VARIoT IoT vulnerabilities database

VAR-200707-0108 | CVE-2007-3923 | Cisco WAE Used by appliances Cisco WAAS of CIFS Denial of service in network optimization (DoS) Vulnerability |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The Common Internet File System (CIFS) optimization in Cisco Wide Area Application Services (WAAS) 4.0.7 and 4.0.9, as used by Cisco WAE appliance and the NM-WAE-502 network module, when Edge Services are configured, allows remote attackers to cause a denial of service (loss of service) via a flood of TCP SYN packets to port (1) 139 or (2) 445. Cisco Wide Area Application Services software is prone to a remote denial-of-service vulnerability.
Exploiting this issue allows remote attackers to cause a device running the affected software to stop processing all types of traffic, effectively denying service to legitimate users.
Cisco WAAS 4.0.7 and 4.0.9 are affected.
NOTE: Only devices configured with Edge Services are vulnerable to this issue. There is a loophole in the implementation of WAAS, and a remote attacker may use this loophole to make the device unavailable. The CIFS function of WAAS software uses ports 139 and 445. This can be caused by network traffic sent directly to WAAS platforms or by automated systems such as host scanners, port scanners, or network worms.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
The vulnerability is caused due to an error in Edge Services, which
uses CIFS optimisation, when handling packets sent to ports 139/TCP
and 445/TCP.
The vulnerability is reported in WAE appliances and the NM-WAE-502
network modules running WAAS versions 4.0.7 or 4.0.9.
SOLUTION:
Update to version 4.0.11.
http://www.cisco.com/pcgi-bin/tablebuild.pl/waas40?psrtdcat20e2
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20070718-waas.shtml
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0110 | CVE-2007-3925 | Ipswitch IMail Server 2006 of imapd32.exe Vulnerable to buffer overflow |
CVSS V2: 6.5 CVSS V3: - Severity: MEDIUM |
Multiple buffer overflows in the IMAP service (imapd32.exe) in Ipswitch IMail Server 2006 before 2006.21 allow remote authenticated users to execute arbitrary code via the (1) Search or (2) Search Charset command. Ipswitch IMail Server is prone to multiple buffer-overflow vulnerabilities because the software fails to properly check boundaries on user-supplied data before copying it to an insufficiently sized buffer.
Successful attacks allow arbitrary code to run, facilitating the remote compromise of affected computers. Exploit attempts may also cause the application to crash.
Ipswitch IMail Server 2006 is vulnerable to these issues; other versions may also be affected. Ipswitch IMail Server is an American Ipswitch company's mail server running on the Microsoft Windows operating system. IMail bundles an IMAP daemon (imapd32.exe) that allows users to access mail.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
Ipswitch IMail Server/Collaboration Suite Multiple Buffer Overflows
SECUNIA ADVISORY ID:
SA26123
VERIFY ADVISORY:
http://secunia.com/advisories/26123/
CRITICAL:
Highly critical
IMPACT:
System access
WHERE:
>From remote
SOFTWARE:
IMail Server 2006
http://secunia.com/product/8653/
Ipswitch Collaboration Suite 2006
http://secunia.com/product/8652/
DESCRIPTION:
Some vulnerabilities have been reported in Ipswitch IMail Server and
Collaboration Suite, which can be exploited by malicious users and
malicious people to compromise a vulnerable system.
Vulnerabilities #1 and #2 are reported in version 6.8.8.1 of
imapd32.exe.
3) A boundary error in Imailsec can be exploited to cause a
heap-based buffer overflow and allows execution of arbitrary code.
4) A boundary error in "subscribe" can be exploited to cause a buffer
overflow. No further information is currently available.
Vulnerabilities #3 and #4 are reported in Ipswitch IMail Server and
Collaboration Suite prior to version 2006.21.
SOLUTION:
Update to IMail Server version 2006.21.
http://www.ipswitch.com/support/imail/releases/im200621.asp
Update to Ipswitch Collaboration Suite 2006.21.
http://www.ipswitch.com/support/ics/updates/ics200621.asp
PROVIDED AND/OR DISCOVERED BY:
1) Manuel Santamarina Suarez, reported via iDefense Labs.
2) An anonymous person, reported via iDefense Labs.
3, 4) The vendor credits TippingPoint and the Zero Day Initiative.
ORIGINAL ADVISORY:
IPSwitch:
http://www.ipswitch.com/support/imail/releases/im200621.asp
http://www.ipswitch.com/support/ics/updates/ics200621.asp
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=563
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0112 | CVE-2007-3927 | Ipswitch IMail Server 2006 Vulnerable to buffer overflow |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
Multiple buffer overflows in Ipswitch IMail Server 2006 before 2006.21 (1) allow remote attackers to execute arbitrary code via unspecified vectors in Imailsec and (2) allow attackers to have an unknown impact via an unspecified vector related to "subscribe.". Ipswitch IMail Server is prone to multiple buffer-overflow vulnerabilities because the software fails to properly check boundaries on user-supplied data before copying it to an insufficiently sized buffer.
Successful attacks allow arbitrary code to run, facilitating the remote compromise of affected computers. Exploit attempts may also cause the application to crash.
Ipswitch IMail Server 2006 is vulnerable to these issues; other versions may also be affected. Ipswitch IMail Server is an American Ipswitch company's mail server running on the Microsoft Windows operating system. The IMailsec.dll component uses the lstrcpyA() function to copy the data provided by the user to a fixed-length heap buffer when trying to authenticate the user, so an attacker can trigger an overflow by submitting an overlong authentication request, resulting in arbitrary code execution.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
Ipswitch IMail Server/Collaboration Suite Multiple Buffer Overflows
SECUNIA ADVISORY ID:
SA26123
VERIFY ADVISORY:
http://secunia.com/advisories/26123/
CRITICAL:
Highly critical
IMPACT:
System access
WHERE:
>From remote
SOFTWARE:
IMail Server 2006
http://secunia.com/product/8653/
Ipswitch Collaboration Suite 2006
http://secunia.com/product/8652/
DESCRIPTION:
Some vulnerabilities have been reported in Ipswitch IMail Server and
Collaboration Suite, which can be exploited by malicious users and
malicious people to compromise a vulnerable system.
1) A boundary error in the processing of the IMAP "SEARCH" command
can be exploited to cause a stack-based buffer overflow.
2) A boundary error in the processing of the IMAP "SEARCH CHARSET"
command can be exploited to cause a heap-based buffer overflow.
Vulnerabilities #1 and #2 are reported in version 6.8.8.1 of
imapd32.exe.
3) A boundary error in Imailsec can be exploited to cause a
heap-based buffer overflow and allows execution of arbitrary code.
4) A boundary error in "subscribe" can be exploited to cause a buffer
overflow. No further information is currently available.
Vulnerabilities #3 and #4 are reported in Ipswitch IMail Server and
Collaboration Suite prior to version 2006.21.
SOLUTION:
Update to IMail Server version 2006.21.
http://www.ipswitch.com/support/imail/releases/im200621.asp
Update to Ipswitch Collaboration Suite 2006.21.
http://www.ipswitch.com/support/ics/updates/ics200621.asp
PROVIDED AND/OR DISCOVERED BY:
1) Manuel Santamarina Suarez, reported via iDefense Labs.
2) An anonymous person, reported via iDefense Labs.
3, 4) The vendor credits TippingPoint and the Zero Day Initiative.
ORIGINAL ADVISORY:
IPSwitch:
http://www.ipswitch.com/support/imail/releases/im200621.asp
http://www.ipswitch.com/support/ics/updates/ics200621.asp
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=563
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200901-0467 | CVE-2007-2795 | Ipswitch IMail Server Multiple Buffer Overflow Vulnerabilities |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) the authentication feature in IMailsec.dll, which triggers heap corruption in the IMail Server, or (2) a long SUBSCRIBE IMAP command, which triggers a stack-based buffer overflow in the IMAP Daemon. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Ipswitch IMail and ICS server. Authentication is not required to exploit this vulnerability.The specific flaw resides in IMailsec.dll while attempting to authenticate users. The affected component is used by multiple services that listen on a default installation. The authentication mechanism copies user-supplied data into fixed length heap buffers using the lstrcpyA() function. The unbounded copy operation can cause a memory corruption resulting in an exploitable condition. Authentication is required to exploit this vulnerability.The specific flaw exists due to a lack of bounds checking during theparsing of arguments to the SUBSCRIBE IMAP command sent to the IMAP daemon listening by default on TCP port 143. By providing an overly long string as the argument, an exploitable stack-based buffer overflow occurs. Ipswitch IMail Server is prone to multiple buffer-overflow vulnerabilities because the software fails to properly check boundaries on user-supplied data before copying it to an insufficiently sized buffer.
Successful attacks allow arbitrary code to run, facilitating the remote compromise of affected computers. Exploit attempts may also cause the application to crash.
Ipswitch IMail Server 2006 is vulnerable to these issues; other versions may also be affected. Ipswitch IMail Server is an American Ipswitch company's mail server running on the Microsoft Windows operating system. IMail bundles an IMAP daemon (imapd32.exe) that allows users to access mail. ZDI-07-042: Ipswitch IMail Server GetIMailHostEntry Memory Corruption
Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-07-042.html
July 24, 2007
-- CVE ID:
CVE-2007-2795
-- Affected Vendor:
Ipswitch
-- Affected Products:
Ipswitch IMail
Ipswitch Collaboration Suite
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since July 24, 2007 by Digital Vaccine protection
filter ID 5224.
-- Vendor Response:
Ipswitch has issued an update to correct this vulnerability. More
details can be found at:
http://www.ipswitch.com/support/imail/releases/im200621.asp
-- Disclosure Timeline:
2007.02.26 - Vulnerability reported to vendor
2007.07.24 - Digital Vaccine released to TippingPoint customers
2007.07.24 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by Sebastian Apelt
(webmaster@buzzworld.org).
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, a division of 3Com, The Zero Day Initiative
(ZDI) represents a best-of-breed model for rewarding security
researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used.
3Com does not re-sell the vulnerability details or any exploit code.
Instead, upon notifying the affected product vendor, 3Com provides its
customers with zero day protection through its intrusion prevention
technology. Explicit details regarding the specifics of the
vulnerability are not exposed to any parties until an official vendor
patch is publicly available. Furthermore, with the altruistic aim of
helping to secure a broader user base, 3Com provides this vulnerability
information confidentially to security vendors (including competitors)
who have a vulnerability protection or mitigation product.
CONFIDENTIALITY NOTICE: This e-mail message, including any attachments,
is being sent by 3Com for the sole use of the intended recipient(s) and
may contain confidential, proprietary and/or privileged information.
Any unauthorized review, use, disclosure and/or distribution by any
recipient is prohibited. If you are not the intended recipient, please
delete and/or destroy all copies of this message regardless of form and
any included attachments and notify 3Com immediately by contacting the
sender via reply e-mail or forwarding to 3Com at postmaster@3com.com
VAR-200707-0246 | CVE-2007-3828 | Apple Mac OS X of mDNSResponder Vulnerable to arbitrary code execution |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in mDNSResponder in Apple Mac OS X allows remote attackers to execute arbitrary code via unspecified vectors, a related issue to CVE-2007-2386. The problem is CVE-2007-2386 The problem is related to.A third party may execute arbitrary code. Failed exploit attempts likely result in a denial-of-service condition.
NOTE: This has not been confirmed by any other researchers or the vendor. This vulnerability may be related to CVE-2007-2386. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201201-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: mDNSResponder: Multiple vulnerabilities
Date: January 20, 2012
Bugs: #290822
ID: 201201-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in mDNSResponder, which could
lead to execution of arbitrary code with root privileges.
Background
==========
mDNSResponder is a component of Apple's Bonjour, an initiative for
zero-configuration networking.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/mDNSResponder < 212.1 >= 212.1
Description
===========
Multiple vulnerabilities have been discovered in mDNSResponder. Please
review the CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All mDNSResponder users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/mDNSResponder-212.1"
NOTE: This is a legacy GLSA. Updates for all affected architectures are
available since November 21, 2009. It is likely that your system is
already no longer affected by this issue.
References
==========
[ 1 ] CVE-2007-2386
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2386
[ 2 ] CVE-2007-3744
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3744
[ 3 ] CVE-2007-3828
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3828
[ 4 ] CVE-2008-0989
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0989
[ 5 ] CVE-2008-2326
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2326
[ 6 ] CVE-2008-3630
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3630
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201201-05.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
VAR-200707-0279 | CVE-2007-3787 | eSoft InstaGate EX2 UTM Vulnerability to gain privileges on devices |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
The eSoft InstaGate EX2 UTM device does not require entry of the old password when changing the admin password, which might allow remote attackers to gain privileges by conducting a CSRF attack, making a password change from an unattended workstation, or other attacks. Instagate Ex2 Utm is prone to a denial-of-service vulnerability.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
eSoft InstaGate Cross-Site Request Forgery Vulnerability
SECUNIA ADVISORY ID:
SA26005
VERIFY ADVISORY:
http://secunia.com/advisories/26005/
CRITICAL:
Less critical
IMPACT:
Cross Site Scripting
WHERE:
>From remote
OPERATING SYSTEM:
eSoft InstaGate
http://secunia.com/product/14790/
DESCRIPTION:
Daniel Weber has reported a vulnerability in eSoft InstaGate, which
can be exploited by malicious people to conduct cross-site request
forgery attacks.
The vulnerability is caused due to the web interface of the device
allowing users to perform certain actions via HTTP requests without
performing any validity checks to verify the request. This can be
exploited e.g. to change certain settings or to change the
administrator's password by enticing a logged-in administrator to
visit a malicious site.
The vulnerability is reported in eSoft InstaGate EX2. Other versions
may also be affected.
SOLUTION:
Update to firmware version 3.1.20070615 or later.
PROVIDED AND/OR DISCOVERED BY:
Daniel Weber, Calyptix Security
ORIGINAL ADVISORY:
http://labs.calyptix.com/CX-2007-05.txt
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0280 | CVE-2007-3788 | eSoft InstaGate EX2 UTM Vulnerabilities in which important information is obtained on devices |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
The eSoft InstaGate EX2 UTM device stores the admin password within the settings HTML document, which might allow context-dependent attackers to obtain sensitive information by reading this document. Instagate Ex2 Utm is prone to a information disclosure vulnerability.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
eSoft InstaGate Cross-Site Request Forgery Vulnerability
SECUNIA ADVISORY ID:
SA26005
VERIFY ADVISORY:
http://secunia.com/advisories/26005/
CRITICAL:
Less critical
IMPACT:
Cross Site Scripting
WHERE:
>From remote
OPERATING SYSTEM:
eSoft InstaGate
http://secunia.com/product/14790/
DESCRIPTION:
Daniel Weber has reported a vulnerability in eSoft InstaGate, which
can be exploited by malicious people to conduct cross-site request
forgery attacks.
The vulnerability is caused due to the web interface of the device
allowing users to perform certain actions via HTTP requests without
performing any validity checks to verify the request. This can be
exploited e.g. to change certain settings or to change the
administrator's password by enticing a logged-in administrator to
visit a malicious site.
The vulnerability is reported in eSoft InstaGate EX2. Other versions
may also be affected.
SOLUTION:
Update to firmware version 3.1.20070615 or later.
PROVIDED AND/OR DISCOVERED BY:
Daniel Weber, Calyptix Security
ORIGINAL ADVISORY:
http://labs.calyptix.com/CX-2007-05.txt
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0278 | CVE-2007-3786 | esoft of instagate ex2 utm Vulnerability in |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Cross-site request forgery (CSRF) vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a former customer. esoft of instagate ex2 utm Exists in unspecified vulnerabilities.None. A remote attacker can perform privileged operations like an administrator.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
eSoft InstaGate Cross-Site Request Forgery Vulnerability
SECUNIA ADVISORY ID:
SA26005
VERIFY ADVISORY:
http://secunia.com/advisories/26005/
CRITICAL:
Less critical
IMPACT:
Cross Site Scripting
WHERE:
>From remote
OPERATING SYSTEM:
eSoft InstaGate
http://secunia.com/product/14790/
DESCRIPTION:
Daniel Weber has reported a vulnerability in eSoft InstaGate, which
can be exploited by malicious people to conduct cross-site request
forgery attacks. This can be
exploited e.g. to change certain settings or to change the
administrator's password by enticing a logged-in administrator to
visit a malicious site.
The vulnerability is reported in eSoft InstaGate EX2. Other versions
may also be affected.
SOLUTION:
Update to firmware version 3.1.20070615 or later.
PROVIDED AND/OR DISCOVERED BY:
Daniel Weber, Calyptix Security
ORIGINAL ADVISORY:
http://labs.calyptix.com/CX-2007-05.txt
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0241 | CVE-2007-3823 | IPSwitch WS_FTP of Logsrv.exe Denial of service in Japan (DoS) Vulnerability |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The Logging Server (Logsrv.exe) in IPSwitch WS_FTP 7.5.29.0 allows remote attackers to cause a denial of service (daemon crash) by sending a crafted packet containing a long string to port 5151/udp. WS_FTP is prone to a denial-of-service vulnerability.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
Ipswitch WS_FTP Server FTP Log Server Denial of Service Vulnerability
SECUNIA ADVISORY ID:
SA26040
VERIFY ADVISORY:
http://secunia.com/advisories/26040/
CRITICAL:
Moderately critical
IMPACT:
DoS
WHERE:
>From remote
SOFTWARE:
WS_FTP Server 6.x
http://secunia.com/product/14782/
DESCRIPTION:
Justin Seitz has discovered a vulnerability in Ipswitch WS_FTP
Server, which can be exploited by malicious people to cause a DoS
(Denial of Service).
The vulnerability is caused due to an error within the FTP Log Server
(ftplogsrv.exe) when handling certain messages.
The vulnerability is confirmed in FTP Log Server (ftplogsrv.exe)
version 7.5.29.0 included in WS_FTP Server 6. Other versions may also
be affected.
SOLUTION:
Restrict network access to the affected service.
PROVIDED AND/OR DISCOVERED BY:
Justin Seitz, VDA Labs
ORIGINAL ADVISORY:
http://www.vdalabs.com/tools/ipswitch.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0285 | CVE-2007-3793 | JP1/NETM/DM Manager SQL Injection Vulnerability |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
SQL injection vulnerability in Job Management Partner 1/NETM/DM (JP1/NETM/DM) Manager on Windows before 20070413 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Multiple Hitachi JP1/NETM/DM Manager products are prone to an SQL-injection vulnerability because the applications fail to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
Hitachi JP1/NETM/DM Manager SQL Injection Vulnerability
SECUNIA ADVISORY ID:
SA26052
VERIFY ADVISORY:
http://secunia.com/advisories/26052/
CRITICAL:
Less critical
IMPACT:
Manipulation of data
WHERE:
>From remote
SOFTWARE:
Hitachi JP1/NETM/DM Manager
http://secunia.com/product/14788/
DESCRIPTION:
A vulnerability has been reported in Hitachi JP1/NETM/DM Manager,
which can be exploited by malicious users to conduct SQL injection
attacks.
Unspecified input is not properly sanitised before being used in an
SQL query. This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.
SOLUTION:
Update to the latest version (please see the vendor's advisory for
details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://www.hitachi-support.com/security_e/vuls_e/HS07-019_e/index-e.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0286 | CVE-2007-3794 | Multiple Hitachi Products GIF Image Buffer Overflow Vulnerability |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
Buffer overflow in Hitachi Cosminexus V4 through V7, Processing Kit for XML before 20070511, Developer's Kit for Java before 20070312, and third-party products that use this software, allows attackers to have an unknown impact via certain GIF images, related to use of GIF image processing APIs by a Java application. Multiple Hitachi products are prone to a buffer-overflow vulnerability because the applications fail to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Given the nature of this issue, successful exploits may lead to remote code execution, but this has not been confirmed.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
The vulnerability is caused due to an boundary error within the
handling of GIF files and can be exploited to cause a buffer
overflow. No further information is currently available.
Please see vendor advisory for affected products and versions.
SOLUTION:
Update to the latest versions (please see vendor advisory for
details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://www.hitachi-support.com/security_e/vuls_e/HS07-018_e/index-e.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0276 | CVE-2007-3784 | Belkin G Plus Router DHCP Client List HTML Injection Vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in the Belkin G Plus Router F5D7231-4 with firmware 4.05.03 allows remote attackers to inject arbitrary web script or HTML via a hostname of a DHCP client. The Belkin G Plus Router is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.
Exploiting this issue may allow an attacker to execute HTML and script code in the context of the device, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.
Firmware version 4.05.03 is vulnerable; other versions may also be affected.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
Input passed via the hostname when listing DHCP clients is not
properly sanitised before being used. This can be exploited to
execute arbitrary HTML and script code in an administrator's browser
session in context of an affected interface.
SOLUTION:
List DHCP clients in a trusted network environment only.
PROVIDED AND/OR DISCOVERED BY:
Nico Leidecker, Portcullis Computer Security Ltd.
ORIGINAL ADVISORY:
http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070710/98374694/attachment-0033.txt
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0291 | CVE-2007-3906 | Kaspersky Anti-Virus 5.5 for Check Point Firewall-1 Denial of Service Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in Kaspersky Anti-Virus for Check Point FireWall-1 before Critical Fix 1 (5.5.161.0) might allow attackers to cause a denial of service (kernel hang) via unspecified vectors. NOTE: it is not clear whether there is an attacker role. Kaspersky Anti-Virus 5.5 for Check Point Firewall-1 is prone to a denial-of-service vulnerability. Further details are currently unavailable.
This issue affects Kaspersky Anti-Virus 5.5 for Check Point Firewall-1.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
SOLUTION:
Apply Critical Fix-1 (Build 5.5.161.0).
http://www.kaspersky.com/productupdates?chapter=146274607
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://support.kaspersky.com/checkpoint?qid=208279464
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200710-0500 | CVE-2007-3699 | Symantec Product Decomposer Service disruption in components (DoS) Vulnerabilities |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain value in the PACK_SIZE field of a RAR archive file header. This vulnerability allows attackers to create a denial of service condition on software with vulnerable installations of the Symantec's AntiVirus engine. Authentication is not required to exploit this vulnerability.The specific flaw resides in a forged PACK_SIZE field of a RAR file header. These issues include a denial-of-service vulnerability and a buffer-overflow vulnerability. Symantec AntiVirus is a very popular antivirus solution.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
Symantec Products CAB and RAR Archive Handling Vulnerabilities
SECUNIA ADVISORY ID:
SA26053
VERIFY ADVISORY:
http://secunia.com/advisories/26053/
CRITICAL:
Highly critical
IMPACT:
DoS, System access
WHERE:
>From remote
OPERATING SYSTEM:
Symantec Gateway Security 5400 Series 2.x
http://secunia.com/product/6633/
Symantec Gateway Security 5000 Series 3.x
http://secunia.com/product/6648/
SOFTWARE:
Symantec Web Security 3.x
http://secunia.com/product/2813/
Symantec Scan Engine 5.x
http://secunia.com/product/6651/
Symantec Mail Security for SMTP 5.x
http://secunia.com/product/13591/
Symantec Mail Security for Microsoft Exchange 6.x
http://secunia.com/product/14765/
Symantec Mail Security for Microsoft Exchange 5.x
http://secunia.com/product/6650/
Symantec Mail Security for Exchange 4.x
http://secunia.com/product/2820/
Symantec Mail Security for Domino 5.x
http://secunia.com/product/11179/
Symantec Mail Security for Domino 4.x
http://secunia.com/product/4624/
Symantec Client Security 3.x
http://secunia.com/product/6649/
Symantec Client Security 2.x
http://secunia.com/product/3478/
Symantec Brightmail AntiSpam 6.x
http://secunia.com/product/3656/
Symantec Brightmail AntiSpam 5.x
http://secunia.com/product/4628/
Symantec Brightmail AntiSpam 4.x
http://secunia.com/product/4627/
Symantec AntiVirus/Filtering for Domino 3.x
http://secunia.com/product/2029/
Symantec AntiVirus Scan Engine 4.x
http://secunia.com/product/3040/
Symantec AntiVirus for Network Attached Storage 4.x
http://secunia.com/product/4625/
Symantec AntiVirus for Macintosh 10.x
http://secunia.com/product/14768/
Symantec AntiVirus Corporate Edition for Linux
http://secunia.com/product/14767/
Symantec AntiVirus Corporate Edition 9.x
http://secunia.com/product/3549/
Symantec AntiVirus Corporate Edition 10.x
http://secunia.com/product/5555/
Symantec Norton AntiVirus 2004
http://secunia.com/product/2800/
Symantec Norton AntiVirus 2005
http://secunia.com/product/4009/
Symantec Norton AntiVirus 2006
http://secunia.com/product/6634/
Symantec Norton Internet Security 2004
http://secunia.com/product/2441/
Symantec Norton Internet Security 2004 Professional
http://secunia.com/product/2442/
Symantec Norton Internet Security 2005
http://secunia.com/product/4848/
Symantec Norton Internet Security 2006
http://secunia.com/product/6635/
Symantec Norton SystemWorks 2004
http://secunia.com/product/2796/
Symantec Norton SystemWorks 2005
http://secunia.com/product/4847/
Symantec Norton SystemWorks 2006
http://secunia.com/product/6636/
Symantec Norton Personal Firewall 2006
http://secunia.com/product/6638/
Symantec Norton AntiVirus for Macintosh 9.x
http://secunia.com/product/5948/
Symantec Norton AntiVirus for Macintosh 10.x
http://secunia.com/product/5949/
Symantec Norton Internet Security for Macintosh 3.x
http://secunia.com/product/5951/
Symantec Norton SystemWorks for Macintosh 3.x
http://secunia.com/product/5952/
DESCRIPTION:
Two vulnerabilities have been reported in various Symantec products,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.
The vulnerabilities are reported in the following products and
versions:
* Symantec Mail Security 8200 (all builds)
* Symantec Mail Security for Microsoft Exchange versions 4.6.3 and
prior, 5.0.0.204, and 6.0.0 (all builds)
* Symantec Mail Security for Domino NT versions 4.1.4 and prior and
5.0.0.47 (all builds)
* Symantec AntiVirus/Filtering for Domino MPE(AIX, Linux, Solaris)
versions 3.0.12 and prior (all builds)
* Symantec Scan Engine version 5.0.1 and prior (all builds)
* Symantec AntiVirus Scan Engine versions 4.1.8 and prior and 4.3.12
and prior (all builds)
* Symantec AntiVirus Scan Engine for MS ISA versions 4.3.12 and prior
(all builds)
* Symantec AntiVirus Scan Engine for MS Sharepoint versions 4.3.12
and prior (all builds)
* Symantec AntiVirus Scan Engine for Messaging versions 4.3.12 and
prior (all builds)
* Symantec AntiVirus for Network Attached Storage versions 4.3.12 and
prior (all builds)
* Symantec AntiVirus Scan Engine for Clearswift versions 4.3.12 and
prior (all builds)
* Symantec AntiVirus Scan Engine for Caching versions 4.3.12 and
prior (all builds)
* Symantec Client Security versions 3.0, 3.x, and 2.x (all builds)
* Symantec Web Security versions 3.0.1.76 and prior (all builds)
* Symantec Gateway Security 5000 Series version 3.01 (all builds)
* Symantec Gateway Security 5400 Series version 2.0.1 (all builds)
* Symantec Brightmail AntiSpam versions 6.0.x, 5.5, and 4.x (all
builds)
* Symantec AntiVirus Corporate Edition versions 10.1, 10.0, and 9.0
(10.1.5.5000 and prior and 9.0.6.1000 and prior)
* Symantec AntiVirus Corperate Edition for Linux
* Symantec AntiVirus for Macintosh version 10.x (all builds)
* Symantec Web Security for Microsoft ISA 2004 version 5.0 (all
builds)
* Symantec Mail Security for SMTP version 5.0.0
(Windows/Linux/Solaris) and 5.0.1 (all builds)
* Norton AntiVirus 2004/2005/2006
* Norton Internet Security 2004/2005/2005.5 AntiSpyware Edition/2006
* Norton SystemWorks 2004/2005/2006
* Norton Personal Firewall 2006
* Norton AntiVirus for Macintosh versions 9.x and 10.x
* Norton Internet Security for Macintosh version 3.x
* Norton SystemWorks for Macintosh version 3.x
SOLUTION:
Apply updates or run LiveUpdate. Please see the vendor's advisory for
details.
ORIGINAL ADVISORY:
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11f.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. ZDI-07-039: Symantec AntiVirus Engine RAR File Parsing DoS Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-07-039.html
July 12, 2007
-- CVE ID:
CVE-2007-3699
-- Affected Vendor:
Symantec
-- Affected Products:
Symantec AntiVirus Engine
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since November 20, 2006 by Digital Vaccine protection
filter ID 4695,4824. Authentication is not required to exploit this
vulnerability.
-- Vendor Response:
Symantec has issued an update to correct this vulnerability. More
details can be found at:
http://www.symantec.com/avcenter/security/Content/2007.07.11f.html
-- Disclosure Timeline:
2006.11.01 - Vulnerability reported to vendor
2006.11.20 - Digital Vaccine released to TippingPoint customers
2007.07.12 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by an anonymous researcher.
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, a division of 3Com, The Zero Day Initiative
(ZDI) represents a best-of-breed model for rewarding security
researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used.
3Com does not re-sell the vulnerability details or any exploit code.
Instead, upon notifying the affected product vendor, 3Com provides its
customers with zero day protection through its intrusion prevention
technology. Explicit details regarding the specifics of the
vulnerability are not exposed to any parties until an official vendor
patch is publicly available. Furthermore, with the altruistic aim of
helping to secure a broader user base, 3Com provides this vulnerability
information confidentially to security vendors (including competitors)
who have a vulnerability protection or mitigation product.
CONFIDENTIALITY NOTICE: This e-mail message, including any attachments,
is being sent by 3Com for the sole use of the intended recipient(s) and
may contain confidential, proprietary and/or privileged information.
Any unauthorized review, use, disclosure and/or distribution by any
recipient is prohibited. If you are not the intended recipient, please
delete and/or destroy all copies of this message regardless of form and
any included attachments and notify 3Com immediately by contacting the
sender via reply e-mail or forwarding to 3Com at postmaster@3com.com
VAR-200710-0007 | CVE-2007-0447 | Symantec Product Decomposer Component heap-based buffer overflow vulnerability |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives. User interaction is not required to exploit this vulnerability.The specific flaw exists during the process of scanning multiple maliciously formatted CAB archives. The parsing routine implicitly trusts certain user-supplied values that can result in an exploitable heap corruption. These issues include a denial-of-service vulnerability and a buffer-overflow vulnerability. Symantec AntiVirus is a very popular antivirus solution.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
Symantec Products CAB and RAR Archive Handling Vulnerabilities
SECUNIA ADVISORY ID:
SA26053
VERIFY ADVISORY:
http://secunia.com/advisories/26053/
CRITICAL:
Highly critical
IMPACT:
DoS, System access
WHERE:
>From remote
OPERATING SYSTEM:
Symantec Gateway Security 5400 Series 2.x
http://secunia.com/product/6633/
Symantec Gateway Security 5000 Series 3.x
http://secunia.com/product/6648/
SOFTWARE:
Symantec Web Security 3.x
http://secunia.com/product/2813/
Symantec Scan Engine 5.x
http://secunia.com/product/6651/
Symantec Mail Security for SMTP 5.x
http://secunia.com/product/13591/
Symantec Mail Security for Microsoft Exchange 6.x
http://secunia.com/product/14765/
Symantec Mail Security for Microsoft Exchange 5.x
http://secunia.com/product/6650/
Symantec Mail Security for Exchange 4.x
http://secunia.com/product/2820/
Symantec Mail Security for Domino 5.x
http://secunia.com/product/11179/
Symantec Mail Security for Domino 4.x
http://secunia.com/product/4624/
Symantec Client Security 3.x
http://secunia.com/product/6649/
Symantec Client Security 2.x
http://secunia.com/product/3478/
Symantec Brightmail AntiSpam 6.x
http://secunia.com/product/3656/
Symantec Brightmail AntiSpam 5.x
http://secunia.com/product/4628/
Symantec Brightmail AntiSpam 4.x
http://secunia.com/product/4627/
Symantec AntiVirus/Filtering for Domino 3.x
http://secunia.com/product/2029/
Symantec AntiVirus Scan Engine 4.x
http://secunia.com/product/3040/
Symantec AntiVirus for Network Attached Storage 4.x
http://secunia.com/product/4625/
Symantec AntiVirus for Macintosh 10.x
http://secunia.com/product/14768/
Symantec AntiVirus Corporate Edition for Linux
http://secunia.com/product/14767/
Symantec AntiVirus Corporate Edition 9.x
http://secunia.com/product/3549/
Symantec AntiVirus Corporate Edition 10.x
http://secunia.com/product/5555/
Symantec Norton AntiVirus 2004
http://secunia.com/product/2800/
Symantec Norton AntiVirus 2005
http://secunia.com/product/4009/
Symantec Norton AntiVirus 2006
http://secunia.com/product/6634/
Symantec Norton Internet Security 2004
http://secunia.com/product/2441/
Symantec Norton Internet Security 2004 Professional
http://secunia.com/product/2442/
Symantec Norton Internet Security 2005
http://secunia.com/product/4848/
Symantec Norton Internet Security 2006
http://secunia.com/product/6635/
Symantec Norton SystemWorks 2004
http://secunia.com/product/2796/
Symantec Norton SystemWorks 2005
http://secunia.com/product/4847/
Symantec Norton SystemWorks 2006
http://secunia.com/product/6636/
Symantec Norton Personal Firewall 2006
http://secunia.com/product/6638/
Symantec Norton AntiVirus for Macintosh 9.x
http://secunia.com/product/5948/
Symantec Norton AntiVirus for Macintosh 10.x
http://secunia.com/product/5949/
Symantec Norton Internet Security for Macintosh 3.x
http://secunia.com/product/5951/
Symantec Norton SystemWorks for Macintosh 3.x
http://secunia.com/product/5952/
DESCRIPTION:
Two vulnerabilities have been reported in various Symantec products,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.
The vulnerabilities are reported in the following products and
versions:
* Symantec Mail Security 8200 (all builds)
* Symantec Mail Security for Microsoft Exchange versions 4.6.3 and
prior, 5.0.0.204, and 6.0.0 (all builds)
* Symantec Mail Security for Domino NT versions 4.1.4 and prior and
5.0.0.47 (all builds)
* Symantec AntiVirus/Filtering for Domino MPE(AIX, Linux, Solaris)
versions 3.0.12 and prior (all builds)
* Symantec Scan Engine version 5.0.1 and prior (all builds)
* Symantec AntiVirus Scan Engine versions 4.1.8 and prior and 4.3.12
and prior (all builds)
* Symantec AntiVirus Scan Engine for MS ISA versions 4.3.12 and prior
(all builds)
* Symantec AntiVirus Scan Engine for MS Sharepoint versions 4.3.12
and prior (all builds)
* Symantec AntiVirus Scan Engine for Messaging versions 4.3.12 and
prior (all builds)
* Symantec AntiVirus for Network Attached Storage versions 4.3.12 and
prior (all builds)
* Symantec AntiVirus Scan Engine for Clearswift versions 4.3.12 and
prior (all builds)
* Symantec AntiVirus Scan Engine for Caching versions 4.3.12 and
prior (all builds)
* Symantec Client Security versions 3.0, 3.x, and 2.x (all builds)
* Symantec Web Security versions 3.0.1.76 and prior (all builds)
* Symantec Gateway Security 5000 Series version 3.01 (all builds)
* Symantec Gateway Security 5400 Series version 2.0.1 (all builds)
* Symantec Brightmail AntiSpam versions 6.0.x, 5.5, and 4.x (all
builds)
* Symantec AntiVirus Corporate Edition versions 10.1, 10.0, and 9.0
(10.1.5.5000 and prior and 9.0.6.1000 and prior)
* Symantec AntiVirus Corperate Edition for Linux
* Symantec AntiVirus for Macintosh version 10.x (all builds)
* Symantec Web Security for Microsoft ISA 2004 version 5.0 (all
builds)
* Symantec Mail Security for SMTP version 5.0.0
(Windows/Linux/Solaris) and 5.0.1 (all builds)
* Norton AntiVirus 2004/2005/2006
* Norton Internet Security 2004/2005/2005.5 AntiSpyware Edition/2006
* Norton SystemWorks 2004/2005/2006
* Norton Personal Firewall 2006
* Norton AntiVirus for Macintosh versions 9.x and 10.x
* Norton Internet Security for Macintosh version 3.x
* Norton SystemWorks for Macintosh version 3.x
SOLUTION:
Apply updates or run LiveUpdate. Please see the vendor's advisory for
details.
ORIGINAL ADVISORY:
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11f.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. ZDI-07-040: Symantec AntiVirus Engine CAB Parsing Heap Overflow
Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-07-040.html
July 12, 2007
-- CVE ID:
CVE-2007-0447
-- Affected Vendor:
Symantec
-- Affected Products:
Symantec AntiVirus Engine
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since November 30, 2006 by Digital Vaccine protection
filter ID 4875.
-- Vendor Response:
Symantec has issued an update to correct this vulnerability. More
details can be found at:
http://www.symantec.com/avcenter/security/Content/2007.07.11f.html
-- Disclosure Timeline:
2006.11.09 - Vulnerability reported to vendor
2006.11.30 - Digital Vaccine released to TippingPoint customers
2007.07.12 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by an anonymous researcher.
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, a division of 3Com, The Zero Day Initiative
(ZDI) represents a best-of-breed model for rewarding security
researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used.
3Com does not re-sell the vulnerability details or any exploit code.
Instead, upon notifying the affected product vendor, 3Com provides its
customers with zero day protection through its intrusion prevention
technology. Explicit details regarding the specifics of the
vulnerability are not exposed to any parties until an official vendor
patch is publicly available. Furthermore, with the altruistic aim of
helping to secure a broader user base, 3Com provides this vulnerability
information confidentially to security vendors (including competitors)
who have a vulnerability protection or mitigation product.
CONFIDENTIALITY NOTICE: This e-mail message, including any attachments,
is being sent by 3Com for the sole use of the intended recipient(s) and
may contain confidential, proprietary and/or privileged information.
Any unauthorized review, use, disclosure and/or distribution by any
recipient is prohibited. If you are not the intended recipient, please
delete and/or destroy all copies of this message regardless of form and
any included attachments and notify 3Com immediately by contacting the
sender via reply e-mail or forwarding to 3Com at postmaster@3com.com
VAR-200707-0218 | CVE-2007-3800 | Symantec AntiVirus Corporate Edition and Client Security of RTVScan Vulnerability gained privileges in components |
CVSS V2: 6.0 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in the Real-time scanner (RTVScan) component in Symantec AntiVirus Corporate Edition 9.0 through 10.1 and Client Security 2.0 through 3.1, when the Notification Message window is enabled, allows local users to gain privileges via crafted code.
A local attacker can exploit this issue to elevate privileges to the SYSTEM level. This could facilitate a complete compromise of the affected computer. Symantec AntiVirus is a very popular antivirus solution. There is a loophole in Symantec AntiVirus processing log display. If this feature is enabled, local non-privileged users can use this window to gain system and privileges and execute arbitrary commands in the system.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
The vulnerability is caused due to an error in the Real-Time scanner
(RTVScan) component when displaying a notification window containing
information on threats found on a system. This can be exploited to
execute arbitrary code with SYSTEM privileges.
http://www.symantec.com/enterprise/support/all_products.jsp
Symantec AntiVirus Corporate Edition 9.0:
SAV 9.0.6 MR6 MP1- build 1100 or later
Symantec AntiVirus Corporate Edition 10.0/10.1:
10.1.4 MR4 MP1- build 4010 or later
Symantec Client Security 2.0:
SCS 2.0.6 MR6 MP1 - build 1100 or later
Symantec Client Security 3.0/3.1:
SCS 3.1.4 MR4 MP1 - build 4010 or later
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Ali Rhabar, Sysdream.
ORIGINAL ADVISORY:
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11c.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0339 | CVE-2006-5278 | CUCM of RIS Data Collector Service integer overflow vulnerability |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
Integer overflow in the Real-Time Information Server (RIS) Data Collector service (RisDC.exe) in Cisco Unified Communications Manager (CUCM, formerly CallManager) before 20070711 allow remote attackers to execute arbitrary code via crafted packets, resulting in a heap-based buffer overflow.
An attacker can exploit these issues to execute arbitrary code within the context of the vulnerable application. Successful exploits may result in a complete compromise of affected servers. Failed exploit attempts will likely result in denial-of-service conditions. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
----------------------------------------------------------------------
TITLE:
Cisco Unified Communications Manager Two Vulnerabilities
SECUNIA ADVISORY ID:
SA26043
VERIFY ADVISORY:
http://secunia.com/advisories/26043/
CRITICAL:
Moderately critical
IMPACT:
DoS, System access
WHERE:
>From local network
SOFTWARE:
Cisco Unified CallManager 5.x
http://secunia.com/product/12535/
Cisco Unified CallManager 4.x
http://secunia.com/product/12534/
Cisco Unified CallManager 3.x
http://secunia.com/product/2805/
Cisco Unified Communications Manager 5.x
http://secunia.com/product/11019/
Cisco Unified Communications Manager 4.x
http://secunia.com/product/5363/
DESCRIPTION:
Some vulnerabilities have been reported in Cisco Unified
Communications Manager (CUCM), which can be exploited by malicious
people to cause a DoS (Denial of Service) or potentially compromise a
vulnerable system.
1) An off-by-one error in the Certificate Trust List Provider service
(CTLProvider.exe) can be exploited to cause a heap-based buffer
overflow by sending specially crafted packets to the vulnerable
service (default port 2444/TCP).
Note: This vulnerability does not affect CUCM 3.x.
Successful exploitation may allow execution of arbitrary code.
SOLUTION:
Apply updated versions:
Vulnerability #1 is corrected in CUCM versions 4.1(3)SR5, 4.2(3)SR2,
4.3(1)SR1 and 5.1(2).
Vulnerability #2 is corrected in CUCM versions 3.3(5)SR2b, 4.1(3)SR5,
4.2(3)SR2, 4.3(1)SR1 and 5.1(2).
See vendor advisory for a detailed patch matrix.
PROVIDED AND/OR DISCOVERED BY:
IBM Internet Security Systems X-Force
ORIGINAL ADVISORY:
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml
IBM Internet Security Systems:
1) http://www.iss.net/threats/270.html
2) http://www.iss.net/threats/271.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0297 | CVE-2007-3771 | Symantec AntiVirus Corporate Edition and Client Security Vulnerable to stack-based buffer overflow |
CVSS V2: 4.6 CVSS V3: - Severity: MEDIUM |
Stack-based buffer overflow in the Internet E-mail Auto-Protect feature in Symantec AntiVirus Corporate Edition before 10.1, and Client Security before 3.1, allows local users to cause a denial of service (service crash) via a long (1) To, (2) From, or (3) Subject header in an outbound SMTP e-mail message. NOTE: the original vendor advisory referenced CVE-2006-3456, but this was an error. This issue occurs because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.
An attacker can exploit this issue to cause denial-of-service conditions.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
The vulnerability is caused due to an error within the Internet Email
Auto-Protect feature when scanning outgoing email messages. This can
be exploited to cause a stack overflow via an email message
containing an overly long (greater than 951 characters) string in the
"To:", "From:", or "Subject" fields.
Successful exploitation crashes the Internet E-mail real-time
protection service and results in subsequent outgoing SMTP email
messages not being scanned.
ORIGINAL ADVISORY:
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11b.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0301 | CVE-2007-3775 | CUCM Service disruption in (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Cisco Unified Communications Manager (CUCM, formerly CallManager) and Unified Presence Server (CUPS) allows remote attackers to cause a denial of service (loss of cluster services) via unspecified vectors, aka (1) CSCsj09859 and (2) CSCsj19985.
To exploit this issue, an attacker must have administrative access.
Attackers may exploit these issues to gain access to sensitive information or to cause denial-of-service conditions.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
The vulnerabilities are caused due to unspecified errors and can be
exploited by an unauthorized administrator to e.g. activate and
terminate system services or to view SNMP configuration information
in a CUCM/CUPS cluster environment.
CUCM 5.0/5.1:
Update to CUCM 5.1(2a) -
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-51?psrtdcat20e2
CUPS 1.0:
Upgrade to CUPS 6.0(1) -
http://www.cisco.com/pcgi-bin/tablebuild.pl/cups-60?psrtdcat20e2
Version 1.0 is reportedly discontinued. The vendor recommends users
to upgrade to version 6.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20070711-voip.shtml
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-200707-0302 | CVE-2007-3776 | CUCM Vulnerability in which important information is obtained |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
Cisco Unified Communications Manager (CUCM, formerly CallManager) and Unified Presence Server (CUPS) allow remote attackers to obtain sensitive information via unspecified vectors that reveal the SNMP community strings and configuration settings, aka (1) CSCsj20668 and (2) CSCsj25962.
To exploit this issue, an attacker must have administrative access.
Attackers may exploit these issues to gain access to sensitive information or to cause denial-of-service conditions.
----------------------------------------------------------------------
Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.
The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.
The vulnerabilities are caused due to unspecified errors and can be
exploited by an unauthorized administrator to e.g. activate and
terminate system services or to view SNMP configuration information
in a CUCM/CUPS cluster environment.
CUCM 5.0/5.1:
Update to CUCM 5.1(2a) -
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-51?psrtdcat20e2
CUPS 1.0:
Upgrade to CUPS 6.0(1) -
http://www.cisco.com/pcgi-bin/tablebuild.pl/cups-60?psrtdcat20e2
Version 1.0 is reportedly discontinued. The vendor recommends users
to upgrade to version 6.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20070711-voip.shtml
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------