Brett Moore

Name of the Vulnerable Software and Affected Versions: Symantec Altiris Deployment Solution versions prior to 6.9.355 SP1 Description: The issue allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack. This attack targets the `CommandLine` parameter to `cmd.exe` to use SYSTEM privileges and modifies the DLL loaded using the `LoadLibrary` API function. Recommendations: For Symantec Altiris Deployment Solution versions prior to 6.9.355 SP1, update to version 6.9.355 SP1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer version 7 Description: A remote code execution issue exists due to attempts to access uninitialized memory in certain situations. An attacker could exploit this by constructing a specially crafted Web page. When a user views the Web page, it could allow remote code execution, potentially giving the attacker the same user rights as the logged-on user. Recommendations: For Microsoft Internet Explorer version 7, consider avoiding the use of WebDAV requests for files with long names until a patch is available. As a temporary workaround, restrict access to crafted HTML documents that could trigger memory corruption.

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Basic 6.0 Visual Studio .NET versions 2002 SP1 and 2003 SP1 Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2 Office Project versions 2003 SP3 and 2007 Gold and SP1 Description: A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a crafted AVI file. This triggers an allocation error and memory corruption. The vulnerability can be exploited by constructing a specially crafted web page, potentially leading to remote code execution when viewed. If successfully exploited, an attacker could gain the same user rights as the logged-on user. Recommendations: For Microsoft Visual Basic 6.0, update to a version that includes the fix for this issue. For Visual Studio .NET versions 2002 SP1 and 2003 SP1, apply the necessary patch or update to a newer version. For Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2, consider disabling the use of AVI files until a patch is available. For Office Project versions 2003 SP3 and 2007 Gold and SP1, restrict access to crafted web pages to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Symantec Altiris Deployment Solution versions 6.8.x through 6.9.x before 6.9.176 Description: The issue allows remote attackers to more easily guess encrypted domain credentials due to the generation of credentials with a fixed salt or without any salt by axengine.exe. Recommendations: For Symantec Altiris Deployment Solution versions 6.8.x through 6.9.x before 6.9.176, update to version 6.9.176 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Symantec Altiris Deployment Solution versions 6.8.x through 6.9.x before 6.9.176 Description: The issue allows remote attackers to execute arbitrary SQL commands via unspecified string fields in a notification packet. This is a result of a SQL injection vulnerability in axengine.exe. Recommendations: For versions 6.8.x through 6.9.x before 6.9.176, update to version 6.9.176 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: LizardTech DjVu Browser Plug-in versions prior to 6.1.1 Description: The issue is related to multiple buffer overflows that allow remote attackers to execute arbitrary code. The exact vectors used for the attack are not specified. Recommendations: For versions prior to 6.1.1, update to version 6.1.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue is related to a buffer overflow in the Step-by-Step Interactive Training component of Microsoft Windows. This allows remote attackers to execute arbitrary code via a long Syllabus string in crafted bookmark link files, such as those with .cbo, .cbl, or .cbm extensions. Recommendations: For Microsoft Windows 2000 SP4, XP SP2 and Professional, and Server 2003 SP1, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns a problem in the projectserver/logon/pdsrequest.asp file of Microsoft Project Server 2003. It allows remote authenticated users to obtain the MSProjectUser password for a SQL database. This is achieved via a GetInitializationData request. The response to this request includes the information in the `UserName` and `Password` tags.

The issue allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments. This can be demonstrated using win.com when it is in a web directory with certain permissions. The IUSR Machine account can execute non-EXE files such as .COM files.

The issue allows user-assisted remote attackers to execute arbitrary vbscript and commands. This is achieved via the /r option in a telnet:// URI, which is configured to use hawin32.exe.

The issue allows remote attackers to execute arbitrary vbscript and commands via a session file, which can be automatically opened using Internet Explorer.

A cross-site scripting (XSS) issue exists in the skinning feature, allowing local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser.

The issue arises from improper filtering of HTML tags, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved by including a NULL byte (%00) in certain HTML tags. For example, using "%00script" in a tag can demonstrate this exploit.

The issue allows remote attackers to obtain sensitive information. This can be achieved through a URL request for a non-existent file, such as a JWS, CFM, CFML, or CFC file, which displays the installation path in the resulting error message. Additionally, accessing /CFIDE/administrator/login.cfm without a host can reveal the server's internal IP address in an HREF tag.

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Information Services (IIS) versions 5.0 through 6.0 Description: A buffer overflow issue in Microsoft Internet Information Services (IIS) allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP). Recommendations: For versions 5.0 through 6.0, update to a newer version that contains a fix for this issue.

The issue is an argument injection vulnerability in the URI handler that allows remote authorized attackers to download arbitrary files via a crafted URL. This can lead to unauthorized information disclosure when a malicious user sends a crafted URL to a targeted user, resulting in a loss of confidentiality.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue is related to the Web View in Windows Explorer, which does not properly handle certain HTML characters in preview fields. This allows remote user-assisted attackers to execute arbitrary code. Recommendations: For Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to read or write to arbitrary files. This is achieved via the (1) MakeArchive or (2) MakeArchiveStr methods.

The issue allows remote attackers to execute arbitrary code via a bookmark link file with a long `User` field. This can be achieved by using files with .cbo, .cbl, or .cbm extensions.

The issue allows remote attackers to execute arbitrary commands via a telnet:// URL that uses the /F option to specify a configuration file on a samba share.