[ELEYTT] Public Advisory 20-10-2007

Eleytt Research www.eleytt.com Overview: ==================== Michal Bucko, Eleytt, http://www.eleytt.com/michal.bucko Tomasz Polis, Eleytt, http://www.eleytt.com/ Credit: ==================== Michal Bucko, Eleytt, www.eleytt.com/michal.bucko Vulnerability Table =================== 1. Firefox...

Marshal MailMarshal TAR Unpacking Vulnerability

Marshal MailMarshal TAR Unpacking Vulnerability Overview -------- Vendor: Marshal www.marshal.com Product: MailMarshal = 6.2.1.3253 Vulnerability: Remote file overwrite, Remote execution Risk: HIGH Description ----------- During a security audit for a customer we have discovered a serios...

MOSEB-07 Bonus: Vulnerabilities in Yandex.Server

New bonus vulnerabilities in Yandex. In this case vulnerabilities not directly at Yandex’s site, like at MOSEB-07: Vulnerability at blogs.yandex.ru, but in local search engine made by Yandex. The holes are in Yandex.Server Яndex.Server, local search engine from Yandex, which used by a lot of site...

MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine

MOSEB-15 Bonus: Vulnerability in Google Custom Search Engine 22:57 15.06.2007 New bonus vulnerability in Google. In this case vulnerability not directly at Google’s site, like at MOSEB-15: Vulnerabilities at images.google.com, but in his search engine called Google Custom Search Engine also known...

MOSEB-12 Bonus: Vulnerability in AltaVista

MOSEB-12 Bonus: Vulnerability in AltaVista 22:40 12.06.2007 New bonus vulnerability in AltaVista. In this case vulnerability not directly at AltaVista’s site, like at MOSEB-12: Vulnerabilities at www.altavista.com, but in local search engine made by AltaVista. The hole are in AltaVista local sear...

DSA-1328-1 unicon - buffer overflow

Bulletin has no description...

DSA-1326-1 fireflier

Bulletin has no description...

DSA-1327-1 gsambad - insecure temporary files

Bulletin has no description...

myspeach-inclusion.txt

/=======================================\ | Advisory :: MySpeach = 5.0.0, registerglobals = On, allowurlfopen = On | | Vuln 2 : registerglobals = On | | Risk level : High | | | +-------------------------------------------------------------------------------------------------------+ | | | Program...

LSAT: Insecure temporary file creation

Background The Linux Security Auditing Tool LSAT is a post install security auditor which checks many system configurations and local network settings on the system for common security or configuration errors and for packages that are not needed. Description LSAT insecurely writes in /tmp with a...

[Argeniss] Practical 10 minutes security audit: Oracle Case (Paper)

Hi. Abstract: This paper will show a extremely simple technique to quickly audit a software product in order to infer how trustable and secure it is. I will show you step by step how to identify half dozen of local 0day vulnerabilities in few minutes just making a couple of clicks on very easy to...

CVE-2007-0434

BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection...

GLSA-200611-17 : fvwm: fvwm-menu-directory fvwm command injection

The remote host is affected by the vulnerability described in GLSA-200611-17 fvwm: fvwm-menu-directory fvwm command injection Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that fvwm-menu-directory does not sufficiently sanitise directory names prior to generating menus. Impact ...

Debian DSA-893-1 : acidlab - missing input sanitising

Remco Verhoef has discovered a vulnerability in acidlab, Analysis Console for Intrusion Databases, and in acidbase, Basic Analysis and Security Engine, which can be exploited by malicious users to conduct SQL injection attacks. The maintainers of Analysis Console for Intrusion Databases ACID in...

DSA-1158 streamripper

Bulletin has no description...

JavaScript engine vulnerabilities — Mozilla

Continuing our security audit of the JavaScript engine, Mozilla developers found and fixed several potential vulnerabilities...

DSA-1035-1 fcheck - insecure temporary file

Bulletin has no description...

DSA-1010-1 ilohamail - missing input sanitising

Bulletin has no description...

[Full-disclosure] [SSAG#001] :: cURL tftp:// URL Buffer Overflow

SSAG001 :: cURL tftp:// URL Buffer Overflow INTRODUCTION "curl is a command line tool for transferring files with URL syntax, supporting FTP, FTPS, TFTP, HTTP, HTTPS, TELNET, DICT, FILE and LDAP. curl supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies...

GLSA-200603-08 : GnuPG: Incorrect signature verification

The remote host is affected by the vulnerability described in GLSA-200603-08 GnuPG: Incorrect signature verification OpenPGP is the standard that defines the format of digital signatures supported by GnuPG. OpenPGP signatures consist of multiple sections, in a strictly defined order. Tavis Ormand...