MailEnable SMTP NTLM认证多个安全漏洞

MailEnable是一款商业性质的POP3和SMTP服务器。 MailEnable的NTLM认证过程中SMTP连接器存在3个预认证漏洞。 1. 在处理NTLM Type1消息的签名字段时存在缓冲区溢出，可能导致执行任意代码； 2. 在处理base64编码的NTLM Type1消息中安全缓冲区时存在越界读取，可能导致拒绝服务； 3. 在Type3消息的base64编码过程中存在越界读取，可能导致执行任意代码。 MailEnable MailEnable Professional 2.0 MailEnable MailEnable Enterprise 2.0...

Microsoft ISA Server 2000站点和内容规则绕过漏洞

Microsoft Internet Security和Acceleration Server 2000是一款微软开发的防火墙和代理服务器程序。 Microsoft ISA Server的站点和内容访问规则实现存在问题，远程攻击者可以利用这个漏洞绕过这些规则，访问限制资源。 如果在请求的域名增加点'.'字符，可绕过代理服务器的过滤器，访问管理员规定的限制的资源和内容。如站点和内容规则设置对www.example.com进行拒绝访问，但是用户可以通过如下格式访问目标地址： www.example.com. Microsoft ISA Server 2000 Microsoft ISA...

CA多个产品消息引擎RPC服务器多个缓冲区溢出漏洞

Computer Associates是世界领先的安全厂商，产品包括多种杀毒软件及备份恢复系统。 CA多个产品的消息引擎处理用户请求时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 ASCORE.dll是CA多个产品的消息引擎RPC服务器所使用的DLL。当消息引擎（msgeng.exe）在处理TCP 6503端口ID为dc246bf0-7a7a-11ce-9f88-00805fe43838的端点上的RPC请求时，可能会触发一个堆溢出和一个栈溢出。有漏洞的操作分别是由这个端口上的Opnum 43和Opnum...

PHP Ini_Restore() Safe_Mode及Open_Basedir限制绕过漏洞

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP在处理配置选项时存在漏洞，远程攻击者可能利用此漏洞绕过安全限制。 如果将PHP用作Apache模块的话，就可以使用Apache配置文件（如httpd.conf）中的指令更改配置设置。例如，httpd.conf中的openbasedir： - --- Directory /usr/home/frajer/publichtml/ Options FollowSymLinks MultiViews Indexes AllowOverride None phpadminflag safemode 1...

Joomla!多个远程安全漏洞

Joomla!是一款开放源码的内容管理系统（CMS）。 Joomla!中存在多个跨站脚本和安全限制绕过漏洞： 1 mosMail和JosIsValidEmail函数中存在输入验证错误。 2 PEAR.php中存在安全漏洞。 3 globals.php没有包含在administrator/index.php中。 4 由于缺少defined 'VALIDMOS' 检查以及Admin "Upload Image"、Admin "Popups"和"comcontent"功能中的错误，导致存在不充分的访问控制检查。 5 dopdf功能以及处理emailform...

SoftBB多个远程代码执行及信息泄露漏洞

SoftBB是一款基于WEB的论坛程序。 SoftBB v0.1中存在多个输入验证错误，如下： 1 在SQL查询时没有正确的验证对/addmembre.php文件中groupe参数及/moveto.php文件中select参数的输入，允许攻击者执行SQL注入攻击。 2 在PHP脚本中存储之前没有正确过滤对admin/saveopt.php中多个参数的输入，允许攻击者执行任意PHP代码。成功攻击可能要求管理员权限。 3 对index.php中page参数的输入没有正确的处理空的或无效的参数，允许攻击者判断安装路径。 SoftBB = 0.1...

Mambo/Joomla plugin.class.php脚本远程文件包含漏洞

Mambo（也被称为Joomla）是一款开放源代码的WEB内容管理系统。 Mambo在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 在Mambo的comcomprofiler文件夹的plugin.class.php脚本中： -----------------------plugin.class.php---------------------- ?php / Plugin handler @package Joomla @author various, JoomlaJoe and Beat / requireonce...

Linux Kernel SCSI ProcFS拒绝服务漏洞

BUGTRAQ ID: 14790 CVECAN ID: CVE-2005-2800 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的SCSI驱动的procfs接口中存在拒绝服务漏洞。本地攻击者可以反复读取/proc/scsi/sg/devices，而next iterator返回NULL或错误时没有正确的处理这种情况，耗尽kernel内存，导致拒绝服务。 Linux kernel = 2.6.13 Ubuntu Linux 5.0 4 powerpc Ubuntu Linux 5.0 4 i386 Ubuntu Linux 5.0 4...

VMSA-2006-0004 Cross site scripting vulnerability and other fixes

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2006-0004 Synopsis: Cross site scripting vulnerability and other fixes Knowledge base URL:http://kb.vmware.com/kb/2118366 Issue date:...

MyBB1.0.3-private.txt

\ORIGINAL ADVISORYimei addmimistrator Risk Level: high —————–Description————— There is some security bug in MyBB 1.0.3 software latest version fully patched file private.php that allows attacker performe an SQLINJECTION attack. bug is in result of poor checking quotations for user suplied...

UW-imapd fails to properly authenticate users when using CRAM-MD5

Overview A vulnerablility in an authentication method for the University of Washington IMAP server could allow a remote attacker to access any user's mailbox. Description The Internet Message Access Protocol IMAP is a method of accessing electronic messages kept on a remote mail server and is...

Important: Red Hat Security Advisory: mod_ssl security update

An updated modssl package for Apache that fixes a format string vulnerability is now available. The modssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL and Transport Layer Security TLS protocols. A format string issue was discovered in modssl for...

Multiple tools within the Netpbm package create temporary files in an insecure manner

Overview Multiple tools within the Netpbm package create temporary files in an insecure manner. Description Netpbm is a toolkit that contains over 220 separate tools for manipulating graphic images. Multiple tools within the Netpbm package create temporary files insecurely. --- Impact A local...

Linux kernel IP stack incorrectly calculates size of an ICMP citation for ICMP errors

Overview The Linux 2.0 kernel contains a vulnerability in the way it processes ICMP errors. This could lead to portions of memory being leaked to a malicious user. Description The Linux 2.0 kernel versions 2.0 through 2.0.39 inclusive contains an error in the calculation of the size for an ICMP...

Venturi Client 2.1 confirmed as open relay [Verizon Wireless Mobile Office]

Product: Fourelle|Venturi Wireless Venturi Client all versions prior to 2.2 Brief Description: Acts as an open proxy for protocols including SMTP. Description: Venturi Client is a multi-protocol proxy that operates in conjunction with a proprietary transcoding server. It inserts itself into the...

sendmail 8.12.8 available

-----BEGIN PGP SIGNED MESSAGE----- Sendmail, Inc., and the Sendmail Consortium announce the availability of sendmail 8.12.8. It contains a fix for a critical security problem discovered by Mark Dowd of ISS X-Force; we thank ISS X-Force for bringing this problem to our attention. Sendmail urges al...

Multiple IPsec implementations do not adequately validate authentication data

Overview IPsec implementations from multiple vendors do not adequately validate the authentication data in IPsec packets, exposing vulnerable systems to a denial of service. Description For background: RFC 2401 Security Architecture for the Internet Protocol RFC 2402 IP Authentication Header RFC...

Microsoft Windows 2000 vulnerable to DoS via malformed packets sent to port 445/tcp

Overview The default configuration of Microsoft Windows 2000 does not properly handle malformed packets received on TCP port 445. As a result, Windows may cease to function normally upon receipt of malformed packets on this port. Description Microsoft LAN Manager LANMAN is enabled by default on...

thttpd-219.txt

thttpd 2.19 and earlier server-side-includes CGI program ssi allows retrieval of arbitrary world-readable files Date: October 2, 2000 Application: thttpd 2.19 and before Author: ghandi Vendor Status: merged patches into thttpd 2.20 Fix: upgrade into thttpd 2.20 1. Description The included cgi-bin...

Michael Sandrof IrcII 4.4-7 - Remote Buffer Overflow

Michael Sandrof IrcII 4.4-7 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/1046/info IrcII is a well-known Internet Relay Chat IRC client for unix. Version 4.4-7 and possibly previous versions are known to be vulnerable to a buffer overflow condition in their direct...