Microsoft Windows DNS客户端可预测事件处理ID漏洞（MS08-020）

BUGTRAQ ID: 28553 CVECAN ID: CVE-2008-1085 Microsoft Windows是微软发布的非常流行的操作系统。 Windows DNS客户端服务在执行DNS查询时，随机选择事件处理值没有提供足够的熵。未经认证的攻击者可以向有漏洞客户端的DNS请求返回恶意响应，欺骗或重新定向合法位置的Internet通讯。 Microsoft Windows XP SP2 Microsoft Windows Vista Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1...

Microsoft Office Web组件ActiveX控件远程代码执行漏洞（MS08-017）

BUGTRAQ ID: 28135,28136 CVECAN ID: CVE-2006-4695,CVE-2007-1201 Microsoft Office Web组件是COM控件集合，用于向Web发布电子表格、图表和数据库，并查看所发布的组件。 Microsoft Office Web组件在解析特制的URL时管理内存资源的方式存在漏洞，如果用户受骗访问了恶意网页的话，就可能触发内存破坏，导致执行任意指令。 Microsoft Office Web Components 2000 临时解决方法： 禁止在Internet Explorer中运行Office Web组件库，为CLSID...

Panda Security cpoint.sys Kernel Memory Corruption

A vulnerability in the 'Cpoint.sys' kernel driver shipped with Panda Antivirus+ Firewall 2008 and Panda Internet Security 2008 fails to sufficiently validate IOCTL requests before processing them. A local attacker may be able to leverage this issue to execute arbitrary code with kernel privileges...

Solaris 10 (x86) : 137001-08 (deprecated)

SunOS 5.10x86: PostgreSQL 8.2 documentation patch. Date this patch was last updated by Sun : Jun/09/11 This plugin has been deprecated and either replaced with individual 137001 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATE...

Core Security Technologies Advisory 2007.0930

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs Path Traversal vulnerability in VMware's shared folders implementation Advisory Information Title: Path Traversal vulnerability in VMware's shared folders implementati...

HP-UX PHSS_37273 : s700_800 11.X OV NNM7.51 PA-RISC Intermediate Patch 18

s700800 11.X OV NNM7.51 PA-RISC Intermediate Patch 18 : The remote HP-UX host is affected by multiple vulnerabilities : - Potential vulnerabilities have been identified with HP OpenView Network Node Manager OV NNM. The vulnerabilities could be exploited remotely to create a Denial of Service DoS ...

HP-UX PHSS_37274 : s700_800 11.X OV NNM7.51 IA-64 Intermediate Patch 18

s700800 11.X OV NNM7.51 IA-64 Intermediate Patch 18 : The remote HP-UX host is affected by multiple vulnerabilities : - A potential security vulnerability has been identified with HP OpenView Network Node Manager OV NNM. The vulnerability could be exploited remotely to create a Denial of Service...

iPhoto < 7.1.2 Format String Vulnerability

The remote host is running a version of iPhoto 7.1 older than version 7.1.2. Such versions are reportedly affected by a format string vulnerability. If an attacker can trick a user on the affected host into subscribing to a specially crafted photocast, these issues could be leveraged to execute...

Debian Security Advisory DSA 230-1 (bugzilla)

The remote host is missing an update to bugzilla announced via advisory DSA 230-1. OpenVAS Vulnerability Test $Id: deb2301.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 230-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 139-1 (super)

The remote host is missing an update to super announced via advisory DSA 139-1. OpenVAS Vulnerability Test $Id: deb1391.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 139-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 1134-1 (mozilla-thunderbird)

The remote host is missing an update to mozilla-thunderbird announced via advisory DSA 1134-1. Several security related problems have been discovered in Mozilla which are also present in Mozilla Thunderbird. For details, please visit the referenced security advisories. OpenVAS Vulnerability Test...

MS08-001: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (941644)

The remote version of Windows contains a version of the TCP/IP protocol that does not properly parse IGMPv3, MLDv2 and ICMP structure. An attacker may exploit these flaws to execute code on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid29893;...

Trolltech Qt QSslSocket类证书验证绕过安全限制漏洞

BUGTRAQ ID: 27112 CVECAN ID: CVE-2007-5965 Qt是一款C++应用开发工具，包括类库和跨平台开发工具。 Qt可能没有对SSL连接中的QSslSocket类证书执行验证，使用QSslSocket的应用可能受骗接受伪造的证书，这有助于攻击者执行网络钓鱼类的攻击。 Trolltech Qt 4.3.2 Trolltech Qt 4.3.1 Trolltech Qt 4.3.0 Trolltech --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Novell Groupwise Windows客户端API非授权邮件访问漏洞

BUGTRAQ ID: 18716 CVECAN ID: CVE-2006-3268 Novell GroupWise是一款跨平台协作软件。 Novell GroupWise的客户端API实现上存在漏洞，攻击者可能利用漏洞绕过安全限制，访问某些非授权的邮件。 Novell Groupwise 7.x Novell Groupwise 6.x Novell Groupwise 5.x 厂商补丁： Novell ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： GroupWise 6.5: Apply SP6 Client Update 1...

Ingres用户认证非授权访问漏洞

BUGTRAQ ID: 26959 CVECAN ID: CVE-2007-6334 Ingres是很多CA产品默认所使用的数据库后端。 Windows平台上的Ingres数据库为之后连接的用户分配了与第一个连接用户相同的权限和身份，这允许远程攻击者获得非授权访问。仅在运行于Microsoft IIS Web服务器上且启用了集成Windows认证（IWA）选项的情况下才会出现这个漏洞。 Ingres Corporation Ingres Database 2.6 Ingres Corporation Ingres Database 2.5 厂商补丁： Ingres Corporation...

Cisco防火墙服务模块中应用程序检测拒绝服务漏洞

BUGTRAQ ID: 26941 CVE ID：CVE-2007-5584 CNCVE ID:CNCVE-20075584 Cisco Firewall Services Module FWSM是一款思科公司提供的防火墙服务模块，集成在Cisco Catalyst 6500交换机和Cisco 7600系列路由器上。 Cisco Firewall Services Module FWSM包含的第7层应用程序检测处理上存在问题，远程攻击者可以利用漏洞使FWSM模块重载，造成拒绝服务攻击。...

Fedora 7 : lighttpd-1.4.18-1.fc7 (2007-2132)

Lighttpd 1.4.17 and earlier is prone to a header overflow when using the modfastcgi extension, this can lead to arbitrary code execution in the fastcgi application. This 1.4.18 update fixes the issue. Note that Tenable Network Security has extracted the preceding description block directly from t...

Fedora 7 : python-2.5-14.fc7 (2007-2663)

This update fixes: Multiple integer overflows in the imageop module 295971 Also included are a dependency fix on binutils 307221, so the ctypes module works, and a tkinter fix when dealing with zero length text in some widgets 281751. Note that Tenable Network Security has extracted the preceding...

Altiris Deployment Solution Elevation of Privilege

SUMMARY Symantecs Altiris Deployment Solution is vulnerable to an elevation of privilege attack. Risk Impact Medium Remote Access | No ---|--- Local Access | Yes Authentication Required | Yes Exploit available | No AFFECTED PRODUCTS Affected Products Product | Version | Build | Solution...

Altiris Deployment Solution Directory Traversal

SUMMARY Symantecs Altiris Deployment Solution is vulnerable to an elevation of privilege attack. Risk Impact Medium Remote Access | Yes ---|--- Local Access | Yes Authentication Required | Yes Exploit available | No AFFECTED PRODUCTS Affected Products Product | Version | Build | Solution...