jetlib.sec » Tags » manager-interface

Feeds

133363 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

38 items tagged "manager interface"

Related tags: apache tomcat [+], tomcat [+], project [+], html [+], apache [+], service vulnerability [+], shell commands [+], project security [+], resource exhaustion [+], web [+], user [+], tomcat servlet [+], stack buffer [+], security advisory [+], resource [+], mandriva linux [+], manager users [+], manager [+], jsp engine [+], intermediate files [+], interface [+], file [+], exhaustion [+], denial of service [+], debian [+], buffer overflow [+], application [+], advisory [+], tcp port 80 [+], sql [+], manager. authentication [+], command execution [+], backend database [+], backend [+], arbitrary command [+], service [+], asterisk [+], security [+], vulnerability [+]

• April 23, 2012
• 16:04

  Asterisk Project Security Advisory - AST-2012-004

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.

  Tags:  user security asterisk manager-interface shell-commands project-security  

• 16:04

  Asterisk Project Security Advisory - AST-2012-004

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.

  Tags:  user security asterisk manager-interface shell-commands project-security  

• 16:04

  Asterisk Project Security Advisory - AST-2012-004

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.

  Tags:  user security asterisk manager-interface shell-commands project-security  

• March 15, 2012
• 20:07

  Asterisk Project Security Advisory - AST-2012-003

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - An attacker attempting to connect to an HTTP session of the Asterisk Manager Interface can send an arbitrarily long string value for HTTP Digest Authentication. This causes a stack buffer overflow, with the possibility of remote code injection.

  Tags:  project security asterisk manager-interface stack-buffer buffer-overflow  

• 20:07

  Asterisk Project Security Advisory - AST-2012-003

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - An attacker attempting to connect to an HTTP session of the Asterisk Manager Interface can send an arbitrarily long string value for HTTP Digest Authentication. This causes a stack buffer overflow, with the possibility of remote code injection.

  Tags:  project security asterisk manager-interface stack-buffer buffer-overflow  

• 20:07

  Asterisk Project Security Advisory - AST-2012-003

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - An attacker attempting to connect to an HTTP session of the Asterisk Manager Interface can send an arbitrarily long string value for HTTP Digest Authentication. This causes a stack buffer overflow, with the possibility of remote code injection.

  Tags:  project security asterisk manager-interface stack-buffer buffer-overflow  

• January 04, 2012
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• December 23, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• November 23, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• November 07, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• August 14, 2011
• 17:09

  Asterisk Manager File Descriptor Resource Exhaustion Vulnerability

   » ‎ SecuriTeam
  A Denial of Service vulnerability was identified on systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  vulnerability service asterisk manager-interface resource-exhaustion service-vulnerability  

• June 23, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• May 17, 2011
• 0:00

  Vuln: Asterisk Manager Interface Arbitrary Command Execution Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Asterisk Manager Interface Arbitrary Command Execution Security Bypass Vulnerability

  Tags:  manager asterisk interface manager-interface command-execution arbitrary-command  

• April 26, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  apache-tomcat manager-interface vulnerability  

• 0:00

  Vuln: Asterisk Manager Interface Arbitrary Command Execution Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Asterisk Manager Interface Arbitrary Command Execution Security Bypass Vulnerability

  Tags:  manager asterisk interface manager-interface command-execution arbitrary-command  

• 0:00

  Vuln: Asterisk Manager Interface Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Asterisk Manager Interface Remote Denial of Service Vulnerability

  Tags:  manager asterisk interface service-vulnerability manager-interface denial-of-service  

• April 21, 2011
• 17:19

  Asterisk Project Security Advisory - AST-2011-006

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the "Async" header with the "Application" header during an Originate action, allows authenticated manager users to execute shell commands. Only users with the "system" privilege should be able to do this.

  Tags:  shell-commands manager-interface manager-users  

• 17:19

  Asterisk Project Security Advisory - AST-2011-006

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the "Async" header with the "Application" header during an Originate action, allows authenticated manager users to execute shell commands. Only users with the "system" privilege should be able to do this.

  Tags:  project security asterisk manager-interface shell-commands manager-users  

• 17:19

  Asterisk Project Security Advisory - AST-2011-006

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the "Async" header with the "Application" header during an Originate action, allows authenticated manager users to execute shell commands. Only users with the "system" privilege should be able to do this.

  Tags:  project security asterisk manager-interface shell-commands manager-users  

• 16:58

  Asterisk Project Security Advisory - AST-2011-005

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.

  Tags:  project security asterisk manager-interface project-security security-advisory  

• 16:58

  Asterisk Project Security Advisory - AST-2011-005

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.

  Tags:  project security asterisk manager-interface project-security security-advisory  

• 16:58

  Asterisk Project Security Advisory - AST-2011-005

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.

  Tags:  project security asterisk manager-interface project-security security-advisory  

• April 01, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• March 31, 2011
• 0:00

  Vuln: Asterisk Manager Interface Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Asterisk Manager Interface Remote Denial of Service Vulnerability

  Tags:  service-vulnerability manager-interface denial-of-service  

• March 29, 2011
• 0:00

  Vuln: Asterisk Manager Interface Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Asterisk Manager Interface Remote Denial of Service Vulnerability

  Tags:  service-vulnerability manager-interface denial-of-service  

• March 17, 2011
• 6:50

  Asterisk Resource Exhaustion In Manager Interface

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - The Asterisk Manager Interface suffers from a denial of service vulnerability. Versions 1.6.1.x, 1.6.2.x, and 1.8.x are all affected.

  Tags:  exhaustion resource asterisk manager-interface resource-exhaustion service-vulnerability  

• 6:50

  Asterisk Resource Exhaustion In Manager Interface

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - The Asterisk Manager Interface suffers from a denial of service vulnerability. Versions 1.6.1.x, 1.6.2.x, and 1.8.x are all affected.

  Tags:  exhaustion resource asterisk manager-interface resource-exhaustion service-vulnerability  

• 6:50

  Asterisk Resource Exhaustion In Manager Interface

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - The Asterisk Manager Interface suffers from a denial of service vulnerability. Versions 1.6.1.x, 1.6.2.x, and 1.8.x are all affected.

  Tags:  exhaustion resource asterisk manager-interface resource-exhaustion service-vulnerability  

• February 18, 2011
• 16:46

  Mandriva Linux Security Advisory 2011-030

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2011-030 - Multiple vulnerabilities has been found and corrected in tomcat5. When running under a SecurityManager, access to the file system is limited but web applications are granted read/write permissions to the work directory. This directory is used for a variety of temporary files such as the intermediate files generated when compiling JSPs to Servlets. The location of the work directory is specified by a ServletContect attribute that is meant to be read-only to web applications. However, due to a coding error, the read-only setting was not applied. Therefore, a malicious web application may modify the attribute before Tomcat applies the file permissions. This can be used to grant read/write permissions to any area on the file system which a malicious web application may then take advantage of. This vulnerability is only applicable when hosting web applications from untrusted sources such as shared hosting environments. The HTML Manager interface displayed web application provided data, such as display names, without filtering. A malicious web application could trigger script execution by an administrative user when viewing the manager pages.

  Tags:  web file application mandriva-linux manager-interface intermediate-files  

• 16:46

  Mandriva Linux Security Advisory 2011-030

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2011-030 - Multiple vulnerabilities has been found and corrected in tomcat5. When running under a SecurityManager, access to the file system is limited but web applications are granted read/write permissions to the work directory. This directory is used for a variety of temporary files such as the intermediate files generated when compiling JSPs to Servlets. The location of the work directory is specified by a ServletContect attribute that is meant to be read-only to web applications. However, due to a coding error, the read-only setting was not applied. Therefore, a malicious web application may modify the attribute before Tomcat applies the file permissions. This can be used to grant read/write permissions to any area on the file system which a malicious web application may then take advantage of. This vulnerability is only applicable when hosting web applications from untrusted sources such as shared hosting environments. The HTML Manager interface displayed web application provided data, such as display names, without filtering. A malicious web application could trigger script execution by an administrative user when viewing the manager pages.

  Tags:  web file application mandriva-linux manager-interface intermediate-files  

• 16:46

  Mandriva Linux Security Advisory 2011-030

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2011-030 - Multiple vulnerabilities has been found and corrected in tomcat5. When running under a SecurityManager, access to the file system is limited but web applications are granted read/write permissions to the work directory. This directory is used for a variety of temporary files such as the intermediate files generated when compiling JSPs to Servlets. The location of the work directory is specified by a ServletContect attribute that is meant to be read-only to web applications. However, due to a coding error, the read-only setting was not applied. Therefore, a malicious web application may modify the attribute before Tomcat applies the file permissions. This can be used to grant read/write permissions to any area on the file system which a malicious web application may then take advantage of. This vulnerability is only applicable when hosting web applications from untrusted sources such as shared hosting environments. The HTML Manager interface displayed web application provided data, such as display names, without filtering. A malicious web application could trigger script execution by an administrative user when viewing the manager pages.

  Tags:  web file application mandriva-linux manager-interface intermediate-files  

• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• February 14, 2011
• 12:21

  Debian Security Advisory 2160-1

   » ‎ Packet Storm Security Advisories
  Debian Linux Security Advisory 2160-1 - Several vulnerabilities were discovered in the Tomcat Servlet and JSP engine. It was discovered that the SecurityManager insufficiently restricted the working directory. It was discovered that the HTML manager interface is affected by cross-site scripting. It was discovered that NIO connector performs insufficient validation of the HTTP headers, which could lead to denial of service.

  Tags:  advisory debian security tomcat-servlet jsp-engine manager-interface  

• 12:21

  Debian Security Advisory 2160-1

   » ‎ Packet Storm Security Recent Files
  Debian Linux Security Advisory 2160-1 - Several vulnerabilities were discovered in the Tomcat Servlet and JSP engine. It was discovered that the SecurityManager insufficiently restricted the working directory. It was discovered that the HTML manager interface is affected by cross-site scripting. It was discovered that NIO connector performs insufficient validation of the HTTP headers, which could lead to denial of service.

  Tags:  advisory debian security tomcat-servlet jsp-engine manager-interface  

• 12:21

  Debian Security Advisory 2160-1

   » ‎ Packet Storm Security Misc. Files
  Debian Linux Security Advisory 2160-1 - Several vulnerabilities were discovered in the Tomcat Servlet and JSP engine. It was discovered that the SecurityManager insufficiently restricted the working directory. It was discovered that the HTML manager interface is affected by cross-site scripting. It was discovered that NIO connector performs insufficient validation of the HTTP headers, which could lead to denial of service.

  Tags:  advisory debian security tomcat-servlet jsp-engine manager-interface  

• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• October 28, 2010
• 1:01

  ZDI-10-226.txt

   » ‎ Packet Storm Security Recent Files
  Zero Day Initiative Advisory 10-226 - This vulnerability allows remote attackers to inject arbitrary SQL into the backend database on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IM Manager interface exposed by the web server which listens by default on TCP port 80. The rdpageimlogic.aspx file does not validate the rdReport variable when parsing requests. It parses SQL statements from the file pointed to by this variable. A remote attacker can abuse this behavior to inject arbitrary SQL into the backend database.

  Tags:  vulnerability backend sql manager.-authentication tcp-port-80 manager-interface backend-database  

• 1:00

  ZDI-10-226.txt

   » ‎ Packet Storm Security Advisories
  Zero Day Initiative Advisory 10-226 - This vulnerability allows remote attackers to inject arbitrary SQL into the backend database on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IM Manager interface exposed by the web server which listens by default on TCP port 80. The rdpageimlogic.aspx file does not validate the rdReport variable when parsing requests. It parses SQL statements from the file pointed to by this variable. A remote attacker can abuse this behavior to inject arbitrary SQL into the backend database.

  Tags:  vulnerability backend sql manager.-authentication tcp-port-80 manager-interface backend-database