Niels Teusink

Name of the Vulnerable Software and Affected Versions: Zyxel USG devices version 4.60 Description: The issue concerns an undocumented account `zyfwp` with an unchangeable password that can be found in cleartext in the firmware of Zyxel USG devices. This account allows someone to login to the ssh server or web interface with admin privileges. The password for this account is `PrOw!aN fXp`. There is a significant increase in attempts to access this known SSH backdoor using these undocumented credentials. Recommendations: For Zyxel USG devices version 4.60, consider disabling the `zyfwp` account until a patch is available. Restrict access to the ssh server and web interface to minimize the risk of exploitation. Avoid using the `zyfwp` account and its associated password `PrOw!aN fXp` until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 **Description** The issue is related to errors in processing files with .LNK (or .PIF) extensions. Exploitation of this issue can allow a remote attacker to execute arbitrary code using a specially crafted .LNK (or .PIF) file. This can occur when Windows Explorer improperly handles icon display for such files. The issue has been demonstrated in the wild and was originally reported for malware leveraging vulnerabilities in Siemens WinCC SCADA systems. An estimated number of affected devices is not provided, but the issue has been observed in real-world incidents. Technical details include the exploitation of `Windows Shell` in Microsoft Windows, where a crafted (1) `.LNK` or (2) `.PIF` shortcut file is not properly handled during icon display. **Recommendations** For Microsoft Windows versions XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7, apply the update that addresses the vulnerability previously discussed in Microsoft Security Advisory 2286198 to prevent arbitrary code execution when the operating system displays the icon of a malicious shortcut file. As a temporary workaround, consider restricting access to `.LNK` and `.PIF` files to minimize the risk of exploitation until a patch is available.

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18 NaSMail versions prior to 1.7 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a `username` string that is used by the `ypmatch` program. This is due to a problem in the `map yp alias` function in `functions/imap general.php`. Recommendations: For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting the input for the `username` string to prevent the use of shell metacharacters until a patch is available.

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18 NaSMail versions prior to 1.7 Description: The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible through various vectors, including certain encrypted strings in e-mail headers related to contrib/decrypt headers.php, PHP SELF, and the query string. Recommendations: For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the contrib/decrypt headers.php module and limiting the use of PHP SELF and query strings in affected API endpoints until a patch is available.

Name of the Vulnerable Software and Affected Versions: GrabIt versions 1.7.2 Beta 3 and earlier Description: The issue is related to a stack-based buffer overflow in the NZB importer feature. This can be exploited by remote attackers through a crafted DTD reference in a DOCTYPE element in an NZB file, allowing them to execute arbitrary code. Recommendations: For GrabIt versions 1.7.2 Beta 3 and earlier, consider disabling the NZB importer feature until a patch is available to prevent potential exploitation.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote web sites on the browser's whitelist to execute arbitrary Javascript with chrome privileges. This can lead to arbitrary code execution on the system when combined with other vulnerabilities. The exploitation can be demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site. Recommendations: For Firefox version 1.0.3, consider restricting access to the `install` function until a patch is available. As a temporary workaround, avoid using the `javascript:` URL scheme for package icons to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote attackers to execute arbitrary Javascript in other domains. This is achieved by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution. Recommendations: For Firefox version 1.0.3, update to a newer version to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** phpBB versions 2.0.6 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL and gain privileges. This is achieved via the `search id` parameter in the "search.php" file. **Recommendations** For phpBB versions 2.0.6 and earlier, update to a version later than 2.0.6 to resolve the issue.