:: IT Security Neophyte Investigator's MEMO ::

2010年3月25日木曜日

25日木曜日、大安

MySQL 5.1.46 (Not yet released)
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-46.html

Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of the Cisco IOS Software MPLS Packet Vulnerability
http://www.cisco.com/warp/public/707/cisco-amb-20100324-ldp.shtml

Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of the Cisco Unified Communications Manager Express and Cisco IOS Software H.323 and SIP DoS Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-amb-20100324-voice.shtml

Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of the Cisco IOS Software Crafted TCP Packet Denial of Service Vulnerability
http://www.cisco.com/warp/public/707/cisco-amb-20100324-tcp.shtml

欧州における情報セキュリティ関連動向調査報告書
Study on EU Information Security Situation
http://www.ipa.go.jp/security/fy21/reports/fraunhofer/index.html

JPCERT/CC WEEKLY REPORT 2010-03-25
http://www.jpcert.or.jp/wr/2010/wr101101.html

JVNDB-2010-001186 Apple Safari の Cascading Style Sheet 実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001186.html

JVNDB-2010-001185 Apple Safari における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001185.html

JVNDB-2010-001184 Apple Safari の PubSub における Cookie が設定される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001184.html

JVNDB-2010-001183 Apple Safari の ImageIO における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001183.html

JVNDB-2010-001182 Apple Safari の ImageIO における重要な情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001182.html

JVNDB-2010-001181 Apple Safari の ImageIO における重要な情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001181.html

JVNDB-2010-001180 Apple Safari の ColorSync における整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001180.html

JVNDB-2009-001925 libtiff の LZWDecodeCompat 関数におけるバッファアンダーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001925.html

JVNDB-2008-001453 Apache HTTP Server の ap_proxy_http_process_response() 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001453.html

JVNDB-2007-001201 GNU tar の safer_name_suffix 関数におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001201.html

JVNDB-2005-000872 GNU cpio における大きなサイズのファイル処理によるバッファーオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2005/JVNDB-2005-000872.html

Google、Gmailに不審なアクセスを警告する機能を追加
http://itpro.nikkeibp.co.jp/article/NEWS/20100325/346176/?ST=security

Microsoft PowerPoint LinkedSlideAtom Heap Overflow Vulnerability
http://www.securiteam.com/windowsntfocus/5FP3K0U0UQ.html

Microsoft PowerPoint OEPlaceholderAtom Use-After-Free Vulnerability
http://www.securiteam.com/windowsntfocus/5EP3J0U0UQ.html

Microsoft PowerPoint OEPlaceholderAtom Invalid Array Indexing Vulnerability
http://www.securiteam.com/unixfocus/5DP3I0U0UA.html

HP Project and Portfolio Management Center Input Validation Hole Permits Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Mar/1023749.html

+ Two Security Vulnerabilities in GNU tar (see gtar(1)) May Lead to Files Being Overwritten, Execution of Arbitrary Code, or a Denial of Service (DoS)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-273551-1

+ HPSBUX02508 SSRT100007 rev.1 - HP-UX Running sendmail with STARTTLS Enabled, Remote Unauthorized Access
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02009860

+ OpenSSL 0.9.8n is now available
http://www.openssl.org/source/

+ OpenSSL Security Advisory: "Record of death" vulnerability in OpenSSL 0.9.8f through 0.9.8m
http://www.openssl.org/news/secadv_20100324.txt
http://securitytracker.com/alerts/2010/Mar/1023748.html

++ Cisco Security Advisory: Cisco IOS Software IPsec Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20100324-ipsec.shtml

+ Cisco Security Advisory: Cisco IOS Software NAT Skinny Call Control Protocol Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20100324-sccp.shtml

+ Cisco Security Advisory: Cisco IOS Software Multiprotocol Label Switching Packet Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20100324-ldp.shtml

+ Cisco Security Advisory: Cisco IOS Software H.323 Denial of Service Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sa-20100324-h323.shtml

+ Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b20f32.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20100324-sip.shtml

+ Cisco Security Advisory: Cisco IOS Software Crafted TCP Packet Denial of Service Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20100324-tcp.shtml

[ANNOUNCE] Release of Apache MyFaces Extensions Validator 1.1.3, 1.2.3 and 2.0.3
http://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310821&styleName=Html&version=12314098
http://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310821&styleName=Html&version=12313876
http://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310821&styleName=Html&version=12313875

HPSBMA02436 SSRT080064 rev.1 - HP Project and Portfolio Management Center (PPMC), Remote Cross Site Scripting (XSS)
http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01762443&docLocale=en&admit=109447626+1269488162970+28353475

Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sa-20100303-cucm.shtml

Independent Researcher : Multiple vulnerabilities in Deliver
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32076

Ubuntu Security Notice : Samba vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32071

Ubuntu Security Notice : Puppet vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32072

Debian : New mediawiki packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32073

Digital Security Research Group : SAP GUI - Insecure method, code execution
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32079

悪人向け「ウイルス検査サービス」登場！対策ソフト回避が目的
既存の無料サービスには“限界”、1ファイル当たり15セントから
http://itpro.nikkeibp.co.jp/article/NEWS/20100324/346088/?ST=security

PCI DSSで効果的な二つのセキュリティ技術、ビジネスアシュアランスが講演
http://itpro.nikkeibp.co.jp/article/NEWS/20100324/346148/?ST=security

「2010年はエンドポイントセキュリティの見直し時期」とガートナーの石橋氏
http://itpro.nikkeibp.co.jp/article/NEWS/20100324/346161/?ST=security

Symlink attack with Solaris Update manager and Sun Patch Cluster
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00209.html

Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabil
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00210.html

Cisco Security Advisory: Cisco IOS Software IPsec Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00211.html

Cisco Security Advisory: Cisco IOS Software NAT Skinny Call Control Protocol Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00205.html

Secunia Research: Pulse CMS login.php Arbitrary File Writing Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00202.html

Secunia Research: Pulse CMS Arbitrary File Deletion Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00206.html

Secunia Research: Pulse CMS Arbitrary File Writing Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00203.html

Multiple vulnerabilities in Deliver
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00207.html

[USN-918-1] Samba vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00201.html

[USN-917-1] Puppet vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00208.html

CVE-2009-4505 OpenCMS OAMP Comments Module XSS
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00196.html

"$referer" export lead to the cross-site flaws in all versions of Discuz!
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00200.html

[HITB-Announce] HITBSecConf2009 - Malaysia Videos Released! *Correction*
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00197.html

Symlink attack with Solaris Update manager
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00204.html

[USN-916-1] Kerberos vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00198.html

CVE-2009-2907: SpringSource Hyperic HQ multiple XSS vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00199.html

[SECURITY] [DSA 2022-1] New mediawiki packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00195.html

Wax nostalgic - commodore64 updated to present time
http://isc.sans.org/diary.html?storyid=8485

Cisco security updates
http://isc.sans.org/diary.html?storyid=8488

Vulnerability Note VU#181737: IntelliCom NetBiter Config HICP hostname buffer overflow
http://www.kb.cert.org/vuls/id/181737

OpenSSL Record Processing Bug Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023748.html

Cisco IOS Unified CME or Unified SRST SCCP Processing Bugs Let Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023745.html

Cisco IOS SIP Processing Flaws Let Remote Users Deny Service and Potentially Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023744.html

Cisco IOS TCP Option Processing Error Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023743.html

Cisco IOS H.323 Processing Flaws Let Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023742.html

Cisco IOS IKE Packet Processing Flaw Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023741.html

Cisco IOS MPLS LDP Processing Flaw Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023740.html

Cisco IOS Skinny NAT Bug Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023739.html

Cisco IOS Unified Communications Manager Express Denial of Service Vulnerabilities
http://secunia.com/advisories/39069/

HP TCP/IP Services for OpenVMS NTP Multiple Vulnerabilities
http://secunia.com/advisories/39066/

Ubuntu update for puppet
http://secunia.com/advisories/39050/

Pulse CMS Multiple Vulnerabilities
http://secunia.com/advisories/39011/

Ubuntu update for samba
http://secunia.com/advisories/39049/

ABO.CMS Multiple SQL Injection Vulnerabilities
http://secunia.com/advisories/38965/

Joomla! SMEStorage Component "controller" Local File Inclusion Vulnerability
http://secunia.com/advisories/39071/

Insky CMS "ROOT" File Inclusion Vulnerabilities
http://secunia.com/advisories/39112/

Joomla J!Research Component "controller" File Inclusion Vulnerability
http://secunia.com/advisories/39079/

Joomla Real Estate Property Component "controller" File Inclusion Vulnerability
http://secunia.com/advisories/39074/

Lexmark Laser Printers Flood Protection Denial of Service
http://secunia.com/advisories/39056/

Lexmark Laser Printers PJL Buffer Overflow
http://secunia.com/advisories/39053/

Serv-U Multiple Security Issues
http://secunia.com/advisories/39060/

Fedora update for glpi
http://secunia.com/advisories/39015/

Debian update for mediawiki
http://secunia.com/advisories/39022/

Ubuntu update for krb5
http://secunia.com/advisories/39023/

Red Hat update for kernel-rt
http://secunia.com/advisories/39033/

Kerberos SPNEGO Denial of Service Vulnerability
http://secunia.com/advisories/39010/

HP TCP/IP Services for OpenVMS NTP Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0697

Serv-U Security Update Fixes Security Bypass and DoS Vulnerabilities
http://www.vupen.com/english/advisories/2010/0696

Lexmark Printers PJL Processing Remote Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0695

Lexmark Printers FTP Flood Remote Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0694

MIT Kerberos SPNEGO GSS-API Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0693

Mozilla Products Code Execution and Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0692

Fedora Security Update Fixes GLPI phpCAS Cross Site Scripting Issue
http://www.vupen.com/english/advisories/2010/0691

Redhat Security Update Fixes Kernel Security Bypass and DoS Issues
http://www.vupen.com/english/advisories/2010/0690

SuSE Security Update Fixes Kernel Security Bypass and DoS Issues
http://www.vupen.com/english/advisories/2010/0689

Turbolinux Security Update Fixes httpd Information Disclosure Issue
http://www.vupen.com/english/advisories/2010/0688

Mandriva Security Update Fixes Cpio Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0687

Mandriva Security Update Fixes Libpng Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0686

Debian Security Update Fixes MediaWiki Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0685

Serv-U Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/38923

Adobe Flash Media Server Directory Traversal Vulnerability
http://www.securityfocus.com/bid/37420

Adobe Flash Media Server Resource Exhaustion Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37419

RETIRED: Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities
http://www.securityfocus.com/bid/38918

Linux Kernel KVM Segment Selector Loading Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38467

Linux Kernel KVM 'handle_dr()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/37221

Linux Kernel KVM Multiple Privilege Escalation and Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/38158

Linux Kernel 'sctp_rcv_ootb()' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38857

tDiary TrackBack Transmission Plugin Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/38413

ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
http://www.securityfocus.com/bid/35848

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37255

NTP 'ntpd' Autokey Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35017

NTP 'ntpq' Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34481

Samba Symlink Directory Traversal Vulnerability
http://www.securityfocus.com/bid/38111

Puppet Supplementary Groups Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36628

Reductive Labs Puppet '/tmp' Insecure File Permissions Vulnerabilities
http://www.securityfocus.com/bid/38474

Linux Kernel 'net/ipv6/ip6_output.c' NULL Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/38185

GNU TAR and CPIO safer_name_suffix Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/26445

GNU Tar Dot_Dot Function Remote Directory Traversal Vulnerability
http://www.securityfocus.com/bid/25417

Multiple SpringSource Products Multiple HTML Injection Vulnerabilities
http://www.securityfocus.com/bid/38913

Mozilla Firefox 'multipart/x-mixed-replace' Image Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38921

Mozilla Firefox 'window.location' Same Origin Policy Security Bypass Vulnerability
http://www.securityfocus.com/bid/38919

Multiple MicroWorld eScan Products Remote Command Execution Vulnerability
http://www.securityfocus.com/bid/38750

MIT Kerberos 'gss_accept_sec_context()' Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38904

MIT Kerberos KDC 'handle_tgt_authdata()' Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38260

phpCAS Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/38883

Pulse CMS 'delete.php' Arbitrary File Deletion Vulnerability
http://www.securityfocus.com/bid/38947

Mozilla Firefox/Thunderbird/Seamonkey CVE-2010-0167 Multiple Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/38944

Mozilla Firefox 'gfxTextRun::SanitizeGlyphRuns()' Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38943

Joomla! 'com_software' Component 'software_id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38942

Joomla! 'com_wallpapers' Component 'cid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38941

Cisco IOS For Communication Manager Express SCCP (CVE-2010-0586) Denial of Service Vulnerability
http://www.securityfocus.com/bid/38940

Mozilla Firefox 'TraceRecorder::traverseScopeChain()' Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38939

Cisco IOS Multiprotocol Label Switching (MPLS) Malformed Packet Denial of Service Vulnerability
http://www.securityfocus.com/bid/38938

Cisco IOS NAT SCCP Fragmentation Support Denial of Service Vulnerability
http://www.securityfocus.com/bid/38937

Cisco IOS For Communication Manager Express SCCP (CVE-2010-0585) Denial of Service Vulnerability
http://www.securityfocus.com/bid/38936

Cisco IOS SIP Message (CVE-2010-0579) Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38935

Cisco IOS H.323 Interface Memory Leak Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38934

Cisco IOS SIP Message (CVE-2010-0581) Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38933

Cisco IOS IPsec Internet Key Exchange (IKE) Malformed Packet Denial of Service Vulnerability
http://www.securityfocus.com/bid/38932

Cisco IOS H.323 Interface Queue Resource Exhaustion Denial of Service Vulnerability
http://www.securityfocus.com/bid/38931

Cisco IOS Software Crafted TCP Packet Denial of Service Vulnerability
http://www.securityfocus.com/bid/38930

Cisco IOS SIP Message (CVE-2010-0580) Denial of Service Vulnerability
http://www.securityfocus.com/bid/38929

Sun Connection Update Manager for Solaris Multiple Insecure Temporary File Creation Vulnerabilities
http://www.securityfocus.com/bid/38928

Mozilla Firefox Image Preloading Content-Policy Check Security Bypass Vulnerability
http://www.securityfocus.com/bid/38927

OpenCMS OAMP Comments Module Add Comment HTML Injection Vulnerability
http://www.securityfocus.com/bid/38926

Deliver Local Privilege Escalation and Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/38924

Joomla! 'com_jresearch' Component 'controller' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/38917

2010年3月24日水曜日

24日水曜日、仏滅

+ Two Security Vulnerabilities in GNU tar (see gtar(1)) May Lead to Files Being Overwritten, Execution of Arbitrary Code, or a Denial of Service (DoS)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-273551-1

Postfix 2.8 Snapshot 20100323
http://mirror.postfix.jp/postfix-release/experimental/postfix-2.8-20100323.HISTORY

Postfix legacy release 2.6.6, 2.5.10 and 2.4.14
http://www.postfix.org/announcements/postfix-2.6.6.html

Trend Micro Network VirusWall Enforcer 1500i / 3500i Patch 1 および移行ツール公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1386

Trend Micro Threat Mitigator 2.5 Service Pack 1 公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1387

ALERT WEEKLY SUMMARY REPORT
http://sunsolve.sun.com/search/document.do?assetkey=1-66-275470-1

JVNDB-2009-002523 VMware Fusion の vmx86 のカーネル拡張における整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002523.html

JVNDB-2009-002522 VMware Fusion の vmx86 のカーネル拡張における権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002522.html

JVNDB-2009-002521 複数の VMware 製品の VMnc media コーデックにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002521.html

JVNDB-2009-002520 複数の VMware 製品の VMnc media コーデックにおけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002520.html

JVNDB-2009-002519 VMware Studio の Web インターフェースにおけるディレクトリトラバーサルの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002519.html

JVNDB-2009-002518 複数の VMware 製品の Descheduled Time Accounting ドライバにおけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002518.html

JVNDB-2009-002517 複数の VMware 製品の仮想マシン表示機能における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002517.html

JVNDB-2009-002516 複数の VMware 製品の仮想マシン通信インターフェイスにおける権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002516.html

".sys" Directories Delivering Driveby Downloads
http://isc.sans.org/diary.html?storyid=8482

Lexmark Laser Printer Buffer Overflow in Processing PJL Data Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023735.html

Lexmark Laser Printer FTP Service Flood Protection Error Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023734.html

Kerberos SPNEGO GSS-API Mechanism Flaw Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023733.html

+ Postfix 2.5 Patchlevel 10, 2.4 Patchlevel 14 released
http://mirror.postfix.jp/postfix-release/official/postfix-2.5.10.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-2.4.14.HISTORY

+ [FreeBSD-Announce] FreeBSD 7.3-RELEASE Available
http://www.freebsd.org/releases/7.3R/announce.html
http://www.freebsd.org/releases/7.3R/relnotes.html

[ANNOUNCE] Apache Directory Server 1.5.6 released !
http://directory.apache.org/apacheds/1.5/downloads.html

[ANNOUNCE] 2nd set of PostgreSQL 9.0 Alpha4 RPMs are available.
http://developer.postgresql.org/pgdocs/postgres/release-9-0.html

HPSBOV02506 SSRT090244 rev.1 - HP Secure Web Server for OpenVMS (based on Apache) CSWS, Remote Denial of Service (DoS), Unauthorized Disclosure of Information, Unauthorized Modification of Information
http://www13.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=emr_na-c02002308

HPSBOV02497 SSRT090245 rev.1 - HP TCP/IP Services for OpenVMS Running NTP, Remote Execution of Arbitrary Code, Denial of Service (DoS)
http://www13.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=emr_na-c01961959

VMware ESX and ESXi 3.5 Comparison
http://kb.vmware.com/selfservice/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=1006543&sliceId=1&docTypeID=DT_KB_1_1

Using the VMware SCSI Disk Driver for Windows Guest Operating Systems
http://kb.vmware.com/selfservice/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=1006956&sliceId=1&docTypeID=DT_KB_1_1

Overview of VMware Tools
http://kb.vmware.com/selfservice/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=340&sliceId=1&docTypeID=DT_KB_1_1

Independent Researcher : Vulnerability Astaro Security Linux v5
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32066

Mandriva : libpng
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32063

Mandriva : cpio
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32064

Safari browser port blocking bypassed by integer overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00186.html

MITKRB5-SA-2010-002 denial of service in SPNEGO [CVE-2010-0628 VU#839413]
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00188.html

[DSECRG-09-064] SAP GUI - Insecure method, code execution
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00180.html

[ MDVSA-2010:065 ] cpio
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00187.html

[ MDVSA-2010:064 ] libpng
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00175.html

Vulnerability Astaro Security Linux v5
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00179.html

[HITB-Announce] HITBSecConf2009 - Malaysia Videos Released!
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00184.html

[ MDVSA-2010:063 ] libpng
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00171.html

Aris AGX agXchange ESM Cross Site Scripting Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00189.html

Vulnerabilities in CaptchaSecurityImages
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00183.html

{PRL} Lexmark Multiple Laser Printer Remote Stack Overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00173.html

[SECURITY] [DSA 2021-1] New spamass-milter packages fix remote command execution
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00177.html

CFP - GameSec 2010 - Conference on Decision and Game Theory for Security
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00169.html

REMINDER: Month of PHP Security 2010 - CALL FOR PAPERS - Only 3 weeks left
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00174.html

MX Simulator Server 2010-02-06 Remote Buffer Overflow PoC
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00168.html

[CORELAN-10-015] - Remote Help 0.0.7 Httpd DoS (Format String)
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00190.html

IE 6.0 - Local Crash Exploit
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00178.html

The Top 10 Riskiest US Cities for Cybercrime
http://isc.sans.org/diary.html?storyid=8476

Mozilla Firefox Heap Overflow in WOFF Decoder Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023732.html

Fedora update for qt
http://secunia.com/advisories/39094/

Qt WebKit Multiple Vulnerabilities
http://secunia.com/advisories/39091/

OpenPage "id" SQL Injection Vulnerability
http://secunia.com/advisories/39090/

RepairShop2 "prod" Cross-Site Scripting and SQL Injection Vulnerabilities
http://secunia.com/advisories/39043/

WordPress Password Protection Weakness
http://secunia.com/advisories/39040/

Cafu Denial of Service and Format String Vulnerabilities
http://secunia.com/advisories/39054/

Mxserver Packet Processing Buffer Overflow Vulnerability
http://secunia.com/advisories/39051/

SUSE update for kernel
http://secunia.com/advisories/39102/

Fedora update for asterisk
http://secunia.com/advisories/39096/

vBulletin "query" Cross-Site Scripting Vulnerability
http://secunia.com/advisories/39047/

Vulnerability Note VU#964549: Mozilla WOFF decoder integer overflow
http://www.kb.cert.org/vuls/id/964549

Mozilla Firefox WOFF Font Processing Integer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0684

Debian Security Update Fixes spamass-milter Code Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0683

Mandriva Security Update Fixes Libpng Memory Disclosure and DoS
http://www.vupen.com/english/advisories/2010/0682

MX Simulator Server Remote Buffer Overflow PoC
http://www.exploit-db.com/exploits/11857

uhttp Server Path Traversal Vulnerability
http://www.exploit-db.com/exploits/11856

MediaWiki 'thumb.php' Security Bypass Vulnerability
http://www.securityfocus.com/bid/38617

MediaWiki 'CSS validation' Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38621

Multiple Vendor HTML Form Protocol Vulnerability
http://www.securityfocus.com/bid/3181

Heimdal Multiple Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/38868

Astaro Security Linux 'index.fpl' Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/38893

OpenCart 'page' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38605

Linux Kernel 'do_pages_move()' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38144

Linux Kernel 'drivers/connector/connector.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38058

Linux Kernel PI Futex Invalid Pointer Dereference Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38165

Linux Kernel CVE-2010-0291 'mmap()' and 'mremap()' Multiple Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/37906

Linux Kernel 'ebtables' Security Bypass Vulnerability
http://www.securityfocus.com/bid/37762

Linux Kernel 'fasync_helper()' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37806

Linux Kernel 'print_fatal_signal()' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/37724

Linux Kernel 'net/ipv6/ip6_output.c' NULL Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/38185

Uiga Fan Club, Personal Portal and Business Portal 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38464

dpkg-source Directory Traversal Vulnerability
http://www.securityfocus.com/bid/38654

Mozilla Firefox WOFF Decoder Integer Overflow Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38298

Webmatic HTML Injection and Cross-Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/38874

VLC Media Player ASS File Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37832

Libpng 'png_decompress_chunk()' Function Denial of Service Vulnerability
http://www.securityfocus.com/bid/38478

Opera Web Browser 'Content-Length' Header Integer Overflow Vulnerability
http://www.securityfocus.com/bid/38519

WebKit HTML Elements Callback Use-After-Free Error Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38686

WebKit CSS 'format()' Arguments Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38684

WebKit Cross-Origin Stylesheet Request Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38692

WebKit Nested HTML Tags Use-After-Free Error Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38685

WebKit HTML Image Element Handling Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38691

WebKit Right-to-Left Displayed Text Handling Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38689

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

Asterisk CIDR Notation in Access Rule Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/38424

Asterisk Dialplan '${EXTEN}' Variable String Injection Vulnerability
http://www.securityfocus.com/bid/38314

Asterisk T.38 'FaxMaxDatagram' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38047

Libpng 1-bit Interlaced Images Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35233

Multiple SpringSource Products Multiple HTML Injection Vulnerabilities
http://www.securityfocus.com/bid/38913

Joomla! 'com_properties' Component 'controller' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/38912

SMEStorage 'com_smestorage' Component for Joomla! Local File Include Vulnerability
http://www.securityfocus.com/bid/38911

Joomla! 'com_gds' Component 'sid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38910

Kasseler CMS News Module 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38909

phpAuthent 'useradd.php' Multiple HTML Injection Vulnerabilities
http://www.securityfocus.com/bid/38908

RepairShop 2 'prod' Parameter Cross Site Scripting and SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/38907

Multiple Lexmark Laser Printers FTP Service Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38906

Secure Portal and Secure Dept Portal Page Restriction Security Bypass Vulnerability
http://www.securityfocus.com/bid/38905

MIT Kerberos 'gss_accept_sec_context()' Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38904

Multiple Lexmark Laser Printers PJL Processing Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38901

Stack 'action' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/38899

Cafu Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/38897

agXchange ESM 'ucquerydetails.jsp' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38896

Lussumo Vanilla 'definitions.php' Multiple Remote File Include Vulnerabilities
http://www.securityfocus.com/bid/38889

2010年3月23日火曜日

23日火曜日、先負

+ Postfix 2.5 Patchlevel 10, 2.4 Patchlevel 14 released
http://mirror.postfix.jp/postfix-release/official/postfix-2.5.10.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-2.4.14.HISTORY

Firefox 3.6.2 update now available as free download
http://www.mozilla.com/firefox/3.6.2/releasenotes/

ALERT WEEKLY SUMMARY REPORT
http://sunsolve.sun.com/search/document.do?assetkey=1-66-275470-1

JVNDB-2010-001179 複数の VMware 製品の ioctl におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001179.html

JVNDB-2010-001178 複数の VMware 製品の VNnc コーデックにおけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001178.html

JVNDB-2010-001177 複数の VMware 製品の VNnc コーデックにおけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001177.html

JVNDB-2010-001176 VMware ACE の ACE 共有フォルダ実装における無効にされた共有フォルダを有効にされる脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001176.html

JVNDB-2010-001175 複数の VMware 製品の VI Client におけるパスワードを取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001175.html

JVNDB-2010-001174 Apache HTTP Server の ap_read_request 関数における重要な情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001174.html

JVNDB-2010-001173 Apache HTTP Server の ap_proxy_ajp_request 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001173.html

JVNDB-2010-001172 KVM の x86 エミュレータにおける権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001172.html

+ Integer Overflow Security Vulnerability in AES and RC4 Decryption in the Solaris Kerberos Crypto Library May Lead to Execution of Arbitrary Code or a Denial of Service (DoS)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-275530-1

+ A Security Vulnerability in the ntp Daemon (xntpd(1M)) May Lead to a Denial of the Solaris Network Time Protocol(NTP) Service
http://sunsolve.sun.com/search/document.do?assetkey=1-66-275590-1

+ Postfix 2.6 Patchlevel 6 released
http://mirror.postfix.jp/postfix-release/official/postfix-2.6.6.HISTORY

+- IBM Lotus Notes 'names.nsf' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38880

+- IBM Lotus Notes 'names.nsf' Open Redirection Vulnerability
http://www.securityfocus.com/bid/38852

Year 1 prototype release of BIND 10 is now available
http://bind10.isc.org/wiki/Year1Deliverable
http://bind10.isc.org/

cURL: Twelve years old and time for git
http://curl.haxx.se/source.html

Package: Courier 0.64.2 released
https://sourceforge.net/projects/courier/files/courier/0.64.2/courier-0.64.2.tar.bz2/download

Package: maildrop 2.4.3 released
https://sourceforge.net/projects/courier/files/maildrop/2.4.3/maildrop-2.4.3.tar.bz2/download

Dovecot 2.0.beta4 released
http://www.dovecot.org/list/dovecot-news/2010-March/000153.html

Linux kernel 2.6.34-rc2 released
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.34-rc2

Linux Kernel release: 2.6.34-rc2
http://www.linux.org/news/2010/03/20/0001.html

Nordic Perl Workshop 2010
http://use.perl.org/article.pl?sid=10/03/19/2216230&from=rss

Corelan Security Team : Ken Ward Zipper .zip 0day Stack BOF
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32059

Debian : New spamass-milter packages fix remote command execution
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32055

Corelan Security Team : Remote Help 0.0.7 Httpd DoS (Format String)
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32057

Debian : New pango1.0 packages fix denial of service
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32053

Debian : New ikiwiki packages fix cross-site scripting
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32054

Mandriva : Security Announce curl
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32052

Independent Researcher : Vulnerability Httpdx v1.5.3b
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32056

Independent Researcher : IBM Lotus 6.x HTTP Response Splitting Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32061

MustLive : Vulnerabilities in WordPress
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32058

Computer Associates : Security Notice for CA ARCserve Backup
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32051

Debian : New php5 packages fix null pointer dereference
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32050

RHBA-2010:0159-1: rhnlib bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0159.html

[SECURITY] [DSA 2020-1] New ikiwiki packages fix cross-site scripting
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00167.html

[SECURITY] [DSA-2019-1] New pango1.0 packages fix denial of service
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00166.html

[ MDVSA-2010:062 ] curl
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00163.html

IBM Lotus 6.x names.nsf Cross Site Scripting Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00165.html

Firefox 3.6 for Windows includes a forged CA cert
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00164.html

Aris AGX agXchange ESM Open Redirection Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00162.html

announcing skipfish, an automated web app security scanner
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00161.html

Vulnerability Httpdx v1.5.3b
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00160.html

IBM Lotus 6.x HTTP Response Splitting Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00159.html

There are lost of xss vul in PHPWind v6.0 !
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00158.html

CA20100318-01: Security Notice for CA ARCserve Backup
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00156.html

[SECURITY] [DSA-2018-1] New php5 packages fix null pointer dereference
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00155.html

[USN-915-1] Thunderbird vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00157.html

Skipfish - Web Application Security Tool
http://isc.sans.org/diary.html?storyid=8467

Responding To The Unexpected
http://isc.sans.org/diary.html?storyid=8470

Firefox 3.6.2 to be released March 30
http://isc.sans.org/diary.html?storyid=8458

BitDefender 2010 Update Problem
http://isc.sans.org/diary.html?storyid=8464

I Know What Your Office Equipment Did Last Summer...
http://isc.sans.org/diary.html?storyid=8455

Heimdal Kerberos Length Checking Error Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023731.html

Mozilla Thunderbird SSPI Authentication and Message Indexing Bugs May Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023730.html

Mozilla Seamonkey SSPI Authentication and Message Indexing Bugs May Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023729.html

Mozilla Seamonkey Plugin Content Flaw Lets Remote Users Access Files
http://securitytracker.com/alerts/2010/Mar/1023728.html

CA ARCserve Backup Includes a Vulnerable Distribution of Java Runtime Environment
http://securitytracker.com/alerts/2010/Mar/1023727.html

Asterisk T.38 Remote Crash Vulnerability
http://www.securiteam.com/unixfocus/5EP382K0US.html

HP Enterprise Cluster Master Toolkit Local Unauthorized Access
http://www.securiteam.com/unixfocus/5CP362K0UQ.html

RealNetworks RealPlayer 11 HTTP Chunked Encoding Vulnerability
http://www.securiteam.com/unixfocus/5OP3B2K0UK.html

HP-UX running HP CIFS Server Remote Unauthorized Access
http://www.securiteam.com/unixfocus/5DP372K0UU.html

HP OpenVMS RMS Local Escalation of Privilege
http://www.securiteam.com/unixfocus/5FP392K0UI.html

Mozilla Bugzilla Multiple Vulnerabilities
http://www.securiteam.com/unixfocus/5QP3D2K0UK.html

RealNetworks RealPlayer CMediumBlockAllocator Integer Overflow Vulnerability
http://www.securiteam.com/securitynews/5NP3A2K0UC.html

Real Networks RealPlayer Compressed GIF Handling Integer Overflow
http://www.securiteam.com/securitynews/5PP3C2K0UA.html

Online Community Site SQL Injection Vulnerabilities
http://secunia.com/advisories/38963/

IBM OS/400 HTTP Server Information Disclosure Vulnerability
http://secunia.com/advisories/39081/

Mini CMS RibaFS "login" SQL Injection Vulnerability
http://secunia.com/advisories/39018/

GLPI phpCAS Cross-Site Scripting Vulnerability
http://secunia.com/advisories/39086/

GLPI Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/39083/

Debian update for spamass-milter
http://secunia.com/advisories/38956/

Webmatic Cross-Site Scripting and Script Insertion Vulnerabilities
http://secunia.com/advisories/39035/

Fedora update for esorex
http://secunia.com/advisories/39075/

Pay Per Watch & Bid Auktions System "id_auk" SQL Injection Vulnerability
http://secunia.com/advisories/39059/

eDisplay Personal FTP Server Buffer Overflow Vulnerabilities
http://secunia.com/advisories/39045/

Teamsite Hack Plugin "userid" SQL Injection Vulnerability
http://secunia.com/advisories/39009/

Secure Dept Portal Security Bypass Vulnerabilities
http://secunia.com/advisories/39085/

Secure Portal Security Bypass Vulnerabilities
http://secunia.com/advisories/39052/

Ken Ward's Zipper Buffer Overflow Vulnerability
http://secunia.com/advisories/39017/

phpCAS Cross-Site Scripting Vulnerability
http://secunia.com/advisories/39055/

notsoPureEdit "content" File Inclusion Vulnerability
http://secunia.com/advisories/39070/

Joomla! JE Form Creator Component "view" Local File Inclusion Vulnerability
http://secunia.com/advisories/39063/

Fedora update for dpkg
http://secunia.com/advisories/39077/

Debian update for ikiwiki
http://secunia.com/advisories/39048/

Debian update for pango1.0
http://secunia.com/advisories/39041/

Heimdal Two Denial of Service Vulnerabilities
http://secunia.com/advisories/39037/

Fedora update for gnu-smalltalk
http://secunia.com/advisories/39082/

GNU Smalltalk libtool Search Path Privilege Escalation Security Issue
http://secunia.com/advisories/39076/

IBM HTTP Server Multiple Vulnerabilities
http://secunia.com/advisories/39044/

Limny Multiple Vulnerabilities
http://secunia.com/advisories/39014/

Crimson Editor Configuration File Buffer Overflow Vulnerability
http://secunia.com/advisories/39042/

SiteDone Custom Edition "articleId" SQL Injection Vulnerability
http://secunia.com/advisories/39038/

CA ARCserve Backup JRE Multiple Vulnerabilities
http://secunia.com/advisories/38929/

Ubuntu update for thunderbird
http://secunia.com/advisories/38977/

Liquid XML Studio LtXmlComHelp8 ActiveX "OpenFile()" Buffer Overflow
http://secunia.com/advisories/38974/

Debian update for php5
http://secunia.com/advisories/38930/

eFront "langname" Parameter Processing Local File Inclusion Vulnerability
http://www.vupen.com/english/advisories/2010/0681

Secure Dept Portal Unspecified Script Unauthorized Access Vulnerability
http://www.vupen.com/english/advisories/2010/0680

Secure Portal Unspecified Script Unauthorized Access Vulnerability
http://www.vupen.com/english/advisories/2010/0679

Ken Ward Zipper ZIP Archive Filename Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0678

phpCAS URL Data Processing Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0677

Jewelry Cart "disproid" Parameter Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0676

Fw-BofF "configRootDir" and "configDBchoice" File Inclusion Issues
http://www.vupen.com/english/advisories/2010/0675

WebMaid CMS Multiple Parameter File Inclusion Vulnerabilities
http://www.vupen.com/english/advisories/2010/0674

notsoPureEdit "content" Parameter Remote File Inclusion Vulnerability
http://www.vupen.com/english/advisories/2010/0673

4xcms "user" Parameter Processing Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0672

Gift Exchange for Joomla "pkg" Parameter SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0671

Pay Per Watch & Bid Auktions System "id_auk" SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0670

Trouble Ticket Express "fid" Parameter File Download Vulnerability
http://www.vupen.com/english/advisories/2010/0669

IBM HTTP Server Security Update Fixes Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0668

Fedora Security Update Fixes Libpng Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0667

Fedora Security Update Fixes dpkg Directory Traversal Vulnerability
http://www.vupen.com/english/advisories/2010/0666

Fedora Security Update Fixes Cpio Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0665

Fedora Security Update Fixes Smalltalk Libtool Untrusted Path Issue
http://www.vupen.com/english/advisories/2010/0664

Fedora Security Update Fixes EsoRex Libtool Untrusted Path Issue
http://www.vupen.com/english/advisories/2010/0663

Debian Security Update Fixes ikiwiki Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0662

Debian Security Update Fixes Pango Array Indexing Vulnerability
http://www.vupen.com/english/advisories/2010/0661

Mandriva Security Update Fixes cURL Data Callback Excessive Length
http://www.vupen.com/english/advisories/2010/0660

CA ARCserve Backup JRE Code Execution and Security Bypass Issues
http://www.vupen.com/english/advisories/2010/0659

Debian Security Update Fixes PHP XML-RPC Denial of Service Issue
http://www.vupen.com/english/advisories/2010/0658

Ubuntu Security Update Fixes Thunderbird Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0657

Kenward zipper v1.4 0day Stack Buffer Overflow PoC exploit
http://www.exploit-db.com/exploits/11834

Uiga Fan Club and Personal Portal 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38464

Apache Subrequest Handling Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38580

Linux Kernel 'drivers/connector/connector.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38058

Linux Kernel PI Futex Invalid Pointer Dereference Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38165

Linux Kernel 'do_pages_move()' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38144

Linux Kernel KVM Large SMP Instruction Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/37130

GNU Libtool 'libltdl' Library Search Path Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37128

Qualiteam X-Cart 'cart.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38205

Advanced Software Engineering ChartDirector 'cacheId' Parameter Directory Traversal Vulnerability
http://www.securityfocus.com/bid/36300

Microsoft Excel DbOrParamQry Record Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38555

Yahoo! Player Playlist Processing Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38581

SpamAssassin Milter Plugin 'mlfi_envrcpt()' Remote Arbitrary Command Injection Vulnerability
http://www.securityfocus.com/bid/38578

ikiwiki 'htmlscrubber' Plugin Remote Script Code Injection Vulnerability
http://www.securityfocus.com/bid/38844

Pango Glyph Definition Table Denial of Service Vulnerability
http://www.securityfocus.com/bid/38760

dpkg-source Directory Traversal Vulnerability
http://www.securityfocus.com/bid/38654

Mozilla Firefox Unspecified Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38298

Libpng 'png_decompress_chunk()' Function Denial of Service Vulnerability
http://www.securityfocus.com/bid/38478

GNU Tar and GNU Cpio Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38628

cURL/libcURL CURLOPT_ENCODING Option Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38162

OpenPage 'index.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38888

freeSSHd SSH2 Connection Data Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38887

Powie PowieSys 'shownews' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38886

Ken Ward's Zipper 'filename' Stack-Based Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38885

Apple Safari Nested 'object' Tag Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38884

phpCAS Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/38883

GLPI Prior to 0.72.4 Multiple Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/38882

Mini CMS RibaFS 'admin/login.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38881

agXchange ESM 'ucschcancelproc.jsp' Open Redirection Vulnerability
http://www.securityfocus.com/bid/38879

WordPress Password Protection Security Bypass Vulnerability
http://www.securityfocus.com/bid/38876

Remote Help HTTP GET Request Format String Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38875

Wazzum Dating Software Arbitrary File Upload Vulnerabilities
http://www.securityfocus.com/bid/38873

Woltlab Burning Board Lexikon Plugin 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38871

Woltlab Burning Board Teamsite Hack Plugin 'userid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38870

Heimdal Multiple Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/38868

Pay Per Auction Watch & Bid System 'id_auk' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38878

KDE KSysguard '.sgrd' File Processing Arbitrary Command Execution Vulnerability
http://www.securityfocus.com/bid/38872

Joomla! Gift Exchange Component 'pkg' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38869

Microsoft Windows Media Player AVI File Colorspace Conversion Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38790

Apache mod_proxy_ajp Module Incoming Request Body Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38491

MIT Kerberos AES and RC4 Decryption Integer Underflow Vulnerabilities
http://www.securityfocus.com/bid/37749

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37255

Realtek Media Player Playlist Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/32860

MediaCoder Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38405

IBM Lotus Notes 'names.nsf' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38880

Webmatic HTML Injection and Cross-Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/38874

PHPWind Multiple Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/38867

Joomla! 'com_jeformcr' Component 'view' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/38866

Dew-Code Dew-NewPHPLinks 'lang' Parameter Multiple Local File Include Vulnerabilities
http://www.securityfocus.com/bid/38864

Sahana 'stream.php' Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/38863

eDisplay Personal FTP server Multiple Commands Remote Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/38860

Limny 2.01 Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/38859

eDisplay Personal FTP Server 'USER' Command Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38855

Xilisoft Video Converter Wizard '.yuv' File Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38854

IBM Lotus Notes 'names.nsf' Open Redirection Vulnerability
http://www.securityfocus.com/bid/38852

Computer Associates ARCserve Backup JRE Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/38851

2010年3月19日金曜日

19日金曜日、大安

JVNTA10-068A Microsoft 製品における複数の脆弱性に対するアップデート
http://jvn.jp/cert/JVNTA10-068A/index.html

JVNDB-2010-001171 Microsoft Internet Explorer における解放済みメモリを使用する脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001171.html

JVNDB-2010-001170 複数の Microsoft 製品における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001170.html

JVNDB-2010-001169 複数の Microsoft 製品における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001169.html

JVNDB-2010-001168 複数の Microsoft 製品におけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001168.html

JVNDB-2010-001167 複数の Microsoft 製品におけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001167.html

JVNDB-2010-001166 複数の Microsoft 製品における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001166.html

JVNDB-2010-001165 複数の Microsoft 製品における任意のコードを実行される脆弱性http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001165.html

JVNDB-2010-001164 Microsoft Office Excel における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001164.html

JVNDB-2010-001163 Microsoft Windows Movie Maker および Microsoft Producer におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001163.html

- The "zpool create" Command May Dump Core When Used on Systems Running Sun Cluster 3.2
http://sunsolve.sun.com/search/document.do?assetkey=1-66-242426-1

[ANNOUNCE] Apache Mahout 0.3 Released
http://www.apache.org/dyn/closer.cgi/lucene/mahout
http://issues.apache.org/jira/browse/MAHOUT/fixforversion/12314281

phpMyAdmin at Google Summer of Code 2010
http://sourceforge.net/news/?group_id=23067&id=284219

RHEA-2010:0156-1: new packages: kmod-lpfc-rhel5u4-8.2.0.63-1.1
http://rhn.redhat.com/errata/RHEA-2010-0156.html

RHEA-2010:0157-1: Virtio drivers for kernel 2.4.21-63.EL
http://rhn.redhat.com/errata/RHEA-2010-0157.html

Independent Researcher : Citrix Web interface - Source code disclosure?
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32043

Dangers of copy&paste
http://isc.sans.org/diary.html?storyid=8449

IBM DB2 Content Manager Web Services Single Sign-on Flaw Has Unspecified Impact
http://securitytracker.com/alerts/2010/Mar/1023726.html

DotNetNuke Cross-Site Scripting Vulnerability
http://secunia.com/advisories/38920/

Nensor CMS File Inclusion Vulnerabilities
http://secunia.com/advisories/39019/

Sahana Disaster Management System Authentication Security Bypass
http://secunia.com/advisories/39020/

Joomla VXDate Component SQL Injection and Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/39024/

ManageEngine ServiceDesk Plus "woID" SQL Injection Vulnerability
http://secunia.com/advisories/39032/

IBM DB2 Content Manager Information Integrator Security Issue
http://secunia.com/advisories/39025/

Drupal Email Input Filter Module PHP Code Execution Vulnerability
http://secunia.com/advisories/39034/

Drupal Tag Order Module Script Insertion Vulnerability
http://secunia.com/advisories/39030/

Transmission "tr_magnetParse()" Magnet Parsing Buffer Overflows
http://secunia.com/advisories/39031/

VariCAD Products DWB Processing Buffer Overflow
http://secunia.com/advisories/39027/

Drupal Keys Module Cross-Site Reques Forgery Vulnerability
http://secunia.com/advisories/39026/

Google Chrome Multiple Vulnerabilities
http://secunia.com/advisories/39029/

Mozilla SeaMonkey Multiple Vulnerabilities
http://secunia.com/advisories/39001/

Google Picasa for Mac JPEG Processing Memory Corruption
http://secunia.com/advisories/38753/

NinkoBB Cross-Site Request Forgery
http://secunia.com/advisories/39016/

Red Hat update for java-1.4.2-ibm
http://secunia.com/advisories/39028/

IBM DB2 Content Manager Web Services Single Sign-on Vulnerability
http://www.vupen.com/english/advisories/2010/0656

Transmission "tr_magnetParse()" Magnet Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0655

myMP3-Player Playlist Processing Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0654

VariCAD Products "DWB" File Processing Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0653

SugarCRM Document Name Handling Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0652

Redhat Security Update Fixes Java TLS/SSL Renegotiation Issue
http://www.vupen.com/english/advisories/2010/0651

Redhat Security Update Fixes Thunderbird Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0650

Redhat Security Update Fixes Kernel Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0649

Mozilla SeaMonkey Code Execution and Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0648

Google Chrome Code Execution and Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0647

Google Picasa for Mac JPEG Image Integer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0646

ZippHo 3.0.6 (.zip) 0day stack buffer overflow PoC exploit
http://www.exploit-db.com/exploits/11797

MediaCoder (.lst) file local Buffer Overflow Exploit
http://www.exploit-db.com/exploits/11794

SAP MaxDB 'serv.exe' Unspecified Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38769

PHP xmlrpc Extension Multiple Remote Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/38708

Mozilla Firefox and SeaMonkey NTLM Credential Reflection Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/37366

Mozilla Firefox Floating Point Conversion Heap Overflow Vulnerability
http://www.securityfocus.com/bid/36851

Mozilla Firefox and SeaMonkey Download Filename Spoofing Vulnerability
http://www.securityfocus.com/bid/36867

Mozilla Firefox MFSA 2009-47, -48, -49, -50, -51 Multiple Vulnerabilities
http://www.securityfocus.com/bid/36343

Mozilla Firefox and Thunderbird Remote Integer Overflow Vulnerability
http://www.securityfocus.com/bid/35769

Mozilla Thunderbird Multiple Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/38831

Bible Study Joomla! Component 'controller' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/37583

Energizer DUO USB Battery Charger Unauthorized Access Vulnerability
http://www.securityfocus.com/bid/38571

Google Picasa JPEG Image Processing Integer Overflow Vulnerability
http://www.securityfocus.com/bid/38384

OSSIM 'file' Parameter Directory Traversal Vulnerability
http://www.securityfocus.com/bid/38780

OSSIM 'what' Parameter Multiple Remote Command Execution Vulnerabilities
http://www.securityfocus.com/bid/38779

OSSIM 'repository_attachment.php' Arbitrary File Upload Vulnerability
http://www.securityfocus.com/bid/37377

ABO.CMS 'c.php' Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/38847

chillyCMS 'admin/index.php' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38846

ikiwiki 'htmlscrubber' Plugin Remote Script Code Injection Vulnerability
http://www.securityfocus.com/bid/38844

Softsaurus CMS Multiple Remote File Include Vulnerabilities
http://www.securityfocus.com/bid/38842

DotNetNuke Search Function Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38841

Nensor CMS Local File Include and SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/38839

Citrix Web Interface Source Code Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38838

MPlayer WAV File Remote Null Pointer Dereference Vulnerability
http://www.securityfocus.com/bid/38837

ZippHo '.zip' File Stack-Based Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38836

myMP3-Player '.m3u' File Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38835

ManageEngine ServiceDesk Plus 'woID' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38834

登録: 投稿 (Atom)

2010年3月25日木曜日

25日 木曜日、大安