Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities

Background Cyrus-SASL is an implementation of the Simple Authentication and Security Layer. Description Cyrus-SASL contains a remote buffer overflow in the digestmda5.c file. Additionally, under certain conditions it is possible for a local user to exploit a vulnerability in the way the SASLPATH...

Netpbm: Multiple temporary file issues

Background Netpbm is a toolkit containing more than 200 separate utilities for manipulation and conversion of graphic images. Description Utilities contained in the Netpbm package prior to the 9.25 version contain defects in temporary file handling. They create temporary files with predictable...

Icecast Crafted URI Remote DoS

The remote server runs a version of Icecast, an open source streaming audio server that is older than version 1.3.11. This version is affected by a remote denial of service because Icecast server does not properly sanitize user-supplied input. A remote attacker could send a specially crafted URL,...

Debian DSA-427-1 : linux-kernel-2.4.17-mips+mipsel - missing boundary check

Paul Starzetz discovered a flaw in bounds checking in mremap in the Linux kernel present in version 2.4.x and 2.6.x which may allow a local attacker to gain root privileges. Version 2.2 is not affected by this bug. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-011-2 : mgetty - insecure tempfile handling

Immunix reports that mgetty does not create temporary files in a secure manner, which could lead to a symlink attack. This has been corrected in mgetty 1.1.21-3potato1 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Debian DSA-018-1 : tinyproxy - remote nobody exploit

PkC have found a heap overflow in tinyproxy that could be remotely exploited. An attacker could gain a shell user nobody remotely. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-018. The...

Debian DSA-118-1 : xsane - insecure temporary files

Tim Waugh found several insecure uses of temporary files in the xsane program, which is used for scanning. This was fixed for Debian/stable by moving those files into a securely created directory within the /tmp directory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian DSA-112-1 : hanterm - buffer overflow

A set of buffer overflow problems have been found in hanterm, a Hangul terminal for X11 derived from xterm, that will read and display Korean characters in its terminal window. The font handling code in hanterm uses hard limited string variables but didn't check for boundaries. This problem can b...

getmail: Filesystem overwrite vulnerability

Background getmail is a reliable fetchmail replacement that supports Maildir, Mboxrd and external MDA delivery. Description David Watson discovered a vulnerability in getmail when it is configured to run as root and deliver mail to the maildirs/mbox files of untrusted local users. A malicious loc...

GTK+ 2, gdk-pixbuf: Multiple image decoding vulnerabilities

Background GTK+ GIMP Toolkit + is a toolkit for creating graphical user interfaces. The GdkPixbuf library provides facilities for image handling. It is available as a standalone library as well as shipped with GTK+ 2. Description A vulnerability has been discovered in the BMP image preprocessor...

Mozilla contains integer overflows in bitmap image decoder

Overview A vulnerability in the way Mozilla and its derived programs handle certain bitmap images could allow a remote attacker to execute arbitrary code on a vulnerable system. Description The Mozilla web browser and related Mozilla products support the ability to natively display a number of...

MailEnable SMTP Connector Service DNS MX Response DoS

According to its banner, the remote host is running at least one instance of MailEnable's SMTP Connector service. A flaw exists in both the Standard Edition 1.7x and Professional Edition 1.2x/1.5a-e that results in this service crashing if it receives a DNS response with over 100 MX records. A...

Keene Digital Media Server Multiple Script XSS

The remote host runs Keene digital media server, a web server used to share digital information. This version is vulnerable to multiple cross-site scripting attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Drinsane include'deprecatednasllevel.inc'; include'compat.inc';...

MailEnable HTTPMail Service Authorization Header Handling Remote DoS

The remote host is running an instance of MailEnable that has a flaw in the HTTPMail service MEHTTPS.exe in the Professional and Enterprise Editions. The flaw can be exploited by issuing an HTTP request with a malformed Authorization header, which causes a NULL pointer dereference error and crash...

Oracle Database Server contains several vulnerabilities

Overview Several vulnerabilities exist in the Oracle Database Server and Listener. According the the Oracle Security Alert, exploitation of these vulnerabilities would require the attacker to have network access, but not a valid user account on the vulnerable system. Description Oracle Database 1...

GLSA-200406-13 : Squid: NTLM authentication helper buffer overflow

The remote host is affected by the vulnerability described in GLSA-200406-13 Squid: NTLM authentication helper buffer overflow Squid is a full-featured Web Proxy Cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other URLs, as well as SSL support, cache...

GLSA-200404-07 : ClamAV RAR Archive Remote Denial Of Service Vulnerability

The remote host is affected by the vulnerability described in GLSA-200404-07 ClamAV RAR Archive Remote Denial Of Service Vulnerability Certain types of RAR archives, including those created by variants of the W32.Beagle.A@mm worm, may cause clamav to crash when it attempts to process them. Impact...

GLSA-200404-03 : Tcpdump Vulnerabilities in ISAKMP Parsing

The remote host is affected by the vulnerability described in GLSA-200404-03 Tcpdump Vulnerabilities in ISAKMP Parsing There are two specific vulnerabilities in tcpdump, outlined in reference 1 . In the first scenario, an attacker may send a specially crafted ISAKMP Delete packet which causes...

MoinMoin: Group ACL bypass

Background MoinMoin is a Python clone of WikiWiki, based on PikiPiki. Description MoinMoin contains two unspecified bugs, one allowing anonymous users elevated access when not using ACLs, and the other in the ACL handling in the PageEditor. Impact Restrictions on anonymous users were not properly...

CVSTrac filediff Arbitrary Remote Code Execution

The remote host seems to be running cvstrac, a web-based bug and patch-set tracking system for CVS. This version of filediff has a flaw in the input sanitation which, when exploited, can lead to a remote attacker executing arbitrary commands on the system. Nessus has determined the vulnerability...