4-4.2.4-0.8mdv2009.1.x86_64.rpm 8c0950479a23531a03836f7744d6b90d 2009.1/x86_64/lib64krosscore4-4.2.4-0.8mdv2009.1.x86_64.rpm ca61efacf989bd4421d2c88abc440e3f 2009.1/x86_64/lib64krossui4-4.2.4-0.8mdv2009.1.x86_64.rpm bcd31e87995de0f86ad9c363e87ea0d4 2009.1/x86_64/lib64ktexteditor4-4.2.4-0.8mdv2009.1.x86_64.rpm 23a0f2c640a20dd1be2b4475a9102cd6 2009.1/x86_64/lib64kunittest4-4.2.4-0.8mdv2009.1.x86_64.rpm e49987a6d8016b6ac39011b6cac0b570 2009.1/x86_64/lib64kutils4-4.2.4-0.8mdv2009.1.x86_64.rpm 90d6806fa9dcd2ac1b71fc3b72dd4f81 2009.1/x86_64/lib64nepomuk4-4.2.4-0.8mdv2009.1.x86_64.rpm 4808080c578223d0bcb156e78f5d661f 2009.1/x86_64/lib64plasma3-4.2.4-0.8mdv2009.1.x86_64.rpm e8cecb137634dfc738617b67a6d34122 2009.1/x86_64/lib64solid4-4.2.4-0.8mdv2009.1.x86_64.rpm 35c8778eaaa5465a8f15c27a57d8ed60 2009.1/x86_64/lib64threadweaver4-4.2.4-0.8mdv2009.1.x86_64.rpm fe70dc01416cc986d1e19c15a0b5cfa7 2009.1/SRPMS/kdelibs4-4.2.4-0.8mdv2009.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. ZDI-09-022: Apple Safari Malformed SVGList Parsing Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-022 May 13, 2009 -- CVE ID: CVE-2009-0945 -- Affected Vendors: Apple -- Affected Products: Apple Safari -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 6960. -- Vendor Response: Apple has issued an update to correct this vulnerability. More details can be found at: http://support.apple.com/kb/HT3549 -- Disclosure Timeline: 2009-03-19 - Vulnerability reported to vendor 2009-05-13 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by: * Nils -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ . =========================================================== Ubuntu Security Notice USN-836-1 September 23, 2009 webkit vulnerabilities CVE-2009-0945, CVE-2009-1687, CVE-2009-1690, CVE-2009-1698, CVE-2009-1711, CVE-2009-1712, CVE-2009-1725 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 8.10 Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.10: libwebkit-1.0-1 1.0.1-2ubuntu0.2 libwebkit-1.0-1-dbg 1.0.1-2ubuntu0.2 libwebkit-dev 1.0.1-2ubuntu0.2 Ubuntu 9.04: libwebkit-1.0-1 1.0.1-4ubuntu0.1 libwebkit-1.0-1-dbg 1.0.1-4ubuntu0.1 libwebkit-dev 1.0.1-4ubuntu0.1 After a standard system upgrade you need to restart any applications that use WebKit, such as Epiphany-webkit and Midori, to effect the necessary changes. Details follow: It was discovered that WebKit did not properly handle certain SVGPathList data structures. (CVE-2009-0945) Several flaws were discovered in the WebKit browser and JavaScript engines. (CVE-2009-1687, CVE-2009-1690, CVE-2009-1698, CVE-2009-1711, CVE-2009-1725) It was discovered that WebKit did not prevent the loading of local Java applets. (CVE-2009-1712) Updated packages for Ubuntu 8.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/w/webkit/webkit_1.0.1-2ubuntu0.2.diff.gz Size/MD5: 25401 ca58f621eec09ea60847fb7eeb18ef2a http://security.ubuntu.com/ubuntu/pool/main/w/webkit/webkit_1.0.1-2ubuntu0.2.dsc Size/MD5: 1538 ebdb32117beca5fff473ca0c1b065b42 http://security.ubuntu.com/ubuntu/pool/main/w/webkit/webkit_1.0.1.orig.tar.gz Size/MD5: 13418752 4de68a5773998bea14e8939aa341c466 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.0.1-2ubuntu0.2_all.deb Size/MD5: 34590 acb9cdfb9608c5f4146ea88eef384e75 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-2ubuntu0.2_amd64.deb Size/MD5: 62592212 df3152f6a40e538e3a267908d83783c0 http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-1_1.0.1-2ubuntu0.2_amd64.deb Size/MD5: 3501472 e68f67894e53eb2faa48191ea3953732 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-2ubuntu0.2_i386.deb Size/MD5: 62206938 b7d1dde62360865cbc814122b93d4005 http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-1_1.0.1-2ubuntu0.2_i386.deb Size/MD5: 3014500 73a5a3e9985f6d165120c5c3cca6d06b lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-2ubuntu0.2_lpia.deb Size/MD5: 62284322 75ff8aefee1fdea994f660dab5f6554f http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-1_1.0.1-2ubuntu0.2_lpia.deb Size/MD5: 2966170 1c52f1920282c659a0a81a3be44dde7f Updated packages for Ubuntu 9.04: Source archives: http://security.ubuntu.com/ubuntu/pool/main/w/webkit/webkit_1.0.1-4ubuntu0.1.diff.gz Size/MD5: 30900 0ea9f48f994b9bd759446a939ff5dca3 http://security.ubuntu.com/ubuntu/pool/main/w/webkit/webkit_1.0.1-4ubuntu0.1.dsc Size/MD5: 1538 31502504b765f1161825ccdb82f71788 http://security.ubuntu.com/ubuntu/pool/main/w/webkit/webkit_1.0.1.orig.tar.gz Size/MD5: 13418752 4de68a5773998bea14e8939aa341c466 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.0.1-4ubuntu0.1_all.deb Size/MD5: 34678 5042c01c01e9d128a13d1457c56b0cbd amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4ubuntu0.1_amd64.deb Size/MD5: 62772554 3026ef7b332447cae68ed4f72b35ddb2 http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-1_1.0.1-4ubuntu0.1_amd64.deb Size/MD5: 3502830 0fcd75b07524e2d70f8770ccd5bdc0c3 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4ubuntu0.1_i386.deb Size/MD5: 62357024 777eb37c5384472cf9b4adac21f0d116 http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-1_1.0.1-4ubuntu0.1_i386.deb Size/MD5: 3014688 100fd9406ea649edd954f4d154ab4d30 lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4ubuntu0.1_lpia.deb Size/MD5: 62441454 18aa72b5c443a86153906e5ba4a87e55 http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-1_1.0.1-4ubuntu0.1_lpia.deb Size/MD5: 2968040 9651199f95dfee6252e2aacde99ebbbf . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1950 security@debian.org http://www.debian.org/security/ Giuseppe Iuculano December 12, 2009 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : webkit Vulnerability : several Problem type : remote (local) Debian-specific: no CVE Id : CVE-2009-0945 CVE-2009-1687 CVE-2009-1690 CVE-2009-1698 CVE-2009-1711 CVE-2009-1712 CVE-2009-1725 CVE-2009-1714 CVE-2009-1710 CVE-2009-1697 CVE-2009-1695 CVE-2009-1693 CVE-2009-1694 CVE-2009-1681 CVE-2009-1684 CVE-2009-1692 Debian Bug : 532724 532725 534946 535793 538346 Several vulnerabilities have been discovered in webkit, a Web content engine library for Gtk+. CVE-2009-1711 WebKit does not properly initialize memory for Attr DOM objects, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document. CVE-2009-1725 WebKit do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. CVE-2009-1714 Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes. CVE-2009-1710 WebKit allows remote attackers to spoof the browser's display of the host name, security indicators, and unspecified other UI elements via a custom cursor in conjunction with a modified CSS3 hotspot property. CVE-2009-1697 CRLF injection vulnerability in WebKit allows remote attackers to inject HTTP headers and bypass the Same Origin Policy via a crafted HTML document, related to cross-site scripting (XSS) attacks that depend on communication with arbitrary web sites on the same server through use of XMLHttpRequest without a Host header. CVE-2009-1695 Cross-site scripting (XSS) vulnerability in WebKit allows remote attackers to inject arbitrary web script or HTML via vectors involving access to frame contents after completion of a page transition. CVE-2009-1693 WebKit allows remote attackers to read images from arbitrary web sites via a CANVAS element with an SVG image, related to a "cross-site image capture issue." CVE-2009-1694 WebKit does not properly handle redirects, which allows remote attackers to read images from arbitrary web sites via vectors involving a CANVAS element and redirection, related to a "cross-site image capture issue." CVE-2009-1681 WebKit does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document. CVE-2009-1684 Cross-site scripting (XSS) vulnerability in WebKit allows remote attackers to inject arbitrary web script or HTML via an event handler that triggers script execution in the context of the next loaded document. CVE-2009-1692 WebKit allows remote attackers to cause a denial of service (memory consumption or device reset) via a web page containing an HTMLSelectElement object with a large length attribute, related to the length property of a Select object. For the stable distribution (lenny), these problems has been fixed in version 1.0.1-4+lenny2. For the testing distribution (squeeze) and the unstable distribution (sid), these problems have been fixed in version 1.1.16-1. We recommend that you upgrade your webkit package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 5.0 alias lenny - -------------------------------- Debian (stable) - --------------- Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/w/webkit/webkit_1.0.1.orig.tar.gz Size/MD5 checksum: 13418752 4de68a5773998bea14e8939aa341c466 http://security.debian.org/pool/updates/main/w/webkit/webkit_1.0.1-4+lenny2.diff.gz Size/MD5 checksum: 35369 506c8f2fef73a9fc856264f11a3ad27e http://security.debian.org/pool/updates/main/w/webkit/webkit_1.0.1-4+lenny2.dsc Size/MD5 checksum: 1447 b5f01d6428f01d79bfe18338064452ab Architecture independent packages: http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1.0.1-4+lenny2_all.deb Size/MD5 checksum: 35164 df682bbcd13389c2f50002c2aaf7347b alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_alpha.deb Size/MD5 checksum: 65193740 fc8b613c9c41ef0f0d3856e7ee3deeae http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_alpha.deb Size/MD5 checksum: 4254938 252b95b962bda11c000f9c0543673c1b amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_amd64.deb Size/MD5 checksum: 3502994 4a96cad1e302e7303d41d6f866215da4 http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_amd64.deb Size/MD5 checksum: 62518476 d723a8c76b373026752b6f68e5fc4950 arm architecture (ARM) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_arm.deb Size/MD5 checksum: 2721324 1fac2f59ffa9e3d7b8697aae262f09e4 http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_arm.deb Size/MD5 checksum: 61478724 260faea7d5ba766268faad888b3e61ff armel architecture (ARM EABI) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_armel.deb Size/MD5 checksum: 2770654 5b88754e9804d9290537afdf6127643a http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_armel.deb Size/MD5 checksum: 59892062 99c8f13257a054f42686ab9c6329d490 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_hppa.deb Size/MD5 checksum: 3869020 c61be734b6511788e8cc235a5d672eab http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_hppa.deb Size/MD5 checksum: 63935342 f1db2bd7b5c22e257c74100798017f30 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_i386.deb Size/MD5 checksum: 62161744 f89fc6ac6d1110cabe47dd9184c9a9ca http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_i386.deb Size/MD5 checksum: 3016584 b854f5294527adac80e9776efed37cd7 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_ia64.deb Size/MD5 checksum: 5547624 2bd2100a345089282117317a9ab2e7d1 http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_ia64.deb Size/MD5 checksum: 62685224 5eaff5d431cf4a85beeaa0b66c91958c mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_mips.deb Size/MD5 checksum: 3109134 a680a8f105a19bf1b21a5034c14c4822 http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mips.deb Size/MD5 checksum: 64547832 dd440891a1861262bc92deb0a1ead013 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_mipsel.deb Size/MD5 checksum: 2992848 952d643be475c35e253a8757075cd41b http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mipsel.deb Size/MD5 checksum: 62135970 7cd635047e3f9bd000ff4547a47eaaec s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_s390.deb Size/MD5 checksum: 3456914 6fc856a50b3f899c36381ed8d51af44e http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_s390.deb Size/MD5 checksum: 64385860 98ded86952a2c6714ceba76a4a98c35b sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1-dbg_1.0.1-4+lenny2_sparc.deb Size/MD5 checksum: 63621854 f0dd17453bc09fdc05c119faf2212d70 http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_1.0.1-4+lenny2_sparc.deb Size/MD5 checksum: 3499170 3f2084d6416459ce1416bd6f6f2845e3 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAksjbAYACgkQNxpp46476aqm7wCaAk6WARfBzzrdYYoxAUKA5weL V5YAmwRkz4XNwdcqnPzdeDzoakljqf1s =DBEQ -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe's position is "a PDF file is active content.". Safari is prone to a security bypass vulnerability. Safari is Apple Computer's bundled web browser