Kf

**Name of the Vulnerable Software and Affected Versions** eIQnetworks Enterprise Security Analyzer (ESA) versions prior to 2.5.0 **Description** The issue allows remote attackers to execute arbitrary code via long commands to various servers, including the Syslog daemon, Topology server, License Manager, and Monitoring agent. The affected commands include `DELTAINTERVAL`, `LOGFOLDER`, `DELETELOGS`, `FWASERVER`, `SYSLOGPUBLICIP`, `GETFWAIMPORTLOG`, `GETFWADELTA`, `DELETERDEPDEVICE`, `COMPRESSRAWLOGFILE`, `GETSYSLOGFIREWALLS`, `ADDPOLICY`, `EDITPOLICY`, `GUIADDDEVICE`, `ADDDEVICE`, `DELETEDEVICE`, `LICMGR ADDLICENSE`, `TRACE`, and `QUERYMONITOR`. **Recommendations** For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable commands and servers, such as the Syslog daemon, Topology server, License Manager, and Monitoring agent, until a patch is available. Avoid using long commands to these servers to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** freeFTPd versions prior to 1.0.9 **Description** The issue is a stack-based buffer overflow that can be triggered when Logging is enabled. It allows remote attackers to cause a denial of service, potentially leading to application crashes. In some cases, it may also be possible for attackers to execute arbitrary code. This is achieved by sending a long USER command. **Recommendations** For versions prior to 1.0.9, update to version 1.0.9 or later to resolve the issue. As a temporary workaround, consider disabling the Logging feature until a patch is available. Restrict access to the USER command to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: IBM Informix Dynamic Server (IDS) versions prior to 9.40.xC3 Description: The issue allows local users to execute arbitrary code via a modified INFORMIXDIR environment variable that points to a file with format string specifiers in the filename. Recommendations: For versions prior to 9.40.xC3, update to version 9.40.xC3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** BlackICE PC Protection versions 3.6 and earlier **Description** The issue allows local users to modify configuration or possibly execute arbitrary code by exploiting vulnerabilities in the .INI parsers, due to insecure permissions set for .INI files such as `blackice.ini`, `firewall.ini`, `protect.ini`, or `sigs.ini`. **Recommendations** For BlackICE PC Protection versions 3.6 and earlier, consider restricting access to the .INI files to prevent modification and potential code execution until a proper fix is applied. As a temporary workaround, manually set secure permissions for the .INI files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BlackICE PC Protection versions prior to 3.6.ccb **Description** A buffer overflow issue exists in the blackd.exe component, allowing local users to gain system privileges. This can be achieved by modifying the .INI file to include a long `packetLog.fileprefix` value when application protection is off. **Recommendations** For BlackICE PC Protection versions prior to 3.6.ccb, update to version 3.6.ccb or later to resolve the issue. As a temporary workaround, consider restricting modifications to the .INI file to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Carbon Copy version 6.0.5257 **Description** The issue allows local users to gain privileges via the help topic interface in CCW32.exe, which launches Notepad, or the help button in the Carbon Copy Scheduler (CCSched.exe), because system privileges are not dropped when opening external programs. **Recommendations** For Carbon Copy version 6.0.5257, consider restricting access to the help topic interface in CCW32.exe and the help button in CCSched.exe to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP DB Development Tools versions 7.x **Description** The issue concerns the instdbmsrv and instlserver programs in SAP DB Development Tools, which trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program. This allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program. **Recommendations** For SAP DB Development Tools versions 7.x, consider restricting access to the INSTROOT environment variable to prevent malicious modifications. As a temporary workaround, restrict the execution of the lserver program to trusted users only until a patch is available.

**Name of the Vulnerable Software and Affected Versions** SAP DB versions 7.x **Description** The RPM installation of SAP DB creates certain programs with world-writable permissions, allowing local users to gain privileges by modifying those programs. Specifically, the programs `dbmsrv` or `lserver` are created with these permissions. **Recommendations** For SAP DB version 7.x, change the permissions of the `dbmsrv` and `lserver` programs to prevent world-writable access. As a temporary workaround, consider restricting access to these programs until a proper fix is applied.

**Name of the Vulnerable Software and Affected Versions** Symantec LiveUpdate versions 1.70.x through 1.90.x Norton Internet Security versions 2001 through 2004 SystemWorks versions 2001 through 2004 Norton AntiVirus Pro versions 2001 through 2004 AntiVirus for Handhelds version v3.0 **Description** The issue allows local users to gain SYSTEM privileges due to a problem in the GUI functionality for an interactive session in Symantec LiveUpdate. **Recommendations** For Symantec LiveUpdate versions 1.70.x through 1.90.x, consider restricting access to the GUI functionality for an interactive session until a fix is available. For Norton Internet Security versions 2001 through 2004, SystemWorks versions 2001 through 2004, and Norton AntiVirus Pro versions 2001 through 2004, restrict the use of the affected Symantec LiveUpdate component to minimize the risk of exploitation. For AntiVirus for Handhelds version v3.0, avoid using the affected Symantec LiveUpdate functionality until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Symantec PCAnywhere versions 10.x through 11.x **Description** The issue allows attackers to gain SYSTEM privileges via the help interface using AWHOST32.exe when Symantec PCAnywhere is started as a service. **Recommendations** For Symantec PCAnywhere versions 10.x through 11.x, consider disabling the help interface or restricting access to AWHOST32.exe until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Clam AntiVirus versions 0.60 through 0.60p Clam AntiVirus versions prior to 0.65 **Description** The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in the `email address` argument of a "MAIL FROM" command. **Recommendations** For Clam AntiVirus versions 0.60 through 0.60p, update to version 0.65 or later. For Clam AntiVirus versions prior to 0.65, update to version 0.65 or later.

Name of the Vulnerable Software and Affected Versions: Backup and Restore Utility for Unix (BRU) versions 17.0 and earlier Description: The issue allows local users to execute arbitrary code via a long command line argument when the utility is running setuid. Recommendations: For Backup and Restore Utility for Unix (BRU) versions 17.0 and earlier, consider updating to a version later than 17.0 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Backup and Restore Utility for Unix (BRU) versions 17.0 and earlier Description: The issue allows local users to execute arbitrary code via format string specifiers in a command line argument when the utility is running setuid. Recommendations: For versions 17.0 and earlier, update to a version later than 17.0 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: cdrtools versions 2.01 and earlier Description: The issue allows local users to overwrite arbitrary files and gain root privileges by specifying the target file as a command line argument, which is modified while rscsi is running with privileges. Recommendations: For versions 2.01 and earlier, update to a version later than 2.01 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: IBM U2 UniVerse version 10.0.0.9 and earlier Description: The issue allows local users to gain privileges by deleting and overwriting arbitrary files, as `cci dir` in IBM U2 UniVerse creates hard links and unlinks files as root. Recommendations: For IBM U2 UniVerse version 10.0.0.9 and earlier, consider restricting the `cci dir` functionality to prevent local users from gaining privileges by deleting and overwriting arbitrary files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM U2 UniVerse versions 10.0.0.9 and earlier Description: A buffer overflow issue exists in the uvadmsh component, allowing the uvadm user to execute arbitrary code via a long command line argument, specifically the -uv.install option. Recommendations: For IBM U2 UniVerse versions 10.0.0.9 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: IBM U2 UniVerse versions 10.0.0.0 through 10.0.0.9 Description: The issue allows local users to gain privileges by exploiting a trust in the user-supplied -uv.install command line option. This option is used to find and execute the uv.install program. If a user provides a pathname that is under their control, they can potentially exploit this to elevate their privileges. Recommendations: For IBM U2 UniVerse versions 10.0.0.0 through 10.0.0.9, consider restricting access to the uv.install program to minimize the risk of exploitation. As a temporary workaround, consider disabling the execution of the uv.install program based on user-supplied pathnames until a fix is available.

Name of the Vulnerable Software and Affected Versions: Progress 4GL Compiler versions 9.1D06 and earlier Description: A buffer overflow issue allows attackers to execute arbitrary code via source code containing a long, invalid data type. Recommendations: For Progress 4GL Compiler versions 9.1D06 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Progress Database versions 9.1 to 9.1D06 Description: The issue allows local users to gain privileges by exploiting the trust in user input to find and load libraries using `dlopen()`. This can be achieved through manipulating the `PATH` environment variable to point to malicious libraries, such as `libjutil.so` in ` proapsv`, or by utilizing the `-installdir` command line parameter with malicious libraries like `librocket r.so` in ` dbagent`. Recommendations: For Progress Database versions 9.1 to 9.1D06, consider restricting access to the `dlopen()` function or limiting the ability to modify the `PATH` environment variable and the `-installdir` command line parameter to prevent privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Options Parsing Tool (OPT) shared library versions 3.18 and earlier Description: The issue is related to multiple buffer overflows in the OPT shared library. When used in setuid programs, local users may be able to execute arbitrary code via long command line options that are fed into macros such as `opt warn 2`, as used in functions such as `opt atoi()`. Recommendations: For Options Parsing Tool (OPT) shared library versions 3.18 and earlier, consider updating to a version later than 3.18 to resolve the issue. As a temporary workaround, consider restricting the use of the OPT shared library in setuid programs to minimize the risk of exploitation.