exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 61 RSS Feed

Files Date: 2013-02-21 to 2013-02-22

Oracle 11g Stealth Password Cracking
Posted Feb 21, 2013
Authored by Esteban Martinez Fayo | Site appsecinc.com

Team SHATTER Security Advisory - There is a flaw in the way that Authentication Session Keys are generated and protected by Oracle Database Server during the authentication process. It is possible to use this flaw to perform unlimited password guesses (cracking) of any user password in a similar way as if the password hash would be available. Oracle Database version 11gR1 and 11gR2 are affected.

tags | advisory
advisories | CVE-2012-3137
SHA-256 | 6de8cff55b66f1dae7efecbf927e6903f0d40a21e1f69993bb4e363b2732b39d
Oracle Alter FBA Table SQL Injection
Posted Feb 21, 2013
Authored by Martin Rakhmanov | Site appsecinc.com

Team SHATTER Security Advisory - Renaming a table having flashback archive using specially crafted table name triggers internal SQL injection. This allows users to execute code with elevated privileges. Oracle Database Enterprise Edition version 11.1 and 11.2 are affected.

tags | advisory, sql injection
advisories | CVE-2012-1751
SHA-256 | fe12a85f642cabb0360ed843da29b8d6e66283d99716b980d61f47a9ad23614c
HP Security Bulletin HPSBMU02836 SSRT101056
Posted Feb 21, 2013
Authored by HP | Site hp.com

HP Security Bulletin HPSBMU02836 SSRT101056 - Potential security vulnerabilities have been identified with HP ArcSight Connector Appliance and HP ArcSight Logger. These vulnerabilities could be exploited remotely to allow disclosure of information, command injection and cross-site scripting (XSS). Revision 1 of this advisory.

tags | advisory, vulnerability, xss
advisories | CVE-2012-2960, CVE-2012-3286, CVE-2012-5198, CVE-2012-5199
SHA-256 | 14f9abc7c565329aeda8e943a1d8fa34bb61bd4bb69850d90b97b588c089d5d0
Red Hat Security Advisory 2013-0552-01
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0552-01 - In accordance with the Red Hat Enterprise Virtualization Errata Support Policy, the support for Red Hat Enterprise Virtualization 2 will end on 1st March, 2013. Customers are recommended to upgrade their existing Red Hat Enterprise Virtualization 2.x installations to version 3.0. The upgrade from RHEV Manager version 2.2 running on Microsoft Windows to Red Hat Enterprise Virtualization Manager 3.0 running on Red Hat Enterprise Linux is fully supported and requires no downtime, during the upgrade all virtual machines will continue to run without loss of service.

tags | advisory
systems | linux, redhat, windows
SHA-256 | c50b91c502da9056e729946a5d451a8df385851f224db15587a947e0fe9c225c
Red Hat Security Advisory 2013-0544-01
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0544-01 - Red Hat Subscription Asset Manager acts as a proxy for handling subscription information and software updates on client machines. It was discovered that Katello did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to download consumer certificates or change settings of other users' systems if they knew the target system's UUID. A vulnerability in rubygem-ldap_fluff allowed a remote attacker to bypass authentication and log into Subscription Asset Manager when a Microsoft Active Directory server was used as the back-end authentication server.

tags | advisory, remote
systems | linux, redhat
advisories | CVE-2012-5561, CVE-2012-5603, CVE-2012-5604, CVE-2012-6109, CVE-2012-6496, CVE-2013-0162, CVE-2013-0183, CVE-2013-0184
SHA-256 | 40ed8cc02a824cba926dc987492cb7cfa65beb82b844986c7ceface61e3927c2
Red Hat Security Advisory 2013-0548-01
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0548-01 - Red Hat CloudForms is an on-premise hybrid cloud Infrastructure-as-a-Service product that lets you create and manage private and public clouds. It provides self-service computing resources to users in a managed, governed, and secure way. Three flaws were found in rubygem-rack. A remote attacker could use these flaws to perform a denial of service attack against applications using rubygem-rack. It was found that documentation created by rubygem-rdoc was vulnerable to a cross-site scripting attack. If such documentation was accessible over a network, and a remote attacker could trick a user into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's session. As rubygem-rdoc is used for creating documentation for Ruby source files, it is not a common scenario to make such documentation accessible over the network.

tags | advisory, remote, web, denial of service, arbitrary, xss, ruby
systems | linux, redhat
advisories | CVE-2012-6109, CVE-2013-0162, CVE-2013-0183, CVE-2013-0184, CVE-2013-0256
SHA-256 | 7eeecf4bd61add69a8fdb62e0fc678b6962eaa82560b226a399c33ad350a2198
Red Hat Security Advisory 2013-0549-01
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0549-01 - The redhat-ds-base packages provide Red Hat Directory Server, which is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol server and command-line utilities for server administration. A flaw was found in the way the 389 Directory Server daemon handled access control instructions using certificate groups. If an LDAP user that had a certificate group defined attempted to bind to the directory server, it would cause ns-slapd to enter an infinite loop and consume an excessive amount of CPU time.

tags | advisory, protocol
systems | linux, redhat
advisories | CVE-2012-0833
SHA-256 | dcc5bc41f9e0012dc142cd0fe93552492f5d9cd278e58d24ffb573240480fcfc
Ubuntu Security Notice USN-1734-1
Posted Feb 21, 2013
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1734-1 - Joshua Harlow discovered that Nova would allow XML entity processing. A remote unauthenticated attacker could exploit this using the Nova API to cause a denial of service via resource exhaustion.

tags | advisory, remote, denial of service
systems | linux, ubuntu
advisories | CVE-2013-1664, CVE-2013-1664
SHA-256 | 6d3859f8e73a01c731e048bd1058cbd83ecde2953d41aa5b88921039d3de8376
Red Hat Security Advisory 2013-0550-01
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0550-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. DNS64 is used to automatically generate DNS records so IPv6 based clients can access IPv4 systems through a NAT64 server. A flaw was found in the DNS64 implementation in BIND when using Response Policy Zones. If a remote attacker sent a specially-crafted query to a named server that is using RPZ rewrite rules, named could exit unexpectedly with an assertion failure. Note that DNS64 support is not enabled by default.

tags | advisory, remote, protocol
systems | linux, redhat
advisories | CVE-2012-5689
SHA-256 | be9b3927189a1166d36e2cf7d1edc674fbba7aea987f7b05d7bef60fe0de9dd9
Red Hat Security Advisory 2013-0547-01
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0547-01 - Red Hat CloudForms is an on-premise hybrid cloud Infrastructure-as-a-Service product that lets you create and manage private and public clouds. It provides self-service computing resources to users in a managed, governed, and secure way. CloudForms System Engine can be used to configure new systems, subscribe to updates, and maintain installations in distributed environments. It was found that the "/usr/share/katello/script/katello-generate-passphrase" utility, which is run during the installation and configuration process, set world-readable permissions on the "/etc/katello/secure/passphrase" file. A local attacker could use this flaw to obtain the passphrase for Katello, giving them access to information they would otherwise not have access to.

tags | advisory, local
systems | linux, redhat
advisories | CVE-2012-5561, CVE-2012-6116
SHA-256 | 339740d9406c3350301caab4ada52a15b3430be5af36a984271eda01e623b9b6
Red Hat Security Advisory 2013-0545-01
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0545-01 - Red Hat CloudForms is an on-premise hybrid cloud Infrastructure-as-a-Service product that lets you create and manage private and public clouds. It provides self-service computing resources to users in a managed, governed, and secure way. CloudForms Cloud Engine is a management application for cloud resources. It was found that the Aeolus Configuration Server stored passwords in plain text in the world-readable "/var/log/aeolus-configserver/configserver.log" file. A local attacker could use this flaw to obtain the administrative passwords for other services.

tags | advisory, local
systems | linux, redhat
advisories | CVE-2012-5509, CVE-2012-6117, CVE-2012-6118
SHA-256 | 289d775b58d68820148aa9883ca53a46eccbfdd48348721c182bb2dfa5c860cc
Red Hat Security Advisory 2013-0551-01
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0551-01 - Adobe Reader allows users to view and print documents in Portable Document Format. This update fixes two security flaws in Adobe Reader. These flaws are detailed in the Adobe Security bulletin APSB13-07, listed in the References section. A specially-crafted PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader when opened. All Adobe Reader users should install these updated packages. They contain Adobe Reader version 9.5.4, which is not vulnerable to these issues. All running instances of Adobe Reader must be restarted for the update to take effect.

tags | advisory, arbitrary
systems | linux, redhat
advisories | CVE-2013-0640, CVE-2013-0641
SHA-256 | b5678dbc538551c8b44179f8422625403d44e85d0e42dd8fd82f22dab2e7f6c9
PHPMyGallery 1.51.010 XSS / Local File Disclosure
Posted Feb 21, 2013
Authored by TheMirkin

PHPMyGallery versions 1.51.010 and below suffer from cross site scripting and local file disclosure vulnerabilities.

tags | exploit, local, vulnerability, xss, file inclusion
SHA-256 | 20d47589fda76b6266aba44c1e813c04372ac15ad0236197863aa8da862bb577
Web Cookbook File Disclosure / SQL Injection
Posted Feb 21, 2013
Authored by cr4wl3r

Web Cookbook suffers from file disclosure and remote SQL injection vulnerabilities.

tags | exploit, remote, web, vulnerability, sql injection, info disclosure
SHA-256 | 190be9195cee32cae8fedc09d268ca560d5320e5f2cff88ab751a247c7d6146b
OpenEMR 4.1.1 Cross Site Scripting
Posted Feb 21, 2013
Authored by LiquidWorm | Site zeroscience.mk

OpenEMR version 4.1.1 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 2794e272098c49fab5ad0608f9d0bb8abb46fa3cfb850da04587f0f744cfa619
Red Hat Security Advisory 2013-0505-02
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0505-02 - Squid is a high-performance proxy caching server for web clients that supports FTP, Gopher, and HTTP data objects. A denial of service flaw was found in the way the Squid Cache Manager processed certain requests. A remote attacker who is able to access the Cache Manager CGI could use this flaw to cause Squid to consume an excessive amount of memory. Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function, child processes of Squid terminated upon encountering a failed assertion. An upstream patch has been provided and Squid child processes no longer terminate.

tags | advisory, remote, web, denial of service, cgi
systems | linux, redhat
advisories | CVE-2012-5643
SHA-256 | f92dd78de16315f861e5ab75471d33381f6ccb43aae9c20d97fc87566f9db500
Red Hat Security Advisory 2013-0503-03
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0503-03 - The 389-ds-base packages provide 389 Directory Server, which is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol server and command-line utilities for server administration. A flaw was found in the way 389 Directory Server enforced ACLs after performing an LDAP modify relative distinguished name operation. After modrdn was used to move part of a tree, the ACLs defined on the moved were not properly enforced until the server was restarted. This could allow LDAP users to access information that should be restricted by the defined ACLs.

tags | advisory, protocol
systems | linux, redhat
advisories | CVE-2012-4450
SHA-256 | 81f266349d360bc98f9ba001b096803762605fe489020374a17f656017a2aed6
Red Hat Security Advisory 2013-0500-02
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0500-02 - The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project, which provides drivers for Hewlett-Packard printers and multi-function peripherals. Several temporary file handling flaws were found in HPLIP. A local attacker could use these flaws to perform a symbolic link attack, overwriting arbitrary files accessible to a process using HPLIP. The CVE-2013-0200 issues were discovered by Tim Waugh of Red Hat.

tags | advisory, arbitrary, local
systems | linux, redhat
advisories | CVE-2011-2722, CVE-2013-0200
SHA-256 | d0e265e67da2b6518e25c5a95ef17a56c0cd1044ceaa1d1df7600cf3916e91b6
Red Hat Security Advisory 2013-0277-02
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0277-02 - The dnsmasq packages contain Dnsmasq, a lightweight DNS forwarder and DHCP server. It was discovered that dnsmasq, when used in combination with certain libvirtd configurations, could incorrectly process network packets from network interfaces that were intended to be prohibited. A remote, unauthenticated attacker could exploit this flaw to cause a denial of service via DNS amplification attacks. In order to fully address this issue, libvirt package users are advised to install updated libvirt packages. Refer to RHSA-2013:0276 for additional information.

tags | advisory, remote, denial of service
systems | linux, redhat
advisories | CVE-2012-3411
SHA-256 | 69f64a8faf20496d8acc9c8b3c87f09f8d380a6cb7de2df96355d561e0a0394b
Red Hat Security Advisory 2013-0499-02
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0499-02 - The xinetd package provides a secure replacement for inetd, the Internet services daemon. xinetd provides access control for all services based on the address of the remote host and/or on time of access, and can prevent denial-of-access attacks. When xinetd services are configured with the "TCPMUX" or "TCPMUXPLUS" type, and the tcpmux-server service is enabled, those services are accessible via port 1. It was found that enabling the tcpmux-server service allowed every xinetd service, including those that are not configured with the "TCPMUX" or "TCPMUXPLUS" type, to be accessible via port 1. This could allow a remote attacker to bypass intended firewall restrictions.

tags | advisory, remote
systems | linux, redhat
advisories | CVE-2012-0862
SHA-256 | be4a4f35af787c54658b20d107cfe272957cfaa2dae54a130663d846f2c788ab
Red Hat Security Advisory 2013-0496-02
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0496-02 - The kernel packages contain the Linux kernel, the core of any Linux operating system. A race condition was found in the way asynchronous I/O and fallocate() interacted when using the ext4 file system. A local, unprivileged user could use this flaw to expose random data from an extent whose data blocks have not yet been written, and thus contain data from a deleted file.

tags | advisory, kernel, local
systems | linux, redhat
advisories | CVE-2012-4508, CVE-2012-4542, CVE-2013-0190, CVE-2013-0309, CVE-2013-0310, CVE-2013-0311
SHA-256 | 3a925a69e9ed312b981ff3a349917d1490658caff3fcba8bf43104f107a6da83
Ubuntu Security Notice USN-1733-1
Posted Feb 21, 2013
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1733-1 - Jean-Philippe Aumasson discovered that Ruby incorrectly generated predictable hash values. An attacker could use this issue to generate hash collisions and cause a denial of service. Evgeny Ermakov discovered that documentation generated by rdoc is vulnerable to a cross-site scripting issue. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. Various other issues were also addressed.

tags | advisory, remote, denial of service, vulnerability, xss, ruby
systems | linux, ubuntu
advisories | CVE-2012-5371, CVE-2013-0256, CVE-2013-0269, CVE-2012-5371, CVE-2013-0256, CVE-2013-0269
SHA-256 | dddd7e4c2113ee021334b4b14478e4a1ed7d308a57d26ab172def828073de257
Ubuntu Security Notice USN-1732-1
Posted Feb 21, 2013
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1732-1 - Adam Langley and Wolfgang Ettlingers discovered that OpenSSL incorrectly handled certain crafted CBC data when used with AES-NI. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 12.10. Stephen Henson discovered that OpenSSL incorrectly performed signature verification for OCSP responses. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service
systems | linux, ubuntu
advisories | CVE-2012-2686, CVE-2013-0166, CVE-2013-0169, CVE-2012-2686, CVE-2013-0166, CVE-2013-0169
SHA-256 | 3840d7b0427c8c47a692ec2a92d448203e10c63f63d934450bf70540d9f0574d
Red Hat Security Advisory 2013-0276-02
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0276-02 - The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. It was discovered that libvirt made certain invalid assumptions about dnsmasq's command line options when setting up DNS masquerading for virtual machines, resulting in dnsmasq incorrectly processing network packets from network interfaces that were intended to be prohibited. This update includes the changes necessary to call dnsmasq with a new command line option, which was introduced to dnsmasq via RHSA-2013:0277.

tags | advisory, remote
systems | linux, redhat
advisories | CVE-2012-3411
SHA-256 | 68a3d89546b9f2deade7e656586c7b374600b35508e282a078dfd3fde24aec1f
Red Hat Security Advisory 2013-0521-02
Posted Feb 21, 2013
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0521-02 - Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. A stack-based buffer overflow flaw was found in the way the pam_env module parsed users' "~/.pam_environment" files. If an application's PAM configuration contained "user_readenv=1", a local attacker could use this flaw to crash the application or, possibly, escalate their privileges. A denial of service flaw was found in the way the pam_env module expanded certain environment variables. If an application's PAM configuration contained "user_readenv=1", a local attacker could use this flaw to cause the application to enter an infinite loop.

tags | advisory, denial of service, overflow, local
systems | linux, redhat
advisories | CVE-2011-3148, CVE-2011-3149
SHA-256 | 3db6488fc0487eab8391005641b6b481366220faead1fe7681d7aa18230fd1a5
Page 1 of 3
Back123Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close