Archiv für 3. Februar 2010

Apple iPhone / iPod touch Multiple Vulnerabilities SECUNIA ADVISORY ID: SA38362 VERIFY ADVISORY: http://secunia.com/advisories/38362/ DESCRIPTION: Some vulnerabilities and weaknesses have been reported in Apple iPhone and iPod touch, which can be exploited by malicious people to bypass certain security restrictions, disclose sensitive information, or potentially compromise a user’s system. 1) An input validation error in [...]

OpenCart Cross-Site Request Forgery Vulnerability SECUNIA ADVISORY ID: SA38419 VERIFY ADVISORY: http://secunia.com/advisories/38419/ DESCRIPTION: Ben Maynard has discovered a vulnerability in OpenCart, which can be exploited by malicious people to conduct cross-site request forgery attacks. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This [...]

GMime Uuencode Size Macro Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA38459 VERIFY ADVISORY: http://secunia.com/advisories/38459/ DESCRIPTION: A vulnerability has been reported in GMime, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) or compromise an application using the library. The vulnerability is caused due to the “GMIME_UUENCODE_LEN()” macro incorrectly calculating [...]

NetBSD “azalia” and “hdaudio” Drivers Array Indexing Vulnerabilities SECUNIA ADVISORY ID: SA38284 VERIFY ADVISORY: http://secunia.com/advisories/38284/ DESCRIPTION: NetBSD has acknowledged some vulnerabilities in the azalia(4) and hdaudio(4) drivers, which can be exploited by malicious, local users to cause a DoS (Denial of Service). The vulnerabilities are caused due to an array indexing error within the “azalia_query_devinfo()” [...]

Tinypug Script Insertion and Cross-Site Request Forgery Vulnerabilities SECUNIA ADVISORY ID: SA38402 VERIFY ADVISORY: http://secunia.com/advisories/38402/ DESCRIPTION: AmnPardaz Security Research Team has discovered some vulnerabilities in Tinypug, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site request forgery attacks. 1) Input passed via the “comment_text” parameter [...]

Linux Kernel connector Denial of Service Security Issue SECUNIA ADVISORY ID: SA38317 VERIFY ADVISORY: http://secunia.com/advisories/38317/ DESCRIPTION: A security issue has been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service). The security issue is caused due to an error within the notification code in [...]

CERT-Bund Meldung —————– KURZINFO CB-K10/0045 Titel: IBM DB2: Mehrere Schwachstellen Datum: 03.02.2010 Software: IBM DB2 Universal Database 9.7 Plattform: UNIX, Linux Auswirkung: Denial-of-Service Remoteangriff: Ja Risiko: niedrig Bezug: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0472 BESCHREIBUNG IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM. Ein entfernter anonymer oder entfernter authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um einen [...]

CERT-Bund Meldung —————– KURZINFO CB-K10/0044 Titel: PostgreSQL: Schwachstelle ermöglicht Denial of Service Angriff Datum: 03.02.2010 Software: Open Source PostgreSQL 8.3.8, Open Source PostgreSQL 8.1.11, Open Source PostgreSQL 8.0.23 Plattform: UNIX, Windows Auswirkung: Denial-of-Service Remoteangriff: Ja Risiko: mittel Bezug: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0442 BESCHREIBUNG PostgreSQL ist eine frei verfügbare Datenbank für unterschiedliche Betriebssysteme. Ein entfernt authentisierter Angreifer kann eine [...]

CERT-Bund Meldung —————– KURZINFO CB-K10/0043 Titel: Apple iPhone OS: Mehrere Schwachstellen Datum: 03.02.2010 Software: Apple iPhone OS < 3.1.3 Plattform: iPhoneOS Auswirkung: Erlangen von Benutzerrechten Remoteangriff: Ja Risiko: hoch Bezug: http://support.apple.com/kb/HT4013 BESCHREIBUNG Das Apple iPhone OS ist das Betriebssystem für das von Apple entwickelte Smartphone iPhone. Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen [...]

CERT-Bund Meldung —————– KURZINFO CB-K09/0317 UPDATE 1 Titel: IBM AIX: Schwachstelle erlaubt Ausführung von beliebigem Code Datum: 03.02.2010 Software: IBM VIOS 2.1, IBM VIOS 1.5, IBM VIOS 1.4, IBM AIX 6.1, IBM AIX 5.3 Plattform: UNIX Auswirkung: Erlangen von Administratorrechten Remoteangriff: Ja Risiko: hoch Bezug: http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc BESCHREIBUNG IBM AIX ist ein Unix Betriebssystem von IBM. [...]