Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-200909-0477 CVE-2009-3247 vtiger CRM of Activities Module cross-site scripting vulnerability

Related entries in the VARIoT exploits database: VAR-E-200908-0598		 CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
Cross-site scripting (XSS) vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the query_string vector is already covered by CVE-2008-3101.3. vtiger CRM is prone to multiple input-validation vulnerabilities: - A remote PHP code-execution vulnerability - Multiple local file-include vulnerabilities - A cross-site scripting vulnerability - Multiple cross-site request-forgery vulnerabilities Attackers can exploit these issues to execute arbitrary script code within the context of the webserver, perform unauthorized actions, compromise the affected application, steal cookie-based authentication credentials, or obtain information that could aid in further attacks. The issues affect vtiger CRM 5.0.4; other versions may also be affected
VAR-200908-0433 CVE-2009-2474 neon In X.509 Any certificate processing SSL Vulnerability impersonating a server CVSS V2: 5.8
CVSS V3: -
Severity: MEDIUM
neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. This vulnerability CVE-2009-2408 And is related.A crafted certificate allows any man-in-the-middle attacker to SSL There is a possibility of impersonating a server. This issue affects Neon when compiled against OpenSSL. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks. Versions prior to Neon 0.28.6 are vulnerable. Additional applications that use the affected library may also be vulnerable. neon is an HTTP/1.1 and WebDAV client library with a C interface. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:221 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libneon0.27 Date : August 24, 2009 Affected: 2008.1, 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in libneon0.27: neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564 (CVE-2009-2473). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2473 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2474 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.1: 26729257d5b2255a8a6242cfe6931dc9 2008.1/i586/libneon0.27-0.28.3-0.2mdv2008.1.i586.rpm 992af0611f69a2e4043f29faf50de608 2008.1/i586/libneon0.27-devel-0.28.3-0.2mdv2008.1.i586.rpm 71e83652b0aa875f404ecf0df9409184 2008.1/i586/libneon0.27-static-devel-0.28.3-0.2mdv2008.1.i586.rpm a4b59dd8d54e66de85f70186c7726269 2008.1/SRPMS/libneon0.27-0.28.3-0.2mdv2008.1.src.rpm Mandriva Linux 2008.1/X86_64: 56eb9b74f3e2202ac683377a16799c70 2008.1/x86_64/lib64neon0.27-0.28.3-0.2mdv2008.1.x86_64.rpm f688d9a1285f19e7b80997b52a147a60 2008.1/x86_64/lib64neon0.27-devel-0.28.3-0.2mdv2008.1.x86_64.rpm 08f5058e8dc35470e8cdc8cf9cb16381 2008.1/x86_64/lib64neon0.27-static-devel-0.28.3-0.2mdv2008.1.x86_64.rpm a4b59dd8d54e66de85f70186c7726269 2008.1/SRPMS/libneon0.27-0.28.3-0.2mdv2008.1.src.rpm Mandriva Linux 2009.0: 9bf34661a2420bd2402cafc4565a2587 2009.0/i586/libneon0.27-0.28.3-1.1mdv2009.0.i586.rpm f6ed581464940115491ec68cacafe859 2009.0/i586/libneon0.27-devel-0.28.3-1.1mdv2009.0.i586.rpm db2dc25faa186ceb3394af63a9e2d0e6 2009.0/i586/libneon0.27-static-devel-0.28.3-1.1mdv2009.0.i586.rpm 14cbfad698a74067a74199807e8c9282 2009.0/SRPMS/libneon0.27-0.28.3-1.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 3a86cf10f1df3feaea91ae64e28f3e8d 2009.0/x86_64/lib64neon0.27-0.28.3-1.1mdv2009.0.x86_64.rpm 872195ee41e00405d03ab18010bd15d9 2009.0/x86_64/lib64neon0.27-devel-0.28.3-1.1mdv2009.0.x86_64.rpm f841222c663bc8506e6e0e87a165c6b7 2009.0/x86_64/lib64neon0.27-static-devel-0.28.3-1.1mdv2009.0.x86_64.rpm 14cbfad698a74067a74199807e8c9282 2009.0/SRPMS/libneon0.27-0.28.3-1.1mdv2009.0.src.rpm Mandriva Linux 2009.1: 14c6caacb5e2b3f9e0a2e7b7924ba1e3 2009.1/i586/libneon0.27-0.28.3-2.1mdv2009.1.i586.rpm 242e3182440acc212408d03d27ba9a08 2009.1/i586/libneon0.27-devel-0.28.3-2.1mdv2009.1.i586.rpm 71701b0c1b6931979cb6eabe377522aa 2009.1/i586/libneon0.27-static-devel-0.28.3-2.1mdv2009.1.i586.rpm 58bd3f3f6ac9178d9e4903fa88fd5862 2009.1/SRPMS/libneon0.27-0.28.3-2.1mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 5ac6a8cefa50849e32957b821ec1ef8c 2009.1/x86_64/lib64neon0.27-0.28.3-2.1mdv2009.1.x86_64.rpm 5b801b45bf9d73a59b7eb0a4b350431f 2009.1/x86_64/lib64neon0.27-devel-0.28.3-2.1mdv2009.1.x86_64.rpm 72e5bce2285b22ccd6b6f68c8c47bff8 2009.1/x86_64/lib64neon0.27-static-devel-0.28.3-2.1mdv2009.1.x86_64.rpm 58bd3f3f6ac9178d9e4903fa88fd5862 2009.1/SRPMS/libneon0.27-0.28.3-2.1mdv2009.1.src.rpm Corporate 4.0: 6c92c285d835d3d283c820bbe14fa013 corporate/4.0/i586/libneon0.27-0.28.3-0.2.20060mlcs4.i586.rpm ae72e53a686010d7b31e56bee90000e5 corporate/4.0/i586/libneon0.27-devel-0.28.3-0.2.20060mlcs4.i586.rpm 1814371725d85bb607af694a074fc816 corporate/4.0/i586/libneon0.27-static-devel-0.28.3-0.2.20060mlcs4.i586.rpm 617b5c9c0bf440531b571e34409023b3 corporate/4.0/SRPMS/libneon0.27-0.28.3-0.2.20060mlcs4.src.rpm Corporate 4.0/X86_64: 9db63260cab1c01d8f6e3882f719a8a6 corporate/4.0/x86_64/lib64neon0.27-0.28.3-0.2.20060mlcs4.x86_64.rpm 526df150c547d98fdeeda8241774bcbf corporate/4.0/x86_64/lib64neon0.27-devel-0.28.3-0.2.20060mlcs4.x86_64.rpm 02fa7448bb3a59c6f0947a2e96983813 corporate/4.0/x86_64/lib64neon0.27-static-devel-0.28.3-0.2.20060mlcs4.x86_64.rpm 617b5c9c0bf440531b571e34409023b3 corporate/4.0/SRPMS/libneon0.27-0.28.3-0.2.20060mlcs4.src.rpm Mandriva Enterprise Server 5: a2209a398a7f98673c5bd459dfa1fd58 mes5/i586/libneon0.27-0.28.3-1.1mdvmes5.i586.rpm 18631025bb665c21dcbd4ef75986dc2f mes5/i586/libneon0.27-devel-0.28.3-1.1mdvmes5.i586.rpm b216b56ea349e57db0bd1a06791c1192 mes5/i586/libneon0.27-static-devel-0.28.3-1.1mdvmes5.i586.rpm 2cd59a4c7297629446c6c0779363d6fd mes5/SRPMS/libneon0.27-0.28.3-1.1mdvmes5.src.rpm Mandriva Enterprise Server 5/X86_64: ee892ef74cca60e827899a0d9e06c8cd mes5/x86_64/lib64neon0.27-0.28.3-1.1mdvmes5.x86_64.rpm db0c1a9ab2315bf05dc35382349d4534 mes5/x86_64/lib64neon0.27-devel-0.28.3-1.1mdvmes5.x86_64.rpm 0c131d6264ef181e0b3870c8eb438b36 mes5/x86_64/lib64neon0.27-static-devel-0.28.3-1.1mdvmes5.x86_64.rpm 2cd59a4c7297629446c6c0779363d6fd mes5/SRPMS/libneon0.27-0.28.3-1.1mdvmes5.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFKkvLkmqjQ0CJFipgRAq6qAJ9cjtiGVrF46gPqCQlUYpyiTrM/uwCgm9Wp 0gkprOAZM9dbBhPRDNeWeEs= =E/sr -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . Packages for 2008.0 are being provided due to extended support for Corporate products. For more information: SA31508 SA36371 SOLUTION: Apply updated packages. -- Ubuntu 6.06 LTS -- Source archives: http://security.ubuntu.com/ubuntu/pool/main/n/neon/neon_0.25.5.dfsg-5ubuntu0.1.diff.gz Size/MD5: 21241 816587e0cf93ab4a4b83facb7768962f http://security.ubuntu.com/ubuntu/pool/main/n/neon/neon_0.25.5.dfsg-5ubuntu0.1.dsc Size/MD5: 789 883a571edfb6ca2f265b6cc830b92cec http://security.ubuntu.com/ubuntu/pool/main/n/neon/neon_0.25.5.dfsg.orig.tar.gz Size/MD5: 633438 32ed43bea8568f8f592266c6ff6acf0f amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dbg_0.25.5.dfsg-5ubuntu0.1_amd64.deb Size/MD5: 150072 8fe35489f1bf3c0d9dc029c737a3b400 http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dev_0.25.5.dfsg-5ubuntu0.1_amd64.deb Size/MD5: 139964 1fc960e8c8d23498f73651158c5fed88 http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25_0.25.5.dfsg-5ubuntu0.1_amd64.deb Size/MD5: 105972 718aab24299009494603f217d680343e i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dbg_0.25.5.dfsg-5ubuntu0.1_i386.deb Size/MD5: 129460 850a2dcae6650b6cd360d8fd5e260306 http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dev_0.25.5.dfsg-5ubuntu0.1_i386.deb Size/MD5: 127282 b29d4d5725a2b166a65317b39d927a2d http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25_0.25.5.dfsg-5ubuntu0.1_i386.deb Size/MD5: 98742 d925ff133a28cd973197e22b2e0d18e4 powerpc architecture (Apple Macintosh G3/G4/G5): http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dbg_0.25.5.dfsg-5ubuntu0.1_powerpc.deb Size/MD5: 149668 037f23da1f9566622a018632fe610c2d http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dev_0.25.5.dfsg-5ubuntu0.1_powerpc.deb Size/MD5: 139344 f1fe92c7c7f59ca0968a1bb87d585717 http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25_0.25.5.dfsg-5ubuntu0.1_powerpc.deb Size/MD5: 102650 38eff65b3cb36fdf18b1a9c508ebbd56 sparc architecture (Sun SPARC/UltraSPARC): http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dbg_0.25.5.dfsg-5ubuntu0.1_sparc.deb Size/MD5: 131338 e204e6cb89e1bf96d3367c3bbf1487c1 http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dev_0.25.5.dfsg-5ubuntu0.1_sparc.deb Size/MD5: 133516 213211b48418ed7388bb9235130efa9a http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25_0.25.5.dfsg-5ubuntu0.1_sparc.deb Size/MD5: 101588 3cb88debbc07258d7ee434b32262128e -- Ubuntu 8.04 LTS -- Source archives: http://security.ubuntu.com/ubuntu/pool/main/n/neon27/neon27_0.27.2-1ubuntu0.1.diff.gz Size/MD5: 20712 20939a5349b3b1d57c6ce3660e362f42 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/neon27_0.27.2-1ubuntu0.1.dsc Size/MD5: 939 a8ad0b6b6c520828fd7d00749897f26a http://security.ubuntu.com/ubuntu/pool/main/n/neon27/neon27_0.27.2.orig.tar.gz Size/MD5: 812750 24d434a4d5d4b6ce8f076039688f60ce amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.27.2-1ubuntu0.1_amd64.deb Size/MD5: 176652 ed7021e0f6b21df0851aab43e6c008d3 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.27.2-1ubuntu0.1_amd64.deb Size/MD5: 402820 9f302f4e9031233a43d49b636706e13f http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dbg_0.27.2-1ubuntu0.1_amd64.deb Size/MD5: 157874 ff25752134f938896a7b146169ddee49 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dev_0.27.2-1ubuntu0.1_amd64.deb Size/MD5: 376918 2615e14d72ec90aa8b42cf6ca0b379b2 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_0.27.2-1ubuntu0.1_amd64.deb Size/MD5: 108292 2539874993245e5a3e34fbc6ecf29fda http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.27.2-1ubuntu0.1_amd64.deb Size/MD5: 133262 70d032dcdcac2b62d0279504990f5d3e i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.27.2-1ubuntu0.1_i386.deb Size/MD5: 170324 916695eae648a04716d6decd5afd454e http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.27.2-1ubuntu0.1_i386.deb Size/MD5: 369116 6a079f855afcbf62debaec5b6d924d78 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dbg_0.27.2-1ubuntu0.1_i386.deb Size/MD5: 151426 654b963a71dcb4e96e4f37bf858a498f http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dev_0.27.2-1ubuntu0.1_i386.deb Size/MD5: 344216 42923c3cd16536839d33e91391afe58a http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_0.27.2-1ubuntu0.1_i386.deb Size/MD5: 103146 85cbd67c28eed802c146f49266986793 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.27.2-1ubuntu0.1_i386.deb Size/MD5: 127926 99fa358256515f29eab2057538cf3ee1 lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.27.2-1ubuntu0.1_lpia.deb Size/MD5: 172252 eab88350f2284d5f9d74f8788555fc81 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.27.2-1ubuntu0.1_lpia.deb Size/MD5: 371158 8e97b2cc49f5213f127848b9bf760324 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.27.2-1ubuntu0.1_lpia.deb Size/MD5: 153228 191f3882e96d175eb9f58df4db377cdd http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.27.2-1ubuntu0.1_lpia.deb Size/MD5: 345646 026e6d7570cfcd8452aabc1aa4e430c5 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.27.2-1ubuntu0.1_lpia.deb Size/MD5: 102114 96bc6e6b22ca0c87c4542d447ef87f6c http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.27.2-1ubuntu0.1_lpia.deb Size/MD5: 127030 4e55fd691c2349280efceb57448dba6a powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.27.2-1ubuntu0.1_powerpc.deb Size/MD5: 176704 c5cb99ca83490774d54ca181d537ead2 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.27.2-1ubuntu0.1_powerpc.deb Size/MD5: 421734 a1465902d5fce2a81631971b3e7158a7 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.27.2-1ubuntu0.1_powerpc.deb Size/MD5: 157946 a983b5baf576d1f065176ba12166cc19 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.27.2-1ubuntu0.1_powerpc.deb Size/MD5: 391658 4a9785df166703eb6fa7c8132a98a3b1 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.27.2-1ubuntu0.1_powerpc.deb Size/MD5: 110220 d885beccb5d7db7aace902b39ebd2cb5 http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.27.2-1ubuntu0.1_powerpc.deb Size/MD5: 134874 bdc0bd129db2bc565b514a86eff5aaef sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.27.2-1ubuntu0.1_sparc.deb Size/MD5: 162998 ff3ed6431bffadfc57c3f8a9d4cac74e http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.27.2-1ubuntu0.1_sparc.deb Size/MD5: 371204 fced2fe9f2cc105203c9fe518408c12c http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.27.2-1ubuntu0.1_sparc.deb Size/MD5: 144480 5d79c57d41605ab64dd46500e42e0843 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.27.2-1ubuntu0.1_sparc.deb Size/MD5: 343442 94b1d72e42b52c2164168f8d377773e8 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.27.2-1ubuntu0.1_sparc.deb Size/MD5: 103374 8c77263ab7d6181405005208022a1b06 http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.27.2-1ubuntu0.1_sparc.deb Size/MD5: 128486 e272c8dddd67ce4d87afbd4c90fedffa -- Ubuntu 8.10 -- Source archives: http://security.ubuntu.com/ubuntu/pool/main/n/neon27/neon27_0.28.2-2ubuntu0.1.diff.gz Size/MD5: 23815 6f6b1e6ada9a523896127613b1f2a217 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/neon27_0.28.2-2ubuntu0.1.dsc Size/MD5: 1379 7ea5e427b97085cc7511afcdcedf857d http://security.ubuntu.com/ubuntu/pool/main/n/neon27/neon27_0.28.2.orig.tar.gz Size/MD5: 797944 b99b3f44e8507ae2d17362f1b34aaf02 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.28.2-2ubuntu0.1_amd64.deb Size/MD5: 191520 f6ab3ecad18b6cd3d05e2751ffa7a5a9 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.28.2-2ubuntu0.1_amd64.deb Size/MD5: 428176 5830845f7612a0dba4efbe2a8021e4c4 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-2ubuntu0.1_amd64.deb Size/MD5: 172890 97942efd1db0a758e97bcdf37f0d8f76 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-2ubuntu0.1_amd64.deb Size/MD5: 402762 892c4c6fb330a202e7c3bb6202bb0a02 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_0.28.2-2ubuntu0.1_amd64.deb Size/MD5: 119264 d313c4dc3a6b379fbe4e2f973b5947e6 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.28.2-2ubuntu0.1_amd64.deb Size/MD5: 144902 7d580f2550b264fada435ec7597a5742 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.28.2-2ubuntu0.1_i386.deb Size/MD5: 184370 3d50415bf133d4dfe276dfc03e71e020 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.28.2-2ubuntu0.1_i386.deb Size/MD5: 393130 29bd3b6e83c131e6900c031805ba34fa http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-2ubuntu0.1_i386.deb Size/MD5: 166050 f65eddb05aa5d975a7e122c84d7b7845 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-2ubuntu0.1_i386.deb Size/MD5: 368212 eb7020e74a0311d2104976e1772b641a http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_0.28.2-2ubuntu0.1_i386.deb Size/MD5: 114122 035e3b754e87e0cf46a8ec136caaa026 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.28.2-2ubuntu0.1_i386.deb Size/MD5: 139584 cfc9ceb5dcc52610fde529ffe5604da7 lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-2ubuntu0.1_lpia.deb Size/MD5: 185900 17a1d4d1f1ab9708aa18e034fb7b29e1 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-2ubuntu0.1_lpia.deb Size/MD5: 394742 24f17a926e8a8c17b0273dab1c24a70e http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-2ubuntu0.1_lpia.deb Size/MD5: 167492 2c73ae4810ba0742f849803620595c74 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-2ubuntu0.1_lpia.deb Size/MD5: 370226 f7ff770cfcfd9a624db80a2c8100e436 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-2ubuntu0.1_lpia.deb Size/MD5: 113006 4e7446c38f409381e44fa3348d9cf16d http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-2ubuntu0.1_lpia.deb Size/MD5: 138624 a2de6a9c1ec02a3970f01052caccef64 powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-2ubuntu0.1_powerpc.deb Size/MD5: 191006 d2ae675e1836a76db2974ca4bb10a6d2 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-2ubuntu0.1_powerpc.deb Size/MD5: 445778 75977229ba9371115dd80bd77b078230 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-2ubuntu0.1_powerpc.deb Size/MD5: 173002 265636356f24a9fea8be60ca92938b37 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-2ubuntu0.1_powerpc.deb Size/MD5: 415936 5f87a783c030a936ce9535a06f627785 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-2ubuntu0.1_powerpc.deb Size/MD5: 120452 c543de922280e517454db6bdef402cde http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-2ubuntu0.1_powerpc.deb Size/MD5: 145836 cc66be766fd9275d137edd4ec11ed625 sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-2ubuntu0.1_sparc.deb Size/MD5: 175622 3ba09f3066863bdf0520c2a8f8eb45ac http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-2ubuntu0.1_sparc.deb Size/MD5: 392552 359ede258a11a7d17457e24a98986775 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-2ubuntu0.1_sparc.deb Size/MD5: 156452 0ffb01d9c0bbfe97fe114af0d331fd3e http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-2ubuntu0.1_sparc.deb Size/MD5: 365460 79920f83cac355effe18b7bdc872c634 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-2ubuntu0.1_sparc.deb Size/MD5: 113430 f603e40fb8ec979f617a3d45b4bf5ce0 http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-2ubuntu0.1_sparc.deb Size/MD5: 139032 0ec4017b6acb3ef39f2a6f6d2447844b -- Ubuntu 9.04 -- Source archives: http://security.ubuntu.com/ubuntu/pool/main/n/neon27/neon27_0.28.2-6.1ubuntu0.1.diff.gz Size/MD5: 24132 da9be21a19b61748eda43f41a1aca91c http://security.ubuntu.com/ubuntu/pool/main/n/neon27/neon27_0.28.2-6.1ubuntu0.1.dsc Size/MD5: 1411 bae9926bff7220064db056ba7ce726f9 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/neon27_0.28.2.orig.tar.gz Size/MD5: 797944 b99b3f44e8507ae2d17362f1b34aaf02 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon25-dev_0.28.2-6.1ubuntu0.1_amd64.deb Size/MD5: 51354 8617736f3540ceb2c7fdd1b2a54d3dda http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.28.2-6.1ubuntu0.1_amd64.deb Size/MD5: 191964 1dd150f8babcfce047b839607bcac0f7 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.28.2-6.1ubuntu0.1_amd64.deb Size/MD5: 428610 00f874c335002728e868f365db185b04 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_amd64.deb Size/MD5: 173350 71cfa13feebdde24f2332a5bd0e73c0c http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_amd64.deb Size/MD5: 403366 a4e0c48c548fef1014e604e59c15b027 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_0.28.2-6.1ubuntu0.1_amd64.deb Size/MD5: 119684 52876e4cecf3b1ec6d8192eea3da2778 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.28.2-6.1ubuntu0.1_amd64.deb Size/MD5: 145328 3b6f9fe274456465097f4f41ac265e13 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon25-dev_0.28.2-6.1ubuntu0.1_i386.deb Size/MD5: 51354 93dde95d793a6ce061cb3af2db75a271 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.28.2-6.1ubuntu0.1_i386.deb Size/MD5: 184882 8000f55c371f25d1ee87f91f9ca7f364 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.28.2-6.1ubuntu0.1_i386.deb Size/MD5: 393574 b5ed91f1b2cc9306b482cd936cc5c78c http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_i386.deb Size/MD5: 166604 b21c479d09f7e88e0510c12190d87296 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_i386.deb Size/MD5: 368756 ee65f90a0496ed8128526a338ffd7fe7 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_0.28.2-6.1ubuntu0.1_i386.deb Size/MD5: 114522 96bc36544b43d5e65727725e85b75ff0 http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.28.2-6.1ubuntu0.1_i386.deb Size/MD5: 140030 267bdfbc9b9784baf73857798a99967d lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/n/neon27/libneon25-dev_0.28.2-6.1ubuntu0.1_lpia.deb Size/MD5: 51352 97c0f618e1a8da22999f9904f78c573d http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-6.1ubuntu0.1_lpia.deb Size/MD5: 186410 5e20424a69ce45d3a66db001e5efb2dc http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-6.1ubuntu0.1_lpia.deb Size/MD5: 395242 372ebcd1dd210f2d5c136e9129b08ace http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_lpia.deb Size/MD5: 168082 cbe9aede94ebf50f2ba0ff571429efc8 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_lpia.deb Size/MD5: 370768 b9f57bf4900fa9ffe18a07fd71da3b8a http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-6.1ubuntu0.1_lpia.deb Size/MD5: 113406 1846871ab639b8a0bc919a65c1d09e6e http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-6.1ubuntu0.1_lpia.deb Size/MD5: 139088 66b63223d36d97786e6174173d267dcb powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/n/neon27/libneon25-dev_0.28.2-6.1ubuntu0.1_powerpc.deb Size/MD5: 51354 07ee535da3df9885366f770800bd6598 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-6.1ubuntu0.1_powerpc.deb Size/MD5: 191494 e7843d2987691be6246d6d1041dc4ca6 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-6.1ubuntu0.1_powerpc.deb Size/MD5: 446240 b47ea0b823d1118a71591e83cbe0eb48 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_powerpc.deb Size/MD5: 173578 a295423d33a38e5420988e1dac86e9b4 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_powerpc.deb Size/MD5: 416384 5ea6c1bdb3c729500216f4deedad8dfc http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-6.1ubuntu0.1_powerpc.deb Size/MD5: 120876 68ec1ef141c84bcad4ac4f84c547db17 http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-6.1ubuntu0.1_powerpc.deb Size/MD5: 146292 0984c79035eb76183dc9be0b79cbd721 sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/n/neon27/libneon25-dev_0.28.2-6.1ubuntu0.1_sparc.deb Size/MD5: 51354 2024b1b2d5b26aef5fb0572e2daa8359 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-6.1ubuntu0.1_sparc.deb Size/MD5: 176196 4913aebd8db013e216c5e15fa4484ea9 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-6.1ubuntu0.1_sparc.deb Size/MD5: 393056 318c10bfa9e933e6b899608b48e1f8ce http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_sparc.deb Size/MD5: 156960 a3f9117577059313afe62e30ae9ca3d4 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_sparc.deb Size/MD5: 365968 45a35f598143a009cd432e1c5f146f36 http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-6.1ubuntu0.1_sparc.deb Size/MD5: 113806 ed7d45494f5bc5749abef18218b5c697 http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-6.1ubuntu0.1_sparc.deb Size/MD5: 139408 a5248c13c20456a323f932f8cd32b04c ORIGINAL ADVISORY: http://www.ubuntu.com/usn/usn-835-1 OTHER REFERENCES: SA31508: http://secunia.com/advisories/31508/ SA36371: http://secunia.com/advisories/36371/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. =========================================================== Ubuntu Security Notice USN-835-1 September 21, 2009 neon, neon27 vulnerabilities CVE-2008-3746, CVE-2009-2474 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 8.10 Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: libneon25 0.25.5.dfsg-5ubuntu0.1 Ubuntu 8.04 LTS: libneon27 0.27.2-1ubuntu0.1 libneon27-gnutls 0.27.2-1ubuntu0.1 Ubuntu 8.10: libneon27 0.28.2-2ubuntu0.1 libneon27-gnutls 0.28.2-2ubuntu0.1 Ubuntu 9.04: libneon27 0.28.2-6.1ubuntu0.1 libneon27-gnutls 0.28.2-6.1ubuntu0.1 In general, a standard system upgrade is sufficient to effect the necessary changes. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: neon Denial of Service and Spoofing Vulnerabilities SECUNIA ADVISORY ID: SA36371 VERIFY ADVISORY: http://secunia.com/advisories/36371/ DESCRIPTION: Two vulnerabilities have been reported in neon, which can be exploited by malicious people to conduct spoofing attacks or cause a DoS (Denial of Service). 1) An error when expanding XML entities can be exploited to consume large amounts of memory and cause a crash or hang via a specially crafted XML document. Successful exploitation of this vulnerability requires that the expat library is used. 2) An error when processing SSL certificates containing NULL characters embedded in certain certificate fields and can be exploited to spoof certificates for legitimate domains. This is related to vulnerability #2 in: SA36093 The vulnerabilities are reported in versions prior to 0.28.6. SOLUTION: Update to version 0.28.6. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://lists.manyfish.co.uk/pipermail/neon/2009-August/001044.html http://lists.manyfish.co.uk/pipermail/neon/2009-August/001045.html http://lists.manyfish.co.uk/pipermail/neon/2009-August/001046.html OTHER REFERENCES: SA36093: http://secunia.com/advisories/36093/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0363 CVE-2009-2932 SAP NetWeaver Application Server of UDDI Client cross-site scripting vulnerability CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field. SAP NetWeaver Application Server is prone to an HTML-injection vulnerability because the application's UDDI client fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. This issue is documented by SAP Note 1322098. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: SAP NetWeaver Application Server UDDI Client Cross-Site Scripting SECUNIA ADVISORY ID: SA36228 VERIFY ADVISORY: http://secunia.com/advisories/36228/ DESCRIPTION: A vulnerability has been reported in SAP NetWeaver, which can be exploited by malicious people to conduct cross-site scripting attacks. The vulnerability is reported in SAP NetWeaver Application Server Java version 7.0. Other versions may also be affected. SOLUTION: Apply vendor patch (please see SAP note 1322098). https://service.sap.com/sap/support/notes/1322098 PROVIDED AND/OR DISCOVERED BY: Alexander Polyakov, Digital Security Research Group [DSecRG] ORIGINAL ADVISORY: http://www.dsecrg.com/pages/vul/show.php?id=133 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0534 No CVE 2Wire Router Malicious Request Password Reset Vulnerability CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
2Wire HomePortal and OfficePortal are both small router devices from 2Wire. The 2Wire web interface does not properly validate the page=CD35_SETUP_01 request parameter submitted by the user to the xslt script. If the remote attacker submits a very long password1 parameter of more than 512 characters, the password can be reset and the new password will be prompted the next time you log in to the router. Multiple 2Wire routers are prone to an access-validation vulnerability because they fail to adequately authenticate users before performing certain actions. Unauthenticated attackers can leverage this issue to change the router's administrative password. Successful attacks will completely compromise affected devices. 2Wire routers prior to Firmware version 5.29.135.5 are vulnerable
VAR-200908-0266 CVE-2009-2200 Apple Safari of WebKit Vulnerability in which important information is obtained CVSS V2: 7.1
CVSS V3: -
Severity: HIGH
WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document. WebKit is prone to a remote information-disclosure vulnerability. An attacker can exploit this issue to obtain sensitive information that may aid in further attacks. Apple Safari is a WEB browser. A remote information disclosure vulnerability exists in the URL policies of Apple Safari WebKit. ---------------------------------------------------------------------- Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). Request a free trial: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: SUSE update for Multiple Packages SECUNIA ADVISORY ID: SA43068 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/43068/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=43068 RELEASE DATE: 2011-01-25 DISCUSS ADVISORY: http://secunia.com/advisories/43068/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/43068/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=43068 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: SUSE has issued an update for multiple packages, which fixes multiple vulnerabilities. For more information: SA32349 SA33495 SA35095 SA35379 SA35411 SA35449 SA35758 SA36269 SA36677 SA37273 SA37346 SA37769 SA38061 SA38545 SA38932 SA39029 SA39091 SA39384 SA39661 SA39937 SA40002 SA40072 SA40105 SA40112 SA40148 SA40196 SA40257 SA40664 SA40783 SA41014 SA41085 SA41242 SA41328 SA41390 SA41443 SA41535 SA41841 SA41888 SA41968 SA42151 SA42264 SA42290 SA42312 SA42443 SA42461 SA42658 SA42769 SA42886 SA42956 SA43053 SOLUTION: Apply updated packages via YaST Online Update or the SUSE FTP server. ORIGINAL ADVISORY: SUSE-SR:2011:002: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0263 CVE-2009-2196 Apple Safari In Top Sites Any Web Vulnerabilities that display sites CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors. An attacker may exploit this issue to promote arbitrary sites into the Top Site views through automated actions. Successful exploits will lead to other attacks. Versions prior to Apple Safari 4.0.3 are vulnerable
VAR-200908-0262 CVE-2009-2195 Apple Safari of WebKit Vulnerable to buffer overflow CVSS V2: 9.3
CVSS V3: -
Severity: HIGH
Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted floating-point numbers. WebKit is prone to a remote buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition. Versions prior to Apple Safari 4.0.3 are vulnerable; other applications using WebKit may also be affected. Apple Safari is a WEB browser. ---------------------------------------------------------------------- Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). Request a free trial: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: SUSE update for Multiple Packages SECUNIA ADVISORY ID: SA43068 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/43068/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=43068 RELEASE DATE: 2011-01-25 DISCUSS ADVISORY: http://secunia.com/advisories/43068/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/43068/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=43068 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: SUSE has issued an update for multiple packages, which fixes multiple vulnerabilities. For more information: SA32349 SA33495 SA35095 SA35379 SA35411 SA35449 SA35758 SA36269 SA36677 SA37273 SA37346 SA37769 SA38061 SA38545 SA38932 SA39029 SA39091 SA39384 SA39661 SA39937 SA40002 SA40072 SA40105 SA40112 SA40148 SA40196 SA40257 SA40664 SA40783 SA41014 SA41085 SA41242 SA41328 SA41390 SA41443 SA41535 SA41841 SA41888 SA41968 SA42151 SA42264 SA42290 SA42312 SA42443 SA42461 SA42658 SA42769 SA42886 SA42956 SA43053 SOLUTION: Apply updated packages via YaST Online Update or the SUSE FTP server. ORIGINAL ADVISORY: SUSE-SR:2011:002: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0265 CVE-2009-2199 Apple Safari of WebKit In URL Domain name spoofing vulnerability CVSS V2: 5.8
CVSS V3: -
Severity: MEDIUM
Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified homoglyphs. Apple Safari of WebKit Is URL There are vulnerabilities that make it easier to phishing attacks by spoofing the domain name inside.To a third party URL The domain name inside may be phishing attacks. WebKit is affected by a URI-spoofing vulnerability because it fails to adequately handle specific characters in international domain name (IDN) domains. An attacker may leverage this issue to spoof the source URI of a site presented to an unsuspecting user. This may lead to a false sense of trust because the user may be presented with a source URI of a trusted site while interacting with the attacker's malicious site. Versions prior to Apple Safari 4.0.3 are vulnerable; other applications using WebKit may also be affected. Apple Safari is a WEB browser. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Apple iPhone / iPod touch Multiple Vulnerabilities SECUNIA ADVISORY ID: SA36677 VERIFY ADVISORY: http://secunia.com/advisories/36677/ DESCRIPTION: Some vulnerabilities, security issues, and weaknesses have been reported in Apple iPhone and iPod touch, which can be exploited by malicious people with physical access to the device to bypass certain security restrictions or disclose sensitive information, and by malicious people to disclose sensitive information, conduct cross-site scripting and spoofing attacks, cause a DoS (Denial of Service), or to compromise a user's system. 1) An error in CoreAudio when processing sample size table entries of AAC and MP3 files can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 2) An error in Exchange Support exists due to the "Require Passcode" setting not being affected by the "Maximum inactivity time lock" setting. This may lead to a time window, regardless of the Maximum inactivity time lock" setting, in which a person with physical access to the device is able to use the Exchange services. 3) A security issue exists in MobileMail due to deleted mails being accessible via Spotlight search. This can be exploited by malicious people with physical access to the device to disclose potentially sensitive information. 4) An unspecified error exists in the Recovery Mode command parsing. This can be exploited by a person with physical access to a device to cause a heap-based buffer overflow and e.g. gain access to a locked device. 5) A NULL pointer dereference error within the handling of SMS arrival notifications can be exploited to cause a service interruption. 6) An error in the handling of passwords in UIKit can be exploited by a person with physical access to a device to disclose a password. 7) Safari includes the user name and password in the "Referer" header, which can lead to the exposure of sensitive information. 8) Two vulnerabilities in WebKit can be exploited by malicious people to conduct cross-site scripting attacks or potentially compromise a user's system. For more information: SA35758 9) A vulnerability in WebKit can be exploited by malicious people to conduct spoofing attacks. For more information see vulnerability #6 in: SA36269 SOLUTION: Update to iPhone OS 3.1 or iPhone OS for iPod touch 3.1.1 (downloadable and installable via iTunes). PROVIDED AND/OR DISCOVERED BY: 1) Tobias Klein, trapkit.de The vendor credits: 2) Allan Steven, Robert Duran, Jeff Beckham of PepsiCo, Joshua Levitsky, Michael Breton of Intel Corporation, Mike Karban of Edward Jones, and Steve Moriarty of Agilent Technologies 3) Clickwise Software and Tony Kavadias 5) Charlie Miller of Independent Security Evaluators and Collin Mulliner of Technical University Berlin 6) Abraham Vegh 7) James A. T. Rice of Jump Networks Ltd ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3860 Tobias Klein: http://trapkit.de/advisories/TKADV2009-007.txt OTHER REFERENCES: SA35758: http://secunia.com/advisories/35758/ SA36269: http://secunia.com/advisories/36269/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . ---------------------------------------------------------------------- Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). Request a free trial: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: SUSE update for Multiple Packages SECUNIA ADVISORY ID: SA43068 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/43068/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=43068 RELEASE DATE: 2011-01-25 DISCUSS ADVISORY: http://secunia.com/advisories/43068/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/43068/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=43068 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: SUSE has issued an update for multiple packages, which fixes multiple vulnerabilities. For more information: SA32349 SA33495 SA35095 SA35379 SA35411 SA35449 SA35758 SA36269 SA36677 SA37273 SA37346 SA37769 SA38061 SA38545 SA38932 SA39029 SA39091 SA39384 SA39661 SA39937 SA40002 SA40072 SA40105 SA40112 SA40148 SA40196 SA40257 SA40664 SA40783 SA41014 SA41085 SA41242 SA41328 SA41390 SA41443 SA41535 SA41841 SA41888 SA41968 SA42151 SA42264 SA42290 SA42312 SA42443 SA42461 SA42658 SA42769 SA42886 SA42956 SA43053 SOLUTION: Apply updated packages via YaST Online Update or the SUSE FTP server
VAR-200908-0708 CVE-2009-2412 APR Library and APR-util Integer overflow vulnerability in the library CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information. Apache APR (Apache Portable Runtime) and 'APR-util' are prone to multiple integer-overflow vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of an application that uses the affected library. Successful exploits will compromise the affected application and possibly the computer. Failed attacks will cause denial-of-service conditions. This update provides fixes for these vulnerabilities. Update: apr-util packages were missing for Mandriva Enterprise Server 5 i586, this has been adressed with this update. (CVE-2009-0023). The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564 (CVE-2009-1955). Packages for 2008.0 are being provided due to extended support for Corporate products. The updated packages have been patched to prevent this. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2412 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0023 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1955 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1956 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.0: d55d5dd456de0c7977f93bff217406d7 2008.0/i586/apr-util-dbd-mysql-1.2.10-1.1mdv2008.0.i586.rpm bd02eb2233dcc07aadd7e5eb84df9ce8 2008.0/i586/apr-util-dbd-pgsql-1.2.10-1.1mdv2008.0.i586.rpm 334e127fb8ac03379c8a5f2ee7c144b6 2008.0/i586/apr-util-dbd-sqlite3-1.2.10-1.1mdv2008.0.i586.rpm 4307983fb3d21ab0f9955711e116f92e 2008.0/i586/libapr1-1.2.11-1.1mdv2008.0.i586.rpm ff24f1e1587f2210346ea134d4a2053e 2008.0/i586/libapr-devel-1.2.11-1.1mdv2008.0.i586.rpm 3d50a85109e011ced9e36f1565e9bc69 2008.0/i586/libapr-util1-1.2.10-1.1mdv2008.0.i586.rpm b786e2329fc63d459b841bf001261543 2008.0/i586/libapr-util-devel-1.2.10-1.1mdv2008.0.i586.rpm 6ef7669ea3d0db3dbaed35f35ae2dbdc 2008.0/SRPMS/apr-1.2.11-1.1mdv2008.0.src.rpm 1a923fc9c2f912ef339b942a59bff4e6 2008.0/SRPMS/apr-util-1.2.10-1.1mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 91588bbcf3940cd106b0fe458be6d4b9 2008.0/x86_64/apr-util-dbd-mysql-1.2.10-1.1mdv2008.0.x86_64.rpm b71d8b14cc536cf8a2448b353d2b4047 2008.0/x86_64/apr-util-dbd-pgsql-1.2.10-1.1mdv2008.0.x86_64.rpm 10b889bb625dbae01711ed7e8e101744 2008.0/x86_64/apr-util-dbd-sqlite3-1.2.10-1.1mdv2008.0.x86_64.rpm 068334fc392c68f9b29e629dd3776f83 2008.0/x86_64/lib64apr1-1.2.11-1.1mdv2008.0.x86_64.rpm a9ed011d8b421e8604e66a87a4972477 2008.0/x86_64/lib64apr-devel-1.2.11-1.1mdv2008.0.x86_64.rpm c08da53c4c88464249f46c6577f3c2a8 2008.0/x86_64/lib64apr-util1-1.2.10-1.1mdv2008.0.x86_64.rpm 4b1b86a3e07f4b87a1a53f0dbaaa3aff 2008.0/x86_64/lib64apr-util-devel-1.2.10-1.1mdv2008.0.x86_64.rpm 6ef7669ea3d0db3dbaed35f35ae2dbdc 2008.0/SRPMS/apr-1.2.11-1.1mdv2008.0.src.rpm 1a923fc9c2f912ef339b942a59bff4e6 2008.0/SRPMS/apr-util-1.2.10-1.1mdv2008.0.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFLGEWRmqjQ0CJFipgRAsWiAJ9LbNZNAkUIxWbq84aERpTacFEJPACg0xgy wuYdtSQeV/bOOP7w17qo2V0= =V8dA -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . Subversion clients and servers, versions 1.6.0 - 1.6.3 and all versions < 1.5.7, are vulnerable to several heap overflow problems which may lead to remote code execution. The official advisory (mirrored at http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt) follows: Subversion clients and servers up to 1.6.3 (inclusive) have heap overflow issues in the parsing of binary deltas. Summary: ======== Subversion clients and servers have multiple heap overflow issues in the parsing of binary deltas. This is related to an allocation vulnerability in the APR library used by Subversion. Clients with commit access to a vulnerable server can cause a remote heap overflow; servers can cause a heap overflow on vulnerable clients that try to do a checkout or update. This can lead to a DoS (an exploit has been tested) and to arbitrary code execution (no exploit tested, but the possibility is clear). Known vulnerable: ================= Subversion clients and servers <= 1.5.6. Subversion clients and servers 1.6.0 through 1.6.3 (inclusive). Known fixed: ============ Subversion 1.6.4 Subversion 1.5.7 (Search for "Patch" below to see the patches from 1.6.3 -> 1.6.4 and 1.5.6 -> 1.5.7. Search for "Recommendations" to get URLs for the 1.6.4 release and associated APR library patch.) Details: ======== The libsvn_delta library does not contain sufficient input validation of svndiff streams. If a stream with large windows is processed, one of several integer overflows may lead to some boundary checks incorrectly passing, which in turn can lead to a heap overflow. Severity: ========= A remote attacker with commit access to repository may be able to execute code on a Subversion server. A malicious server may be able to execute code on a Subversion client. Recommendations: ================ We recommend all users to upgrade to Subversion 1.6.4. We recommend all users to upgrade to the latest versions of APR and APR-UTIL, or apply the CVE-2009-2412 patch appropriate to their APR installation from <http://www.apache.org/dist/apr/patches/>. New Subversion packages can be found at: http://subversion.tigris.org/project_packages.html References: =========== CVE-2009-2411 (Subversion) CVE-2009-2412 (APR) Reported by: ============ Matt Lewis, Google. Patches: ======== This patch applies to Subversion 1.6.x (apply with patch -p0 < patchfile): [[[ Index: subversion/libsvn_delta/svndiff.c =================================================================== --- subversion/libsvn_delta/svndiff.c (revision 38519) +++ subversion/libsvn_delta/svndiff.c (working copy) @@ -60,10 +60,23 @@ struct encoder_baton { apr_pool_t *pool; }; +/* This is at least as big as the largest size of an integer that + encode_int can generate; it is sufficient for creating buffers for + it to write into. This assumes that integers are at most 64 bits, + and so 10 bytes (with 7 bits of information each) are sufficient to + represent them. */ +#define MAX_ENCODED_INT_LEN 10 +/* This is at least as big as the largest size for a single instruction. */ +#define MAX_INSTRUCTION_LEN (2*MAX_ENCODED_INT_LEN+1) +/* This is at least as big as the largest possible instructions + section: in theory, the instructions could be SVN_DELTA_WINDOW_SIZE + 1-byte copy-from-source instructions (though this is very unlikely). */ +#define MAX_INSTRUCTION_SECTION_LEN (SVN_DELTA_WINDOW_SIZE*MAX_INSTRUCTION_LEN) /* Encode VAL into the buffer P using the variable-length svndiff integer format. Return the incremented value of P after the - encoded bytes have been written. + encoded bytes have been written. P must point to a buffer of size + at least MAX_ENCODED_INT_LEN. This encoding uses the high bit of each byte as a continuation bit and the other seven bits as data bits. High-order data bits are @@ -85,7 +98,7 @@ encode_int(char *p, svn_filesize_t val) svn_filesize_t v; unsigned char cont; - assert(val >= 0); + SVN_ERR_ASSERT_NO_RETURN(val >= 0); /* Figure out how many bytes we'll need. */ v = val >> 7; @@ -96,6 +109,8 @@ encode_int(char *p, svn_filesize_t val) n++; } + SVN_ERR_ASSERT_NO_RETURN(n <= MAX_ENCODED_INT_LEN); + /* Encode the remaining bytes; n is always the number of bytes coming after the one we're encoding. */ while (--n >= 0) @@ -112,7 +127,7 @@ encode_int(char *p, svn_filesize_t val) static void append_encoded_int(svn_stringbuf_t *header, svn_filesize_t val) { - char buf[128], *p; + char buf[MAX_ENCODED_INT_LEN], *p; p = encode_int(buf, val); svn_stringbuf_appendbytes(header, buf, p - buf); @@ -168,7 +183,7 @@ window_handler(svn_txdelta_window_t *window, void svn_stringbuf_t *i1 = svn_stringbuf_create("", pool); svn_stringbuf_t *header = svn_stringbuf_create("", pool); const svn_string_t *newdata; - char ibuf[128], *ip; + char ibuf[MAX_INSTRUCTION_LEN], *ip; const svn_txdelta_op_t *op; apr_size_t len; @@ -346,6 +361,8 @@ decode_file_offset(svn_filesize_t *val, const unsigned char *p, const unsigned char *end) { + if (p + MAX_ENCODED_INT_LEN < end) + end = p + MAX_ENCODED_INT_LEN; /* Decode bytes until we're done. */ *val = 0; while (p < end) @@ -365,6 +382,8 @@ decode_size(apr_size_t *val, const unsigned char *p, const unsigned char *end) { + if (p + MAX_ENCODED_INT_LEN < end) + end = p + MAX_ENCODED_INT_LEN; /* Decode bytes until we're done. */ *val = 0; while (p < end) @@ -382,7 +401,7 @@ decode_size(apr_size_t *val, data is not compressed. */ static svn_error_t * -zlib_decode(svn_stringbuf_t *in, svn_stringbuf_t *out) +zlib_decode(svn_stringbuf_t *in, svn_stringbuf_t *out, apr_size_t limit) { apr_size_t len; char *oldplace = in->data; @@ -390,6 +409,13 @@ static svn_error_t * /* First thing in the string is the original length. */ in->data = (char *)decode_size(&len, (unsigned char *)in->data, (unsigned char *)in->data+in->len); + if (in->data == NULL) + return svn_error_create(SVN_ERR_SVNDIFF_INVALID_COMPRESSED_DATA, NULL, + _("Decompression of svndiff data failed: no size")); + if (len > limit) + return svn_error_create(SVN_ERR_SVNDIFF_INVALID_COMPRESSED_DATA, NULL, + _("Decompression of svndiff data failed: " + "size too large")); /* We need to subtract the size of the encoded original length off the * still remaining input length. */ in->len -= (in->data - oldplace); @@ -487,10 +513,10 @@ count_and_verify_instructions(int *ninst, return svn_error_createf (SVN_ERR_SVNDIFF_INVALID_OPS, NULL, _("Invalid diff stream: insn %d cannot be decoded"), n); - else if (op.length <= 0) + else if (op.length == 0) return svn_error_createf (SVN_ERR_SVNDIFF_INVALID_OPS, NULL, - _("Invalid diff stream: insn %d has non-positive length"), n); + _("Invalid diff stream: insn %d has length zero"), n); else if (op.length > tview_len - tpos) return svn_error_createf (SVN_ERR_SVNDIFF_INVALID_OPS, NULL, @@ -499,7 +525,8 @@ count_and_verify_instructions(int *ninst, switch (op.action_code) { case svn_txdelta_source: - if (op.length > sview_len - op.offset) + if (op.length > sview_len - op.offset || + op.offset > sview_len) return svn_error_createf (SVN_ERR_SVNDIFF_INVALID_OPS, NULL, _("Invalid diff stream: " @@ -565,11 +592,11 @@ decode_window(svn_txdelta_window_t *window, svn_fi instin = svn_stringbuf_ncreate((const char *)data, insend - data, pool); instout = svn_stringbuf_create("", pool); - SVN_ERR(zlib_decode(instin, instout)); + SVN_ERR(zlib_decode(instin, instout, MAX_INSTRUCTION_SECTION_LEN)); ndin = svn_stringbuf_ncreate((const char *)insend, newlen, pool); ndout = svn_stringbuf_create("", pool); - SVN_ERR(zlib_decode(ndin, ndout)); + SVN_ERR(zlib_decode(ndin, ndout, SVN_DELTA_WINDOW_SIZE)); newlen = ndout->len; data = (unsigned char *)instout->data; @@ -685,6 +712,14 @@ write_handler(void *baton, if (p == NULL) return SVN_NO_ERROR; + if (tview_len > SVN_DELTA_WINDOW_SIZE || + sview_len > SVN_DELTA_WINDOW_SIZE || + /* for svndiff1, newlen includes the original length */ + newlen > SVN_DELTA_WINDOW_SIZE + MAX_ENCODED_INT_LEN || + inslen > MAX_INSTRUCTION_SECTION_LEN) + return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL, + _("Svndiff contains a too-large window")); + /* Check for integer overflow. */ if (sview_offset < 0 || inslen + newlen < inslen || sview_len + tview_len < sview_len @@ -841,6 +876,14 @@ read_window_header(svn_stream_t *stream, svn_files SVN_ERR(read_one_size(inslen, stream)); SVN_ERR(read_one_size(newlen, stream)); + if (*tview_len > SVN_DELTA_WINDOW_SIZE || + *sview_len > SVN_DELTA_WINDOW_SIZE || + /* for svndiff1, newlen includes the original length */ + *newlen > SVN_DELTA_WINDOW_SIZE + MAX_ENCODED_INT_LEN || + *inslen > MAX_INSTRUCTION_SECTION_LEN) + return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL, + _("Svndiff contains a too-large window")); + /* Check for integer overflow. */ if (*sview_offset < 0 || *inslen + *newlen < *inslen || *sview_len + *tview_len < *sview_len Index: subversion/libsvn_delta/text_delta.c =================================================================== --- subversion/libsvn_delta/text_delta.c (revision 38519) +++ subversion/libsvn_delta/text_delta.c (working copy) @@ -548,7 +548,7 @@ svn_txdelta_target_push(svn_txdelta_window_handler /* Functions for applying deltas. */ /* Ensure that BUF has enough space for VIEW_LEN bytes. */ -static APR_INLINE void +static APR_INLINE svn_error_t * size_buffer(char **buf, apr_size_t *buf_size, apr_size_t view_len, apr_pool_t *pool) { @@ -557,8 +557,11 @@ size_buffer(char **buf, apr_size_t *buf_size, *buf_size *= 2; if (*buf_size < view_len) *buf_size = view_len; + SVN_ERR_ASSERT(APR_ALIGN_DEFAULT(*buf_size) >= *buf_size); *buf = apr_palloc(pool, *buf_size); } + + return SVN_NO_ERROR; } @@ -659,7 +662,7 @@ apply_window(svn_txdelta_window_t *window, void *b >= ab->sbuf_offset + ab->sbuf_len))); /* Make sure there's enough room in the target buffer. */ - size_buffer(&ab->tbuf, &ab->tbuf_size, window->tview_len, ab->pool); + SVN_ERR(size_buffer(&ab->tbuf, &ab->tbuf_size, window->tview_len, ab->pool)); /* Prepare the source buffer for reading from the input stream. */ if (window->sview_offset != ab->sbuf_offset @@ -668,7 +671,8 @@ apply_window(svn_txdelta_window_t *window, void *b char *old_sbuf = ab->sbuf; /* Make sure there's enough room. */ - size_buffer(&ab->sbuf, &ab->sbuf_size, window->sview_len, ab->pool); + SVN_ERR(size_buffer(&ab->sbuf, &ab->sbuf_size, window->sview_len, + ab->pool)); /* If the existing view overlaps with the new view, copy the * overlap to the beginning of the new buffer. */ ]]] This patch applies to Subversion 1.5.x: [[[ Index: subversion/libsvn_delta/svndiff.c =================================================================== --- subversion/libsvn_delta/svndiff.c (revision 38498) +++ subversion/libsvn_delta/svndiff.c (working copy) @@ -55,10 +55,23 @@ struct encoder_baton { apr_pool_t *pool; }; +/* This is at least as big as the largest size of an integer that + encode_int can generate; it is sufficient for creating buffers for + it to write into. This assumes that integers are at most 64 bits, + and so 10 bytes (with 7 bits of information each) are sufficient to + represent them. */ +#define MAX_ENCODED_INT_LEN 10 +/* This is at least as big as the largest size for a single instruction. */ +#define MAX_INSTRUCTION_LEN (2*MAX_ENCODED_INT_LEN+1) +/* This is at least as big as the largest possible instructions + section: in theory, the instructions could be SVN_DELTA_WINDOW_SIZE + 1-byte copy-from-source instructions (though this is very unlikely). */ +#define MAX_INSTRUCTION_SECTION_LEN (SVN_DELTA_WINDOW_SIZE*MAX_INSTRUCTION_LEN) /* Encode VAL into the buffer P using the variable-length svndiff integer format. Return the incremented value of P after the - encoded bytes have been written. + encoded bytes have been written. P must point to a buffer of size + at least MAX_ENCODED_INT_LEN. This encoding uses the high bit of each byte as a continuation bit and the other seven bits as data bits. High-order data bits are @@ -91,6 +104,8 @@ encode_int(char *p, svn_filesize_t val) n++; } + assert(n <= MAX_ENCODED_INT_LEN); + /* Encode the remaining bytes; n is always the number of bytes coming after the one we're encoding. */ while (--n >= 0) @@ -107,7 +122,7 @@ encode_int(char *p, svn_filesize_t val) static void append_encoded_int(svn_stringbuf_t *header, svn_filesize_t val) { - char buf[128], *p; + char buf[MAX_ENCODED_INT_LEN], *p; p = encode_int(buf, val); svn_stringbuf_appendbytes(header, buf, p - buf); @@ -163,7 +178,7 @@ window_handler(svn_txdelta_window_t *window, void svn_stringbuf_t *i1 = svn_stringbuf_create("", pool); svn_stringbuf_t *header = svn_stringbuf_create("", pool); const svn_string_t *newdata; - char ibuf[128], *ip; + char ibuf[MAX_INSTRUCTION_LEN], *ip; const svn_txdelta_op_t *op; apr_size_t len; @@ -341,6 +356,8 @@ decode_file_offset(svn_filesize_t *val, const unsigned char *p, const unsigned char *end) { + if (p + MAX_ENCODED_INT_LEN < end) + end = p + MAX_ENCODED_INT_LEN; /* Decode bytes until we're done. */ *val = 0; while (p < end) @@ -360,6 +377,8 @@ decode_size(apr_size_t *val, const unsigned char *p, const unsigned char *end) { + if (p + MAX_ENCODED_INT_LEN < end) + end = p + MAX_ENCODED_INT_LEN; /* Decode bytes until we're done. */ *val = 0; while (p < end) @@ -377,7 +396,7 @@ decode_size(apr_size_t *val, data is not compressed. */ static svn_error_t * -zlib_decode(svn_stringbuf_t *in, svn_stringbuf_t *out) +zlib_decode(svn_stringbuf_t *in, svn_stringbuf_t *out, apr_size_t limit) { apr_size_t len; char *oldplace = in->data; @@ -385,6 +404,13 @@ static svn_error_t * /* First thing in the string is the original length. */ in->data = (char *)decode_size(&len, (unsigned char *)in->data, (unsigned char *)in->data+in->len); + if (in->data == NULL) + return svn_error_create(SVN_ERR_SVNDIFF_INVALID_COMPRESSED_DATA, NULL, + _("Decompression of svndiff data failed: no size")); + if (len > limit) + return svn_error_create(SVN_ERR_SVNDIFF_INVALID_COMPRESSED_DATA, NULL, + _("Decompression of svndiff data failed: " + "size too large")); /* We need to subtract the size of the encoded original length off the * still remaining input length. */ in->len -= (in->data - oldplace); @@ -482,10 +508,10 @@ count_and_verify_instructions(int *ninst, return svn_error_createf (SVN_ERR_SVNDIFF_INVALID_OPS, NULL, _("Invalid diff stream: insn %d cannot be decoded"), n); - else if (op.length <= 0) + else if (op.length == 0) return svn_error_createf (SVN_ERR_SVNDIFF_INVALID_OPS, NULL, - _("Invalid diff stream: insn %d has non-positive length"), n); + _("Invalid diff stream: insn %d has length zero"), n); else if (op.length > tview_len - tpos) return svn_error_createf (SVN_ERR_SVNDIFF_INVALID_OPS, NULL, @@ -494,7 +520,8 @@ count_and_verify_instructions(int *ninst, switch (op.action_code) { case svn_txdelta_source: - if (op.length > sview_len - op.offset) + if (op.length > sview_len - op.offset || + op.offset > sview_len) return svn_error_createf (SVN_ERR_SVNDIFF_INVALID_OPS, NULL, _("Invalid diff stream: " @@ -560,11 +587,11 @@ decode_window(svn_txdelta_window_t *window, svn_fi instin = svn_stringbuf_ncreate((const char *)data, insend - data, pool); instout = svn_stringbuf_create("", pool); - SVN_ERR(zlib_decode(instin, instout)); + SVN_ERR(zlib_decode(instin, instout, MAX_INSTRUCTION_SECTION_LEN)); ndin = svn_stringbuf_ncreate((const char *)insend, newlen, pool); ndout = svn_stringbuf_create("", pool); - SVN_ERR(zlib_decode(ndin, ndout)); + SVN_ERR(zlib_decode(ndin, ndout, SVN_DELTA_WINDOW_SIZE)); newlen = ndout->len; data = (unsigned char *)instout->data; @@ -680,6 +707,14 @@ write_handler(void *baton, if (p == NULL) return SVN_NO_ERROR; + if (tview_len > SVN_DELTA_WINDOW_SIZE || + sview_len > SVN_DELTA_WINDOW_SIZE || + /* for svndiff1, newlen includes the original length */ + newlen > SVN_DELTA_WINDOW_SIZE + MAX_ENCODED_INT_LEN || + inslen > MAX_INSTRUCTION_SECTION_LEN) + return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL, + _("Svndiff contains a too-large window")); + /* Check for integer overflow. */ if (sview_offset < 0 || inslen + newlen < inslen || sview_len + tview_len < sview_len @@ -836,6 +871,14 @@ read_window_header(svn_stream_t *stream, svn_files SVN_ERR(read_one_size(inslen, stream)); SVN_ERR(read_one_size(newlen, stream)); + if (*tview_len > SVN_DELTA_WINDOW_SIZE || + *sview_len > SVN_DELTA_WINDOW_SIZE || + /* for svndiff1, newlen includes the original length */ + *newlen > SVN_DELTA_WINDOW_SIZE + MAX_ENCODED_INT_LEN || + *inslen > MAX_INSTRUCTION_SECTION_LEN) + return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL, + _("Svndiff contains a too-large window")); + /* Check for integer overflow. */ if (*sview_offset < 0 || *inslen + *newlen < *inslen || *sview_len + *tview_len < *sview_len Index: subversion/libsvn_delta/text_delta.c =================================================================== --- subversion/libsvn_delta/text_delta.c (revision 38498) +++ subversion/libsvn_delta/text_delta.c (working copy) @@ -498,7 +498,7 @@ svn_txdelta_target_push(svn_txdelta_window_handler /* Functions for applying deltas. */ /* Ensure that BUF has enough space for VIEW_LEN bytes. */ -static APR_INLINE void +static APR_INLINE svn_error_t * size_buffer(char **buf, apr_size_t *buf_size, apr_size_t view_len, apr_pool_t *pool) { @@ -507,8 +507,13 @@ size_buffer(char **buf, apr_size_t *buf_size, *buf_size *= 2; if (*buf_size < view_len) *buf_size = view_len; + if (APR_ALIGN_DEFAULT(*buf_size) < *buf_size) + return svn_error_create(SVN_ERR_SVNDIFF_INVALID_OPS, NULL, + "Diff stream resulted in invalid buffer size."); *buf = apr_palloc(pool, *buf_size); } + + return SVN_NO_ERROR; } @@ -609,7 +614,7 @@ apply_window(svn_txdelta_window_t *window, void *b >= ab->sbuf_offset + ab->sbuf_len))); /* Make sure there's enough room in the target buffer. */ - size_buffer(&ab->tbuf, &ab->tbuf_size, window->tview_len, ab->pool); + SVN_ERR(size_buffer(&ab->tbuf, &ab->tbuf_size, window->tview_len, ab->pool)); /* Prepare the source buffer for reading from the input stream. */ if (window->sview_offset != ab->sbuf_offset @@ -618,7 +623,8 @@ apply_window(svn_txdelta_window_t *window, void *b char *old_sbuf = ab->sbuf; /* Make sure there's enough room. */ - size_buffer(&ab->sbuf, &ab->sbuf_size, window->sview_len, ab->pool); + SVN_ERR(size_buffer(&ab->sbuf, &ab->sbuf_size, window->sview_len, + ab->pool)); /* If the existing view overlaps with the new view, copy the * overlap to the beginning of the new buffer. */ ]]] . The Apache Portable Runtime Utility Library (aka APR-Util) provides an interface to functionality such as XML parsing, string matching and databases connections. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/apr < 1.3.8 >= 1.3.8 2 dev-libs/apr-util < 1.3.9 >= 1.3.9 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description =========== Matt Lewis reported multiple Integer overflows in the apr_rmm_malloc(), apr_rmm_calloc(), and apr_rmm_realloc() functions in misc/apr_rmm.c of APR-Util and in memory/unix/apr_pools.c of APR, both occurring when aligning memory blocks. Impact ====== A remote attacker could entice a user to connect to a malicious server with software that uses the APR or act as a malicious client to a server that uses the APR (such as Subversion or Apache servers), possibly resulting in the execution of arbitrary code with the privileges of the user running the application. Workaround ========== There is no known workaround at this time. Resolution ========== All Apache Portable Runtime users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =dev-libs/apr-1.3.8 All APR Utility Library users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =dev-libs/apr-util-1.3.9 References ========== [ 1 ] CVE-2009-2412 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2412 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200909-03.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . =========================================================== Ubuntu Security Notice USN-813-2 August 08, 2009 apache2 vulnerability CVE-2009-2412 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: libapr0 2.0.55-4ubuntu2.7 After a standard system upgrade you need to restart any applications using apr, such as Subversion and Apache, to effect the necessary changes. Details follow: USN-813-1 fixed vulnerabilities in apr. This update provides the corresponding updates for apr as provided by Apache on Ubuntu 6.06 LTS. Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.7.diff.gz Size/MD5: 126010 68da83341313e1b166fe345138d1eaa5 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.7.dsc Size/MD5: 1156 0b17c48d0880ab82c769c41d1aff7002 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55.orig.tar.gz Size/MD5: 6092031 45e32c9432a8e3cf4227f5af91b03622 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu2.7_all.deb Size/MD5: 2125530 9356b79c2b1591ffec1a6cd1974f82fd amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 833902 08b8aaf66aa52e6fd9dbed1647bb5dd2 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 229124 400d32297652e4976456cb7b367cc435 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 224122 07be7749fd618703c9f093efeb5e6fad http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 228700 9c79315063121eb7017cd99c6bb4667c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 172244 e15a994901f09e6e8294d656b8a8254c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 173028 985f0a987b0e5e17b24fdd6f8475781a http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 95066 2b836251f30a5c3d0cb24c2775a9b997 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 37096 2756f162320b3b183c7447dad130cff9 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 286664 f46d70c05cba04ceaba7d62afe5ac5be http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.7_amd64.deb Size/MD5: 145234 e1c285b96d1ee5e8a66d01eadcc289c6 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 787150 ab3e75481087dc0148ca3ccc450a1ab1 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 203722 e10938af36f0e1802fbd3b0946ae6e3c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 199634 7ee8d5ba9679c8c7dd78c95b5fb74046 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 203146 5456087e20afd24d2a27d648fafeb135 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 172228 98a58d9526a667a05573e9b26fcfd45b http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 173020 1db636c0e79b0ea3c405da958c35c932 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 92998 737aee7a7026d4d9b33a0f71b44e0b19 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 37098 15db8827569af434025942a84e77b381 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 262652 93f2171d69072153264cab51860f781c http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.7_i386.deb Size/MD5: 133118 cac6f1c804a1e34bf4250be4d8670862 powerpc architecture (Apple Macintosh G3/G4/G5): http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 859954 558399d0c5fb22cee0cdc1b20d4d7586 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 221090 94c5789d3d06b3553d883eca45ab06b7 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 216702 68edfa60eb9de377b20be68e10bd879a http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 220634 8f103f83772eb2e52cd38bb0fb1efbec http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 172234 559b5683e44f424324d43b09f42c63f6 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 173014 7c05a2f5fe626036ebaa271cece0cd09 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 104772 63a31e0f30472ebc19a79744b1b1fe03 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 37098 c00f5d32432f97ac992652ac1bbb7259 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 282244 1a2c7d7038b335ae2ab6ff68d06a380f http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.7_powerpc.deb Size/MD5: 142328 169a4ce5fc42eb789c76f46acb07aa00 sparc architecture (Sun SPARC/UltraSPARC): http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 804250 3a780a65322c539717e93a64792acc16 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 211276 e1f45226511664f1759a6ad75aff6155 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 206948 19e2792273d8a4935ef6fcc6ee369326 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 210556 e62136b10dca8c665defa2cc54640e64 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 172232 6e2213cb4b6a5dec1506fe01ce5cc028 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 173010 9603ee752f034d04fd349db168fbe2f2 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 94084 c6f6315ff2e1865f409ae49d54e3a233 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 37102 fdb3a44756f9d6e8d36c1b2558420d57 http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 268648 03fbe81b3cc1f0ac17961fc5c58a3f5f http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.7_sparc.deb Size/MD5: 131056 8707670bfb577280d9b5d0689c51608c
VAR-200908-0404 CVE-2009-1723 Apple Mac OS of CFNetwork In any HTTPS Web Vulnerability that can be disguised as visiting a site CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
CFNetwork in Apple Mac OS X 10.5 before 10.5.8 places an incorrect URL in a certificate warning in certain 302 redirection scenarios, which makes it easier for remote attackers to trick a user into visiting an arbitrary https web site by leveraging an open redirect vulnerability, a different issue than CVE-2009-2062. This vulnerability CVE-2009-2062 Is a different vulnerability.Optional to a third party HTTPS Web You may be disguised as visiting the site. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 3) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA36030 9) A boundary error in ImageIO when processing EXIF metadata can be exploited to cause a buffer overflow and potentially execute arbitrary code via a specially crafted image. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 15) An error in the kernel when processing AppleTalk response packets can be exploited to cause a buffer overflow and potentially execute arbitrary code with system privileges. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0403 CVE-2009-1728 Apple Mac OS of image RAW Vulnerable to arbitrary code execution CVSS V2: 6.8
CVSS V3: -
Severity: MEDIUM
Stack-based buffer overflow in Image RAW in Apple Mac OS X 10.5 before 10.5.8, and 10.4 before Digital Camera RAW Compatibility Update 2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Canon RAW image. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA36030 9) A boundary error in ImageIO when processing EXIF metadata can be exploited to cause a buffer overflow and potentially execute arbitrary code via a specially crafted image. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 15) An error in the kernel when processing AppleTalk response packets can be exploited to cause a buffer overflow and potentially execute arbitrary code with system privileges. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0402 CVE-2009-1727 Apple Mac OS of CoreTypes Any of the blacklists in JavaScript Vulnerability to be executed CVSS V2: 6.8
CVSS V3: -
Severity: MEDIUM
Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X 10.5 before 10.5.8 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. A list of system content types that will be marked as unsafe in certain circumstances (such as when downloading from a web page). I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 3) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA36030 9) A boundary error in ImageIO when processing EXIF metadata can be exploited to cause a buffer overflow and potentially execute arbitrary code via a specially crafted image. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 15) An error in the kernel when processing AppleTalk response packets can be exploited to cause a buffer overflow and potentially execute arbitrary code with system privileges. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0401 CVE-2009-1726 Apple Mac OS of ColorSync Vulnerable to arbitrary code execution CVSS V2: 9.3
CVSS V3: -
Severity: HIGH
Heap-based buffer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image containing an embedded ColorSync profile. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. A heap overflow exists when handling graphics embedded with ColorSync configuration files, opening malicious graphics may lead to unexpected application termination or arbitrary code execution. ---------------------------------------------------------------------- Secunia CSI integrated with Microsoft WSUS and Microsoft SCCM for 3rd party Patch Management Free webinars http://secunia.com/vulnerability_scanning/corporate/webinars/ ---------------------------------------------------------------------- TITLE: Apple Safari Multiple Vulnerabilities SECUNIA ADVISORY ID: SA40105 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/40105/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=40105 RELEASE DATE: 2010-06-09 DISCUSS ADVISORY: http://secunia.com/advisories/40105/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/40105/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=40105 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Some vulnerabilities have been reported in Apple Safari, which can be exploited by malicious people to bypass certain security restrictions, disclose sensitive information, conduct spoofing or cross-site scripting attacks, and potentially compromise a user's system. 1) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to potentially execute arbitrary code. This is related to vulnerability #2 in: SA36096 2) The browser follows links containing arbitrary user information without warning, which can be exploited to facilitate phishing attacks via specially crafted URLs. 3) A use-after-free error when handling PDF files can be exploited to potentially execute arbitrary code. 4) An error in WebKit when handling clipboard URLs can be exploited to disclose sensitive files if a user is tricked into dragging or pasting links or images to a malicious website. 5) An error in WebKit when a selection from a website is dragged or pasted into another website can be exploited to potentially execute arbitrary JavaScript code in the context of the destination website. 6) An error in WebKit when handling UTF-7 encoded text can be exploited to leave an HTML quoted string unterminated and facilitate cross-site scripting attacks. 7) An input sanitation error in WebKit when handling Local Storage and Web SQL databases can be exploited to create database files in arbitrary directories via directory traversal attacks. 8) A use-after-free error in WebKit when rendering HTML buttons can be exploited to potentially execute arbitrary code. 9) A use-after-free error in WebKit when handling attribute manipulations can be exploited to potentially execute arbitrary code. 10) An error in WebKit when handling HTML document fragments can be exploited to execute arbitrary JavaScript code in a legitimate context processing foreign HTML fragments. 11) An error in WebKit when handling keyboard focus can be exploited to deliver key press events intended for a different frame. 12) An error in WebKit when handling DOM constructor objects can be exploited to conduct cross-site scripting attacks. 13) A use-after-free error in WebKit when handling the removal of container elements can be exploited to potentially execute arbitrary code. 14) A use-after-free error in WebKit when rendering a selection at the time of a layout change can be exploited to potentially execute arbitrary code. 15) An error in WebKit when handling ordered list insertions can be exploited to corrupt memory and potentially execute arbitrary code. 16) An uninitialised memory access error in WebKit when handling selection changes on form input elements can be exploited to potentially execute arbitrary code. 17) A use-after-free error in WebKit when handling caption elements can be exploited to potentially execute arbitrary code. 18) A use-after-free error in WebKit when handling the ":first-letter" pseudo-element in cascading stylesheets can be exploited to potentially execute arbitrary code. 19) A double-free error in WebKit when handling event listeners in SVG documents can be exploited to potentially execute arbitrary code. 20) An uninitialised memory access error in WebKit when handling "use" elements in SVG documents can be exploited to potentially execute arbitrary code. 21) A use-after-free error in WebKit when handling SVG documents with multiple "use" elements can be exploited to potentially execute arbitrary code. 22) An error in WebKit when handling nested "use" elements in SVG documents can be exploited to corrupt memory and potentially execute arbitrary code. 23) A use-after-free error in WebKit when handling CSS run-ins can be exploited to potentially execute arbitrary code. 24) A use-after-free error in WebKit when handling HTML elements with custom vertical positioning can be exploited to potentially execute arbitrary code. 25) An error exists in WebKit when visiting HTTPS websites redirecting to HTTP websites. This can be exploited to disclose potentially sensitive information contained in the HTTPS URL by reading the "Referer" header. 26) An integer truncation error in WebKit when handling TCP requests can be exploited to pass arbitrary data to arbitrary TCP ports. 27) An error in WebKit when processing connections to IRC ports can be exploited to send arbitrary data to arbitrary IRC servers. 28) A use-after-free error in WebKit when handling hover events can be exploited to potentially execute arbitrary code. 29) An error in WebKit can be exploited to read NTLM credentials that are incorrectly transmitted in plain-text via Man-in-the-Middle (MitM) attacks. 30) A use-after-free error in WebKit when handling the "removeChild" DOM method can be exploited to potentially execute arbitrary code. 31) An error in WebKit when handling libxml contexts can be exploited to potentially execute arbitrary code. 32) An error in WebKit when handling a canvas with an SVG image pattern can be exploited to load and capture an image from another website. 33) An error in WebKit when rendering CSS-styled HTML content with multiple ":after" pseudo-selectors can be exploited to corrupt memory and potentially execute arbitrary code. 34) An error in WebKit when handling the "src" attribute of a frame element can be exploited to facilitate cross-site scripting attacks. 35) A use-after-free error in WebKit when handling drag and drop operations can be exploited to potentially execute arbitrary code. 36) An error in the implementation of the JavaScript "execCommand" function can be exploited to modify the contents of the clipboard. 37) An error when handling malformed URLs can be exploited to bypass the same-origin policy and execute arbitrary script code in the context of a different domain. 38) A use-after-free error in WebKit when handling DOM "Range" objects can be exploited to potentially execute arbitrary code. 39) A use-after-free error in WebKit when handling the "Node.normalize()" method can be exploited to potentially execute arbitrary code. 40) A use-after-free error in WebKit when rendering HTML document subtrees can be exploited to potentially execute arbitrary code. 41) An error in WebKit when handling HTML content in "textarea" elements can be exploited to conduct cross-site scripting attacks. 42) An error in WebKit when visiting a website which redirects form submissions to a redirecting website can be exploited disclose submitted data. 43) A type checking error in WebKit when handling text nodes can be exploited to potentially execute arbitrary code. 44) A use-after-free error in WebKit when handling fonts can be exploited to potentially execute arbitrary code. 45) An error in WebKit when handling HTML tables can be exploited to trigger an out-of-bounds memory access and potentially execute arbitrary code. 46) An error in WebKit when handling the CSS ":visited" pseudo-class can be exploited to disclose visited websites. PROVIDED AND/OR DISCOVERED BY: 37) Michal Zalewski The vendor also credits: 1) Chris Evans of the Google Security Team, and Andrzej Dyjak 2) Abhishek Arya of Google 3) Borja Marcos of Sarenet 4) Eric Seidel of Google 5) Paul Stone of Context Information Security 6) Masahiro Yamada 8) Matthieu Bonetti of Vupen 9) Ralf Philipp Weinmann working with TippingPoint's Zero Day Initiative 10, 41) Eduardo Vela Nava (sirdarckcat) of Google 11) Michal Zalewski of Google 12) Gianni "gf3" Chiappetta of Runlevel6 13, 15, 16, 18, 19, 20, 21, 23, 43) wushi of team509, working with TippingPoint's Zero Day Initiative 14) wushi and Z of team509, working with TippingPoint's Zero Day Initiative 17) regenrecht working with iDefense 22, 31) Aki Helin of OUSPG 24) Ojan Vafai of Google 25) Colin Percival of Tarsnap 28) Dave Bowker 30) Mark Dowd of Azimuth Security 32) Chris Evans of Google 33, 45) wushi of team509 34) Sergey Glazunov 35) kuzzcc, and Skylined of Google Chrome Security Team 38) Yaar Schnitman of Google 39) Mark Dowd 40) James Robinson of Google 42) Marc Worrell of WhatWebWhat ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT4196 Michal Zalewski: http://lcamtuf.blogspot.com/2010/06/safari-tale-of-betrayal-and-revenge.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . Some have an unknown impact and others can be exploited by malicious people to bypass certain security restrictions, disclose sensitive information, or compromise a user's system. For more information: SA37931 SA40105 4) One unspecified vulnerability with an unknown impact has been reported in WebKit included in iTunes. No further information is currently available. 5) Two vulnerabilities in WebKit can be exploited by malicious people to compromise a user's system. PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Chris Evans of the Google Security Team and Andrzej Dyjak. 2) The vendor credits Kevin Finisterre, digitalmunition.com. 4) Reported by the vendor. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities
VAR-200908-0272 CVE-2009-2194 Apple Mac OS Service disruption related to file descriptor sharing (DoS) Vulnerabilities CVSS V2: 4.9
CVSS V3: -
Severity: MEDIUM
Apple Mac OS X 10.5 before 10.5.8 does not properly share file descriptors over local sockets, which allows local users to cause a denial of service (system crash) by placing file descriptors in messages sent to a socket that has no receiver, related to a "synchronization issue.". Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 3) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA36030 9) A boundary error in ImageIO when processing EXIF metadata can be exploited to cause a buffer overflow and potentially execute arbitrary code via a specially crafted image. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 15) An error in the kernel when processing AppleTalk response packets can be exploited to cause a buffer overflow and potentially execute arbitrary code with system privileges. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0270 CVE-2009-2192 Apple Mac OS of MobileMe Vulnerable to session hijacking CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
MobileMe in Apple Mac OS X 10.5 before 10.5.8 does not properly delete credentials upon signout from the preference pane, which makes it easier for attackers to hijack a MobileMe session via unspecified vectors, related to a "logic issue.". Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 3) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA36030 9) A boundary error in ImageIO when processing EXIF metadata can be exploited to cause a buffer overflow and potentially execute arbitrary code via a specially crafted image. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 15) An error in the kernel when processing AppleTalk response packets can be exploited to cause a buffer overflow and potentially execute arbitrary code with system privileges. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0271 CVE-2009-2193 Apple Mac OS of kernel Vulnerable to buffer overflow CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Buffer overflow in the kernel in Apple Mac OS X 10.5 before 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a crafted AppleTalk response packet. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0268 CVE-2009-2190 Apple Mac OS of launchd Service disruption in (DoS) Vulnerabilities CVSS V2: 7.8
CVSS V3: -
Severity: HIGH
launchd in Apple Mac OS X 10.5 before 10.5.8 allows remote attackers to cause a denial of service (individual service outage) by making many connections to an inetd-based launchd service. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 3) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA36030 9) A boundary error in ImageIO when processing EXIF metadata can be exploited to cause a buffer overflow and potentially execute arbitrary code via a specially crafted image. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 15) An error in the kernel when processing AppleTalk response packets can be exploited to cause a buffer overflow and potentially execute arbitrary code with system privileges. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0269 CVE-2009-2191 Apple Mac OS Arbitrary login window execution vulnerability CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
Format string vulnerability in Login Window in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in an application name. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. I. II. Impact The impact of these vulnerabilities vary. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 3) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA36030 9) A boundary error in ImageIO when processing EXIF metadata can be exploited to cause a buffer overflow and potentially execute arbitrary code via a specially crafted image. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 15) An error in the kernel when processing AppleTalk response packets can be exploited to cause a buffer overflow and potentially execute arbitrary code with system privileges. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0267 CVE-2009-2188 Apple Mac OS of ImageIO and Safari Vulnerable to arbitrary code execution CVSS V2: 9.3
CVSS V3: -
Severity: HIGH
Buffer overflow in ImageIO in Apple Mac OS X 10.5 before 10.5.8, and Safari before 4.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with crafted EXIF metadata. Apple's ImageIO component is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data. Successful exploits will allow an attacker to run arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. This issue affects Mac OS X 10.5 through 10.5.7, Mac OS X Server 10.5 through 10.5.7, and Apple Safari prior to 4.0.3. NOTE: This vulnerability was previously documented in BID 35954 (Apple Mac OS X 2009-003 Multiple Security Vulnerabilities) but has been given its own record to better document the issue. I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 15) An error in the kernel when processing AppleTalk response packets can be exploited to cause a buffer overflow and potentially execute arbitrary code with system privileges. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. For more information: SA28923 SOLUTION: Update to Mac OS X v10.5.8 or apply Security Update 2009-003. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
VAR-200908-0247 CVE-2009-0151 Apple Mac OS of Dock Vulnerability that can prevent locks in screen savers inside CVSS V2: 7.2
CVSS V3: -
Severity: HIGH
The screen saver in Dock in Apple Mac OS X 10.5 before 10.5.8 does not prevent four-finger Multi-Touch gestures, which allows physically proximate attackers to bypass locking and "manage applications or use Expose" via unspecified vectors. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003. The update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel, and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues. I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 3) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA36030 9) A boundary error in ImageIO when processing EXIF metadata can be exploited to cause a buffer overflow and potentially execute arbitrary code via a specially crafted image. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 15) An error in the kernel when processing AppleTalk response packets can be exploited to cause a buffer overflow and potentially execute arbitrary code with system privileges. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------