Packet Storm Security Last 100

07.09.08-1.txt - (Found July 15, 2008 )

iDefense Security Advisory 07.09.08 - Remote exploitation of a heap buffer overflow vulnerability in Novell Inc.'s eDirectory could allow an attacker to execute arbitrary code with the privileges of the affected service. The vulnerability exists due to an incorrect calculation when allocating a heap buffer to store the search parameters. By passing NULL search parameters, it is possible to overflow a heap based buffer with the string (null) . This can result in the corruption of heap...
http://packetstormsecurity.org/0807-advisories/07.09.08-1.txt

zonealarm-uhoh.txt - (Found July 15, 2008 )

Apparently, the latest auto update patch KB951748 (for all versions of Windows) cuts connectivity for all users with ZoneAlarm set to 'high' security for the internet zone.
http://packetstormsecurity.org/0807-advisories/zonealarm-uhoh.txt

ISVA-080709.1.txt - (Found July 15, 2008 )

Insomnia Security Vulnerability Advisory - Microsoft SQL Server contains a buffer overflow that can be reached by causing the server to attempt a database restore from a corrupt back file.
http://packetstormsecurity.org/0807-advisories/ISVA-080709.1.txt

poppler-poc.txt - (Found July 15, 2008 )

The libpoppler pdf rendering library can free uninitialized pointers leading to arbitrary code execution. This vulnerability results from memory management bugs in the Page class constructordestructor. Proof of concept code included.
http://packetstormsecurity.org/0807-exploits/poppler-poc.txt

coffeedc2008-cfb.txt - (Found July 15, 2008 )

Coffee Wars 9: Call For Beans - In addition to whatever other insanity flourishes at Defcon each year, the last eight years have been witness to the amazing and ridiculous contest known as CoffeeWars. This single ludicrous event is really two contests. The first, and most important, is the attempt to select the finest coffee from all of hacker culture. The second is the loopy part: to find the upper limit on how much coffee the staff can drink.
http://packetstormsecurity.org/papers/call_for/coffeedc2008-cfb.txt

fusil-0.9.tar.gz - (Found July 15, 2008 )

Fusil the fuzzer is a Python library used to write fuzzing programs. It helps to start process with a prepared environment (limit memory, environment variables, redirect stdout, etc.), start network client or server, and create mangled files. Fusil has many probes to detect program crash: watch process exit code, watch process stdout and syslog for text patterns (eg. segmentation fault ), watch session duration, watch cpu usage (process and system load), etc.
http://packetstormsecurity.org/libraries/fusil-0.9.tar.gz

MDVSA-2008-142.txt - (Found July 15, 2008 )

Mandriva Linux Security Advisory - Multiple vulnerabilities have been found in the Ruby interpreter and in Webrick, the webserver bundled with Ruby. Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash () path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1).%5c (encoded backslash) sequences or (2) filenames that match patterns in the..
http://packetstormsecurity.org/0807-advisories/MDVSA-2008-142.txt

MDVSA-2008-141.txt - (Found July 15, 2008 )

Mandriva Linux Security Advisory - Multiple vulnerabilities have been found in the Ruby interpreter and in Webrick, the webserver bundled with Ruby. Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash () path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1).%5c (encoded backslash) sequences or (2) filenames that match patterns in the..
http://packetstormsecurity.org/0807-advisories/MDVSA-2008-141.txt

MDVSA-2008-140.txt - (Found July 15, 2008 )

Mandriva Linux Security Advisory - Multiple vulnerabilities have been found in the Ruby interpreter and in Webrick, the webserver bundled with Ruby. Directory traversal vulnerability in WEBrick in Ruby 1.9.0 and earlier, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3). (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the...
http://packetstormsecurity.org/0807-advisories/MDVSA-2008-140.txt

MDVSA-2008-139.txt - (Found July 15, 2008 )

Mandriva Linux Security Advisory - A weakness was found in the DNS protocol by Dan Kaminsky. A remote attacker could exploit this weakness to spoof DNS entries and poison DNS caches. This could be used to misdirect users and services; i.e. for web and email traffic. This update provides the latest stable BIND releases for all platforms except Corporate ServerDesktop 3.0 and MNF2, which have been patched to correct the issue.
http://packetstormsecurity.org/0807-advisories/MDVSA-2008-139.txt