N-Stalker has made available the latest database update (v115) for N-Stealth

Web Security Scanner.

An important security check was added concerning the new Apache httpd server
release. A summary of these vulnerabilities can be found below:
– mod_cgid mishandling of CGI redirect paths could result in CGI output going

to the wrong client when a threaded MPM is used [CAN-2003-0789]
– A buffer overflow could occur in mod_alias and mod_rewrite when a regular
expression with more than 9 captures is configured [CAN-2003-0542]

You might download version 2.0.48 or 1.3.29 (according to your installation)
at http://httpd.apache.org.

This updates are available for the N-Stealth 5.2 version. If you are currently

using an old version, please, contact us at:

E-mail: support@nstalker.com (24hs) or

Phone: +55-11-3675-7093 (9am to 18pm GMT-0300)

This release has included the following vulnerabilities:

– Apache 2.0.47 and 1.3.28 mod_rewrite/mod_alias Vulnerability
– BEA WebLogic 8.1 InteractiveQuery.jsp Cross-Site Scripting Vulnerability
– Citrix Metaframe XP Cross-site Scripting Vulnerability
– Plug and Play Web Server Remote Denial of Service Vulnerability
– Ashley Brown iWeb Server Encoded Backslash Directory Traversal Vulnerability
– BEA Tuxedo and WebLogic Enterprise Input Validation Vulnerability
– Booby 0.2.3 Error Message Cross-Site Scripting Vulnerability
– Ledscripts LedForums Multiple Fileds HTML Injection Vulnerability
– E107 0.6.3 Chatbox.php Denial of Service Vulnerability
– InfronTech WebTide 7.0.4 Directory/File Disclosure Vulnerability
– Centrinity FirstClass 7.1 HTTP Server Directory Disclosure Vulnerability
– RedHat 9.0 Apache Directory Index Default Configuration Error
– Les Visiteurs 2.1 Multiple Remote File Include Vulnerabilities
– Musicqueue 1.1.1 Multiple Buffer Overrun Vulnerabilities
– thttpd defang 2.23 Remote Buffer Overflow Vulnerability
– Multiple Advanced Poll 2.0.2 PHP Vulnerabilities
– Apache Cocoon 2.2 Directory Traversal Vulnerability
– PSCS VPOP3 2.0e Email Server WebAdmin Cross-Site Scripting Vulnerability
– Sun Management Center 3.5 Error Message Information Disclosure Vulnerability
– DansGuardian 2.7.3 Denied URL Cross-Site Scripting Vulnerability
– Vivisimo Clustering Engine Search Script Cross-Site Scripting Vulnerability
– FuzzyMonkey MyClassifieds 2.11 Email Variable SQL Injection Vulnerability
– Web Wiz 7.0.1 Forums Multiple Cross-Site Scripting Vulnerabilities
– Bytehoard 0.7 File Disclosure Vulnerability
– Caucho Resin 2.1.2 Multiple HTML Injection and Cross-site Scripting
Vulnerabilities
– Origo ADSL Router 3.2.1 Remote Administrative Interface Configuration
Vulnerability
– DeskPro 1.1.0 Multiple SQL Injection Vulnerabilities
– Dansie Shopping Cart Server Error Message Installation Path Disclosure
Vulnerability
– Geeklog 1.3.8 Forgot Password SQL Injection Vulnerability
– CPCommerce 0.5f Functions Remote File Include Vulnerability
– My Photo Gallery 3.5 Unspecified Vulnerability
– GoldLink 3.0 Cookie SQL Injection Vulnerability
– PHP-Nuke 7.0 Search Field Path Disclosure Vulnerability

N-Stealth DB General Information
Version: 115
Release Date: 11/02/2003