<< Previous Next >>
Affected Versions
| | The pedantic option in the SIP channel driver can also be |
| | turned off to prevent this issue from occurring. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------------+---------+---------------------------------|
| Asterisk Open Source | 1.2.x | Not affected |
It has been discovered that the default value of the TYPO3 configuration variable fileDenyPattern allows arbitrary code execution on Apache web servers. Besides that, the library fe_adminlib.inc allows Cross Site Scripting (XSS).
=== Component Type ===
TYPO3 Core
=== Affected Versions ===
TYPO3 versions 3.x, 4.0 to 4.0.7, 4.1 to 4.1.6, 4.2
=== Vulnerability Types ===
Arbitrary code execution on Apache, Cross Site Scripting
| |adequate time be given to fix any such vulnerability. Recommended reading: |
| |http://www.oisafety.org/guidelines/Guidelines%20for%20Security%20Vulnerability%20Reporting%20and%20Response%20V2.0.pdf|
+---------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.0.x | All versions |
| | secure internal networks when an IAXy is initially |
| | provisioned. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.0.x | All versions |
Discovered By : HACKERS PAL
Copy rights : HACKERS PAL
Website : http://www.soqor.net
Email Address : security@soqor.net
Affected Versions
1.0.X -> tested on 1.0.12
and 1.5 maybe affected -> not tested but probebly affected
sql injection
The following test case can be used to expose internal system configuration for PHP engine:
url_placeholder/sla/index.php?l=/../../../../../../../../etc/php.ini
Affected Versions
IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)
Mitigation
| | immediately planned. However, the issue will be fixed in |
| | Asterisk Open Source version 1.4.12 when it is released. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|--------------------------------+-------------+-------------------------|
| Asterisk Open Source | 1.0.x | Not Affected |
| | functionality where SIP dialog history is not recorded in |
| | memory if it is not enabled. Furthermore, a maximum of 50 |
| | entires in the history will be stored for each dialog |
| | when recording history is turned on. |
| | |
| | The only way to avoid this problem in affected versions |
| | of Asterisk is to disable chan_sip. If chan_sip is being |
| | used, the system must be upgraded to a version that has |
| | this issue resolved. |
+------------------------------------------------------------------------+
Firefox 2.0 fully patched.
User intervention (e.g. clicking on a malicious link) is necessary to
trigger the exploit.
Affected Versions:
This vulnerability has been confirmed in the following versions:
- - 4.3.0.246
- - 4.3.0.246.5
Firefox 2.0 fully patched.
User intervention (e.g. clicking on a malicious link) is necessary to
trigger the exploit.
Affected Versions:
This vulnerability has been confirmed in the following versions:
- 4.3.0.246
- 4.3.0.246.5
| | the appropriate version listed in the corrected in |
| | section of this advisory. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.0.x | Not affected |
> Discovered By : HACKERS PAL
> Copy rights : HACKERS PAL
> Website : http://www.soqor.net
> Email Address : security (at) soqor (dot) net
>
> Affected Versions
> 1.0.X -> tested on 1.0.12
>
> and 1.5 maybe affected -> not tested but probebly affected
>
> sql injection
commands.
Resolution Asterisk now performs checks against manager commands that
cause these behaviors for each of the affected actions.
Affected Versions
Product Release Series
Asterisk Open Source 1.6.2.x All versions
Asterisk Open Source 1.8.x All versions
Asterisk Open Source 10.x All versions
Asterisk Business Edition C.3.x All versions
> Discovered By : HACKERS PAL
> Copy rights : HACKERS PAL
> Website : http://www.soqor.net
> Email Address : security (at) soqor (dot) net
>
> Affected Versions
> 1.0.X -> tested on 1.0.12
>
> and 1.5 maybe affected -> not tested but probebly affected
>
> sql injection
Discovered By : HACKERS PAL
Copy rights : HACKERS PAL
Website : http://www.soqor.net
Email Address : security (at) soqor (dot) net
Affected Versions
1.0.X -> tested on 1.0.12
and 1.5 maybe affected -> not tested but probebly affected
sql injection
This means that if your company uses hidden SSID wireless network. I
could steal you WPA key when your employees join any conferences. All of
attack processes require no user interactions, no social engineering.
:: Affected Versions ::
Android 2.3
Android 3.0
Other versions may be affected but I have not tested
:: Reproduce The Attack ::
the site. Additionally, a Local Path Disclosure vulnerability was
also discovered.
Affected Versions
------------------------------------------------------------
Each vulnerability was confirmed in versions 2.4.103 and 2.5.139-beta.
The Cross Site Scripting vulnerability affecting the redirect
parameter is only found in version 2.5.139-beta.
Details
=======
Product: Alcatel-Lucent OmniPCX
Affected Versions: All versions up to and including R7.1
Fixed Versions: All supported versions
Vulnerability Type: Remote Command Execution
Security-Risk: high
Vendor-URL: http://www1.alcatel-lucent.com/psirt/statements.htm
reference number 2007002
| | Asterisk, nor is it installed by default. The module may |
| | be either disabled or upgraded to fix this issue. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------+-------------+-----------------------------------|
| Asterisk Open Source | 1.0.x | All versions |
point would be to subscribe to MyReview newsletter, if not done yet.
Version and platform Affected
Affected Platforms - Any
Affected Software - MyReview, http://myreview.intellagence.eu/
Affected Versions - Any (prior or equal to 1.9.9, as 2.0 is still in beta)
Severity - High
Requirements
Authentication - None
Access - Distant (Internet)
| | to the sprintf call. This includes places which are not |
| | currently prone to buffer overflows. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.0.x | Unaffected |
Details
=======
Product: Papoo CMS
Affected Versions: 3.7.3 (older versions are probably also vulnerable)
Fixed Versions: 3.7.3 after applying vendor patch
Vulnerability Type: Code Execution
Security Risk: medium
Vendor URL: http://www.papoo.de
Vendor Status: notified, fixed version released
+------------------------------------------------------------------------+
| Resolution | Upgrade to Asterisk release 1.4.15 or higher. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------------------+--------------+----------------------|
| Asterisk Open Source | 1.0.x | All versions |
+------------------------------------------------------------------------+
| Resolution | Upgrade to Asterisk release 1.4.15 or higher. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|------------------------------+-------------+---------------------------|
| Asterisk Open Source | 1.0.x | None |
| | embarrassment of reporting a vulnerability that wasn't) |
| | in the future. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release Series | |
|-----------------+----------------+-------------------------------------|
| Zaptel | 1.2.x | All versions prior to 1.2.22 |
|-----------------+----------------+-------------------------------------|
| Resolution | Users should upgrade to a version listed in the |
| | "Corrected In" section below. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release Series | |
|-------------------------------+----------------+-----------------------|
| Asterisk Open Source | 1.2.x | Unaffected |
|-------------------------------+----------------+-----------------------|
| | database. A fix is included in the newest release of |
| | Asterisk, as provided below. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------------+-------------+-----------------------------|
| Asterisk Open Source | 1.0.x | Not affected |
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.11 and B.11.23 running OpenSSL before vA.00.09.07m, and B.11.31 running OpenSSL before vA.00.09.08g.
BACKGROUND
To determine if an HP-UX system has an affected version, search the output of "swlist -a revision -l fileset"
for one of the filesets listed below. For affected systems verify that the recommended action has been taken.
AFFECTED VERSIONS
HP-UX B.11.11
In addition, an attacker can use his control over the FEP server to insert a generic electric grid malware as specified in our SysScan08 presentation, in order to cause harm to the grid.
Both documents are available at http://www.c4-security.com/index-5.html .
Affected Versions
-------------------------
PCU400 4.4
PCU400 4.5
PCU400 4.6
Other versions may be vulnerable, as they were not tested.
center" and "field to control center" attack vectors mentioned in C4's S4
2008 paper "Control System Attack Vectors and Examples: Field Site and
Corporate Network"
<http://www.c4-security.com/SCADA%20Security%20-%20Attack%20Vectors.pdf> .
Affected Versions
-------------------------
e-terrahabitat version 5.5.x
e-terrahabitat version 5.6.x
e-terrahabitat version 5.7.x
<<Previous Next>>
|
