|
|
Colapse all |
Post message
Multiple vulnerabilities within RockLiffe MailSite Express WebMail 2005-10-28 Paul Craig (paul craig security-assessment com) File Including In PBLang 2005-10-27 abducter_minds yahoo com Class: Input Validation Error CVE: CVE-MAP-NOMATCH Remote: Yes Local: Yes Credit: Abducter (ABDUCTER_MINDS (at) YAHOO (dot) COM [email concealed]) Or (ABDUCTER_MINDS76 (at) HOTMAIL (dot) COM [email concealed]) Vulnerable: File Including In PBLang 4.65 (ALL VERSION) * info * PBLang IS POWER PHP SITES SUPPORT HERE http://pblang.drmartinus.de/ [ more ] [ reply ] iDefense Security Advisory 10.28.05: Multiple Vendor chmlib CHM File Handling Buffer Overflow Vulnerability 2005-10-28 iDEFENSE Labs (labs-no-reply idefense com) Multiple Vendor chmlib CHM File Handling Buffer Overflow Vulnerability iDefense Security Advisory 10.28.05 www.idefense.com/application/poi/display?id=332&type=vulnerabilities October 28, 2005 I. BACKGROUND chmlib is a library for dealing with Microsoft ITSS/CHM format files. II. DESCRIPTION [ more ] [ reply ] MDKSA-2005:200 - Updated apache-mod_auth_shadow packages fix security restriction bypass issues. 2005-10-27 Mandriva Security Team (security mandriva com) [ GLSA 200510-22 ] SELinux PAM: Local password guessing attack 2005-10-28 Thierry Carrez (koon gentoo org) [ GLSA 200510-23 ] TikiWiki: XSS vulnerability 2005-10-28 Thierry Carrez (koon gentoo org) (1 replies) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200510-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - [ more ] [ reply ] Re: [ GLSA 200510-23 ] TikiWiki: XSS vulnerability 2005-10-28 dave canuck (dave_canuck2001 yahoo com) MDKSA-2005:201 - Updated sudo packages fix vulnerability 2005-10-27 Mandriva Security Team (security mandriva com) [SECURITY] [DSA 878-1] New netpbm-free packages fix arbitrary code execution 2005-10-28 joey infodrom org (Martin Schulze) [SECURITY] [DSA 877-1] New gnump3d packages fix several vulnerabilities 2005-10-28 joey infodrom org (Martin Schulze) [CIRT.DK] - Novell ZENworks Patch Management Server 6.0.0.52 - SQL injection 2005-10-27 CIRT.DK Advisory (advisory cirt dk) The Novell ZENworks Patch Management Server 6.0.0.52 is vulnerable to SQL injection in the management console. To being able to exploit this issue the administrator have to manually created a none-privileged account as minimum, to allow exploitation. Fix: Upgrade to ZENworks Patch Management ve [ more ] [ reply ] [SECURITY] [DSA 876-1] New lynx-ssl packages fix arbitrary code execution 2005-10-27 joey infodrom org (Martin Schulze) [SECURITY] [DSA 875-1] New OpenSSL packages fix cryptographic weakness 2005-10-27 joey infodrom org (Martin Schulze) fetchmail security announcement 2005-02 (CVE-2005-3088) 2005-10-27 ma+nomail dt e-technik uni-dortmund de fetchmail-SA-2005-02: security announcement Topic: password exposure in fetchmailconf Author: Matthias Andree Version: 1.02 Announced: 2005-10-21 Type: insecure creation of file Impact: passwords are written to a world-readable file Danger: medium Credits: Thomas Wolff, Miloslav Trmac for poi [ more ] [ reply ] [SECURITY] [DSA 874-1] New lynx packages fix arbitrary code execution 2005-10-27 joey infodrom org (Martin Schulze) MDKSA-2005:199 - Updated netpbm packages fix pnmtopng vulnerabilities 2005-10-26 Mandriva Security Team (security mandriva com) RE: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte 2005-10-25 Debasis Mohanty (mail hackingspirits com) Hello Andrey, Few comments on this - Correct me if I am wrong, "forged magic byte" might not always be able to fool the AV in real scenario (especially EXEs) unless you are talking about Static Virus scanners. In past few years the AV scanning technology has improved a lot and has gone even beyond [ more ] [ reply ] MDKSA-2005:196 - Updated perl-Compress-Zlib packages fix vulnerabilities 2005-10-26 Mandriva Security Team (security mandriva com) MDKSA-2005:194 - Updated php-imap packages fix buffer overflow vulnerabilities. 2005-10-26 Mandriva Security Team (security mandriva com) MDKSA-2005:195 - Updated squid packages fix vulnerabilities 2005-10-26 Mandriva Security Team (security mandriva com) MDKSA-2005:186-1 - Updated lynx packages fix remote buffer overflow 2005-10-26 Mandriva Security Team (security mandriva com) MDKSA-2005:197 - Updated unzip packages fix suid, permissions vulnerabilities. 2005-10-26 Mandriva Security Team (security mandriva com) MDKSA-2005:198 - Updated uim packages fix suid linking vulnerabilities. 2005-10-26 Mandriva Security Team (security mandriva com) MDKSA-2005:193-1 - Updated ethereal packages fix multiple vulnerabilities 2005-10-26 Mandriva Security Team (security mandriva com) Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through 2005-10-26 Andreas Marx (gega-it web de) Hi! Thanks, that's interesting to read. In 2000, I've found and suggested the following in an article I've written for the Virus Bulletin magazine <http://www.virusbtn.com> : "[...] Some scanners do not actually scan all files even when set to "scan all files" or when the mask "*.*" is used. Most [ more ] [ reply ] Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through 2005-10-26 Andrey Bayora (andrey securityelf org) Hi Andreas Marx, It is ironic that now the AV programs implemented the "smart" file format checking, but "forgot" about file extensions :) I think, that "smart" file format checking must be complemented with the "smart" file extension checking. Regards, Andrey Bayora. ----- Original Message ---- [ more ] [ reply ] Update for the magic byte bug 2005-10-26 Andrey Bayora (andrey securityelf org) UPDATE, October 26, 2005 - Updated list of the vulnerable products. Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte. AUTHOR: Andrey Bayora (www.securityelf.org) For more details, screenshots and examples please read my article "The Magic of magic byt [ more ] [ reply ] |
|
Privacy Statement |
= Multiple vulnerabilities within RockLiffe MailSite Express WebMail
=
= Also available online at
=
http://www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_
Vuln
erabilities.pdf
=
= Vendor Website:
= http://www
[ more ] [ reply ]