CVE-2008-1447

The DNS protocol, as implemented in 1 BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; 2 Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referral...

openSUSE 10 Security Update : kernel (kernel-5339)

This kernel update fixes the following security problems: CVE-2008-2136: A problem in SIT IPv6 tunnel handling could be used by remote attackers to immediately crash the machine. CVE-2008-1615: On x8664 a denial of service attack could be used by local attackers to immediately panic / crash the...

Diigo Toolbar - Global XSS and Information Leakage in SSL URLs

Diigo Toolbar - Global XSS and Information Leakage in SSL URLs == Global XSS == Diigo is http://www.diigo.com/ a social bookmarking and sharing application which allows users to see other users comments and notes for every website. For this feature users should use Diigolet bookmarklet or Diigo...

Snort碎片重组TTL值导致漏报漏洞

BUGTRAQ ID: 29327 CVECAN ID: CVE-2008-1804 Snort是广泛部署的开放源码网络入侵检测系统（IDS）。 Snort没有正确地重组IP报文，远程攻击者可能利用此漏洞绕过检测。 在接收入站碎片时，Snort检查碎片的存活时间（TTL）值并与初始碎片的TTL做比较。如果二者之间的差异大于所配置的量（默认最大值为5）的话，就会丢弃碎片，也无法对其应用规则，这导致Snort无法过滤或检查有效的通讯。 Snort Project Snort 2.8 Snort Project Snort 2.6 临时解决方法：...

snort IDS protection bypass

Packet's fragments with significant TTL difference are ignored...

CVE-2008-2271

The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain session IDs from the database...

ruby -- DNS spoofing vulnerability in resolv.rb

resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than...

ruby -- DNS spoofing vulnerability in resolv.rb

resolv.rb allow remote attackers to spoof DNS answers. This risk can be reduced by randomness of DNS transaction IDs and source ports, so resolv.rb is fixed to randomize them...

Fedora 8 : pdns-recursor-3.1.5-1.fc8 (2008-3036)

Bug 440247 - CVE-2008-1637 pdns-recursor: perdictable query ids Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

CVE-2008-0087

The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows remote attackers to spoof DNS responses...

PT-2008-1742 · Microsoft · Windows Server 2003 +4

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: A spoofing issue exists in the Windows DNS client, allowing unauthenticated attackers to send malicious responses to DNS requests, thereby spoofing or redirecting Internet...

Nik Software Sharpener Pro vulnerable to privilege escalation

Overview The Nik Software Shapener Pro installs files with insecure permissions, which may allow a local attacker to elevate privileges. Description Nik Software Sharpener Pro is an Adobe Photoshop plug-in that provides image sharpening capabilities. The Nik Software Sharpener Pro installer sets...

Memory corruption

GnuPG gpg 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."...

DEBIAN-CVE-2008-1530

GnuPG gpg 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."...

CVE-2008-1530

GnuPG gpg 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."...

Web Server Uses Non Random Session IDs

The remote web server generates a session ID for each connection. A session ID is typically used to keep track of a user's actions while they visit a website. The remote server generates non-random session IDs. An attacker might use this flaw to guess the session IDs of other users and therefore...

Fedora 8 : asterisk-1.4.18.1-1.fc8 (2008-2554)

Update to 1.4.18.1 plus another patch to fix some security issues. AST-2008-002 details two buffer overflows that were discovered in RTP codec payload type handling. http://downloads.digium.com/pub/security/AST-2008-002.pdf All users of SIP in Asterisk 1.4 and 1.6 are affected. AST-2008-003 detai...

DEBIAN-CVE-2008-1390

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values...

Session fixation

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values...

Debian: Security Advisory (DSA-1515-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...