Secunia Advisory: SA21989
Release Date: 2006-09-19
Last Update: 2006-09-25

Critical: Extremely critical

Impact: System access

Where: From remote

Solution Status: Unpatched

OS: Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional

CVE reference: CVE-2006-4868 (Secunia mirror)

Description: A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in the Microsoft Vector Graphics Rendering(VML) library (vgx.dll) when processing certain content in Vector Markup Language (VML) documents. This can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into viewing a malicious VML document containing an overly long "fill" method inside a "rect" tag with the Internet Explorer browser. Successful exploitation allows execution of arbitrary code with the privileges of the application using the vulnerable functionality in the library. The vulnerability is confirmed on a fully patched Microsoft Windows XP SP2 system. Other versions may also be affected.

NOTE: The vulnerability is currently being actively exploited.

Solution: Un-register Vgx.dll (see the vendor's security advisory for details). Sunbelt recommended that disabling JavaScript may also help to mitigate the attacks.

NOTE: This affects the functionality of applications rendering VML.

Provided and/or discovered by: Discovered as a 0-day.

Sample exploit provided by Sunbelt Software.

Changelog:
2006-09-19: Updated advisory with additional information.
2006-09-20: Added CVE reference.
2006-09-25: Updated "Solution" section.

Original Advisory: Microsoft: http://www.microsoft.com/technet/security/advisory/925568.mspx

Other References: US-CERT VU#416092: http://www.kb.cert.org/vuls/id/416092

TITLE: Advanced-Clan-Script *content* File Inclusion Vulnerability

SECUNIA ADVISORY ID: SA22070

VERIFY ADVISORY: http://secunia.com/advisories/22070/

CRITICAL: Highly critical

IMPACT: System access

WHERE: >From remote

SOFTWARE: Advanced-Clan-Script 3.x - http://secunia.com/product/12106/

DESCRIPTION: xdh has discovered a vulnerability in Advanced-Clan-Script, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "content" parameter in mcf.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources. The vulnerability has been confirmed in version 3.4. Other versions may also be affected.

SOLUTION: Edit the source code to ensure that input is properly verified.

PROVIDED AND/OR DISCOVERED BY: xdh

TITLE: Plesk filemanager.php Information Disclosure

SECUNIA ADVISORY ID: SA22058

VERIFY ADVISORY: http://secunia.com/advisories/22058/

CRITICAL: Less critical

IMPACT: Exposure of system information

WHERE: >From remote

SOFTWARE: Plesk 7.x - http://secunia.com/product/3833/

DESCRIPTION: GuanYu has reported a vulnerability in Plesk, which potentially can be exploited by malicious users to disclose certain information.

Input passed to the "file" parameter in filemanager/filemanager.php is not properly verified before being used. This can be exploited to disclose the contents of certain directories via directory traversal attacks. The vulnerability is reported in version 7.6 for Windows. Other versions may also be affected.

SOLUTION: Grant only trusted users access to the affected application.

PROVIDED AND/OR DISCOVERED BY: GuanYu

TITLE: WS_FTP LE *PASV* Response Buffer Overflow Vulnerability

SECUNIA ADVISORY ID: SA22032

VERIFY ADVISORY: http://secunia.com/advisories/22032/

CRITICAL: Moderately critical

IMPACT: DoS, System access

WHERE: >From remote

SOFTWARE: WS_FTP LE 5.x - http://secunia.com/product/12062/

DESCRIPTION: h07 has discovered a vulnerability in WS_FTP LE, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error within the handling of responses to the "PASV" command. This can be exploited to cause a buffer overflow by e.g. tricking a user into connecting to a malicious FTP server. Successful exploitation allows execution of arbitrary code. The vulnerability has been confirmed in version 5.08. Other versions may also be affected.

SOLUTION: Connect to trusted FTP servers only. Use another product.

PROVIDED AND/OR DISCOVERED BY: h07

drakken20 writes:  

New category for retooled themes.

Click here to browse PHP-Nuke ReLoaded

These themes have been redesigned and coded, as well as including phpBB templates that integrated into the design.

My phpBB templates have been correctly integrated into PHP-Nuke, instead of just included. On most designs I have seen(but may not be the case for alot), the forum template is generated in the middle of the page, redeclaring the doc type, html, body and other tags that are not supposed to be in the body of the page.My templates have corrected this.

So, what is reloading your site worth?

Try 5.99

There are currently 48 made, with a bunch more on the way.

Just click here to browse current designs.

Buy yours now,

Thanks,
John

forgotz writes:  

Guaranteed Traffic & Branding! DaDaNuke will send visitors to a URL of your choice. Pay only when someone visits your site. Tell us what your max bid per visitor is, and we'll charge you only the min that is necessary. You will not write or upload an ad. Instead, visitors will automatically be taken to your site. Starting Bid: $0.010

Click here to choose to have more traffic for your site!  Read More...