Apple Mac OS X Directory Services contains a buffer overflow

Overview A buffer overflow in Apple Mac OS X Directory Service's authentication process may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Apple Mac OS X Server Directory Service provides reading, writing, and authentication services within...

Apple Mac OS X Safari vulnerable to arbitrary command execution via URLs in PDF files

Overview Apple Mac OS X WebKit and Safari security controls may be bypassed, possibly allowing remote command execution. Description Mac OS X includes the Safari web browser, which can display Portable Document Format PDF files directly. This functionality is part of the WebKit system framework...

EMC Legato NetWorker portmapper allows remote calls to "pmap_set" and "pmap_unset"

Overview The EMC Legato NetWorker PortMapper allows remote access to pmapset and pmapunset. This could allow a remote attacker to cause a denial of service or potentially to eavesdrop on communications between NetWorker programs. Description EMC Legato NetWorker is a cross-platform backup and...

EMC Legato NetWorker uses weak AUTH_UNIX authentication

Overview EMC Legato NetWorker uses weak AUTHUNIX authentication, allowing a remote attacker to execute arbitrary commands, gain elevated privileges, or cause a denial of service. Description EMC Legato NetWorker is a cross-platform backup and recovery application. It is also repackaged by Sun...

Adobe Acrobat contains a remotely exploitable buffer overflow

Overview A buffer overflow in Adobe Acrobat/Acrobat Reader may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition Description Adobe Acrobat is a suite of applications that allow users to manipulate PDF Portable Document Format files. A buffer within a core...

EMC Legato NetWorker database services use insufficient authentication

Overview The EMC Legato NetWorker database services use weak authentication, allowing a remote attacker to gain root access to the server. Description EMC Legato NetWorker is a cross-platform backup and recovery application. It is also repackaged by Sun Microsystems as Solstice Backup and StorEdg...

Novell eDirectory iMonitor vulnerable to buffer overflow

Overview Novell eDirectory iMonitor contains a buffer overflow that can be remotely exploited to allow execution of arbitrary code or crash an affected system. Description Novell eDirectory iMonitor is a service for monitoring servers in an eDirectory installation. A buffer overflow exists in...

GNOME gedit contains format string vulnerability

Overview gedit has a format string vulnerability in some error dialogs that can occur when a file is opened for editing. Description gedit is the official text editor of the GNOME desktop environment. gedit 2.10.2 has a format string error in some some error dialogs that can occur when a file is...

VERITAS Backup Exec uses hard-coded authentication credentials

Overview The VERITAS Backup Exec Remote Agent uses hard-coded authentication credentials. An attacker with knowledge of these credentials could access arbitrary files on a vulnerable system. Description VERITAS Backup Exec Remote Agent is a data backup and recovery solution with support for...

Microsoft Windows domain controller denial of service in Kerberos message handling

Overview Microsoft Windows domain controllers do not properly handle some Kerberos messages, potentially allowing a remote, authenticated attacker to cause a denial-of-service condition. Description Microsoft Windows domain controllers running Windows 2000 Server and Server 2003 use the Kerberos...

Microsoft Plug and Play contains a buffer overflow vulnerability

Overview Microsoft Plug and Play contains a flaw in the handling of message buffers that may result in local or remote arbitrary code execution or denial-of-service conditions. Description The following is from the Microsoft Plug and Play description: Plug and Play PnP allows the operating system...

Multiple COM objects cause memory corruption in Microsoft Internet Explorer

Overview Microsoft Internet Explorer IE allows instantiation of COM objects not designed for use in the browser, which may allow a remote attacker to execute arbitrary code or crash IE. Description Microsoft COMMicrosoft COM is a technology that allows programmers to create reusable software...

Microsoft Windows Remote Desktop Protocol service input validation vulnerability

Overview An input validation error in the Microsoft Remote Desktop Protocol RDP service may allow a remote attacker to cause a denial-of-service condition. Description Microsoft describes the Remote Desktop Protocol RDP as follows.RDP is based on, and is an extension of, the T.120 protocol family...

Microsoft Print Spooler service contains a buffer overflow

Overview A buffer overflow in the Microsoft Print Spooler service may allow a remote attacker to execute arbitrary code on a vulnerable system. Description According to Microsoft, the Print Spooler service is ...an executable file that is installed as a service. The spooler is loaded when the...

Microsoft Internet Explorer JPEG rendering library vulnerable to buffer overflow

Overview A vulnerability in the Microsoft Internet Explorer JPEG image rendering routines may allow an attacker to remotely execute arbitrary code. Description Microsoft Internet Explorer is a web browser that is available for a variety of platforms and devices. A flaw in the image rendering...

Computer Associates BrightStor ARCserve Backup Discovery Service vulnerable to buffer overflow

Overview The Computer Associates BrightStor ARCserve Backup Discovery Service contains a buffer overflow, which may allow a remote attacker to execute arbitrary code. Description Computer Associates BrightStor ARCserve Backup is a cross-platform backup and recovery application. The ARCserve Backu...

Computer Associates BrightStor ARCserve Backup Discovery Service SERVICEPC vulnerable to buffer overflow

Overview The Computer Associates BrightStor ARCserve Backup Discovery Service contains a buffer overflow, which may allow a remote attacker to execute arbitrary code. Description Computer Associates BrightStor ARCserve Backup is a cross-platform backup and recovery application. The ARCserve Backu...

Computer Associates BrightStor ARCserve Backup Agents vulnerable to buffer overflow

Overview Several Computer Associates BrightStor ARCserve Backup Agents contain a buffer overflow, which may allow a remote attacker to execute arbitrary code. Description Computer Associates BrightStor ARCserve Backup is a cross-platform backup and recovery application. Backup Agents are availabl...

Cisco IOS OSPF neighbor IO buffer overflow

Overview Cisco Internetwork Operating System IOS is the operating system for the majority of Cisco routers. Open Shortest-Path First OSPF is a interior routing protocol. A flaw in some Cisco IOS versions can allow a buffer overflow when handling a large number of OSPF neighbor connection requests...

Mozilla Firefox insecurely handles content from external applications

Overview Mozilla Firefox does not properly enforce domain restrictions on content sent by external applications, allowing a remote attacker to execute code on a vulnerable system. Description Mozilla Firefox can accept links from external applications, such as Flash and Quicktime. When such an...

Mozilla insecurely clones objects and member functions

Overview Mozilla fails to enforce security restrictions on cloned base objects. This may allow a remote attacker to execute arbitrary code on a vulnerable web browser. Description Mozilla supports the use of JavaScript to perform client side scripting. JavaScript uses prototyping as a way to...

Cisco IOS vulnerable to DoS or arbitrary code execution via specially crafted IPv6 packet

Overview Cisco Internetwork Operating System IOS IPv6 packet handling is vulnerable to a denial-of-service attack and may potentially be vulnerable to a flaw that allows arbitrary code execution. Description Cisco Systems devices running IOS that are configured to handle Internet Protocol version...

Some SSH servers on Microsoft Windows set insecure permissions for the host identification key file

Overview SSH provides remote, encrypted terminal access to hosts. Some SSH servers, when running on Microsoft Windows, set insecure permissions on the file storing the private SSH server hostkey. This could allow an authenticated user to obtain the SSH hostkey and use it to impersonate the server...

Oracle products contain multiple vulnerabilities

Overview Multiple vulnerabilities exist in numerous Oracle products. The impacts of these vulnerabilities are varied and may include remote execution of arbitrary code, the disclosure of sensitive information, and denial-of-service conditions Description Multiple vulnerabilities exist in numerous...

MIT Kerberos 5 allows unauthenticated attacker to cause MIT krb5 Key Distribution Center to free unallocated memory

Overview An unauthenticated attacker can cause MIT krb5 Key Distribution Center KDC to free unallocated memory, possibly leading to arbitrary code execution. Description Kerberos is a network authentication system which uses a trusted third party a KDC to authenticate clients and servers to each...

WebEOC handles sensitive information in an insecure manner

Overview WebEOC handles sensitive information in an insecure manor. As a result, sensitive information may be exposed to untrusted parties. Description WebEOC is a web-based crisis information management application that provides functions to gather, coordinate, and disseminate information betwee...

MIT Kerberos 5 contains double free vulnerability in "krb5_recvauth()" function

Overview An unauthenticated attacker can cause krb5recvauth function to free a block of memory twice, possibly leading to arbitrary code execution. Description Kerberos is a network authentication system that uses a trusted third party a KDC to authenticate clients and servers to each other. It i...

WebEOC implements weak algorithms to encrypt sensitive information

Overview WebEOC uses weak cryptographic algorithms to encrypt sensitive information. Description WebEOC is a web-based crisis information management application that provides functions to gather, coordinate, and disseminate information between emergency personnel and Emergency Operations Centers...

WebEOC is vulnerable to a denial-of-service condition via uploading large files

Overview WebEOC does not properly impose size limits on files that a user can upload. This may allow a authorized attacker to exhaust system resources leading to a denial-of-service condition. Description WebEOC is a web-based crisis information management application that provides functions to...

MIT Kerberos 5 allows unauthenticated attacker to cause MIT krb5 Key Distribution Center to overflow a heap buffer by one byte

Overview Unauthenticated attacker can cause MIT krb5 Key Distribution Center KDC to overflow a heap buffer by one byte, possibly leading to arbitrary code execution. Description Kerberos is a network authentication system which uses a trusted third party a KDC to authenticate clients and servers ...

WebEOC uses a global shared key

Overview WebEOC installations may use the a common secret key to encrypt data. If an attacker can retrieve this key from one site, they will be able to decipher all data encoded with the key across all WebEOC installations. Description WebEOC is a web-based crisis information management applicati...

WebEOC is vulnerable to cross-site scripting attacks

Overview WebEOC contains multiple cross-site scripting vulnerabilities that may allow a remote attacker to inject and execute arbitrary script using a vulnerable WebEOC site. Description WebEOC is a web-based crisis information management application that provides functions to gather, coordinate,...

WebEOC contains multiple SQL injection vulnerabilities

Overview WebEOC contains multiple SQL injection vulnerabilities that may allow attackers to execute sql queries, potentially viewing or modifying data, or executing database commands. Description WebEOC is a web-based crisis information management application that provides functions to gather,...

WebEOC privileges are based on client-side authorization

Overview WebEOC ties privileges and roles to client-side resources. If an attacker can access a resource directly, that attacker will be granted all the privileges associated with that resource. Description WebEOC is a web-based crisis information management application that provides functions to...

WebEOC account lock-out policy may allow a denial-of-service

Overview WebEOC account lock out policy may allow a remote attacker to disable user and system accounts resulting in a denial-of-service condition. Description WebEOC is a web-based crisis information management application that provides functions to gather, coordinate, and disseminate informatio...

Microsoft Word buffer overflow in font processing routine

Overview A buffer overflow in the font processing routine used by Microsoft Word may allow a remote attacker to execute code on a vulnerable system. Description Microsoft Word contains a buffer overflow in the routine that processes fonts. An remote attacker may be able to trigger the buffer...

Microsoft Color Management Module buffer overflow during profile tag validation

Overview Microsoft Color Management Module contains a flaw that may allow an attacker to execute arbitrary code. Description The Microsoft Color Management Module provides consistent color management operations between applications and devices, and transforms between colorspaces such as 'RGB' and...

AIX FTP server may not properly timeout ephemeral data ports

Overview The IBM AIX FTP server may be vulnerable to a denial-of-service condition when passive data ports are not closed properly. Description IBM AIX includes an FTP server, ftpd, which allows files to be transferred between hosts with the FTP protocol. This server is vulnerable to a condition...

zlib inflate() routine vulnerable to buffer overflow

Overview A buffer overflow in the zlib compression library may cause any application linked to zlib to improperly and immediately terminate. Description There is a buffer overflow in the zlib data-compression library caused by a lack of bounds checking in the inflate routine. If an attacker...

Ettercap contains a format string error in the "curses_msg()" function

Overview Ettercap has a format string vulnerability in the ncurses user interface. Description Ettercap is open-source software designed for man-in-the-middle attacks on LANs. Ettercap contains multiple user interfaces, including one written using ncurses, a library for manipulating text screens...

Apple Web Kit-based browsers may allow remote access to local filesystem contents

Overview Web browsers based on AppleWebKit may allow remote web sites to reference content on the local filesystem. This may allow an attacker to execute script within the security context of the local machine. Description Web browsers that allow remote web sites to reference content that resides...

Multiple PHP XML-RPC implementations vulnerable to code injection

Overview A vulnerability in a common PHP extension module could allow a remote attacker to execute code on a vulnerable system. Description XML-RPC is a specification and a set of implementations that allow software running on disparate operating systems and in different environments to make...

JVIEW Profiler (javaprxy.dll) COM object contains an unspecified vulnerability

Overview The JVIEW Profiler COM object contains an unspecified vulnerability, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft COMMicrosoft COM is a technology that allows programmers to create reusable software components that can be...

Microsoft Message Queuing vulnerable to buffer overflow

Overview Microsoft Message Queuing contains a buffer overflow vulnerability. This could allow a remote attacker to execute arbitrary code on the system running the vulnerable software. Description Microsoft Message Queuing MSMQ is a component of Microsoft Windows that provides messaging services...

XMLHttpRequest Object security bypass in Opera Web Browser

Overview The Opera Web Browser fails to properly enforce security restrictions on the XMLHttpRequest Object. This may allow a remote, unauthenticated attacker to insert content from potentially malicious web sites. Description The XMLHttpRequest Object is a scripting object that provides routines...

Microsoft Log Sink Class ActiveX control incorrectly marked "safe for scripting"

Overview The Microsoft Log Sink Class ActiveX control is incorrectly marked safe for scripting. This may allow a remote attacker to create or append to arbitrary files on a vulnerable system. Description ActiveXActiveX is a technology that allows programmers to create reusable software components...

VERITAS Backup Exec remote registry access validation vulnerability

Overview VERITAS Backup Exec contains a remote registry access validation vulnerability. Description VERITAS Backup Exec is a data backup and recovery solution with support for over the network backup.An access validation vulnerability in Backup Exec for Windows allows remote attackers to access...

VERITAS Backup Exec Remote Agent fails to properly validate authentication requests

Overview Backup Exec Remote Agent for Windows Servers contains a buffer overflow vulnerability due to incorrect validation on authentication requests. Description VERITAS Backup Exec is a data backup and recovery solution with support for over the network backup. The VERITAS Backup Exec Agent run...

VERITAS Backup Exec Server Service contains a buffer overflow vulnerability

Overview A heap-based buffer overflow in VERITAS Backup Exec Admin Plus Pack Option may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description VERITAS Backup Exec is a data backup and recovery solution with support for over the network backup.VERITA...

paFileDB fails to properly sanitize "query" parameter in "pafiledb.php"

Overview paFileDB works around the default "off" state for the "registerglobals" security directive in PHP and then fails to initialize the "query" variable, which can be used to inject arbitrary SQL queries. Description "paFileDB is designed to allow webmasters have a database of files for...