Peter Winter-Smith

**Name of the Vulnerable Software and Affected Versions** libssh versions prior to 0.7.6 libssh versions prior to 0.8.4 **Description** A vulnerability was found in libssh's server-side state machine. It allows a malicious client to create channels without first performing authentication, resulting in unauthorized access. The issue is related to errors in the authentication procedure, which can be exploited by a remote attacker using a specially crafted message to bypass authentication. **Recommendations** For versions prior to 0.7.6, update to version 0.7.6 or later. For versions prior to 0.8.4, update to version 0.8.4 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 7 through 9 **Description** The issue arises from the improper handling of objects in memory, allowing remote attackers to execute arbitrary code. This can occur when accessing an object that was not properly initialized or has been deleted, potentially corrupting memory in a way that enables an attacker to execute arbitrary code in the context of the logged-on user. **Recommendations** For Microsoft Internet Explorer versions 7 through 9, update to a version that properly handles objects in memory to prevent arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Media Format Runtime versions 9.0, 9.5, and 11 Windows Media Services versions 9.1 and 2008 **Description** The issue arises from the improper parsing of malformed headers in Advanced Systems Format (ASF) files, which can lead to the execution of arbitrary code. This can be achieved by a remote attacker through a crafted file with extensions such as .asf, .wmv, or .wma. **Recommendations** For Microsoft Windows Media Format Runtime versions 9.0, 9.5, and 11, update to a version that properly handles ASF file headers to prevent arbitrary code execution. For Windows Media Services versions 9.1 and 2008, apply the necessary patches or updates to ensure correct parsing of ASF file headers and prevent exploitation.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows 2000 Server SP4 Description: The issue is related to the LDAP service in Windows Active Directory, where it does not properly check the number of convertible attributes. This allows remote attackers to cause a denial of service via a crafted LDAP request, related to client sent LDAP request logic. Recommendations: For Microsoft Windows 2000 Server SP4, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** PGP Desktop versions prior to 9.5.1 **Description** The issue concerns the lack of validation for data objects received over specific named pipes, allowing remote authenticated users to gain privileges. This is achieved by sending a data object that represents an absolute pointer, leading to code execution at the corresponding address. The affected named pipes are related to PGPServ.exe and PGPsdkServ.exe. **Recommendations** For versions prior to 9.5.1, update to version 9.5.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 Microsoft Windows Server 2003 up to SP1 **Description** A buffer overflow issue exists in the Client Service for NetWare (CSNW) component, allowing remote attackers to execute arbitrary code through crafted messages. This issue is also known as the "Client Service for NetWare Memory Corruption" problem. **Recommendations** For Microsoft Windows 2000 SP4, apply the necessary patch to fix the buffer overflow issue in CSNW. For Microsoft Windows XP SP2, apply the necessary patch to fix the buffer overflow issue in CSNW. For Microsoft Windows Server 2003 up to SP1, apply the necessary patch to fix the buffer overflow issue in CSNW.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to Windows 2000 SP4, XP SP3, and Server 2003 SP2 **Description** A buffer overflow issue exists in the Remote Access Connection Manager service (RASMAN) of Microsoft Windows, allowing remote attackers to execute arbitrary code via crafted RPC related requests. This leads to registry corruption and stack corruption. **Recommendations** For Windows 2000 SP4 and earlier, XP SP1 and SP2, and Server 2003 SP1 and earlier, apply the necessary patches to update to a non-vulnerable version, such as Windows 2000 SP4, XP SP3, or Server 2003 SP2. As a temporary workaround, consider restricting access to the RASMAN service until a patch is available.

**Name of the Vulnerable Software and Affected Versions** LISTSERV versions 14.3 through 14.4 **Description** The issue is related to multiple buffer overflows in the web archive interface of LISTSERV, including LISTSERV Lite and HPO. This allows remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI. **Recommendations** For LISTSERV versions 14.3 through 14.4, consider disabling the web archive interface until a patch is available. Restrict access to the WA CGI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 **Description** The issue concerns the URL parser in Microsoft Internet Information Services (IIS) 5.1, allowing remote attackers to execute arbitrary code. This is achieved through multiple requests to ".dll" followed by specific arguments, such as `~0` through `~9`, which causes ntdll.dll to produce a return value that IIS does not handle correctly. An example of such a request is "/ vti bin/.dll/*/~0". Initially, it was believed that the consequence of this issue would only be a denial of service, resulting in an application crash and reboot. **Recommendations** For Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2, consider restricting access to the URL parser or applying specific configuration changes to handle the return value from ntdll.dll correctly until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel versions 2000 through 2003 Microsoft Office version 2000 SP3 **Description** The issue allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range, potentially leading to memory corruption. This can be exploited by constructing a specially crafted Excel file, allowing remote code execution. **Recommendations** For Microsoft Excel versions 2000 through 2003, update to a version that is not affected by this issue. For Microsoft Office version 2000 SP3, consider applying security patches or updates that address this vulnerability. As a temporary workaround, consider restricting the use of Excel files from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sun Java System Directory Server versions 5.2 2003Q4 through 5.2 2005Q1 Red Hat Directory Server (affected versions not specified) Certificate Server versions prior to 7.1 SP1 Sun ONE Directory Server versions 5.1 SP4 and earlier Sun ONE Administration Server version 5.2 **Description** The issue is a stack-based buffer overflow in the help.cgi component of the HTTP administrative interface. This can be exploited by remote attackers to cause a denial of service, resulting in the admin server crashing. Local users can also exploit this issue to gain root privileges. **Recommendations** For Sun Java System Directory Server versions 5.2 2003Q4 through 5.2 2005Q1, update to a version later than 5.2 2005Q1. For Red Hat Directory Server, contact the vendor for a fix. For Certificate Server versions prior to 7.1 SP1, update to version 7.1 SP1 or later. For Sun ONE Directory Server versions 5.1 SP4 and earlier, update to a version later than 5.1 SP4. For Sun ONE Administration Server version 5.2, update to a version later than 5.2.

**Name of the Vulnerable Software and Affected Versions** iMonitor for Novell eDirectory version 8.7.3 **Description** A buffer overflow issue in the dhost.exe component allows attackers to cause a denial of service, resulting in a crash, and potentially obtain access to files. The exact vectors used for the attack are not specified. **Recommendations** For iMonitor for Novell eDirectory version 8.7.3, consider restricting access to the dhost.exe component to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to XP SP3 and Server 2003 SP2 **Description** The issue is caused by an integer overflow in Microsoft Windows, allowing remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file. This can be triggered by a large size field that causes a heap-based buffer overflow. The vulnerability can be exploited using a "ms-its:" URL in Internet Explorer. **Recommendations** For Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier, update to a newer version to mitigate the risk. For versions prior to XP SP3, apply the necessary patches or updates to resolve the issue. For Server 2003 SP2, ensure all security updates are applied to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** LISTSERV versions 14.3, 1.8e, 1.8d **Description** The issue involves multiple unknown vulnerabilities that allow remote attackers to execute arbitrary code or cause a denial of service. **Recommendations** For versions 14.3, 1.8e, and 1.8d, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Winamp versions 2.91 through 5.02 **Description** A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a Fasttracker 2 (.xm) mod media file. **Recommendations** For versions 2.91 through 5.02, update to a version that contains a fix for this issue to prevent arbitrary code execution.

**Name of the Vulnerable Software and Affected Versions** WinRAR version 3.40 **Description** The issue is related to the Repair Archive command in WinRAR, which can be exploited by remote attackers to cause a denial of service, resulting in an application crash. This is achieved by using a corrupt ZIP archive. The problem is triggered when the Repair command is used on a corrupt ZIP archive, leading to a loss of availability for the service. **Recommendations** For WinRAR version 3.40, as a temporary workaround, consider disabling the Repair Archive command until a patch is available. Restrict access to the Repair function to minimize the risk of exploitation. Avoid using the Repair command on untrusted or potentially corrupt ZIP archives until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer versions 5.01 through 6 **Description** The issue is related to an integer overflow in the Install Engine, which can be triggered by a malicious website or HTML email containing a long .CAB file name. This leads to a heap-based buffer overflow, allowing remote attackers to execute arbitrary code. **Recommendations** For Internet Explorer versions 5.01 through 6, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions 2000 through 2003 Microsoft Works Suites versions 2001 through 2004 **Description** A buffer overflow issue exists in the converter for Microsoft WordPerfect 5.x, allowing remote attackers to execute arbitrary code via a malicious document or website. **Recommendations** For Microsoft Office versions 2000 through 2003, update to a version that includes the fix for this issue. For Microsoft Works Suites versions 2001 through 2004, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of the WordPerfect 5.x converter until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Windows 2000 Windows XP Internet Explorer 6 on Windows NT 4.0 **Description** A stack-based buffer overflow issue allows local or remote attackers to execute arbitrary code via a .job file containing long parameters. This can be exploited by accessing a .job file on an anonymous share using Internet Explorer. **Recommendations** For Windows 2000, update to a version that includes the fix for this issue. For Windows XP, update to a version that includes the fix for this issue. For Internet Explorer 6 on Windows NT 4.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to .job files on anonymous shares to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Palace versions 3.5 and earlier **Description** A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via a link to a "palace:// url" followed by a long server address string. **Recommendations** For versions 3.5 and earlier, update to a version later than 3.5 to resolve the issue.