Niels Teusink

**Nome do software vulnerável e versões afetadas: Dispositivos Zyxel USG versão 4.60 Descrição: O problema diz respeito a uma conta não documentada `zyfwp` com uma senha imutável que pode ser encontrada em texto simples no firmware dos dispositivos Zyxel USG. Essa conta permite que alguém faça login no servidor SSH ou na interface web com privilégios de administrador. A senha dessa conta é `PrOw!aN fXp`. Há um aumento significativo nas tentativas de acesso a esse backdoor SSH conhecido usando essas credenciais não documentadas. Recomendações: Para dispositivos Zyxel USG versão 4.60, considere desativar a conta `zyfwp` até que um patch esteja disponível. Restrinja o acesso ao servidor SSH e à interface web para minimizar o risco de exploração. Evite usar a conta `zyfwp` e sua senha associada `PrOw!aN fXp` até que o problema seja resolvido. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 **Description** The issue is related to errors in processing files with .LNK (or .PIF) extensions. Exploitation of this issue can allow a remote attacker to execute arbitrary code using a specially crafted .LNK (or .PIF) file. This can occur when Windows Explorer improperly handles icon display for such files. The issue has been demonstrated in the wild and was originally reported for malware leveraging vulnerabilities in Siemens WinCC SCADA systems. An estimated number of affected devices is not provided, but the issue has been observed in real-world incidents. Technical details include the exploitation of `Windows Shell` in Microsoft Windows, where a crafted (1) `.LNK` or (2) `.PIF` shortcut file is not properly handled during icon display. **Recommendations** For Microsoft Windows versions XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7, apply the update that addresses the vulnerability previously discussed in Microsoft Security Advisory 2286198 to prevent arbitrary code execution when the operating system displays the icon of a malicious shortcut file. As a temporary workaround, consider restricting access to `.LNK` and `.PIF` files to minimize the risk of exploitation until a patch is available.

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18 NaSMail versions prior to 1.7 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a `username` string that is used by the `ypmatch` program. This is due to a problem in the `map yp alias` function in `functions/imap general.php`. Recommendations: For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting the input for the `username` string to prevent the use of shell metacharacters until a patch is available.

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18 NaSMail versions prior to 1.7 Description: The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible through various vectors, including certain encrypted strings in e-mail headers related to contrib/decrypt headers.php, PHP SELF, and the query string. Recommendations: For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the contrib/decrypt headers.php module and limiting the use of PHP SELF and query strings in affected API endpoints until a patch is available.

Name of the Vulnerable Software and Affected Versions: GrabIt versions 1.7.2 Beta 3 and earlier Description: The issue is related to a stack-based buffer overflow in the NZB importer feature. This can be exploited by remote attackers through a crafted DTD reference in a DOCTYPE element in an NZB file, allowing them to execute arbitrary code. Recommendations: For GrabIt versions 1.7.2 Beta 3 and earlier, consider disabling the NZB importer feature until a patch is available to prevent potential exploitation.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote web sites on the browser's whitelist to execute arbitrary Javascript with chrome privileges. This can lead to arbitrary code execution on the system when combined with other vulnerabilities. The exploitation can be demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site. Recommendations: For Firefox version 1.0.3, consider restricting access to the `install` function until a patch is available. As a temporary workaround, avoid using the `javascript:` URL scheme for package icons to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote attackers to execute arbitrary Javascript in other domains. This is achieved by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution. Recommendations: For Firefox version 1.0.3, update to a newer version to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** phpBB versions 2.0.6 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL and gain privileges. This is achieved via the `search id` parameter in the "search.php" file. **Recommendations** For phpBB versions 2.0.6 and earlier, update to a version later than 2.0.6 to resolve the issue.