Hacker Fantastic

**Nome do Software Vulnerável e Versões Afetadas** Horde Virtual File System (VFS) API versões anteriores a 3.0.1 **Description** O driver Horde Vfs Smb contém uma falha de injeção de comando de SO onde o método ` escapeShellCommand()` não sanitiza adequadamente sequências de substituição de comando. Atacantes autenticados podem explorar isso fornecendo nomes de arquivos maliciosos durante operações de upload de arquivos, criação de pastas, renomeação ou exclusão. Esses nomes de arquivos são interpolados em um contexto de shell com aspas duplas e executados via `proc open()` através do `/bin/sh -c` antes da execução do `smbclient`, permitindo a execução de comandos de shell arbitrários no sistema subjacente. **Recommendations** Atualize o Horde Virtual File System (VFS) API para a versão 3.0.1 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Amanda version 3.3.1 **Description** An issue in Amanda allows a user with backup privileges to compromise a client installation. The `runtar` setuid root binary does not check for additional arguments supplied after `--create`, enabling users to manipulate commands and perform command injection as root. **Recommendations** For Amanda version 3.3.1, consider restricting the use of the `runtar` setuid root binary until a patch is available to prevent command injection. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Amanda version 3.3.1 **Description** An issue was discovered that allows a user with backup privileges to compromise a client installation. The Amstar script, which is part of the Amanda Application API, should not be run directly by users. It utilizes the star utility for backup and restore operations and executes binaries with root permissions when parsing the --star-path command line argument. **Recommendations** For Amanda version 3.3.1, consider restricting access to the Amstar script to prevent direct execution by users, and ensure that the --star-path argument is properly validated to prevent unauthorized execution of binaries with root permissions.

**Name of the Vulnerable Software and Affected Versions** Oracle Sun Systems Products Suite versions 10 **Description** The issue is related to inadequate access control in the Common Desktop Environment (CDE) component of the Solaris operating system. This allows a low-privileged attacker with local access to the infrastructure where Solaris is executed to compromise Solaris, potentially leading to a takeover. The vulnerability is considered easily exploitable. **Recommendations** For version 10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.1 **Description** The issue is related to the Just-in-time (JIT) JavaScript compiler, also known as TraceMonkey, in Mozilla Firefox. It allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations. This can be demonstrated by a document containing specific elements. **Recommendations** For versions prior to 3.5.1, update to version 3.5.1 or later to resolve the issue.