BSD Broadcast Address Filter Bypass

Network Security News – Friday, December 02, 2005 Events

BSD Broadcast Address Filter Bypass

Multiple BSD OSs contain a flaw that may allow a malicious attacker to bypass firewall rulesets. The issue is triggered when a packet is sent with a unicast link-layer address that contains an IP broadcast address. It is possible that the flaw may allow a TCP connection to a broadcast address resulting in a loss of integrity.. Read more at osvdb.org/5308

Microsoft IE window() Function Arbitrary Code Execution

Internet Explorer contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue occurs when the browser does not properly handle requests to the window() object. A remote attacker could create a malicious website that uses an onload event to initialize a window() object, which may cause Internet Explorer to crash or execute arbitrary code with the privileges of the person running it.. Read more at osvdb.org/17094

BSD Rogue Multiple Overflows

A local overflow exists in Rogue on multiple BSD OSs. The game fails to check bounds when reading the saved game file, resulting in a buffer overflow. With a specially crafted request, an attacker can obtain group "games" resulting in a loss of integrity.. Read more at osvdb.org/6098

OvBB profile.php userid Variable SQL Injection (Myth/Fake)

OvBB contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the profile.php script not properly sanitizing user-supplied input to the 'userid' variable.

Followup research along with vendor dispute indicates this issue can not be used to manipulate SQL queries. It is believed that non-numeric input may cause an SQL error giving the appearance of injection capability.. Read more at osvdb.org/21308

OvBB thread.php threadid Variable SQL Injection (Myth/Fake)

OvBB contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the thread.php script not properly sanitizing user-supplied input to the 'threadid' variable.

Followup research along with vendor dispute indicates this issue can not be used to manipulate SQL queries. It is believed that non-numeric input may cause an SQL error giving the appearance of injection capability.. Read more at osvdb.org/21307

MXChange Unspecified XSS

MXChange contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified variables upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.. Read more at osvdb.org/21338

MXChange Unspecified SQL Injection

MXChange contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to an unspecified script not properly sanitizing user-supplied input to an unspecified variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/21339

Lore article.php id Variable SQL Injection

Lore contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the article.php script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/21328

Omnistar KBase comments.php article_id Variable SQL Injection

OmniStar KBase contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the comments.php script not properly sanitizing user-supplied input to the 'article_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/21203

Omnistar KBase Express search.php search Variable SQL Injection

OmniStar KBase Express contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the search.php script not properly sanitizing user-supplied input to the 'search' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.. Read more at osvdb.org/21340

Vuln: Open Motif libUil Buffer Overflow Vulnerabilities

Open Motif libUil Buffer Overflow Vulnerabilities. Read more at securityfocus.com/bid/15678

Vuln: Cisco IOS HTTP Service HTML Injection Vulnerability

Cisco IOS HTTP Service HTML Injection Vulnerability. Read more at securityfocus.com/bid/15602

Vuln: Gallery Multiple Input Validation Vulnerabilities

Gallery Multiple Input Validation Vulnerabilities. Read more at securityfocus.com/bid/15614

Vuln: Drupal Submitted Content HTML Injection Vulnerability

Drupal Submitted Content HTML Injection Vulnerability. Read more at securityfocus.com/bid/15677

Edgewall Trac SQL Injection Vulnerability

Edgewall Trac SQL Injection Vulnerability. Read more at securityfocus.com/archive/1/418294

Re: DNS query spam

Re: DNS query spam. Read more at securityfocus.com/archive/1/418273

Sunbelt set to acquire Kerio Personal Firewall

Sunbelt set to acquire Kerio Personal Firewall. Read more at securityfocus.com/archive/1/418272

Re: WebCalendar Multiple Vulnerabilities

Re: WebCalendar Multiple Vulnerabilities. Read more at securityfocus.com/archive/1/418261