psoTFX reports :

phpBB Group are pleased to announce the release of phpBB 2.0.12 the 'Horray for Furrywood' release. This release addresses a number of bugs and a couple of potential exploits. [...] one of the potential exploits addressed in this release could be serious in certain situations and thus we urge all users, as always, to upgrade to this release as soon as possible. Mostly this release is concerned with eliminating disclosures of information which while useful in debug situations may allow third parties to gain information which could be used to do harm via unknown or unfixed exploits in this or other applications.

The ChangeLog for phpBB 2.0.12 states :

- Prevented full path display on critical messages

- Fixed full path disclosure in username handling caused by a PHP 4.3.10 bug - AnthraX101

- Added exclude list to unsetting globals (if register_globals is on)
- SpoofedExistence

- Fixed arbitrary file disclosure vulnerability in avatar handling functions - AnthraX101

- Fixed arbitrary file unlink vulnerability in avatar handling functions - AnthraX101

- Fixed path disclosure bug in search.php caused by a PHP 4.3.10 bug (related to AnthraX101's discovery)

- Fixed path disclosure bug in viewtopic.php caused by a PHP 4.3.10 bug - matrix_killer

A Red Hat advisory reports :

Oleksandr Byelkin discovered that 'ALTER TABLE ... RENAME' checked the CREATE/INSERT rights of the old table instead of the new one.

Table access restrictions, on the affected MySQL servers, may accidentally or intentionally be bypassed due to this bug.

The following package needs to be updated: dropbear

The following package needs to be updated: gallery

Sverre H. Huseby discovered a vulnerability in Adobe Acrobat and Adobe Reader. Under certain circumstances, using XML scripts it is possible to discover the existence of local files.

The following package needs to be updated: isc-dhcp3

An NGSSoftware Insight Security Research Advisory reports :

Two vulnerabilities have been discovered in RealPlayer which may potentially be leveraged to allow remote code execution, or may used in combination with the Real Metadata Package File Deletion vulnerability to reliably delete files from a users system.

When a user is granted access to a database with a name containing an underscore and the underscore is not escaped then that user might also be able to access other, similarly named, databases on the affected system.

The problem is that the underscore is seen as a wildcard by MySQL and therefore it is possible that an admin might accidentally GRANT a user access to multiple databases.

The eqn2graph and pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files.

A Debian Security Advisory reports :

Ulf Harnhammar from the Debian Security Audit Project discovered a buffer overflow in axel, a light download accelerator. When reading remote input the program did not check if a part of the input can overflow a buffer and maybe trigger the execution of arbitrary code.

The following package needs to be updated: cvstrac

The remote host is running a version of FreeBSD which contains a flaw in the sendfile() API.

There is an error in the sendfile() API which may allow a local user to disclose parts of the contents of the kernel memory.

The remote host is running a version of FreeBSD which contains a flaw in the 'fetch' utility.

'fetch' is a command-line tool used to retrieve data at a given URL. It is used (among others) by the FreeBSD port collection.

There is an integer overflow condition in the processing of HTTP headers which may result in a buffer overflow.

An attacker may exploit this flaw to execute arbitrary commands on the remote host. To exploit this flaw, an attacker would need to lure a victim on the remote host into downloading a URL from a malicious web server using this utility.

The remote host has the following package installed :
	0.8.0 <= freeradius < 1.0.1


The remote version of this software is vulnerable to a flaw which may allow an attacker to disable this service remotely.

The remote host is running a version of FreeBSD which contains a flaw in the syscons console driver.

There are boundary errors in the CONS_SCRSHOT ioctls that may allow a local attacker to read portions of the kernel memory, which may contain sensitive information.

Marcus Meissner discovered that ImageMagick's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability.

The following package needs to be updated: nss

According to the SpamAssassin 2.64 release announcement :

Security fix prevents a denial of service attack open to certain malformed messages; this DoS affects all SpamAssassin 2.5x and 2.6x versions to date.

The issue appears to be triggered by overly long message headers.

Qt contains several vulnerabilities related to image loading, including possible crashes when loading corrupt GIF, BMP, or JPEG images. Most seriously, Chris Evans reports that the BMP crash is actually due to a heap buffer overflow. It is believed that an attacker may be able to construct a BMP image that could cause a Qt-using application to execute arbitrary code when it is loaded.

According to a Debian Security Advisory :

Andres Salomon noticed a problem in the CGI session management of Ruby, an object-oriented scripting language. CGI::Session's FileStore (and presumably PStore [...]) implementations store session information insecurely. They simply create files, ignoring permission issues. This can lead an attacker who has also shell access to the webserver to take over a session.

An iDEFENSE security advisory reports :

Remote exploitation of an input validation error in the uudecoding feature of Adobe Acrobat Reader (Unix) 5.0 allows an attacker to execute arbitrary code.

The Unix and Linux versions of Adobe Acrobat Reader 5.0 automatically attempt to convert uuencoded documents back into their original format. The vulnerability specifically exists in the failure of Acrobat Reader to check for the backtick shell metacharacter in the filename before executing a command with a shell. This allows a maliciously constructed filename to execute arbitrary programs.

SSLtelnet contains a format string vulnerability that could allow remote code execution and privilege escalation.

The remote host is running a version of the FreeBSD kernel which may be contains a programming error in the shmat(2) system call which can let a local attacker to gain read or write access to a portion of the kernel memory which in turn might be used to elevate his privileges or gain access to sensitive information.

The remote host is running a version of FreeBSD 5.2 older than FreeBSD 5.2.1-p4

There is a programming error in the version of this kernel which may allow a local attacker to read portions of the kernel memory or to cause a system panic by misusing the setsockopt() system call on IPv6 sockets.

The remote host is running a version of the FreeBSD kernel which may be vulnerable to a remote denial of service attack when processing many out of sequence TCP packets.

A remotely exploitable heap buffer overflow vulnerability was found in MPlayer's URL decoding code. If an attacker can cause MPlayer to visit a specially crafted URL, arbitrary code execution with the privileges of the user running MPlayer may occur. A `visit' might be caused by social engineering, or a malicious web server could use HTTP redirects which MPlayer would then process.

The remote host is running a version of FreeBSD which contains a bug in the mksnap_ffs(8) utility which may reset file flags on the remote file system, thus resetting the type of access control that were assigned to a file.

The remote host is running a version of the FreeBSD kernel which contains a programming error in the way it handles some Linux system calls, which may be exploited by an attacker to gain super-user privileges on the remote host, or to crash it.

The remote host is running a version of the FreeBSD kernel which contains a bug which may allow a jailed process to attach to another jail.

An attacker compromised a jailed process on the remote host could exploit this flaw to switch to other jails on the system.

The remote host is running a version of the FreeBSD kernel which contains a bug which may allow a jailed process to modify the host routing tables of the whole system.

The remote host is running a version of FreeBSD which contains a heap overflow in the cvs pserver code. This flaw may be used by an attacker to execute arbitrary code on the remote host, provided that it's running a cvs pserver.

The remote host is running a version of FreeBSD which contains a programming error in the msync(2) system call which may let a local user with read access to a given file to forbid any change to this file to be written to disk.

ID	Name	Severity
18824	FreeBSD : phpbb -- multiple information disclosure vulnerabilities (03653079-8594-11d9-afa0-003048705d5a)	high
18823	FreeBSD : mysql -- erroneous access restrictions applied to table renames (035d17b2-484a-11d9-813c-00065be4b5b6)	high
18822	FreeBSD : dropbear (1291)	high
18821	FreeBSD : gallery (1290)	high
18820	FreeBSD : acroread -- XML External Entity vulnerability (02bc9b7c-e019-11d9-a8bd-000cf18bbe54)	medium
18819	FreeBSD : isc-dhcp3 (1286)	high
18818	FreeBSD : realplayer -- arbitrary file deletion and other vulnerabilities (02274fd9-6bc5-11d9-8edb-000a95bc6fae)	high
18817	FreeBSD : mysql -- GRANT access restriction problem (01c231cd-4393-11d9-8bb9-00065be4b5b6)	medium
18816	FreeBSD : groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files (01bb84e2-bd88-11d9-a281-02e018374e71)	low
18815	FreeBSD : axel -- remote buffer overflow (0163b498-af54-11d9-acd0-000854d03344)	high
18814	FreeBSD : cvstrac (1276)	high
17984	FreeBSD : SA-05:02.sendfile	critical
15761	FreeBSD : SA-04:16.fetch	critical
15500	FreeBSD Ports : FreeRADIUS < 1.0.1	medium
15419	FreeBSD : SA-04:15.syscons	medium
14588	FreeBSD : ImageMagick -- BMP decoder buffer overflow (b6cad7f3-fb59-11d8-9837-000c41e2cdad)	high
14440	FreeBSD : nss -- exploitable buffer overflow in SSLv2 protocol handler (129)	high
14345	FreeBSD : SpamAssassin -- denial-of-service in tokenize_headers (0d3a5148-f512-11d8-9837-000c41e2cdad)	medium
14340	FreeBSD : qt -- image loader vulnerabilities (ebffe27a-f48c-11d8-9837-000c41e2cdad)	high
14280	FreeBSD : Ruby insecure file permissions in the CGI session management (e811aaf1-f015-11d8-876f-00902714cc7c)	low
14266	FreeBSD : acroread uudecoder input validation error (78348ea2-ec91-11d8-b913-000c41e2cdad)	critical
12617	FreeBSD : Format string vulnerability in SSLtelnet (4aec9d58-ce7b-11d8-858d-000d610a3b12)	critical
12614	FreeBSD : SA-04:02.shmat	medium
12613	FreeBSD : SA-04:06.ipv6 : setsockopt()	low
12589	FreeBSD : SA-04:04.tcp	medium
12581	FreeBSD : mplayer heap overflow in http requests (5e7f58c3-b3f8-4258-aeb8-795e5e940ff8)	high
12575	FreeBSD : SA-04:01.mksnap_ff	medium
12566	FreeBSD : SA-04:13.linux	low
12556	FreeBSD : SA-04:03.jail	medium
12555	FreeBSD : SA-04:12.jailroute	high
12530	FreeBSD : SA-04:10.cvs	high
12527	FreeBSD : SA-04:11.msync	low

Detections

Analytics

FreeBSD Local Security Checks Family for Nessus

high

high

high

high

medium

high

high

medium

low

high

high

critical

critical

medium

medium

high

high

medium

high

low

critical

critical

medium

low

medium

high

medium

low

medium

high

high

low