Summary of Security Items from April 13 through April 19, 2005
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores.
Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
- High: vulnerabilities with a CVSS base score of 7.0–10.0
- Medium: vulnerabilities with a CVSS base score of 4.0–6.9
- Low: vulnerabilities with a CVSS base score of 0.0–3.9
Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.
Information
in the US-CERT Cyber Security Bulletin is a compilation and includes information
published by outside sources, so the information should not be considered the
result of US-CERT analysis. Software vulnerabilities are categorized in the
appropriate section reflecting the operating system on which the vulnerability
was reported; however, this does not mean that the vulnerability only affects
the operating system reported since this information is obtained from
open-source information.
This bulletin
provides a summary of new or updated vulnerabilities, exploits, trends, viruses,
and trojans. Updates to vulnerabilities that
appeared in previous bulletins are listed in bold
text. The text in the Risk column appears in red for vulnerabilities
ranking High. The risks levels applied to
vulnerabilities in the Cyber Security Bulletin are based on how the "system" may
be impacted. The Recent Exploit/Technique table contains a "Workaround or Patch
Available" column that indicates whether a workaround or patch has been
published for the vulnerability which the script exploits.
name=vulns> face="Arial, Helvetica, sans-serif">Vulnerabilities
class=style46>The table belowsummarizes vulnerabilities that have been identified, even if they are not being
exploited. Complete details about patches or workarounds are available from the
source of the information or from the URL provided in the section. CVE numbers
are listed where applicable. Vulnerabilities that affect both
Windows and Unix Operating Systems are included in the Multiple
Operating Systems section.
Note: All the information included in the following tables
has been discussed in newsgroups and on web sites.
The Risk levels
defined below are based on how the system may be impacted:
- High - A
high-risk vulnerability is defined as one that will allow an intruder to
immediately gain privileged access (e.g., sysadmin or root) to the system or
allow an intruder to execute code or alter arbitrary system files. An example
of a high-risk vulnerability is one that allows an unauthorized user to send a
sequence of instructions to a machine and the machine responds with a command
prompt with administrator privileges. - Medium - A
medium-risk vulnerability is defined as one that will allow an intruder
immediate access to a system with less than privileged access. Such
vulnerability will allow the intruder the opportunity to continue the attempt
to gain privileged access. An example of medium-risk vulnerability is a server
configuration error that allows an intruder to capture the password
file. - Low - A
low-risk vulnerability is defined as one that will provide information to an
intruder that could lead to further compromise attempts or a Denial of Service
(DoS) attack. It should be noted that while the DoS attack is deemed low from
a threat potential, the frequency of this type of attack is very high. DoS
attacks against mission-critical nodes are not included in this rating and any
attack of this nature should instead be considered to be a "High"
threat.
Vendor & Software Name | Vulnerability - Impact Patches - Workarounds Attacks Scripts | Common Name / CVE Reference |
face="Arial, Helvetica, sans-serif">Risk |
face="Arial, Helvetica, sans-serif">Source |
QuickTime for Windows 6.5.2 | A buffer overflow vulnerability has been reported that could let remote No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Low | BUGTRAQ:20050413, April 13, 2005 | |
ACNews 1.0 | An input validation vulnerability has been reported that could let a No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | High | Security Tracker Alert ID: 1013681, April 12, 2005 | |
Centra 7 | A vulnerability has been reported that could let a remote malicious No workaround or patch available at time of publishing. Currently we are not aware of any exploits for this | High | Secunia SA14930, April 13, 2005 | |
Comersus 4.x | An input validation vulnerability has been reported in the 'curPage' Version 6 is reportedly not affected. A Proof of Concept exploit has been published. | Comersus Cross-Site Scripting Vulnerability | High | OSVDB Reference: 15539, April 12, 2005 |
DameWare 4.9 and prior - NT Utilities and MiniRemote Control | A vulnerability has been reported that could let a local malicious user No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Medium | Security Tracker Alert ID: 1013725, April 15, 2005 | |
WebcamXP 2.16.468 and prior | Multiple vulnerabilities have been reported in which a remote malicious A fixed version (2.16.478) is available at: href="http://webcamxp.com">http://webcamxp.com A Proof of Concept exploit has been published. | exploitlabs WebcamXP User Redirection and Denial of | Low | Security Tracker Alert ID: 1013753, April 18, 2005 |
Internet Security Suite 2005 | A file permission vulnerability has been reported that could let a Updates are available through Automatic Update feature. A Proof of Concept exploit has been published. | McAfee Internet Security Suite Elevated Privilege href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1107">CAN-2005-1107 | Medium | iDEFENSE Security Advisory 04.18.05 |
Exchange 2000 Server SP3, 2003, 2003 SP1 | A vulnerability has been reported due to an unchecked buffer in the V1.1: Bulletin updated to reflect a revised "Security Update Updates available:
href="http://www.microsoft.com/technet/security/Bulletin/MS05-021.mspx"> Currently we are not aware of any exploits for this | High | Microsoft Security
href="http://www.us-cert.gov/cas/techalerts/TA05-102A.html">Technical Microsoft Security | |
Internet Explorer 5.01, 5.5, 6 | Multiple vulnerabilities have been reported that include DHTML Object Updates available:
href="http://www.microsoft.com/technet/security/Bulletin/MS05-020.mspx"> An exploit script has been published. | Microsoft Internet Explorer Remote Code Execution Vulnerability
href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0553">CAN-2005-0553 | High | Microsoft Security Bulletin MS05-020, April 12, 2005
href="http://www.us-cert.gov/cas/techalerts/TA05-102A.html">Technical href="http://www.kb.cert.org/vuls/id/222050">US-CERT VU#222050 href="http://www.kb.cert.org/vuls/id/756122"> Security Focus, 13120, April 12, 2005 |
Microsoft Windows 2000 Avaya DefinityOne Media Servers, IP600 Media Servers, S3400 Message | Microsoft Windows Explorer is prone to a script injection No vendor workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Microsoft Windows Explorer Preview Pane Script Injection | High | Security Focus Bugtraq ID 13248, April 19, 2005 |
Windows 2000 SP 3 and SP4 Windows XP SP 1 and SP2 Windows XP 64-Bit Edition SP1 and 2003 (Itanium) Windows Server 2003 Windows Server 2003 for Itanium-based Systems Windows 98, Windows 98 SE, and Windows ME | Multiple vulnerabilities have been reported that include IP Validation, Updates available: A Proof of Concept exploit has been published. | Microsoft Windows TCP/IP Remote Code Execution and Denial of Service
href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0048">CAN-2005-0048 | Low/ High (High if arbitrary code can be | Microsoft Security Bulletin MS05-019, April 12, 2005
href="http://www.us-cert.gov/cas/techalerts/TA05-102A.html">Technical |
Windows 2000 SP 3 and SP4 Windows XP SP1 Windows XP 64-Bit Edition SP1 Windows 98 and 98 SE | A buffer overflow vulnerability has been reported that could let a V1.1: Bulletin updated to reflect an updated Updates available:
href="http://www.microsoft.com/technet/security/Bulletin/MS05-017.mspx"> Currently we are not aware of any exploits for this | High | Microsoft Security Bulletin MS05-017, April 12, 2005 Microsoft Security Bulletin MS05-017 V1.1, April 14, 2005 | |
Windows 2000 SP3 and SP4 Windows XP SP1 and SP2 Windows XP 64-Bit Edition SP 1 and 2003 (Itanium) Windows Server 2003 Windows Server 2003 for Itanium-based Systems Windows 98, 98 SE, ME | A vulnerability has been reported that could let a remote malicious Updates available:
href="http://www.microsoft.com/technet/security/Bulletin/MS05-016.mspx "> Exploit scripts have been published. | Microsoft Windows Shell Remote Code Execution href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0063">CAN-2005-0063 | High | Microsoft Security Bulletin MS05-016, April 12, 2005 Security Focus, 13132, April 13, 2005 |
Windows 2000 SP3 and SP4 Windows XP SP1 and SP2 Windows XP 64-Bit Edition SP1 and 2003 (Itanium) Windows Server 2003 Windows Server 2003 for Itanium-based Systems Windows 98, 98 SE, and ME | Multiple vulnerabilities have been reported that include errors in the Updates available:
href="http://www.microsoft.com/technet/security/Bulletin/MS05-018.mspx">h Currently we are not aware of any exploits for these | Microsoft Windows Kernel Elevation of Privilege and Denial of Service
href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0060">CAN-2005-0060 | Low/ Medium (Medium if elevated privileges can be obtained) | Microsoft Security Bulletin MS05-018, April 12, 2005
href="http://www.kb.cert.org/vuls/id/259197">US-CERT |
Windows NT Server 4.0 SP6a, Windows NT Server 4.0 Terminal Avaya DefinityOne Media Servers; Avaya IP600 Media Servers; Avaya S3400 | A buffer overflow vulnerability exists in the License Logging service Patches available at:
href="http://www.microsoft.com/technet/security/bulletin/MS05-007.mspx"> A Proof of Concept exploit has been published. V 1.2: Bulletin updated to reflect a revised | Low/ class=highrisk>High (High if arbitrary code can be | Microsoft Security Bulletin, MS05-010, February 8, 2005 US-CERT US-CERT Security Focus, Bugtraq ID 12481, April 12, 2005 Microsoft Security Bulletin, MS05-010 V1.2, February 8, | |
Word 2000, 2002 Works Suite 2001, 2002, 2003, and 2004 Office Word 2003 | A buffer overflow vulnerability has been reported that could lead to V1.1 Bulletin updated to point to the correct Exchange 2000 Currently we are not aware of any exploits for this | Microsoft Word Remote Code Execution and Escalation of
href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0963">CAN-2004-0963 | High | Microsoft Security Bulletin MS05-023, April 12, 2005 Microsoft Security Bulletin MS05-023 V1.1, April 14, |
Jukebox 10.00.2047 and prior | Multiple vulnerabilities have been reported that could let a local The vendor has released a fixed version at:
href="http://www.musicmatch.com/download/free/security.htm">http://www.musicmatch.com Currently we are not aware of any exploits for these | High | Hyperdose Security Advisories H2005-04 and H2005-05 | |
RUMBA 7.3, 7.4 | Multiple buffer overflow vulnerabilities have been reported when RTO No workaround or patch available at time of publishing. Proofs of Concept exploits have been published. | Low/ High (High if arbitrary code can be executed) | Security Focus, Bugtraq, 395705, April 13, 2005 | |
OneWorldStore | Multiple vulnerabilities have been reported that could let a remote No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | High | Dcrab 's Security Advisory, April 14, 2005 | |
| PMSoftware Simple Web Server 1.0.15 | A buffer overflow vulnerability has been reported that could let a No workaround or patch available at time of publishing. A Proof of Concept exploit script has been published. | Low/ High (High if arbitrary code can be executed) | Secunia SA15000, April 19, 2005 | |
RSA Authentication Agent for Web for IIS 5.2 | A vulnerability has been reported that could let remote malicious users Update to version 5.3:
href="http://www.rsasecurity.com/node.asp?id=2807&node_id="> A Proof of Concept exploit has been published. | High | Secunia SA14954, April 15, 2005 | |
Sun Java System Web Server (Sun ONE/iPlanet) 6.0 SP7 | A vulnerability has been reported that could let remote users cause a Update to Sun Java System Web Server 6.0 Service Pack 8 or later:
href="http://wwws.sun.com/software/download/products/40968fe6.html"> Currently we are not aware of any exploits for this | Low | Sun Alert ID: 57760, April 13, 2005 | |
WinHex 12.05 SR-14 | A vulnerability has been reported that could let a malicious user cause No workaround or patch available at time of publishing. Currently we are not aware of any exploits for this | Low | Security Tracker Alert ID: 1013727, April 15, 2005 | |
Yager 5.24 and prior | Multiple vulnerabilities have been reported that could let a remote No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Yager Denial of Service and Remote Code Execution Vulnerabilities
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1163">CAN-2005-1163 | Low/ High (High if arbitrary code can be executed) | Luigi Auriemma, April 14, 2005 |
[back to
top]
size=-2>
|
id=other name=other>Multiple Operating Systems - Windows / UNIX / Linux / Other | ||||
Vendor & Software Name | Vulnerability - Impact Patches - Workarounds Attacks Scripts | Common Name / CVE Reference |
face="Arial, Helvetica, sans-serif">Risk |
face="Arial, Helvetica, sans-serif">Source |
All4WWW-Homepagecreator 1.0 a | A vulnerability has been reported in 'index.php' due to insufficient sanitization of the 'site' parameter, which could let a remote malicious user execute arbitrary code. No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit | High | Secunia Advisory: SA14972, April 15, 2005 | |
CMS 2.4 | A vulnerability has been reported in the 'loader.php' file because the 'configs/ariadne.phtml' and 'configs/store.phtml' files are included relative to the 'araidne' variable without proper validation of the user-supplied variable, which could let a remote malicious user execute arbitrary code. No workaround or patch available at time of publishing. There is no exploit code required. | High | Security Tracker Alert,1013721, April 15, 2005 | |
Image Cropper/Resizer 52 | A Cross-Site Scripting vulnerability has been reported in the 'image-editor-52' script due to insufficient validation of the several variables, which could let a remote malicious user execute arbitrary HTML and script code. No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | CityPost Image Cropper/Resizer Cross-Site Scripting | High | sNKenjoi's Security Advisory, April 18, 2005 |
LNKX 52 | A Cross-Site Scripting vulnerability has been reported in thee 'message.php' script due to insufficient validation of the 'msg' parameter, which could let a remote malicious user execute arbitrary HTML and script code. No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | CityPost PHP LNKX Cross-Site Scripting | High | sNKenjoi's Security Advisory, April 18, 2005 |
Simple PHP Upload 53 | A Cross-Site Scripting vulnerability has been reported in the 'simple-upload-53.php' script due to insufficient validation of the 'message' parameter, which could let a remote malicious user execute arbitrary HTML and script code. No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | CityPost Simple PHP Upload Cross-Site Scripting | High | sNKenjoi's Security Advisory, April 18, 2005 |
BrightStor ARCServe Backup for Windows 9.0.1, 11.0, 11.1, 11.1 (All), | A buffer overflow vulnerability has been reported in the 'option' field Updates available at: An exploit script has been published. | Low/ High (High if arbitrary code can be executed) | iDEFENSE Security Advisory, Security Focus, 13102, April 13, 2005 | |
Datenbank Module for phpbb | Several vulnerabilities have been reported; a vulnerability has been reported in 'Mod.php' due to insufficient sanitization, which could let a remote malicious user execute arbitrary SQL code; and a Cross-Site Scripting vulnerability has been reported in 'Mod.php' due to insufficient sanitization of user-supplied input, which could let a remote malicious user execute arbitrary HTML and script code. No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit | High | Bugtraq, 396048, April 16, 2005 | |
eGroupWare 1.0.1, 1.0.6 | A vulnerability has been reported because when an email with an attachment is composed, but not sent, then the attachment is sent to the next person the user emails, which could let a malicious user obtain sensitive information. No workaround or patch available at time of publishing. There is no exploit code required. | Medium | Secunia Advisory, SA14940, April 13, 2005 | |
eGroupWare 1.0-1.0.3, 1.0.6 | Multiple unspecified vulnerabilities have been fixed in the latest Upgrades available at: Currently we are not aware of any exploits for these | eGroupWare Multiple Vulnerabilities | Not Specified | Security Focus, 13213, April 18, 2005 |
BigIP 9.0.2-9.0.4 | An undisclosed vulnerability has been reported in the F5 BIG-IP user interface when a user is simultaneously logged into the web user interface with multiple clients. The impact was not specified. Update available at:
href="http://tech.f5.com/home/bigip-next/solutions/gui/sol4369.html "> There is no exploit code required. | F5 BIG-IP User Interface | Not Specified | Security Focus,13240, April 19, 2005 |
PHP-Nuke 7.6 | An HTTP response splitting vulnerability has been reported due to insufficient sanitization of the 'forwarder' parameter, which could let a remote malicious user execute arbitrary HTML and script code. No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit | High | Dcrab 's Security Advisory, April 16, 2005 | |
GOCR Optical Character Recognition Utility 0.3.2, 0.3.4, 0.37, 0.39, | Several vulnerabilities have been reported: an integer overflow vulnerability was reported in the 'readpgm()' function that uses netpbm library when reading a specially crafted PNM, which could let a remote malicious user execute arbitrary code; and a buffer overflow vulnerability was reported in the 'readpgm()' function that doesn't use the netpbm library when reading a specially crafted PNM, which could let a remote malicious user execute arbitrary code. No workaround or patch available at time of publishing. Currently we are not aware of any exploits for this | High | Overflow.pl Security Advisory #1, April 15, 2005 | |
Coppermine Photo Gallery 1.0 RC3, 1.1 beta 2, 1.1 .0, 1.2, 1.2.1, 1.2.2 | A vulnerability has been reported in the 'include/init.inc.php' script due to insufficient sanitization of user-supplied input before written in log files, which could let a remote malicious user execute arbitrary HTML and script code. No workaround or patch available at time of publishing. There is no exploit code required. | High | Bugtraq, 396080, April 18, 2005 | |
iSeries AS400 | A vulnerability has been reported in the POP3 service during authentication, which could let a remote malicious user obtain sensitive information. No workaround or patch available at time of publishing. There is no exploit code required. | Medium | Securiteam, April 17, 2005 | |
Lotus Domino 6.0-6.0.3, 6.5.0-6.5.3 | A buffer overflow vulnerability has been reported due to the way Upgrade information available at:
href="http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21202431"> Currently we are not aware of any exploits for this | Low/ High (High if arbitrary code can be executed) | Next Generation Insight Security Research (NGS Software) Advisory, April 12, 2005 | |
OS/400 5.x | A remote Denial of Service vulnerability has been reported in the IRC Patch information available at:
href="http://www-1.ibm.com/support/docview.wss?uid=nas29afd3991f5f290b086256fdb0053b293"> Currently we are not aware of any exploits for this | Low | Secunia Advisory, SA14970, April 18,2005 | |
Websphere Application Server 5.0, 5.0.1, 5.0.2 .1-5.0.2 .9, 5.0.2, | A vulnerability has been reported due to a failure to properly handle various requests under certain circumstances, which could let a remote malicious user obtain JSP source code. Workaround available at: There is no exploit code required; however, a Proof of Concept exploit | Medium | Security Tracker Alert,1013697, April 13, 2005 | |
MailServer prior to 6.0.9
| A remote Denial of Service vulnerability has been reported when a Update available at: Currently we are not aware of any exploits for this | Low | Security Tracker Alert, 1013708, April 14, 2005 | |
M4300, U8120, U8200, U8210 | A remote Denial of Service vulnerability has been reported when No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Low | Security Focus, 13154, April 13, 2005 | |
CalendarScript 3.20, 3.21 | Several vulnerabilities have been reported: a Cross-Site Scripting No workaround or patch available at time of publishing. Proofs of Concept exploits have been published. | CalendarScript Cross-Site Scripting & Information Disclosure
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1145">CAN-2005-1145 | Medium/ High (High if arbitrary code can be executed) | Security Tracker Alert ID: 1013705, April 14, 2005 |
Mozilla Browser 1.0-1.0.2, 1.1-1.7.6, Firefox 0.8-0.10.1, 1.0.1, 1.0.2 | Multiple vulnerabilities have been reported: a vulnerability was reported in the 'EMBED' tag for non-installed plugins when processing the 'PLUGINSPAGE' attribute due to an input validation error, which could let a remote malicious user execute arbitrary code; a vulnerability was reported because blocked popups that are opened through the GUI incorrectly run with 'chrome' privileges, which could let a remote malicious user execute arbitrary code; a vulnerability was reported because the global scope of a window or tab are not cleaned properly before navigating to a new web site, which could let a remote malicious user execute arbitrary code; a vulnerability was reported because the URL of a 'favicons' icon for a web site isn't verified before changed via JavaScript, which could let a remote malicious user execute arbitrary code with elevated privileges; a vulnerability was reported because the search plugin action URL is not properly verified before used to perform a search, which could let a remote malicious user execute arbitrary code; a vulnerability was reported due to the way links are opened in a sidebar when using the '_search' target, which could let a remote malicious user execute arbitrary code; several input validation vulnerabilities were reported when handling invalid type parameters passed to 'InstallTrigger' and 'XPInstall' related objects, which could let a remote malicious user execute arbitrary code; and vulnerabilities were reported due to insufficient validation of DOM nodes in certain privileged UI code, which could let a remote malicious user execute arbitrary code. Upgrades available at:
Gentoo:
href="http://security.gentoo.org/glsa/glsa-200504-18.xml"> There is no exploit code required. | Mozilla Suite / Firefox Multiple Vulnerabilities
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0752">CAN-2005-0752
| High | Mozilla Foundation Security Advisories, 2005-35 - 2005-41, April 16, Gentoo Linux Security Advisory, GLSA 200504-18, April 19, 2005 |
Mozilla.org Mozilla Browser 1.7.6, Firefox 1.0.1, 1.0.2; K-Meleon | A vulnerability has been reported in the javascript implementation due The vendor has issued a fix, available via CVS. There is no exploit code required; however, a Proof of Concept exploit | Medium | Security Tracker Alert, 1013635, April 4, 2005 Security Focus, 12988, April 16, 2005 | |
Linux kernel test12, 2.4-2.4.30, 2.6 .10, 2.6 -test1-test11, | A remote Denial of Service vulnerability has been reported when an active TCP session stream encounters an erroneous TCP acknowledgement number. No workaround or patch available at time of publishing. A Proof of Concept exploit script has been published. | Low | Security Focus, 13215, April 18, 2005 | |
See US-CERT | Multiple vendor implementations of TCP/IP Internet Control Message Protocol (ICMP) do not adequately validate ICMP error messages, which could let a remote malicious user cause a Denial of Service. Cisco: IBM: RedHat:
href="http://rhn.redhat.com/errata/"> Currently we are not aware of any exploits for these | Multiple Vendor TCP/IP Implementation ICMP Remote Denial of Service
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1060">CAN-2004-1060 | Low | US-CERT VU#222750 |
Squid Web Proxy Cache 2.3, STABLE2, STABLE4-STABLE7, 2.5, STABLE1, | A remote Denial of Service vulnerability has been reported when a Patches available at: Conectiva: Ubuntu: There is no exploit code required. | Low | Security Focus, 13166, April 14, 2005 | |
mvnForum 1.0 RC4 | A Cross-Site Scripting vulnerability has been reported due to No workaround or patch available at time of publishing. There is no exploit code required; however,a Proof of Concept exploit | High | Security Focus, 13213, April 18,2005 | |
MySQL 4.0.23, and 4.1.10 | A vulnerability was reported in the CREATE FUNCTION command that could A fixed version (4.0.24 and 4.1.10a) is available at:
href="http://dev.mysql.com/downloads/index.html"> Gentoo:
href="http://security.gentoo.org/glsa/glsa-200503-19.xml"> Ubuntu:
href="http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/"> Mandrake:
href="http://www.mandrakesecure.net/en/ftp.php" Trustix:
href="http://http.trustix.org/pub/trustix/updates/"> ALT Linux:
href="http://lists.altlinux.ru/pipermail/security-announce/2005-March/000287.html"> RedHat:
href="http://rhn.redhat.com/errata/RHSA-2005-334.html"> SuSE:
href="ftp://ftp.suse.com/pub/suse/"> Conectiva: Debian: A Proof of Concept exploit has been published. | High | Security Tracker Alert ID: 1013415, March 11, 2005 Gentoo Linux Security Advisory, GLSA 200503-19, March 16, 2005 Ubuntu Security Notice, USN-96-1 March 16, 2005 Mandrakelinux Security Update Advisory, MDKSA-2005:060, March 21, 2005 Trustix Secure Linux Security Advisory, TSL-2005-0009, March 21, SUSE Security Announcement, SUSE-SA:2005:019, March 24, 2005 RedHat Security Advisory, RHSA-2005:334-07, March 28, 2005 ALTLinux Security Advisory, March 29, 2005 Conectiva Linux Security Announcement, CLA-2005:946, April 4, 2005 Debian Security Advisory, DSA 707-1 , April 13, 2005 | |
MySQL 4.0.23, and 4.1.10 | A vulnerability has been reported that could let local malicious users The vulnerabilities have been fixed in version 4.0.24 (when available): Gentoo:
href="http://security.gentoo.org/glsa/glsa-200503-19.xml"> Ubuntu:
href="http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/"> Mandrake:
href="http://www.mandrakesecure.net/en/ftp.php" Trustix:
href="http://http.trustix.org/pub/trustix/updates/"> ALT Linux:
href="http://lists.altlinux.ru/pipermail/security-announce/2005-March/000287.html"> RedHat:
href="http://rhn.redhat.com/errata/RHSA-2005-334.html"> SuSE:
href="ftp://ftp.suse.com/pub/suse/"> Conectiva: Debian: A Proof of Concept exploit has been published. | MySQL Escalated Privilege Vulnerabilities href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0711">CAN-2005-0711
| Medium | Secunia SA14547, March 11, 2005 Gentoo Linux Security Advisory, GLSA 200503-19, March 16, 2005 Ubuntu Security Notice, USN-96-1 March 16, 2005 Mandrakelinux Security Update Advisory, MDKSA-2005:060, March 21, 2005 SUSE Security Announcement, SUSE-SA:2005:019, March 24, 2005 Trustix Secure Linux Security Advisory, TSL-2005-0009, March 21, RedHat Security Advisory, RHSA-2005:334-07, March 28, 2005 ALTLinux Security Advisory, March 29, 2005 Conectiva Linux Security Announcement, CLA-2005:946, April 4, 2005 Debian Security Advisory, DSA 707-1 , April 13, 2005 |
MySQL 4.0.23, and 4.1.10 | An input validation vulnerability was reported in udf_init() that could A fixed version (4.0.24 and 4.1.10a) is available at:
href="http://dev.mysql.com/downloads/index.html"> Gentoo:
href="http://security.gentoo.org/glsa/glsa-200503-19.xml"> Ubuntu:
href="http://security.ubuntu.com/ubuntu/pool/main/m/mysql-dfsg/"> Mandrake:
href="http://www.mandrakesecure.net/en/ftp.php" Trustix:
href="http://http.trustix.org/pub/trustix/updates/"> ALT Linux:
href="http://lists.altlinux.ru/pipermail/security-announce/2005-March/000287.html"> RedHat:
href="http://rhn.redhat.com/errata/RHSA-2005-334.html"> SuSE:
href="ftp://ftp.suse.com/pub/suse/"> Conectiva: Debian: A Proof of Concept exploit has been published. | High | Security Tracker Alert ID: 1013414, March 11, 2005 Gentoo Linux Security Advisory, GLSA 200503-19, March 16, 2005 Ubuntu Security Notice, USN-96-1 March 16, 2005 SUSE Security Announcement, SUSE-SA:2005:019, March 24, 2005 Mandrakelinux Security Update Advisory, MDKSA-2005:060, March 21, 2005 Trustix Secure Linux Security Advisory, TSL-2005-0009, March 21, RedHat Security Advisory, RHSA-2005:334-07, March 28, 2005 ALTLinux Security Advisory, March 29, 2005 Conectiva Linux Security Announcement, CLA-2005:946, April 4, 2005 Debian Security Advisory, DSA 707-1 , April 13, 2005 | |
myBloggie 2.1.1 | A vulnerability has been reported due to insufficient sanitization of No workaround or patch available at time of publishing. There is no exploit code required. | High | Security Focus, 13192, April 15, 2005 | |
EasyPHPCalendar | Several vulnerabilities have been reported: a Cross-Site Scripting vulnerability has been reported in the 'index.php' script due to insufficient validation of the 'yr' parameter, which could let a remote malicious user execute arbitrary HTML and script code; and a vulnerability has been reported in the 'popup.php' script due to an invalid 'ev' parameter value, which could let a remote malicious user obtain sensitive information. No workaround or patch available at time of publishing. A Proof of Concept exploit has been published. | Medium/ High (High if arbitrary code can be executed) | Security Tracker Alert, 1013704, April 14, 2005 | |
Opera Web Browser 8 Beta 3 | A vulnerability has been reported due to a design error when using first-generation vetted digital certificates, which could lead to a false sense of security. No workaround or patch available at time of publishing. There is no exploit code required. | Medium | Security Focus, 13176, April 14, 2005 | |
Oracle Application Server 10g, | Multiple SQL injection vulnerabilities have been reported due to insufficient sanitization of user-supplied data, which could let a remote malicious user execute arbitrary SQL code. Update information available at: Proofs of Concept exploits have been published. | Oracle Database Multiple SQL Injection | High | Security Focus 13144, April 12, 2005 |
Oracle Application Server 10g, Collaboration Suite Release 2, Database | Several vulnerabilities have been reported in the Change Data Capture, Data Pump, Intermedia, Authentication, Database SSL Library, Internet Directory, Spatial, XML Database, XDK, HTML database, and Oracle HTTP Server components, which could let a remote malicious user obtain database information, modify database information, and cause Denial of Service. Update information available at: Currently we are not aware of any exploits for these | Oracle Products Multiple Unspecified Vulnerabilities | Low/ Medium (Medium if information can be obtained or modified) | Secunia Advisory, SA14935, April 13, 2005 |
Oracle Forms versions 3.0 up to 10g | A vulnerability has been reported in the 'Query/Where' Update information available at: There is no exploit code required. | High | Securiteam, April 13, 2005 | |
Oracle10g Application Server 10.1.0.2, Oracle10g Enterprise Edition | A buffer overflow vulnerability has been reported in the 'MDSYS.MD2.SDO_CODE_SIZE' procedure, which could let a remote malicious user execute arbitrary code. Update information available at: A Proof of Concept exploit script has been published. | High | Security Focus, 13145, April 13, 2005 | |
PHP 4.3.6-4.3.9, 5.0 candidate 1-canidate 3, 5.0 .0-5.0.2 | Multiple vulnerabilities exist: a buffer overflow vulnerability exists in the 'pack()' function, which could let a remote malicious user execute arbitrary code; an integer overflow vulnerability exists in the 'unpack()' function, which could let a remote malicious user obtain sensitive information; a vulnerability exists in 'safe_mode' when executing commands, which could let a remote malicious user bypass the security restrictions; a vulnerability exists in 'safe_mode' combined with certain implementations of 'realpath(),' which could let a remote malicious user bypass security restrictions; a vulnerability exists in 'realpath()' because filenames are truncated; a vulnerability exists in the 'unserialize()' function, which could let a remote malicious user obtain sensitive information or execute arbitrary code; a vulnerability exists in the 'shmop_write()' function, which may result in an attempt to write to an out-of-bounds memory location; a vulnerability exists in the 'addslashes()' function because '\0' if not escaped correctly; a vulnerability exists in the 'exif_read_data()' function when a long sectionname is used, which could let a remote malicious user obtain sensitive information; and a vulnerability exists in 'magic_quotes_gpc,' which could let a remote malicious user obtain sensitive information. Upgrades available at: Mandrake:
href="http://www.mandrakesecure.net/en/ftp.php" Conectiva: RedHat:
href="http://rhn.redhat.com/errata/RHSA-2005-031.html"> SuSE:
href="ftp://ftp.suse.com/pub/suse/"> Ubuntu:
href="http://security.ubuntu.com/ubuntu/pool/main/p/php4/"> Apple:
href="http://www.apple.com/support/downloads/"> FedoraLegacy: Ubuntu:
href="http://security.ubuntu.com/ubuntu/pool/main/p/php4/"> There is no exploit code required; however, a Proof of Concept exploit | PHP Multiple Remote Vulnerabilities
href="http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CAN-2004-1018">CAN-2004-1018 | Medium/ High (High if arbitrary code can be executed) | Bugtraq, December 16, 2004 Conectiva Linux Security Announcement, CLA-2005:915, January 13, Red Hat, Advisory: RHSA-2005:031-08, January 19, 2005 SUSE Security Announcement, SUSE-SA:2005:002, January 17, 2005 Ubuntu Security Notice, USN-66-1, January 20, 2005 Apple Security Update, APPLE-SA-2005-01-25, January 26, 2005 Fedora Legacy Update Advisory, FLSA:2344, March 7, 2005 Ubuntu Security Notice, USN-99-1 March 18, 2005 Mandriva Linux Security Update Advisory, MDKSA-2005:072, April
|
PHP prior to 5.0.4 | Multiple Denial of Service vulnerabilities have been reported in Upgrade available at: Ubuntu: Slackware: Debian: SUSE: Gentoo: Mandrake:
href="http://www.mandrakesecure.net/en/ftp.php"> Currently we are not aware of any exploits for these | Low | iDEFENSE Security Advisory, Ubuntu Security Notice, USN-105-1 Slackware Security Advisory, SSA:2005- Debian Security Advisory, DSA 708-1, April 15, 2005 SUSE Security Announcement, SUSE-SA:2005:023, April 15, 2005 Gentoo Linux Security Advisory, GLSA 200504-15, April 18, 2005 Mandriva Linux Security Update Advisory, MDKSA-2005:072, April | |
phpBB 1.0 .0, 1.2.0, | A vulnerability has been reported in the Knowledge Base Module due to No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit | phpBB Knowledge Base SQL Injection & Information Disclosure | High | Bugtraq, 396098, April 18, 2005 |
phpBB2 Plus 1.5, 1.52 | Cross-Site Scripting vulnerabilities have been reported in 'GroupCP.php,' 'Indexphp,' 'Portal.php,' 'ViewForum.php,' and 'ViewTopic.php,' due to insufficient sanitization of user-supplied input, which could let a remote malicious user execute arbitrary HTML and script code. No workaround or patch available at time of publishing. There is no exploit code required; however, Proofs of Concept exploits | High | Dcrab 's Security Advisory, April 13, 2005 | |
Pinnacle Cart | A Cross-Site Scripting vulnerability has been reported in 'index.php' due to insufficient sanitization of the 'pg' parameter, which could let a remote malicious user execute arbitrary HTML and script code. No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit | High | Secunia Advisory, SA14924, April 13, 2005 | |
Serendipity 0.3-0.8 | A vulnerability has been reported in the 'exit.php' script due to insufficient validation of the 'url_id' and 'entry_id' parameters, which could let a remote malicious user execute arbitrary SQL code. Upgrades available at: href="http://www.s9y.org/12.html">http://www.s9y.org/12.html An exploit script has been published. | High | ADZ Security Team Advisory, April 13, 2005 | |
Photo Album 2.0.53 | Several vulnerabilities have been reported: an SQL injection vulnerability has been reported in 'Album_Search.php' due to insufficient sanitization of user-supplied input before using in an SQL query, which could let a remote malicious user inject arbitrary SQL code; and Cross-Site Scripting vulnerabilities have been reported in 'Album_Cat.PHP,' and 'Album_Comment.PHP' due to insufficient sanitization of user-supplied input, which could let a remote malicious user execute arbitrary HTML and script code. No workaround or patch available at time of publishing. There is no exploit code required; however, Proofs of Concept exploits | High | Security Focus, 13155, April 13, 2005 | |
sphpBlog 0.4.0 | Several vulnerabilities have been reported: a vulnerability was No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit | SPHPBlog Information Disclosures
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1136">CAN-2005-1136
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1135"> | Medium | Waraxe Advisory, April 13, 2005 |
sphpBlog 0.4.0 | A Cross-Site Scripting vulnerability has been reported in 'Search.php' No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit | High | Security Focus, 13170, April 14, 2005 | |
OpenOffice 1.1.4, 2.0 Beta | A vulnerability has been reported due to a heap overflow when a specially crafted malformed '.doc' file is opened, which could lead to a Denial of Service or execution of arbitrary code. Fedora: Gentoo: SUSE: Currently we are not aware of any exploits for this | Low/ High (High if arbitrary code can be executed) | Security Focus, 13092, Fedora Update Notification, Gentoo Linux Security Advisory, GLSA 200504-13, April 15, 2005 SUSE Security Announcement, SUSE-SA:2005:025, April 19, 2005 | |
JavaMail 1.3.2 | A Directory Traversal vulnerability has been reported in the 'MimeBodyPart.getFileName' method due to insufficient validation, which could let a remote malicious user obtain sensitive information. No workaround or patch available at time of publishing. There is no exploit code required; however, a Proof of Concept exploit | Medium | Bugtraq, 395584, April 12, 2005 | |
i3 FocalPoint Server 7.1 | A vulnerability has been reported due to an unspecified error. The Patch available at: Currently we are not aware of any exploits for this | Not Specified | Security Tracker Alert, 1013694, April 13, 2005 | |
WorkCentre 32 Color 01.02.077.1, 01.02.058.4, 01.02.053.1, 01.00.060, | A vulnerability has been reported in the SNMP functionality and the Web Upgrades available at: Currently we are not aware of any exploits for this | Medium | Xerox Security Bulletin, XRX05-005, April 12, 2005 | |
[back to
top]
size=-2>
Recent
Exploit Scripts/Techniques
The table belowcontains a sample of exploit scripts and "how to" guides identified during this
period. The "Workaround or Patch Available" column indicates if vendors,
security vulnerability listservs, or Computer Emergency Response Teams (CERTs)
have published workarounds or patches.
Note: At times,
scripts/techniques may contain names or content that may be considered
offensive.
Date of | Script name | Workaround or Patch Available | Script Description |
| April 18, 2005 | amap-5.0.tar.gz | N/A | A next-generation scanning tool that allows you to identify the applications that are running on a specific port. It does this by connecting to the port(s) and sending trigger packets. |
| April 18, 2005 | includer10.pl.txt includer10exec.pl.txt | No | Exploit scripts for the The Includer Remote File Include vulnerability. |
| April 18, 2005 | kismet-2005-04-R1.tar.gz | N/A | Kismet is an 802.11 layer 2 wireless network sniffer that can sniff 802.11b, 802.11a, and 802.11g traffic. |
| April 18, 2005 | msjet.c | No | Exploit for the Microsoft Jet Database Remote Code Execution Vulnerability. |
| April 18, 2005 | ong_bak.c | Yes | Script that exploits the Linux Kernel Bluetooth Signed Buffer Index vulnerability. |
| April 18, 2005 | p2pShareSpy.txt | No | Exploit for the Rebrand P2P Share Spy Information Disclosure Vulnerability. |
| April 18, 2005 | pmSoftwareSimpleWebBufferOverflowPoC.pl | No | Perl script that exploits the PMSoftware Simple Web Server Remote Buffer Overflow vulnerability. |
| April 18, 2005 | sash.c | No | Proof of Concept exploit for the sash 3.7 buffer overflow vulnerability. |
| April 18, 2005 | storm.c | No | Proof of Concept exploit for the Multiple Vendor TCP Session Acknowledgement Number Denial of Service vulnerability. |
| April 17, 2005 | 23laeon.c.txt aeon02a.pl.txt | No | Exploit for the Aeon 0.2a and below vulnerability. |
| April 17, 2005 | aiodio_read.c | No | Exploit for the Linux Kernel Asynchronous Input/Output Local Denial of Service vulnerability. |
| April 17, 2005 | argo.c | No | Script that exploits the ArGoSoft FTP Server 'DELE' Command Remote Buffer Overflow vulnerability. |
| April 17, 2005 | ftpNow2614.c | No | Script that exploits the Network-Client.com FTP Now Local Information Disclosure Vulnerability. |
| April 17, 2005 | getdataBack.c | No | Script that exploits the Runtime GetDataBack for NTFS Local Information Disclosure Vulnerability. |
| April 17, 2005 | mailenable_EHLO_DoS.pl | No | Perl script that exploits the MailEnable IMAP 'LOGIN' Command Buffer Overflow Vulnerability. |
| April 17, 2005 | maxthon_arbitrary_read-write.html.txt | Yes | Exploit example for the GNU Maxthon Security ID Disclosure Vulnerability. |
| April 17, 2005 | nokia_mms_gateway_vuln.txt | No | Exploit URLS for the Nokia MMS "Terminal Gateway" Login Bypass vulnerability. |
| April 17, 2005 | ocean12_xss_and_sql_inj.txt | No | Example exploit URLs for the Ocean12 Membership Manager Pro Cross-Site Scripting and SQL Injection Vulnerability. |
| April 17, 2005 | sco507nwprint.c | No | Script that exploits the SCO OpenServer NWPrint Command Buffer Overflow vulnerability. |
| April 17, 2005 | Vixie_crontab_readfiles-exploit_and_advisory.txt | Yes | Proof of Concept exploit for the Vixie Cron Crontab Information Disclosure vulnerability. |
| April 15, 2005 | libsafe-PoC.c | No | Proof of Concept exploit for the Libsafe Multi-threaded Process Security Bypass vulnerability. |
| April 14, 2005 | netv-locsbof.c netv-remhbof.c | No | Exploits for the BakBone NetVault Buffer Overflows Permit Remote Code Execution vulnerability. |
| April 14, 2005 | xsumus.c | No | Exploit for the Sumus Game Server Remote Buffer Overflow vulnerability. |
| April 14, 2005 | yagerbof.zip | No | Exploit for the Yager Development Yager Game Buffer Overflow & Denial of Service vulnerabilities. |
| April 13, 2005 | adz_serendipity.pl | Yes | Perl script that exploits the S9Y Serendipity Exit.PHP Input Validation vulnerability. |
| April 13, 2005 | cabrightstor_uniagent.pm | Yes | Exploit for the Computer Associates BrightStor ARCserve Backup UniversalAgent Remote Buffer Overflow vulnerability. |
| April 13, 2005 | lgfreeze.mid | No | Proof of Concept exploit for the LG U8120 Mobile Phone MIDI File Remote Denial of Service vulnerability. |
| April 13, 2005 | ms05016.c windowsShellCodeExecPoC.cpp | Yes | Scripts that exploit the Microsoft Windows Shell Remote Code Execution Vulnerability. |
| April 13, 2005 | oracle_sql_poc | Yes | Proofs of Concept exploits for the Oracle Database Multiple SQL Injection vulnerabilities. |
| April 12, 2005 | 0x82-meOw_linuxer_forever.c | Yes | Proof of Concept exploit for the Salim Gasmi Salim Gasmi GLD Buffer Overflow & Format String vulnerabilities. |
| April 12, 2005 | oracle_bof_exp | Yes | Exploit for the Oracle Database MDSYS.MD2.SDO_CODE_SIZE Buffer Overflow vulnerability. |
| April 12, 2004 | InternetExploiter2.zip | Yes | Proof of Concept exploit for the Microsoft Internet Explorer Remote Code Execution Vulnerability. |
face="Arial, Helvetica, sans-serif" size=-2>[back to
top]
name=trends>Trends
- Russian hackers unite in organized criminal groups:
This year's e-Crime Congress revealed that while partnerships between
law enforcement agencies are improving - witness the presence attendance of
senior figures from the US Secret Service, FBI, Hong Kong Police and Russia's
MVD General Miroshnikov - the level of online crime continues to expand as
organized gangs cooperate across borders to steal and extort over the internet
at unprecedented speed. Source: href="http://www.crime-research.org/news/18.04.2005/1159/">http://www.crime-research.org/news/18.04.2005/1159/Rootkits "Serious" Security Problem: class=tabletext> According to some security analysts, rootkits are now gaining
popularity among virus writers. Rootkits can hide
the existence of other malware on a computer by modifying file data, Windows
registry keys, or active processes, all of which are used by malicious code
detection software to spot worms, viruses, and spyware that's been installed
on a PC. Source: href="http://informationweek.com/story/showArticle.jhtml?articleID=160900692">http://informationweek.com/story/showArticle.jhtml?articleID=160900692.Secure Sockets Layer security aiding online fraud:
The number of lower-security Secure Sockets Layer (SSL) certificates
is increasing at twice the rate of the more secure organization-validated
certificates - a situation some industry observers say could lead to increased
online fraud. Domain-validated certificates, a lower-assurance form of
certificate that many Certification Authorities (CAs) have begun issuing
relatively recently, are one of several emerging controversies affecting
Internet security and e-commerce. Source: href="http://www.techworld.com/security/news/index.cfm?NewsID=3468">http://www.techworld.com/security/news/index.cfm?NewsID=3468. - Kelvir IM
Worm Strikes Reuters: Reuters Group was able to bring its instant
messaging system back online early Friday morning, April 15, after an outbreak
of the Kelvir worm led the company to shut down the system for most of
Thursday. The London-based news and information provider detected the external
worm on its network coming though a customer Internet portal mid-morning on
Thursday and took the system down as a precaution, according to Reuters
spokesperson Johnny Weir. After insuring there were proper filters in place,
the IM system was made operational again on Friday. Source: href="http://www.pcworld.com/news/article/0,aid,120447,00.asp">http://www.pcworld.com/news/article/0,aid,120447,00.asp
face="Arial, Helvetica, sans-serif">
name=viruses>Viruses/Trojans
Top Ten Virus Threats
A list of high threat
viruses, as reported to various anti-virus vendors and virus incident reporting
organizations, has been ranked and categorized in the table below. For the
purposes of collecting and collating data, infections involving multiple systems
at a single location are considered a single infection. It is therefore possible
that a virus has infected hundreds of machines but has only been counted once.
With the number of viruses that appear each month, it is possible that a new
virus will become widely distributed before the next edition of this
publication. To limit the possibility of infection, readers are reminded to
update their anti-virus packages as soon as updates become available. The table
lists the viruses by ranking (number of sites affected), common virus name, type
of virus code (i.e., boot, file, macro, multi-partite, script), trends (based on
number of infections reported since last week), and approximate date first
found.
face="Arial, Helvetica, sans-serif">Rank | Common Name | Type of Code |
face="Arial, Helvetica, sans-serif">Trends |
face="Arial, Helvetica, sans-serif">Date |
1 | Netsky-P | Win32 Worm | Stable | March 2004 |
2 | Netsky-Q | Win32 Worm | Stable | March 2004 |
3 | Zafi-D | Win32 Worm | Stable | December 2004 |
4 | Mytob.C | Win32 Worm | Stable | March 2004 |
5 | Bagle.BJ | Win32 Worm | Stable | January 2005 |
6 | Netsky-D | Win32 Worm | Stable | March 2004 |
6 | Netsky-Z | Win32 Worm | Stable | April 2004 |
7 | Zafi-B | Win32 Worm | Stable | June 2004 |
7 | Netsky-B | Win32 Worm | Stable | February 2004 |
8 | Bagle-AU | Win32 Worm | Stable | October 2004 |
8 | Sober-I | Win32 Worm | Stable | November 2004 |
face="Arial, Helvetica, sans-serif">Table Updated April 19,
2005
Viruses or Trojans Considered to be a High Level of
Threat
-
href="#mytob">Mytob: The number of Mytob worm variants
continues to grow, and spawning a record 40 variants since its appearance six
weeks ago. Alfred Huger, senior director of engineering at Symantec's security
response team, says the number of variants may result from numerous virus
writers sharing the original source code and making their own changes. Source:
href="http://www.securitypipeline.com/160701146">http://www.securitypipeline.com/160701146 - Sober: A new Sober
mass mailer worm is making its way around the Internet and tricking users into
opening attachments with clever messages in both English and German,
anti-virus companies warned Tuesday, April 19. W32.Sober.N@mm sends e-mail
messages with the subject headers "I've_got your EMail on my_account!" and
"FwD: Ich bin's nochmal" and carries attachments with names like
your_text.zip, according to Helsinki security firm F-Secure. When opened, the
attachment scans files on the infected computer to harvest e-mail addresses
that enable the worm to spread. Source: href="http://www.nwfusion.com/news/2005/0419newsober.html">http://www.nwfusion.com/news/2005/0419newsober.html
The following table
provides, in alphabetical order, a list of new viruses, variations of previously
encountered viruses, and Trojans that have been discovered during the period
covered by this bulletin. This information has been compiled from the following
anti-virus vendors: Sophos, Trend Micro, Symantec, McAfee, Network Associates,
Central Command, F-Secure, Kaspersky Labs, MessageLabs, Panda Software, Computer
Associates, and The WildList Organization International. Users should keep
anti-virus software up to date and should contact their anti-virus vendors to
obtain specific information on the Trojans and Trojan variants that anti-virus
software detects.
NOTE: At
times, viruses and Trojans may contain names or content that may be considered
offensive.
updated
Please share your thoughts
We recently updated our anonymous product survey; we’d welcome your feedback.