Brett Moore

Name of the Vulnerable Software and Affected Versions: Symantec Altiris Deployment Solution versions prior to 6.9.355 SP1 Description: The issue allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack. This attack targets the `CommandLine` parameter to `cmd.exe` to use SYSTEM privileges and modifies the DLL loaded using the `LoadLibrary` API function. Recommendations: For Symantec Altiris Deployment Solution versions prior to 6.9.355 SP1, update to version 6.9.355 SP1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer version 7 Description: A remote code execution issue exists due to attempts to access uninitialized memory in certain situations. An attacker could exploit this by constructing a specially crafted Web page. When a user views the Web page, it could allow remote code execution, potentially giving the attacker the same user rights as the logged-on user. Recommendations: For Microsoft Internet Explorer version 7, consider avoiding the use of WebDAV requests for files with long names until a patch is available. As a temporary workaround, restrict access to crafted HTML documents that could trigger memory corruption.

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Basic 6.0 Visual Studio .NET versions 2002 SP1 and 2003 SP1 Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2 Office Project versions 2003 SP3 and 2007 Gold and SP1 Description: A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a crafted AVI file. This triggers an allocation error and memory corruption. The vulnerability can be exploited by constructing a specially crafted web page, potentially leading to remote code execution when viewed. If successfully exploited, an attacker could gain the same user rights as the logged-on user. Recommendations: For Microsoft Visual Basic 6.0, update to a version that includes the fix for this issue. For Visual Studio .NET versions 2002 SP1 and 2003 SP1, apply the necessary patch or update to a newer version. For Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2, consider disabling the use of AVI files until a patch is available. For Office Project versions 2003 SP3 and 2007 Gold and SP1, restrict access to crafted web pages to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Symantec Altiris Deployment Solution versions 6.8.x through 6.9.x before 6.9.176 Description: The issue allows remote attackers to more easily guess encrypted domain credentials due to the generation of credentials with a fixed salt or without any salt by axengine.exe. Recommendations: For Symantec Altiris Deployment Solution versions 6.8.x through 6.9.x before 6.9.176, update to version 6.9.176 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Symantec Altiris Deployment Solution versions 6.8.x through 6.9.x before 6.9.176 Description: The issue allows remote attackers to execute arbitrary SQL commands via unspecified string fields in a notification packet. This is a result of a SQL injection vulnerability in axengine.exe. Recommendations: For versions 6.8.x through 6.9.x before 6.9.176, update to version 6.9.176 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: LizardTech DjVu Browser Plug-in versions prior to 6.1.1 Description: The issue is related to multiple buffer overflows that allow remote attackers to execute arbitrary code. The exact vectors used for the attack are not specified. Recommendations: For versions prior to 6.1.1, update to version 6.1.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue is related to a buffer overflow in the Step-by-Step Interactive Training component of Microsoft Windows. This allows remote attackers to execute arbitrary code via a long Syllabus string in crafted bookmark link files, such as those with .cbo, .cbl, or .cbm extensions. Recommendations: For Microsoft Windows 2000 SP4, XP SP2 and Professional, and Server 2003 SP1, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Project Server 2003 **Description** The issue concerns a problem in the projectserver/logon/pdsrequest.asp file of Microsoft Project Server 2003. It allows remote authenticated users to obtain the MSProjectUser password for a SQL database. This is achieved via a GetInitializationData request. The response to this request includes the information in the `UserName` and `Password` tags. **Recommendations** For Microsoft Project Server 2003, consider restricting access to the projectserver/logon/pdsrequest.asp file to minimize the risk of exploitation. As a temporary workaround, limit the use of the GetInitializationData request until a more permanent solution is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Information Services (IIS) version 5.1 **Description** The issue allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments. This can be demonstrated using win.com when it is in a web directory with certain permissions. The IUSR Machine account can execute non-EXE files such as .COM files. **Recommendations** For Microsoft Internet Information Services (IIS) version 5.1, consider restricting the execution of non-EXE files, such as .COM files, by the IUSR Machine account to minimize the risk of exploitation. As a temporary workaround, consider disabling the execution of .COM files in web directories until a patch is available. Restrict access to sensitive web directories to prevent attackers from executing arbitrary commands.

**Name of the Vulnerable Software and Affected Versions** HyperAccess version 8.4 **Description** The issue allows user-assisted remote attackers to execute arbitrary vbscript and commands. This is achieved via the /r option in a telnet:// URI, which is configured to use hawin32.exe. **Recommendations** For HyperAccess version 8.4, consider disabling the use of the /r option in telnet:// URIs to minimize the risk of exploitation until a patch is available. Restrict access to hawin32.exe to prevent unauthorized execution of commands.

**Name of the Vulnerable Software and Affected Versions** HyperAccess version 8.4 **Description** The issue allows remote attackers to execute arbitrary vbscript and commands via a session file, which can be automatically opened using Internet Explorer. **Recommendations** For HyperAccess version 8.4, consider disabling the automatic opening of session files in Internet Explorer as a temporary workaround until a patch is available. Restrict access to .HAW files to minimize the risk of exploitation. Avoid using Internet Explorer to open untrusted session files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SiteKiosk versions prior to 6.5.150 **Description** A cross-site scripting (XSS) issue exists in the skinning feature, allowing local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser. **Recommendations** For versions prior to 6.5.150, update to version 6.5.150 or later to resolve the issue. As a temporary workaround, consider restricting access to the skinning feature until a patch is available. Avoid using the ABOUT: URI in the title bar of the browser to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Adobe ColdFusion MX versions prior to 7.0.2 **Description** The issue arises from improper filtering of HTML tags, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved by including a NULL byte (%00) in certain HTML tags. For example, using "%00script" in a tag can demonstrate this exploit. **Recommendations** For Adobe ColdFusion MX versions prior to 7.0.2, update to version 7.0.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adobe ColdFusion MX7 **Description** The issue allows remote attackers to obtain sensitive information. This can be achieved through a URL request for a non-existent file, such as a JWS, CFM, CFML, or CFC file, which displays the installation path in the resulting error message. Additionally, accessing /CFIDE/administrator/login.cfm without a host can reveal the server's internal IP address in an HREF tag. **Recommendations** For Adobe ColdFusion MX7, consider restricting access to the /CFIDE/administrator/login.cfm endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the error messages that reveal sensitive information until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Information Services (IIS) versions 5.0 through 6.0 Description: A buffer overflow issue in Microsoft Internet Information Services (IIS) allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP). Recommendations: For versions 5.0 through 6.0, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Skype versions 2.0.*.104 through 2.5.*.78 **Description** The issue is an argument injection vulnerability in the URI handler that allows remote authorized attackers to download arbitrary files via a crafted URL. This can lead to unauthorized information disclosure when a malicious user sends a crafted URL to a targeted user, resulting in a loss of confidentiality. **Recommendations** For Skype versions 2.0.*.104 through 2.5.*.78, avoid using the URI handler until a patch is available. As a temporary workaround, consider restricting access to the URI handler to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue is related to the Web View in Windows Explorer, which does not properly handle certain HTML characters in preview fields. This allows remote user-assisted attackers to execute arbitrary code. Recommendations: For Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebArchiveX.dll version 5.5.0.76 **Description** The issue allows remote attackers to read or write to arbitrary files. This is achieved via the (1) MakeArchive or (2) MakeArchiveStr methods. **Recommendations** For WebArchiveX.dll version 5.5.0.76, consider disabling the MakeArchive and MakeArchiveStr methods until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Step-by-Step Interactive Training (orun32.exe) (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code via a bookmark link file with a long `User` field. This can be achieved by using files with .cbo, .cbl, or .cbm extensions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SecureCRT versions 4.0 through 4.1 **Description** The issue allows remote attackers to execute arbitrary commands via a telnet:// URL that uses the /F option to specify a configuration file on a samba share. **Recommendations** For versions 4.0 and 4.1, consider disabling the use of the /F option to specify configuration files from samba shares until a patch is available. As a temporary workaround, restrict access to configuration files on samba shares to minimize the risk of exploitation.