Hello bugtraq readers,

A vulnerability exists in phpBB 2.06 that could allow an attacker to manipulate SQL
queries and gain administrative control over the forum.
The search.php script of the application does not sufficiently sanitize the input of the
"search_id" parameter. As a result of this an

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message

Hi,

David Shaw wrote a patch against GnuPG 1.2.3 to disable the ability to
create signatures using the ElGamal sign+encrypt (type 20) keys as
well as to remove the option to create such keys.

This

[ more ]  [ reply ]

RNN's Guestbook 1.2 Multiple Vulnerabilies Discovered by
Chris Rahm (aka: BrainRawt) (brainrawt at haxworx.com)

Vulnerabilities: Remote Command Execution
Administrative Access
Information Disclosure (Reading of Files)
Arbitrary HTML I

[ more ]  [ reply ]

Summary
-------

Buffer overflow in GNU screen allows privilege escalation for local users.
Usually screen is installed either setgid-utmp or setuid-root.

It also has some potential for remote attacks or getting control of another
user's screen. The problem is that you have to transfer around 2-3 g

[ more ]  [ reply ]

*gobble* *gobble*.

-KF

[ more ]  [ reply ]

[Outlook and Notes users -- please ask your system administrators to
assist you in creating out-of-office-autoreplies that respect public
mail lists; perhaps, creating such a reply that works only within the
organization or business partners.]

[Virus scanner administrators -- sending virus warnings

[ more ]  [ reply ]

In-Reply-To: <20031124214628.9101.AKURODA (at) mx5.nisiq (dot) net [email concealed]>

Dear Atsushi,

Thank you for your interest in InvisiLan technology. Regarding the hackchallenge;

due to practical reasons (we are in the process of creating a proper demo-space in

Amsterdam) we have decided to postpone the event.

We

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

+-----------------------------------------------------------------------
-+
| Guardian Digital Security Advisory November 26, 2003 |
| http://www.guardiandigital.com ESA-20031126-031 |
|

[ more ]  [ reply ]

/* EPIC4 remote client-side stack-based overflow

* by Li0n7 - Li0n7[at]voila[dot]fr

*

* EPIC4 versions later than pre2.003 are prone to a remotly exploitable

* stack-based overflow in send_ctcp() (src/ctcp.c). It occurs when

* strlen(to) is greater than IRCD_BUFFER_SIZE-12, then alloca()

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----

________________________________________________________________________
______
SGI Security Advisory

Title : SGI ProPack v2.3 security update
Number : 20031103-01-U
Date : November 26, 2003
Reference : Red Hat Adviso

[ more ]  [ reply ]

Product: My_eGallery
Versions affected: all <3.1.1.g
Website: http://lottasophie.sourceforge.net/index.php

1. Introduction
---------------

My_eGallery is a very nice PostNuke module, which allows users to create and
manipulate their own galleries on the web, plus offers various additional
feature

[ more ]  [ reply ]

Liu Die Yu wrote Tuesday, November 25, 2003 4:51 AM

> MHTML Redirection Leads to Downloading EXE and Executing
> http://www.safecenter.net/UMBRELLAWEBV4/MhtRedirLaunchInetExe/MhtRedirLa
unchInetExe-Demo.zip

mhtml:res: also seems to work just fine most of the time. It seems to work even better with

[ more ]  [ reply ]

S-Quadra Advisory #2003-11-26

Topic: FreeRADIUS <= 0.9.3 rlm_smb module stack overflow vulnerability
Severity: High
Vendor URL: http://www.freeradius.org
Advisory URL: http://www.s-quadra.com/advisories/Adv-20031126.txt
Release date: 26 Nov 2003

1. DESCRIPTION

The FreeRADIU

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandrake Linux Security Update Advisory
_______________________________________________________________________

Package name: stunnel
Advisory ID:

[ more ]  [ reply ]

Speedtouch 510 ADSL Modem/FW/Router

We have been attempting to run NMAP and NESSUS scans using a new ADSL cable link. Using the ADSL modem mentioned above, we found that a standard NMAP/NESSUS scan of an IP range would force the router to reboot itself after 20 seconds. Thinking this was faulty

[ more ]  [ reply ]

I have made a wargame containing 5 levels of SQL Injection Attacks. It's a great way to learn it in a creative manner.

It can be found at http://warsql.hackingzone.org

I am also looking for the suggestions to add new levels in the wargame.

Thank You,

lifofifo

hackingzone.org

[ more ]  [ reply ]

Invalid ContentType may disclose cache directory

[tested]

OS:WinXp, CN version

Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16

[overview]

The problem lies in the download function of Internet Explorer. This can be exploited by malicious web pages to get cache directory includ

[ more ]  [ reply ]

HijackClickV2 - a successor of HijackClick attack

[tested]

OS:Win2k3,CN version

IE: with MS03-048 installed.

OS:WinXp, CN version

Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16

[overview]

After applying MS03-048, the original HijackClick exploit doesn't work any more.

W

[ more ]  [ reply ]

Cache Disclosure Leads to MYCOMPUTER Zone and Remote Compromise

[tested]

OS:WinXp, CN version

Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16

[overview]

By combining cache file disclosure and several other unpatched vulnerabilties, an malicious INTERNET page can reach MYCOMPU

[ more ]  [ reply ]

Note for "Invalid ContentType may disclose cache directory"

This vulnerability("Invalid ContentType may disclose cache directory") doesn't work on all systems.

("Invalid ContentType may disclose cache directory", at http://www.safecenter.net/UMBRELLAWEBV4/threadid10008/)

Please note that exec

[ more ]  [ reply ]

A paper entitled "Security at Microsoft" describes what the Microsoft
Corporate Security Group does to prevent malicious or unauthorized use
of digital assets at Microsoft is now available at
http://www.microsoft.com/technet/itsolutions/msit/security/mssecbp.asp

Cheers, Michael

[Writing Secure Cod

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
Red Hat Security Advisory

Synopsis: Updated XFree86 packages provide security and bug fixes
Advisory ID: RHSA-2003:286-01
Issue date: 2003-

[ more ]  [ reply ]

IE Remote Compromise by Getting Cache Location

[tested]

OS:WinXp, CN version

Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16

[overview]

With the help of LocalZoneInCache(refer to "[technical details]" part), an attacker can compromise a user's system even though the user has:

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
Red Hat Security Advisory

Synopsis: Updated XFree86 packages provide security and bug fixes
Advisory ID: RHSA-2003:287-01
Issue date: 2003-

[ more ]  [ reply ]

BackToFramedJpu - a successor of BackToJpu attack

[tested]

OS:Win2k3,CN version

IE: with MS03-048 installed.

OS:WinXp, CN version

Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16

[overview]

A cross-zone scripting vulnerability has been found in Internet Explorer. If a webp

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security.html http://www.openpkg.org
openpkg-security (at) openpkg (dot) org [email concealed]

[ more ]  [ reply ]

MHTML Redirection Leads to Downloading EXE and Executing

[tested]

OS:Win2k3,CN version

IE: with MS03-048 installed.

OS:WinXp, CN version

Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16

[overview]

A vulnerability in Internet Explorer is found: any attacker that can reach M

[ more ]  [ reply ]