Cesar Cerrudo

**Name of the Vulnerable Software and Affected Versions** Iridium satellite terminals (affected versions not specified) **Description** The issue allows remote attackers to read hardcoded credentials via the web interface on the Pilot Below Deck Equipment (BDE) and OpenPort implementations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Iridium satellite terminals (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code by uploading new firmware to the TCP port 54321. This is related to the Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Digital Alert Systems DASDEC EAS device versions prior to 2.0-2 Monroe Electronics R189 One-Net EAS device versions prior to 2.0-2 **Description** The default configuration of the affected devices contains a known SSH private key, allowing remote attackers to obtain root access and spoof alerts via an SSH session. **Recommendations** For Digital Alert Systems DASDEC EAS device versions prior to 2.0-2, update to version 2.0-2 or later to resolve the issue. For Monroe Electronics R189 One-Net EAS device versions prior to 2.0-2, update to version 2.0-2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through SP2 and R2 Microsoft Windows 7 (affected versions not specified) **Description** The issue arises from the Consent User Interface (UI) not properly handling an unspecified registry-key value. This allows local users with SeImpersonatePrivilege rights to gain privileges via a crafted application. The vulnerability could allow an attacker to run code with elevated privileges, potentially executing arbitrary code and taking complete control of an affected system. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Windows Vista versions SP1 through SP2, update to a version that properly handles registry-key values to prevent elevation of privilege. For Microsoft Windows Server 2008 versions Gold through SP2 and R2, apply a configuration change to restrict the Consent UI's ability to process special registry values. For Microsoft Windows 7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through SP2 and R2 Microsoft Windows 7 (affected versions not specified) **Description** The issue arises from incorrect access control lists (ACLs) on the registry keys for the Tracing Feature for Services in Microsoft Windows. This could allow an attacker to run code with elevated privileges, potentially leading to the execution of arbitrary code and complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Windows Vista versions SP1 through SP2, update to a version with the correct ACLs on the registry keys for the Tracing Feature for Services. For Microsoft Windows Server 2008 versions Gold through SP2 and R2, update to a version with the correct ACLs on the registry keys for the Tracing Feature for Services. For Microsoft Windows 7, update to a version with the correct ACLs on the registry keys for the Tracing Feature for Services.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through SP2 and R2 Microsoft Windows 7 (affected versions not specified) **Description** The issue arises from the Tracing Feature for Services not properly determining the length of strings in the registry. This allows local users to gain privileges or cause a denial of service through memory corruption by using a long string. An elevation of privilege vulnerability exists due to the way the Tracing Feature for Services allocates memory when processing specially crafted long strings from the registry. An attacker who successfully exploits this could run arbitrary code with system-level privileges, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Windows Vista versions SP1 through SP2, update to a version that includes the fix for the Tracing Memory Corruption Vulnerability. For Microsoft Windows Server 2008 versions Gold through SP2 and R2, apply the necessary patch to resolve the elevation of privilege vulnerability. For Microsoft Windows 7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.6 **Description** The issue allows remote attackers to discover a redirect's target URL for a specific user's session on a web site. This is achieved by placing the site's URL in the HREF attribute of a stylesheet LINK element within an IFRAME, and then reading the `document.styleSheets[0].href` property value. **Recommendations** For versions prior to 3.6, update to version 3.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Safari (affected versions not specified) **Description** The issue allows remote attackers to discover a redirect's target URL for a specific user's session on a web site. This can be achieved by placing the site's URL in the HREF attribute of a stylesheet LINK element and then reading the `document.styleSheets[0].href` property value. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebKit versions before r53607 Google Chrome versions before 4.0.249.89 **Description** The issue allows remote attackers to discover a redirect's target URL for a specific user's session on a web site. This is achieved by placing the site's URL in the HREF attribute of a stylesheet LINK element within an IFRAME element, and then reading the `document.styleSheets[0].href` property value. **Recommendations** For WebKit versions before r53607, update to version r53607 or later. For Google Chrome versions before 4.0.249.89, update to version 4.0.249.89 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 versions SP1 through SP2 **Description** The issue arises from the RPCSS service in Microsoft Windows not properly isolating processes running under the NetworkService or LocalService accounts. This allows local users to gain privileges by accessing the resources of one of the processes. An attacker could exploit this to run code with elevated privileges, potentially executing arbitrary code and taking complete control of the affected system. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Windows XP versions SP2 through SP3, update to a version that includes the fix for this issue. For Microsoft Windows Server 2003 versions SP1 through SP2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the RPCSS service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version **Description** The issue arises from the Windows Management Instrumentation (WMI) provider not properly isolating processes running under the NetworkService or LocalService accounts. This could allow an attacker to run code with elevated privileges, potentially leading to the execution of arbitrary code and complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Windows versions prior to the fixed version, update to the latest version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Vista versions prior to SP2 Windows Server 2008 versions prior to SP2 **Description** The issue arises from the improper implementation of isolation among processes running under the same account, allowing local users to gain privileges by accessing resources of other processes due to incorrect thread ACLs. This could enable an attacker to run code with elevated privileges, potentially leading to the execution of arbitrary code and complete control of the affected system. An attacker could then perform various malicious actions such as installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights. **Recommendations** For Windows Vista versions prior to SP2, update to SP2 or a later service pack to resolve the issue. For Windows Server 2008 versions prior to SP2, update to SP2 or a later service pack to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** IBM DB2 versions 8.0 through 8.0 FP15 IBM DB2 versions 9.1 through 9.1 FP3 IBM DB2 versions 9.5 through 9.5 FP0 **Description** The issue allows remote authenticated users to overwrite arbitrary files via the log file parameter in the NNSTAT procedure. **Recommendations** For IBM DB2 version 8, update to at least FP16 to resolve the issue. For IBM DB2 version 9.1, update to at least FP4a to resolve the issue. For IBM DB2 version 9.5, update to at least FP1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fix, including Windows XP Professional SP2, Vista, Server 2003, and Server 2008 **Description** The issue is related to the improper management of the SeImpersonatePrivilege user right, allowing context-dependent attackers to gain privileges. This is due to the Microsoft Distributed Transaction Coordinator (MSDTC) transaction facility leaving a NetworkService token that can be impersonated by any process that calls into it. An attacker who successfully exploits this issue could execute arbitrary code and take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Windows XP Professional SP2, Vista, Server 2003, and Server 2008, update to a version that includes the fix for this issue to prevent privilege escalation. For systems where updating is not immediately possible, consider restricting the SeImpersonatePrivilege user right to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions 2000 through 2000 SP4 Microsoft Windows versions XP through SP2 Description: A privilege elevation issue exists in the Graphics Rendering Engine, allowing local users to cause a denial of service and gain privileges. This is due to the engine mapping GDI Kernel structures on a global shared memory section that can be remapped by other processes as read-write, enabling modification of kernel structures. The vulnerability could allow a logged-on user to take complete control of the system. Recommendations: For Microsoft Windows 2000 through 2000 SP4, apply the necessary security patches to fix the Graphics Rendering Engine issue. For Microsoft Windows XP through SP2, apply the necessary security patches to fix the Graphics Rendering Engine issue.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server versions 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 **Description** The issue is related to an unspecified vulnerability in the Net Listener component of the Oracle Database server. The impact and attack vectors of this issue are not specified. **Recommendations** For Oracle Database server version 8.1.7.4, update to a version that includes the fix for this issue. For Oracle Database server version 9.0.1.5, update to a version that includes the fix for this issue. For Oracle Database server version 9.0.1.5 FIPS, update to a version that includes the fix for this issue. For Oracle Database server version 9.2.0.7, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions prior to 6.0-STABLE **Description** The issue is related to an integer overflow in the IEEE 802.11 network subsystem, specifically in the ieee80211 ioctl.c file. This occurs while scanning for wireless networks and allows remote attackers to execute arbitrary code. The attack can be carried out by broadcasting crafted beacon or probe response frames. **Recommendations** For versions prior to 6.0-STABLE, update to version 6.0-STABLE or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server version 10.1.0.5 **Description** The issue affects the Oracle Database server and involves multiple unspecified vulnerabilities in various components, including the Data Pump, Net Listener, and Oracle Text components. Specifically, it is claimed by a reliable independent researcher that one of the vulnerabilities, DB06, is a SQL injection issue in certain functions within the DBMS DATAPUMP module, including `GENERATE JOB NAME`, `GET WORKERSTATUSLIST1010`, `GET PARAMVALUES1010`, `GET DUMPFILESET1010`, `GET JOBSTATUS1010`, `ATTACH`, and `ESTABLISH REMOTE CONTEXT`. The exact impact and attack vectors are not specified due to unavailable details from Oracle. **Recommendations** For Oracle Database server version 10.1.0.5, as a temporary workaround, consider restricting access to the affected functions in the DBMS DATAPUMP module, specifically `GENERATE JOB NAME`, `GET WORKERSTATUSLIST1010`, `GET PARAMVALUES1010`, `GET DUMPFILESET1010`, `GET JOBSTATUS1010`, `ATTACH`, and `ESTABLISH REMOTE CONTEXT`, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Database server versions 8.1.7.4 and 9.0.1.5 **Description** The issue allows remote attackers to bypass security restrictions, execute arbitrary SQL commands, and gain access to sensitive data. The Connection Manager component is affected, but specific details about the impact and attack vectors are not provided. **Recommendations** For Oracle Database server version 8.1.7.4, update to a version that addresses the security restrictions bypass and arbitrary SQL command execution issues. For Oracle Database server version 9.0.1.5, update to a version that addresses the security restrictions bypass and arbitrary SQL command execution issues. As a temporary workaround, consider restricting access to sensitive data and limiting the execution of SQL commands until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite and Applications version 11.5.10 **Description** The issue affects various components of Oracle E-Business Suite and Applications, including the Application Install, Oracle Applications Framework, Oracle Applications Technology Stack, Oracle Human Resources, Oracle Marketing, Marketing Encyclopedia System, Oracle Trade Management, and Oracle Web Applications Desktop Integration components. The vulnerabilities have unspecified impact and attack vectors. **Recommendations** For Oracle E-Business Suite and Applications version 11.5.10, apply the patches or fixes provided by Oracle for the respective components to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.