A patch has been written and released that covers the vulnerabilities out-lined above.

the patch is availiable here:

http://www.myupb.com/forum/viewtopic.php?id=26&t_id=118

[ more ]  [ reply ]

Hello

While working on the FreeBSD Security Advisory for the recent tcpdump
issues (CAN-2005-1278, CAN-2005-1279, and CAN-2005-1280) I noticed
another similar infinite loop DoS vulnerability in the BGP handling
code. It affects at least tcpdump 3.8.3 and tcpdump 3.9 snapshots
from before May 5.

T

[ more ]  [ reply ]

Sudo version 1.6.8, patchlevel 9 is now available, which fixes a
race condition in Sudo's pathname validation. This is a security
issue.

Summary:
A race condition in Sudo's command pathname handling prior to
Sudo version 1.6.8p9 that could allow a user with Sudo privileges
to run arbit

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Happy Python Hackers Project
www.hardened-php.net

-= Security Advisory =-

Advisory: Fileupload/download vulnerability in Trac
Release Date: 2005/06/20
Last Modified: 2005/06/2

[ more ]  [ reply ]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200506-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ]  [ reply ]

SEC-CONSULT Security Advisory < 20050616-0 >
=======================================================================
title: Source Code Disclosure in Yaws Webserver
program: Yaws Webserver
vulnerable version: 1.55 and earlier
homepage: http://yaw

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hey BugTraq,

I just wanted to let you know we got some new content on-line as well as a reminder about upcoming registration deadlines. Hope to see you there!

REMINDER: Register before July 1st to take advantage of the earlier pricing!
http://www.bl

[ more ]  [ reply ]

Security Advisory: JBOSS 3.2.2-3.2.7 / 4.0.2 installation path
disclosure / config disclosure / version fingerprinting
Date: 14/06/05
URL: http://www.illegalaccess.org/java/jboss_path.php

Problem:
The default installation of JBoss reveals the path of the installation
directory and
allows fingerp

[ more ]  [ reply ]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200506-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ]  [ reply ]

#!/usr/bin/perl
#
# Passwords Decrypter for UPB <= 1.9.6
# Related advisory:
http://www.securityfocus.com/archive/1/402461/30/0/threaded
# Discovered and Coded by Alberto Trivero

use Getopt::Std;
use LWP::Simple;
getopt('hfu');

print "\n\t========================================\n";
print "\t= Pas

[ more ]  [ reply ]

Hello,

The e107 is an open-source, PHP and SQL based portal and content
management system[1]. I found some new vulnerabilities in the current
release v0.617. Also some "older" flaws[2] has been re-discovered in
different ways. This email has been sent some months ago to the e107
developers. They f

[ more ]  [ reply ]

XML External Entity (XXE) Attack Possible in Adobe Reader 7
-----------------------------------------------------------

SHH #7, 2005-06-16

Description
-----------

Recent versions of Adobe Reader (previously known as Acrobat Reader)
are vulnerabl

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Guys,

This is a general feeler email. Due to the popularity of SquirrelMail,
and the fact it is packaged with quite a few distributions, the
SquirrelMail administration team are looking to setup a "vendor"
notification list to work in conjunction wi

[ more ]  [ reply ]

Hello All,

Several cross site scripting (XSS) vulnerabilties have been discovered
in SquirrelMail versions 1.4.0 - 1.4.4. These have been addressed in a
patch that can be found at [1]. We advise all our users to apply this
patch. We're also releasing SquirrelMail 1.4.5 release candidate 1
today. We

[ more ]  [ reply ]

M4DR007-06SA (security advisory): Multiple vulnerabilities in UPB 1.9.6 GOLD

Published: 06 16 2005

Released: 06 16 2005

Name: Ultimate PHP Board (UPB)

Affected Systems: <= 1.9.6 GOLD

Issue: Full Path Disclosure, Cross-Site Scripting, Sensitive Information
Disclosure

Author: Alberto Trivero

Ve

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Update Advisory
_______________________________________________________________________

Package name: gedit
Advisory ID:

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Update Advisory
_______________________________________________________________________

Package name: tcpdump
Advisory ID:

[ more ]  [ reply ]

EEYEB-20050316 - HTML Help File Parsing Buffer Overflow

Release Date:
June 14, 2005

Date Reported:
March 16, 2005

Severity:
High (Remote Code Execution)

Vendor:
Microsoft

Systems Affected:
Windows 98 / 98 SE
Windows Me
Windows 2000 Service Pack 3 / Service Pack 4
Windows XP Service Pack 1 / Ser

[ more ]  [ reply ]

" * Denying any user (even Administrator) to write to the hosts file.
* Denying any user (even Administrator) to change your DNS settings."

Then who is going to modify the settings?





> On 6/14/05, lists @ NGSEC <lists (at) ngsec (dot) com [email concealed]> wrote:
> >
> > -----BEGIN PGP SIGNED MESSAGE-

[ more ]  [ reply ]

MADSHEEP-05SA (security advisory): WebHints <= v1.03 Remote Command
Execution Vulnerability

06/11/2005

MADSHEEP-05SA (security advisory): WebHints <= v1.03 Remote Command
Execution Vulnerability

Published: 06 11 2005

Released: 06 11 2005

Name: WebHints

Affected Systems: <= 1.03

Issue: R

[ more ]  [ reply ]

[ more ]  [ reply ]

Product : Mambo 4.5.2.2 (http://www.mamboserver.com)
Summary: Mambo 4.5.2.2 and below SQL Injection in UPDATE statement
Severity: Low

Description
===========
Mambo is a full-featured management system that can be used for everything
from simple websites to complex corporate applications.

Detail

[ more ]  [ reply ]

seems I did missing something?
in past reliabl vuln info for Adobe only comes from iDefense and Secunia.
yesterday friend send me this link:
http://www.adobe.com/support/security/main.html

is this new or what? anybody more info on this?

------------------
root your admin......

[ more ]  [ reply ]

##########################################################
# GulfTech Security Research June 14th, 2005
##########################################################
# Vendor : php Arena
# URL : http://www.phparena.net/pafiledb.php
# Version : paFileDB 3.1 && Earlier
# Risk : Multiple

[ more ]  [ reply ]

SANS (http://isc.sans.org/) has published a detailed description of Microsoft's bulletin.

Take a deeper look at MS05-027 a new worm may be on his way.

albatross

[ more ]  [ reply ]