Security Bulletin

RISK: Medium Risk

Microsoft Windows Active Directory Federation Services (ADFS) Multiple Vulnerabilities( 09 December 2009 )

1. Single Sign On Spoofing in ADFS Vulnerabilityspoofing vulnerability in Active Directory Federation Services could allow an attacker to impersonate an authenticated user if the attacker has access to a workstation and Web browser recently used by the targeted user to access a Web site that offers single sign...

Last Update Date: 28 Jan 2011 Release Date: 9 Dec 2009 4507 Views

RISK: Medium Risk

Microsoft Windows Internet Authentication Service Multiple Vulnerabilities( 09 December 2009 )

1. Internet Authentication Service Memory Corruption VulnerabilityA remote code execution vulnerability exists in implementations of Protected Extensible Authentication Protocol (PEAP) on the Internet Authentication Service. The vulnerability is due to incorrect copying into memory of messages received by the server when handling PEAP authentication attempts. ...

Last Update Date: 28 Jan 2011 Release Date: 9 Dec 2009 4547 Views

RISK: Medium Risk

Microsoft Windows Local Security Authority Subsystem Service (LSASS) Resource Exhaustion Vulnerability( 09 December 2009 )

A denial of service vulnerability exists in Microsoft Windows due to the way that the Local Security Authority Subsystem Service (LSASS) improperly handles specially crafted ISAKMP messages communicated through IPsec.

Last Update Date: 28 Jan 2011 Release Date: 9 Dec 2009 4644 Views

RISK: Medium Risk

Microsoft WordPad and Office Text converter Memory Corruption Vulnerability( 09 December 2009 )

A remote code execution vulnerability exists in the way that text converters in Microsoft WordPad and Microsoft Office Word process memory when a user opens a specially crafted Word 97 file.

Last Update Date: 28 Jan 2011 Release Date: 9 Dec 2009 4667 Views

RISK: Medium Risk

Microsoft Internet Explorer Multiple Vulnerabilities( 09 December 2009 )

1. ATL COM Initialization VulnerabilityA remote code execution vulnerability exists in an ActiveX control built with vulnerable Microsoft Active Template Library (ATL) headers. This vulnerability only directly affects systems with components and controls installed that were built using Visual Studio ATL. Components and controls built...

Last Update Date: 28 Jan 2011 Release Date: 9 Dec 2009 4483 Views

RISK: Medium Risk

Microsoft Office Project Memory Validation Vulnerability( 09 December 2009 )

A remote code execution vulnerability exists in the way that Microsoft Office Project handles specially crafted Project files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; ...

Last Update Date: 28 Jan 2011 Release Date: 9 Dec 2009 4553 Views

RISK: Medium Risk

BlackBerry Products PDF Distiller Code Execution Vulnerabilities

Multiple vulnerabilities have been identified in BlackBerry Enterprise Server and BlackBerry Professional Software, which could be exploited by attackers to compromise a vulnerable device. These issues are caused by memory corruption errors in the PDF distiller of the BlackBerry Attachment Service component when processing malformed PDF files, ...

Last Update Date: 28 Jan 2011 Release Date: 4 Dec 2009 4527 Views

RISK: Medium Risk

VMware Products Multiple Code Execution and Security Bypass Vulnerabilities

Multiple vulnerabilities have been identified in various VMware products, which could be exploited by remote attackers to bypass security restrictions, disclose sensitive information, cause a denial of service or compromise a vulnerable system. These issues are caused by errors in JRE, Tomcat, ntp, ...

Last Update Date: 28 Jan 2011 Release Date: 24 Nov 2009 4808 Views

RISK: Medium Risk

HPOpenView Operations Default Account Code Execution Vulnerability

A vulnerability has been identified in HP OpenView Operations, which could be exploited by remote attackers to compromise a vulnerable system. This issue is caused due to a hidden account being present within the Tomcat users XML file, which could allow remote attackers to gain unauthorized access...

Last Update Date: 28 Jan 2011 Release Date: 24 Nov 2009 4746 Views

RISK: Medium Risk

MicrosoftInternet Explorer CSS Handling Code Execution Vulnerability

A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by attackers to compromise a vulnerable system. This issue is caused by a dangling pointer in the Microsoft HTML Viewer (mshtml.dll) when retrieving certain CSS/STYLE objects via the "...

Last Update Date: 28 Jan 2011 Release Date: 23 Nov 2009 4582 Views