Forums Usage Guidelines

Forums Usage Guidelines

Symantec provides
these Norton Forums as a service to
help customers exchange ideas, tips, information, and techniques
related to
our products. These Forums are here for the enjoyment and benefit on
Symantec customers, and are accessible to all who register and are 13
years of age or older. These guidelines and
rules are presented here so that you know what is expected of you and
what you can expect from other participants when using the Forums. By
participating, you agree to follow these Usage Guidelines.

– Stay on topic –

 

For
everyone’s benefit please stay on topic. These Forums are provided for
the specific purpose of making it possible for Symantec customers to
exchange information and help each other in using Symantec products.
Please refrain from discussing personal matters, abusing
any company or product, or, in general, from posting in a manner
unrelated to the direct resolution of issues expected in the support of
Symantec beta products.

 

 

– Keep it courteous –

Everyone
wants to have a positive experience while on the Forums – please make
sure that you are not detracting from any other participants
experience. In particular, please refrain from posting anything
unlawful, libelous, defamatory, obscene, pornographic, indecent, lewd,
harassing, threatening, harmful, invasive of privacy or publicity
rights, abusive, inflammatory or otherwise objectionable or injurious
to third parties. Your opinions are always welcome, but personal
attacks and harassment ( “flaming” ) in either the Forums or through
private messaging are not acceptable.

– Keep it spam-free –

The
Forums are provided as a benefit to Symantec customers and
are not intended for the promotion of third party services, products,
websites, or organizations. Please refrain from posting content that
would constitute advertising, junk mail, spam, chain letters, or any
other form of unauthorized solicitation.

– Keep it legal –

It
is unacceptable to post any material (i) that would infringe on any
patent, trademark, trade secret, copyright, or other proprietary rights
of any party, (ii) that contains software viruses or any other computer
code or files that are designed to disrupt, damage, or limit the
functioning of any software or hardware, or (iii) that is deemed to be
illegal by any local, state, federal, or international law.

– Be careful –

Most
people are happy to help out on these Forums, but remember that their
advice is theirs only and that you are responsible for deciding whether
or not to follow it. If the advice given by a participant sounds wrong
to you, do not try it. In particular, if any participant asks you for
personal information, such as an account number, address, password or
credit card number, do not provide it.

– Symantec retains the right to remove content and limit users’ access –

Symantec
does not generally edit or monitor content posted by participants to
the Forums. However, Symantec retains the right, at its sole
discretion, to limit participants access to the Forums and to remove
material that, in the sole judgment of Symantec, does not comply with the
present Usage Guidelines, or that is otherwise inappropriate for these
Forums, harmful, objectionable, or inaccurate. Symantec is not
responsible for any failure or delay in removing such material.

Symantec
Forum moderators may take any action they deem necessary in their own
judgment to support the Usage Guidelines. Such actions may include
editing or deleting material and banning individual participants.

– Disclaimer of Warranties and Limitation of Liability –

Members
like you are providing most of the material in the Forums. Such
third-party content is the sole responsibility of the person
originating the material. Symantec does not control and is not
responsible for this third-party material.

Symantec does not
warrant or guarantee the accuracy, reliability, completeness,
usefulness, non-infringement on intellectual property rights, or
quality of any material in the Forums, regardless of who originates
that material. You expressly understand and agree that you bear all
risks associated with using or relying on the material. Symantec will
not be liable or responsible in any way for any content in the Forums,
including, but not limited to, any errors or omissions in the material,
or for any losses or damage of any kind incurred as a result of the use
of or reliance on any material. This disclaimer and limitation on
liability is in addition to the disclaimers and limitations contained
in the Legal Notices posted on Symantecs web site that apply to all use
of Symantecs web site, which can be found at http://www.symantec.com/about/profile/policies/legal.jsp.
In case of discrepancy between this document and Symantec Legal
Notices, or with the Symantec Privacy Policy, the Legal Notices and the
Privacy Policy will prevail.

CVE-2008-1531

The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost. (CVSS:4.3) (Last Update:2011-10-11)

CVE-2008-1360

Cross-site scripting (XSS) vulnerability in Nagios before 2.11 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts, a different issue than CVE-2007-5624. (CVSS:4.3) (Last Update:2008-09-05)

CVE-2008-1270

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory. (CVSS:5.0) (Last Update:2008-09-05)

SA-2008-018 – Drupal core – Cross site scripting

  • Advisory ID: DRUPAL-SA-2008-018
  • Project: Drupal core
  • Version: 6.0
  • Date: 2008-February-27
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Multiple cross site scripting vulnerabilities

Description

Titles are not escaped prior to being displayed on content edit forms, allowing users to inject arbitrary HTML and script code into these pages.

The Drupal.checkPlain function, used to escape text in ECMAScript, contains a bug which causes it to escape only the first instance of a character, allowing users to inject arbitrary HTML and script code in certain pages.

Wikipedia has more information about cross site scripting (XSS).

Versions affected

  • Drupal 6.x before version 6.1.

Solution

Install the latest version:

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade.

Reported by

  • Steve McKenzie discovered the ECMAScript issue
  • The Drupal security team

Contact

The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Drupal version: 

CVE-2008-0983

lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access. (CVSS:5.0) (Last Update:2008-09-10)

Software and Security Information