VARIoT IoT vulnerabilities database

Check Point Firewall-1 4.1 up to NG AI R55 allows remote attackers to obtain potentially sensitive information by sending an Internet Key Exchange (IKE) with a certain Vendor ID payload that causes Firewall-1 to return a response containing version and other information. This issue is due to a design error that may present sensitive information to an attacker. An attacker can leverage this issue to disclose information about the affected firewall product including the version number and various details about the firewall's capabilities. Furthermore this issue would facilitate fingerprinting or identifying a firewall by carrying out active scans. There are vulnerabilities in Check Point Firewall-1 version 4.1 up to NG AI R55

Cisco IOS 11.1(x) through 11.3(x) and 12.0(x) through 12.2(x), when configured for BGP routing, allows remote attackers to cause a denial of service (device reload) via malformed BGP (1) OPEN or (2) UPDATE messages. Multiple implementations of the Border Gateway Protocol (BGP) contain vulnerabilities related to the processing of UPDATE and OPEN messages. The impacts of these vulnerabilities appear to be limited to denial of service. During processing the offending packet the affected device will reset. It should be noted that this issue only affects devices with BGP enabled; BGP is not enabled by default. It has been reported that this issue would be very difficult to exploit as it would require injecting malicious packets into communication between trusted peers. An attacker may exploit this issue to cause the affected device to reset, taking several minutes to become functional. It is possible to create a persistent denial of service condition by continually transmitting malformed packets to the affected device. The vulnerability exists in Cisco IOS Releases 11.1(x) through 11.3(x) and 12.0(x) through 12.2(x)

Cisco CatOS 5.x before 5.5(20) through 8.x before 8.2(2) and 8.3(2)GLX, as used in Catalyst switches, allows remote attackers to cause a denial of service (system crash and reload) by sending invalid packets instead of the final ACK portion of the three-way handshake to the (1) Telnet, (2) HTTP, or (3) SSH services, aka "TCP-ACK DoS attack.". A vulnerability in Cisco CatOS may allow a remote attacker to cause a denial of service on an affected device. Cisco CatOS 5.x versions prior to 5.5(20) through 8.x versions prior to 8.2(2) and 8.3(2)GLX are vulnerable

The DNS proxy (DNSd) for multiple Symantec Gateway Security products allows remote attackers to poison the DNS cache via a malicious DNS server query response that contains authoritative or additional records. It is reported that dnsd is prone to a cache poisoning vulnerability. Dnsd does not ensure that the data returned from a remote DNS server contains related information about the requested records. An attacker could exploit this vulnerability to deny service to legitimate users by redirecting traffic to inappropriate hosts. Man-in-the-middle attacks, impersonation of sites, and other attacks may be possible. Symantec Enterprise Firewall is an enterprise-class firewall that includes DNSD proxy. Symantec Enterprise Firewall has issues with its implementation of DNSD, which could be exploited by remote attackers for man-in-the-middle, fake site, or various other attacks. An attacker can control the DNS server and return a malicious response, resulting in the insertion of a fake DNS entry in the target system, thereby attacking Attackers can carry out attacks such as man-in-the-middle attacks/denial of service/social engineering

Cross-site scripting (XSS) vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to inject arbitrary web script or HTML via the next_file parameter. The problem presents itself when an attacker passes malicious HTML or script code to the application via the 'next_file' parameter of the 'main.cgi' script. Linksys Web Camera software version 2.10 is reportedly prone to this issue, however, it is possible that other versions are affected as well

Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "crash.c" program. The Linux kernel contains a denial-of-service vulnerability that allows local users to disable affected hosts. Linux Kernel Stores the process state of the floating point unit / Used to restore FSAVE/FRSTOR There are deficiencies in the handling of instructions. This issue is due to a design error that causes the kernel to fail to properly handle floating-point exceptions. This issue may be leveraged by an attacker to cause the affected system to crash, denying service to legitimate users. Although only select Linux kernels are reported to be affected, it is likely that various other versions are vulnerable as well. These issues were found during a recent audit of the Linux kernel source. The following drivers are reportedly affected by these issues: aironet asus_acpi decnet mpu401 msnd pss These issues may reportedly allow attackers to access kernel memory or gain escalated privileges on the affected computer. Local attackers can exploit these vulnerabilities to elevate privileges or conduct denial-of-service attacks on the system. The affected device drivers are: aironet, asus_acpi, decnet, mpu401, msnd, and pss. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1069-1 security@debian.org http://www.debian.org/security/ Martin Schulze, Dann Frazier May 20th, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : kernel-source-2.4.18,kernel-image-2.4.18-1-alpha,kernel-image-2.4.18-1-i386,kernel-image-2.4.18-hppa,kernel-image-2.4.18-powerpc-xfs,kernel-patch-2.4.18-powerpc,kernel-patch-benh Vulnerability : several Problem-Type : local/remote Debian-specific: no CVE IDs : CVE-2004-0427 CVE-2005-0489 CVE-2004-0394 CVE-2004-0447 CVE-2004-0554 CVE-2004-0565 CVE-2004-0685 CVE-2005-0001 CVE-2004-0883 CVE-2004-0949 CVE-2004-1016 CVE-2004-1333 CVE-2004-0997 CVE-2004-1335 CVE-2004-1017 CVE-2005-0124 CVE-2005-0528 CVE-2003-0984 CVE-2004-1070 CVE-2004-1071 CVE-2004-1072 CVE-2004-1073 CVE-2004-1074 CVE-2004-0138 CVE-2004-1068 CVE-2004-1234 CVE-2005-0003 CVE-2004-1235 CVE-2005-0504 CVE-2005-0384 CVE-2005-0135 Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. CVE-2004-0394 A buffer overflow in the panic handling code has been found. CVE-2004-0565 An information leak in the context switch code has been found on the IA64 architecture. CVE-2004-0685 Unsafe use of copy_to_user in USB drivers may disclose sensitive information. CVE-2005-0001 A race condition in the i386 page fault handler may allow privilege escalation. CVE-2004-0883 Multiple vulnerabilities in the SMB filesystem code may allow denial of service of information disclosure. CVE-2004-0949 An information leak discovered in the SMB filesystem code. CVE-2004-0997 A local privilege escalation in the MIPS assembly code has been found. CVE-2004-1335 A memory leak in the ip_options_get() function may lead to denial of service. CVE-2004-1017 Multiple overflows exist in the io_edgeport driver which might be usable as a denial of service attack vector. CVE-2005-0124 Bryan Fulton reported a bounds checking bug in the coda_pioctl function which may allow local users to execute arbitrary code or trigger a denial of service attack. CVE-2005-0528 A local privilege escalation in the mremap function has been found CVE-2003-0984 Inproper initialization of the RTC may disclose information. CVE-2004-1070 Insufficient input sanitising in the load_elf_binary() function may lead to privilege escalation. CVE-2004-1071 Incorrect error handling in the binfmt_elf loader may lead to privilege escalation. CVE-2004-1072 A buffer overflow in the binfmt_elf loader may lead to privilege escalation or denial of service. CVE-2004-1073 The open_exec function may disclose information. CVE-2004-1074 The binfmt code is vulnerable to denial of service through malformed a.out binaries. CVE-2004-1068 A programming error in the unix_dgram_recvmsg() function may lead to privilege escalation. CVE-2004-1234 The ELF loader is vulnerable to denial of service through malformed binaries. CVE-2005-0003 Crafted ELF binaries may lead to privilege escalation, due to insufficient checking of overlapping memory regions. CVE-2004-1235 A race condition in the load_elf_library() and binfmt_aout() functions may allow privilege escalation. CVE-2005-0504 An integer overflow in the Moxa driver may lead to privilege escalation. The following matrix explains which kernel version for which architecture fix the problems mentioned above: Debian 3.0 (woody) Source 2.4.18-14.4 Alpha architecture 2.4.18-15woody1 Intel IA-32 architecture 2.4.18-13.2 HP Precision architecture 62.4 PowerPC architecture 2.4.18-1woody6 PowerPC architecture/XFS 20020329woody1 PowerPC architecture/benh 20020304woody1 Sun Sparc architecture 22woody1 We recommend that you upgrade your kernel package immediately and reboot the machine. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get dist-upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEb9YGXm3vHE4uyloRAkhXAJ0e1RmUxVZSbQICFa/j07oKPfWRVwCeMrhj wYGegwosZg6xi3oI77opLQY= =eu/T -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-sparc-2.4_26woody1.dsc Size/MD5 checksum: 692 27f44a0eec5837b0b01d26c6cff392be http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-sparc-2.4_26woody1.tar.gz Size/MD5 checksum: 27768 6c719a6343c9ea0dad44a736b3842504 http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody5.dsc Size/MD5 checksum: 792 d7c89c90fad77944ca1c5a18327f31dd http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody5.tar.gz Size/MD5 checksum: 1013866 21b4b677a7a319442c8fe8a4c72eb4c2 http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19-4.woody3.dsc Size/MD5 checksum: 672 4c353db091e8edc4395e46cf8d39ec42 http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19-4.woody3.diff.gz Size/MD5 checksum: 71071 7012adde9ba9a573e1be66f0d258721a http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19.orig.tar.gz Size/MD5 checksum: 32000211 237896fbb45ae652cc9c5cecc9b746da Architecture independent components: http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-headers-2.4.18-sparc_22woody1_all.deb Size/MD5 checksum: 1521850 75d23c7c54094b1d25d3b708fd644407 http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-headers-2.4.19-sparc_26woody1_all.deb Size/MD5 checksum: 1547874 c6881b25e3a5967e0f6f9c351fb88962 http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody5_all.deb Size/MD5 checksum: 1014564 0e89364c2816f5f4519256a8ea367ab6 http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-doc-2.4.19_2.4.19-4.woody3_all.deb Size/MD5 checksum: 1785490 c66cef9e87d9a89caeee02af31e3c96d http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19-4.woody3_all.deb Size/MD5 checksum: 25902158 321403201a198371fd55c9b8ac4583f7 Sun Sparc architecture: http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-2.4.18-sun4u_22woody1_sparc.deb Size/MD5 checksum: 3923058 db7bbd997410667bec4ac713d81d60ea http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-2.4.18-sun4u-smp_22woody1_sparc.deb Size/MD5 checksum: 4044796 106fcb86485531d96b4fdada61b71405 http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-2.4.19-sun4u_26woody1_sparc.deb Size/MD5 checksum: 3831424 347b0c290989f0cc99f3b336c156f61d http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-2.4.19-sun4u-smp_26woody1_sparc.deb Size/MD5 checksum: 3952220 f7dd8326c0ae0b0dee7c46e24023d0a2 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-headers-2.4.19_2.4.19-0.020911.1.woody5_mips.deb Size/MD5 checksum: 3890804 7348a8cd3961190aa2a19f562c96fe2f http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-image-2.4.19-r4k-ip22_2.4.19-0.020911.1.woody5_mips.deb Size/MD5 checksum: 2080618 d52d00e7097ae0c8f4ccb6f34656361d http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-image-2.4.19-r5k-ip22_2.4.19-0.020911.1.woody5_mips.deb Size/MD5 checksum: 2080830 db7141d3c0d86a43659176f974599cc2 http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/mips-tools_2.4.19-0.020911.1.woody5_mips.deb Size/MD5 checksum: 15816 c31e3b72d6eac6f3f99f75ea838e0bf9 These files will probably be moved into the stable distribution on its next update

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rlanguage, and hits parameters, or (4) savecomment function in the Reviews module, as demonstrated using the uname parameter. NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-1023. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the a parameter of the 'Reviews' module. As a result of this issue an attacker could modify the logic and structure of database queries. Finally a remote denial of service vulnerability is reported to exist in the score subsystem of the 'Review' module of PHP-Nuke, it is reported that a large number supplied as a value for a parameter passed to the 'Reviews' module will deny service to legitimate PHP-Nuke users

The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large, out-of-range score parameter. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the a parameter of the 'Reviews' module. As a result of this issue an attacker could modify the logic and structure of database queries. A vulnerability exists in the Reviews module of PHP-Nuke versions 6.0 to 7.3

The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the a parameter of the 'Reviews' module. As a result of this issue an attacker could modify the logic and structure of database queries. Finally a remote denial of service vulnerability is reported to exist in the score subsystem of the 'Review' module of PHP-Nuke, it is reported that a large number supplied as a value for a parameter passed to the 'Reviews' module will deny service to legitimate PHP-Nuke users

SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. As a result of this issue an attacker could modify the logic and structure of database queries. Finally a remote denial of service vulnerability is reported to exist in the score subsystem of the 'Review' module of PHP-Nuke, it is reported that a large number supplied as a value for a parameter passed to the 'Reviews' module will deny service to legitimate PHP-Nuke users

Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the a parameter of the 'Reviews' module. As a result of this issue an attacker could modify the logic and structure of database queries. Finally a remote denial of service vulnerability is reported to exist in the score subsystem of the 'Review' module of PHP-Nuke, it is reported that a large number supplied as a value for a parameter passed to the 'Reviews' module will deny service to legitimate PHP-Nuke users. The send_review function in the Reviews module of PHP-Nuke 6.0 to 7.3 has a Canonicalize-before-filter error vulnerability

It has been reported that Cisco CatOS is vulnerable to a denial of service attack. Improper initial TCP handshakes can cause affected devices to cease functioning and reboot. These improper connections can originate from spoofed source addresses, making it easier for an attacker to accomplish a denial of service attack. This vulnerability is only accessible if the device is running telnet, HTTP, or SSH services. IOS is not affected by this vulnerability.

Absolute path traversal vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to read arbitrary files via an absolute pathname in the next_file parameter. Linksys Web Camera software version 2.10 is reportedly prone to this issue, however, it is possible that other versions are affected as well. Linksys Web Camera has an input validation vulnerability when processing user requests. The main.cgi program of Linksys Web Camera lacks sufficient inspection and filtering for the \'\'next_file\'\' parameter submitted by the user. If the system file name is submitted as a parameter, the attacker can read the content of the corresponding file

LaunchServices in Mac OS X 10.3.4 and 10.2.8 automatically registers and executes new applications, which could allow attackers to execute arbitrary code without warning the user. apple's Apple Mac OS X and Apple Mac OS X Server Exists in unspecified vulnerabilities.None. A security update has been released to address these issues and provide other enhancements. The following issues were reported: LaunchServices is reported prone to a vulnerability where the LaunchServices utility automatically registers applications. It is reported that an attacker may exploit this issue to register and run malicious applications. DiskImageMounter is reported prone to a vulnerability where the disk:// URI handler may be used to mount an anonymous remote file system. This attack can be achieved using the HTTP protocol. A remote attacker may exploit this vulnerability to write to the local disk. Safari is reported prone to an unspecified vulnerability where the Safari "Show in Finder" button, when invoked, would attempt to execute certain files instead of revealing the files in the finder window. An attacker may potentially exploit this condition to automatically execute files on the file system (including downloaded files). This could lead to privilege escalation or remote compromise. Some of these issues may already be described in previous BIDs. This BID will be split up into unique BIDs when further analysis of this update is complete. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2004-06-07 Security Update 2004-06-07 Description Security Update 2004-06-07 delivers a number of security enhancements and is recommended for all Macintosh users. The purpose of this update is to increase security by alerting you when opening an application for the first time via document mappings or a web address (URL). Discussion: LaunchServices is a system component that discovers and opens applications. This system component has been modified to only open applications that have previously been explicitly run on the system. Attempts to run an application that has not previously been explicitly run will result in a user alert. Further information is available in http://docs.info.apple.com/article.html?artnum=25785 Component: DiskImageMounter CVE-ID: No CVE ID has been reserved as this is only an additional preventative measure. Component: Terminal CVE-ID: Not applicable Impact: Attempts to use a telnet:// URI with an alternate port number fail. Discussion: A modification has been made to allow the specification of an alternate port number in a telnet:// URI. This restores functionality that was removed with the recent fix for CAN-2004-0485. ================================================ Security Update 2004-06-07 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: For Mac OS X v10.3.4 "Panther" and Mac OS X Server v10.3.4 ========================================================== http://www.apple.com/support/downloads/ Click on: Security Update 2004-06-07 (10.3.4) The download file is named: "SecUpd2004-06-07Pan.dmg" Its SHA-1 digest is: 182745485d8db3ea29ec67cb603cc5668a4f60d9 For Mac OS X v10.2.8 "Jaguar" and Mac OS X Server v10.2.8 ========================================================= http://www.apple.com/support/downloads/ Click on: Security Update 2004-06-07 (10.2.8) The download file is named: "SecUpd2004-06-07Jag.dmg" Its SHA-1 digest is: e5fa73f6a67bdcd9af76927d3416974f039b2087 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBQMTXipyw5owIz4TQAQJabgf/XdzbpuwKuBbVYQAVUl8mZd+Bs7QVdF2x sVJiNlgjyObJjTd5sjqCP9695enrEhClliNM+qOtoUcj0ed4gKIWtOBDzPuuYSb8 xjgb0ntbOg8VOoI5FX5o8dWRAmJu7SXDbnKNvpTgPfFl0Gb2spgGsX5aINGLD8iS h5SerdpJYDEMvXyAl/7Mnfz0TYH8ThWStRiEkEeaucD6Uc1yBDhUl3uV/jjHjvcp AFbaI14R/UNEypI4z0ylpH0a5tLG4CKOTAOwt68Kcs3Undbqbp8FvIUqD2Iy6fXF EtdF329mjgcaa7iDYnt2BXPvkRvthla+98flmjD9okzhM69x2t0Ubg== =JdW9 -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored

The "Show in Finder" button in the Safari web browser in Mac OS X 10.3.4 and 10.2.8 may execute downloaded applications, which could allow remote attackers to execute arbitrary code. This could allow an attacker to execute arbitrary code. apple's Apple Mac OS X and Apple Mac OS X Server Exists in unspecified vulnerabilities.None. A security update has been released to address these issues and provide other enhancements. The following issues were reported: LaunchServices is reported prone to a vulnerability where the LaunchServices utility automatically registers applications. It is reported that an attacker may exploit this issue to register and run malicious applications. DiskImageMounter is reported prone to a vulnerability where the disk:// URI handler may be used to mount an anonymous remote file system. This attack can be achieved using the HTTP protocol. A remote attacker may exploit this vulnerability to write to the local disk. An attacker may potentially exploit this condition to automatically execute files on the file system (including downloaded files). This could lead to privilege escalation or remote compromise. Some of these issues may already be described in previous BIDs. This BID will be split up into unique BIDs when further analysis of this update is complete. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2004-06-07 Security Update 2004-06-07 Description Security Update 2004-06-07 delivers a number of security enhancements and is recommended for all Macintosh users. The purpose of this update is to increase security by alerting you when opening an application for the first time via document mappings or a web address (URL). For more details, including a description of the new alert dialog box, please see: http://docs.info.apple.com/article.html?artnum=25785 Versions: Security Update 2004-06-07 is available for the following system versions: * Mac OS X v10.3.4 "Panther" * Mac OS X Server v10.3.4 "Panther" * Mac OS X v10.2.8 "Jaguar" * Mac OS X Server v10.2.8 "Jaguar" The following components are updated: Component: LaunchServices CVE-ID: CAN-2004-0538 Impact: LaunchServices automatically registers applications, which could be used to cause the system to run unexpected applications. Discussion: LaunchServices is a system component that discovers and opens applications. This system component has been modified to only open applications that have previously been explicitly run on the system. Attempts to run an application that has not previously been explicitly run will result in a user alert. Further information is available in http://docs.info.apple.com/article.html?artnum=25785 Component: DiskImageMounter CVE-ID: No CVE ID has been reserved as this is only an additional preventative measure. Component: Terminal CVE-ID: Not applicable Impact: Attempts to use a telnet:// URI with an alternate port number fail. Discussion: A modification has been made to allow the specification of an alternate port number in a telnet:// URI. This restores functionality that was removed with the recent fix for CAN-2004-0485. ================================================ Security Update 2004-06-07 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: For Mac OS X v10.3.4 "Panther" and Mac OS X Server v10.3.4 ========================================================== http://www.apple.com/support/downloads/ Click on: Security Update 2004-06-07 (10.3.4) The download file is named: "SecUpd2004-06-07Pan.dmg" Its SHA-1 digest is: 182745485d8db3ea29ec67cb603cc5668a4f60d9 For Mac OS X v10.2.8 "Jaguar" and Mac OS X Server v10.2.8 ========================================================= http://www.apple.com/support/downloads/ Click on: Security Update 2004-06-07 (10.2.8) The download file is named: "SecUpd2004-06-07Jag.dmg" Its SHA-1 digest is: e5fa73f6a67bdcd9af76927d3416974f039b2087 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBQMTXipyw5owIz4TQAQJabgf/XdzbpuwKuBbVYQAVUl8mZd+Bs7QVdF2x sVJiNlgjyObJjTd5sjqCP9695enrEhClliNM+qOtoUcj0ed4gKIWtOBDzPuuYSb8 xjgb0ntbOg8VOoI5FX5o8dWRAmJu7SXDbnKNvpTgPfFl0Gb2spgGsX5aINGLD8iS h5SerdpJYDEMvXyAl/7Mnfz0TYH8ThWStRiEkEeaucD6Uc1yBDhUl3uV/jjHjvcp AFbaI14R/UNEypI4z0ylpH0a5tLG4CKOTAOwt68Kcs3Undbqbp8FvIUqD2Iy6fXF EtdF329mjgcaa7iDYnt2BXPvkRvthla+98flmjD9okzhM69x2t0Ubg== =JdW9 -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored

NetGear WG602 (aka WG602v1) Wireless Access Point firmware 1.04.0 and 1.5.67 has a hardcoded account of username "super" and password "5777364", which allows remote attackers to modify the configuration. Netgear WG602 reportedly contains a default administrative account. This issue can allow a remote attacker to gain administrative access to the device. Netgear WG602 access point with firmware version 1.04.0 is reportedly affected by this issue. It is likely that other versions of the firmware are also vulnerable. It is reported that the new version (1.7.14) of the Firmware for WG602 is vulnerable to this issue as well, however, the username and password for the backdoor account has been changed. Remote attackers can use this vulnerability to modify the configuration

NetGear WG602 (aka WG602v1) Wireless Access Point 1.7.14 has a hardcoded account of username "superman" and password "21241036", which allows remote attackers to modify the configuration. Netgear WG602 reportedly contains a default administrative account. This issue can allow a remote attacker to gain administrative access to the device. Netgear WG602 access point with firmware version 1.04.0 is reportedly affected by this issue. It is likely that other versions of the firmware are also vulnerable. It is reported that the new version (1.7.14) of the Firmware for WG602 is vulnerable to this issue as well, however, the username and password for the backdoor account has been changed

PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string. PHP-Nuke is affected by a direct script access security vulnerability. This issue is due to a failure to properly validate the location and name of the file being accessed. This issue will allow an attacker to gain access to sensitive scripts such as the 'admin.php' script. The attacker may be able to exploit this unauthorized access to carry out attacks against the affected application. PHP-Nuke is a popular website creation and management tool, it can use many database software as backend, such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc

The Web interface in Linksys WRT54G 2.02.7 and BEFSR41 version 3, with the firewall disabled, allows remote attackers to attempt to login to an administration web page, even when the configuration specifies that remote administration is disabled. Linksys WRT54G Router is a router device.  Even when the management function is turned off, Linksys WRT54G Router still provides 80 and 443 port management web pages on the WAN interface. As a result, an attacker can access the management interface. In combination with other loopholes, the router may be controlled. A weakness is reported to affect the Linksys WRT54G appliance

Unknown vulnerability in Mac OS X 10.3.4, related to "handling of process IDs during package installation," a different vulnerability than CVE-2004-0516. A vulnerability in Mac OS X may permit a local authenticated user with physical access to the machine to gain elevated privileges. apple's Apple Mac OS X and Apple Mac OS X Server Exists in unspecified vulnerabilities.None. Mac OS X 10.3.4 has been released to address these issues and provide other security enhancements