$B%;%-%e%j%F%#%[!<%k(B memo - 2004.12

Microsoft Internet Explorer XP SP2 Fully Automated Remote Compromise

$B!!;XE&$5$l$?7g4Y$rMxMQ$7$?967b;vNc$,H/@8$7$F$$$k$h$&$@!#(B

• Trojan.Phel.A ($B%7%^%s%F%C%/(B)
• bid 11467: Microsoft Internet Explorer HTML Help Control Local Zone Security Restriction Bypass Vulnerability (securityfocus)
• News from the Lab: Tuesday, December 28, 2004 (F-Secure)

$B!!(BPHP $B$r;H$C$?%Z!<%8$K$*$1$k%W%m%0%i%_%s%0%(%i!<$r96N,$9$k%o!<%`$,EP>l$7$F$$$k$h$&$G$9!#(BPHP $B$N(B Include() $B$"$k$$$O(B Require() $B$r8mMQ$7$?%Z!<%8$rMxMQ$7$FHK?#$7$F$$$k$h$&$G$9!#(B

• Handler's Diary December 26th 2004 (SANS ISC)
• PhpInclude.Worm - PHP Scripts Automated Arbitrary File Inclusion (K-Otik.com)
• Analyst's Diary: Santy updates - worm renamed (viruslist.com)
• PHP Security Mistakes (devshed.com)

$B!!(BPHP $B$rMxMQ$7$F$$$k?M$O!":#$9$0$=$N$h$&$J8mMQ$,$J$$$+$I$&$+3NG'$7!"$^$?MxMQ$7$F$$$k(B PHP $B$N%P!<%8%g%s$r:G?7>uBV$K%"%C%W%G!<%H$9$k$3$H$,?d>)$5$l$F$$$^$9!#(B

$B!!4XO"(B: PHP$B$rA@$&?7$?$J%o!<%`$,=P8=!$(BWeb$B%Z!<%8$N%W%m%0%i%`!&%_%9$rFM$/(B ($BF|7P(B IT Pro, 12/27)

WordPad $B$N@H

$B!!(BiDEFENSE Security Advisory 12.14.04 - Microsoft Word 6.0/95 Document Converter Buffer Overflow Vulnerability

$B%O%$%Q!<(B $B%?!<%_%J%k$N@H

$B!!(BHyperTerminal - Buffer Overflow In .ht File$B!#(B

proxy $B4D6-$G(B Windows XP SP2 $B$rMxMQ$9$k$H!"(BWindows Update $B$G%U%!%$%k$r%@%&%s%m!<%I$G$-$J$$(B

$B!!2C2l$5$s$+$i(B ($B$"$j$,$H$&$4$6$$$^$9(B):

> $B2sHr:v$O!V(BWindows Server 2003 $B$N(B proxycfg.exe $B$r%3%T$C$F$/$k!W$H$$$&!"(B
>$B$J$s$H$bMpK=$J$b$N!#$=$s$J$3$H8@$&$N$J$i!"(BWindows Server 2003 $B$N(B
>proxycfg.exe $B$r%@%&%s%m!<%I$G$-$k$h$&$K$9$Y$-$@$H;W$&$N$@$,!#$D!<$+!"<+(B
>$BM3$K%3%T$C$F$$$$$s$G$9$+(B

$B;d$b!V<+M3$K%3%T$C$F$M!*!W$K5?Ld$r;}$C$F$$$?$N$G%^%$%/%m%=%U%H$KLd$$9g$o$;$r$7$F$_$^$7$?!#(B

$B<+M3$K%3%T$C$F$$$$$N$+$H!"(B
http://www.microsoft.com/japan/legal/permission/t-mark/img-req4.htm
$B$3$3$K%a!<%k$G
Windows Update$B$K4X$9$k$3$H$J$N$G!"EEOC$GLd$$9g$o$;$F$_$^$7$?!#(B
http://support.microsoft.com/oas/default.aspx?gprid=6527
$B%3%T$C$F(BOK$B$H$$$&JV;v$rLc$&$3$H$,$G$-$^$7$?!#(B

$B%3%T$k$3$H$K4X$7$F$OEEOC$GLd$$9g$o$;$9$l$P(BOK$B$C$]$$$G$9!#(B

#68 : Oracle Server$B@=IJ$K4X$9$k%;%-%e%j%F%#$N@H

$B!!(BNGSSoftware $B$,>\:Y>pJs$r8x3+$7$?!#(B

• Oracle extproc buffer overflow (#NISR23122004A)
• Oracle extproc directory traversal (#NISR23122004B)
• Oracle extproc local command execution (#NISR23122004C)
• Oracle clear text passwords (#NISR2122004D)
• Oracle ISQLPlus file access vulnerability (#NISR2122004E)
• Oracle TNS Listener DoS (#NISR2122004F)
• Oracle Character Conversion Bugs (#NISR2122004G)
• Oracle multiple PL/SQL injection vulnerabilities (#NISR2122004H)
• Oracle Trigger Abuse (#NISR2122004I)
• Oracle wrapped procedure overflow (#NISR2122004J)

[VulnWatch] Patch available for IBM DB2 Universal Database flaws

$B!!(BNGSSoftware $B$,>\:Y>pJs$r8x3+$7$?!#(B

• [VulnWatch] IBM DB2 rec2xml buffer overflow vulnerability (#NISR2122004J)
• [VulnWatch] IBM DB2 generate_distfile buffer overflow vulnerability (#NISR2122004L)

• Hat-Squad Advisory: Remote buffer overflow in Netcat TCP/IP Swiss Army Knife

• [SECURITY] [DSA 618-1] New imlib packages fix arbitrary code execution$B!#(B imlib $B$N(B CAN-2004-1025 (heap overflow) $B$H(B CAN-2004-1026 (integer overflow) $B$rD>$7$?$=$&$G$9!#(B

• [SA13664] Snort TCP/IP Options Denial of Service Vulnerability $B!#(BSnort 2.2.x DoS $BOC!#(B

• iDEFENSE Security Advisory 12.21.04: Multiple Vendor xpdf PDF Viewer Buffer Overflow Vulnerability

  xpdf 3.00pl2 $B$G=$@5$5$l$F$$$k!#(B CVE: CAN-2004-1125$B!#(B

• xine 0.99.2 $B$K(B 2 $B$D$N7g4Y!#(B

  • iDEFENSE Security Advisory 12.21.04: Multiple Vendor Xine version 0.99.2 PNM Handler Negative Read Length Heap Overflow Vulnerability$B!#(B CVE: CAN-2004-1188
  • iDEFENSE Security Advisory 12.21.04: Multiple Vendor Xine version 0.99.2 PNM Handler PNA_TAG Heap Overflow Vulnerability$B!#(B CVE: CAN-2004-1187

  xine-lib 1-rc8 $B$G=$@5$5$l$F$$$k!#$^$?(B patch (input/pnm.c 1.20-1.21) $B$,MxMQ$G$-$k!#(B

• CVE: CAN-2004-1138$B!#(B

  Vim 6.3.044 $B0JA0$K7g4Y!#(Bmodeline $B$,M-8z$J>l9g$K!"(Blocal user $B$,(B temcap $B$d(B keymap $B$J$I$N%*%W%7%g%s$rDL$8$FG$0U$N%3%^%s%I$r6.3.045 $B$G=$@5$5$l$F$$$k!#(B

• 'File' Stack Overflow in Processing ELF Headers May Permit Arbitrary Code Execution$B!#(B file 4.11 $B0JA0$K7g4Y!#(BELF $B%X%C%@$N2r

• MIT krb5 Security Advisory 2004-004: heap buffer overflow in libkadm5srv

  1.3.5 $B0JA0$N(B MIT Kerberos 5 administration library (libkadm5srv) $B$K(B heap overflow $B$9$k7g4Y!#(BCVE: CAN-2004-1189$B!#(B krb5-1.3.6 $B$G=$@5$5$l$F$$$k!#$^$?(B patch $B$,MQ0U$5$l$F$$$k!#(B

• Sybase Adaptive Server Enterprise 12.5.2 vulnerabilities$B!#(B $B>\:Y$OITL@!#(BSybase ASE 12.5.3 $B$G=$@5$5$l$F$$$k$=$&$@!#(B

• [SA13618] Citrix Metaframe XP Unspecified Buffer Overflow Vulnerability$B!#(B Metaframe XP 1.0 SP4 $B$G=$@5$5$l$F$$$k$=$&$@!#(B

• squid 2.5.STABLE7 Patches: Confusing results on empty acl declarations$B!#;2>H$7$F$$$k(B ACL $B$,6u$H$7$FDj5A$5$l$F$$$k>l9g$K!"(BACL $B$,JQ$K$J$k$N$+$J!#(Bsquid -k parse $B$G@_Dj%U%!%$%k$r%A%'%C%/$9$k$H$$$$$N$+$J!#(B

• iDEFENSE Security Advisory 12.21.04: Hewlett Packard HP-UX ftpd Remote Buffer Overflow Vulnerability$B!#(B HP-UX $B$N(B ftpd $B$O!"5/F0%*%W%7%g%s$K(B -v $B$r$D$1$F$$$k$H(B buffer overflow $B$7$F(B root $B$r

• ruby $BJ}LL$G(B [ruby-dev:25241] net/https.rb and server identity (RFC2818) $B$H$$$&OC$,$"$k$h$&$G$9!#(B $B$D$E$-(B: [ruby-dev:25254]

• [PATCH] Crashes when parsing malformed directory listings from FTP server$B!#(B $B0-0U$"$k(B ftp $B%5!<%P$G(B wget $B$r(B crash $B$5$;$i$l$k$H$$$&OC!#(B wget $B$X$N(B patch $B$D$-!#(B

2005.01.05 $BDI5-(B:

$B!!(Bnetcat 1.11 for Windows is released (vulnwatch.org)$B!#(B Hat-Squad Advisory: Remote buffer overflow in Netcat TCP/IP Swiss Army Knife $B$N(B fix$B!#(B

$B!!(BWindows Media Player 9 $B$KIUB0$9$k(B Active X $B%3%s%H%m!<%k$K7g4Y$,$"$k$?$a!"96N,(B web $B%5!<%P$+$i(B

• $B%*!<%G%#%*%U%!%$%k$N%"!<%F%#%9%H!&%"%k%P%`!&6JL>$r>e=q$-$7$?$j(B
• PC $B>e$N%U%!%$%k$NB8:_$d%U%!%$%k%5%$%:$r8!::$7$?$j(B

$B$G$-$F$7$^$&!#$3$N7g4Y$O(B Windows Media Player 10 $B$G=$@5$5$l$F$$$k$=$&$@!#(B

$B!!(Blibtiff $B$K(B 2 $B$D$N7g4Y$,H/8+$5$l$^$7$?!#(B

• iDEFENSE Security Advisory 12.21.04: libtiff Directory Entry Count Integer Overflow Vulnerability

  tif_dirread.c $B$*$h$S(B tif_fax3.c $B$G(B heap overflow $B$,H/@8!"G$0U$N%3!<%I$rCAN-2004-1308

• iDEFENSE Security Advisory 12.21.04: libtiff STRIPOFFSETS Integer Overflow Vulnerability

  libtiff/tif_dirread.c $B$G(B integer overflow $B$,H/@8!"G$0U$N%3!<%I$r

$B!!(B$B05=L%U%!%$%k2rE`$N@H ($B$^$C$A$c(B 139 hiki) $B$,!"(BSONY CLIE (Palm OS 5) $BFbB"$N(B CLIE Files $B$K$b$"$C$?LOMM!#(BCLIE Files v.1.1.2 $B$G=$@5$5$l$F$$$k!#(B

$B!!0lIt8E$$$b$N$b$"$j$^$9$,!D!D!#(B

• Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation

  POSIX Capability LSM $B%b%8%e!<%k$,@EE*$KAH$_9~$^$l$F$$$J$$(B Linux 2.6.x $B$K$*$$$F!"(BCapability LSM $B%b%8%e!<%k$,F0E*$KFI$_9~$^$l$k(B (# modprobe capability) $B$H!"FI$_9~$^$l$k$H$-$KF0:n$7$F$$$?0lHL%f!<%6$N%W%m%;%9$,(B root $B8"8B$r

• [SA13493] Linux Kernel "ip_options_get()" and "vc_resize()" Vulnerabilities

  2.4.28 $B0JA0$N(B Linux 2.4.x$B!"(B2.6.9 $B0JA0$N(B Linux 2.6.x $B$K$*$$$FJ#?t$N7g4Y$,$"$j!"(Blocal user $B$,(B DoS $B967b$rhttp://www.guninski.com/where_do_you_want_billg_to_go_today_2.html $B$K(B PoC $B%3!<%I$,7G:\$5$l$F$$$k!#(B Linux 2.6.10 $B$G=$@5$5$l$F$$$k$H;W$o$l$k!#(B

• Linux kernel scm_send local DoS

  2.4.28 $B0JA0$N(B Linux 2.4.x$B!"(B2.6.9 $B0JA0$N(B Linux 2.6.x $B$N(B socket $BCAN-2004-1016

• Linux kernel IGMP vulnerabilities

  2.4.28 $B0JA0$N(B Linux 2.4.x$B!"(B2.6.9 $B0JA0$N(B Linux 2.6.x $B$N(B IGMP $BCAN-2004-1137

• Advisory 14/2004: Linux 2.x smbfs multiple remote vulnerabilities

  2.4.27 $B0JA0$N(B Linux 2.4.x$B!"(B2.6.9 $B0JA0$N(B Linux 2.6.x $B$N(B smbfs $BpJs$NO31H$d(B DoS$B!"G$0U$N%3!<%I$NCAN-2004-0883 CAN-2004-0949

$B!!(BWindows XP SP2 (IE 6.0 SP2) $B$K$*$$$F!"(Bweb $B%Z!<%8$K%"%/%;%9$7$?$@$1$G!"A4<+F0$G96N,%U%!%$%k$r%f!<%6$N%9%?!<%H%"%C%W$KJ]B8$5$;$k$3$H$,2DG=$@!"$H$$$&;XE&!#(B

$B!!BP1~J}K!$H$7$F!"(B.HTA $B%U%!%$%k$NL58z2=(B ($B4XO"$E$1$N:o=|$H$$$&0UL#$+(B?)$B!"(BIE $B$K$*$1$k%"%/%F%#%V%9%/%j%W%H$NL58z2=!"$*$h$S(B IE $B$r;H$o$J$$(B (Mozilla / FireFox $B$r;H$&(B)$B!"$,5s$2$i$l$F$$$k!#(BActiveX $B$NL58z2=$bM-8z$J5$$,$9$k$1$I!"5-:\$5$l$F$$$J$$!#(B

2004.12.28 $BDI5-(B:

$B!!;XE&$5$l$?7g4Y$rMxMQ$7$?967b;vNc$,H/@8$7$F$$$k$h$&$@!#(B

• Trojan.Phel.A ($B%7%^%s%F%C%/(B)
• bid 11467: Microsoft Internet Explorer HTML Help Control Cross-Zone Scripting Vulnerability (securityfocus)
• News from the Lab: Tuesday, December 28, 2004 (F-Secure)

2005.01.04 $BDI5-(B:

$B!!(BQwik-Fix Pro Blocks XP SP2 Vulnerability (pivx.com, 2004.12.28)$B!#$H$$$&$3$H$G!#(B

2005.01.13 $BDI5-(B:

$B!!(BHTML $B%X%k%W$N@H $B$K$*$$$F!"(BHTML $B%X%k%W(B ActiveX $B%3%s%H%m!<%k(B (Hhctrl.ocx / Whhctrl.ocx) $B$K$D$$$F$O7g4Y$,=$@5$5$l$^$7$?!#(B

$B!!(Bxfocus $B$N(B flashsky $B;a$,(B Windows $B$NL$=$@5$N7g4Y$r(B 3 $B

• Microsoft Windows Kernel ANI File Parsing Crash and DOS Vulnerability

  $BBP>](B: Windows NT 4.0 / 2000 / XP (gold / SP1 $B$N$_(B) / Server 2003$B!#(B $BFCuBV$H$J$k!#(B

  $B4XO"(B:

  • Exploit-ANIfile (McAfee)$B!#(BDAT 4417 $B$GBP1~!#(B
  • Bloodhound.Exploit.20 (Symantec)$B!#(B2004.12.24 $BHG(B Intelligent Updater $B$GBP1~!#(B

• Microsoft Windows LoadImage API Integer Buffer overflow

  $BBP>](B: Windows NT 4.0 / 2000 / XP (gold / SP1 $B$N$_(B) / Server 2003$B!#(B LoadImage API $B$K(B integer overflow $B$9$k7g4Y$,$"$j!"G$0U$N%3!<%I$r

  $B4XO"(B:

  • Exploit-LoadImgAPI (McAfee)$B!#(BDAT 4417 $B$GBP1~!#(B
  • Bloodhound.Exploit.19 ($B%7%^%s%F%C%/(B)$B!#(B2004.12.24 $BHG(B Intelligent Updater $B$GBP1~!#(B
  • bid 12095: Microsoft Windows LoadImage API Function Integer Overflow Vulnerability (securityfocus.com)

• Microsoft Windows winhlp32.exe Heap Overflow Vulnerability

  $BBP>](B: Windows NT 4.0 / 2000 / XP / Server 2003$B!#(B winhlp32.exe $B$K$*$1$k(B .hlp $B%U%!%$%k$N=hM}$K$*$$$F(B heap overflow $B$9$k7g4Y$,$"$k$?$a!"96N,(B .hlp $B%U%!%$%k$rMxMQ$7$FG$0U$N%3!<%I$r

  $B4XO"(B:

  • Bloodhound.Exploit.21 (Symantec)$B!#(B2004.12.25 $BHG(B Intelligent Updater $B$GBP1~!#(B

$B!!$$$:$l$K$D$$$F$b(B http://www.xfocus.net/flashsky/icoExp/index.html $B$G(B PoC $B%3!<%I$,8x3+$5$l$F$$$k!#(B

$B!!>e5-$7$?$h$&$K!":G=i$N(B 2 $B$D$K$D$$$F$O(B Windows XP SP2 $B$OBP>]30$H$J$C$F$$$k!#(B $B$^$?%7%^%s%F%C%/$H%^%+%U%#!<$N%"%s%A%&%$%k%9%W%m%@%/%H$G$OBP1~$5$l$k(B ($BM=Dj(B) $B$,$"$k$h$&$@!#$"$kDxEY$NKI8f$K$O$J$k$@$m$&!#(B

$B!!4XO"JsF;(B:

• Windows$B$N?7$7$$7g4Y$r0-MQ$9$k%(%/%9%W%m%$%H%3!<%I$,8x3+$K(B (ITmedia, 12/24)
• Windows$B%X%k%W%U%!%$%k$J$I!"B??t$NL$%Q%C%A@H (ITmedia, 12/25)

$B!!>e5-$N$&$A!"(BMicrosoft Windows LoadImage API Integer Buffer overflow $B$H(B Microsoft Windows Kernel ANI File Parsing Crash and DOS Vulnerability $B$K$D$$$F$O(B MS05-002 $B$G=$@5$5$l$F$$$k$h$&$K;W$($k!#(B

$B!!B>$N(B exploit: [Full-Disclosure] Windows (XP SP2) Remote code execution with parameters$B!#(B About CMDExe (Command Execution) Remote code execution with parameters $B$G2r@b$5$l$F$$$k!#(B

$B!!(BIE 6 SP1 / SP2 $B$K7g4Y!#(B img $B%?%0$N(B src $BB0@-$KFC$B%G%b%Z!<%8(B$B$K(B IE $B$G%"%/%;%9$9$k$H!"(B ian-example@penguinhosting.net $B08$K%a!<%k$,Aw$i$l$k$N$GCm0U!#(B $B

$B!!$J$*!"%^%+%U%#!<(B VirusScan Enterprise 8.0i $B$,%$%s%9%H!<%k$5$l$F$$$k4D6-$G$O!"(B VSE 8.0i $B$N!VBgNL%a!<%kG[?.7?%o!<%`$K%a!<%k$rAw?.$5$;$J$$!W5!G=$K$h$j%a!<%kAw?.$,M^;_$5$l$?!#F1MM$N5!G=$N$"$k%;%-%e%j%F%#@=IJ(B ($B%Q!<%=%J%k%U%!%$%"%&%)!<%k$H$+(B?) $B$J$I$rMxMQ$7$F$$$l$PM^;_$G$-$k$G$7$g$&!#(B

2004.12.24 $BDI5-(B:

$B!!%d%^%,%?$5$s$+$i(B ($B$"$j$,$H$&$4$6$$$^$9(B):

$B"!(B[Full-Disclosure] Internet Explorer FTP client can be used to sendmail
http://www.st.ryukoku.ac.jp/%7Ekjm/security/memo/2004/12.html#20041224_IEFTP

$B$N7o$G$9$,!"?7$7$$@H
$B"!(BMicrosoft Internet Explorer FTP Command Injection Vulnerability (Secunia)
http://secunia.com/advisories/13404/
http://www.7a69ezine.org/node/view/168
http://yamagata.int21h.jp/d/?date=20041210#p03

$B$N7o$N1~MQ$N$h$&$G$9!#(B

$B%f!<%6L>(B or $B%Q%9%o!<%I(B or $B%G%#%l%/%H%jL>ItJ,$K4^$^$l$k2~9T%3!<%I(B(%0d%0a)$B$r$=$N$^$^E83+$7$F$7$^$&$3$H$,860x$H$J$j$^$9!#"+2~9T%3!<%I%$%s%8%'%/%7%g%s(B

Advisory 01/2004: Multiple vulnerabilities in PHP 4/5

$B!!(BCAN-2004-1018 $B$,$J$<$+(B REJECT $B$5$l$F$$$^$9!#$d$^$M$5$s>pJs$"$j$,$H$&$4$6$$$^$9!#(B

IE$B$K%U%#%C%7%s%0$N4m81!=!=(BActiveX$B$KLdBj(B

$B!!4XO"(B: IE$B$K%/%m%9%5%$%H!&%9%/%j%W%F%#%s%0967b$r5v$9$<$$ ($BF|7P(B IT Pro, 12/17)

Windows $B%+!<%M%k$*$h$S(B LSASS $B$N@H:3J$,5/$3$k(B (885835) (MS04-044)

$B!!(B891531 - Windows 2000 $B%Y!<%9$N%3%s%T%e!<%?$K%;%-%e%j%F%#99?7%W%m%0%i%`(B 885835 $B$r%$%s%9%H!<%k$7$?8e!"(BVeritas Backup Exec 8.6 $B$G%9%1%8%e!<%k$7$?%P%C%/%"%C%W$G%(%i!<$,H/@8$7!"%"%W%j%1!<%7%g%s%$%Y%s%H(B ID 57480 $B$,=PNO$5$l$k(B (Microsoft)$B!#(BMS04-044 $B=$@5%W%m%0%i%`(B (KB885835) $B$rE,MQ$7$?4D6-$G!"(BVeritas Backup Exec 8.6 $B$,%H%i%V$k$3$H$,$"$kLOMM!#(BVeritas Backup Exec 8.6 $B$r99?7$;$h!"$H=q$+$l$F$$$k!#(B

$BDa55%a!<%k$K$*$1$k(BS/MIME$B$N=pL>8!>Z$K@H

$B!!(B$B$3$N$^$^$G$O(BJVN$B$OLr$KN)$?$J$$(B ($B9bLZ9@8w!w<+Bp$NF|5-(B, 12/19)$B!#(B $BDa55%a!<%k$N(B S/MIME $B$^$o$j$K$O$5$i$J$k7g4Y$,$"$j!"(B4.00 $BHG$G=$@5$5$l$?(B ($B!V(BS/MIME$BEE;R=pL>$N8!>Z4X78$G$N@H

$B!!(BWindows XP SP2 $B$N!V(BWindows $B%;%-%e%j%F%#$N=EMW$J7Y9p!W2hLL$G$O!V%W%m%0%i%`%"%$%3%s!W!VL>A0!W!VH/9T85!W$7$+I=<($5$l$J$$$?$a!"$3$l$i$r5v2D$5$l$F$$$k$G$"$m$&%W%m%0%i%`$HF1$8$K$9$k$3$H$K$h$j!"MxMQ

2005.01.04 $BDI5-(B:

$B!!>\:Y5-;v(B: [Windows $B%;%-%e%j%F%#$N=EMW$J7Y9p(B] $B2hLL$r0-MQ$7$?56Au$K$D$$$F(B (penetration technique research site, 2005.01.03)$B!#(B

$BL>A0$NItJ,$K%+!<%=%k$rCV$$$F?tICBT$D$H!"$,I=<($5$l$k$N$G!"(B[Windows $B%;%-%e%j%F%#$N=EMW$J7Y9p(B] $B2hLL$r0-MQ$7$?56Au$r8+GK$k$H$-$KLrN)$D>pJs$H$7$F3P$($F$*$$$F$$$?$@$-$?$$!#(B

$B!!$I$3$+$N%l%8%9%H%j$r$$$8$k$H:G=i$+$iI=<($5$l$?$j$9$k$H$&$l$7$$$N$@$1$I$J$"!#(B

$B!!(BMozilla Firefox 1.0 / Mozilla 1.7.x / Opera 7.51$B!A(B7.54 $B$K7g4Y!#(B HTML $B%U%!%$%k$r(B Content-Type: text/html. ($B%I%C%H$D$-(B) $B$G

$B!!(BMSIE DHTML Edit Control Cross Site Scripting Vulnerability (bugtraq, Wed, 15 Dec 2004 17:01:33 +0900) $B$NOC!#(B IE 6 $B$N(B DHTML Edit ActiveX $B%3%s%H%m!<%k$K%/%m%9%5%$%H%9%/%j%W%F%#%s%07g4Y$,$"$k$?$a!"(Bweb $B%5%$%H$OK\Mh$N%3%s%F%s%D$KBP$7$FG$0U$N(B JavaScript $B$rA^F~$G$-$k!#$3$l$rMxMQ$9$k$H!"K\Mh$O$G$-$J$$$O$:$N%"%I%l%9%P!<$N(B URL $B:>>N$d(B SSL $B80%"%$%3%s$N:>>N$J$I$,2DG=$H$J$k!#(B

$B!!=$@5%W%m%0%i%`$O$^$@B8:_$7$J$$!#2sHrJ}K!$H$7$F$O!"(BActiveX $B$rL58z$H$9$k!#(B $B$^$?(B Windows XP SP2 $B$G$O!"

1. DHTML Edit ActiveX $B%3%s%H%m!<%k$rFI$_9~$^$;$k(B web $B%Z!<%8$r1\Mw$9$k!#(B $B%G%b%5%$%H(B ($B8e=R(B) $B$r1\Mw$9$l$P$h$$!#(B
2. IE $B$N%D!<%k%a%K%e!<$+$i(B [$B%"%I%*%s$N4IM}(B(A)...] $B$rA*$V!#!V%"%I%*%s$N4IM}!W%&%#%s%I%&$,I=<($5$l$k!#(B
3. $B!V%"%I%*%s$N4IM}!W%&%#%s%I%&$G!V8=:_(B Internet Explorer $B$GFI$_9~$^$l$F$$$k%"%I%*%s!W$rI=<($5$;!"(BDHTML Edit $B%3%s%H%m!<%k$r%]%$%s%H$7!"!VL58z!W$r@_Dj$9$k(B ($B2hA|(B)$B!#(B
4. IE $B$r:F5/F0$9$k!#(B $B:F$SF1MM$N$B2hA|(B)$B!#(B

$B!!4XO"(B:

• [SA13482] Internet Explorer DHTML Edit ActiveX Control Cross-Site Scripting (Secunia)

$B!!%G%b%5%$%H(B:

• Secunia $B$K$h$k$b$N(B: http://secunia.com/internet_explorer_cross-site_scripting_vulnerability_test/
• $B7g4YH/8+http://freehost07.websamba.com/greyhats/abusiveparent.htm

2004.12.23 $BDI5-(B:

$B!!4XO"(B: IE$B$K%/%m%9%5%$%H!&%9%/%j%W%F%#%s%0967b$r5v$9$<$$ ($BF|7P(B IT Pro, 12/17)

$B!!(BMS05-013 $B$G=$@5$5$l$F$$$k!#(B CVE: CAN-2004-1319

$B!!(BphpBB 2.0.10 $B0JA0$K7g4Y!#(B viewtopic.php $B$N(B highlight $B%Q%i%a!<%?$KBP$9$k=|@w$,IT40A4$J$?$a!"$3$l$rMxMQ$9$k$H(B remote $B$+$iG$0U$N%3!<%I$rDatabase passwords is open. Passthru() is available. (phpBB.com :: Security Tracker - Final Report)$B!#(B

$B!!(BphpBB 2.0.11 $B$G=$@5$5$l$F$$$k!#(B $B$^$?(B howdark.com exploits - follow up (phpBB) $B$G<($5$l$F$$$k=$@5$r;\$7$F$b$h$$!#(B

$B!!$3$N7g4Y$rA@$C$?%o!<%`(B "Santy" $B$,EP>l$7$F$$$k!#(B

• Santy internet worm attacks thousands of web bulletin boards, Sophos reports (Sophos)
• Santy (F-Secure)
• WORM_SANTY.A ($B%H%l%s%I%^%$%/%m(B)
• PERL/Santy.worm (McAfee)
• Perl.Santy (Symantec)
• Perl/Santy-A (Sophos)
• Santy worm defaces websites using php bug (Handler's Diary December 21st 2004)

$B!!$J$*!"(BphpBB 2.0.11 $B$G$OB>$K$b(B XSS in username field for privmsg.php $B$d(B XSpider 7 reports vunerabilitt$B!"(B phpBB Attachment Mod Directory Traversal HTTP POST Injection $B$,=$@5$5$l$F$$$k$=$&$@!#(B

2004.12.23 $BDI5-(B:

$B!!4XO"(B:

• PHP$B7G<(HD$N@H (Internet Watch, 12/22)
• $B%&%$%k%9!V(BSanty$B!W$K$h$k967b@h$N8!:w$r(BGoogle$B$, (Internet Watch, 12/22)
• Google$B8!:w$r0-MQ$9$k(BSanty$B%o!<%`!"%*%s%i%$%s7G<(HD$K46@w(B (ITmedia, 12/22)
• Google$B$,(BSanty$B%o!<%`$KBP=h!"!V0l;~E*A (ITmedia, 12/22)

Adobe Reader 6.0.3 update - English, Japanese

$B!!(BiDEFENSE Security Advisory 12.13.04: Adobe Reader 6.0 .ETD File Format String Vulnerability (bugtraq)$B!#(B CVE: CAN-2004-1153 $B$NOC!#(B

$B!!8E$$$M$?$b$"$j$^$9$,!D!D!#(B

• NetBSD Security Advisory 2004-010: Insufficient argument validation in compat code$B!#(BNetBSD 1.6.2 $B0JA0$,3:Ev!#(B $B:G?7$N(B NetBSD 2.0 $B$K$O$3$N7g4Y$O$J$$!#(B

• DJB's students release 44 *nix software vulnerability advisories (bugtraq)$B!#(B $B7g4Y$"$j(B: abc2midi, abc2mtex, abcm2ps, abcpp, abctab2ps, asp2php, bsb2ppm, chbg, Convex 3D, csv2xml, CUPS, dxfscope, elm/bolthole filter, greed, html2hdml, IglooFTP, jcabc2ps, jpegtoavi, junkie, LinPopUp, Mesh Viewer, mpg123, MPlayer, NapShare, NASM, o3read, pgn2web, qwik-smtpd, ringtonetools, rtf2latex2e, tnftp, uml-utilities, unrtf, vb2c, vilistextum, xine-lib, xlreader, Yanf

• [VulnWatch] Veritas BackupExec Agent vulnerability$B!#(B

  • 8.60.3878 Hotfix 68 - Backup Exec (Buffer overflow creates a security hole in Agent Browser) (Veritas)
  • 9.1.4691 Hotfix 40 - Backup Exec (Buffer overflow creates a security hole in Agent Browser; Licensed Storage Central becomes Eval when Backup Exec 9.1 is uninstalled) *Requires Backup Exec 9.1.4691 Service Pack 1 (Veritas)

  $B4XO"(B: iDEFENSE Security Advisory 12.16.04: Veritas Backup Exec Agent Browser Registration Request Buffer Overflow Vulnerability$B!#(B CVE: CAN-2004-1172

• MPlayer $B4XO"(B

  • iDEFENSE Security Advisory 12.16.04: MPlayer Remote RTSP HeapOverflow Vulnerability$B!#(B patch$B!#(B
  • iDEFENSE Security Advisory 12.16.04: MPlayer MMST Streaming Stack Overflow Vulnerability$B!#(B patch$B!#(B
  • iDEFENSE Security Advisory 12.16.04: MPlayer Bitmap Parsing Remote Heap Overflow Vulnerability$B!#(B patch$B!#(B

• iDEFENSE Security Advisory 12.14.04 - Adobe Acrobat Reader 5.0.9 mailListIsPdf() Buffer Overflow Vulnerability$B!#(B UNIX $BHG(B Acrobat Reader 5.0.9 $B$K(B buffer overflow $B$9$k7g4Y!"96N,(B PDF $B%U%!%$%k$K$h$jG$0U$N%3!<%I$rCAN-2004-1152

  $B4XO"(B: Acrobat Reader 5.0.10 for UNIX addresses potential security vulnerability (adobe)

• XSS $BOC(B

  • [VulnWatch] Yahoo! Mail Cross-Site Scripting Vulnerability
  • [VulnWatch] Hotmail Cross-Site Scripting Vulnerability #1
  • [VulnWatch] Hotmail Cross Site Scripting Vulnerability #2

  $B$$$:$l$b4{$K(B fix $B$5$l$F$$$k!#B>$N?M$b!"F1MM;vNc$K$R$C$+$+$i$J$$$h$&5$$r$D$1$^$7$g$&!#(B

• Multiple problems in Ethereal versions 0.9.0 to 0.10.7 (ethereal.com)$B!#(B 0.10.8 $B$G=$@5$5$l$F$$$k$=$&$G$9!#(B

• CISCO $B$M$?(B

  • Cisco Security Advisory: Default Administrative Password in Cisco Guard and Traffic Anomaly Detector
  • Cisco Security Advisory: Cisco Unity Integrated with Exchange Has Default Passwords

  $B$I$C$A$b%G%U%)%k%H%Q%9%o!<%IOC!#(B

• KDE $B$M$?(B

  • KDE Security Advisory: plain text password exposure (KDE.org)$B!#(B world-readable $B$J%U%!%$%k$K(B smb $B%"%/%;%9%Q%9%o!<%I$,5-O?$5$l$F$7$^$&!#(B
  • KDE Security Advisory: kfax libtiff vulnerabilities (KDE.org)$B!#(B CVE: CAN-2004-0803 CAN-2004-0804 CAN-2004-0886
  • KDE Security Advisory: Konqueror Window Injection Vulnerability $B!#(B CVE: CAN-2004-1158

• Government Uses Color Laser Printer Technology to Track Documents (PC World, 11/22)

  According to experts, several printer companies quietly encode the serial number and the manufacturing code of their color laser printers and color copiers on every document those machines produce. Governments, including the United States, already use the hidden markings to track counterfeiters.

  $BC/$+8+$D$1$F$_$F$/$@$5$$!#(B

• Google Desktop Search $B4XO"(B:

  • $B!V4k6HFb$G(BGoogle Desktop Search$B$r;H$o$J$$$h$&$K!W!'%,!<%H%J!<$,7Y9p(B (CNET, 12/15)
  • Google Desktop Search$B$N5l%P!<%8%g%s$K>pJsO31L$K$D$J$,$k?<9o$J@H (Internet Watch, 12/21)$B!#%P!<%8%g%s(B 121004 $B0J9_$G=$@5$5$l$F$$$k$=$&$G$9!#(B

• iDEFENSE Security Advisory 12.15.04: Computer Associates eTrust EZ Antivirus Insecure File Permission Vulnerability$B!#(B CVE: CAN-2004-1149

• [CAN-2004-1022] Insecure Credential Storage on Kerio Software$B!#(B Kerio WinRoute Firewall / ServerFirewall / MailServer $B$,3:Ev!#(B Kerio WinRoute Firewall 6.0.9 / ServerFirewall 1.0.1 / MailServer 6.0.5 $B$G=$@5$5$l$F$$$k!#(B CVE: CAN-2004-1022

2005.01.16 $BDI5-(B:

$B!!(BVeritas BackupExec Agent vulnerability $B$N(B exploit $B$,EP>l$7!"$J$K$d$i$5$o$,$7$/$J$C$F$$$kLOMM!#(B

• Handler's Diary January 12th 2005 (SANS ISC)
• Handler's Diary January 14th 2005 (SANS ISC)

$B!!%]!<%HHV9f$rJQ$($k$K$O!"(B255498 - How to change the port that Network Data Management Protocol uses in VERITAS Backup Exec 9.x for Windows Servers (Veritas) $B$r;2>H$9$k$H$h$$$i$7$$!#$G$b$^$:$O!"(Bpatch $B$"$F$^$7$g$&!#(B

2005.02.01 $BDI5-(B:

$B!!(BJ273419: Backup Exec 8.x $B$*$h$S(B 9.x $B$K$*$1$k%9%?%C%/>e$N%P%C%U%!(B $B%*!<%P!<%U%m!<$KBP$9$k@H (VERITAS)$B!#(B

$B!!(BGNU wget 1.8.x / 1.9.x $B$KJ#?t$N7g4Y!#(B

• HTTP $B%j%@%$%l%/%H$5$l$k>u67$K$*$$$F!"(B $B4{B8%U%!%$%k$r>e=q$-$9$k$h$&$J>u67$,H/@8$7$F$b!"L58@$G>e=q$-$7$F$7$^$&!#(B

• HTTP $B%j%@%$%l%/%H$5$l$k>u67$K$*$$$F(B .. $B%P%0$,$"$j!"0-0U$"$k(B web $B%5%$%H$,G$0U$N0LCV$K%U%!%$%k$r:n@.$G$-$F$7$^$&!#(B PoC $B%3!<%I$r8+$k8B$j$G$O!"(BLocation: $B%X%C%@$KBP$9$k=|@w$,IT==J,$J$h$&$@!#(B

• HTTP $B%l%9%]%s%9Cf$K5-=R$5$l$?@)8fJ8;z$,=|@w$5$l$J$$$^$^CDebian bug #261755 $B;2>H!#(B

• $B4{B8%U%!%$%k$r>e=q$-$9$k>l9g$K!"$=$l$,%7%s%\%j%C%/%j%s%/$G$"$k$+H]$+$r8!::$7$J$$$?$a!"%7%s%\%j%C%/%j%s%/967b$r

• FreeBSD: wget -- multiple vulnerabilities$B!#D>$C$F$^$;$s!#(B

Adobe Reader 6.0.3 update - English, Japanese

$B!!(BAcrobat$B$N@H (slashdot.jp) $B$K5.=E$J>pJs$,!#(B

• MacOS X$BBP1~HG$O!"(B6.0.3$B$,0lC6%j%j!<%9$5$l$F (slashdot.jp) $B$k$=$&$G$9!#(B Adobe Reader 6.0.3a update - English, Japanese (adobe) $B$+$i!#(B $B4{$K(B Adobe Reader 6.0.3 $B$r%$%s%9%H!<%k$7$F$7$^$C$??M$O!"(B $B2?$b$7$J$/$F$$$$$=$&$G$9!#(B

  The problem with the 6.0.3 update affected Adobe Acrobat only, not Adobe Reader.

  Acrobat $B$J?M$O"-$rE,MQ$7$^$7$g$&!#(B

• Reader $B$G$O$J$$(B Acrobat $B$N%"%C%W%G!<%H$N$"$j$+(B (slashdot.jp) $B$O$3$A$i$@$=$&$G$9(B:

  • Windows: Adobe Acrobat 6.0.3 Professional and Standard Update - English, Japanese (adobe)
  • Mac OS: Adobe Acrobat 6.0.3a Professional and Standard update - English, Japanese (adobe)

Advisory 01/2004: Multiple vulnerabilities in PHP 4/5

$B!!4XO"(B:

• php unserialize$B!#(B unserialize() $B7g4Y$K4X$9$k(B PoC $B%3!<%I$D$-!#(B

• PHP Input Validation Vulnerabilities$B!#(B magic_quotes_gpc $B$,(B On $B$N>l9g(B ($B4{DjCM(B: On) $B$K!"(B addslashes() $B$,F~NOCM$K4^$^$l$k(B NULL $B$d(B ' $B$KBP$7$F(B \ $B$r$D$1$k$,!"$3$N(B \ $B$,%Q%96h@Z$j$H$7$F2ru67$,H/@8$9$k!#(B

• PHP Multiple Vulnerabilities (secunia)

$B!!(BPHP 4.3.9 $B0JA0(B / 5.0.2 $B0JA0$KJ#?t$N=EBg$J7g4Y!#(B

• CAN-2004-1018: pack(), unpack() $B$K$*$$$F!"(Binteger overflow $B$K5/0x$9$k(B heap overflow $B$,H/@8!#(Bremote $B$+$iG$0U$N%3!<%I$r

• CAN-2004-1019: unserialize() $B$K7g4Y!#(B unserialize() $B$KEO$90z?t$r:Y9)$9$k$3$H$K$h$j0[>o$J%a%b%j>uBV$r

• CAN-2004-1063: $B%^%k%A%9%l%C%I$J(B PHP $B4D6-$G$O(B safe_mode_exec_dir $B$K$h$k@)8B$,2sHr$5$l$F$7$^$&!#(B

• CAN-2004-1064: OS $B$K$*$1$k(B realpath() $B$N$,5v2D$5$l$F$7$^$&!#(B

$B!!(BPHP 4.3.10 / 5.0.3 $B$G=$@5$5$l$F$$$k!#(B PHP 4.3.10 Release Announcement $B$K$b!V(BThis is a maintenance release that in addition to over 30 non-critical bug fixes addresses several very serious security issues$B!W(B $B$H$"$j$^$9$N$G!"Aa4|$K%"%C%W%G!<%H$7$^$;$&!#(B $B$?$@$7!"(BPHP 4.3.10, 5.0.3$B%j%j!<%9(B (slashdot.jp) $B$K$O(B$B%"%C%W%G!<%H$K$h$k(B Zend Optimizer $B$NIT6q9g(B$B$bJs9p$5$l$F$$$k$N$GCm0U$5$l$?$$!#:G?7$N(B Zend Optimizer $B$J$iBg>fIW$@$=$&$@!#(B

$B!!:#2s$N7g4Y$O(B Hardened-PHP $B$N3+H/Cf$KH/8+$5$l$?$N$@$=$&$@!#(Bfrom documentation:

Hardened-PHP provides:

+ Protection of the Zend Memory Manager with canaries
+ Protection of Zend Linked Lists with canaries
+ Protection against internal format string exploits
+ Protection against arbitrary code inclusion
+ Syslog logging of attackers IP

2004.12.20 $BDI5-(B:

$B!!4XO"(B:

• php unserialize$B!#(B unserialize() $B7g4Y$K4X$9$k(B PoC $B%3!<%I$D$-!#(B

• PHP Input Validation Vulnerabilities$B!#(B magic_quotes_gpc $B$,(B On $B$N>l9g(B ($B4{DjCM(B: On) $B$K!"(B addslashes() $B$,F~NOCM$K4^$^$l$k(B NULL $B$d(B ' $B$KBP$7$F(B \ $B$r$D$1$k$,!"$3$N(B \ $B$,%Q%96h@Z$j$H$7$F2ru67$,H/@8$9$k!#(B

• PHP Multiple Vulnerabilities (secunia)

2004.12.23 $BDI5-(B:

$B!!(BCAN-2004-1018 $B$,$J$<$+(B REJECT $B$5$l$F$$$^$9!#$d$^$M$5$s>pJs$"$j$,$H$&$4$6$$$^$9!#(B