Cisco Catalyst reboots in response to an SSH "protocol mismatch" error

Overview Multiple versions of Cisco Catalyst switches contain a denial-of-service vulnerability that allows unauthenticated remote users to restart an affected device. Description Cisco Catalyst switches in the 6000, 5000, and 4000 series contain a vulnerability in their SSH support component. Th...

Ethereal contains multiple vulnerabilities in the UCP protocol dissector

Overview Ethereal contains multiple buffer overflows in the Universal Control Protocol UCP protocol dissector. These vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code. Description Ethereal is a network traffic analysis package. It includes the ability to...

Ethereal fails to properly decode Transaction IDs within TCAP packets

Overview Ethereal contains a vulnerability in the way the Transaction Capabilities Application Part TCAP protocol dissector parses ASN.1 encoded Transaction IDs within TCAP packets. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing TC...

Norton "WrapNISUM Class" (WrapUM.dll) ActiveX control allows remote arbitrary command execution

Overview Symantec's Norton Internet Security 2004 Professional is a software package that provides antivirus, antispam, and personal firewall applications. A vulnerability in an Symantec's Norton Internet Security 2004 suite may permit a remote attacker to execute arbitrary commands on the local...

Norton AntiSpam contains boundary error within the "SymSpamHelper Class" (symspam.dll) ActiveX component.

Overview Symantec's Norton AntiSpam is a software package that provides spam filtering. A vulnerability in an ActiveX control that ships with Norton AntiSpam may permit a remote attacker to execute arbitrary code on the local system. Description Symantec Norton AntiSpam for Windows installs the...

Ethereal ISUP protocol dissector fails to properly decode ISUP packets

Overview Ethereal fails to properly decode ISDN User Part ISUP packets containing an overly long Interworking Function Address IWFA value. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing ISUP data. There is a vulnerability in the wa...

Ethereal fails to properly decode BGP packets containing MPLS IPv6 labels

Overview Ethereal contains a vulnerability in the way the Border Gateway Protocol BGP protocol dissector decodes Multiprotocol Label Switching MPLS IPv6 labels. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing BGP data. According to...

Ethereal IrDA dissector plugin fails to properly parse IRCOM_PORT_NAME parameter

Overview Ethereal contains a vulnerability in the way the Infrared Data Association IrDA dissector plugin parses the IRCOMPORTNAME parameter. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing IrDA data. There is a vulnerability in the...

Ethereal contains multiple vulnerabilities in the IGAP protocol dissector

Overview Ethereal contains multiple buffer overflows in the Internet Group Membership Authentication Protocol IGAP protocol dissector. These vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code. Description Ethereal is a network traffic analysis package. It...

Ethereal crashes when processing malformed RADIUS packets

Overview Ethereal contains a vulnerability in the way it processes Remote Authentication Dial In User Service RADIUS packets. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing RADIUS data. There is a vulnerability that causes Ethereal...

Ethereal integer underflow when parsing malformed PGM packets with NAK lists

Overview Ethereal fails to properly parse Pragmatic General Multicast PGM packets containing a crafted negative acknowledgement NAK list. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing PGM data. There is a vulnerability in the way...

Apache HTTP Server vulnerable to DoS race condition in the handling of short-lived connections

Overview A race condition exists in Apache 2 HTTP Server that may cause a denial-of-service condition on some platforms. Description Apache HTTP Server versions 2.0.48 and prior contain a race condition in the handling of short-lived connections. According to the Apache anouncement, when using...

Ethereal fails to properly handle a zero-length Presentation protocol selector

Overview Ethereal fails to properly handle a zero-length Presentation protocol selector, which could cause Ethereal to crash. Description Ethereal is a network traffic analysis package. There is a vulnerability in the way Ethereal processes a zero-length Presentation protocol selector. Exploitati...

Ethereal fails to properly parse NetFlow UDP packets with an overly large template_entry count

Overview Ethereal fails to properly parse v9template structures in NetFlow UDP packets with an overly large templateentry count. This could allow an attacker to execute arbitrary code. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing...

Ethereal contains multiple vulnerabilities in the EIGRP protocol dissector

Overview Ethereal contains multiple vulnerabilities in the Enhanced Interior Gateway Routing Protocol EIGRP protocol dissector. These vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code. Description Ethereal is a network traffic analysis package. It includes t...

Ethereal fails to properly handle malformed color filter files

Overview Ethereal fails to properly handle malformed color filter files, which could allow an attacker to cause a segmentation fault. Description Ethereal is a network traffic analysis package. It provides a feature that allows a user to customize the foreground and background colors of packet...

Common Desktop Environment (CDE) dtlogin XDMCP parser improperly deallocates memory

Overview A "double-free" vulnerability in the CDE dtlogin program could allow a remote attacker to execute arbitrary code or cause a denial of service on a vulnerable system. Description The Common Desktop Environment CDE is an integrated graphical user interface that runs on UNIX and Linux...

util-linux login program discloses sensitive information

Overview util-linux login program uses a pointer that was previously freed and reallocated which could allow an attacker to gain access to sensitive information. Description util-linux is shipped with Red Hat and numerous other Linux distributions. It contains a collection of utility programs, su...

ModSecurity for Apache vulnerable to off-by-one overflow when directive "SecFilterScanPost" is enabled

Overview A vulnerability in the modsecurity module for Apache may permit a remote attacker to execute arbitrary code on the vulnerable web server. Description ModSecurity is an open source intrusion detection and prevention engine for web applications. The modsecurity module for Apache 2.0.X...

SSH Tectia Server contains a race condition when the password change plugin is enabled

Overview SSH Tectia Server contains a race condition that may permit an authenticated user access to the private key of the server. Exploitation of this vulnerability may lead to the ability to compromise the trust relationships of the vulnerable server. Description SSH Tectia Server versions 4.0...

HP-UX CDE library libDtSvc contains unspecified buffer overflow

Overview CDE, the default X Windows environment in HP-UX, ships with a libraray called libDtSvc. It has a locally-exploitable buffer overflow in some versions. Description Please see HP Security Bulletin HPSBUX0401-308 SSRT3492 for more details. --- Impact A local user may be able to gain...

Oracle Application Server Web Cache contains heap overflow vulnerability

Overview Oracle Application Server Web Cache contains a heap overflow vulnerability in the handling of client requests that could result in arbitrary code execution. Description The Oracle Web Cache acts as a reverse proxy, caching static and dynamic content generated from Oracle Application web...

Internet Security Systems Protocol Analysis Module (PAM) does not properly handle ICQ server response messages

Overview The Protocol Analysis Module PAM used by Internet Security Systems ISS intrusion detection and prevention products does not properly handle ICQ server response messages. An unauthenticated, remote attacker could execute arbitrary code by sending a specially crafted UDP packet. Descriptio...

F-Secure Anti-Virus for Linux fails to properly detect Sober.D virus

Overview F-Secure Anti-Virus for Linux contains a flaw that may prevent it from properly detecting the Sober.D virus. A hotfix for this vulnerability has been released. Description F-Secure Anti-Virus version 4.52 for Linux contains a flaw that may prevent it from properly detecting the Sober.D...

OpenSSL does not properly handle unknown message types

Overview OpenSSL does not properly handle unknown message types, allowing an unauthenticated, remote attacker to cause a denial of service. This vulnerability was addressed in OpenSSL 0.9.6d and 0.9.7. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Security TLS...

OpenSSL contains null-pointer assignment in do_change_cipher_spec() function

Overview OpenSSL contains a null-pointer assignment in the dochangecipherspec function which could allow a remote, unauthenticated attacker to cause OpenSSL to crash. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols and includes a general...

OpenSSL does not adequately validate length of Kerberos ticket during SSL/TLS handshake

Overview OpenSSL contains a vulnerability in code that processes SSL/TLS handshakes when configured to use the Kerberos cipher suites. This vulnerability could allow a remote attacker to cause OpenSSL to crash. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Securi...

cPanel fails to verify input passed to the "user" parameter

Overview A remotely exploitable vulnerability in CPanel's password reset and login scripts may allow a remote attacker to gain control of the vulnerable system. Description Cpanel is an application that provides the ability to manage accounts and provides an interface to the end users of web...

Apple Mac OS X "cd9660.util" buffer overflow

Overview A component utility in Apple's Mac OS X operating system suffers from a buffer overflow vulnerability in its handling of command-line arguments. This vulnerability could allow a local attacker to gain elevated privileges on the vulnerable system. Description Apple's Mac OS X operating...

Microsoft MSN Messenger fails to properly validate file requests

Overview Microsoft MSN Messenger fails to properly validate file requests which could allow an attacker to view the contents of files on the victim's system. Description Microsoft MSN Messenger is an instant messaging application that allows users to collaborate with friends using text messages,...

Microsoft Windows Media Services fails to properly validate TCP requests

Overview Microsoft Windows Media Services fails to properly validate TCP requests which could allow a remote, unauthenticated attacker to cause the services to refuse new TCP connections. Description Microsoft Windows Media Services is an optional component that provides the ability to deliver...

Linux kernel mremap(2) system call does not properly check return value from do_munmap() function

Overview A vulnerability in the Linux mremap2 system call could allow an authenticated, local attacker to execute arbitrary code with root privileges. Description The Linux kernel uses a linked list of vitrual memory area VMA descriptors to reference valid regions of the page table for a given...

Linux kernel do_mremap() call creates virtual memory area of 0 bytes in length

Overview There is a vulnerability in the Linux kernel memory management routines that allows local users to gain superuser privileges. Description The Linux kernel contains a vulnerability in the domremap call that allows software to create a virtual memory area VMA with a length of 0 bytes. This...

Microsoft Outlook fails to properly filter parameters passed via "mailto:" URL

Overview A vulnerability in the way that Microsoft Outlook 2002 handles a certain type of hyperlink could allow a remote attacker to execute arbitrary code on the vulnerable system. Description Microsoft Outlook provides a centralized application for managing and organizing e-mail messages,...

NetScreen Instant Virtual Extranet (IVE) platform contains cross-site scripting vulnerability in delhomepage.cgi

Overview NetScreen Instant Virtual Extranet IVE platform contains a cross-site scripting vulnerability in the row parameter of delhomepage.cgi, which could allow an attacker to mount a cross-site scripting attack. Description The Instant Virtual Extranet platform is an application security gatewa...

Libxml2 URI parsing errors in nanohttp and nanoftp

Overview Libxml is the XML parser for Gnome, a desktop suite and development platform for Linux systems. Libxml2, the latest version of the library as of this writing, has a buffer overflow vulnerability which may allow execution of arbitrary code. Description Gnome, a desktop suite and developme...

Apple Mac OS X TruBlueEnvironment vulnerable to buffer overflow

Overview Apple Mac OS X contains a buffer overflow in TruBlueEnvironment which could allow a local, authenticated attacker to execute arbitrary code with root privileges. Description Mac OS X allows older Macintosh applications to run in an environment called Classic. TruBlueEnvironment is part o...

IBM Net.Data db2www CGI interpreter fails to properly validate requested macro filenames

Overview IBM Net.Data fails to properly validate user input passed to the db2www CGI interpreter, which could allow an attacker to mount a cross-site scripting attack against a vulnerable system. Description IBM Net.Data is a scripting language used to create web applications. Net.Data macros are...

NTP service vulnerable to internal overflow if date / time offset is greater than 34 years

Overview NTP Network TIme Protocol contains an integer overflow vulnerability that may lead to clients receiving an incorrect date/time offset. Description NTP Network Time Protocol is a method by which client machines can synchronize the local date and time with a reference server. The server wi...

Sun Solaris passwd command allows for privilege escalation

Overview Sun Solaris contains a vulnerability in the passwd1 command which could allow for privilege escalation. Description The passwd command is used to update a user's authentication tokens. There is non-specific vulnerability identified in Sun Security Alert ID: 57454. This vulnerability coul...

Cisco CSS 11000 Series Content Services Switch vulnerable to DoS via malformed UDP packets

Overview Several models of the Cisco Content Services Switch contain a vulnerability in their management interface that allows an attacker to restart the switch, resulting in a denial of service attack. Description The Cisco CSS 11000 Series Content Services Switches contain a vulnerability in...

FreeBSD fails to limit number of TCP segments held in reassembly queue

Overview FreeBSD fails to limit the number of TCP segments held in a reassembly queue which could allow an attacker to exhaust all available memory buffers mbufs on the destination system resulting in a denial-of-service condition. Description The Transmission Control Protocol TCP is part of the...

Solaris conv_fix insecure file handling vulnerability

Overview A vulnerability in a program supplied with the Solaris printing system could allow a local attacker to gain elevated privileges on the system. Description The Solaris operating system from Sun Microsystems includes a number of supplemental programs to aid in configuration and maintenance...

WinZip vulnerable to buffer overflow in handling of MIME archive parameters

Overview A buffer overflow vulnerability in the WinZip program could allow a remote attacker to execute arbitrary code on a vulnerable system. Description WinZip Computing, Inc.'s WinZip is a popular utility for creating and extracting a variety of archive file formats on Microsoft Windows-based...

Internet Security Systems' BlackICE and RealSecure contain a heap overflow in the processing of SMB packets

Overview Internet Security Systems' BlackICE and RealSecure intrusion detection products contain a remotely exploitable vulnerability. Exploitation of this vulnerability could lead to the compromise of the system with privileges of the vulnerable process, typically the "SYSTEM" user. Description...

Oracle9i Database contains buffer overflow in NUMTODSINTERVAL() function

Overview Oracle9i Database contains a buffer overflow in the NUMTODSINTERVAL function which could allow anyone who can query the server to execute arbitrary code or access data with the privileges of the vulnerable process. Description A buffer overflow exists in the NUMTODSINTERVAL function. Thi...

Oracle9i Database contains buffer overflow in TIME_ZONE session parameter

Overview Oracle9i Database contains a buffer overflow in the TIMEZONE session parameter which could allow anyone who can query the server to execute arbitrary code or access data with the privileges of the vulnerable process. Description The TIMEZONE parameter is a session parameter that specifie...

Oracle9i Database contains buffer overflow in FROM_TZ() function

Overview Oracle9i Database contains a buffer overflow in the FROMTZ function which could allow anyone who can query the server to execute arbitrary code or access data with the privileges of the vulnerable process. Description A buffer overflow exists in the FROMTZ function. This function is...

Oracle9i Database contains buffer overflow in NUMTOYMINTERVAL() function

Overview Oracle9i Database contains a buffer overflow in the NUMTOYMINTERVAL function which could allow anyone who can query the server to execute arbitrary code or access data with the privileges of the vulnerable process. Description A buffer overflow exists in the NUMTOYMINTERVAL function. Thi...

Apple Mac OS X Point-to-Point Protocol daemon (pppd) contains format string vulnerability

Overview Apple Mac OS X Point-to-Point Protocol daemon contains a format string vulnerability in the handling of invalid command line arguments. Description The Point-to-Point Protocol PPP provides a method for transmitting datagrams over serial point-to-point links. There is a format string...