[gull-annonces] Resume SecurityFocus #404-410

Marc SCHAEFER schaefer at alphanet.ch
Sat Aug 11 10:33:58 CEST 2007


8E6 R3000 INTERNET FILTER MULTIPLE CROSS-SITE SCRIPTING
VULNERABILITIES
BugTraq ID: 24206
Last Updated: 2007-07-13
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24206
Summary:
  The 8e6 R3000 Internet Filter appliance is prone to multiple cross-
  site scripting vulnerabilities because it fails to properly sanitize
  user-supplied input.

  An attacker may leverage these issues to execute arbitrary script
  code in the browser of an unsuspecting user in the context of the
  affected device. This may help the attacker steal cookie-based
  authentication credentials and launch other attacks.

  Firmware versions prior to 2.0.05 are vulnerable.

[ firmware ]

APOP PROTOCOL INSECURE MD5 HASH WEAKNESS
BugTraq ID: 23257
Last Updated: 2007-06-27
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23257
Summary:
  Applications that implement the APOP protocol may be vulnerable to a
  password-hash weakness. This issue occurs because the MD5 hash
  algorithm fails to properly prevent collisions.

  Attackers may exploit this issue in man-in-the-middle attacks to
  potentially gain access to the first three characters of passwords.
  This will increase the likelihood of successful brute-force attacks
  against APOP authentication.

  To limit the possibility of successful exploits, applications that
  implement the APOP protocol should set up safeguards to ensure that
  message IDs are RFC-compliant.

  Mozilla Thunderbird, Evolution, mutt, and fetchmail are reportedly
  affected by this issue.

AASTRA 9112I SIP PHONE SIP MESSAGE DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 24537
Last Updated: 2007-06-19
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24537
Summary:
  Aastra 9112i SIP Phone is prone to a denial-of-service vulnerability
  because, the device fails to handle specially crafted SIP messages.

  An attacker can exploit this issue to crash the affected device,
  denying service to legitimate users.

  This issue affects Firmware 1.4.0.1049, Boot version: 1.1.0.10.

[ firmware ]

APACHE HTTP SERVER MOD_CACHE DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 24649
Last Updated: 2007-06-27
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24649
Summary:
  The Apache mod_cache module is prone to a denial-of-service
  vulnerability.

  A remote attacker may be able to exploit this issue to crash the
  child process. This could lead to denial-of-service conditions if
  the server is using a multithreaded Multi-Processing Module (MPM).

APACHE HTTP SERVER MOD_STATUS CROSS-SITE SCRIPTING VULNERABILITY
BugTraq ID: 24645
Last Updated: 2007-06-27
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24645
Summary:
  The Apache HTTP Server mod_status module is prone to a cross-site
  scripting vulnerability because the application fails to properly
  sanitize user-supplied input.

  An attacker may leverage this issue to execute arbitrary script code
  in the browser of an unsuspecting user in the context of the
  affected site. This may allow the attacker to steal cookie-based
  authentication credentials and to launch other attacks.

APACHE HTTP SERVER WORKER PROCESS MULTIPLE DENIAL OF SERVICE
VULNERABILITIES
BugTraq ID: 24215
Last Updated: 2007-07-13
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24215
Summary:
  Apache is prone to multiple denial-of-service vulnerabilities.

  An attacker with the ability to execute arbitrary server-side script-
  code can exploit these issues to stop arbitrary services on the
  affected computer in the context of the master webserver process;
  other attacks may also be possible.

APACHE MYFACES TOMAHAWK JSF FRAMEWORK AUTOSCROLL PARAMETER CROSS SITE
SCRIPTING VULNERABILITY
BugTraq ID: 24480
Last Updated: 2007-06-14
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24480
Summary:
  Apache Tomahawk MyFaces JSF Framework is prone to a cross-site
  scripting vulnerability because it fails to properly sanitize user-
  supplied input.

  Exploiting this vulnerability may allow an attacker to perform cross-
  site scripting attacks on unsuspecting users in the context of the
  affected website. As a result, the attacker may be able to steal cookie-
  based authentication credentials and to launch other attacks.

APACHE TOMCAT ACCEPT-LANGUAGE CROSS SITE SCRIPTING VULNERABILITY
BugTraq ID: 24524
Last Updated: 2007-06-19
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24524
Summary:
  Apache Tomcat is prone to a cross-site scripting vulnerability
  because the application fails to properly sanitize user-
  supplied input.

  An attacker can exploit this vulnerability to inject HTML and
  script code into the browser of an unsuspecting victim. The
  attacker may then steal cookie-based authentication credentials and
  launch other attacks.

  This issue may have been reported as part of the vulnerabilities
  described in BID 24058 (Apache Tomcat Documentation Sample
  Application Multiple Cross-Site Scripting Vulnerabilities). Symantec
  has not been able to confirm this information. We will update this
  BID when more information emerges.

APACHE TOMCAT JK CONNECTOR DOUBLE ENCODING SECURITY BYPASS
VULNERABILITY
BugTraq ID: 24147
Last Updated: 2007-06-18
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24147
Summary:
  Apache HTTP server running with the Tomcat JK Web Server Connector
  is prone to a security-bypass vulnerability because it decodes
  request URLs multiple times.

  Exploiting this issue allows attackers to access restricted files in
  the Tomcat web directory. This can expose sensitive information that
  could help attackers launch further attacks.

  This issue is present in versions of Apache Tomcat JK Connector
  prior to 1.2.23.

APACHE TOMCAT JSP EXAMPLE WEB APPLICATIONS CROSS SITE SCRIPTING
VULNERABILITY
BugTraq ID: 24476
Last Updated: 2007-07-17
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24476
Summary:
  Apache Tomcat is prone to a cross-site scripting vulnerability
  because it fails to properly sanitize user-supplied input.

  Exploiting this vulnerability may allow an attacker to perform cross-
  site scripting attacks on unsuspecting users in the context of the
  affected website. As a result, the attacker may be able to steal cookie-
  based authentication credentials and to launch other attacks.

APACHE TOMCAT MANAGER AND HOST MANAGER UPLOAD SCRIPT CROSS-SITE
SCRIPTING VULNERABILITY
BugTraq ID: 24475
Last Updated: 2007-07-17
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24475
Summary:
  Apache Tomcat Manager and Host Manager are prone to a cross-site
  scripting vulnerability because the applications fail to properly
  sanitize user-supplied input.

  An attacker may leverage this issue to execute arbitrary script
  code in the browser of an unsuspecting user. This may help the
  attacker steal cookie-based authentication credentials and launch
  other attacks.

APACHE TOMCAT MOD_JK.SO ARBITRARY CODE EXECUTION VULNERABILITY
BugTraq ID: 22791
Last Updated: 2007-07-09
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/22791
Summary:
  Apache Tomcat is prone to a vulnerability that will allow remote
  attackers to execute arbitrary code on an affected computer. A
  successful attack may result in a complete compromise.

ASTERISK IAX2 CHANNEL DRIVER IAX2_WRITE FUNCTION REMOTE STACK BUFFER
OVERFLOW VULNERABILITY
BugTraq ID: 24949
Last Updated: 2007-07-18
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24949
Summary:
  Asterisk is prone to a remote stack-based buffer-overflow
  vulnerability because the application fails to bounds-check user-
  supplied data before copying it into an insufficiently sized buffer.

  Successful exploits may allow an attacker to execute arbitrary
  machine code to compromise an affected computer or to cause a denial-of-
  service condition.

ASTERISK MULTIPLE REMOTE DENIAL OF SERVICE VULNERABILITIES
BugTraq ID: 24950
Last Updated: 2007-07-18
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24950
Summary:
  Asterisk is prone to multiple remote denial-of-service
  vulnerabilities.

  Exploiting these issues allows remote attackers to cause the
  application to crash, effectively denying service to
  legitimate users.

ASTERISK SIP T.38 SDP PARSING REMOTE STACK BUFFER OVERFLOW
VULNERABILITIES
BugTraq ID: 23648
Last Updated: 2007-07-04
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23648
Summary:
  Asterisk is prone to multiple remote stack-based buffer-overflow
  vulnerabilities because it fails to perform adequate boundary
  checks on user-supplied data before copying it to insufficiently
  sized buffers.

  Successful exploits may allow an attacker to execute arbitrary
  machine code to compromise an affected computer or to cause denial-of-
  service conditions.

  Versions prior to Asterisk Open Source 1.4.3, AsteriskNOW Beta 6,
  and Asterisk Appliance Developer Kit 0.4.0 are vulnerable.

  NOTE: These issues occur only when 't38 fax over SIP' is enabled in
        'sip.conf'.

AVAYA 4602SW SIP PHONE CNONCE PARAMETER AUTHENTICATION SPOOFING
VULNERABILITY
BugTraq ID: 24539
Last Updated: 2007-06-19
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24539
Summary:
  The Avaya 4602SW SIP Phone and SIP call server is prone to an
  authentication spoofing vulnerability.

  This allows an attacker to impersonate a SIP call server,
  compromising the confidentiality of a victim's phone conversations.

and

  The Avaya 4602SW SIP Phone is prone to a security-bypass
  vulnerability because it accepts SIP requests from random source IP
  addresses.

  An attacker can exploit this issue to bypass security
  restrictions. The attacker may then be able to transmit malicious
  messages to the device.

  This issue affects The Avaya 4602 SW IP Phone (Model 4602D02A).

[ firmware ]

CALDERA OPENLINUX 'SMAIL -D' COMMAND VULNERABILITY
BugTraq ID: 1268
Last Updated: 2007-07-16
Remote: No
Relevant URL: http://www.securityfocus.com/bid/1268
Summary:
According to the Caldera advisory (CSSA-1999:001.0),  smail's -D option names the debug file to use. If an attacker submits a UUCP job containing the following rmail invocation: 

  rmail -N -D /usr/lib/uucp/.rhosts -oMs "joe\nhostname user\n" uucp

  where '\n' is a newline, and 'hostname' and 'user' specify the
  attacking host and user, then 'smail' will happily append the
  following to the UUCP '.rhosts' file:

  rmail: Debugging started: pid=25919

  write_log:Received FROM:uucp HOST:joe hostname user PROGRAM:rmail
  SIZE:99 ... some more lines ...

  The attacker can then 'rsh' into the target host and try to exploit
  the UUCP account (e.g. by replacing the 'uux' binary).

  Note that this hole is also exploitable locally; all you have to do
  is call 'uux rmail ....' to make it work.

[ smail ... is obsolete for decades. And even ALPHANET dropped UUCP in
  2003 :->
]

CENTERICQ MULTIPLE REMOTE BUFFER OVERFLOW VULNERABILITIES
BugTraq ID: 24854
Last Updated: 2007-07-11
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24854
Summary:
  Centericq is prone to multiple remote buffer-overflow
  vulnerabilities because the application fails to properly bounds-
  check user-supplied input before copying it to an insufficiently
  sized memory buffer

  An attacker can exploit these issues to execute arbitrary code
  within the context of the affected application. Failed exploit
  attempts will result in a denial of service.

CISCO IOS IPV6 PROCESSING ARBITRARY CODE EXECUTION VULNERABILITY
BugTraq ID: 14414
Last Updated: 2007-06-27
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/14414
Summary:
  A remote arbitrary code execution vulnerability affects the IPv6
  processing functionality of Cisco IOS.

  A successful attack may allow a remote attacker to execute arbitrary
  code and gain unauthorized access to the device. An attacker can
  also leverage this issue to cause an affected device to reload,
  denying service to legitimate users.

  This issue may be related to BID 12368 (Cisco IOS IPv6 Processing
  Remote Denial Of Service Vulnerability).

  Cisco has stated that exploitation of this vulnerability in Cisco
  IOS XR may cause the IPv6 neighbor discovery process to restart. If
  exploited repeatedly, this could result in a prolonged denial of
  service affecting IPv6 traffic travelling through the device.

[ firmware ]

CISCO IOS SSL PACKETS MULTIPLE DENIAL OF SERVICE VULNERABILITIES
BugTraq ID: 24097
Last Updated: 2007-06-27
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24097
Summary:
  Cisco IOS is prone to multiple denial-of-service vulnerabilities
  because it fails to handle malformed SSL packets.

  Attackers can exploit these issues to cause denial-of-service
  conditions on an affected device.

  NOTE: Attackers can exploit these issues only via an established TCP
        connection, but only prior to security authentication. An
        attacker can, however, interrupt a secure session and inject
        malicious packets when a new session is started. Due to these
        factors, the likelihood of successful attacks is reduced.

[ firmware ]

CISCO WIRELESS CONTROL SYSTEM MULTIPLE SECURITY VULNERABILITIES
BugTraq ID: 18701
Last Updated: 2007-06-04
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/18701
Summary:
  Cisco Wireless Control System is prone to multiple security
  vulnerabilities.

  The following issues have been disclosed:

  - Authorization-bypass vulnerability due to multiple hardcoded
    username and password pairs
  - Arbitrary file access vulnerability
  - Cross-site scripting vulnerability
  - Information-disclosure vulnerability

  An attacker can exploit these issues to retrieve potentially
  sensitive information, overwrite files, perform cross-site
  scripting attacks, and gain unauthorized access; other attacks are
  also possible.

[ firmware ]

CLAM ANTIVIRUS CLAMAV OLE2 PARSER REMOTE DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 24316
Last Updated: 2007-06-15
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24316
Summary:
  ClamAV is prone to a denial-of-service vulnerability when handling
  malformed OLE2 files.

  A successful attack may allow an attacker to cause denial-of-service
  conditions.

  Versions prior to ClamAV 0.90.3 are affected.

CLAM ANTIVIRUS CLAMAV RAR HANDLING REMOTE DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 24289
Last Updated: 2007-06-15
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24289
Summary:
  ClamAV is prone to a denial-of-service vulnerability.

  A successful attack may allow an attacker to cause denial-of-service
  conditions.

CLAMAV MULTIPLE UNSPECIFIED VULNERABILITIES
BugTraq ID: 24358
Last Updated: 2007-06-15
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24358
Summary:
  ClamAV is prone to multiple unspecified vulnerabilities.

  These issues arise because the software incorrectly calculates the
  end of a buffer and gives improper permissions to temporary files.

  Versions prior to ClamAV 0.90.3 are vulnerable to these issues.

CURL GNUTLS CERTIFICATE VERFICATION ACCESS VALIDATION VULNERABILITY
BugTraq ID: 24938
Last Updated: 2007-07-18
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24938
Summary:
  Curl is prone to a vulnerability that permits an attacker to access
  unauthorized websites. The attacker may then launch other attacks.

  This issue affects versions prior to Curl 7.16.14. Other
  applications using the 'libcurl' library are also affected.

D-LINK DWL-G650 TIM INFORMATION ELEMENT WIRELESS DRIVER BEACON BUFFER
OVERFLOW VULNERABILITY
BugTraq ID: 24438
Last Updated: 2007-06-13
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24438
Summary:
  The D-Link Wireless Device Driver for DWL-G650 devices is prone to a
  buffer-overflow vulnerability because the driver fails to properly
  bounds-check user-supplied data before copying it into an
  insufficiently sized memory buffer.

  Exploiting this issue potentially allows attackers to execute
  arbitrary machine code in the context of the kernel hosting the
  vulnerable driver. Failed attempts will likely crash the kernel,
  resulting in denial-of-service conditions.

  D-Link DWL-G650 6.0.0.18 (Rev. A1) is reported vulnerable; other
  versions may also be affected.

[ firmware ]

DISK ARCHIVE FLAWED BLOWFISH-CBC CRYPTOGRAPHY IMPLEMENTATION WEAKNESS
BugTraq ID: 24930
Last Updated: 2007-07-17
Remote: No
Relevant URL: http://www.securityfocus.com/bid/24930
Summary:
  Disk ARchive ('dar') is prone to a design error in its cryptographic
  Blowfish-CBC implementation.

  The application contains two unique flaws that contribute to a
  weakening of the protections provided under its Blowfish-CBC mode.

  Versions prior to 'dar' 2.3.4 are vulnerable to this issue.

EXIF LIBRARY EXIF FILE PROCESSING INTEGER OVERFLOW VULNERABILITY
BugTraq ID: 24461
Last Updated: 2007-07-04
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24461
Summary:
  The 'libexif' library is reported prone to an integer-overflow
  vulnerability. Reportedly, the issue presents itself when the
  affected library is processing malformed EXIF files.

  Attackers may leverage this issue to execute arbitrary code in the
  context of an application that is linked to the vulnerable library.
  Failed exploit attempts will likely result in denial-of-service
  conditions.

  This issue affects 'libexif' 0.6.13 to 0.6.15; other versions may
  also be affected.

FILE MULTIPLE DENIAL OF SERVICE VULNERABILITIES
BugTraq ID: 24146
Last Updated: 2007-07-10
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24146
Summary:
  The 'file' utility is prone to multiple denial-of-service
  vulnerabilities because it fails to handle exceptional conditions.

  An attacker could exploit this issue by enticing a victim to open a
  specially crafted file. A denial-of-service condition can occur.
  Arbitrary code execution may be possible, but Symantec has not
  confirmed this.

FILE(1) COMMAND FILE_PRINTF INTEGER UNDERFLOW VULNERABILITY
BugTraq ID: 23021
Last Updated: 2007-07-10
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23021
Summary:
  The file(1) command is prone to an integer-underflow vulnerability
  because the command fails to adequately handle user-supplied data.

  An attacker can leverage this issue to corrupt heap memory and
  execute arbitrary code with the privileges of a user running the
  command. A successful attack may result in the compromise of
  affected computers. Failed attempts will likely cause denial-of-
  service conditions.

  Versions prior to 4.20 are vulnerable.

FREETYPE TT_LOAD_SIMPLE_GLYPH() TTF FILE INTEGER OVERFLOW
VULNERABILITY
BugTraq ID: 24074
Last Updated: 2007-07-18
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24074
Summary:
  FreeType is prone to an integer-overflow vulnerability because it
  fails to properly validate TTF files.

  An attacker may exploit this issue by enticing victims into opening
  maliciously crafted TTF Files.

  Successful exploits will allow attackers to execute arbitrary code
  in the context in the context of applications that use the affected
  library. Failed exploit attempts will likely result in denial-of-
  service conditions.

  This issue affects FreeType 2.3.4 and prior versions.

FUJITSU PRIMERGY BX300 BLADE SERVER INFORMATION DISCLOSURE
VULNERABILITY
BugTraq ID: 24761
Last Updated: 2007-07-04
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24761
Summary:
  Fujitsu PRIMERGY BX300 is prone to a remote information-disclosure
  vulnerability because the device fails to properly authenticate
  users prior to granting access to sensitive information.

  Exploiting this issue allows remote attackers to gain access to
  potentially sensitive configuration information from affected
  devices. This may aid them in further attacks.

[ firmware ? ]

GD GRAPHICS LIBRARY PNG FILE PROCESSING DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 24089
Last Updated: 2007-06-14
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24089
Summary:
  The GD graphics library is prone to a denial-of-service
  vulnerability.

  An attacker can exploit this issue to cause denial-of-service
  conditions in applications implementing the affected library.

  GD graphics library 2.0.34 is reported vulnerable; other versions
  may be affected as well.

GDB DWARF MULTIPLE BUFFER OVERFLOW VULNERABILITIES
BugTraq ID: 19802
Last Updated: 2007-07-03
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/19802
Summary:
  GDB is prone to multiple buffer-overflow vulnerabilities because of
  insufficient bounds-checking when handling DWARF and DWARF2 data.

  Attackers could leverage this issue to run arbitrary code outside of
  a restricted environment; this may lead to privilege escalation.

GDB PROCESS_COFF_SYMBOL UPX FILE BUFFER OVERFLOW VULNERABILITY
BugTraq ID: 24291
Last Updated: 2007-06-04
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24291
Summary:
  GDB is prone to a buffer-overflow vulnerability because it fails
  to properly check bounds when handling specially crafted
  executable files.

  Attackers could leverage this issue to run arbitrary code outside of
  a restricted environment, which may lead to privilege escalation.
  Symantec has not confirmed code execution.

GIMP PSD FILE INTEGER OVERFLOW VULNERABILITY
BugTraq ID: 24745
Last Updated: 2007-07-04
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24745
Summary:
  GIMP is prone to an integer-overflow vulnerability because it fails
  to properly bounds-check user-supplied input data before copying it
  to an insufficiently sized memory buffer.

  Successful exploits of this vulnerability allow remote attackers to
  execute arbitrary machine code in the context of the affected
  application.

  GIMP 2.2.15 is vulnerable to this issue; other versions may also
  be affected.

GNU GLIBC LD.SO MASK DYNAMIC LOADER INTEGER OVERFLOW VULNERABILITY
BugTraq ID: 24758
Last Updated: 2007-07-03
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24758
Summary:
  GNU glibc is prone to an integer-overflow vulnerability because it
  fails to properly ensure that integer math operations do not result
  in overflow.

  An attacker can exploit this issue to execute arbitrary code with
  superuser privileges. Successfully exploiting this issue will result
  in the complete compromise of affected application. Failed exploit
  attempts will result in a denial-of-service.

  Versions 2.5 and prior vulnerable to this issue.

GNU IMAGE MANIPULATION PROGRAM MULTIPLE INTEGER OVERFLOW
VULNERABILITIES
BugTraq ID: 24835
Last Updated: 2007-07-10
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24835
Summary:
  GNU Image Manipulation Program (GIMP) is prone to multiple integer-
  overflow vulnerabilities because it fails to adequately bounds-check
  user-supplied data.

  An attacker can exploit these vulnerabilities to execute arbitrary
  code with the privileges of the user running GIMP. Failed exploit
  attempts will likely cause denial-of-service conditions.

  Versions prior to GIMP 2.2.16 are vulnerable.

GSAMBAD INSECURE TEMPORARY FILE CREATION VULNERABILITY
BugTraq ID: 24717
Last Updated: 2007-07-02
Remote: No
Relevant URL: http://www.securityfocus.com/bid/24717
Summary:
  GSAMBAD creates temporary files in an insecure manner.

  An attacker with local access could potentially exploit this issue
  to perform symlink attacks, overwriting arbitrary files in the
  context of the affected application.

  An attacker may leverage this issue to corrupt or overwrite
  arbitrary files with the privileges of an unsuspecting user that
  activated the affected application. Reportedly, attackers can
  exploit this issue to escalate privileges.

  All versions of GSAMBAD are considered to be vulnerable to
  this issue.

GNOME EVOLUTION DATA SERVER ARRAY INDEX MEMORY ACCESS VULNERABILITY
BugTraq ID: 24567
Last Updated: 2007-07-03
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24567
Summary:
  Evolution is prone to an input-validation error that attackers may
  exploit to execute arbitrary code. The vulnerability stems from an
  input-validation error for a critical array index value.

  Versions prior to Evolution Data Server 1.11.4 are vulnerable.

GNOME EVOLUTION FORMAT STRING VULNERABILITY
BugTraq ID: 23073
Last Updated: 2007-07-03
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23073
Summary:
  Gnome Evolution is prone to a format-string vulnerability.

  This issue presents itself because the application fails to properly
  sanitize user-supplied input before passing it as the format
  specifier in a shared memo.

  A successful attack may crash the application or possibly lead to
  arbitrary code execution. This may facilitate unauthorized access or
  privilege escalation in the context of the user running the
  application.

  Gnome Evolution version 2.8.2.1 is vulnerable to this issue; other
  versions may also be affected.

IBM HARDWARE MANAGEMENT CONSOLE UNSPECIFIED VULNERABILITY
BugTraq ID: 24844
Last Updated: 2007-07-10
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24844
Summary:
  IBM Hardware Management Console is prone to an unspecified
  vulnerability.

  Currently, very little is known about this issue. We will update
  this BID as more information emerges.

  This issue affects Hardware Management Console 7R3.1.0; other
  versions may also be affected.

[ firmware ]

IBM TOTALSTORAGE DS400 REMOTE TELNET BACKDOOR VULNERABILITY
BugTraq ID: 24452
Last Updated: 2007-06-13
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24452
Summary:
  IBM TotalStorage DS400 is prone to a remote telnet backdoor
  vulnerability. This issue occurs because of an undocumented telnet
  server as well as accounts without passwords that may be present in
  affected devices.

  Successfully exploiting this issue allows remote attackers to gain
  superuser-level access to affected devices.

  This issue affects devices with firmware version 4.15 installed;
  other versions may also be affected.

[ firmware ]

IPV6 PROTOCOL TYPE 0 ROUTE HEADER DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 23615
Last Updated: 2007-06-13
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23615
Summary:
  IPv6 protocol implementations are prone to a denial-of-service
  vulnerability due to a design error.

  Exploiting this issue allows attackers to cause denial-of-service
  conditions.

  This issue is related to the issue discussed in BID 22210 (Cisco IOS
  IPv6 Source Routing Remote Memory Corruption Vulnerability).

ISC BIND REMOTE DNSSEC VALIDATION DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 22231
Last Updated: 2007-06-18
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/22231
Summary:
  ISC BIND is prone to a remote denial-of-service vulnerability
  because the application fails to properly handle malformed DNSSEC
  validation requests.

  Successfully exploiting this issue allows remote attackers to crash
  affected DNS servers, denying further service to legitimate users.

ISC BIND REMOTE FETCH CONTEXT DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 22229
Last Updated: 2007-06-13
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/22229
Summary:
  ISC BIND is prone to a remote denial-of-service vulnerability
  because the application fails to properly handle unexpected
  DNS requests.

  Successfully exploiting this issue allows remote attackers to crash
  affected DNS servers, denying further service to legitimate users.

IMLIB BMP IMAGE _LOADBMP FUNCTION DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 24750
Last Updated: 2007-07-03
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24750
Summary:
  ImLib is prone to a denial-of-service vulnerability because the
  application fails to properly process certain BMP image files.

  Remote attackers may exploit this issue by enticing victims into
  opening maliciously crafted BMP files.

  An attacker could exploit this issue to cause denial-of-service
  conditions on applications using the affected library.

IMAGEMAGICK DCM XWD FORMATS MULTIPLE INTEGER OVERFLOW VULNERABILITIES
BugTraq ID: 23347
Last Updated: 2007-07-10
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23347
Summary:
  ImageMagick is prone to multiple integer-overflow vulnerabilities
  because it fails to adequately handle user-supplied data.

  An attacker can exploit these issues to execute arbitrary code in
  the context of the application. Failed exploit attempts will likely
  cause denial-of-service conditions.

  ImageMagick 6.2.9 through 6.3.3-4 are vulnerable.

IMAGEMAGICK XGETPIXEL/XINITIMAGE MULTIPLE INTEGER OVERFLOW
VULNERABILITIES
BugTraq ID: 23300
Last Updated: 2007-07-10
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23300
Summary:
  ImageMagick is prone to multiple integer-overflow vulnerabilities
  because it fails to properly validate user-supplied data.

  An attacker can exploit these issues to execute arbitrary code in
  the context of the application. Failed exploit attempts will likely
  cause denial-of-service conditions.

IMGSVR TEMPLATE PARAMETER LOCAL FILE INCLUDE VULNERABILITY
BugTraq ID: 24853
Last Updated: 2007-07-11
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24853
Summary:
  ImgSvr is prone to a local file-include vulnerability because it
  fails to sanitize user-supplied input.

  Attackers may exploit this issue to access files that may contain
  sensitive information.

IPUTILS RARPD REMOTE DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 23706
Last Updated: 2007-06-04
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23706
Summary:
  The 'iputils rarpd' program is affected by a remote denial-of-
  service vulnerability because the software fails to properly handle
  certain network packets.

  A successful attack allows a remote attacker to crash the
  application, denying further service to legitimate users.

KDE KONQUEROR ADDRESS BAR URI SPOOFING VULNERABILITY
BugTraq ID: 24912
Last Updated: 2007-07-16
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24912
Summary:
  KDE Konqueror is affected by a URI-spoofing vulnerability because it
  fails to adequately handle user-supplied data.

  An attacker may leverage this issue by padding the URI and inserting
  arbitrary content to spoof the source URI of a file presented to an
  unsuspecting user. This may lead to a false sense of trust because
  the victim may be presented with a source URI of a trusted site
  while interacting with the attacker's malicious site.

  Konqueror 3.5.7 are vulnerable; other versions may also be affected.

  UPDATE: This issue also affects the Opera browser. This BID
  originally tracked the issue for both products but has been split
  into two separate BIDs. The issue affecting Opera is now being
  tracked as BID 24917.

LEDGERSMB LOGIN.PL AUTHENTICATION BYPASS VULNERABILITY
BugTraq ID: 24940
Last Updated: 2007-07-18
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24940
Summary:
  LedgerSMB is prone to an authentication-bypass vulnerability.

  An attacker can exploit this issue to gain unauthorized access to
  the application.

  This issue affects LedgerSMB 1.2.6 and prior versions.

LIBEXIF EXIF_DATA_LOAD_DATA_ENTRY REMOTE INTEGER OVERFLOW
VULNERABILITY
BugTraq ID: 23927
Last Updated: 2007-07-04
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23927
Summary:
  The libexif library is prone to an integer-overflow vulnerability
  because the software fails to properly ensure that integer math
  operations do not result in overflows.

  Successful exploits of this vulnerability allow remote attackers to
  execute arbitrary machine code in the context of an application
  using the vulnerable library. Failed attempts will likely result in
  denial-of-service conditions.

  Versions of libexif prior to 0.6.14 are vulnerable to this issue.

LIBPNG GRAPHICS LIBRARY PNG_SET_SPLT REMOTE DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 21078
Last Updated: 2007-06-19
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/21078
Summary:
  LibPNG is reported prone to a denial-of-service vulnerability. The
  library fails to perform proper bounds-checking of user-supplied
  input, which leads to an out-of-bounds read error.

  Attackers may exploit this vulnerability to crash an application
  that relies on the affected library.

LIBPNG LIBRARY REMOTE DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 24000
Last Updated: 2007-07-03
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24000
Summary:
  The 'libpng' library is prone to a remote denial-of-service
  vulnerability because the library fails to handle malicious
  PNG files.

  Successful exploits may allow remote attackers to cause denial-of-
  service conditions on computers running the affected library.

  This issue affects 'libpng' 1.2.16 and prior versions.

LINUX KERNEL AIO_SETUP_RING LOCAL DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 22193
Last Updated: 2007-06-18
Remote: No
Relevant URL: http://www.securityfocus.com/bid/22193
Summary:
  The Linux kernel is prone to a local denial-of-service vulnerability
  because the kernel fails to properly initialize a variable.

  Exploiting this issue allows local attackers to cause kernel
  crashes, denying service to legitimate users.

LINUX KERNEL ATM SKBUFF DEREFERENCE REMOTE DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 20363
Last Updated: 2007-06-15
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/20363
Summary:
  The Linux kernel is prone to a remote denial-of-service
  vulnerability.

  This issue is triggered when the kernel processes incoming ATM data.

  Exploiting this vulnerability may allow remote attackers to crash
  the affected kernel, resulting in denial-of-service conditions.

  This issue affects only systems that have ATM hardware and are
  configured for ATM kernel support.

  Kernel versions from 2.6.0 up to and including 2.6.17 are vulnerable
  to this issue.

LINUX KERNEL APPLETALK ATALK_SUM_SKB FUNCTION DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 23376
Last Updated: 2007-07-09
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/23376
Summary:
  The Linux kernel is prone to a denial-of-service vulnerability. This
  issue presents itself when malformed AppleTalk frames are processed.

  An attacker can exploit this issue to crash host computers,
  effectively denying service to legitimate users.

  Versions prior to 2.6.20.5 are vulnerable.

LINUX KERNEL BINFMT_ELF PT_INTERP LOCAL INFORMATION DISCLOSURE
VULNERABILITY
BugTraq ID: 22903
Last Updated: 2007-06-18
Remote: No
Relevant URL: http://www.securityfocus.com/bid/22903
Summary:
  The Linux kernel is prone to a vulnerability in the Linux ELF binary
  loader. Exploiting this issue can allow local attackers to gain
  access to privileged information.

  An attacker may be able to obtain sensitive data that can
  potentially be used to gain elevated privileges.

  This issue is a variant of the vulnerability assigned CVE candidate
  ID CAN-2004-1073, which is documented in BID 11646.

  Linux Kernel versions in the 2.6.0 branch prior to 2.6.20 are
  vulnerable; versions in the 2.4.0 branch may also be affected.

LINUX KERNEL BLUETOOTH CAPI PACKET REMOTE BUFFER OVERFLOW
VULNERABILITY
BugTraq ID: 21604
Last Updated: 2007-06-18
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/21604
Summary:
  The Linux kernel is prone to a remote buffer-overflow vulnerability
  because the kernel fails to bounds-check user-supplied data before
  copying it into an insufficiently sized buffer.

  An attacker may exploit this issue to execute arbitrary code with
  kernel-level privileges, facilitating the complete compromise of
  affected computers. Failed exploit attempts will result in denial-of-
  service conditions.

  Versions prior to 2.4.33.5 are vulnerable to this issue.

LINUX KERNEL DECODE_CHOICES FUNCTION REMOTE DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 24818
Last Updated: 2007-07-10
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24818
Summary:
  The Linux kernel is prone to a remote denial-of-service
  vulnerability because it fails to handle certain H.323 data.

  Attackers can exploit this issue to crash the affected operating
  system, denying access to legitimate users.

  Versions prior to 2.6.21.6, 2.6.20.15, and 2.6.22 are vulnerable.

LINUX KERNEL DEV_QUEUE_XMIT LOCAL DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 22317
Last Updated: 2007-06-18
Remote: No
Relevant URL: http://www.securityfocus.com/bid/22317
Summary:
  The Linux Kernel is prone to a denial-of-service vulnerability.

  A local attacker can exploit this issue to corrupt data and cause
  the kernel to become unresponsive, denying further service to
  legitimate users.

LINUX KERNEL IPV6_GETSOCKOPT_STICKY MEMORY LEAK INFORMATION DISCLOSURE
VULNERABILITY
BugTraq ID: 22904
Last Updated: 2007-07-11
Remote: No
Relevant URL: http://www.securityfocus.com/bid/22904
Summary:
  Linux Kernel is prone to an information-disclosure vulnerability
  because it fails to handle unexpected user-supplied input.

  Successful exploits will allow attackers to obtain portions of
  kernel memory. Information harvested may be used in further attacks.

  Kernel versions 2.6.0 up to 2.6.20.1 are vulnerable to this issue.

LINUX KERNEL IPV6_SOCKGLUE.C NULL POINTER DEREFERENCE VULNERABILITY
BugTraq ID: 23142
Last Updated: 2007-07-09
Remote: No
Relevant URL: http://www.securityfocus.com/bid/23142
Summary:
  The Linux kernel is prone to a NULL-pointer dereference
  vulnerability.

  A local attacker can exploit this issue to crash the affected
  application, denying service to legitimate users. The attacker may
  also be able to execute arbitrary code with elevated privileges, but
  this has not been confirmed.

LINUX KERNEL IPV6 TCP SOCKETS LOCAL DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 23104
Last Updated: 2007-07-09
Remote: No
Relevant URL: http://www.securityfocus.com/bid/23104
Summary:
  The Linux kernel is prone to a denial-of-service vulnerability.

  Exploiting this issue allows local attackers to cause the kernel to
  crash, effectively denying service to legitimate users. Attackers
  may also be able to execute arbitrary code with elevated privileges,
  but this has not been confirmed.

  This issue affects the Linux kernel 2.6 series.

LINUX KERNEL ISDN PPP CCP RESET STATE TIMER DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 21883
Last Updated: 2007-06-15
Remote: No
Relevant URL: http://www.securityfocus.com/bid/21883
Summary:
  The Linux kernel is prone to a denial-of-service vulnerability
  because it fails to handle exceptional conditions.

  An attacker can exploit this issue to crash the affected kernel,
  denying service to legitimate users.

LINUX KERNEL ISDN PPP REMOTE DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 21835
Last Updated: 2007-06-15
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/21835
Summary:
  The Linux kernel is prone to a denial-of-service vulnerability.

  An attacker can exploit this issue to cause an affected kernel to
  crash, effectively denying service to legitimate users.

  Versions prior to 2.4.34 are vulnerable to this issue.

LINUX KERNEL ISO9660 DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 20920
Last Updated: 2007-06-18
Remote: No
Relevant URL: http://www.securityfocus.com/bid/20920
Summary:
  The Linux kernel is prone to a local denial-of-service
  vulnerability. This issue affects the code that handles the ISO9660
  filesystem.

  An attacker can exploit this issue to crash the affected computer,
  denying service to legitimate users.

LINUX KERNEL KEY_ALLOC_SERIAL() LOCAL DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 22539
Last Updated: 2007-06-15
Remote: No
Relevant URL: http://www.securityfocus.com/bid/22539
Summary:
  The Linux Kernel is prone to a denial-of-service vulnerability.

  A successful attack can allow local attackers to trigger a crash and
  deny service to legitimate users.

  Kernel versions 2.6.x are vulnerable.

LINUX KERNEL L2CAP AND HCI SETSOCKOPT MEMORY LEAK INFORMATION
DISCLOSURE VULNERABILITY
BugTraq ID: 23594
Last Updated: 2007-06-14
Remote: No
Relevant URL: http://www.securityfocus.com/bid/23594
Summary:
  Linux Kernel is prone to an information-disclosure vulnerability
  because it fails to handle unexpected user-supplied input.

  Successful exploits will allow attackers to view portions of kernel
  memory. Information harvested may be used in further attacks.

  Kernel versions 2.4.34.2 and prior are vulnerable to this issue.

LINUX KERNEL LISTXATTR LOCAL DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 22316
Last Updated: 2007-06-18
Remote: No
Relevant URL: http://www.securityfocus.com/bid/22316
Summary:
  The Linux Kernel is prone to a denial-of-service vulnerability.

  Successful exploits will result in denial-of-service conditions or
  potentially privilege escalation.

LINUX KERNEL MINCORE USER SPACE ACCESS LOCKING LOCAL DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 21663
Last Updated: 2007-06-18
Remote: No
Relevant URL: http://www.securityfocus.com/bid/21663
Summary:
  The Linux Kernel is prone to a denial-of-service vulnerability due
  to a design error.

  A local attacker can exploit this issue to cause the kernel to
  become unresponsive, denying further service to legitimate users.

  Linux Kernel versions prior to 2.4.33.6 are vulnerable.

LINUX KERNEL MULTIPLE IPV6 PACKET FILTERING BYPASS VULNERABILITIES
BugTraq ID: 20955
Last Updated: 2007-06-15
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/20955
Summary:
  The Linux kernel is prone to multiple IPv6 packet-filtering-
  bypass vulnerabilities because of insufficient handling of
  fragmented packets.

  An attacker could exploit these issues to bypass ip6_table filtering
  rules. This could result in a false sense of security because
  filtering rules set up by system administrators can be bypassed in
  order to access services that are otherwise protected.

LINUX KERNEL NETLINK_FIB_LOOKUP LOCAL DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 23677
Last Updated: 2007-06-15
Remote: No
Relevant URL: http://www.securityfocus.com/bid/23677
Summary:
  The Linux kernel is prone to a denial-of-service vulnerability. This
  issue presents itself when a NETLINK message is misrouted.

  A local attacker may exploit this issue to trigger an infinite-
  recursion stack-based overflow in the kernel. This results in a
  denial of service to legitimate users.

  Versions prior to 2.6.20.8 are vulnerable.

LINUX KERNEL NFSACL DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 22625
Last Updated: 2007-06-15
Remote: No
Relevant URL: http://www.securityfocus.com/bid/22625
Summary:
  The Linux kernel is prone to a local denial-of-service
  vulnerability.

  An attacker can exploit this issue to crash the affected computer,
  denying service to legitimate users.

  This issue affects the Linux kernel 2.6 series up to 2.6.20.

LINUX KERNEL OMNIKEY CARDMAN 4040 DRIVER LOCAL BUFFER OVERFLOW
VULNERABILITY
BugTraq ID: 22870
Last Updated: 2007-06-15
Remote: No
Relevant URL: http://www.securityfocus.com/bid/22870
Summary:
  The Linux kernel is prone to a local buffer-overflow vulnerability
  because it fails to properly bounds-check user-supplied input before
  using it in a memory copy operation.

  This issue allows local attackers to overwrite kernel memory with
  arbitrary data, potentially allowing them to execute malicious
  machine code in the context of affected kernels. Exploiting this
  vulnerability facilitates the complete compromise of affected
  computers.

  Linux kernel versions prior to 2.6.21-rc3 are affected by this
  issue.

LINUX KERNEL PPPOE SOCKET LOCAL DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 23870
Last Updated: 2007-06-14
Remote: No
Relevant URL: http://www.securityfocus.com/bid/23870
Summary:
  The Linux kernel is prone to a denial-of-service vulnerability.

  Exploiting this issue allows local attackers to exhaust memory
  resources and eventually cause the kernel to crash, effectively
  denying service to legitimate users.

  This issue affects the Linux kernel 2.6 series prior to 2.6.21-git8.

LINUX KERNEL PRNG ENTROPY WEAKNESS
BugTraq ID: 24390
Last Updated: 2007-06-14
Remote: No
Relevant URL: http://www.securityfocus.com/bid/24390
Summary:
  The Linux kernel is prone to a weakness that may result in weaker
  cryptographic security.

  Linux kernel versions prior to 2.6.21.4 are vulnerable to this
  issue.

  This weakness was initially discussed in BID 24376 (Linux Kernel
  Multiple Weaknesses and Vulnerabilities), but has been assigned its
  own record.

LINUX KERNEL SCTP CONNECTION DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 24376
Last Updated: 2007-07-10
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24376
Summary:
  The Linux kernel is prone to a denial-of-service vulnerability.

  Linux kernel versions prior to 2.6.21.4 are vulnerable to this
  issue.

  This BID initially discussed three weaknesses/vulnerabilities in the
  Linux kernel. These issues have been separated into the following
  individual records:

  24389 Linux Kernel CPUSet Tasks Memory Leak Information Disclosure
  Vulnerability 24390 Linux Kernel PRNG Entropy Weakness 24376 Linux
  Kernel SCTP Connection Denial Of Service Vulnerability

LINUX KERNEL USB DRIVER DATA QUEUE LOCAL DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 19033
Last Updated: 2007-06-14
Remote: No
Relevant URL: http://www.securityfocus.com/bid/19033
Summary:
  The Linux kernel is prone to a local denial-of-service
  vulnerability. This issue is due to a design error in the USB FTDI
  SIO driver.

  This vulnerability allows local users to consume all available
  memory resources, denying further service to legitimate users.

  This issue affects Linux kernel versions prior to 2.6.16.27.

LINUX KERNEL USBLCD MEMORY CONSUMPTION DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 24734
Last Updated: 2007-07-04
Remote: No
Relevant URL: http://www.securityfocus.com/bid/24734
Summary:
  The Linux Kernel is prone to a denial-of-service vulnerability
  because it fails to limit memory consumption by 'fast writers'.

  Attackers can exploit this issue to consume memory, resulting in denial-of-
  service conditions.

  Versions prior to 2.6.22-rc7 are vulnerable.

LINUX KERNEL UNMAP_HUGEPAGE_AREA LOCAL DENIAL OF SERVICE VULNERABILITY
BugTraq ID: 20362
Last Updated: 2007-06-18
Remote: No
Relevant URL: http://www.securityfocus.com/bid/20362
Summary:
  The Linux kernel is prone to a local denial-of-service vulnerability
  because the kernel fails to properly handle unexpected errors.

  Exploiting this issue allows local, unprivileged attackers to cause
  kernel crashes, denying service to legitimate users.

  Linux kernel versions 2.6.0 through 2.6.12 are vulnerable to
  this issue.

LINUX POWERPC KERNEL RESTORE_SIGCONTEXT LOCAL DENIAL OF SERVICE
VULNERABILITY
BugTraq ID: 24845
Last Updated: 2007-07-10
Remote: No
Relevant URL: http://www.securityfocus.com/bid/24845
Summary:
  The PowerPC Linux kernel is prone to a denial-of-service
  vulnerability.

  Exploiting this issue allows local attackers to corrupt memory
  resources and eventually cause the kernel to crash, effectively
  denying service to legitimate users.

  Note that this issue affects only the Linux kernel on PowerPC
  architectures.

MIT KERBEROS 5 KADMIND SERVER RPC TYPE CONVERSION STACK BUFFER
OVERFLOW VULNERABILITY
BugTraq ID: 24657
Last Updated: 2007-07-04
Remote: Yes
Relevant URL: http://www.securityfocus.com/bid/24657
Summary:
  Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is
  prone to a stack-based buffer-overflow vulnerability because the
  software fails to adequately bounds-check user-supplied data before
  copying it to an insufficiently sized buffer.

  An attacker can exploit this issue to execute arbitrary code with
  administrative privileges. A successful attack can result in the
  complete compromise of the application. Failed attempts will likely




More information about the gull-annonces mailing list