Packet Storm new exploits for January, 2007.
b6eaa47a9e3232720a1866fd9bb709e19225ef854d9fc29c0f8316bdef7f3e8aMIMEDefang is a flexible MIME email scanner designed to protect Windows clients from viruses. Includes the ability to do many other kinds of mail processing, such as replacing parts of messages with URLs. It can alter or delete various parts of a MIME message according to a very flexible configuration file. It can also bounce messages with unacceptable attachments. MIMEDefang works with Sendmail 8.11/8.12's new "Milter" API, which makes it more flexible and efficient than procmail-based approaches.
7a979726a20f5d8cfc2ddb085ce14afff641b44febf17513f3d17a77e6a5c641Whitepaper entitled Exploiting JSON Framework - 7 Attack Shots.
4ef0bb62586c04ed3138bfb5fb9552f437721e1488319a608841047e93441684Debian Security Advisory 1256-1 - It was discovered that the image loading code in the GTK+ graphical user interface library performs insufficient error handling when loading malformed images, which may lead to denial of service.
b09a4615b310099e85d75d5e99d8735aed49adae09bdd0c243d326f4c66dd1afGentoo Linux Security Advisory GLSA 200701-27 - Teemu Salmela discovered an error in the validation code of smb:// URLs used by ELinks, the same issue as reported in GLSA 200612-16 concerning Links. Versions less than 0.11.2 are affected.
40744269992e8705c50c1ae275e5f9020b3779855d6b4e86f88b322e8ee5f8f2Gentoo Linux Security Advisory GLSA 200701-26 - KSirc fails to check the size of an incoming PRIVMSG string sent from an IRC server during the connection process. Versions less than 3.5.5-r1 are affected.
886ee48ee05282452da8dca388e9421d7f5b421ae6109fe24b987c95868885c7Gentoo Linux Security Advisory GLSA 200701-28 - thttpd is vulnerable to an underlying change made to the start-stop-daemon command in the current stable Gentoo baselayout package (version 1.12.6). In the new version, the start-stop-daemon command performs a chdir / command just before starting the thttpd process. In the Gentoo default configuration, this causes thttpd to start with the document root set to /, the system root directory. Versions less than 2.25b-r6 are affected.
d78d95cdf42f47e5dd6e20432c044b26afc2e09f6eca76efd06ed329f37e3447Debian Security Advisory 1255-1 - Liu Qishuai discovered that the GNOME gtop library performs insufficient sanitising when parsing the system's /proc table, which may lead to the execution of arbitrary code.
503823eabe2e69836f447b3760432f1cb77fc9414387824bad0d62af89a04bf5Cadre suffers from a remote file inclusion flaw.
a30e4cb73af41aa801f1a08472b89c5c7b284bd9db0651dccdf58147fa85c880Cisco Security Advisory - Cisco devices running IOS which support voice and are not configured for Session Initiated Protocol (SIP) are vulnerable to a crash under yet to be determined conditions, but isolated to traffic destined to Port 5060. SIP is enabled by default on all Advanced images which support voice and do not contain the fix for CSCsb25337. There are no reports of this vulnerability on the devices which are properly configured for SIP processing. Workarounds exist to mitigate the effects of this problem. IOS releases that include voice support after 12.3(14)T, 12.3(8)YC1, 12.3(8)YG and all of 12.4 are affected.
3a3579db497b0b2ef8633d579dc08b9d34662167267cdd1c6b866dd78a93e9fdOracle 10g R2 Enterprise Manager suffers from a classic directory traversal flaw. Details provided.
7b239d813c0b71f35706e82ceb10a5685fed697cf244b62a9ea0ed16b798e32fBrightStor ARCserve Backup for Laptops and Desktops r11.1 suffers from a remote resource exhaustion vulnerability. By sending a specially crafted series of packets to the LGSERVER.EXE process that listens on TCP port 2200, it is possible to cause LGSERVER.EXE to write very large files to the system disk. In addition, the LGSERVER.EXE process becomes unresponsive until the file has been written.
5e363b53e6622717f68088020395485bc3abf558e7989dfb9923e72982cf384eBrightStor ARCserve Backup for Laptops and Desktops r11.1 suffers from a remote denial of service vulnerability. By sending a specially crafted series of packets to the LGSERVER.EXE process that listens on TCP port 2200, it is possible to cause the process to terminate.
b2beae78b9dc5bc4bf16421bd8c3f8c7bbb339c861377bc711310256b5da4cd2BrightStor ARCserve Backup for Laptops and Desktops r11.1 suffers from a remote c ode execution vulnerability. By sending a specially crafted packet to the LGSERVER.EXE process that listens on TCP port 1900, it is possible to cause a stack overflow that allows arbitrary code execution as Local System.
93b42c48737208bb1775e556207027438baca25f161de47442e043e659a7b1e6BrightStor ARCserve Backup for Laptops and Desktops r11.1 suffers from a remote code execution vulnerability. By sending a specially crafted packet to the LGSERVER.EXE process that listens on TCP port 2200, it is possible to execute arbitrary code as SYSTEM on a Windows Platform.
474a498ff00370f5a46dd87ae7f9feeac3510fc1c6ca6e8ff022be0dc35ff0c6
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed