[security-alerts] FW: @RISK: The Consensus Security Vulnerability Alert Vol. 5 No. 10

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> ************************************************************
> 
> (2) MODERATE: L-Soft Listserv Remote Code Execution
> Affected:
> LISTSERV version 14.4 and 14.3, including LISTSERV Lite and HPO
> 
> Description: LISTSERV is a popular email management software that can
> be used to manage email newsletters, discussion groups or announcement
> lists. The LISTSERV web interface that allows remote web management of
> the mailing lists contains flaws that may be exploited to execute
> arbitrary code on the server running the LISTSERV software. The
> discoverers will post the complete technical details on June 3, 2006.
> 
> Status: L-Soft has released version 14.5 to fix the flaws.
> 
> Council Site Actions: The affected software and/or 
> configuration are not
> in production or widespread use, or are not officially 
> supported at any
> of the council sites. They reported that no action was necessary.
> 
> References:
> Posting by NGSSoftware
> http://www.securityfocus.com/archive/1/426770/30/90/threaded 
> LISTSERV Homepage
> http://www.lsoft.com/products/listserv.asp 
> SecurityFocus BID 
> Not available yet.
> 
> ****************************************************************
> 
> (3) MODERATE: Microsoft Visual Studio Overflow
> Affected:
> Microsoft Visual Studio version 6.0
> Microsoft Development Environment version 6.0 (SP6)
> 
> Description: Microsoft Visual Studio, a development tool for Windows
> applications, reportedly contains a stack-based overflow. The overflow
> can be triggered by a ".dbp" (database project) or ".sln" 
> (visual studio
> solution) file containing a long "DataProject" name. A malicious
> webpage, email or a file share can exploit this flaw to execute
> arbitrary code on a developer's system. Exploit code has been publicly
> posted. Note that ".dbp" and ".sln" files are not opened 
> automatically.
> 
> Status: Microsoft is aware of the issue, no patches available yet.
> Developers should be cautioned not to open ".dbp" or ".sln" files
> delivered via web or HTTP from untrusted sources.
> 
> References:
> Posting by AtmaCA
> http://www.spyinstructors.com/show.php?name=Advisories&pa=show
> page&pid=73 
> Exploit Code
> http://www.frsirt.com/exploits/20060305.ms-visual-dbp.c.php 
> Product Homepage
> http://msdn.microsoft.com/vstudio/ 
> SecurityFocus BID
> http://www.securityfocus.com/bid/16953 
> 
> **********************************************************************
> 
> **************
> Exploits
> **************
> 
> (5)LibTIFF TIFFOpen Buffer Overflow Vulnerability
> 
> Council Site Actions: The affected software and/or 
> configuration are not
> in production or widespread use, or are not officially 
> supported at any
> of the council sites. Most of the council sites reported that 
> no action
> was necessary.  One site will distribute patches to their small number
> of affected hosts during their next regularly scheduled system update
> process.
> 
> References:
> Exploit Code
> http://www.frsirt.com/exploits/20060305.libtiff_exploit.c.php  
> Previous @RISK Newsletter Posting
> http://www.sans.org/newsletters/risk/display.php?v=4&i=19#05.19.26  
> 
> ______________________________________________________________________
> 06.10.1 CVE: CVE-2006-1043
> Platform: Other Microsoft Products
> Title: Microsoft Visual Studio  Buffer Overflow
> Description: Microsoft Visual Studio is a development tool. It is
> vulnerable to a buffer overflow when a malicious file contains a
> "DataProject" field of 384 bytes. Microsoft Visual Studio version 6 is
> vulnerable.
> Ref: http://www.securityfocus.com/archive/1/426767
> ______________________________________________________________________
> 
> 06.10.2 CVE: Not Available
> Platform: Other Microsoft Products
> Title: Internet Explorer Java Applet Handling Denial of Service
> Description: Microsoft Internet Explorer is affected by a denial of
> service with the "mshtml.dll" library when dereferencing a NULL
> pointer. This issue occurs when Sun's Java runtime environment is
> installed and configured to be the default handler for Java applets.
> Microsoft Internet Explorer versions 6.0 SP2 and earlier are
> vulnerable.
> Ref: http://www.securityfocus.com/archive/1/426817
> ______________________________________________________________________
> 
> 06.10.10 CVE: CVE-2006-1091
> Platform: Linux
> Title: Kaspersky Anti-Virus Unspecified Denial Of Service
> Description: Kaspersky Anti-Virus is vulnerable to a denial of service
> issue when the application scans a file of 1.6 MB in size that does
> not contain suspicious or obviously malicious content. Kaspersky
> Anti-Virus versions 5.0.5 and 5.5.3 for Unix are vulnerable.
> Ref: http://www.securityfocus.com/archive/1/426699
> ______________________________________________________________________
> ______________________________________________________________________
> 
> 06.10.12 CVE: CVE-2006-0742
> Platform: Linux
> Title: Linux Kernel die_if_kernel Local Denial of Service
> Description: The Linux kernel is prone to a local denial of service
> vulnerability. This issue is due to a design error in the
> "die_if_kernel()" function. This issue affects Linux kernel versions
> prior to 2.6.15.6 running on Itanium systems.
> Ref: http://www.securityfocus.com/bid/16993
> ______________________________________________________________________
> 
> 06.10.18 CVE: Not Available
> Platform: Cross Platform
> Title: L-Soft Listserv 14.3 and 14.4 Multiple Unspecified
> Vulnerabilities
> Description: Listserv is a multi-platform application used to manage
> mailing lists. It is affected by multiple unspecified vulnerabilities.
> Listserv versions 14.3 and 14.4 are affected.
> Ref: http://www.securityfocus.com/bid/16951
> ______________________________________________________________________
> 
> 06.10.29 CVE: CVE-2006-0742
> Platform: Cross Platform
> Title: Kerio MailServer Remote Denial of Service
> Description: Kerio MailServer is vulnerable to a denial of service
> issue when the server handles specially crafted IMAP LOGIN commands.
> Kerio MailServer versions 6.1.3 and earlier are vulnerable.
> Ref: http://www.kerio.com/kms_history.html
> ______________________________________________________________________
> 
> 06.10.30 CVE: Not Available
> Platform: Cross Platform
> Title: UnrealIRCd Remote Denial Of Service
> Description: UnrealIRCd is an Internet Relay Chat (IRC) server. It is
> vulnerable to a remote denial of service issue due to a design error
> when handling malformed "TKL" commands from authenticated connections.
> UnrealIRCd versions 3.2.3 and earlier are vulnerable.
> Ref: http://www.securityfocus.com/archive/1/427213
> ______________________________________________________________________
> 
> 06.10.31 CVE: CVE-2006-0049
> Platform: Cross Platform
> Title: GnuPG Incorrect Non-Detached Signature Verification
> Description: GnuPG is prone to a vulnerability involving incorrect
> verification of non-detached signatures. This issue can allow
> attackers to inject arbitrary data into a signed message. It should be
> noted that this issue also affects verification of signatures embedded
> in encrypted messages. Scripts and applications using gpg are affected
> as well as applications using the GPGME library. GnuPG versions prior
> to 1.4.2.2 are vulnerable.
> Ref: 
> http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html
> ______________________________________________________________________
>