SecurityFocus

RE: Recent Oracle exploit is _actually_ an 0day with no patch 2006-04-28
Kornbrust, Alexander (ak red-database-security com)

Cesar, David and Steve,

I agree with your opinion. Oracle is not really fast fixing security
issues.

Currently I have 40+ OPEN/UNFIXED security issues in Oracle products. A
detailed list from Oracle secalert (Report March 2006) can be found at
the end of this email or (the latest version) on my w

[ more ] [ reply ]

Neomail.pl Local Cross Site Scripting 2006-04-28
outlaw aria-security net

#Aria-Security.net Advisory

#Discovered by: O.u.t.l.a.w

#< www.Aria-security.net >

#Gr33t to: A.u.r.a & R@1D3N & Smok3r

#-----------------------------------------------------------

Software: Neomail WebMail

Link: http://neomail.sourceforge.net/

Attack method: Cross Site Scripting

advisory:

[ more ] [ reply ]

[Kurdish Security #2] Artmedic Event Remote File Include Vulnerability 2006-04-28
botan linuxmail org

Original Advisory : http://kurdishsecurity.blogspot.com/2006/04/artmedic-event-remote-file-i
nclude.html

#Artmedic Event Remote File Include Vulnerability

#Website : http://www.artmedic.de/

#Script : Artmedic Event Script

#Risk : High

#Class : Remote

#Greetz : B3g0k,Nistiman,Flot,Netqurd etc

[ more ] [ reply ]

[ GLSA 200604-18 ] Mozilla Suite: Multiple vulnerabilities 2006-04-28
Thierry Carrez (koon gentoo org)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200604-18
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ] [ reply ]

[Kurdish Security #3] CoolMenus Event Remote File Include Vulnerability (For PHP) 2006-04-28
botan linuxmail org

Original Advisory : http://kurdishsecurity.blogspot.com/2006/04/coolmenus-event-remote-file-
include.html

#ColMenus Event Remote File Include Vulnerability#

#Website : http://coolmenus.dhtmlcentral.com/projects/coolmenus [Closed]

#Script : CoolMenus v4.0 Event Script

#Risk : High

#Class : Remo

[ more ] [ reply ]

Re: Recent Oracle exploit is _actually_ an 0day with no patch 2006-04-28
Cesar (cesarc56 yahoo com)

David is right, we also have reported hundreds of
vulnerabiities to Oracle and they only fix what you
report to them, they don't care to fix the same
vulnerability on different portions of code, one good
example is that Oracle should have eliminated SQL
injection bugs since long time ago but there a

[ more ] [ reply ]

[Argeniss] Alert - Yahoo! Mail XSS vulnerability 2006-04-28
Cesar (cesarc56 yahoo com)

Yahoo! Mail XSS vulnerability

Description:

Yahoo! Mail is a very insecure and free Web Mail
service. It allows HTML messages but it has filters to
avoid malicius script being executed on users
browsers. On 17 April 2006 I received a message that
when viewed it redirected to a fake Yahoo! Mail logi

[ more ] [ reply ]

[ECHO_ADV_31$2006] Sws Web Server 0.1.7 Strcpy() & Syslog() Format String Vulnerability 2006-04-28
the_day echo or id

------------------------------------------------------------------------
---------------

[ECHO_ADV_31$2006] Sws Web Server 0.1.7 Strcpy() & Syslog() Format String Vulnerability

------------------------------------------------------------------------
---------------

Author : Dedi Dwianto

Da

[ more ] [ reply ]

WinISO/UltraISO/MagicISO/PowerISO Directory Traversal Vulnerability 2006-04-28
Sowhat (smaillist gmail com)

WinISO/UltraISO/MagicISO/PowerISO Directory Traversal Vulnerability

By Sowhat of Nevis Labs
Date: 2006.04.28

http://www.nevisnetworks.com
http://secway.org/advisory/AD20060428.txt

CVE: N/A

Vendor

WinISO Computing Inc.
EZB Systems, Inc.
MagicISO Inc.
PowerISO Computing, Inc.

Affected Softw

[ more ] [ reply ]

Secunia Research: Servant Salamander unacev2.dll Buffer OverflowVulnerability 2006-04-28
Secunia Research (remove-vuln secunia com)

======================================================================

Secunia Research 28/04/2006

- Servant Salamander unacev2.dll Buffer Overflow Vulnerability -

======================================================================
Table of Contents

Affected Software.

[ more ] [ reply ]

Cireos Portal Cross Site Scripting 2006-04-28
outlaw aria-security net

#Aria-Security.net Advisory

#Discovered by: O.u.t.l.a.w

#< www.Aria-security.net>

#Gr33t to: A.u.r.a & R@1D3N & Smok3r

#-----------------------------------------------------------

Software: SirceOS Operative Solutions

Link: http://www.circeos.it

Attack method: Cross Site Scripting

advisory

[ more ] [ reply ]

Re: Recent Oracle exploit is _actually_ an 0day with no patch 2006-04-28
David Litchfield (davidl ngssoftware com)

>
>>The recent Oracle exploit posted to Bugtraq
>>(http://www.securityfocus.com/archive/1/431353) is actually an 0day
>>and has no patch.
>
> The referenced exploit seems to use GET_DOMAIN_INDEX_METADATA with a
> TYPE_NAME that references an attacker-defined package with a
> (modified?) ODCIIndexGet

[ more ] [ reply ]

Re: Recent Oracle exploit is _actually_ an 0day with no patch 2006-04-27
Steven M. Christey (coley mitre org)

>The recent Oracle exploit posted to Bugtraq
>(http://www.securityfocus.com/archive/1/431353) is actually an 0day
>and has no patch.

The referenced exploit seems to use GET_DOMAIN_INDEX_METADATA with a
TYPE_NAME that references an attacker-defined package with a
(modified?) ODCIIndexGetMeta functi

[ more ] [ reply ]

BL4's SMTP server BufferOverflow Vulnerable 2006-04-27
the_day echo or id

------------------------------------------------------------------------
---

[ECHO_ADV_30$2006] BL4's SMTP server BufferOverflow Vulnerable

------------------------------------------------------------------------
---

Author : Dedi Dwianto

Date : April, 27th 2006

Location : Ind

[ more ] [ reply ]

[SECURITY] [DSA 1045-1] New OpenVPN packages fix arbitrary code execution 2006-04-27
joey infodrom org (Martin Schulze)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 1045-1 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
April 27th, 2006

[ more ] [ reply ]

[USN-275-1] Mozilla vulnerabilities 2006-04-27
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice USN-275-1 April 27, 2006
mozilla vulnerabilities
CVE-2005-4134, CVE-2006-0292, CVE-2006-0296, CVE-2006-0748,
CVE-2006-0749, CVE-2006-1727, CVE-2006-1728, CVE-2006-1729,
CVE-2006-1730, CVE-2006-1731, CVE-2006-1732

[ more ] [ reply ]

Re: Instant Photo Gallery <= Multiple XSS 2006-04-27
Steven M. Christey (coley mitre org)

security curmudgeon mentioned:

> /portfolio.php?cat_id=[XSS]

Based on source inspection of 1.0.2, this parameter is cleansed.

line 31 of portfolio.php says:

$catId = $dbFilter->db_clean_input($_GET['cat_id'], 'integer');

which looks like it's going to do input validation as an integer.

BUT

[ more ] [ reply ]

[SECURITY] [DSA 1046-1] New Mozilla packages fix several vulnerabilities 2006-04-27
joey infodrom org (Martin Schulze)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 1046-1 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
April 27th, 2006

[ more ] [ reply ]

[security bulletin] HPSBMA02113 SSRT061148 rev.1 - HP Oracle for OpenView (OfO) Critical Patch Update April 2006 2006-04-27
security-alert hp com

[security bulletin] HPSBUX02075 SSRT051074 rev.4 - HP-UX Running xterm Local Unauthorized Access 2006-04-27
security-alert hp com

SQL injection exploit IPB <= 2.1.4 2006-04-27
satanchild123 hotmail com

This exploit has only been tested on 2.1.4. Others are most likely vulnerable but have not yet been tested.

Simple SQL injection in func_msg.php on line 448. to_by_id is not properly sanitized. It's passed to the class via an instance of the messenger class, which takes it from the ipb sanitized

[ more ] [ reply ]

[ GLSA 200604-17 ] Ethereal: Multiple vulnerabilities in protocol dissectors 2006-04-27
Sune Kloppenborg Jeppesen (jaervosz gentoo org)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200604-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ] [ reply ]

Re: Instant Photo Gallery <= Multiple XSS 2006-04-27
security curmudgeon (jericho attrition org)

: Discovered by: Qex
: Date: 25 April 2006
:
: /member.php?action=viewpro&member=[XSS]

Can you confirm this? Doing a quick grep of the 1.0.2 source code finds no
occurace of "viewpro" at all. The line above also happens to be exactly
the same as your DevBB disclosure, suggesting this may be a

[ more ] [ reply ]

[security bulletin] HPSBUX02108 SSRT061133 rev.9 - HP-UX running Sendmail, Remote Execution of Arbitrary Code 2006-04-27
security-alert hp com

Land Down Under 802 and below version Path Disclosure Vulnerability 2006-04-27
Advisory Aria-Security net

Land Down Under 802 and below version Path Disclosure Vulnerability

#-----------------------------------------------------------------------
--------------------------------------------------------

#Aria-Security.net Advisory

#Discovered by:R@1D3N (amin emami)

#date:21/04/2006

#original advi

[ more ] [ reply ]

[USN-274-1] MySQL vulnerability 2006-04-27
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice USN-274-1 April 27, 2006
mysql-dfsg vulnerability
CVE-2006-0903
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ub

[ more ] [ reply ]

=?iso-8859-1?q??= 2006-04-27
Yannick von Arx (security slashdot ch)

Firefox, and IE are not a problem. The problem is the AppleWebKit 417.9, and this is "only" used by Safari.

An example:
TextEdit is also using the WebKit. Post the code into a document and open it with Apple's TextEdit... <- will slow down and crash ;-) the same is with SubEthaEdit... <- both bas

[ more ] [ reply ]

MyBB 1.1.1 Local SQL Injections 2006-04-27
o y 6 hotmail com

MyBB Local SQL Injections ..

[ This Local Injections Only For Admin ]

* 1 *

[code]

adminfunctions.php , line 730

$db->query("INSERT INTO ".TABLE_PREFIX."adminlog (uid,dateline,scriptname,action,querystring,ipaddress) VALUES ('".$mybbadmin['uid']."','".$now."','".$scriptname."','".$mybb-

[ more ] [ reply ]

Re: Invision Vulnerabilities, including remote code execution 2006-04-27
mattmecham gmail com

A fix has been made available: http://forums.invisionpower.com/index.php?showtopic=213374

[ more ] [ reply ]

Re: Apple Mac OS X Safari 2.0.3 Vulnerability 2006-04-26
Aaron Phillips (Aaron systech-computers com)

Konqueror 2.3.1 and Firefox 2.0a1 don't appear to be vulnerable. Be nice to
hear about Opera and IE.

On Wednesday 26 April 2006 07:41, jens (at) mac (dot) com [email concealed] wrote:
> All this does is cause Safari to allocate oodles of memory. It won't crash
> or hang the OS, just cause it to slow down due to VM paging. Wai

[ more ] [ reply ]