SecurityFocus News
SecurityFocus Newsletter #509 Aug 12 2009 11:19PM
sfa securityfocus com
SecurityFocus Newsletter #509
----------------------------------------

This issue is sponsored by SC World Congress

Make plans now to attend the second annual SC World Congress - Enterprise Data Security, October 13-14 in New York City. The Congress features a comprehensive, two-day program presented in four tracks-including the unique Editors Choice sessions-and the industry's largest fall product expo showcasing IT security solutions from the leading vendors and hot start-ups. Emphasizing quality content, innovative formats and sessions, global perspectives and ROI, this is the one event you can't afford to miss. Register by August 31 for big savings. www.scworldcongress.com

------------------------------------------------------------------
I. FRONT AND CENTER
1.The Scale of Security
2.Hacker-Tool Law Still Does Little
II. BUGTRAQ SUMMARY
1. Microsoft Message Queuing Service NULL Pointer Dereference Local Privilege Escalation Vulnerability
2. Apple Mac OS X 2009-003 Multiple Security Vulnerabilities
3. Adobe Flash Player and AIR (CVE-2009-1866) Stack Buffer Overflow Vulnerability
4. Adobe Flash Player and AIR NULL Pointer Exception Remote Code Execution Vulnerability
5. TGS Content Management HTML-Injection and Multiple Cross-Site Scripting Vulnerabilities
6. Adobe Flash Player and AIR Sandbox Bypass Information Disclosure Vulnerability
7. Novell Privileged User Manager Remote Library Injection Vulnerability
8. Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability
9. Pidgin OSCAR Protocol Web Message Denial of Service Vulnerability
10. Apache APR-util 'xml/apr_xml.c' Denial of Service Vulnerability
11. LibTIFF 'LZWDecodeCompat()' Remote Buffer Underflow Vulnerability
12. Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability
13. Pidgin Multiple Buffer Overflow Vulnerabilities
14. libsndfile VOC and AIFF Processing Buffer Overflow Vulnerabilities
15. Apache Geronimo Application Server Multiple Remote Vulnerabilities
16. Memcached and MemcacheDB ASLR Information Disclosure Weakness
17. Memcached Multiple Heap Based Buffer Overflow Vulnerability
18. Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability
19. Adobe Flash Player and AIR URI Parsing Heap Buffer Overflow Vulnerability
20. Adobe Flash Player and AIR 'intf_count' Integer Overflow Vulnerability
21. Sun Java Runtime Environment Audio System Privilege Escalation Vulnerability
22. Mozilla Firefox 3.5.1/3.0.12 Multiple Memory Corruption Vulnerabilities
23. Sun Java Runtime Environment JPEG Image Handling Integer Overflow Vulnerability
24. Sun Java Runtime Environment Proxy Mechanism Implementation Privilege Escalation Vulnerabilities
25. JNLPAppletLauncher Arbitrary File Creation Vulnerability
26. Sun Java Runtime Environment Unpack200 JAR Unpacking Utility Integer Overflow Vulnerability
27. CamlImages PNG Image Parsing Multiple Integer Overflow Vulnerabilities
28. Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
29. ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
30. Ruby 'OCSP_basic_verify()' X.509 Certificate Verification Vulnerability
31. Ruby BigDecimal Library Denial Of Service Vulnerability
32. phpGroupWare Multiple Input Validation Vulnerabilities
33. NTP 'ntpd' Autokey Stack Buffer Overflow Vulnerability
34. Asterisk SIP Channel Driver 'scanf' Multiple Remote Denial of Service Vulnerabilities
35. Gallarific Cross Site Scripting and Authentication Bypass Vulnerabilities
36. Avant Browser 'browser:home' Multiple HTML Injection Vulnerabilities
37. NTP 'ntpq' Stack Buffer Overflow Vulnerability
38. BoonEx Orca Topic Title HTML Injection Vulnerability
39. Mozilla Firefox and Seamonkey Regular Expression Parsing Heap Buffer Overflow Vulnerability
40. Mozilla NSS NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
41. libxml2 Multiple Memory Corruption Vulnerabilities
42. Pixaria Gallery 'file' Parameter Directory Traversal Vulnerability
43. WordPress 'wp-login.php' Admin Password Reset Security Bypass Vulnerability
44. strongSwan Crafted X.509 Certificate Multiple Remote Denial Of Service Vulnerabilities
45. Adobe Reader and Acrobat JBIG Segments 'Text Region' Memory Corruption Vulnerability
46. Adobe Reader and Acrobat JBIG 'Pattern Dictionary' Remote Heap Buffer Overflow Vulnerability
47. Adobe Reader & Acrobat JBIG Pattern Dictionary Allocation Remote Heap Buffer Overflow Vulnerability
48. Adobe Reader and Acrobat JBIG 'Halftone Region' Remote Heap Buffer Overflow Vulnerability
49. Adobe Reader and Acrobat FlateDecode Filter Integer Overflow Vulnerability
50. Adobe Reader and Acrobat TrueType Font Handling Memory Corruption Vulnerability
51. Adobe Reader and Acrobat JBIG Halftone Region Grid Area Remote Heap Buffer Overflow Vulnerability
52. Adobe Reader and Acrobat Huffman-encoded JBIG2 Text Heap Overflow Vulnerability
53. Adobe Reader and Acrobat JBIG2 Filter Unspecified Memory Corruption Vulnerability
54. Adobe Reader and Acrobat JBIG 'Halftone Region' Remote Heap Buffer Overflow Vulnerability
55. Adobe Reader and Acrobat U3D Model Remote Stack Buffer Overflow Vulnerability
56. Adobe Reader and Acrobat Unspecified Memory Corruption Vulnerability
57. Adobe Reader and Acrobat Multiple Unspecified Remote Heap Buffer Overflow Vulnerabilities
58. Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities
59. WS_FTP Server Manager Authentication Bypass and Information Disclosure Vulnerabilities
60. Ipswitch FTP Log Server Denial of Service Vulnerability
61. Ipswitch WS_FTP SFTP Opendir Command Buffer Overflow Vulnerability
62. Apple Safari Top Site Feature Website Promotion Security Vulnerability
63. ViewVC Cross Site Scripting and Unspecified Security Vulnerabilities
64. SAP NetWeaver Application Server 'uddiclient/process' HTML Injection Vulnerability
65. cURL / libcURL NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
66. 2Wire Routers 'CD35_SETUP_01' Access Validation Vulnerability
67. Sun OpenSSO Enterprise XML Document Processing Unspecified Memory Corruption Vulnerability
68. IBM AIX '_LIB_INIT_DBG' and '_LIB_INIT_DBG_FILE' File Creation Vulnerability
69. Sun Java SE Multiple Security Vulnerabilities
70. libxml2 'xmlBufferResize()' Remote Denial of Service Vulnerability
71. libxml2 'xmlSAX2Characters()' Integer Overflow Vulnerability
72. Microsoft Windows Malformed AVI File Parsing Remote Integer Overflow Vulnerability
73. Microsoft Windows Malformed AVI File Header Parsing Remote Code Execution Vulnerability
74. PulseAudio setuid Local Privilege Escalation Vulnerability
75. Motorola Timbuktu Pro 'PlughNTCommand' Named Pipe Remote Stack Buffer Overflow Vulnerability
76. Microsoft Active Template Library Object Type Mismatch Remote Code Execution Vulnerability
77. FreeBSD 'mount(2)' and 'nmount(2)' Multiple Stack Buffer Overflow Vulnerabilities
78. SafeNet SoftRemote IKE Service Remote Stack Buffer Overflow Vulnerability
79. Unisys Business Information Server Remote Stack Buffer Overflow Vulnerability
80. IETF and W3C XML Digital Signature Specification HMAC Truncation Authentication Bypass Vulnerability
81. Microsoft Visual Studio Active Template Library COM Object Remote Code Execution Vulnerability
82. Microsoft Visual Studio ATL 'VariantClear()' Remote Code Execution Vulnerability
83. Microsoft Active Template Library 'IPersistStreamInit' Remote Code Execution Vulnerability
84. Microsoft Active Template Library Header Data Remote Code Execution Vulnerability
85. Microsoft Windows WINS Server Network Buffer Length Integer Overflow Vulnerability
86. Sun Solaris XScreenSaver Popup Windows Local Information Disclosure Vulnerability
87. Microsoft OWC ActiveX Control 'BorderAround()' Heap Corruption Remote Code Execution Vulnerability
88. Microsoft Remote Desktop Connection Client Heap Based Buffer Overflow Vulnerability
89. Samba Arbitrary Memory Contents Information Disclosure Vulnerability
90. Microsoft Office Web Components ActiveX Control 'msDataSourceObject()' Code Execution Vulnerability
91. Microsoft Windows WINS Server Network Packet Remote Heap Buffer Overflow Vulnerability
92. Microsoft Office Web Components ActiveX Control Memory Allocation Code Execution Vulnerability
93. CoreGraphics Font Glyph Rendering Library Remote Code Execution Vulnerability
94. Microsoft ASP.NET Request Scheduling Denial Of Service Vulnerability
95. Microsoft Windows Embedded OpenType Font Engine Integer Overflow Vulnerability
96. Microsoft Windows Embedded OpenType Font Engine Heap Overflow Vulnerability
97. Microsoft Visual Studio Active Template Library NULL String Information Disclosure Vulnerability
98. libxml XML Entity Name Heap Buffer Overflow Vulnerability
99. Sun Java Runtime Environment XML Parsing Denial of Service Vulnerability
100. Adobe Flash Player and AIR Unspecified Privilege Escalation Vulnerability
III. SECURITYFOCUS NEWS
1. Web attacks hit U.S., South Korean sites
2. FTC persuades court to shutter rogue ISP
3. Obama launches cybersecurity initiative
4. Browsers bashed first in hacking contest
IV. SECURITY JOBS LIST SUMMARY
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
VII. MICROSOFT FOCUS LIST SUMMARY
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1.The Scale of Security
By Adam O'Donnell
Human beings do not naturally understand scale. While we speak of financial transactions in the hundreds of billions of dollars as being something as routine as brushing our teeth, we question the value of programs that cost in the single-digit millions and quibble with friends over dollars. Similarly, there are many problems in our industry that, when explained to an outsider, sound like they should have been solved decades ago. It is only when we relate the number of systems that need to be considered in the repair that we truly communicate the difficulty of the problem.
http://www.securityfocus.com/columnists/503

2. Hacker-Tool Law Still Does Little
By Mark Rasch
On August 10, 2007, a new section of the German Penal code went into effect. The statute, intended to implement certain provisions of the Council of Europe Treaty on Cybercrime, could be interpreted to make the creation or distribution of computer security software a criminal offense.
http://www.securityfocus.com/columnists/502

II. BUGTRAQ SUMMARY
--------------------
1. Microsoft Message Queuing Service NULL Pointer Dereference Local Privilege Escalation Vulnerability
BugTraq ID: 35969
Remote: No
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35969
Summary:
The Microsoft Message Queuing service is prone to a local privilege-escalation vulnerability because it fails to adequately handle user-supplied input.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Failed exploits will cause a denial of service.

2. Apple Mac OS X 2009-003 Multiple Security Vulnerabilities
BugTraq ID: 35954
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35954
Summary:
Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-003.

The security update addresses new vulnerabilities that affect the CFNetwork, ColorSync, CoreTypes, Dock, Image RAW, ImageIO, launchd, Login Window, MobileMe, Kernel and XQuery components of Mac OS X. The advisory also contains security updates for seven previously reported issues.

3. Adobe Flash Player and AIR (CVE-2009-1866) Stack Buffer Overflow Vulnerability
BugTraq ID: 35901
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35901
Summary:
Adobe Flash Player and Adobe AIR are prone to a stack-based buffer-overflow vulnerability.

Very few details are available regarding this issue. We will update this BID as more information emerges.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition.

This issue was previously covered in BID 35890 (Adobe Flash Player and AIR Multiple Security Vulnerabilities) but has been given its own record to better document it.

This issue affects versions *prior to* the following:

Flash Player 10.0.32.18
AIR 1.5.2

4. Adobe Flash Player and AIR NULL Pointer Exception Remote Code Execution Vulnerability
BugTraq ID: 35906
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35906
Summary:
Adobe Flash Player and Adobe AIR are prone to a remote code-execution vulnerability.

Very few details are available regarding this issue. We will update this BID as more information emerges.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition.

This issue was previously covered in BID 35890 (Adobe Flash Player and AIR Multiple Security Vulnerabilities) but has been given its own record to better document it.

This issue affects versions *prior to* the following:

Flash Player 10.0.32.18
AIR 1.5.2

5. TGS Content Management HTML-Injection and Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 30157
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/30157
Summary:
TGS Content Management is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.

TGS Content Management 0.3.2r2 is vulnerable; other versions may also be affected.

6. Adobe Flash Player and AIR Sandbox Bypass Information Disclosure Vulnerability
BugTraq ID: 35908
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35908
Summary:
Adobe Flash Player and Adobe AIR are prone to an information-disclosure vulnerability.

Very few details are available regarding this issue. We will update this BID as more information emerges.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

This issue was previously covered in BID 35890 (Adobe Flash Player and AIR Multiple Security Vulnerabilities) but has been given its own record to better document it.

This issue affects versions *prior to* the following:

Flash Player 10.0.32.18
AIR 1.5.2

7. Novell Privileged User Manager Remote Library Injection Vulnerability
BugTraq ID: 35752
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35752
Summary:
Novell Privileged User Manager is prone to a vulnerability that allows a remote attacker to inject a malicious library.

The attacker can exploit this issue to inject and execute arbitrary malicious code in the context of the vulnerable application. Successful exploits can compromise the application and possibly the computer; other attacks are also possible.

Novell Privileged User Manager 2.2.0 is vulnerable.

8. Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability
BugTraq ID: 35464
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35464
Summary:
Nagios is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.

Note that, for an exploit to succeed, access to the WAP interface's ping feature must be allowed.

Versions prior to Nagios 3.1.1 are vulnerable.

9. Pidgin OSCAR Protocol Web Message Denial of Service Vulnerability
BugTraq ID: 35530
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35530
Summary:
Pidgin is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input.

Successful exploits will cause the affected application to crash, effectively denying service to legitimate users.

Pidgin 2.4.0 through 2.5.7 are vulnerable.

10. Apache APR-util 'xml/apr_xml.c' Denial of Service Vulnerability
BugTraq ID: 35253
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35253
Summary:
Apache 'APR-util' is prone to a vulnerability that may allow attackers to cause an affected application to consume memory, resulting in a denial-of-service condition.

Versions prior to 'APR-util' 1.3.7 are vulnerable.

11. LibTIFF 'LZWDecodeCompat()' Remote Buffer Underflow Vulnerability
BugTraq ID: 35451
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35451
Summary:
LibTIFF is prone to a remote buffer-underflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary malicious code in the context of a user running an application that uses the affected library. Failed exploit attempts will likely crash the application.

LibTIFF 3.8.2 is vulnerable; other versions may be affected as well.

12. Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability
BugTraq ID: 35251
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35251
Summary:
Apache 'APR-util' is prone to an off-by-one vulnerability that may allow attackers to obtain sensitive information or trigger a denial-of-service condition.

Given the nature of this issue, attackers may also be able to execute arbitrary code in the context of an application that uses the affected library, but this has not been confirmed.

Versions prior to 'APR-util' 1.3.5 on big-endian platforms are vulnerable.

13. Pidgin Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 35067
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35067
Summary:
Pidgin is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.

Successful exploits may allow attackers to execute arbitrary code with the privileges of a user running the software or cause denial-of-service conditions.

Versions prior to Pidgin 2.5.6 are vulnerable.

14. libsndfile VOC and AIFF Processing Buffer Overflow Vulnerabilities
BugTraq ID: 34978
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/34978
Summary:
The 'libsndfile' library is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit these issues to execute arbitrary code in the context of an application using the library. This can compromise the affected application and possibly the computer. Failed attacks will likely cause denial-of-service conditions.

These issues affect versions prior to libsndfile 1.0.20.

15. Apache Geronimo Application Server Multiple Remote Vulnerabilities
BugTraq ID: 34562
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/34562
Summary:
Apache Geronimo Application Server is prone to multiple remote vulnerabilities:

- Multiple directory-traversal vulnerabilities
- A cross-site scripting vulnerability
- Multiple HTML-injection vulnerabilities
- A cross-site request-forgery vulnerability

Attackers can exploit these issues to obtain sensitive information, upload arbitrary files, execute arbitrary script code, steal cookie-based authentication credentials, and perform certain administrative actions.

Apache Geronimo 2.1 through 2.1.3 are vulnerable.

16. Memcached and MemcacheDB ASLR Information Disclosure Weakness
BugTraq ID: 34756
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/34756
Summary:
Memcached and MemcacheDB are prone to an information-disclosure weakness that may aid attackers in bypassing Address Space Layout Randomization (ASLR) protections.

Attackers can exploit this weakness to gain access to sensitive information such as stack, heap, and shared-library memory locations. Information obtained may aid in other attacks.

memcached v1.2.7 and MemcacheDB v1.2.0 are vulnerable.

17. Memcached Multiple Heap Based Buffer Overflow Vulnerability
BugTraq ID: 35989
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35989
Summary:
Memcached is prone to multiple heap-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary-checks on user-supplied data.

Attackers can exploit these issues to execute arbitrary code with superuser privileges. Successfully exploiting this issue will compromise the affected application. Failed exploit attempts will result in a denial-of-service condition.

18. Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability
BugTraq ID: 35221
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35221
Summary:
Apache 'APR-util' is prone to an integer-underflow vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of an affected application. Successful exploits will compromise the affected application and possibly the computer. Failed attacks will cause denial-of-service conditions.

Versions prior to 'APR-util' 1.3.5 are vulnerable.

19. Adobe Flash Player and AIR URI Parsing Heap Buffer Overflow Vulnerability
BugTraq ID: 35902
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35902
Summary:
Adobe Flash Player and Adobe AIR are prone to a heap-based buffer overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition.

This issue was previously covered in BID 35890 (Adobe Flash Player and AIR Multiple Security Vulnerabilities) but has been given its own record to better document it.

This issue affects versions *prior to* the following:

Flash Player 10.0.32.18
AIR 1.5.2

20. Adobe Flash Player and AIR 'intf_count' Integer Overflow Vulnerability
BugTraq ID: 35907
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35907
Summary:
Adobe Flash Player and Adobe AIR are prone to an integer-overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition.

This issue was previously covered in BID 35890 (Adobe Flash Player and AIR Multiple Security Vulnerabilities) but has been given its own record to better document it.

This issue affects versions *prior to* the following:

Flash Player 10.0.32.18
AIR 1.5.2

21. Sun Java Runtime Environment Audio System Privilege Escalation Vulnerability
BugTraq ID: 35939
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35939
Summary:
Sun Java Runtime Environment (JRE) is prone to a privilege-escalation vulnerability.

Successful exploits may allow attackers to access the 'java.lang.System' properties and perform actions with elevated privileges on affected computers.

This issue affects the following:

JDK and JRE 6 Update 14 and prior
JDK and JRE 5.0 Update 19 and prior

NOTE: This issue was previously covered in BID 35922 (Sun Java SE Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

22. Mozilla Firefox 3.5.1/3.0.12 Multiple Memory Corruption Vulnerabilities
BugTraq ID: 35927
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35927
Summary:
Mozilla Firefox is prone to multiple remote memory-corruption vulnerabilities.

An attacker can exploit these issues to corrupt memory on the affected computer and potentially run arbitrary code in the context of the user running the affected application. Failed exploit attempts will cause denial-of-service conditions.

Mozilla Firefox versions prior to 3.5.2 and 3.0.13 are affected.

23. Sun Java Runtime Environment JPEG Image Handling Integer Overflow Vulnerability
BugTraq ID: 35942
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35942
Summary:
Sun Java Runtime Environment (JRE) is prone to an integer-overflow vulnerability.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the affected application. Failed attempts may result in denial-of-service conditions.

This issue affects the following:

JDK and JRE 6 Update 14 and prior

NOTE: This issue was previously covered in BID 35922 (Sun Java SE Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

24. Sun Java Runtime Environment Proxy Mechanism Implementation Privilege Escalation Vulnerabilities
BugTraq ID: 35943
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35943
Summary:
Sun Java Runtime Environment (JRE) is prone to multiple privilege-escalation vulnerabilities.

Successful exploits may allow attackers to perform actions with elevated privileges and gain access to sensitive information, hijack sessions, and violate the same-origin policy.

These issues affect the following:

JDK and JRE 6 Update 14 and prior
JDK and JRE 5.0 Update 19 and prior

NOTE: These issues were previously covered in BID 35922 (Sun Java SE Multiple Security Vulnerabilities), but have been assigned their own record to better document them.

25. JNLPAppletLauncher Arbitrary File Creation Vulnerability
BugTraq ID: 35946
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35946
Summary:
JNLPAppletLauncher is prone to a vulnerability that allows attackers to write arbitrary files on the vulnerable system.

An attacker may exploit this issue to create arbitrary files on the system running the affected application. This may aid in further attacks.

26. Sun Java Runtime Environment Unpack200 JAR Unpacking Utility Integer Overflow Vulnerability
BugTraq ID: 35944
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35944
Summary:
Sun Java Runtime Environment (JRE) is prone to an integer-overflow vulnerability.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the affected application. Failed attempts may result in denial-of-service conditions.

This issue affects the following:

JDK and JRE 6 Update 14 and prior
JDK and JRE 5.0 Update 19 and prior

NOTE: This issue was previously covered in BID 35922 (Sun Java SE Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

27. CamlImages PNG Image Parsing Multiple Integer Overflow Vulnerabilities
BugTraq ID: 35556
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35556
Summary:
CamlImages is prone to multiple integer-overflow vulnerabilities because it fails to properly validate user-supplied input.

Successful exploits may allow attackers to execute arbitrary code in the context of applications that use the affected library. Failed exploit attempts will likely result in denial-of-service conditions.

CamlImages 2.2 and prior are vulnerable; other versions may also be affected.

28. Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
BugTraq ID: 35951
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35951
Summary:
Fetchmail is prone to a security-bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Versions prior to Fetchmail 6.3.11 are vulnerable.

29. ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
BugTraq ID: 35848
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35848
Summary:
ISC BIND is prone to a remote denial-of-service vulnerability because the software fails to properly handle specially crafted dynamic update requests.

Successfully exploiting this issue allows remote attackers to crash affected DNS servers, denying further service to legitimate users. Other attacks are also possible.

Versions prior to BIND 9.4.3-P3, 9.5.1-P3, and 9.6.1-P3 are vulnerable.

30. Ruby 'OCSP_basic_verify()' X.509 Certificate Verification Vulnerability
BugTraq ID: 33769
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/33769
Summary:
Ruby is prone to an X.509 certificate-verification vulnerability.

Exploiting this issue may allow an attacker to have a revoked x.509 certificate accepted as valid. This may allow the attacker to conduct phishing attacks or to impersonate legitimate sites. Other attacks are also possible.

Ruby 1.8.7 and 1.9.1 are vulnerable; other versions may also be affected.

31. Ruby BigDecimal Library Denial Of Service Vulnerability
BugTraq ID: 35278
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35278
Summary:
Ruby is prone to a denial-of-service vulnerability in its BigDecimal library.

Successful exploits may allow remote attackers to cause denial-of-service conditions in applications that use the vulnerable module.

Versions prior to Ruby 1.8.6-p369 and 1.8.7-p173 are affected.

32. phpGroupWare Multiple Input Validation Vulnerabilities
BugTraq ID: 35761
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35761
Summary:
phpGroupWare is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to obtain sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phpGroupWare 0.9.16.12 is affected; other versions may also be vulnerable.

33. NTP 'ntpd' Autokey Stack Buffer Overflow Vulnerability
BugTraq ID: 35017
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35017
Summary:
The 'ntpd' daemon is prone to a stack-based buffer-overflow vulnerability when it is configured to use the 'autokey' OpenSSL protocol.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attempts will likely crash the application, causing denial-of-service conditions.

34. Asterisk SIP Channel Driver 'scanf' Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 36015
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/36015
Summary:
Asterisk is prone to multiple remote denial-of-service vulnerabilities.

Successful exploits can crash the SIP channel driver, resulting in denial-of-service conditions for legitimate users.

The issues affect the Asterisk 1.6.1.

Please note that other versions may also include the affected code but may not be exploitable as they do not allow SIP packets to exceed 1500 bytes total.

35. Gallarific Cross Site Scripting and Authentication Bypass Vulnerabilities
BugTraq ID: 28163
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/28163
Summary:
Gallarific is prone to a cross-site scripting vulnerability and multiple authentication-bypass vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, add new categories, add new users, and modify existing users. Other attacks are also possible.

These issues affect both the commercial and the free versions of Gallarific.

36. Avant Browser 'browser:home' Multiple HTML Injection Vulnerabilities
BugTraq ID: 35898
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35898
Summary:
Avant Browser is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Avant Browser 11.7 build 35 is vulnerable; other versions may also be affected.

37. NTP 'ntpq' Stack Buffer Overflow Vulnerability
BugTraq ID: 34481
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/34481
Summary:
The 'ntpq' command is prone to a stack-based buffer-overflow vulnerability.

Successful exploits will crash the affected utility. Code execution may also be possible, but has not been confirmed.

38. BoonEx Orca Topic Title HTML Injection Vulnerability
BugTraq ID: 33545
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/33545
Summary:
BoonEx Orca is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Orca 2.0.2 is vulnerable; other versions may also be affected.

39. Mozilla Firefox and Seamonkey Regular Expression Parsing Heap Buffer Overflow Vulnerability
BugTraq ID: 35891
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35891
Summary:
Mozilla Firefox and Seamonkey are prone to a heap-based buffer-overflow vulnerability in the regular expression parser used to match common names in SSL certificates.

Successfully exploiting this issue can allow attackers to execute arbitrary code in the context of the application. Failed attempts will likely cause denial-of-service conditions.

Note that attackers need to exploit this issue with a crafted certificate that SeaMonkey trusts; otherwise, a warning message will be presented to the user.

SeaMonkey 1.09 and Firefox 3.0.x are vulnerable; other versions may also be affected.

This issue is related to the vulnerability described by BID 35888 (Mozilla Firefox NULL Character CA SSL Certificate Validation Security Bypass Vulnerability).

40. Mozilla NSS NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
BugTraq ID: 35888
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35888
Summary:
Mozilla Network Security Services (NSS) is prone to a security-bypass vulnerability because the applications fail to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones.

The NSS library is used by a number of applications, including Mozilla Firefox, Thunderbird and SeaMonkey.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

NOTE (6 August 2009): This BID was updated to include a similar issue in Fetchmail; that issue has been documented in BID 35951 (Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability) in order to better describe the vulnerability.

41. libxml2 Multiple Memory Corruption Vulnerabilities
BugTraq ID: 36010
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/36010
Summary:
libxml2 is prone to multiple memory-corruption vulnerabilities.

An attacker can exploit these issues by tricking a victim into opening a specially crafted XML file.

A successful attack can allow attacker-supplied code to run in the context of the application using the vulnerable library or cause a denial-of-service condition.

42. Pixaria Gallery 'file' Parameter Directory Traversal Vulnerability
BugTraq ID: 35802
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35802
Summary:
Pixaria Gallery is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Pixaria 2.3.5 is vulnerable; other versions may also be affected.

43. WordPress 'wp-login.php' Admin Password Reset Security Bypass Vulnerability
BugTraq ID: 36014
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/36014
Summary:
WordPress is prone to a security-bypass vulnerability because it fails to adequately restrict access to the password-reset feature.

An attacker can exploit this issue to reset the administrator password of the application. Repeated attacks may allow the attacker to cause persistent denial-of-service conditions.

WordPress version 2.8.3 is affected; other versions may also be vulnerable.

44. strongSwan Crafted X.509 Certificate Multiple Remote Denial Of Service Vulnerabilities
BugTraq ID: 35452
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35452
Summary:
strongSwan is prone to multiple remote denial-of-service vulnerabilities.

Attackers can exploit these issues to crash the application, denying access to legitimate users.

Versions prior to strongSwan 2.8.10, 4.3.2, and 4.2.16 are vulnerable.

UPDATE (July 27, 2009): Additional corrective measures were added to address these issues in strongSwan 2.8.11. 4.2.17, and 4.3.3.

45. Adobe Reader and Acrobat JBIG Segments 'Text Region' Memory Corruption Vulnerability
BugTraq ID: 35303
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35303
Summary:
Adobe Reader and Acrobat are prone to a memory corruption vulnerability.

An attacker can exploit these issues by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

46. Adobe Reader and Acrobat JBIG 'Pattern Dictionary' Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 35299
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35299
Summary:
Adobe Reader and Acrobat are prone to a remote heap-based buffer-overflow vulnerability because they fail to sufficiently sanitize user-supplied input.

An attacker can exploit this issue by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

47. Adobe Reader & Acrobat JBIG Pattern Dictionary Allocation Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 35300
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35300
Summary:
Adobe Reader and Acrobat are prone to a remote heap-based buffer-overflow vulnerability because they fail to sufficiently sanitize user-supplied input.

An attacker can exploit this issue by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

48. Adobe Reader and Acrobat JBIG 'Halftone Region' Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 35301
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35301
Summary:
Adobe Reader and Acrobat are prone to a remote heap-based buffer-overflow vulnerability because they fail to sufficiently sanitize user-supplied input.

An attacker can exploit this issue by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

49. Adobe Reader and Acrobat FlateDecode Filter Integer Overflow Vulnerability
BugTraq ID: 35294
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35294
Summary:
Adobe Reader and Acrobat are prone to an integer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code. Failed exploit attempts will likely cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

50. Adobe Reader and Acrobat TrueType Font Handling Memory Corruption Vulnerability
BugTraq ID: 35296
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35296
Summary:
Adobe Reader and Acrobat are prone to a memory-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary code. Failed exploit attempts will likely cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

51. Adobe Reader and Acrobat JBIG Halftone Region Grid Area Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 35291
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35291
Summary:
Adobe Reader and Acrobat are prone to a remote heap-based buffer-overflow vulnerability because they fail to sufficiently sanitize user-supplied input.

An attacker can exploit this issue by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

52. Adobe Reader and Acrobat Huffman-encoded JBIG2 Text Heap Overflow Vulnerability
BugTraq ID: 35302
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35302
Summary:
Adobe Reader and Acrobat are prone to a heap-based buffer-overflow vulnerability.

An attacker can exploit these issues by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

53. Adobe Reader and Acrobat JBIG2 Filter Unspecified Memory Corruption Vulnerability
BugTraq ID: 35298
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35298
Summary:
Adobe Reader and Acrobat are prone to an unspecified memory-corruption vulnerability.

An attacker can exploit this issue by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

54. Adobe Reader and Acrobat JBIG 'Halftone Region' Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 35293
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35293
Summary:
Adobe Reader and Acrobat are prone to a remote heap-based buffer-overflow vulnerability because they fail to sufficiently sanitize user-supplied input.

An attacker can exploit this issue by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

55. Adobe Reader and Acrobat U3D Model Remote Stack Buffer Overflow Vulnerability
BugTraq ID: 35282
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35282
Summary:
Adobe Reader and Acrobat are prone to a remote stack-based buffer-overflow vulnerability because they fail to adequately bounds-check user-supplied data.

An attacker can exploit this issue by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

56. Adobe Reader and Acrobat Unspecified Memory Corruption Vulnerability
BugTraq ID: 35289
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35289
Summary:
Adobe Reader and Acrobat are prone to an unspecified memory-corruption vulnerability.

Exploiting this issue will allow remote attackers to execute arbitrary code within the context of the affected application or crash the application.

NOTE: This issue was previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned its own record to better document it.

57. Adobe Reader and Acrobat Multiple Unspecified Remote Heap Buffer Overflow Vulnerabilities
BugTraq ID: 35295
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35295
Summary:
Adobe Reader and Acrobat are prone to multiple remote heap-based buffer-overflow vulnerabilities because they fail to sufficiently sanitize user-supplied input.

An attacker can exploit these issues by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

NOTE: These issues were previously covered in BID 35274 (Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities), but has been assigned their own record to better document the issues.

58. Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities
BugTraq ID: 35274
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/35274
Summary:
Adobe Reader and Acrobat are prone to multiple remote vulnerabilities.

An attacker can exploit these issues by tricking a victim into opening a malicious file to execute arbitrary code and to cause denial-of-service conditions.

The following individual records have been created to better document some of these issues:

35298 Adobe Reader and Acrobat JBIG2 Filter Unspecified Memory Corruption Vulnerability
35295 Adobe Reader and Acrobat Multiple Unspecified Remote Heap Buffer Overflow Vulnerabilities
35294 Adobe Reader and Acrobat 9.1.1 and Prior Integer Overflow Vulnerability
35296 Adobe Reader and Acrobat 9.1.1 and Prior Unspecified Memory Corruption Vulnerability
35289 Adobe Reader and Acrobat Unspecified Memory Corruption Vulnerability
35293 Adobe Reader and Acrobat JBIG 'Halftone Region' Remote Heap Buffer Overflow Vulnerability
35291 Adobe Reader and Acrobat JBIG Halftone Region Grid Area Remote Heap Buffer Overflow Vulnerability
35282 Adobe Reader and Acrobat U3D Model Remote Stack Buffer Overflow Vulnerability
35299 Adobe Reader and Acrobat JBIG 'Pattern Dictionary' Remote Heap Buffer Overflow Vulnerability
35300 Adobe Reader & Acrobat JBIG Pattern Dictionary Allocation Remote Heap Buffer Overflow Vulnerability
35301 Adobe Reader and Acrobat JBIG 'Halftone Region' Remote Heap Buffer Overflow Vulnerability
35302 Adobe Reader and Acrobat Huffman-encoded JBIG2 Text Heap Overflow Vulnerability
35303 Adobe Reader and Acrobat JBIG Segments 'Text Region' Memory Corruption Vulnerability

The vendor reports other unspecified security issues have also been addressed. Information regarding these issues is currently not available. We will update this BID as more information emerges.

59. WS_FTP Server Manager Authentication Bypass and Information Disclosure Vulnerabilities
BugTraq ID: 27654
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/27654
Summary:
WS_FTP Server Manager is prone to an authentication-bypass vulnerability and an information-disclosure vulnerability.

An attacker can exploit these issues to gain unauthorized access to the affected application and gain access to potentially sensitive information.

These issues affect WS_FTP Server Manager 6.1.0.0; prior versions may also be affected.

60. Ipswitch FTP Log Server Denial of Service Vulnerability
BugTraq ID: 27612
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/27612
Summary:
WS_FTP Log Server shipped with WS_FTP is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue allows remote attackers to crash the affected application, denying service to legitimate users.

This issue affects WS_FTP running FTP Log Server 7.9.14.0; other versions may also be affected.

61. Ipswitch WS_FTP SFTP Opendir Command Buffer Overflow Vulnerability
BugTraq ID: 27573
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/27573
Summary:
Ipswitch WS_FTP is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker may exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial of service.

This issue affects WS_FTP 6.1.0.0; other versions may also be affected.

62. Apple Safari Top Site Feature Website Promotion Security Vulnerability
BugTraq ID: 36022
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/36022
Summary:
Apple Safari is prone to a vulnerability that may aid in phishing-style attacks.

An attacker may exploit this issue to promote arbitrary sites into the Top Site views through automated actions. Successfully exploiting this issue will lead to other attacks.

Versions prior to Apple Safari 4.0.3 are vulnerable.

63. ViewVC Cross Site Scripting and Unspecified Security Vulnerabilities
BugTraq ID: 36035
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/36035
Summary:
ViewVC is prone to multiple security vulnerabilities, including:

- A cross-site scripting vulnerability.
- An unspecified security vulnerability that may allow attackers to print illegal parameter names and values.

An attacker may leverage theses issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials. Other attacks are also possible.

Versions prior to ViewVC 1.0.9 are vulnerable.

64. SAP NetWeaver Application Server 'uddiclient/process' HTML Injection Vulnerability
BugTraq ID: 36034
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/36034
Summary:
SAP NetWeaver Application Server is prone to an HTML-injection vulnerability because the application's UDDI client fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

This issue is documented by SAP Note 1322098.

65. cURL / libcURL NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
BugTraq ID: 36032
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/36032
Summary:
cURL and libcURL are prone to a security-bypass vulnerability because they fail to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones.

This issue affects cURL and libcURL when compiled against OpenSSL.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

cURL and libcURL 7.4 through 7.19.5 are vulnerable. Additional applications which use the affected library may also be vulnerable.

66. 2Wire Routers 'CD35_SETUP_01' Access Validation Vulnerability
BugTraq ID: 36031
Remote: Yes
Last Updated: 2009-08-12
Relevant URL: http://www.securityfocus.com/bid/36031
Summary:
Multiple 2Wire routers are prone to an access-validation vulnerability because they fail to adequately authenticate users before performing certain actions.

Unauthenticated attackers can leverage this issue to change the administrative password of the router. Successful attacks will completely compromise affected devices.

2Wire routers prior to Firmware version 5.29.135.5 are vulnerable.

67. Sun OpenSSO Enterprise XML Document Processing Unspecified Memory Corruption Vulnerability
BugTraq ID: 35977
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35977
Summary:
Sun OpenSSO Enterprise (formerly Sun Java System Access Manager and Sun Java System Identity Server) is prone to a memory-corruption vulnerability because it fails to properly handle specially crafted XML documents.

Very few details are available regarding this issue. We will update this BID as more information emerges.

An attacker can exploit this issue to execute arbitrary code within the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.

68. IBM AIX '_LIB_INIT_DBG' and '_LIB_INIT_DBG_FILE' File Creation Vulnerability
BugTraq ID: 35934
Remote: No
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35934
Summary:
IBM AIX is prone to multiple file-creation vulnerabilities.

An attacker with local access can exploit these issues to create arbitrary files and execute arbitrary files with superuser privileges. Successfully exploiting this issue will completely compromise affected computers.

AIX 5.3 and 6.1 are vulnerable.

69. Sun Java SE Multiple Security Vulnerabilities
BugTraq ID: 35922
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35922
Summary:
Sun has released updates to address multiple vulnerabilities in Java SE.

Very little technical information is currently available on these issues. This BID will be updated as the vendor advisories are released.

These issues are addressed in the following releases:

JDK and JRE 6 Update 15
JDK and JRE 5.0 Update 20
SDK and JRE 1.4.2_22
SDK and JRE 1.3.1_26

70. libxml2 'xmlBufferResize()' Remote Denial of Service Vulnerability
BugTraq ID: 32331
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/32331
Summary:
The 'libxml2' library is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to cause the affected application using the library to fall into an infinite loop, denying service to legitimate users.

This issue affects libxml2-2.7.2; other versions may also be affected.

71. libxml2 'xmlSAX2Characters()' Integer Overflow Vulnerability
BugTraq ID: 32326
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/32326
Summary:
The 'libxml2' library is prone to an integer-overflow vulnerability because it fails to properly verify user-supplied data when handling XML files.

Successful exploits of this vulnerability allow remote attackers to execute arbitrary machine code in the context of an affected application. Failed exploits may crash the application.

This issue affects libxml2-2.7.2; other versions may also be affected.

72. Microsoft Windows Malformed AVI File Parsing Remote Integer Overflow Vulnerability
BugTraq ID: 35970
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35970
Summary:
Microsoft Windows is prone to a remote integer-overflow vulnerability.

This issue arises when an affected Windows component handles a malicious Audio Video Interleave (AVI) file.

An attacker can exploit this issue to execute arbitrary code with the privileges of the affected user. Failed exploit attempts will result in a denial-of-service condition.

NOTE: The affected Windows operating system component is independent of Windows Media Player therefore this issue does not specifically affect Windows Media Player.

73. Microsoft Windows Malformed AVI File Header Parsing Remote Code Execution Vulnerability
BugTraq ID: 35967
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35967
Summary:
Microsoft Windows is prone to a remote code-execution vulnerability.

This issue arises when an affected Windows component handles a malicious Audio Video Interleave (AVI) file.

An attacker can exploit this issue to execute arbitrary code with the privileges of the affected user. Failed exploit attempts will result in a denial-of-service condition.

NOTE: The affected Windows operating system component is independent of Windows Media Player therefore this issue does not specifically affect Windows Media Player.

74. PulseAudio setuid Local Privilege Escalation Vulnerability
BugTraq ID: 35721
Remote: No
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35721
Summary:
PulseAudio is prone to a local privilege-escalation vulnerability caused by a race-condition error.

Exploiting this issue could allow attackers to perform actions with superuser privileges, resulting in a complete compromise of affected computers.

75. Motorola Timbuktu Pro 'PlughNTCommand' Named Pipe Remote Stack Buffer Overflow Vulnerability
BugTraq ID: 35496
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35496
Summary:
Motorola Timbuktu Pro for Windows is prone to a remote stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Failed exploit attempts will result in denial-of-service conditions.

Versions prior to Timbuktu Pro 8.6.7 for Windows are vulnerable.

76. Microsoft Active Template Library Object Type Mismatch Remote Code Execution Vulnerability
BugTraq ID: 35982
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35982
Summary:
The Microsoft Active Template Library is prone to a remote code-execution vulnerability.

This issue affects a private version of the ATL used internally by Microsoft; components written by other vendors are unlikely to be affected.

Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running an application built against the affected library. Failed exploit attempts will result in a denial-of-service condition.

77. FreeBSD 'mount(2)' and 'nmount(2)' Multiple Stack Buffer Overflow Vulnerabilities
BugTraq ID: 31002
Remote: No
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/31002
Summary:
FreeBSD is prone to multiple stack-based buffer-overflow vulnerabilities because the kernel fails to perform adequate boundary checks on user-supplied data.

A local attacker can exploit these issues to execute arbitrary code with kernel-level privileges. Successfully exploiting these issues will result in the complete compromise of affected computers. Failed exploit attempts will cause a denial-of-service condition.

FreeBSD 7.0-RELEASE and 7.0-STABLE are vulnerable.

78. SafeNet SoftRemote IKE Service Remote Stack Buffer Overflow Vulnerability
BugTraq ID: 35154
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35154
Summary:
SafeNet SoftRemote is prone to a remote stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to SoftRemote 10.8.6 are vulnerable.

79. Unisys Business Information Server Remote Stack Buffer Overflow Vulnerability
BugTraq ID: 35494
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35494
Summary:
Unisys Business Information Server (formerly known as MAPPER) is prone to a remote stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of an affected server, possibly with SYSTEM-level privileges. Failed exploit attempts will result in denial-of-service conditions.

Business Information Server 10 and 10.1 are vulnerable; other versions may also be affected.

80. IETF and W3C XML Digital Signature Specification HMAC Truncation Authentication Bypass Vulnerability
BugTraq ID: 35671
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35671
Summary:
The IETF and W3C XML Digital Signature Specification is prone to an authentication-bypass vulnerability.

Attackers may exploit this issue to forge signatures to arbitrary XML data. This may lead to further attacks.

Note that the specification doesn't require implementations to accept all truncation length values. As a result, not all implementations of the XML Digital Signature Specification will be affected by this issue.

81. Microsoft Visual Studio Active Template Library COM Object Remote Code Execution Vulnerability
BugTraq ID: 35828
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35828
Summary:
Microsoft Visual Studio is prone to a remote code-execution vulnerability in the Active Template Library (ATL).

Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running an application built against the affected library. Failed exploit attempts will result in a denial-of-service condition.

82. Microsoft Visual Studio ATL 'VariantClear()' Remote Code Execution Vulnerability
BugTraq ID: 35832
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35832
Summary:
Microsoft Visual Studio is prone to a remote code-execution vulnerability in the Active Template Library (ATL).

Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running an application built with the affected library.

83. Microsoft Active Template Library 'IPersistStreamInit' Remote Code Execution Vulnerability
BugTraq ID: 35585
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35585
Summary:
The Microsoft Active Template Library is prone to a remote code-execution vulnerability.

This issue affects a private version of the ATL used internally by Microsoft; components written by other vendors are unlikely to be affected.

Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running an application built against the affected library. Failed exploit attempts will result in a denial-of-service condition.

NOTE: This BID was previously titled "Microsoft Windows 'msvidctl.dll' ActiveX Control Unspecified Remote Memory Corruption Vulnerability". It has been updated to better document the underlying issue.

84. Microsoft Active Template Library Header Data Remote Code Execution Vulnerability
BugTraq ID: 35558
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35558
Summary:
The Microsoft Active Template Library is prone to a remote code-execution vulnerability.

This issue affects a private version of the ATL used internally by Microsoft; components written by other vendors are unlikely to be affected.

Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running an application built against the affected library. Failed exploit attempts will result in a denial-of-service condition.

NOTE: This BID was previously titled "Microsoft Windows 'MPEG2TuneRequest' ActiveX Control Remote Code Execution Vulnerability". It has been updated to better reflect the underlying issue.

85. Microsoft Windows WINS Server Network Buffer Length Integer Overflow Vulnerability
BugTraq ID: 35981
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35981
Summary:
The Microsoft Windows WINS Server is prone to a remote integer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will completely compromise affected computers. Failed exploit attempts will result in a denial-of-service condition.

86. Sun Solaris XScreenSaver Popup Windows Local Information Disclosure Vulnerability
BugTraq ID: 35964
Remote: No
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35964
Summary:
Solaris XScreenSaver is prone to a local information-disclosure vulnerability.

A local attacker can exploit this issue to obtain sensitive information that may lead to further attacks.

NOTE: This issue may be related to the vulnerability described in BID 34421 but this could not be confirmed. We will update this BID when more information becomes available.

This issue affects the following on both SPARC and x86 platforms:

Solaris 8
Solaris 9
Solaris 10
OpenSolaris builds snv_01 through snv_119

87. Microsoft OWC ActiveX Control 'BorderAround()' Heap Corruption Remote Code Execution Vulnerability
BugTraq ID: 35991
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35991
Summary:
Microsoft Office Web Components ActiveX control is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to visit a maliciously crafted webpage.

Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the affected application that uses the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

88. Microsoft Remote Desktop Connection Client Heap Based Buffer Overflow Vulnerability
BugTraq ID: 35971
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35971
Summary:
Microsoft Remote Desktop Connection client is prone to a heap-based buffer-overflow vulnerability when processing certain parameters returned by a malicious RDP (Remote Desktop Protocol) server.

Successfully exploiting this issue would allow an attacker to corrupt heap memory and execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely cause denial-of-service conditions.

89. Samba Arbitrary Memory Contents Information Disclosure Vulnerability
BugTraq ID: 32494
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/32494
Summary:
Samba is prone to an information-disclosure vulnerability.

Successful exploits will allow attackers to obtain arbitrary memory contents.

This issue affects Samba 3.0.29 through 3.2.4.

90. Microsoft Office Web Components ActiveX Control 'msDataSourceObject()' Code Execution Vulnerability
BugTraq ID: 35642
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35642
Summary:
Microsoft Office Web Components is prone to a remote code-execution vulnerability that affects the OWC10.Spreadsheet ActiveX control. The control is identified by the following CLSIDs:

0002E541-0000-0000-C000-000000000046
0002E559-0000-0000-C000-000000000046

An attacker could exploit this issue by enticing a victim to visit a maliciously crafted site.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

91. Microsoft Windows WINS Server Network Packet Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 35980
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35980
Summary:
The Microsoft Windows WINS Server is prone to a remote heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary-checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will completely compromise affected computers. Failed exploit attempts will result in a denial-of-service condition.

92. Microsoft Office Web Components ActiveX Control Memory Allocation Code Execution Vulnerability
BugTraq ID: 35990
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35990
Summary:
Microsoft Office Web Components OWC10 ActiveX control is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to visit a maliciously crafted webpage.

Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the affected application that uses the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

93. CoreGraphics Font Glyph Rendering Library Remote Code Execution Vulnerability
BugTraq ID: 35774
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35774
Summary:
CoreGraphics is prone to a remote code-execution vulnerability.

Successful exploits may allow an attacker to execute arbitrary code in the context of the user running an affected application. Failed attempts will likely result in denial-of-service conditions.

This issue is related to the issue described in BID 34870 (Pango 'pango_glyph_string_set_size()' Integer Overflow Vulnerability).

NOTE: This issue was previously covered in BID 35758 (Mozilla Firefox MFSA 2009-34, -35, -36, -37, -39, -40 Multiple Vulnerabilities) but has been assigned its own record to better document the issue.

94. Microsoft ASP.NET Request Scheduling Denial Of Service Vulnerability
BugTraq ID: 35985
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35985
Summary:
Microsoft ASP.NET is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause the application pool on the affected webserver to become unresponsive, denying service to legitimate users.

NOTE: This issue only affects ASP.NET on webservers running IIS 7 in integrated mode.

95. Microsoft Windows Embedded OpenType Font Engine Integer Overflow Vulnerability
BugTraq ID: 35187
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35187
Summary:
Microsoft Windows is prone to a remotely exploitable integer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.

Remote attackers can exploit this issue to execute arbitrary machine code in the context of the vulnerable software on the targeted user's computer.

96. Microsoft Windows Embedded OpenType Font Engine Heap Overflow Vulnerability
BugTraq ID: 35186
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35186
Summary:
Microsoft Windows is prone to a remotely exploitable heap-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.

Remote attackers can exploit this issue to execute arbitrary machine code in the context of the vulnerable software on the targeted user's computer.

97. Microsoft Visual Studio Active Template Library NULL String Information Disclosure Vulnerability
BugTraq ID: 35830
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35830
Summary:
Microsoft Visual Studio is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to read local memory, which may help the attacker obtain sensitive information or launch further attacks.

98. libxml XML Entity Name Heap Buffer Overflow Vulnerability
BugTraq ID: 31126
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/31126
Summary:
The 'libxml' library is prone to a heap-based buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary within the context of an application using the affected library. Failed exploit attempts will result in a denial-of-service vulnerability.

99. Sun Java Runtime Environment XML Parsing Denial of Service Vulnerability
BugTraq ID: 35958
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35958
Summary:
Sun Java Runtime Environment (JRE) is prone to a denial-of-service vulnerability.

Attackers may exploit this issue to cause denial-of-service conditions in applications that use the vulnerable environment.

This issue affects the following:

JDK and JRE 6 Update 14 and prior
JDK and JRE 5.0 Update 19 and prior

NOTE: This issue was previously covered in BID 35922 (Sun Java SE Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

100. Adobe Flash Player and AIR Unspecified Privilege Escalation Vulnerability
BugTraq ID: 35900
Remote: Yes
Last Updated: 2009-08-11
Relevant URL: http://www.securityfocus.com/bid/35900
Summary:
Adobe Flash Player and Adobe AIR are prone to an unspecified privilege-escalation vulnerability.

Very few details are available regarding this issue. We will update this BID as more information emerges.

Attackers can exploit this issue to execute arbitrary code with elevated privileges. Successfully exploiting this issue will compromise the affected application and possibly the computer.

This issue affects versions *prior to* the following:

Flash Player 10.0.32.18
AIR 1.5.2

This issue was previously covered in BID 35890 (Adobe Flash Player and AIR Multiple Security Vulnerabilities) but has been given its own record to better document it.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Web attacks hit U.S., South Korean sites
By: Robert Lemos
In its fourth day, a widespread distributed denial-of-service attack continued to inundate U.S. government and South Korean Web sites with network traffic.
http://www.securityfocus.com/news/11554

2. FTC persuades court to shutter rogue ISP
By: Robert Lemos
A federal district court shuts down Triple Fiber Network, after the Federal Trade Commission documents the Internet service provider's cooperation with online criminals and child pornographers.
http://www.securityfocus.com/news/11552

3. Obama launches cybersecurity initiative
By: Robert Lemos
The U.S. president announces that the nation's networks will be considered a "strategic national asset" and creates a top position in the White House to formulate a better cybersecurity policy.
http://www.securityfocus.com/news/11551

4. Browsers bashed first in hacking contest
By: Robert Lemos
A security researcher keeps a vulnerability on ice for an entire year, before using it at the Pwn2Own contest to exploit Apple's browser. Microsoft's Internet Explorer 8 falls soon after.
http://www.securityfocus.com/news/11549

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe (at) securityfocus (dot) com [email concealed] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email listadmin (at) securityfocus (dot) com [email concealed] and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This issue is sponsored by SC World Congress

Make plans now to attend the second annual SC World Congress - Enterprise Data Security, October 13-14 in New York City. The Congress features a comprehensive, two-day program presented in four tracks-including the unique Editors Choice sessions-and the industry's largest fall product expo showcasing IT security solutions from the leading vendors and hot start-ups. Emphasizing quality content, innovative formats and sessions, global perspectives and ROI, this is the one event you can't afford to miss. Register by August 31 for big savings. www.scworldcongress.com

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus