SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

Multiple Vulnerabilities: LedgerSMB < 1.2.15


Arrow  SecurityAlert : 4250
Arrow  CVE : CVE-2008-4077
Arrow  CVE : CVE-2008-4078
Arrow  CWE : CWE-399
Arrow  CWE : CWE-89
Arrow  SecurityRisk : High  Security Risk High  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Victim interaction required : No
Arrow  Exploit Available : No
Arrow  Credit : Chris Travers
Arrow  Published : 16.09.2008

Arrow  Affected Software : ledgersmb:ledgersmb:1.2.10
ledgersmb:ledgersmb:1.2.8
ledgersmb:ledgersmb:1.2.9
ledgersmb:ledgersmb:1.2.11
ledgersmb:ledgersmb:1.2.12
ledgersmb:ledgersmb:1.2.13
ledgersmb:ledgersmb:1.2.14 and previous versions
ledgersmb:ledgersmb:1.2.7
ledgersmb:ledgersmb:1.2.5
ledgersmb:ledgersmb:1.2.6
ledgersmb:ledgersmb:1.2.3
ledgersmb:ledgersmb:1.2.4
ledgersmb:ledgersmb:1.1.5
ledgersmb:ledgersmb:1.1.1
ledgersmb:ledgersmb:1.1.0
ledgersmb:ledgersmb:1.0.0
ledgersmb:ledgersmb:1.2.2
ledgersmb:ledgersmb:1.2.1
ledgersmb:ledgersmb:1.2.0
ledgersmb:ledgersmb:1.1.8
ledgersmb:ledgersmb
sql-ledger:sql-ledger:2.6.10
sql-ledger:sql-ledger:2.6.11
sql-ledger:sql-ledger:2.6.12
sql-ledger:sql-ledger:2.6.13
sql-ledger:sql-ledger:2.6.14
sql-ledger:sql-ledger:2.6.15
sql-ledger:sql-ledger:2.6.16
sql-ledger:sql-ledger:2.6.17
sql-ledger:sql-ledger:2.6.18
sql-ledger:sql-ledger:2.6.19
sql-ledger:sql-ledger:2.6.20
sql-ledger:sql-ledger:2.6.21
sql-ledger:sql-ledger:2.6.22
sql-ledger:sql-ledger:2.6.23
sql-ledger:sql-ledger:2.6.24
sql-ledger:sql-ledger:2.6.25
sql-ledger:sql-ledger:2.6.26
sql-ledger:sql-ledger:2.6.27
sql-ledger:sql-ledger:2.8.0
sql-ledger:sql-ledger:2.8.1
sql-ledger:sql-ledger:2.8.2
sql-ledger:sql-ledger:2.8.3
sql-ledger:sql-ledger:2.8.4
sql-ledger:sql-ledger:2.8.5
sql-ledger:sql-ledger:2.8.6
sql-ledger:sql-ledger:2.8.7
sql-ledger:sql-ledger:2.8.8
sql-ledger:sql-ledger:2.8.9
sql-ledger:sql-ledger:2.8.10
sql-ledger:sql-ledger:2.8.11
sql-ledger:sql-ledger:2.8.12
sql-ledger:sql-ledger:2.8.13
sql-ledger:sql-ledger:2.8.14
sql-ledger:sql-ledger:2.8.15
sql-ledger:sql-ledger:2.8.16
sql-ledger:sql-ledger:2.8.17 and previous versions
dws_systems_inc.:sql-ledger:2.6.16
dws_systems_inc.:sql-ledger:2.6.17
dws_systems_inc.:sql-ledger:2.6.14
dws_systems_inc.:sql-ledger:2.6.15
dws_systems_inc.:sql-ledger:2.6.12
dws_systems_inc.:sql-ledger:2.6.13
dws_systems_inc.:sql-ledger:2.6.10
dws_systems_inc.:sql-ledger:2.6.11
dws_systems_inc.:sql-ledger:2.6.6
dws_systems_inc.:sql-ledger:2.6.7
dws_systems_inc.:sql-ledger:2.6.4
dws_systems_inc.:sql-ledger
dws_systems_inc.:sql-ledger:2.6.5
dws_systems_inc.:sql-ledger:2.6.27
dws_systems_inc.:sql-ledger:2.6.3
dws_systems_inc.:sql-ledger:2.6.18
dws_systems_inc.:sql-ledger:2.6.2
sql-ledger:sql-ledger:2.4.12
sql-ledger:sql-ledger:2.4.13
dws_systems_inc.:sql-ledger:2.6.9
sql-ledger:sql-ledger:2.4.10
dws_systems_inc.:sql-ledger:2.6.8
sql-ledger:sql-ledger:2.4.11
sql-ledger:sql-ledger:2.4.16
sql-ledger:sql-ledger:2.4.4
sql-ledger:sql-ledger:2.4.14
sql-ledger:sql-ledger:2.4.15
sql-ledger:sql-ledger:2.4.7
sql-ledger:sql-ledger:2.4.8
sql-ledger:sql-ledger:2.4.5
sql-ledger:sql-ledger:2.4.6
sql-ledger:sql-ledger
sql-ledger:sql-ledger:2.6.0
sql-ledger:sql-ledger:2.4.9
dws_systems_inc.:sql-ledger:2.2.0
sql-ledger:sql-ledger:2.6.1
dws_systems_inc.:sql-ledger:2.2.1
sql-ledger:sql-ledger:2.6.2
dws_systems_inc.:sql-ledger:2.2.2
dws_systems_inc.:sql-ledger:2.2.3
dws_systems_inc.:sql-ledger:2.2.4
dws_systems_inc.:sql-ledger:2.2.5
dws_systems_inc.:sql-ledger:2.2.6
dws_systems_inc.:sql-ledger:2.2.7
dws_systems_inc.:sql-ledger:2.4.0
dws_systems_inc.:sql-ledger:2.4.1
sql-ledger:sql-ledger:2.6.4
dws_systems_inc.:sql-ledger:2.4.11
sql-ledger:sql-ledger:2.6.5
dws_systems_inc.:sql-ledger:2.4.10
sql-ledger:sql-ledger:2.6.6
dws_systems_inc.:sql-ledger:2.4.13
sql-ledger:sql-ledger:2.6.7
dws_systems_inc.:sql-ledger:2.4.12
dws_systems_inc.:sql-ledger:2.4.15
dws_systems_inc.:sql-ledger:2.4.14
dws_systems_inc.:sql-ledger:2.4.2
sql-ledger:sql-ledger:2.6.3
dws_systems_inc.:sql-ledger:2.4.16
dws_systems_inc.:sql-ledger:2.4.4
dws_systems_inc.:sql-ledger:2.4.3
dws_systems_inc.:sql-ledger:2.4.6
dws_systems_inc.:sql-ledger:2.4.5
sql-ledger:sql-ledger:2.6.8
dws_systems_inc.:sql-ledger:2.4.8
sql-ledger:sql-ledger:2.6.9
dws_systems_inc.:sql-ledger:2.4.7
dws_systems_inc.:sql-ledger:2.6.1
dws_systems_inc.:sql-ledger:2.4.9



Arrow  Advisory Content :  

Multiple vulnerabilities: LedgerSMB

Synopsis: Two vulnerabilities announced in LedgerSMB for versions
prior to 1.2.15
Status: Corrected in version 1.2.15 and later (vendor fix available).
Impact: Resource exhaustion on server, arbitrary SQL command execution.
Other software affected: SQL-Ledger, all versions, and likely related
software

Two vulnerabilities have been recently discovered in LedgerSMB which
have been patched in version 1.2.15 and later.

Vulnerability 1: Resource exhaustion
Problem: The CGI scripts read the query string up to
$ENV{CONTENT_LENGTH}, allowing for unlimited data in POST operations
to any screen. Authentication is not required and this can be used to
deny service not only to LedgerSMB but potentially to anything else
running on the server. This was corrected in 1.2.15.

Credit for discovery:
Chris Murtagh

Vulnerability 2: SQL Injection in AR/AP Transactions Report
A parameter was not properly validated prior to being included in the
SQL for generating this report. It would have been possible to inject
arbitrary SQL into the query. Authentication is required to exploit. This
was corrected in 1.2.15.

Credit for discovery:
Seneca Cunningham



Arrow  References :

http://www.securityfocus.com/bid/31109
http://xforce.iss.net/xforce/xfdb/45033
http://www.securityfocus.com/archive/1/archive/1/496181/100/0/threaded
http://www.ledgersmb.org/node/70
http://secunia.com/advisories/31843




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...
Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration
PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass
Copyright © SecurityReason.com. All Rights Reserved.