Similar to previously reported vulnerabilities, Symantec’s Mail Security Appliance is vulnerable to denial of service and a buffer overflow. This is due to insecurity in a third party tool. The exploit can be triggered when the appliance checks a specially crafted file. Administrators are recommended to update to version 5.0.0-36 or later.

Two ActiveX controls installed on client systems using SonicWALL SSL VPN contain vulnerabilities. The first, NeLaunchCtrl, contains boundary errors in a number of functions that could result in a buffer overflow by visiting a malicious site. The WebCacheCleaner control contains an insecure “FileDelete()” method that can be exploited to delete arbitrary files on a system. Firewall admins should update to firmware version 2.5 for SonicWALL SSL VPN 2000/4000, and version 2.1 for SonicWALL SSL-VPN 200.

Hewlett-Packard OpenView Radia Integration Server contains a vulnerability that could allow remote attackers to access arbitrary files on the system. The issues is within the HTTP server running on TCP port 3456 and can be exploited without authentication. Attackers could use this to access configuration or log files which could aid in furthering an attack.

In other news, Firefox update 2.0.0.9 has been released. This is not a security fix, but a stability release. Users should be running at least version 2.0.0.8.

A mac based Trojan, a malicious video codec, is in the wild. Spam emails directing people to pornographic websites are hoping to lure users in to downloading a required codec to watch videos. Once downloaded, no codec is actually installed but a Trojan virus instead.