SecurityFocus

Gamespy cd-key validation system: Cd-key never in use 2005-05-04
Luigi Auriemma (aluigi autistici org)

#######################################################################

Luigi Auriemma

Application: Gamespy cd-key validation system
http://www.gamespy.net
Games: The amount of games that use this system is really huge,
a small list

[ more ] [ reply ]

Multiple vulnearabilities in e107 cms 2005-05-03
hennoj gmail com

Software: http://www.e107.org
Author: Heintz
Advisory origin: http://www.waraxe.us
Software bugtracker: http://e107.org/e107_plugins/bugtracker2/bugtracker2.php?0.bug.558

e107 v 0.617
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
search.php line ~ 142
if($_POST['searchquery']){
echo "<div style=

[ more ] [ reply ]

Secure Science Corporation Advisory CSA-056 2005-05-03
SSC Advisory Notice (bugtraq securescience net)

Secure Science Corporation Advisory CSA-056
http://www.securescience.net
e-response (at) securescience (dot) net [email concealed]
877-570-0455

---------------------------------------------------------

LibTomCrypt version <=1.02 contained weak signature scheme used
with ECC keys, allowing trivial signature forgeries.

-------

[ more ] [ reply ]

[USN-115-1] Kommander vulnerability 2005-05-03
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice USN-115-1 May 03, 2005
kdewebdev vulnerability
CAN-2005-0754
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.04 (Hoary Hedgehog)

T

[ more ] [ reply ]

[USN-117-1] cvs vulnerability 2005-05-04
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice USN-117-1 May 04, 2005
cvs vulnerability
CAN-2005-0753
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.

[ more ] [ reply ]

[USN-114-1] kimgio vulnerability 2005-05-03
Martin Pitt (martin piware de)

===========================================================
Ubuntu Security Notice USN-114-1 May 03, 2005
kdelibs vulnerability
CAN-2005-1046
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.04 (Hoary Hedgehog)

The

[ more ] [ reply ]

[hackgen-2005-#004] - Multiple bugs in MidiCart PHP Shopping Cart 2005-05-05
Exoduks (exoduks gmail com)

http://www.hackgen.org/advisories/hackgen-2005-004.txt

''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' [hackgen-2005-#004] '
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Multiple bugs

[ more ] [ reply ]

Re: ASP.NET __VIEWSTATE crypto validation prone to replay attacks 2005-05-05
Michal Zalewski (lcamtuf gmail com) (1 replies)

> Microsoft has addressed your issues 1-a, 1-b and 1-c by adding a
> property "ViewStateUserKey" to the System.Web.UI.Page class in
> .NET Framework 1.1. The documentation for this property is here:

No, I think this statement is simply not true. The key is intended to
solve a wholly different clas

[ more ] [ reply ]

Re: ASP.NET __VIEWSTATE crypto validation prone to replay attacks 2005-05-05
Michal Zalewski (lcamtuf gmail com)

[USN-118-1] PostgreSQL vulnerabilities 2005-05-04
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice USN-118-1 May 04, 2005
postgresql vulnerabilities
CAN-2005-1409, CAN-2005-1410
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (

[ more ] [ reply ]

DMA[2005-0502a] - 'Apple OSX multiple Bluetooth vulnerabilities' 2005-05-04
Kevin Finisterre (kf digitalmunition com)

This was kinda rushed out... there is probably more typos than usual.

[ more ] [ reply ]

[USN-116-1] gzip vulnerabilities 2005-05-04
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice USN-116-1 May 04, 2005
gzip vulnerabilities
CAN-2005-0988, CAN-2005-1228
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty

[ more ] [ reply ]

Re: AWStats <= 6.4 Multiple vulnerabilities 2005-05-03
Laurent Destailleur (eldy users sourceforge net)

In-Reply-To: <20050214081040.3370.qmail (at) www.securityfocus (dot) com [email concealed]>

>Received: (qmail 16782 invoked from network); 14 Feb 2005 18:00:47 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing3.securityfocus.com) (205.206.231.27)
> by mail.securityfocus.com with SMTP; 14 Feb 2005 18:00:47 -0000

[ more ] [ reply ]

Local root vuln in VPN daemon on MacOS X 2005-05-04
Pieter de Boer (pieter os3 nl)

Local root vulnerability in vpnd on MacOS X <= 10.3.9
-----------------------------------------------------

Overview
--------

There exists a local root exploitable stack based buffer overflow in the
VPN daemon shipping with MacOS X. This bug can be easily exploited to
gain root access.
This vulner

[ more ] [ reply ]

[USN-113-1] libnet-ssleay-perl vulnerability 2005-05-03
Martin Pitt (martin pitt canonical com)

===========================================================
Ubuntu Security Notice USN-113-1 May 03, 2005
libnet-ssleay-perl vulnerability
CAN-2005-0106
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.04 (Hoary Hed

[ more ] [ reply ]

Multiple vulnerabilities in myBloggie 2.1.1 2005-05-05
Alberto Trivero (trivero jumpy it)

******************************************************
* CODEBUG Labs
* Advisory #9
* Title: Multiple vulnerabilities in myBloggie 2.1.1
* Authors: Alberto Trivero & CorryL
* English Version: Alberto Trivero
* Product: myBloggie 2.1.1
* Type: Multiple Vulnerabilities
* Web: http://www.codebug.org/
*

[ more ] [ reply ]

RE: ASP.NET __VIEWSTATE crypto validation prone to replay attacks 2005-05-03
Tim Farley (tfarley spidynamics com)

Microsoft has addressed your issues 1-a, 1-b and 1-c by adding a property "ViewStateUserKey" to the System.Web.UI.Page class in .NET Framework 1.1. The documentation for this property is here:

http://msdn.microsoft.com/library/en-us/cpref/html/frlrfsystemwebuipagec
lassviewstateuserkeytopic.asp

Of

[ more ] [ reply ]

Multiple Vulnerabilities In SitePanel2 2005-05-03
GulfTech Security Research (security gulftech org)

##########################################################
# GulfTech Security Research May 3rd, 2005
##########################################################
# Vendor : Morgan Harvey
# URL : http://www.sitepanel2.com/
# Version : 2.6.1 And Earlier
# Risk : Multiple Vulnerabilit

[ more ] [ reply ]

Multiple Vulnerabilities In osTicket 2005-05-02
GulfTech Security Research (security gulftech org)

##########################################################
# GulfTech Security Research May 2nd, 2005
##########################################################
# Vendor : osTicket
# URL : http://www.osticket.com/
# Version : All Versions
# Risk : Multiple Vulnerabilities
########

[ more ] [ reply ]

dSMTP - SMTP Mail Server 3.1b Linux Remote Root Format String Exploit 2005-05-05
cybertronic gmx net

/*
* dSMTP - SMTP Mail Server 3.1b Linux Remote Root Format String Exploit
*
* cybertronic[at]gmx[dot]net
*
* 05/05/2005
*
* This exploits the "xtellmail" command!
*
* bindc0de breaks somehow, cb works fine!
* remote buffer space is about 256 bytes
* bad chars: 0x00, 0x20, 0x0a and pro

[ more ] [ reply ]

Oracle 10g DBMS_SCHEDULER SESSION_USER issue 2005-05-05
Alexander Kornbrust (ak red-database-security com)

Red-Database-Security GmbH Oracle Security Advisory

Name Oracle 10g DBMS_SCHEDULER SESSION_USER issue
Systems Affected Oracle Database 10g
Severity Medium Risk
Category Switch SESSION_USER to SYS
Vendor URL http://www.oracle.com
Author Ale

[ more ] [ reply ]

Oracle 9i / 10g Fine Grained Auditing Issue 2005-05-05
Alexander Kornbrust (ak red-database-security com)

Red-Database-Security GmbH Oracle Security Advisory

Name Oracle 9i / 10g Fine Grained Auditing Issue
Systems Affected Oracle Database 9i / 10g
Severity Medium Risk
Category FGA Auditing disabled
Vendor URL http://www.oracle.com
Author Alex

[ more ] [ reply ]

MegaBook V2.0 - Cross Site Scripting Exploit 2005-05-05
Spy Hat (spyhat spyhat com)

The ultimate CGI Guestbook Scripts MegaBook V2.0 appears vulnerable to Cross Site Scripting, which will allow the attacker to modify the post in the guestbook. The affected scripts is admin.cgi

URL: (http://www.(yourdomain).com/(yourcgidir)/admin.cgi)

I have tested the script with the followin

[ more ] [ reply ]

MRO Maximo v4 & v5 2005-05-05
Felix (felix shnir bms com)

Due to the fact that all of the files for Maximo Self Service application are served from one directory (maximo_installation) by the integrated Tomcat server, the files not recognized by Tomcat as needing to be run (*.jsps or mapped servlets) are not protected. Therefore, if one was to call upon

[ more ] [ reply ]

directory traversal in SimpleCam 1.2 2005-05-04
Donato Ferrante (fdonato autistici org)

Donato Ferrante

Application: SimpleCam
http://www.deadpirate.com/

Version: 1.2

Bug: directory traversal

Date: 04-May-2005

Author: Donato Ferrante
e-mail: fdonato (at) autistici (dot) org [email concealed]
web: www.autisti

[ more ] [ reply ]

iDEFENSE Security Advisory 05.04.05: Apple Mac OS X vpnd Server_id Buffer Overflow Vulnerability 2005-05-04
iDEFENSE Labs (labs-no-reply idefense com)

Apple Mac OS X vpnd Server_id Buffer Overflow Vulnerability

iDEFENSE Security Advisory 05.04.05
www.idefense.com/application/poi/display?id=240&type=vulnerabilities
May 04, 2005

I. BACKGROUND

Mac OS X is an operating system for the Apple family of microcomputers.
More information is available at

[ more ] [ reply ]

Local file detection bug found through Adobe SVG Viewer 2005-05-04
Hyperdose Security (robfly hyperdose com)

Hyperdose Security Advisory

Name: Local file detection bug found through Adobe SVG Viewer
Systems Affected: v3.0 (unclear if earlier versions were affected)
Severity: Low
Author: Robert Fly - robfly (at) hyperdose (dot) com [email concealed]
Advisory URL: http://www.hyperdose.com/advisories/H2005-07.txt

--Adobe Description--

[ more ] [ reply ]

leafnode security announcement leafnode-SA-2005-01 2005-05-04
Matthias Andree (matthias andree gmx de)

Gossamer Threads Links SQL login XSS Vulnerability 2005-05-04
Nathan House (nhouse stationx net)

Gossamer Threads Links SQL login XSS Vulnerability

Class
Input Validation XSS

Remote Local Published / Updated
Yes Yes 04th May 2005

Vulnerable
Vulnerable: Gossamer Threads Links SQL v3.0
+ Links SQL 2.x
+ Links SQL 2.2.x
+ Links SQL 3.0

Not Vulnerable
-

Discussion
Links SQL is a p

[ more ] [ reply ]

iDEFENSE Security Advisory 05.03.05: Mac OS X Server NeST -target Buffer Overflow Vulnerability 2005-05-03
iDEFENSE Labs (labs-no-reply idefense com)

Mac OS X Server NeST -target Buffer Overflow Vulnerability

iDEFENSE Security Advisory 05.03.05:
http://www.idefense.com/application/poi/display?id=239&type=vulnerabilit

ies
May 03, 2005

I. BACKGROUND

Mac OS X is an advanced operating system which blends features of UNIX
with the ease-of-use of t

[ more ] [ reply ]