[security-alerts] FW: @RISK: The Consensus Security Vulnerability Alert Vol. 6 No. 32

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

>
>
> ********************************
> Widely Deployed Software
> ********************************
> **************************************************************
> ***********
>
> (4) HIGH: Ipswitch Internet Collaboration Suite Multiple
> Vulnerabilities
> Affected:
> Ipswitch Internet Collaboration Suite 2006
> Ipswitch IMail Premium 2006.21 and prior
>
> Description: Ipswitch IMail and Ipswitch Internet Collaboration Suite,
> a popular enterprise mail and collaboration system for Microsoft
> Windows, contain multiple vulnerabilities in its implementation of the
> IMAP "SEARCH" command. An overlong IMAP SEARCH command would allow an
> attacker to execute arbitrary code with the privileges of the
> vulnerable
> process (often SYSTEM). Note that attacker would require
> authentication
> to exploit these vulnerabilities.
>
> Status: Ipswitch has not confirmed, no updates available.
>
> Council Site Actions: The affected software and/or
> configuration is not
> in production or widespread use, or is not officially supported at any
> of the responding council sites. They reported that no action was
> necessary.
>
> References:
> Secunia Security Advisory
> http://secunia.com/advisories/26193/
> Vendor Home Page
> http://ipswitch.com/
> SecurityFocus BID
> http://www.securityfocus.com/bid/25176
>
> **************************************************************
> ***********
>
> (6) MODERATE: Mozilla Products Script Execution Vulnerability
> Affected:
> Mozilla products that have been patched for the MFSA 2007-20
> vulnerability
>
> Description: The Mozilla Firefox web browser, Thunderbird
> email client,
> and SeaMonkey internet suite, contain a flaw in their handling of
> certain URLs when an addon uses the "about:blank" page. A specially
> crafted webpage could exploit this vulnerability to execute arbitrary
> JavaScript with "chrome" privileges. These privileges are usually
> reserved for local JavaScript and involve the user interface. At the
> very least, attackers could use this vulnerability to alter the user
> interface (including spoofing the current location), in addition to
> other vulnerabilities. A proof-of-concept for this vulnerability is
> available, as are full technical details. Note that the exact
> nature of
> the vulnerability depends on the affected addon.
>
> Status: Mozilla confirmed, updates available. Note that this
> vulnerability was introduced by the patch for the MFSA 2007-20
> vulnerability.
>
> References:
> Mozilla Security Advisory
> http://www.mozilla.org/security/announce/2007/mfsa2007-26.html
> Mozilla Bug Entry
> https://bugzilla.mozilla.org/show_bug.cgi?id=388121
> Proof-of-Concept
> http://www.securityfocus.com/bid/25142/exploit
> SecurityFocus BID
> http://www.securityfocus.com/bid/25142
>
> **************************************************************
> ***********
>
>
> Part II - Comprehensive List of Newly Discovered Vulnerabilities from
> Qualys (www.qualys.com)
> Week 32, 2007
>
>
> 07.32.6 CVE: Not Available
> Platform: Third Party Windows Apps
> Title: Ipswitch IMail Server and Collaboration Suite (ICS) Multiple
> Buffer Overflow Vulnerabilities
> Description: Ipswitch IMail Server is an email server that serves
> clients their mail via a web interface. It runs on Microsoft Windows.
> The application is exposed to multiple buffer overflow issues because
> these applications fail to properly bounds check user-supplied input
> before copying it into an insufficiently sized memory buffer.
> Ipswitch Collaboration Suite (ICS) 2006, IMail Premium versions 2006.2
> and 2006.21 are affected.
> Ref: http://www.securityfocus.com/bid/25176
> ______________________________________________________________________
>
>
> 07.32.8 CVE: Not Available
> Platform: Third Party Windows Apps
> Title: ArgoSoft Mail Server MLSRVX.DLL Arbitrary File Overwrite
> Description: ArGoSoft Mail Server is a Windows-based mail server. The
> application is exposed to an arbitrary file overwrite issue that
> occurs in the "mlsrv.dll" ActiveX control with CLSID:
> 3F06B376-8DB8-49D1-8BF8-D4C070EFEBA5. ArGoSoft Mail Server version
> 1.8.9.1 is affected.
> Ref: http://www.securityfocus.com/bid/25105
> ______________________________________________________________________
>
> 07.32.36 CVE: CVE-2007-3844
> Platform: Cross Platform
> Title: Mozilla Firefox Chrome-Loaded About:Blank Script Execution
> Description: Mozilla Firefox is a browser available for multiple
> operating systems. The application is exposed to an issue that allows
> JavaScript to execute with unintended privileges. Firefox versions
> 2.0.0.5 and earlier are affected.
> Ref: http://www.mozilla.org/security/announce/2007/mfsa2007-26.html
> ______________________________________________________________________
>
> (c) 2007.  All rights reserved.  The information contained in this
> newsletter, including any external links, is provided "AS IS," with no
> express or implied warranty, for informational purposes only.  In some
> cases, copyright for material in this newsletter may be held by a
> party other than Qualys (as indicated herein) and permission to use
> such material must be requested from the copyright owner.
>