3日 水曜日、先勝

Vulnerability in XenServer Could Result in Authentication Bypass
http://support.citrix.com/article/CTX123456

Using the VMware SCSI Disk Driver for Windows Guest Operating Systems
http://kb.vmware.com/selfservice/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=1006956&sliceId=1&docTypeID=DT_KB_1_1

コンピュータウイルス・不正アクセスの届出状況[1月分]について
http://www.ipa.go.jp/security/txt/2010/02outline.html

オンライン・バンキング利用者の73％が他サイトと同じパスワードを使用
http://itpro.nikkeibp.co.jp/article/Research/20100203/344104/?ST=security

Apple、iPhone OSの脆弱性を解消するソフトウエア・アップデートをリリース
http://itpro.nikkeibp.co.jp/article/NEWS/20100203/344120/?ST=security

FTP アカウント情報を盗むマルウエアに関する注意喚起
http://www.jpcert.or.jp/at/2010/at100005.txt

JPCERT/CC WEEKLY REPORT 2010-02-03
http://www.jpcert.or.jp/wr/2010/wr100401.html

[SECURITY] [DSA 1986-1] New moodle packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00036.html

[security bulletin] HPSBUX02479 SSRT090212 rev.1 - HP-UX running HP CIFS Server (Samba), Rem
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00035.html

[security bulletin] HPSBUX02464 SSRT090210 rev.1 - HP Enterprise Cluster Master Toolkit (ECMT) r
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00031.html

OpenCart CSRF Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00034.html

[SECURITY] [DSA 1987-1] New lighttpd packages fix denial of service
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00033.html

Tinypug Multiple Vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00032.html

Remote Vulnerability in AIX RPC.cmsd released by iDefense
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00029.html

360 Security Guard breg device drivers Privilege Escalation Vulnerabilitie
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00030.html

JVNDB-2010-001006 Linux kernel の e1000e ドライバにおけるイーサネットフレームの処理に関する脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001006.html

JVNDB-2010-001005 Linux kernel の r8169 ドライバにおけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001005.html

JVNDB-2010-001004 Linux kernel の e1000 ドライバにおけるパケットフィルタの制限を回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001004.html

JVNDB-2009-002480 Linux kernel の handle_dr 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002480.html

JVNDB-2009-002479 Linux kernel の kvm_dev_ioctl_get_supported_cpuid 関数における整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002479.html

JVNDB-2010-001003 Linear eMerge のマネージメントコンポーネントにおけるサービス運用妨害 (DoS)
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001003.html

JVNDB-2009-002478 PHP および GD Graphics Library の _gdGetColors 関数におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002478.html

Cisco Secure Desktop Input Validation Hole Permits Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Feb/1023531.html

OpenVMS Bug in Record Management Services Lets Local Users Gain Elevated Privileges
http://securitytracker.com/alerts/2010/Feb/1023529.html

　

　

+ HPSBUX02464 SSRT090210 rev.1 - HP Enterprise Cluster Master Toolkit (ECMT) running on HP-UX, Local Unauthorized Access
http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01894850
http://www.securitytracker.com/id?1023523
http://secunia.com/advisories/38423/
http://www.vupen.com/english/advisories/2010/0272
http://www.securityfocus.com/bid/38035

+ Multiple Security Vulnerabilities in the Adobe Flash Player for Solaris May Lead to a Denial of Service (DoS) or Arbitrary Code Execution (Adobe Security Bulletin APSB09-19)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-274250-1

+ Linux Kernel 2.4 e1000 Denial of Service Vulnerability
http://secunia.com/advisories/38394/
http://www.securityfocus.com/bid/37519

+ RHSA-2010:0076-1: Important: kernel security and bug fix update
http://rhn.redhat.com/errata/RHSA-2010-0076.html

- Linux Kernel CVE-2010-0291 'mmap()' and 'mremap()' Multiple Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/37906

- Linux Kernel KVM 'pit_ioport_read()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38038

- Lm_sensors 3.1.2 Released!
http://www.lm-sensors.org/browser/lm-sensors/tags/V3-1-2/CHANGES

[ANNOUNCE] RHQ 3.0.0.B02 has been released - includes Jopr
http://rhq-project.org/

MySQL Cluster 7.1.1 is there
ftp://ftp.mysql.com/pub/mysql/download/mysql-5.1.41-ndb-7.1.1-beta.tgz

[ANN] Apache Rampart 1.5 Released
http://ws.apache.org/rampart/

Apache 2.3.5-alpha Released
http://www.apache.org/dist/httpd/Announcement2.3.txt
http://www.apache.org/dist/httpd/CHANGES_2.3

Continuent Finds Success Within SaaS Data Management Market
http://www.postgresql.org/about/news.1178

Debian : New lighttpd packages fix denial of service
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31638

Bugzilla : Security Advisory for Bugzilla 3.0.10, 3.2.5, 3.4.4, and 3.5.2
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31656

Core Security Technologies : Corel Paint Shop Pro Photo X2 FPX Heap Overflow
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31643

Core Security Technologies : Cisco Secure Desktop XSS/JavaScript Injection
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31644

iDEFENSE : RealNetworks RealPlayer 11 HTTP Chunked Encoding Integer Overflow Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31640

iDEFENSE : RealNetworks RealPlayer CMediumBlockAllocator Integer Overflow Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31641

iDEFENSE : Real Networks RealPlayer Compressed GIF Handling Integer Overflow
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31642

Independent Researcher : XSS vulnerability in Drupal's MP3 Player contributed module (version 6.x-1.0-beta1)
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31639

Independent Researcher : Joomla (com_gambling) SQL Injection Vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31650

Independent Researcher : Advisory: jBCrypt http://www.criticalwatch.com/support/security-advisories.aspx?AID=31651

Mandriva : kernel
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31637

Checkmarx Research Labs : Cross-Site History Manipulation (XSHM)
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31652

SYM10-001: セキュリティ アドバイザリー - Symantec Altiris Notification Server 6.x に静的な暗号化キーが保存される脆弱性
http://www.symantec.com/ja/jp/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100128_00

「バレンタインデー便乗スパム」が早くも出現
個人情報の詐取や模造品の販売が目的
http://itpro.nikkeibp.co.jp/article/NEWS/20100203/344118/?ST=security

秘密組織“C.I.A”がネットの平和を守る！---TBSなど3社が情報セキュリティ啓発キャンペーン
http://itpro.nikkeibp.co.jp/article/NEWS/20100202/344096/?ST=security

Pushdo Update
http://isc.sans.org/diary.html?storyid=8131

Twitter Mass Password Reset due to Phishing
http://isc.sans.org/diary.html?storyid=8137

Cisco Secure Desktop Remote XSS Vulnerability
http://isc.sans.org/diary.html?storyid=8140

HP Serviceguard Enterprise Cluster Master Toolkit Lets Local Users Gain Elevated Privileges
http://securitytracker.com/alerts/2010/Feb/1023523.html

Oracle TimesTen 'timestend' Process Can Be Crashed By Remote Users
http://securitytracker.com/alerts/2010/Feb/1023522.html

Squid Processing of Header-Only DNS Messages Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Feb/1023520.html

jBCrypt Character Encoding Security Issue
http://secunia.com/advisories/38432/

360 Security Guard bregdrv.sys Privilege Escalation
http://secunia.com/advisories/38424/

HP Enterprise Cluster Master Toolkit Unauthorised Access
http://secunia.com/advisories/38423/

SUSE Update for Multiple Packages
http://secunia.com/advisories/38420/

Intel Desktop Boards System Management Mode Security Bypass
http://secunia.com/advisories/38413/

(nv2) Awards "id" SQL Injection Vulnerability
http://secunia.com/advisories/38407/

lighttpd Slow Request Denial of Service Vulnerability
http://secunia.com/advisories/38403/

Cisco Secure Desktop Cross-Site Scripting Vulnerability
http://secunia.com/advisories/38397/

Linux Kernel 2.4 e1000 Denial of Service Vulnerability
http://secunia.com/advisories/38394/

Fedora update for mysql
http://secunia.com/advisories/38390/

TYPO3 T3BLOG Extension SQL Injection and Cross-Site Scripting
http://secunia.com/advisories/38388/

AlegroCart Cross-Site Request Forgery Vulnerability
http://secunia.com/advisories/38386/

IBM Java TLS Session Renegotiation Plaintext Injection
http://secunia.com/advisories/38355/

ejabberd Message Queue Denial of Service
http://secunia.com/advisories/38337/

RHBA-2010:0080-1: audit bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0080.html

Qihoo 360 Security Guard breg device drivers Privilege Escalation Vulnerability
http://www.exploit-db.com/exploits/11317

Deepburner pro 1.9.0.228 dbr file Buffer Overflow Exploit (Universal)
http://www.exploit-db.com/exploits/11315

CoreFTP v2.1 b1637 (password field) Universal BOF Exploit
http://www.exploit-db.com/exploits/11314

Corel PaintShop Photo Pro FPX File Heap Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0274

Cisco Secure Desktop "translation" Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0273

HP Enterprise Cluster Master Toolkit Unauthorized Access Vulnerability
http://www.vupen.com/english/advisories/2010/0272

Intel Desktop Boards SMM Local Privilege Escalation Vulnerability
http://www.vupen.com/english/advisories/2010/0271

Sun Solaris Microcode Local Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0270

Linux Kernel 'e1000/e1000_main.c' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35185

Linux Kernel 'PER_CLEAR_ON_SETID' Incomplete Personality List Access Validation Weakness
http://www.securityfocus.com/bid/35647

Linux Kernel Audit System 'audit_syscall_entry()' System Call Security Bypass Vulnerability
http://www.securityfocus.com/bid/33951

Linux e1000 Driver 'Jumbo Frame' Handling Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/37519

Linux e1000e Driver 'Jumbo Frame' Handling Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/37523

Linux Kernel RTL8169 NIC 'RxMaxSize' Frame Size Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37521

Linux Kernel '/proc/net/rt_cache' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/34084

Linux Kernel 'hrtimers' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/26880

Linux Kernel IPv6 Hop-By-Hop Header Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/26943

Linux Kernel 'drivers/scsi/gdth.c' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37068

Linux Kernel 'hfc_usb.c' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37036

Linux Kernel 'megaraid_sas' Driver Insecure File Permission Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37019

PostgreSQL 'bitsubstr' Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37973

FUSE 'fusermount' Race Condition Vulnerability
http://www.securityfocus.com/bid/37983

Samba 'mount.cifs' Utility Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37992

Wireshark Dissector LWRES Multiple Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/37985

Linux Kernel CVE-2010-0291 'mmap()' and 'mremap()' Multiple Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/37906

Moodle Multiple Vulnerabilities
http://www.securityfocus.com/bid/37244

MySQL Multiple Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/37297

WebKit Multiple Remote Code Execution, Denial of Service, and Information Disclosure Vulnerabilities
http://www.securityfocus.com/bid/36995

Apple Mac OS X CoreAudio MP4 File Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37868

WebKit Resource Load Callback Information Disclosure Weakness
http://www.securityfocus.com/bid/36996

LibTIFF 'LZWDecodeCompat()' Remote Buffer Underflow Vulnerability
http://www.securityfocus.com/bid/35451

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

IBM AIX 'rpc.cmsd' Calendar Daemon Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/36615

lighttpd Slow Request Handling Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38036

HP Enterprise Cluster Master Toolkit Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38035

Joomla! 'com_rsgallery2' Component 'catid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38009

RoundCube Webmail DNS prefetching Domain Name Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38046

Apple iPhone and iPod touch USB Control Message Security Bypass Vulnerability
http://www.securityfocus.com/bid/38040

Linux Kernel KVM 'pit_ioport_read()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38038

360.cn Qihoo 360 Security Guard 'bregdrv.sys' Edit Registry Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38037