Hacker Fantastic

**Name of the Vulnerable Software and Affected Versions** Horde Virtual File System (VFS) API versions prior to 3.0.1 **Description** The Horde Vfs Smb driver contains an OS command injection flaw where the ` escapeShellCommand()` method does not properly sanitize command substitution sequences. Authenticated attackers can exploit this by providing malicious filenames during file upload, folder creation, rename, or deletion operations. These filenames are interpolated into a double-quoted shell context and executed via `proc open()` through `/bin/sh -c` before `smbclient` runs, allowing the execution of arbitrary shell commands on the underlying system. **Recommendations** Update Horde Virtual File System (VFS) API to version 3.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Amanda version 3.3.1 **Description** An issue in Amanda allows a user with backup privileges to compromise a client installation. The `runtar` setuid root binary does not check for additional arguments supplied after `--create`, enabling users to manipulate commands and perform command injection as root. **Recommendations** For Amanda version 3.3.1, consider restricting the use of the `runtar` setuid root binary until a patch is available to prevent command injection. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Amanda version 3.3.1 **Description** An issue was discovered that allows a user with backup privileges to compromise a client installation. The Amstar script, which is part of the Amanda Application API, should not be run directly by users. It utilizes the star utility for backup and restore operations and executes binaries with root permissions when parsing the --star-path command line argument. **Recommendations** For Amanda version 3.3.1, consider restricting access to the Amstar script to prevent direct execution by users, and ensure that the --star-path argument is properly validated to prevent unauthorized execution of binaries with root permissions.

**Name of the Vulnerable Software and Affected Versions** Oracle Sun Systems Products Suite versions 10 **Description** The issue is related to inadequate access control in the Common Desktop Environment (CDE) component of the Solaris operating system. This allows a low-privileged attacker with local access to the infrastructure where Solaris is executed to compromise Solaris, potentially leading to a takeover. The vulnerability is considered easily exploitable. **Recommendations** For version 10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.1 **Description** The issue is related to the Just-in-time (JIT) JavaScript compiler, also known as TraceMonkey, in Mozilla Firefox. It allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations. This can be demonstrated by a document containing specific elements. **Recommendations** For versions prior to 3.5.1, update to version 3.5.1 or later to resolve the issue.