Secunia Weekly Summary - Issue: 2004-3

[InfoSec News <isn () c4i org>]

========================================================================

                  The Secunia Weekly Advisory Summary                  
                        2004-01-08 - 2004-01-15                        

                       This week : 52 advisories                       

========================================================================
Table of Contents:

1.....................................................Word From Secunia
2....................................................This Week In Brief
3...............................This Weeks Top Ten Most Read Advisories
4.......................................Vulnerabilities Summary Listing
5.......................................Vulnerabilities Content Listing

========================================================================
1) Word From Secunia:

Secunia Advisory IDs

Every advisory issued by Secunia has an unique identifier: The Secunia
Advisory ID (SA ID). The SA IDs make it very easy to reference,
identify, and find Secunia advisories.

A Shortcut to Secunia Advisories

Finding Secunia Advisories using SA IDs is easily done at the Secunia
website; either by simply entering the SA ID in our search form placed
on the right side of every Secunia web page, or by entering the SA ID
directly after the domain when visiting the Secunia website e.g.
http://secunia.com/SA10395

In the Secunia Weekly Summary SA IDs are displayed in brackets e.g.
[SA10395]

========================================================================
2) This Week in Brief:

Microsoft has released their first 3 security bulletins for 2004, which
address issues in MDAC, Exchange Server 2003, and ISA Server 2000.
Unfortunately, in this new patch round from Microsoft we did not see
any updates for Internet Explorer. It is therefore still vulnerable to
several severe vulnerabilities.
Reference: [SA10611], [SA10615] & [SA10616]

Symantec's Automatic LiveUpdate function used by many Symantec products
(e.g. Norton Antivirus) has been found vulnerable to a privilege
escalation vulnerability. Symantec has released a new version to
address this issue.
Also, Symantec's Web Security suffered a vulnerability in the past
week. It was security researchers Oliver Karow and Brian Soby who
found the vulnerability, which can be exploited to conduct Cross Site
Scripting attacks against users.
Reference: [SA10609] & [SA10618]

NISCC reported vulnerabilities in the H.323 protocol implementation in
several products including some from Microsoft and Cisco. Both vendors
have released security updates that fix the vulnerabilities, which can
be exploited to cause a Denial of Service or gain system access
depending on the affected product.
More information can be found in referenced Secunia Advisories below.
Reference: [SA10610] & [SA10611]

TIP:
Finding Secunia advisories is easily done through the Secunia web site.
Simply enter the SA ID in the URL:
http://secunia.com/SA10609

========================================================================
3) This Weeks Top Ten Most Read Advisories:

1.  [SA10395] Internet Explorer URL Spoofing Vulnerability
2.  [SA10523] Internet Explorer showHelp() Restriction Bypass
              Vulnerability
3.  [SA10573] Yahoo! Messenger Filename Buffer Overflow Vulnerability
4.  [SA10353] rsync File Handling Integer Overflow Vulnerability
5.  [SA10609] Symantec Automatic LiveUpdate Privilege Escalation
              Vulnerability
6.  [SA10532] Linux Kernel "mremap()" Privilege Escalation
              Vulnerability
7.  [SA10596] Multiple AV Products bzip2 Processing Denial of Service
              Vulnerability
8.  [SA10616] Microsoft Data Access Components Broadcast Reply Buffer
              Overflow
9.  [SA10289] Internet Explorer System Compromise Vulnerabilities
10. [SA10589] Windows Ftp Server Format String Vulnerability

========================================================================
4) Vulnerabilities Summary Listing

Windows:
[SA10611] Microsoft ISA Server 2000 H.323 Protocol Filter
Vulnerability
[SA10608] Mabry FTPServer/X Command Format String Vulnerability
[SA10589] Windows Ftp Server Format String Vulnerability
[SA10600] Accipiter AdManager Directory Traversal Vulnerability
[SA10588] FreeProxy Directory Traversal and Denial of Service
Vulnerabilities
[SA10616] Microsoft Data Access Components Broadcast Reply Buffer
Overflow
[SA10579] VERITAS NetBackup Professional Creates Insecure Shares
[SA10618] Symantec Web Security Default Block Pages Cross-Site
Scripting
[SA10615] Microsoft Exchange 2003 May Provide Access to Wrong Mailbox
[SA10575] Snapstream Personal Video Station Cross-Site Scripting
Vulnerability
[SA10586] Cisco Personal Assistant Password Authentication Bypass
Vulnerability
[SA10609] Symantec Automatic LiveUpdate Privilege Escalation
Vulnerability

UNIX/Linux:
[SA10632] Slackware update for INN
[SA10604] ezContents Arbitrary File Inclusion Vulnerability
[SA10587] OpenPKG update for INN
[SA10578] InterNetNews Control Message Handling Buffer Overflow
Vulnerability
[SA10603] Andy's PHP Man Page Lookup Directory Traversal Vulnerability
[SA10599] Debian update for JitterBug
[SA10598] JitterBug Arbitrary Command Execution Vulnerability
[SA10597] Sun ONE Web Server Unspecified Buffer Overflow Vulnerability
[SA10596] Multiple AV Products bzip2 Processing Denial of Service
Vulnerability
[SA10592] DansGuardian Webmin Module Directory Traversal Vulnerability
[SA10591] Debian update for phpgroupware
[SA10627] Red Hat update for cvs
[SA10622] OpenBSD update for isakmpd
[SA10621] Racoon Arbitrary Security Association Deletion Vulnerability
[SA10617] Mandrake update for ethereal
[SA10614] Debian update for CVS
[SA10590] leafnode Missing Header Denial of Service Vulnerability
[SA10624] Red Hat update for httpd
[SA10623] SuSE "SuSEconfig.gnome-filesystem" Insecure Temporary File
Creation
[SA10620] H+BEDV AntiVir Insecure Temporary File Creation
Vulnerability
[SA10605] cstrings Insecure Temporary File Creation Vulnerability
[SA10593] Fedora update for httpd
[SA10585] Slackware update for kernel
[SA10584] Gentoo update for kernel
[SA10583] SmoothWall Express update for kernel
[SA10582] Mandrake update for kernel
[SA10581] HP-UX update for ypxfrd
[SA10580] HP-UX update for VirtualVault
[SA10577] Debian update for vbox3
[SA10613] Debian update for mod_auth_shadow
[SA10612] mod_auth_shadow Account Expiry Date Not Enforced

Other:
[SA10576] EDIMAX AR-6004 Broadband Router Cross-Site Scripting
Vulnerability

Cross Platform:
[SA10610] Cisco Multiple Products H.323 Protocol Denial of Service
Vulnerabilities
[SA10607] BEA WebLogic JVM Denial of Service Vulnerability
[SA10602] PhpGedView Multiple Vulnerabilities
[SA10595] SimpleData Access Restriction Bypass Vulnerability
[SA10594] Zope Multiple Denial of Service and Disclosure
Vulnerabilities
[SA10619] Helix Administrative Interface HTTP POST Request Denial of
Service
[SA10606] BEA WebLogic Password Exposure Weakness

========================================================================
5) Vulnerabilities Content Listing

Windows:--

[SA10611] Microsoft ISA Server 2000 H.323 Protocol Filter
Vulnerability

Critical:    Highly critical
Where:       From remote
Impact:      DoS, System access
Released:    2004-01-13

Microsoft Internet Security and Acceleration Server 2000 contain a
vulnerability in the H.323 protocol implementation, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
gain system access.

Full Advisory:
http://www.secunia.com/advisories/10611/

 --

[SA10608] Mabry FTPServer/X Command Format String Vulnerability

Critical:    Highly critical
Where:       From remote
Impact:      DoS, System access
Released:    2004-01-14

Securma Massine has reported a vulnerability in Mabry Software
FTPServer/X, allowing malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.

Full Advisory:
http://www.secunia.com/advisories/10608/

 --

[SA10589] Windows Ftp Server Format String Vulnerability

Critical:    Highly critical
Where:       From remote
Impact:      DoS, System access
Released:    2004-01-09

Peter Winter-Smith has reported a vulnerability in Windows Ftp Server,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.

Full Advisory:
http://www.secunia.com/advisories/10589/

 --

[SA10600] Accipiter AdManager Directory Traversal Vulnerability

Critical:    Moderately critical
Where:       From remote
Impact:      Exposure of system information, Exposure of sensitive
information
Released:    2004-01-13

Mark Bassett has identified a vulnerability in AdManager, allowing
malicious people to gain knowledge of sensitive information.

Full Advisory:
http://www.secunia.com/advisories/10600/

 --

[SA10588] FreeProxy Directory Traversal and Denial of Service
Vulnerabilities

Critical:    Moderately critical
Where:       From remote
Impact:      Exposure of system information, Exposure of sensitive
information, DoS
Released:    2004-01-09

badpack3t has discovered two vulnerabilities in FreeProxy, which can be
exploited by malicious people to gain knowledge of sensitive
information or cause a DoS (Denial of Service).

Full Advisory:
http://www.secunia.com/advisories/10588/

 --

[SA10616] Microsoft Data Access Components Broadcast Reply Buffer
Overflow

Critical:    Moderately critical
Where:       From local network
Impact:      System access
Released:    2004-01-13

Microsoft has reported a vulnerability in MDAC (Microsoft Data Access
Components), which potentially can be exploited by malicious people to
compromise a vulnerable system.

Full Advisory:
http://www.secunia.com/advisories/10616/

 --

[SA10579] VERITAS NetBackup Professional Creates Insecure Shares

Critical:    Moderately critical
Where:       From local network
Impact:      System access
Released:    2004-01-09

Kay Schluepmann has reported a vulnerability in NetBackup Professional,
allowing malicious people to access files on the system running the
NetBackup client.

Full Advisory:
http://www.secunia.com/advisories/10579/

 --

[SA10618] Symantec Web Security Default Block Pages Cross-Site
Scripting

Critical:    Less critical
Where:       From remote
Impact:      Cross Site Scripting
Released:    2004-01-14

Oliver Karow and Brian Soby have identified a vulnerability in Symantec
Web Security, which can be exploited by malicious people to conduct
cross-site scripting attacks against users.

Full Advisory:
http://www.secunia.com/advisories/10618/

 --

[SA10615] Microsoft Exchange 2003 May Provide Access to Wrong Mailbox

Critical:    Less critical
Where:       From remote
Impact:      Exposure of sensitive information
Released:    2004-01-13

Microsoft has reported a weakness in Exchange Server 2003, which is
caused due to a bug in the handling of NTLM authentication in Outlook
Web Access.

Full Advisory:
http://www.secunia.com/advisories/10615/

 --

[SA10575] Snapstream Personal Video Station Cross-Site Scripting
Vulnerability

Critical:    Less critical
Where:       From remote
Impact:      Cross Site Scripting
Released:    2004-01-09

Rafel Ivgi has reported a vulnerability in Personal Video Station (PVS)
LITE, allowing malicious people to conduct Cross Site Scripting
attacks.

Full Advisory:
http://www.secunia.com/advisories/10575/

 --

[SA10586] Cisco Personal Assistant Password Authentication Bypass
Vulnerability

Critical:    Less critical
Where:       From local network
Impact:      Security Bypass
Released:    2004-01-09

Cisco has issued an advisory regarding a vulnerability in Cisco
Personal Assistant, allowing malicious people to access the
configuration interface.

Full Advisory:
http://www.secunia.com/advisories/10586/

 --

[SA10609] Symantec Automatic LiveUpdate Privilege Escalation
Vulnerability

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-13

KF has discovered a vulnerability in Symantec LiveUpdate, which can be
exploited by malicious, local users to gain escalated privileges on a
vulnerable system.

Full Advisory:
http://www.secunia.com/advisories/10609/


UNIX/Linux:--

[SA10632] Slackware update for INN

Critical:    Highly critical
Where:       From remote
Impact:      System access
Released:    2004-01-15

Slackware has issued updated packages for INN. These fix a
vulnerability, which can be exploited by malicious people to gain
system access.

Full Advisory:
http://www.secunia.com/advisories/10632/

 --

[SA10604] ezContents Arbitrary File Inclusion Vulnerability

Critical:    Highly critical
Where:       From remote
Impact:      System access
Released:    2004-01-13

Zero_X has identified a vulnerability in ezContents, allowing malicious
people to include and execute arbitrary files.

Full Advisory:
http://www.secunia.com/advisories/10604/

 --

[SA10587] OpenPKG update for INN

Critical:    Highly critical
Where:       From remote
Impact:      System access
Released:    2004-01-09

OpenPKG has issued updated packages for INN. These fix a vulnerability,
which can be exploited by malicious people to gain system access.

Full Advisory:
http://www.secunia.com/advisories/10587/

 --

[SA10578] InterNetNews Control Message Handling Buffer Overflow
Vulnerability

Critical:    Highly critical
Where:       From remote
Impact:      System access
Released:    2004-01-08

Dan Riley has discovered a vulnerability in InterNetNews (INN), which
can be exploited by malicious people to compromise a vulnerable
system.

Full Advisory:
http://www.secunia.com/advisories/10578/

 --

[SA10603] Andy's PHP Man Page Lookup Directory Traversal Vulnerability

Critical:    Moderately critical
Where:       From remote
Impact:      Exposure of sensitive information
Released:    2004-01-13

Cabezon Aurélien has identified a vulnerability in Man Page Lookup,
which can be exploited by malicious people to see the content of
arbitrary files.

Full Advisory:
http://www.secunia.com/advisories/10603/

 --

[SA10599] Debian update for JitterBug

Critical:    Moderately critical
Where:       From remote
Impact:      System access
Released:    2004-01-13

Debian has issued updated packages for JitterBug. These fix a
vulnerability, which can be exploited by malicious users to execute
arbitrary commands on a vulnerable system.

Full Advisory:
http://www.secunia.com/advisories/10599/

 --

[SA10598] JitterBug Arbitrary Command Execution Vulnerability

Critical:    Moderately critical
Where:       From remote
Impact:      System access
Released:    2004-01-13

Steve Kemp has discovered a vulnerability in JitterBug, allowing
malicious users to execute arbitrary commands.

Full Advisory:
http://www.secunia.com/advisories/10598/

 --

[SA10597] Sun ONE Web Server Unspecified Buffer Overflow Vulnerability

Critical:    Moderately critical
Where:       From remote
Impact:      DoS
Released:    2004-01-12

Sun has reported a vulnerability in Sun ONE Web Server, which can be
exploited by malicious people to cause a DoS (Denial of Service).

Full Advisory:
http://www.secunia.com/advisories/10597/

 --

[SA10596] Multiple AV Products bzip2 Processing Denial of Service
Vulnerability

Critical:    Moderately critical
Where:       From remote
Impact:      DoS
Released:    2004-01-12

Dr. Peter Bieringer has reported a vulnerability in various AV (Anti
Virus) products, which can be exploited by malicious people to cause a
DoS (Denial of Service).

Full Advisory:
http://www.secunia.com/advisories/10596/

 --

[SA10592] DansGuardian Webmin Module Directory Traversal Vulnerability

Critical:    Moderately critical
Where:       From remote
Impact:      Exposure of system information, Exposure of sensitive
information
Released:    2004-01-09

FIST has reported a vulnerability in the DansGuardian Webmin Module,
allowing malicious people to conduct directory traversal attacks.

Full Advisory:
http://www.secunia.com/advisories/10592/

 --

[SA10591] Debian update for phpgroupware

Critical:    Moderately critical
Where:       From remote
Impact:      Security Bypass, Manipulation of data, Exposure of system
information, Exposure of sensitive information
Released:    2004-01-09

Debian has issued updated packages for phpgroupware. These fix some
vulnerabilities, which can be exploited to conduct SQL injection
attacks and execute certain scripts.

Full Advisory:
http://www.secunia.com/advisories/10591/

 --

[SA10627] Red Hat update for cvs

Critical:    Less critical
Where:       From remote
Impact:      Security Bypass, Privilege escalation
Released:    2004-01-15

Red Hat has issued updated packages for cvs, which fix two
vulnerabilities. The first vulnerability can be exploited by malicious
users to create arbitrary folders and possibly files in the root of the
host's file system.

Full Advisory:
http://www.secunia.com/advisories/10627/

 --

[SA10622] OpenBSD update for isakmpd

Critical:    Less critical
Where:       From remote
Impact:      Manipulation of data, DoS
Released:    2004-01-14

OpenBSD has issued a patch for isakmpd. This fixes a vulnerability,
which can be exploited by malicious people to delete arbitrary SAs
(Security Associations).

Full Advisory:
http://www.secunia.com/advisories/10622/

 --

[SA10621] Racoon Arbitrary Security Association Deletion Vulnerability

Critical:    Less critical
Where:       From remote
Impact:      Manipulation of data, DoS
Released:    2004-01-14

Thomas Walpuski has reported a vulnerability in KAME Racoon, which can
be exploited by malicious people to cause a DoS (Denial of Service) on
users' connections.

Full Advisory:
http://www.secunia.com/advisories/10621/

 --

[SA10617] Mandrake update for ethereal

Critical:    Less critical
Where:       From remote
Impact:      DoS
Released:    2004-01-14

MandrakeSoft has issued updated packages for ethereal. These fix two
vulnerabilities, which can be exploited by malicious people to crash
the application.

Full Advisory:
http://www.secunia.com/advisories/10617/

 --

[SA10614] Debian update for CVS

Critical:    Less critical
Where:       From remote
Impact:      Security Bypass
Released:    2004-01-13

Debian has issued updated packages for cvs. These fix a vulnerability,
which can be exploited by malicious users to create arbitrary folders
and possibly files in the root of the host's file system.

Full Advisory:
http://www.secunia.com/advisories/10614/

 --

[SA10590] leafnode Missing Header Denial of Service Vulnerability

Critical:    Less critical
Where:       From remote
Impact:      DoS
Released:    2004-01-09

Toni Viemerö has identified a vulnerability in leafnode, allowing
malicious people to cause a Denial of Service.

Full Advisory:
http://www.secunia.com/advisories/10590/

 --

[SA10624] Red Hat update for httpd

Critical:    Less critical
Where:       Local system
Impact:      DoS, Privilege escalation
Released:    2004-01-14

Red Hat has issued updated packages for httpd. These fix a
vulnerability, which can be exploited by malicious, local users to
cause a DoS (Denial of Service) or escalate privileges.

Full Advisory:
http://www.secunia.com/advisories/10624/

 --

[SA10623] SuSE "SuSEconfig.gnome-filesystem" Insecure Temporary File
Creation

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-14

l0om has reported a vulnerability in SuSE, allowing malicious, local
users to escalate their privileges on a vulnerable system.

Full Advisory:
http://www.secunia.com/advisories/10623/

 --

[SA10620] H+BEDV AntiVir Insecure Temporary File Creation
Vulnerability

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-14

l0om has reported a vulnerability in AntiVIr, allowing malicious, local
users to escalate their privileges on a vulnerable system.

Full Advisory:
http://www.secunia.com/advisories/10620/

 --

[SA10605] cstrings Insecure Temporary File Creation Vulnerability

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-13

A vulnerability has been reported in cstrings, which potentially can be
exploited by malicious, local users to perform certain actions on a
vulnerable system with escalated privileges.

Full Advisory:
http://www.secunia.com/advisories/10605/

 --

[SA10593] Fedora update for httpd

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation, DoS
Released:    2004-01-12

Red Hat has issued updated packages for httpd. These fix a
vulnerability, which can be exploited by malicious, local users to
cause a DoS (Denial of Service) or escalate privileges.

Full Advisory:
http://www.secunia.com/advisories/10593/

 --

[SA10585] Slackware update for kernel

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-09

Slackware has issued updated packages for the kernel. These fix a
vulnerability, which can be exploited by malicious, local users to gain
escalated privileges.

Full Advisory:
http://www.secunia.com/advisories/10585/

 --

[SA10584] Gentoo update for kernel

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-09

Gentoo has issued updated packages for the kernel. These fix a
vulnerability, which can be exploited by malicious, local users to gain
escalated privileges.

Full Advisory:
http://www.secunia.com/advisories/10584/

 --

[SA10583] SmoothWall Express update for kernel

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-09

SmoothWall has issued updated packages for the kernel. These fix two
vulnerabilities, which may disclose sensitive information to malicious,
local users or allow them to gain escalated privileges.

Full Advisory:
http://www.secunia.com/advisories/10583/

 --

[SA10582] Mandrake update for kernel

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-09

MandrakeSoft has issued updated packages for the kernel. These fix two
vulnerabilities, which may disclose sensitive information to malicious,
local users or allow them to gain escalated privileges.

Full Advisory:
http://www.secunia.com/advisories/10582/

 --

[SA10581] HP-UX update for ypxfrd

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-09

HP has issued patches for HP-UX, which fix an old vulnerability. This
can be exploited by malicious, local users to access arbitrary files on
a vulnerable system.

Full Advisory:
http://www.secunia.com/advisories/10581/

 --

[SA10580] HP-UX update for VirtualVault

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation, DoS
Released:    2004-01-09

HP has acknowledged some vulnerabilities in VirtualVault, which can be
exploited by malicious, local users to cause a DoS (Denial of Service)
or escalate their privileges.

Full Advisory:
http://www.secunia.com/advisories/10580/

 --

[SA10577] Debian update for vbox3

Critical:    Less critical
Where:       Local system
Impact:      Privilege escalation
Released:    2004-01-08

Debian has issued updated packages for vbox3. These fix a
vulnerability, which can be exploited by malicious, local users to gain
escalated privileges.

Full Advisory:
http://www.secunia.com/advisories/10577/

 --

[SA10613] Debian update for mod_auth_shadow

Critical:    Not critical
Where:       From remote
Impact:      Security Bypass
Released:    2004-01-13

Debian has issued updated packages for mod_auth_shadow. These fix a
security issue allowing expired accounts to authenticate.

Full Advisory:
http://www.secunia.com/advisories/10613/

 --

[SA10612] mod_auth_shadow Account Expiry Date Not Enforced

Critical:    Not critical
Where:       From remote
Impact:      Security Bypass
Released:    2004-01-13

David B. Harris has identified a problem in mod_auth_shadow, allowing
malicious people to log in using expired accounts.

Full Advisory:
http://www.secunia.com/advisories/10612/


Other:--

[SA10576] EDIMAX AR-6004 Broadband Router Cross-Site Scripting
Vulnerability

Critical:    Less critical
Where:       From remote
Impact:      Cross Site Scripting
Released:    2004-01-08

Rafel Ivgi has reported a vulnerability in EDIMAX AR-6004 Broadband
Router, which can be exploited by malicious people to conduct
cross-site scripting attacks.

Full Advisory:
http://www.secunia.com/advisories/10576/


Cross Platform:--

[SA10610] Cisco Multiple Products H.323 Protocol Denial of Service
Vulnerabilities

Critical:    Moderately critical
Where:       From remote
Impact:      DoS
Released:    2004-01-13

Multiple Cisco products contain vulnerabilities in the H.323 protocol
implementation, which can be exploited by malicious people to cause a
DoS (Denial of Service).

Full Advisory:
http://www.secunia.com/advisories/10610/

 --

[SA10607] BEA WebLogic JVM Denial of Service Vulnerability

Critical:    Moderately critical
Where:       From remote
Impact:      DoS
Released:    2004-01-13

BEA has issued an advisory regarding a vulnerability in JVM, which can
be exploited to crash BEA WebLogic Server and Express.

Full Advisory:
http://www.secunia.com/advisories/10607/

 --

[SA10602] PhpGedView Multiple Vulnerabilities

Critical:    Moderately critical
Where:       From remote
Impact:      Cross Site Scripting, Manipulation of data, Exposure of
system information
Released:    2004-01-13

JeiAr has reported multiple vulnerabilities in PhpGedView, allowing
malicious people to conduct cross-site scripting and SQL injection
attacks.

Full Advisory:
http://www.secunia.com/advisories/10602/

 --

[SA10595] SimpleData Access Restriction Bypass Vulnerability

Critical:    Moderately critical
Where:       From remote
Impact:      Security Bypass
Released:    2004-01-13

A vulnerability has been identified in SimpleData, which can be
exploited by malicious people to bypass certain security restrictions.

Full Advisory:
http://www.secunia.com/advisories/10595/

 --

[SA10594] Zope Multiple Denial of Service and Disclosure
Vulnerabilities

Critical:    Moderately critical
Where:       From remote
Impact:      Cross Site Scripting, Exposure of system information,
Exposure of sensitive information, DoS
Released:    2004-01-12

Multiple vulnerabilities have been reported in Zope, which can be
exploited by malicious users to cause a DoS (Denial of Service),
conduct cross-site scripting attacks or disclose various information.

Full Advisory:
http://www.secunia.com/advisories/10594/

 --

[SA10619] Helix Administrative Interface HTTP POST Request Denial of
Service

Critical:    Not critical
Where:       From local network
Impact:      DoS
Released:    2004-01-14

Matt Moore has reported a weakness in Helix, allowing malicious,
administrative users to cause a DoS (Denial of Service).

Full Advisory:
http://www.secunia.com/advisories/10619/

 --

[SA10606] BEA WebLogic Password Exposure Weakness

Critical:    Not critical
Where:       Local system
Impact:      Exposure of sensitive information
Released:    2004-01-13

BEA has reported a weakness in BEA WebLogic Server and Express allowing
malicious people to see a password when it is entered.

Full Advisory:
http://www.secunia.com/advisories/10606/



========================================================================

Secunia recommends that you verify all advisories you receive,
by clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only use
those supplied by the vendor.

Definitions: (Criticality, Where etc.)
http://www.secunia.com/about_secunia_advisories/

Subscribe:
http://www.secunia.com/secunia_weekly_summary/

Contact details:
Web     : http://www.secunia.com/
E-mail  : support () secunia com
Tel     : +45 70 20 51 44
Fax     : +45 70 20 51 45

========================================================================



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.