Mark Litchfield

**Name of the Vulnerable Software and Affected Versions** SAP Message Server (affected versions not specified) **Description** The issue is related to a heap-based buffer overflow in the Message HTTP Server. This can be exploited by remote attackers to execute arbitrary code. The exploitation occurs via a long string in the `group` parameter to the "/msgserver/html/group" API endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP GUI (affected versions not specified) **Description** The issue is related to a stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control. This control is located in the FrontEndSapGuikwedit.dll component of the SAP GUI. The overflow can be triggered by passing a long argument to the PrepareToPostHTML function, potentially allowing remote attackers to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP NetWeaver Application Server versions 6.x through 7.x **Description** The issue allows remote attackers to cause a denial of service, resulting in a process crash. This is achieved by sending a URI of a certain length that contains a `sap-isc-key` parameter, which is related to the configuration of a web cache. **Recommendations** For SAP NetWeaver Application Server versions 6.x through 7.x, consider restricting access to the web cache configuration to minimize the risk of exploitation. As a temporary workaround, avoid using the `sap-isc-key` parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP GUI (affected versions not specified) **Description** The issue involves unspecified vulnerabilities in ActiveX controls within the SAP GUI, allowing remote attackers to create certain files through unspecified vectors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP GUI (affected versions not specified) **Description** The issue involves multiple unspecified vulnerabilities in ActiveX controls within the SAP GUI, allowing remote attackers to cause a denial of service, specifically a process crash, via unspecified vectors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EnjoySAP SAP GUI (affected versions not specified) **Description** The issue is related to a heap-based buffer overflow in the rfcguisink.rfcguisink.1 ActiveX control. This can be exploited by remote attackers to execute arbitrary code by providing a long first argument to the `LaunchGui` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Symantec Automated Support Assistant (affected versions not specified) Norton AntiVirus (affected versions not specified) Norton Internet Security (affected versions not specified) Norton System Works 2006 (affected versions not specified) Description: The issue is related to multiple buffer overflows in the SupportSoft ActiveX controls, specifically in the SmartIssue and ScriptRunner components. This allows remote attackers to execute arbitrary code via a crafted HTML message. Recommendations: For Symantec Automated Support Assistant, update to a version that includes the fix for the buffer overflows in the SmartIssue and ScriptRunner ActiveX controls. For Norton AntiVirus, update to a version that includes the fix for the buffer overflows in the SmartIssue and ScriptRunner ActiveX controls. For Norton Internet Security, update to a version that includes the fix for the buffer overflows in the SmartIssue and ScriptRunner ActiveX controls. For Norton System Works 2006, update to a version that includes the fix for the buffer overflows in the SmartIssue and ScriptRunner ActiveX controls. As a temporary workaround, consider disabling the `tgctlsi.dll` and `tgctlsr.dll` ActiveX controls until a patch is available.

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook versions 2000 through 2003 Microsoft Exchange 5.0 Server version SP2 Microsoft Exchange 5.0 Server version SP4 Microsoft Exchange 2000 version SP3 Microsoft Office (affected versions not specified) Description: The issue is related to a remote code execution vulnerability due to improper decoding of Transport Neutral Encapsulation Format (TNEF) MIME attachments in e-mail messages. This allows remote attackers to execute arbitrary code via a crafted attachment. The vulnerability is also related to message length validation. Recommendations: For Microsoft Outlook versions 2000 through 2003, consider disabling the handling of TNEF MIME attachments until a fix is available. For Microsoft Exchange 5.0 Server versions SP2 and SP4, restrict access to TNEF encoded messages to minimize the risk of exploitation. For Microsoft Exchange 2000 version SP3, avoid processing e-mail messages with crafted TNEF attachments until the issue is resolved. For Microsoft Office, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VERITAS Storage Exec versions prior to 5.3 Hotfix 9 VERITAS StorageCentral versions prior to 5.2 Hot Fix 2 **Description** The issue is related to multiple heap-based and stack-based buffer overflows in certain DCOM server components. This allows remote attackers to execute arbitrary code via certain ActiveX controls. **Recommendations** For VERITAS Storage Exec versions prior to 5.3 Hotfix 9, apply Hotfix 9 to resolve the issue. For VERITAS StorageCentral versions prior to 5.2 Hot Fix 2, apply Hot Fix 2 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: VERITAS Backup Exec Web Administration Console (BEWAC) versions 9.0 4367 through 10.0 rev. 5484 Description: A buffer overflow issue allows remote attackers to execute arbitrary code. Recommendations: For versions 9.0 4367 through 10.0 rev. 5484, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows XP and Windows Server 2003 **Description** A buffer overflow issue in the Web Client service allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters. **Recommendations** For Microsoft Windows XP and Windows Server 2003, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Apple iTunes versions prior to 4.8 Description: A buffer overflow issue allows remote attackers to execute arbitrary code via a crafted MPEG4 file. Recommendations: For versions prior to 4.8, update to version 4.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Lotus Domino Server versions 6.0.5 through 6.5.4 **Description** The issue is related to multiple buffer overflows that can be triggered by sending large amounts of data in certain time or date fields. This can cause a denial of service, resulting in an application crash, and potentially allow the execution of arbitrary code. **Recommendations** For Lotus Domino Server versions 6.0.5 through 6.5.4, consider restricting access to the time and date fields to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sybase Adaptive Server Enterprise (ASE) XP Server versions prior to 12.5.3 ESD#1 **Description** The issue allows attackers to cause a denial of service, resulting in a process crash, by sending malformed data to the XP Server TCP port. **Recommendations** For versions prior to 12.5.3 ESD#1, update to version 12.5.3 ESD#1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** RealPlayer versions 10.5 (6.0.12.1056 and earlier), 10, 8 RealOne Player versions V2 and V1 **Description** A heap-based buffer overflow issue allows remote attackers to execute arbitrary code via .WAV files. **Recommendations** For RealPlayer versions 10.5 (6.0.12.1056 and earlier), 10, 8, update to a version later than 6.0.12.1056 to resolve the issue. For RealOne Player versions V2 and V1, update to a version later than V2 to resolve the issue. As a temporary workaround, consider avoiding the use of .WAV files with the affected RealPlayer and RealOne Player versions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** AtHoc toolbar (affected versions not specified) **Description** The issue is related to a stack-based buffer overflow in the SetSkin function, which allows remote attackers to execute arbitrary code via a long skin name. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sybase Adaptive Server Enterprise (ASE) versions prior to 12.5.3 ESD#1 **Description** The issue allows remote authenticated users to execute arbitrary code via several vulnerable functions, including the `attrib valid` function, `covert` function, `declare` statement, or a crafted query plan. Additionally, remote authenticated users with database owner or "sa" role privileges can execute arbitrary code via a crafted install java statement. **Recommendations** For versions prior to 12.5.3 ESD#1, update to version 12.5.3 ESD#1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `attrib valid` function, `covert` function, `declare` statement, and install java statement to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AtHoc toolbar (affected versions not specified) **Description** The issue is related to a format string vulnerability in the SetBaseURL function. This vulnerability allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Norton Internet Security version 2004 **Description** The issue concerns the WrapNISUM ActiveX component, specifically the WrapUM.dll file, which is marked as safe for scripting. This marking allows remote attackers to execute arbitrary programs by utilizing the LaunchURL method. **Recommendations** For Norton Internet Security version 2004, consider disabling the WrapUM.dll file or restricting its use to prevent exploitation until a fix is available.

**Name of the Vulnerable Software and Affected Versions** Norton Internet Security 2004 **Description** The issue is related to a stack-based buffer overflow in the SymSpamHelper ActiveX component. This occurs when a long parameter is passed to the `LaunchCustomRuleWizard` method, allowing remote attackers to execute arbitrary code. **Recommendations** For Norton Internet Security 2004, consider disabling the `LaunchCustomRuleWizard` method in the SymSpamHelper ActiveX component as a temporary workaround until a patch is available. Restrict access to the `symspam.dll` component to minimize the risk of exploitation.