1日 月曜日、仏滅

[ANNOUNCE] RunJasperReports version 1.1 released
http://www.agilebase.co.uk/opensource

[ANNOUNCE] access2pgsql 1.0.1 released
http://pgfoundry.org/projects/access2pgsql/

Sysstat 9.1.1 released (development version)
http://pagesperso-orange.fr/sebastien.godard/

AS/NZ "Online Offensive - Fight fraud online" week March 1-7
http://isc.sans.org/diary.html?storyid=8326

Orbital Viewer v1.04 (.orb) 0day Local Universal SEH Overflow Exploit
http://www.exploit-db.com/exploits/11581

JVNDB-2010-001097 Microsoft Office の MSO.DLL におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001097.html

JVNDB-2010-001096 Microsoft DirectX の DirectShow におけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001096.html

JVNDB-2010-001095 Microsoft Windows の TCP/IP 実装におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001095.html

JVNDB-2010-001094 Microsoft Windows の TCP/IP 実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001094.html

JVNDB-2010-001093 Microsoft Windows の TCP/IP 実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001093.html

JVNDB-2010-001092 Microsoft Windows の TCP/IP 実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001092.html

JVNDB-2010-001091 Microsoft Windows の Microsoft Data Analyzer ActiveX コントロール における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001091.html

JVNDB-2010-001090 Microsoft Windows の SMB クライアント実装における権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001090.html

JVNDB-2010-001089 Microsoft Windows の SMB クライアント実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001089.html

JVNDB-2010-001005 Linux kernel の r8169 ドライバにおけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001005.html

JVNDB-2010-001004 Linux kernel の e1000 ドライバにおけるパケットフィルタの制限を回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001004.html

JVNDB-2009-002399 MySQL における権限チェックを回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002399.html

JVNDB-2009-002398 MySQL における SSL サーバになりすまされる脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002398.html

JVNDB-2009-002013 MySQL の dispatch_command 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002013.html

JVNDB-2008-002424 MySQL のコマンドラインクライアントにおけるクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002424.html

+- FreeBSD-EN-10:02.sched_ule: Deadlock in ULE scheduler
http://security.freebsd.org/advisories/FreeBSD-EN-10:02.sched_ule.asc

+ Multiple Security Vulnerabilities in the Solaris GNOME PDF Rendering Libraries May Lead to a Denial of Service (DoS) or Execution of Arbitrary Code
http://sunsolve.sun.com/search/document.do?assetkey=1-66-274030-1

+ Samba 3.3.11 Available for Download
http://news.samba.org/releases/3.3.11/
http://samba.org/samba/history/samba-3.3.11.html

+ libpng 1.2.43, 1.4.1 released
http://www.libpng.org/pub/png/src/libpng-1.2.43-README.txt
http://www.libpng.org/pub/png/src/libpng-1.4.1-README.txt

+ JK-1.2.29 released
http://tomcat.apache.org/connectors-doc/news/20100101.html#26%20February%20-%20JK-1.2.29%20released
http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html

+ RHSA-2010:0122-1: Important: sudo security update
http://rhn.redhat.com/errata/RHSA-2010-0122.html
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31872
http://secunia.com/advisories/38746/

+ PHP 5.2.13 released
http://www.php.net/releases/5_2_13.php
http://www.php.net/ChangeLog-5.php#5.2.13

+ SA38708: PHP Two Security Bypass Vulnerabilities
http://secunia.com/advisories/38708/
http://securitytracker.com/alerts/2010/Feb/1023661.html
http://www.vupen.com/english/advisories/2010/0479
http://www.securityfocus.com/bid/38431

+ PHP LCG entropy Unspecified Security Vulnerability
http://www.securityfocus.com/bid/38430

+ PHP 'session_save_path()' 'safe_mode' Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38182

++ Multiple Integer Overflow Vulnerabilities in the FreeType 2 Font Engine May Lead to a Denial of Service (DoS) or Allow Execution of Arbitrary Code
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270268-1

- Sysstat 9.0.6.1 released
http://pagesperso-orange.fr/sebastien.godard/

[ANN] Maven 2.0.11 Released
http://maven.apache.org/download.html

MySQL 5.5.2-m2 has been released
http://dev.mysql.com/doc/refman/5.5/en/mysql-nutshell.html

Samba 3.4.6 対応の日本語マニュアル ver 3.4.6-1 を公開しました。
http://sourceforge.jp/forum/forum.php?forum_id=22188

Document ID: 346516: Windows Cluster 2008 MSDTC resource fails to online when VMDG resource is used.
http://seer.entsupport.symantec.com/docs/346516.htm

RHBA-2010:0123-1: openssh bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0123.html

Enhanced VMotion Compatibility (EVC) processor support
http://kb.vmware.com/selfservice/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=1003212&sliceId=1&docTypeID=DT_KB_1_1

Independent Researcher : insufficient domain name validation vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31874

Mandriva : Security Announce apache-mod_security
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31871

Red Hat : Important: sudo security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31872

[ MDVSA-2010:050 ] apache-mod_security
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00230.html

getPlus insufficient domain name validation vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00231.html

ARISg5 (version 5.0) cross site scripting vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00233.html

AST-2010-003: Invalid parsing of ACL rules can compromise security
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00232.html

[ MDVSA-2010:049 ] sudo
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00229.html

Disasters take practice
http://isc.sans.org/diary.html?storyid=8323

PHP 5.2.13 Security Update
http://isc.sans.org/diary.html?storyid=8314

Search Engine Poisoning: Chile Earthquake
http://isc.sans.org/diary.html?storyid=8317

PHP Bugs Let Local Users Bypass safe_mode and open_basedir Security Controls
http://securitytracker.com/alerts/2010/Feb/1023661.html

IBM WebSphere Portal Input Validation Hole in 'login.jsp' Permits Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Feb/1023660.html

Sudo sudoedit and 'runas_default' Flaws Let Local Users Gain Elevated Privileges
http://securitytracker.com/alerts/2010/Feb/1023658.html

Blue Coat ProxySG Protocol Flaw in SSL Renegotiation Lets Remote Users Conduct Man-in-the-Middle Attacks
http://securitytracker.com/alerts/2010/Feb/1023655.html

Blue Coat PacketShaper Protocol Flaw in SSL Renegotiation Lets Remote Users Conduct Man-in-the-Middle Attacks
http://securitytracker.com/alerts/2010/Feb/1023654.html

Orbital Viewer ".orb" File Processing Buffer Overflow Vulnerability
http://secunia.com/advisories/38720/

Red Hat update for sudo
http://secunia.com/advisories/38746/

PHP Two Security Bypass Vulnerabilities
http://secunia.com/advisories/38708/

WebAdministrator Lite CMS "s" SQL Injection Vulnerability
http://secunia.com/advisories/38667/

Website Baker Security Bypass Vulnerability
http://secunia.com/advisories/38747/

Hitachi JP1/Cm2/Network Node Manager Remote Console Insecure File Permissions
http://secunia.com/advisories/38740/

Hitachi Cosminexus Products uCosminexus Portal Framework Cross-Site Scripting
http://secunia.com/advisories/38737/

XMail Insecure Temporary Files Security Issue
http://secunia.com/advisories/38734/

Asterisk CIDR Host Access Rules Security Bypass
http://secunia.com/advisories/38752/

Fedora update for mingw32-libltdl
http://secunia.com/advisories/38705/

Windows XP Internet Explorer 8,7 .HLP vulnerability
http://www.isec.pl/vulnerabilities10.html

PHP Security Update Fixes Multiple Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0479

Orbital Viewer ORB File Processing Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0478

Hitachi JP1/Cm2/Network Node Manager Insecure File Permissions
http://www.vupen.com/english/advisories/2010/0477

Hitachi uCosminexus Portal Framework Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0476

Asterisk CIDR Host Access Rules Security Bypass Vulnerability
http://www.vupen.com/english/advisories/2010/0475

Datev VBSExeCall ActiveX "ExecuteExe()" Code Execution Vulnerability
http://www.vupen.com/english/advisories/2010/0474

Symantec Altiris Deployment Solution Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0473

IBM AIX LDAP Login Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38444

Todd Miller Sudo 'runas_default' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38432

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38362

Quicksilver Forums Local File Include and Arbitrary File Upload Vulnerabilities
http://www.securityfocus.com/bid/32452

Microsoft Windows ICMPv6 Router Advertisement Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38061

NOS getPlus Downloader Domain Validation Arbitrary File Download Vulnerability
http://www.securityfocus.com/bid/38313

Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/34383

FreeType Multiple Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/34550

Squid Web Proxy Cache HTCP Request Processing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38212

ModSecurity Security Bypass And Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/38156

PHP 'session_save_path()' 'safe_mode' Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38182

GNU Libtool 'libltdl' Library Search Path Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37128

Nemo Multiple File Attachments Mail Form 'upload.php' Arbitrary File Upload Vulnerability
http://www.securityfocus.com/bid/38443

ARISg 'wflogin.jsp' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38441

Crawlability vBSEO 'vbseo.php' Local File Include Vulnerability
http://www.securityfocus.com/bid/38439

Orbital Viewer '.orb' File Stack-Based Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38436

Website Baker 'framework/class.wb.php' Security Bypass Vulnerability
http://www.securityfocus.com/bid/38434

FileExecutive Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/38433

PHP 'tempnam()' 'safe_mode' Validation Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38431

PHP LCG entropy Unspecified Security Vulnerability
http://www.securityfocus.com/bid/38430

Hitachi Multiple Products Unspecified Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/38429

Hitachi JP1/Cm2/Network Node Manager Insecure File Permissions Vulnerability
http://www.securityfocus.com/bid/38428