VARIoT IoT vulnerabilities database

The D-Link DI-614 + SOHO router running in firmware 2.30 and the DI-704 SOHO router running in firmware 2.60B2 have vulnerabilities that could allow remote attackers to inject arbitrary scripts or HTML programs using the DHCP HOSTNAM option requested by DHCP. It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log. An attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP hostnames, that when sent to the router, will be logged for later viewing by the administrator of the device. The injected HTML can be used to cause the administrator to make unintended changes to the configuration of the router. Other attacks may be possible. Although only the DI-614+, DI-704, and the DI-624 are reported vulnerable, code reuse across devices is common and other products may also be affected

Multiple unknown vulnerabilities in Linux kernel 2.4 and 2.6 allow local users to gain privileges or access kernel memory, as found by the Sparse source code checking tool. The Linux kernel is reported prone to multiple device-driver issues. These issues were found during a recent audit of the Linux kernel source. Local attackers can exploit these vulnerabilities to elevate privileges or conduct denial-of-service attacks on the system. The affected device drivers are: aironet, asus_acpi, decnet, mpu401, msnd, and pss. -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: kernel Announcement-ID: SUSE-SA:2004:020 Date: Tuesday, Jul 2nd 2004 18:00 MEST Affected products: 8.0, 8.1, 8.2, 9.0, 9.1 SUSE Linux Database Server, SUSE eMail Server III, 3.1 SUSE Linux Enterprise Server 7, 8 SUSE Linux Firewall on CD/Admin host SUSE Linux Connectivity Server SUSE Linux Office Server Vulnerability Type: local privilege escalation Severity (1-10): 6 SUSE default package: yes Cross References: CAN-2004-0495 CAN-2004-0496 CAN-2004-0497 CAN-2004-0535 CAN-2004-0626 Content of this advisory: 1) security vulnerability resolved: - chown: users can change the group affiliation of arbitrary files to the group they belong to - missing DAC check in chown(2): local privilege escalation - overflow with signals: local denial-of-service - pss, mpu401 sound driver: read/write to complete memory - airo driver: read/write to complete memory - ALSA: copy_from_user/copy_to_user confused - acpi_asus: read from random memory - decnet: write to memory without checking - e1000 driver: read complete memory problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - icecast - sitecopy - cadaver - OpenOffice_org - tripwire - postgresql* - mod_proxy - freeswan - ipsec-tools - less - libpng - pavuk - XFree86* - kdebase3 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Multiple security vulnerabilities are being addressed with this security update of the Linux kernel. Kernel memory access vulnerabilities are fixed in the e1000, decnet, acpi_asus, alsa, airo/WLAN, pss and mpu401 drivers. These vulnerabilities can lead to kernel memory read access, write access and local denial of service conditions, resulting in access to the root account for an attacker with a local account on the affected system. Missing Discretionary Access Control (DAC) checks in the chown(2) system call allow an attacker with a local account to change the group ownership of arbitrary files, which leads to root privileges on affected systems. An interesting variant of the missing checks is that the ownership of files in the /proc filesystem can be altered, while the changed ownership still does not allow the files to be accessed as a non-root user for to be able to exploit the vulnerability. Systems that are based on a version 2.4 kernel are not vulnerable to the /proc weakness, and exploitation of the weakness requires the use of the kernel NFS server (knfsd). If the knfsd NFS server is not activated (it is off by default), the vulnerability is not exposed. The only network-related vulnerability fixed with the kernel updates that are subject to this announcement affect the SUSE Linux 9.1 distribution only, as it is based on a 2.6 kernel. Found and reported to bugtraq by Adam Osuchowski and Tomasz Dubinski, the vulnerability allows a remote attacker to send a specially crafted TCP packet to a vulnerable system, causing that system to stall if it makes use of TCP option matching netfilter rules. In some rare configurations of the SUSE Linux 9.1 distribution, some users have experienced stalling systems during system startup. These problems are fixed with this kernel update. SPECIAL INSTALL INSTRUCTIONS: ============================== For the impatient: Run YOU (Yast2 Online Update, command "yast2 online_update" as root) to install the updates (semi) automatically, if you have a SUSE Linux 8.1 and newer system. For those who wish to install their kernel updates manually and for those who use a SUSE Linux 8.0 system: The following paragraphs will guide you through the installation process in a step-by-step fashion. The character sequence "****" marks the beginning of a new paragraph. In some cases, the steps outlined in a particular paragraph may or may not be applicable to your situation. Therefore, please make sure to read through all of the steps below before attempting any of these procedures. All of the commands that need to be executed are required to be run as the superuser (root). Each step relies on the steps before it to complete successfully. **** Step 1: Determine the needed kernel type Please use the following command to find the kernel type that is installed on your system: rpm -qf /boot/vmlinuz Following are the possible kernel types (disregard the version and build number following the name separated by the "-" character) k_deflt # default kernel, good for most systems. k_i386 # kernel for older processors and chipsets k_athlon # kernel made specifically for AMD Athlon(tm) family processors k_psmp # kernel for Pentium-I dual processor systems k_smp # kernel for SMP systems (Pentium-II and above) k_smp4G # kernel for SMP systems which supports a maximum of 4G of RAM kernel-64k-pagesize kernel-bigsmp kernel-default kernel-smp **** Step 2: Download the package for your system Please download the kernel RPM package for your distribution with the name as indicated by Step 1. The list of all kernel rpm packages is appended below. Note: The kernel-source package does not contain a binary kernel in bootable form. Instead, it contains the sources that the binary kernel rpm packages are created from. It can be used by administrators who have decided to build their own kernel. Since the kernel-source.rpm is an installable (compiled) package that contains sources for the linux kernel, it is not the source RPM for the kernel RPM binary packages. The kernel RPM binary packages for the distributions can be found at the locations below ftp://ftp.suse.com/pub/suse/i386/update/. 8.0/images/ 8.1/rpm/i586 8.2/rpm/i586 9.0/rpm/i586 9.1/rpm/i586 After downloading the kernel RPM package for your system, you should verify the authenticity of the kernel rpm package using the methods as listed in section 3) of each SUSE Security Announcement. **** Step 3: Installing your kernel rpm package Install the rpm package that you have downloaded in Steps 3 or 4 with the command rpm -Uhv --nodeps --force <K_FILE.RPM> where <K_FILE.RPM> is the name of the rpm package that you downloaded. Warning: After performing this step, your system will likely not be able to boot if the following steps have not been fully followed. If you run SUSE LINUX 8.1 and haven't applied the kernel update (SUSE-SA:2003:034), AND you are using the freeswan package, you also need to update the freeswan rpm as a dependency as offered by YOU (YaST Online Update). The package can be downloaded from ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/ **** Step 4: configuring and creating the initrd The initrd is a ramdisk that is loaded into the memory of your system together with the kernel boot image by the bootloader. The kernel uses the content of this ramdisk to execute commands that must be run before the kernel can mount its actual root filesystem. It is usually used to initialize SCSI drivers or NIC drivers for diskless operation. The variable INITRD_MODULES in /etc/sysconfig/kernel determines which kernel modules will be loaded in the initrd before the kernel has mounted its actual root filesystem. The variable should contain your SCSI adapter (if any) or filesystem driver modules. With the installation of the new kernel, the initrd has to be re-packed with the update kernel modules. Please run the command mk_initrd as root to create a new init ramdisk (initrd) for your system. On SuSE Linux 8.1 and later, this is done automatically when the RPM is installed. **** Step 5: bootloader If you run a SUSE LINUX 8.x, SLES8, or SUSE LINUX 9.x system, there are two options: Depending on your software configuration, you have either the lilo bootloader or the grub bootloader installed and initialized on your system. The grub bootloader does not require any further actions to be performed after the new kernel images have been moved in place by the rpm Update command. If you have a lilo bootloader installed and initialized, then the lilo program must be run as root. Use the command grep LOADER_TYPE /etc/sysconfig/bootloader to find out which boot loader is configured. If it is lilo, then you must run the lilo command as root. If grub is listed, then your system does not require any bootloader initialization. Warning: An improperly installed bootloader may render your system unbootable. **** Step 6: reboot If all of the steps above have been successfully completed on your system, then the new kernel including the kernel modules and the initrd should be ready to boot. The system needs to be rebooted for the changes to become active. Please make sure that all steps have completed, then reboot using the command shutdown -r now or init 6 Your system should now shut down and reboot with the new kernel. There is no workaround known. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Update packages will be available soon. - sitecopy The sitecopy package includes a vulnerable version of the neon library (CAN-2004-0179, CAN-2004-0398). Update packages will be available soon. - cadaver The cadaver package includes a vulnerable version of the neon library (CAN-2004-0179, CAN-2004-0398). Update packages will be available soon. - OpenOffice_org The OpenOffice_org package includes a vulnerable version of the neon library (CAN-2004-0179, CAN-2004-0398). Update packages will be available soon. - tripwire A format string bug in tripwire can be exploited locally to gain root permissions. New packages are available. - postgresql A buffer overflow in psqlODBC could be exploited to crash the application using it. E.g. a PHP script that uses ODBC to access a PostgreSQL database can be utilized to crash the surrounding Apache web-server. Other parts of PostgreSQL are not affected. New packages are available. - XDM/XFree86 This update resolves random listening to ports by XDM that allows to connect via the XDMCP. SUSE LINUX 9.1 is affected only. New packages are available. - mod_proxy A buffer overflow can be triggered by malicious remote servers that return a negative Content-Length value. This vulnerability can be used to execute commands remotely New packages are available. - freeswan A bug in the certificate chain authentication code could allow an attacker to authenticate any host against a FreeS/WAN server by presenting specially crafted certificates wrapped in a PKCS#7 file. The packages are currently being tested and will be available soon. - ipsec-tools The racoon daemon which is responsible for handling IKE messages fails to reject invalid or self-signed X.509 certificates which allows for man-in-the-middle attacks on IPsec tunnels established via racoon. The packages are currently being tested and will be available soon. - less This update fixes a possible symlink attack in lessopen.sh. The attack can be executed by local users to overwrite arbitrary files with the privileges of the user running less. New packages are available. - libpng This update adds a missing fix for CAN-2002-1363. New packages are available. - pavuk This update fixes a remotely exploitable buffer overflow in pavuk. Thanks to Ulf Harnhammar for reporting this to us. New packages are available. - kdebase3 This update fixes a possible attack on tmp files created at the first login of a user using KDE or at the first time running a KDE application. This bug can be exploited locally to overwrite arbitrary files with the privilege of the victim user. Just affects SUSE LINUX 9.1 New packages are available. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers around the world. While this service is considered valuable and important to the free and open source software community, many users wish to be certain as to be the origin of the package and its content before installing the package. There are two independent verification methods that can be used to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you have downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security@suse.de), the checksums offer proof of the authenticity of the package. We recommend against subscribing to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build@suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security@suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe@suse.com>. suse-security-announce@suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe@suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info@suse.com> or <suse-security-faq@suse.com> respectively. ===================================================================== SUSE's security contact is <security@suse.com> or <security@suse.de>. The <security@suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature must show proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de> #####-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- - -- - - | Roman Drahtm\xfcller <draht@suse.de> // "You don't need eyes to see, | SUSE Linux AG - Security Phone: // you need vision!" | N\xfcrnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBQOWPL3ey5gA9JdPZAQFFzQf+Mo5WmO40BDHakn4qD5rAcfU6H/0rhMpy Bi8r+g6GoSp/m2Zy+1O0Qn3jVb/iirVlnHH3DND1r/GunM3c5CTaMYt2Bt7PTOdt OsjD41lbiFlHDmmmaodROQvcrz7T67YU0gCtSKJdDfs2ATiiUOcyUQZNfi/PiEqD jwmKpP5c1NXSXPSwZ2f430itJA5iUqqVBeB1WHn63kOnIKtHBJ9c6uw3rZ99t1OA iud3L+VQSycb8xQSlOsuiaYW1S236VsogKWRbqY76eo7E2AnVQlMpcZkyW91/vfT WntQlZJAaGFX1q/IyGy+PGFPUoJjNc7H6jy5ZqJqXR5Sb0KrHfadCQ== =24bz -----END PGP SIGNATURE-----

Check Point Firewall-1 4.1 up to NG AI R55 allows remote attackers to obtain potentially sensitive information by sending an Internet Key Exchange (IKE) with a certain Vendor ID payload that causes Firewall-1 to return a response containing version and other information. This issue is due to a design error that may present sensitive information to an attacker. An attacker can leverage this issue to disclose information about the affected firewall product including the version number and various details about the firewall's capabilities. Furthermore this issue would facilitate fingerprinting or identifying a firewall by carrying out active scans. There are vulnerabilities in Check Point Firewall-1 version 4.1 up to NG AI R55

Cisco IOS 11.1(x) through 11.3(x) and 12.0(x) through 12.2(x), when configured for BGP routing, allows remote attackers to cause a denial of service (device reload) via malformed BGP (1) OPEN or (2) UPDATE messages. Multiple implementations of the Border Gateway Protocol (BGP) contain vulnerabilities related to the processing of UPDATE and OPEN messages. The impacts of these vulnerabilities appear to be limited to denial of service. During processing the offending packet the affected device will reset. It should be noted that this issue only affects devices with BGP enabled; BGP is not enabled by default. It has been reported that this issue would be very difficult to exploit as it would require injecting malicious packets into communication between trusted peers. An attacker may exploit this issue to cause the affected device to reset, taking several minutes to become functional. It is possible to create a persistent denial of service condition by continually transmitting malformed packets to the affected device. The vulnerability exists in Cisco IOS Releases 11.1(x) through 11.3(x) and 12.0(x) through 12.2(x)

Cisco CatOS 5.x before 5.5(20) through 8.x before 8.2(2) and 8.3(2)GLX, as used in Catalyst switches, allows remote attackers to cause a denial of service (system crash and reload) by sending invalid packets instead of the final ACK portion of the three-way handshake to the (1) Telnet, (2) HTTP, or (3) SSH services, aka "TCP-ACK DoS attack.". A vulnerability in Cisco CatOS may allow a remote attacker to cause a denial of service on an affected device. Cisco CatOS 5.x versions prior to 5.5(20) through 8.x versions prior to 8.2(2) and 8.3(2)GLX are vulnerable

The DNS proxy (DNSd) for multiple Symantec Gateway Security products allows remote attackers to poison the DNS cache via a malicious DNS server query response that contains authoritative or additional records. It is reported that dnsd is prone to a cache poisoning vulnerability. Dnsd does not ensure that the data returned from a remote DNS server contains related information about the requested records. An attacker could exploit this vulnerability to deny service to legitimate users by redirecting traffic to inappropriate hosts. Man-in-the-middle attacks, impersonation of sites, and other attacks may be possible. Symantec Enterprise Firewall is an enterprise-class firewall that includes DNSD proxy. Symantec Enterprise Firewall has issues with its implementation of DNSD, which could be exploited by remote attackers for man-in-the-middle, fake site, or various other attacks. An attacker can control the DNS server and return a malicious response, resulting in the insertion of a fake DNS entry in the target system, thereby attacking Attackers can carry out attacks such as man-in-the-middle attacks/denial of service/social engineering

Cross-site scripting (XSS) vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to inject arbitrary web script or HTML via the next_file parameter. The problem presents itself when an attacker passes malicious HTML or script code to the application via the 'next_file' parameter of the 'main.cgi' script. Linksys Web Camera software version 2.10 is reportedly prone to this issue, however, it is possible that other versions are affected as well

Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "crash.c" program. The Linux kernel contains a denial-of-service vulnerability that allows local users to disable affected hosts. Linux Kernel Stores the process state of the floating point unit / Used to restore FSAVE/FRSTOR There are deficiencies in the handling of instructions. This issue is due to a design error that causes the kernel to fail to properly handle floating-point exceptions. This issue may be leveraged by an attacker to cause the affected system to crash, denying service to legitimate users. Although only select Linux kernels are reported to be affected, it is likely that various other versions are vulnerable as well. These issues were found during a recent audit of the Linux kernel source. The following drivers are reportedly affected by these issues: aironet asus_acpi decnet mpu401 msnd pss These issues may reportedly allow attackers to access kernel memory or gain escalated privileges on the affected computer. Local attackers can exploit these vulnerabilities to elevate privileges or conduct denial-of-service attacks on the system. The affected device drivers are: aironet, asus_acpi, decnet, mpu401, msnd, and pss. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1069-1 security@debian.org http://www.debian.org/security/ Martin Schulze, Dann Frazier May 20th, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : kernel-source-2.4.18,kernel-image-2.4.18-1-alpha,kernel-image-2.4.18-1-i386,kernel-image-2.4.18-hppa,kernel-image-2.4.18-powerpc-xfs,kernel-patch-2.4.18-powerpc,kernel-patch-benh Vulnerability : several Problem-Type : local/remote Debian-specific: no CVE IDs : CVE-2004-0427 CVE-2005-0489 CVE-2004-0394 CVE-2004-0447 CVE-2004-0554 CVE-2004-0565 CVE-2004-0685 CVE-2005-0001 CVE-2004-0883 CVE-2004-0949 CVE-2004-1016 CVE-2004-1333 CVE-2004-0997 CVE-2004-1335 CVE-2004-1017 CVE-2005-0124 CVE-2005-0528 CVE-2003-0984 CVE-2004-1070 CVE-2004-1071 CVE-2004-1072 CVE-2004-1073 CVE-2004-1074 CVE-2004-0138 CVE-2004-1068 CVE-2004-1234 CVE-2005-0003 CVE-2004-1235 CVE-2005-0504 CVE-2005-0384 CVE-2005-0135 Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. CVE-2004-0394 A buffer overflow in the panic handling code has been found. CVE-2004-0565 An information leak in the context switch code has been found on the IA64 architecture. CVE-2004-0685 Unsafe use of copy_to_user in USB drivers may disclose sensitive information. CVE-2005-0001 A race condition in the i386 page fault handler may allow privilege escalation. CVE-2004-0883 Multiple vulnerabilities in the SMB filesystem code may allow denial of service of information disclosure. CVE-2004-0949 An information leak discovered in the SMB filesystem code. CVE-2004-0997 A local privilege escalation in the MIPS assembly code has been found. CVE-2004-1335 A memory leak in the ip_options_get() function may lead to denial of service. CVE-2004-1017 Multiple overflows exist in the io_edgeport driver which might be usable as a denial of service attack vector. CVE-2005-0124 Bryan Fulton reported a bounds checking bug in the coda_pioctl function which may allow local users to execute arbitrary code or trigger a denial of service attack. CVE-2005-0528 A local privilege escalation in the mremap function has been found CVE-2003-0984 Inproper initialization of the RTC may disclose information. CVE-2004-1070 Insufficient input sanitising in the load_elf_binary() function may lead to privilege escalation. CVE-2004-1071 Incorrect error handling in the binfmt_elf loader may lead to privilege escalation. CVE-2004-1072 A buffer overflow in the binfmt_elf loader may lead to privilege escalation or denial of service. CVE-2004-1073 The open_exec function may disclose information. CVE-2004-1074 The binfmt code is vulnerable to denial of service through malformed a.out binaries. CVE-2004-1068 A programming error in the unix_dgram_recvmsg() function may lead to privilege escalation. CVE-2004-1234 The ELF loader is vulnerable to denial of service through malformed binaries. CVE-2005-0003 Crafted ELF binaries may lead to privilege escalation, due to insufficient checking of overlapping memory regions. CVE-2004-1235 A race condition in the load_elf_library() and binfmt_aout() functions may allow privilege escalation. CVE-2005-0504 An integer overflow in the Moxa driver may lead to privilege escalation. The following matrix explains which kernel version for which architecture fix the problems mentioned above: Debian 3.0 (woody) Source 2.4.18-14.4 Alpha architecture 2.4.18-15woody1 Intel IA-32 architecture 2.4.18-13.2 HP Precision architecture 62.4 PowerPC architecture 2.4.18-1woody6 PowerPC architecture/XFS 20020329woody1 PowerPC architecture/benh 20020304woody1 Sun Sparc architecture 22woody1 We recommend that you upgrade your kernel package immediately and reboot the machine. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get dist-upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEb9YGXm3vHE4uyloRAkhXAJ0e1RmUxVZSbQICFa/j07oKPfWRVwCeMrhj wYGegwosZg6xi3oI77opLQY= =eu/T -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-sparc-2.4_26woody1.dsc Size/MD5 checksum: 692 27f44a0eec5837b0b01d26c6cff392be http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-sparc-2.4_26woody1.tar.gz Size/MD5 checksum: 27768 6c719a6343c9ea0dad44a736b3842504 http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody5.dsc Size/MD5 checksum: 792 d7c89c90fad77944ca1c5a18327f31dd http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody5.tar.gz Size/MD5 checksum: 1013866 21b4b677a7a319442c8fe8a4c72eb4c2 http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19-4.woody3.dsc Size/MD5 checksum: 672 4c353db091e8edc4395e46cf8d39ec42 http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19-4.woody3.diff.gz Size/MD5 checksum: 71071 7012adde9ba9a573e1be66f0d258721a http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19.orig.tar.gz Size/MD5 checksum: 32000211 237896fbb45ae652cc9c5cecc9b746da Architecture independent components: http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-headers-2.4.18-sparc_22woody1_all.deb Size/MD5 checksum: 1521850 75d23c7c54094b1d25d3b708fd644407 http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-headers-2.4.19-sparc_26woody1_all.deb Size/MD5 checksum: 1547874 c6881b25e3a5967e0f6f9c351fb88962 http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody5_all.deb Size/MD5 checksum: 1014564 0e89364c2816f5f4519256a8ea367ab6 http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-doc-2.4.19_2.4.19-4.woody3_all.deb Size/MD5 checksum: 1785490 c66cef9e87d9a89caeee02af31e3c96d http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19-4.woody3_all.deb Size/MD5 checksum: 25902158 321403201a198371fd55c9b8ac4583f7 Sun Sparc architecture: http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-2.4.18-sun4u_22woody1_sparc.deb Size/MD5 checksum: 3923058 db7bbd997410667bec4ac713d81d60ea http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-2.4.18-sun4u-smp_22woody1_sparc.deb Size/MD5 checksum: 4044796 106fcb86485531d96b4fdada61b71405 http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-2.4.19-sun4u_26woody1_sparc.deb Size/MD5 checksum: 3831424 347b0c290989f0cc99f3b336c156f61d http://security.debian.org/pool/updates/main/k/kernel-image-sparc-2.4/kernel-image-2.4.19-sun4u-smp_26woody1_sparc.deb Size/MD5 checksum: 3952220 f7dd8326c0ae0b0dee7c46e24023d0a2 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-headers-2.4.19_2.4.19-0.020911.1.woody5_mips.deb Size/MD5 checksum: 3890804 7348a8cd3961190aa2a19f562c96fe2f http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-image-2.4.19-r4k-ip22_2.4.19-0.020911.1.woody5_mips.deb Size/MD5 checksum: 2080618 d52d00e7097ae0c8f4ccb6f34656361d http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-image-2.4.19-r5k-ip22_2.4.19-0.020911.1.woody5_mips.deb Size/MD5 checksum: 2080830 db7141d3c0d86a43659176f974599cc2 http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/mips-tools_2.4.19-0.020911.1.woody5_mips.deb Size/MD5 checksum: 15816 c31e3b72d6eac6f3f99f75ea838e0bf9 These files will probably be moved into the stable distribution on its next update

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rlanguage, and hits parameters, or (4) savecomment function in the Reviews module, as demonstrated using the uname parameter. NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-1023. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the a parameter of the 'Reviews' module. As a result of this issue an attacker could modify the logic and structure of database queries. Finally a remote denial of service vulnerability is reported to exist in the score subsystem of the 'Review' module of PHP-Nuke, it is reported that a large number supplied as a value for a parameter passed to the 'Reviews' module will deny service to legitimate PHP-Nuke users

The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large, out-of-range score parameter. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the a parameter of the 'Reviews' module. As a result of this issue an attacker could modify the logic and structure of database queries. A vulnerability exists in the Reviews module of PHP-Nuke versions 6.0 to 7.3

The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the a parameter of the 'Reviews' module. As a result of this issue an attacker could modify the logic and structure of database queries. Finally a remote denial of service vulnerability is reported to exist in the score subsystem of the 'Review' module of PHP-Nuke, it is reported that a large number supplied as a value for a parameter passed to the 'Reviews' module will deny service to legitimate PHP-Nuke users

SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. As a result of this issue an attacker could modify the logic and structure of database queries. Finally a remote denial of service vulnerability is reported to exist in the score subsystem of the 'Review' module of PHP-Nuke, it is reported that a large number supplied as a value for a parameter passed to the 'Reviews' module will deny service to legitimate PHP-Nuke users

Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability. PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application: PHP-Nuke is prone to multiple cross-site scripting vulnerabilities. These issues affect the 'Faq', 'Encyclopedia' and 'Reviews' modules. These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. PHP-Nuke is prone to an SQL Injection Vulnerability. Again the issue is due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the a parameter of the 'Reviews' module. As a result of this issue an attacker could modify the logic and structure of database queries. Finally a remote denial of service vulnerability is reported to exist in the score subsystem of the 'Review' module of PHP-Nuke, it is reported that a large number supplied as a value for a parameter passed to the 'Reviews' module will deny service to legitimate PHP-Nuke users. The send_review function in the Reviews module of PHP-Nuke 6.0 to 7.3 has a Canonicalize-before-filter error vulnerability

It has been reported that Cisco CatOS is vulnerable to a denial of service attack. Improper initial TCP handshakes can cause affected devices to cease functioning and reboot. These improper connections can originate from spoofed source addresses, making it easier for an attacker to accomplish a denial of service attack. This vulnerability is only accessible if the device is running telnet, HTTP, or SSH services. IOS is not affected by this vulnerability.

Absolute path traversal vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to read arbitrary files via an absolute pathname in the next_file parameter. Linksys Web Camera software version 2.10 is reportedly prone to this issue, however, it is possible that other versions are affected as well. Linksys Web Camera has an input validation vulnerability when processing user requests. The main.cgi program of Linksys Web Camera lacks sufficient inspection and filtering for the \'\'next_file\'\' parameter submitted by the user. If the system file name is submitted as a parameter, the attacker can read the content of the corresponding file

LaunchServices in Mac OS X 10.3.4 and 10.2.8 automatically registers and executes new applications, which could allow attackers to execute arbitrary code without warning the user. apple's Apple Mac OS X and Apple Mac OS X Server Exists in unspecified vulnerabilities.None. A security update has been released to address these issues and provide other enhancements. The following issues were reported: LaunchServices is reported prone to a vulnerability where the LaunchServices utility automatically registers applications. It is reported that an attacker may exploit this issue to register and run malicious applications. DiskImageMounter is reported prone to a vulnerability where the disk:// URI handler may be used to mount an anonymous remote file system. This attack can be achieved using the HTTP protocol. A remote attacker may exploit this vulnerability to write to the local disk. Safari is reported prone to an unspecified vulnerability where the Safari "Show in Finder" button, when invoked, would attempt to execute certain files instead of revealing the files in the finder window. An attacker may potentially exploit this condition to automatically execute files on the file system (including downloaded files). This could lead to privilege escalation or remote compromise. Some of these issues may already be described in previous BIDs. This BID will be split up into unique BIDs when further analysis of this update is complete. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2004-06-07 Security Update 2004-06-07 Description Security Update 2004-06-07 delivers a number of security enhancements and is recommended for all Macintosh users. The purpose of this update is to increase security by alerting you when opening an application for the first time via document mappings or a web address (URL). Discussion: LaunchServices is a system component that discovers and opens applications. This system component has been modified to only open applications that have previously been explicitly run on the system. Attempts to run an application that has not previously been explicitly run will result in a user alert. Further information is available in http://docs.info.apple.com/article.html?artnum=25785 Component: DiskImageMounter CVE-ID: No CVE ID has been reserved as this is only an additional preventative measure. Component: Terminal CVE-ID: Not applicable Impact: Attempts to use a telnet:// URI with an alternate port number fail. Discussion: A modification has been made to allow the specification of an alternate port number in a telnet:// URI. This restores functionality that was removed with the recent fix for CAN-2004-0485. ================================================ Security Update 2004-06-07 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: For Mac OS X v10.3.4 "Panther" and Mac OS X Server v10.3.4 ========================================================== http://www.apple.com/support/downloads/ Click on: Security Update 2004-06-07 (10.3.4) The download file is named: "SecUpd2004-06-07Pan.dmg" Its SHA-1 digest is: 182745485d8db3ea29ec67cb603cc5668a4f60d9 For Mac OS X v10.2.8 "Jaguar" and Mac OS X Server v10.2.8 ========================================================= http://www.apple.com/support/downloads/ Click on: Security Update 2004-06-07 (10.2.8) The download file is named: "SecUpd2004-06-07Jag.dmg" Its SHA-1 digest is: e5fa73f6a67bdcd9af76927d3416974f039b2087 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBQMTXipyw5owIz4TQAQJabgf/XdzbpuwKuBbVYQAVUl8mZd+Bs7QVdF2x sVJiNlgjyObJjTd5sjqCP9695enrEhClliNM+qOtoUcj0ed4gKIWtOBDzPuuYSb8 xjgb0ntbOg8VOoI5FX5o8dWRAmJu7SXDbnKNvpTgPfFl0Gb2spgGsX5aINGLD8iS h5SerdpJYDEMvXyAl/7Mnfz0TYH8ThWStRiEkEeaucD6Uc1yBDhUl3uV/jjHjvcp AFbaI14R/UNEypI4z0ylpH0a5tLG4CKOTAOwt68Kcs3Undbqbp8FvIUqD2Iy6fXF EtdF329mjgcaa7iDYnt2BXPvkRvthla+98flmjD9okzhM69x2t0Ubg== =JdW9 -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored

The "Show in Finder" button in the Safari web browser in Mac OS X 10.3.4 and 10.2.8 may execute downloaded applications, which could allow remote attackers to execute arbitrary code. This could allow an attacker to execute arbitrary code. apple's Apple Mac OS X and Apple Mac OS X Server Exists in unspecified vulnerabilities.None. A security update has been released to address these issues and provide other enhancements. The following issues were reported: LaunchServices is reported prone to a vulnerability where the LaunchServices utility automatically registers applications. It is reported that an attacker may exploit this issue to register and run malicious applications. DiskImageMounter is reported prone to a vulnerability where the disk:// URI handler may be used to mount an anonymous remote file system. This attack can be achieved using the HTTP protocol. A remote attacker may exploit this vulnerability to write to the local disk. An attacker may potentially exploit this condition to automatically execute files on the file system (including downloaded files). This could lead to privilege escalation or remote compromise. Some of these issues may already be described in previous BIDs. This BID will be split up into unique BIDs when further analysis of this update is complete. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2004-06-07 Security Update 2004-06-07 Description Security Update 2004-06-07 delivers a number of security enhancements and is recommended for all Macintosh users. The purpose of this update is to increase security by alerting you when opening an application for the first time via document mappings or a web address (URL). For more details, including a description of the new alert dialog box, please see: http://docs.info.apple.com/article.html?artnum=25785 Versions: Security Update 2004-06-07 is available for the following system versions: * Mac OS X v10.3.4 "Panther" * Mac OS X Server v10.3.4 "Panther" * Mac OS X v10.2.8 "Jaguar" * Mac OS X Server v10.2.8 "Jaguar" The following components are updated: Component: LaunchServices CVE-ID: CAN-2004-0538 Impact: LaunchServices automatically registers applications, which could be used to cause the system to run unexpected applications. Discussion: LaunchServices is a system component that discovers and opens applications. This system component has been modified to only open applications that have previously been explicitly run on the system. Attempts to run an application that has not previously been explicitly run will result in a user alert. Further information is available in http://docs.info.apple.com/article.html?artnum=25785 Component: DiskImageMounter CVE-ID: No CVE ID has been reserved as this is only an additional preventative measure. Component: Terminal CVE-ID: Not applicable Impact: Attempts to use a telnet:// URI with an alternate port number fail. Discussion: A modification has been made to allow the specification of an alternate port number in a telnet:// URI. This restores functionality that was removed with the recent fix for CAN-2004-0485. ================================================ Security Update 2004-06-07 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: For Mac OS X v10.3.4 "Panther" and Mac OS X Server v10.3.4 ========================================================== http://www.apple.com/support/downloads/ Click on: Security Update 2004-06-07 (10.3.4) The download file is named: "SecUpd2004-06-07Pan.dmg" Its SHA-1 digest is: 182745485d8db3ea29ec67cb603cc5668a4f60d9 For Mac OS X v10.2.8 "Jaguar" and Mac OS X Server v10.2.8 ========================================================= http://www.apple.com/support/downloads/ Click on: Security Update 2004-06-07 (10.2.8) The download file is named: "SecUpd2004-06-07Jag.dmg" Its SHA-1 digest is: e5fa73f6a67bdcd9af76927d3416974f039b2087 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBQMTXipyw5owIz4TQAQJabgf/XdzbpuwKuBbVYQAVUl8mZd+Bs7QVdF2x sVJiNlgjyObJjTd5sjqCP9695enrEhClliNM+qOtoUcj0ed4gKIWtOBDzPuuYSb8 xjgb0ntbOg8VOoI5FX5o8dWRAmJu7SXDbnKNvpTgPfFl0Gb2spgGsX5aINGLD8iS h5SerdpJYDEMvXyAl/7Mnfz0TYH8ThWStRiEkEeaucD6Uc1yBDhUl3uV/jjHjvcp AFbaI14R/UNEypI4z0ylpH0a5tLG4CKOTAOwt68Kcs3Undbqbp8FvIUqD2Iy6fXF EtdF329mjgcaa7iDYnt2BXPvkRvthla+98flmjD9okzhM69x2t0Ubg== =JdW9 -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored

NetGear WG602 (aka WG602v1) Wireless Access Point firmware 1.04.0 and 1.5.67 has a hardcoded account of username "super" and password "5777364", which allows remote attackers to modify the configuration. Netgear WG602 reportedly contains a default administrative account. This issue can allow a remote attacker to gain administrative access to the device. Netgear WG602 access point with firmware version 1.04.0 is reportedly affected by this issue. It is likely that other versions of the firmware are also vulnerable. It is reported that the new version (1.7.14) of the Firmware for WG602 is vulnerable to this issue as well, however, the username and password for the backdoor account has been changed. Remote attackers can use this vulnerability to modify the configuration

NetGear WG602 (aka WG602v1) Wireless Access Point 1.7.14 has a hardcoded account of username "superman" and password "21241036", which allows remote attackers to modify the configuration. Netgear WG602 reportedly contains a default administrative account. This issue can allow a remote attacker to gain administrative access to the device. Netgear WG602 access point with firmware version 1.04.0 is reportedly affected by this issue. It is likely that other versions of the firmware are also vulnerable. It is reported that the new version (1.7.14) of the Firmware for WG602 is vulnerable to this issue as well, however, the username and password for the backdoor account has been changed

PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string. PHP-Nuke is affected by a direct script access security vulnerability. This issue is due to a failure to properly validate the location and name of the file being accessed. This issue will allow an attacker to gain access to sensitive scripts such as the 'admin.php' script. The attacker may be able to exploit this unauthorized access to carry out attacks against the affected application. PHP-Nuke is a popular website creation and management tool, it can use many database software as backend, such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc