Daniel Fabian

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server 2000 versions SP1 through SP3 **Description** The issue is related to a cross-site scripting (XSS) vulnerability when running Outlook Web Access (OWA). It allows remote attackers to inject arbitrary HTML or web script via unknown vectors related to HTML parsing. An attacker could exploit this by constructing an e-mail message with a specially crafted script, which would execute in the security context of the user on the client if run. This requires user interaction. **Recommendations** For Microsoft Exchange Server 2000 versions SP1 through SP3, consider disabling Outlook Web Access (OWA) until a patch is available to prevent exploitation of the script injection vulnerability. Restrict access to HTML parsing components to minimize the risk of arbitrary HTML or web script injection. Avoid using OWA for sensitive operations until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: SugarCRM Sugar Sales versions prior to 2.0.1a Description: The issue allows remote attackers to execute arbitrary SQL commands and gain privileges. This is achieved via the `record` parameter in a DetailView action to "index.php", and `record` parameters in other functionality. Recommendations: For versions prior to 2.0.1a, update to version 2.0.1a or later to resolve the issue. As a temporary workaround, consider restricting access to the DetailView action in index.php to minimize the risk of exploitation. Avoid using the `record` parameter in affected functionality until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: SugarCRM Sugar Sales versions 2.0.1c and earlier Description: The issue allows remote attackers to gain sensitive information via certain requests to scripts that contain invalid input, which reveals the path in an error message. This can be demonstrated using the phprint.php script with an empty `module` parameter. Recommendations: For SugarCRM Sugar Sales versions 2.0.1c and earlier, consider restricting access to the phprint.php script until a fix is available. As a temporary workaround, avoid using the phprint.php script with an empty `module` parameter to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: SugarCRM Sugar Sales versions 2.0.1c and earlier Description: The issue arises from the install scripts not being removed after installation, allowing attackers to obtain the MySQL administrative password in cleartext or cause a denial of service by altering database settings to their default values. Recommendations: For SugarCRM Sugar Sales versions 2.0.1c and earlier, remove the install scripts after installation to prevent potential attacks.

Name of the Vulnerable Software and Affected Versions: SugarCRM Sugar Sales versions 2.0.1c and earlier Description: A directory traversal issue allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. (dot dot) sequences in the `module`, `action`, or `theme` parameters to "index.php", the `theme` parameter to "Login.php", and possibly other parameters or scripts. Recommendations: For SugarCRM Sugar Sales versions 2.0.1c and earlier, as a temporary workaround, consider restricting access to the vulnerable parameters `module`, `action`, and `theme` in "index.php" and the `theme` parameter in "Login.php" until a patch is available.

Name of the Vulnerable Software and Affected Versions: KDE versions 3.2.x through 3.3.2 Description: The issue allows local users to obtain usernames and passwords for remote resources, such as SMB shares, because credentials are stored in plaintext in the user's .desktop file. This file may be created with world-readable permissions, which could be exploited to gain access to sensitive information. The credentials in question are either manually entered by the user or created by the SMB protocol handler. Recommendations: For KDE versions 3.2.x through 3.3.2, consider restricting access to the .desktop file to prevent local users from obtaining the stored credentials. As a temporary workaround, avoid using the SMB protocol handler to create credentials until a proper fix is available. Additionally, ensure that the .desktop file is created with appropriate permissions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LIN:BOX (affected versions not specified) **Description** The issue allows remote attackers to bypass authentication, obtain sensitive information, or gain access via a direct request to "admin/user.pl" preceded by a double leading slash (//). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.