SecurityFocus Newsletter #234
John Boletta <[email protected]> Mon, 2 Feb 2004 13:06:43 -0700 (MST)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #234 ------------------------------ This issue sponsored by: Tenable Network Security Doing network vulnerability scanning? Did you have to ask for permission? Did you have to beg for forgiveness from the admins you caused panic and disruption to? Try NeVO, the worlds only 100% passive vulnerability scanner, from Tenable Network Security! http://www.securityfocus.com/sponsor/TenableSecurity_sf-news_040202 For your 30 day demo please contact: [email protected] ------------------------------------------------------------------------ I. FRONT AND CENTER 1. The Soft Underbelly: Attacking the Client 2. Digital Signatures and European Laws 3. Worms Hit Home 4. We are pleased to announce a new search engine on SecurityFocus. II. BUGTRAQ SUMMARY 1. Sun Solaris modload() Unauthorized Kernel Module Loading Vul... 2. Finjan SurfinGate FHTTP Restart Command Execution Vulnerabil... 3. Novell Netware Enterprise Web Server Multiple Vulnerabilitie... 4. QuadComm Q-Shop Cross Site Scripting Vulnerabilities 5. QuadComm Q-Shop SQL Injection Vulnerabilities 6. Reptile Web Server Remote Denial Of Service Vulnerability 7. RhinoSoft Serv-U FTP Server MDTM Command Stack Overflow Vuln... 8. Oracle HTTP Server isqlplus Cross-Site Scripting Vulnerabili... 9. TinyServer Multiple Vulnerabilities 10. Borland Webserver for Corel Paradox Directory Traversal Vuln... 11. Microsoft Windows XP Explorer Self-Executing Folder Vulnerab... 12. IBM Net.Data db2www Error Message Cross-Site Scripting Vulne... 13. Gaim Multiple Remote Boundary Condition Error Vulnerabilitie... 14. Gallery Remote Global Variable Injection Vulnerability 15. Herberlin BremsServer Cross-Site Scripting Vulnerability 16. mIRC DCC Get Dialog Denial Of Service Vulnerability 17. Herberlin BremsServer Directory Traversal Vulnerability 18. Mbedthis Software AppWeb HTTP Server Empty Options Request D... 19. Antologic Antolinux Administrative Interface NDCR Parameter ... 20. Cherokee Error Page Cross Site Scripting Vulnerability 21. Xoops Viewtopic.php Cross-Site Scripting Vulnerability 22. Kietu Index.PHP Remote File Include Vulnerability 23. InternetNow ProxyNow Multiple Stack and Heap Overflow Vulner... 24. BEA WebLogic Operator/Admin Password Disclosure Vulnerabilit... 25. BEA WebLogic Server and Express SSL Client Privilege Escalat... 26. BEA WebLogic Server/Express Potential Administrator Password... 27. Apple Security Update 2004-01-26 Released To Fix Multiple Vu... 28. BEA WebLogic Incorrect Operator Permissions Password Disclos... 29. WebLogic Server and Express HTTP TRACE Credential Theft Vuln... 30. TCPDump ISAKMP Decoding Routines Denial Of Service Vulnerabi... 31. Novell Groupwise Webacc Cross Site Scripting Vulnerability 32. Apple Mac OS X TruBlueEnvironment Local Buffer Overflow Vuln... 33. Microsoft Internet Explorer CLSID File Extension Misrepresen... 34. IBM Informix Multiple Local Privilege Escalation Vulnerabili... 35. IBM Informix Dynamic Server/Informix Extended Parallel Serve... 36. Internet Security Systems BlackICE PC Protection Upgrade Fil... 37. Internet Security Systems BlackICE PC Protection blackd.exe ... 38. OracleAS TopLink Mapping Workbench Weak Encryption Algorithm... 39. BRS WebWeaver ISAPISkeleton.dll Cross-Site Scripting Vulnera... 40. DotNetNuke Multiple Vulnerabilities 41. Loom Software SurfNow Remote HTTP GET Request Denial Of Serv... 42. TRR19 Privilege Escalation Vulnerability 43. Macromedia ColdFusion MX Security Sandbox Circumvention Vuln... 44. Macromedia ColdFusion MX Form Fields Denial of Service Vulne... 45. Third-party CVSup Binary Insecure ELF RPATH Library Replacem... 46. PJ CGI Neo Review Directory Traversal Vulnerability 47. Kerio Personal Firewall Local Privilege Escalation Vulnerabi... 48. CPAN WWW::Form HTML Injection Vulnerability III. SECURITYFOCUS NEWS ARTICLES 1. DARPA-funded Linux security hub withers 2. 'Warspying' San Francisco 3. Online fraud, I.D. theft soars 4. 'Mydoom' computer virus brings down SCO Group's Web site 5. MS posts $250,000 MyDoom worm bounty 6. Microsoft offers $250,000 reward for arrest of author of lat... IV. SECURITYFOCUS TOP 6 TOOLS 1. Andutteye Surveillance (server) v1.16 2. PIKT - Problem Informant/Killer Tool v1.16.1 3. Jailkit v0.5 4. File Integrity Command & Control v1.2.1 5. DNS Blacklist Packet Filter v0.1 6. Revelation v0.1.1 V. SECURITYJOBS LIST SUMMARY 1. Security Researcher, Silicon Valley, ArcSight (Thread) 2. Security Sales Engineer-Atlanta region (Thread) 3. Symantec Looking for Sr. Security Consultant - VA, C... (Thread) 4. Technology & Operational Risk Management Executive -... (Thread) 5. Director of Sales - NY/NJ (Thread) 6. Security Software Developer(s) (Contract), Mechanics... (Thread) 7. Security Job Opportunities - New Zealand (Thread) 8. Sr. Network Planning Security Engineer with Verizon ... (Thread) 9. Security Consultant - Software Security Audit (Bueno... (Thread) 10. CISSP seeks Information Security Officer position (Thread) 11. Channel Manager/Director Need - Security Technologie... (Thread) 12. Principle Software Engineer - Security Research - Wa... (Thread) 13. 2 Security Analysts needed in DC/ Northern VA (Thread) 14. Security Analyst Position (Thread) 15. Direct Hire Positions - LOCATION (Please Read) (Thread) 16. Vulnerability Detection Engineer North Bay (Thread) 17. Security Engineer Position (Thread) 18. Entry-level Security Jobs in Los Angeles Area (Thread) 19. Direct Company Hire - Information Assurance Speciali... (Thread) 20. Direct Hire #2 - Security Engineer Position (Thread) 21. Product Marketing Manager Silicon Valley CA (Thread) 22. standards (Thread) 23. standards: update (Thread) 24. Senior Security Architect (East Coast-NYC Metro) Exc... (Thread) 25. Vulnerability Detection Eng Silicon Valley CA (Thread) 26. Director Marketing Communications (Thread) 27. InfoSec Engineers - Experienced Associates needed in... (Thread) 28. Architect/Program Manager - Security Hardware/OS (Thread) 29. IT Director position in Los Angeles area (Thread) 30. VA/MD/DC Account Executive- Urgent Need (Thread) 31. Manager of Penetration Testers (Thread) 32. Highly experienced security professional looking for... (Thread) 33. Security Software Sales Manager (Thread) 34. Pre Sales Engineer Manager (Thread) 35. Management / Security engineer (Thread) 36. Seeking a Security Engineer in Columbus, OH (Thread) 37. IT Auditor vacancy (Thread) 38. Security Software Implementation Opportunities (Thread) 39. Looking for a Hero - Technology 'Neutral' Manager of... (Thread) 40. Network Security Planning Engineer with Verizon Wire... (Thread) 41. experience vs. cert/degree - trade vs. profession (Thread) 42. InfoSec Engineers - Sr. Associate needed in Los Ange... (Thread) 43. Looking for position in Wash DC/Baltimore MD area (Thread) 44. Two week giving notice/no notice when being terminat... (Thread) VI. INCIDENTS LIST SUMMARY 1. Novarg (Thread) 2. new IIS exploit? (Thread) 3. exact signature for mydoom / novarg (Thread) 4. Yet another Visa scam scheme (Thread) 5. Blaster Recurrence (Thread) 6. Good Advice Anti-Virus Companies had a Virus Update... (Thread) 7. Novarg - Stopping .Zip Files (Thread) 8. best defense (was: Re: Novarg (Thread) 9. Novarg DOS Payload (Thread) 10. Dead Threads: Novarg/filtering/policies/usereducatio... (Thread) 11. (Fwd) how to filter the Novarg virus (Thread) 12. Does Anyone have the MyDoom.B Virus? (Thread) 13. how to filter the Novarg virus (Thread) 14. New variant of Virus ? --> issue identified. (Thread) 15. New variant of Virus ? (Thread) 16. (Moderator Note) Re: Anyome else seeing a rise in My... (Thread) 17. (Moderator Note) Re: Anyome else seeing a rise in My... (Thread) 18. [Securityfocus-incidents] Re: Fw: Anyome else seeing... (Thread) 19. Anyome else seeing a rise in Mydoom Viruses over ema... (Thread) 20. Fw: Anyome else seeing a rise in Mydoom Viruses over... (Thread) 21. RES: Novarg (Thread) 22. Novarg/Mydoom coming in through web pages? (Thread) 23. (Moderator Note) Re: Anyome else seeing a rise in My... (Thread) 24. Announcement: New Search Engine at SecurityFocus.com (Thread) 25. (Moderator Note) Anyome else seeing a rise in Mydoo... (Thread) VII. VULN-DEV RESEARCH LIST SUMMARY 1. Obfuscated shellcode (Thread) 2. Hacking USB Thumbdrives, Thumprint authentication (Thread) 3. Oracle toplink mapping workbench password algorithm (Thread) 4. Alphanumeric GetPC: alphanumeric_opcodes_defines.h (Thread) 5. Alphanumeric GetPC code. (was: GetPC code (was: Shel... (Thread) 6. vBulletin Patch Information (vBulletin Security Vuln... (Thread) 7. vBulletin Security Vulnerability - POC (Thread) 8. --== Fragementation Attacks ==-- (Thread) VIII. MICROSOFT FOCUS LIST SUMMARY 1. Controlling Admin Access (Thread) 2. SMTP Service in private DMZ OK? (Thread) 3. terminal server (Thread) 4. Encrypt data - SQL Server 2000 (Thread) 5. SecurityFocus Microsoft Newsletter #173 (Thread) IX. SUN FOCUS LIST SUMMARY 1. SPARC assembly training courses? (Thread) X. LINUX FOCUS LIST SUMMARY 1. UNIX Authentication (Thread) 2. Shadow files and the password "!!". (Thread) XI. UNSUBSCRIBE INSTRUCTIONS XII. SPONSOR INFORMATION I. FRONT AND CENTER ------------------- 1. The Soft Underbelly: Attacking the Client By Tom Vogt This article discusses the lack of security inside many corporate networks once hackers have breached the border perimeter and firewall. Client-based attack vectors, malicious payloads and their potential impact to an organization are also discussed. http://www.securityfocus.com/infocus/1758 2. Digital Signatures and European Laws By Mirella Mazzeo This article discusses the security requirements for electronic communications and commerce with European governments and many European- based businesses. It will also give an overview of the current trends for public key infrastructure in Europe, useful for any organization that does business with the EU. http://www.securityfocus.com/infocus/1756 3. Worms Hit Home By Kelly Martin The fact that each of us can only control and manage the patches and virus definitions on machines within our own borders means little as we watch the promulgation of malcode on millions of home machines outside of our control. http://www.securityfocus.com/columnists/216 4. We are pleased to announce a new search engine on SecurityFocus, offering faster and more intuitive results. Features include site wide or section specific searching by author, headline or entire document and sorting by date, headline or URL. II. BUGTRAQ SUMMARY ------------------- 1. Sun Solaris modload() Unauthorized Kernel Module Loading Vul... BugTraq ID: 9477 Remote: No Date Published: Jan 22 2004 Relevant URL: http://www.securityfocus.com/bid/9477 Summary: Sun has reported a vulnerability in the Solaris kernel that may permit unprivileged local users to load arbitrary kernel modules. The source of the problem is reportedly insufficient checks when modload() is called to load a module. This issue is known to affect Solaris versions 7-9 on both SPARC and x86 platforms. In this manner, a local attacker may load a kernel module that compromises system security properties and allows the attacker to gain root access on the system. There are few technical details about this vulnerability at the time of writing. This BID will be updated as more information becomes available. 2. Finjan SurfinGate FHTTP Restart Command Execution Vulnerabil... BugTraq ID: 9478 Remote: Yes Date Published: Jan 23 2004 Relevant URL: http://www.securityfocus.com/bid/9478 Summary: SurfinGate is a commercially available content filtering and application firewall package. It is distributed by Finjan, and available for the Sun Solaris and Microsoft Windows platforms. Finjan SurfinGate is prone to a vulnerability that may permit remote attackers to execute certain management commands (using the FHTTP protocol) through the management control port (3141/TCP). The source of the vulnerability is insufficient authorization of remotely supplied restart commands. While it may be possible to filter access by untrusted IPs to the control port, these commands could also be issued via the HTTP proxy included in the software, so will appear to originate from the localhost in this instance and could theoretically bypass access controls for untrusted external IPs. It has been reported that commands could be issued to restart the server, most likely resulting in a denial of service. 3. Novell Netware Enterprise Web Server Multiple Vulnerabilitie... BugTraq ID: 9479 Remote: Yes Date Published: Jan 23 2004 Relevant URL: http://www.securityfocus.com/bid/9479 Summary: Multiple vulnerabilities have been identified in Novell Netware Enterprise Web Server that may allow an attacker to carry out cross-site scripting attacks, disclose sensitive information, and load potentially malicious files on a vulnerable server. It has been reported that the software may be prone to multiple cross-site scripting vulnerabilities that may allow a remote attacker to launch cross-site scripting attacks. Reportedly, the software contains various variables that are prone to these attacks due to insufficient sanitization of user-supplied data. Various proof of concepts including vulnerable variables have been provided in the report. Successful exploitation of these issues may allow an attacker to steal cookie based authentication credentials and carry out other attacks. An information disclosure issue has been identified in the software as well. It has been reported that a remote attacker may be able to view sensitive data such as internal IP addresses and other unspecified server information. This attack may be carried out by accessing certain files such as snoop.jsp, SnoopServlet, env.bas, and lcgitest.nlm. Successful exploitation of this issue may allow an attacker to gain access to sensitive data that could be used to launch further attacks against a system. Another issue may allow an attacker to access directory listings on a vulnerable server. It has been reported that this issue may be exploited by accessing various pages on a vulnerable server. Successful exploitation of this issue may allow an attacker to gain access to sensitive data that could be used to launch further attacks against a system. A path disclosure issue may also exist in the software that may allow an attacker to gain sensitive information about the file system that could aid in launching more direct attacks against the system. This issue may be exploited via a malicious URI request including '\/' characters. Finally, it has been reported that an attacker may be able to load Microsoft Hypertext Template (.htt) files to a server. This issue may allow an attack to upload potentially malicious files to the server that may corrupt other files. These issues are reported to affect Netware Enterprise Web Server 5.1 and 6.0. Other versions may be affected as well. These issues are currently undergoing further analysis. This cumulative BID will be separated into individual entries when analysis is complete. 4. QuadComm Q-Shop Cross Site Scripting Vulnerabilities BugTraq ID: 9480 Remote: Yes Date Published: Jan 23 2004 Relevant URL: http://www.securityfocus.com/bid/9480 Summary: Q-Shop is an online shopping cart application built for e-commerce web sites. It uses Active Server Pages as well as MS Access or MS-SQL to store data and is built for Windows platforms. Q-Shop has been reported to contain multiple cross-site scripting vulnerabilities. This issue is due to the application failing to perform proper sanitization of values passed through URI parameters, which are then included in dynamically generated web pages. It has been reported that these issues affect the 'imagezoom.asp' and 'recommend.asp' scripts. An attacker can exploit this by creating a specially crafted URI link containing malicious HTML and script code and enticing a user to visit it. These vulnerabilities could allow an attacker to steal cookie-based authentication credentials. Since the attacker may influence how the site will be rendered to the victim user, other attackers are also possible. 5. QuadComm Q-Shop SQL Injection Vulnerabilities BugTraq ID: 9481 Remote: Yes Date Published: Jan 23 2004 Relevant URL: http://www.securityfocus.com/bid/9481 Summary: Q-Shop is an online shopping cart application built for e-commerce web sites. It uses Active Server Pages as well as MS Access or MS-SQL to store data and is built for Windows platforms. It has been reported that Quadcomm's Q-Shop is vulnerable to multiple SQL injection vulnerabilities. This issue is caused by the failure of the application to properly validate user input, which will be included in database queries. The scripts that are vulnerable to SQL injection are reported to be 'search.asp', 'browse.asp', 'details.asp', 'showcat.asp', 'users.asp', 'addtomylist.asp', 'modline.asp', 'cart.asp' and 'newuser.asp'. In the above scripts user input is not properly validated, allowing an attacker to modify the structure and logic of SQL commands that are issued to the database. Furthermore, upon SQL error the system will report the exact details on the SQL failure, giving an attacker details on how to manipulate input to exploit these issues successfully. This issue could be leveraged to compromise the software, corrupt data within the database, disclose sensitive information or possibly execute arbitrary instructions on a vulnerable system due to the MS SQL xp_cmdshell functionality. 6. Reptile Web Server Remote Denial Of Service Vulnerability BugTraq ID: 9482 Remote: Yes Date Published: Jan 23 2004 Relevant URL: http://www.securityfocus.com/bid/9482 Summary: Reptile is a web server that is implemented in Python. Reptile has been reported prone to a remote denial of service vulnerability. It has been reported that this issue exists because the affected server does not time out on incomplete requests. Therefore a remote attacker may open multiple instances of incomplete HTTP requests to the affected service, effectively consuming server resources and ultimately denying service to legitimate users. This vulnerability has been reported to affect Reptile server version 20020105. 7. RhinoSoft Serv-U FTP Server MDTM Command Stack Overflow Vuln... BugTraq ID: 9483 Remote: Yes Date Published: Jan 24 2004 Relevant URL: http://www.securityfocus.com/bid/9483 Summary: RhinoSoft Serv-U FTP Server is designed for use with Microsoft Windows operating systems. Serv-U FTP Server is reportedly prone to a stack-based buffer overflow. When a 'site chmod' command is issued specifying a non-existant file, the FTP server will call the following sprintf command to display an error message: sprintf(dst, "%s: No such file or directory.", filename); The problem exists due to insufficient bounds checking on the 'dst' variable. The buffer assigned to this variable is 256 bytes. If the non-existant filename specified is greater than 256 bytes, the buffer will be overrun, resulting in a failure of the FTP server. It has been conjectured that this vulnerability may be exploited to execute arbitrary code in the security context of the Serv-U FTP Server process. It is important to note that this issue could only be exploited on a writeable directory on the FTP server. This vulnerability was reported to affect all versions of Serv-U FTP Server prior to 4.2. 8. Oracle HTTP Server isqlplus Cross-Site Scripting Vulnerabili... BugTraq ID: 9484 Remote: Yes Date Published: Jan 24 2004 Relevant URL: http://www.securityfocus.com/bid/9484 Summary: Oracle HTTP Server is a customized version of the Apache HTTP server. The Oracle HTTP Server is reportedly prone to a cross-site scripting issue in the 'username', 'password' and 'action' parameters of the 'isqlplus' component. This could permit a remote attacker to create a malicious link to the web server that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks. 9. TinyServer Multiple Vulnerabilities BugTraq ID: 9485 Remote: Yes Date Published: Jan 24 2004 Relevant URL: http://www.securityfocus.com/bid/9485 Summary: TinyServer is a small HTTP server that runs on Windows 95, 98, and 2000 operating systems. TinyServer is reportedly prone to multiple input validation issues. A remote attacker can view or download any file to which the server has access due to the server's failure to sanitize '/../' directory traversal sequences from input. Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system. A denial of service issue also exists due to the failure of the server to validate input strings. A malformed HTTP GET request can trigger this issue on the server. Sending an HTTP GET request containing excessively long data can also cause the server to fail. It is not currently known if this issue could be exploited to execute arbitrary code on the webserver. A cross-site scripting vulnerability is also present in the server. This could permit a remote attacker to create a malicious link to the web server that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks. 10. Borland Webserver for Corel Paradox Directory Traversal Vuln... BugTraq ID: 9486 Remote: Yes Date Published: Jan 24 2004 Relevant URL: http://www.securityfocus.com/bid/9486 Summary: Borland Web Server is a small webserver used for the Corel Paradox relational database. A vulnerability in Borland Web Server 1.0b3 and earlier has been reported that may allow a remote attacker to view files residing outside of the web server root directory on the affected system. This problem exists due to a failure to validate user specified URI data. It has been reported that the Borland Web Server fails to properly sanitize the user supplied URI. The sanitization of "//", "\.", "\..", "\", "\\", and "/../" sequences is performed by the server. However, if a "/..................../" or "/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c" sequence is used, the webroot can be escaped. An attacker may exploit this condition to disclose the contents of Web server readable files. Information harvested in this manner may be used to aid in further attacks targeted against the vulnerable system. 11. Microsoft Windows XP Explorer Self-Executing Folder Vulnerab... BugTraq ID: 9487 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9487 Summary: A vulnerability has been reported in Microsoft Windows XP that may result in execution of malicious code in the context of the currently logged in user. The flaw exists in Windows Explorer and may allow for executable content that is referenced from inside of a folder to be executed automatically when the folder is accessed. It has been demonstrated that an HTML folder that includes malicious scripting can call an arbitrary executable, which could be self-contained in the folder. It should be noted that the folder must exist on the vulnerable system, though it is possible that remote attackers could entice users to open a malicious folder via e-mail or by hosting it on a website. For example, a remote attacker could include the malicious folder in an archive, which a user may then download and then open. In this case, exploitation would occur when the folder inside the archive is accessed by the victim user. This vulnerability poses a security risk since it is assumed that opening a folder is a safe action and that executable content cannot be run when a folder is accessed. A locally based attacker could use this issue to gain elevated privileges on a system by placing the malicious folder in a location that will expectedly be accessed by another user. Remote attackers who can entice a user to download and access the malicious folder could exploit this issue to gain unauthorized remote access to a vulnerable system in the context of the victim user. Additionally, it has been reported that this issue may be exploitable remotely if the malicious folder is accessed from an SMB share. 12. IBM Net.Data db2www Error Message Cross-Site Scripting Vulne... BugTraq ID: 9488 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9488 Summary: IBM Net.Data is a scripting language that provides functionality for interacting with various data sources. It is also included in most versions of DB2. IBM Net.Data is prone to cross-site scripting attacks via error message output. This may permit a remote attack to create a link to a system hosting the software that includes embedded HTML and script code. This hostile code may be rendered in the web browser of a user who follows the malicious link. The source of the problem is that input supplied via URI parameters is displayed in error messages without adequate sanitization of HTML and script code. This vulnerability is known to exist in the db2www CGI component and occurs when HTML and script code are supplied as a macro name in a web request. The default setting is to display the invalid macro name in the error page but the CGI component may also be configured to use static error pages, which would effectively mitigate this issue. It has also been reported that other error messages may be similarly affected, though no specific information has been provided. Exploitation could permit theft of cookie-based authentication credentials or other attacks. 13. Gaim Multiple Remote Boundary Condition Error Vulnerabilitie... BugTraq ID: 9489 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9489 Summary: Gaim is an instant messaging client that supports numerous protocols. It is available for the Unix and Linux platforms. Several vulnerabilities in the handling of YMSG protocol, Oscar protocol, proxy handling, and Gaim utilities have been identified. Because of these issues, it may be possible for a remote attacker to gain unauthorized access to hosts using the vulnerable software. Reports indicate the following 12 problems: Due to two errors in the handling of octal decoding code used for e-mail notification, it is possible to create a condition suitable for heap-based overflow attacks. An overflow in the parsing of Yahoo Web cookies in HTTP headers exists when handling a specially prepared cookie. Initial reports indicate a low possibility of exploitation due to circumstances in memory management of various platforms. There is insufficient bounds checking of data returned from the Yahoo! Login page. Name and Value strings returned to the client from a system purporting to be the Yahoo! Login page could potentially result in the execution of arbitrary code on the client side. The YMSG protocol handler is vulnerable to a buffer overflow when handling keynames of excessive sizes, usually greater than 64 bytes. Remote communications with maliciously crafted keynames can be forwarded through the Yahoo! server. An integer overflow exists in the DirectIM handling by Gaim. A remote user sending a value to a vulnerable Gaim client with a payload length of UINT_MAX will result in an overflow in the calloc function. Due to two errors in the handling of Quoted Printable decoding code used for e-mail notification, it is possible to create conditions suitable for heap-based overflow attacks. The URI parsing utility contains an overflow in the handling of specially crafted URIs. An attacker could pass along a URI of excessive length to create an exploitable stack overflow. The Get User Info utility performs inadequate bounds checking on data received from the YMSG and MSN protocol handlers. Because of this, it is possible for a remote attacker to exploit a stack overflow in the utility to execute arbitrary code. A client-side overflow in the handling of HTTP proxy connections exists in Gaim. A remote proxy sending a string of data in excess of 8192 bytes could potentially create an exploitable stack overflow on the client system. These issues are undergoing further analysis and will be separated into individual BIDs when analysis is complete. *Update: Ultramagnetic, a concurrent fork of the Gaim instant messaging software, has also been reported to be affected by the issues listed under CAN-2004-0006, CAN-2004-0007 and CAN-2004-0008. 14. Gallery Remote Global Variable Injection Vulnerability BugTraq ID: 9490 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9490 Summary: Gallery is a web application designed to allow users to manage images on their web site, such as creating photo albums. Gallery is written in the PHP script language. A vulnerability has been reported to exist in Gallery. This issue, reported by the vendor, occurs due to improper simulation of the behaviour of register_globals when the register_globals settings is disabled. It has been reported that register_globals functionality is simulated by extracting the values of the various $HTTP_ global variables into the global namespace. Due to improper sanitization of user-supplied data, an attacker may be able to overwrite the value of 'HTTP_POST_VARS' via the register_global simulation. Successful exploitation of this issue may allow an attacker to include arbitrary PHP files via the 'GALLERY_BASEDIR' parameter. Other attacks such as gaining unauthorized access by supplying arbitrary values for global variables may be possible as well. Various attacks, may allow an attacker to execute arbitrary code on the remote system by including malicious PHP scripts into the PHP code executed by the web server and ultimately gain unauthorized access. The vendor has reported that this issue exists in Gallery versions 1.3.1, 1.3.2, 1.3.3, 1.4 and 1.4.1. 15. Herberlin BremsServer Cross-Site Scripting Vulnerability BugTraq ID: 9491 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9491 Summary: Herberlin BremsServer is a small HTTP server intended to be used as a testing platform for web page development. BremsServer is implemented with Java and is expected to run on all Java supported platforms. BremsServer has been reported to contain cross-site scripting vulnerabilities. This issue is due to the server failing to check or filter user strings that are sent to the server. This could permit a remote attacker to create a malicious link to the web server that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web server and may allow for theft of cookie-based authentication credentials or other attacks. It has been reported that version 1.2.4 of the software is vulnerable, however it is likely that previous versions of the software are also vulnerable. 16. mIRC DCC Get Dialog Denial Of Service Vulnerability BugTraq ID: 9492 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9492 Summary: mIRC is a chat client for the IRC protocol, designed for Microsoft Windows based operating systems. A vulnerability has been reported to exist in mIRC that may allow a remote attacker to crash a vulnerable mIRC client. The condition is most likely present due to insufficient boundary checking performed on 'DCC GET' requests. It has been reported that the issue will present itself only in certain circumstances. Specifically, the victim must have a minimized "DCC GET" dialog; this dialog must then be opened to "GET" a file that is named with a filename of excessive length. This will reportedly cause a violation in the affected software resulting in a crash. Although unconfirmed, due to the nature of this vulnerability it has been conjectured that a remote attacker may potentially lever this issue to have arbitrary code executed in the context of the affected mIRC client. It should be noted that although mIRC version 6.12 has been reported to be prone to this issue, other versions might be affected as well. 17. Herberlin BremsServer Directory Traversal Vulnerability BugTraq ID: 9493 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9493 Summary: Herberlin BremsServer is a small HTTP server intended to be used as a testing platform for web page development. BremsServer is implemented with Java and is expected to run on all Java supported platforms. It has been reported that a vulnerability in Herberlin BremsServer web server may allow an attacker to gain access to files residing outside of the web server root directory on the affected system. This issue exists due to a failure to validate user specified URI input. The BremsServer is reported to not validate user specified URI requests, and so request strings containing '../' directory traversal sequences will allow an attacker to escape the web server root directory and view web server readable files. Information acquired by exploiting this issue may be used to aid further attacks against a vulnerable system. It has been reported that version 1.2.4 of the software is vulnerable, however it is likely that previous versions of the software are also vulnerable. 18. Mbedthis Software AppWeb HTTP Server Empty Options Request D... BugTraq ID: 9494 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9494 Summary: Mbedthis Software AppWeb HTTP Server is an embedded Web Server solution. AppWeb HTTP Server has been reported prone to a denial of service vulnerability. It has been reported that a remote attacker may trigger this issue, by invoking a HTTP request against the affected server that contains an empty OPTIONS parameter. This will reportedly cause the server to crash. A remote attacker may exploit this condition to deny service to legitimate users. It should be noted that although this vulnerability has been reported to affect Mbedthis Software AppWeb HTTP Server version 1.0.0, other versions might also be affected. 19. Antologic Antolinux Administrative Interface NDCR Parameter ... BugTraq ID: 9495 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9495 Summary: Antologic Antolinux is a Linux server based server. The server is shipped with an administrative interface written in PHP. A vulnerability has been reported to exist in the administration interface of the product that may allow a remote attacker to execute arbitrary commands on vulnerable systems. The issue reportedly exists in the 'NDCR' parameter of the software. Due to insufficient sanitization of user-supplied input, data supplied to this variable will be interpreted in the shell. An attacker can exploit this vulnerability by passing malicious shell metacharacters to the software in order to execute arbitrary commands with the privileges of the server hosting the vulnerable software. It has been demonstrated that an attacker may gain access to the password file by carrying out a 'cat' command. An attacker may need to spoof the HTTP REFERER to carry out successful exploitation. Antologic Antolinux 1.0 has been reported to be prone to this issue, however, other versions may be affected as well. 20. Cherokee Error Page Cross Site Scripting Vulnerability BugTraq ID: 9496 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9496 Summary: Cherokee is a web server distributed under the GNU public license. It is available for numerous platforms, including Microsoft Windows and Unix/Linux variants. Cherokee has been reported to contain a cross-site scripting vulnerability. This issue is due to the server failing to check and filter user-supplied strings issued to the server in a web request, which are then included directly in error output. An attacker can exploit this issue by crafting a URI link containing the malevolent HTML or script code, and enticing a user to follow it. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web server and may allow for theft of cookie-based authentication credentials or other attacks. 21. Xoops Viewtopic.php Cross-Site Scripting Vulnerability BugTraq ID: 9497 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9497 Summary: Xoops is open-source, freely available web portal software written in object-oriented PHP. It is back-ended by a MySQL database and will run on most Unix and Linux distributions. A vulnerability has been reported to exist in Xoops that may allow a remote user to execute HTML or script code in a user's browser. The issue is reported to exist due to improper sanitizing of user-supplied data. It has been reported that HTML and script code may be parsed via the 'topic_id' and 'forum' URI parameters of 'newbb/viewtopic.php' script. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site. Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible. Xoops versions 2.x have been reported to be prone to this issue. 22. Kietu Index.PHP Remote File Include Vulnerability BugTraq ID: 9499 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9499 Summary: Kietu is web-based software to tracking web site usage statistics. It is implemented in PHP. A flaw exists in the Kietu 'index.php' script that may permit remote attackers to include malicious remote files. Remote users may influence the include path for the 'config.php' configuration file which may result in execution of arbitrary commands with the privileges of the webserver process. The issue surrounds the '$kietu[]' array variable. This variable contains application configuration variables including the 'url_hit' variable. An attacker may be able to specify this array variable by issuing a specially crafted URI to the application provided that the local PHP configuration has 'register_global' and 'allow_url_fopen' directives are enables. Please see the exploit section for more details. 23. InternetNow ProxyNow Multiple Stack and Heap Overflow Vulner... BugTraq ID: 9500 Remote: Yes Date Published: Jan 26 2004 Relevant URL: http://www.securityfocus.com/bid/9500 Summary: InternetNow ProxyNow is a proxy server that allows multiple users to access the Internet via one dial up connection. ProxyNow has been reported to be prone to multiple overflow vulnerabilities that may allow an attacker to execute arbitrary code in order to gain unauthorized access to a vulnerable system. The following specific issues have been identified in the software: A heap overflow condition has been reported to exist in the software. It has been reported that this condition presents itself when an attacker sends a HTTP GET request containing an excessively long URI to the server on TCP port 3128. The URI must be prefixed with the string 'ftp://'. By sending a malicious GET request a heap overflow condition may be triggered, potentially causing heap memory management structures to be corrupted. It has been reported that an attacker may exploit this vulnerability to trigger a denial of service condition. Due to the nature of this vulnerability an exploit may be written that manipulates heap management structures in a manner that is sufficient so that remote arbitrary code execution occurs. A stack based buffer overflow vulnerability has been identified in the software as well. The issue also presents itself when an attacker sends a HTTP GET request containing an excessively long URI to the server on TCP port 3128. The URI must be prefixed with the string 'ftp://'. The condition exists due to insufficient boundary checking. Because of this, it may be possible for a remote attacker to gain unauthorized access to a system running the vulnerable software. Immediate consequences of an attack may result in a denial of service condition. Successful exploitation of these vulnerabilities may allow a remote attacker to execute arbitrary code and gain SYSTEM level privileges. ProxyNow versions 2.75 and prior have been reported to be prone to these issues. 24. BEA WebLogic Operator/Admin Password Disclosure Vulnerabilit... BugTraq ID: 9501 Remote: No Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9501 Summary: WebLogic Server and WebLogic Express are enterprise application server products distributed by BEA Systems. BEA WebLogic Server and WebLogic Express are reported prone to a vulnerability that may result in the disclosure of Operator or Admin passwords. The issue is reported to exist in a circumstance where a "node manager" starts a "managed server". The username and password used to start the managed server may be deposited in plain-text format on the file system of the managed server, if the managed server fails during the boot process. An attacker who has interactive access to the affected managed server, may potentially exploit this issue in a timed attack, to harvest credentials when the managed server fails during the boot process. 25. BEA WebLogic Server and Express SSL Client Privilege Escalat... BugTraq ID: 9502 Remote: Yes Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9502 Summary: WebLogic Server and WebLogic Express are enterprise application server products distributed by BEA Systems. A problem has been reported in the use of SSL connections with WebLogic Web Services fat clients. An error in the fat client code could allow a user to connect with another user's identity, allowing them to issue commands within the other user's context. This issue presents itself when the fat client connects to the WebLogic Server using two-way SSL communications. If the client connects multiple times to the same URL with different client certificates, the client may connect to the wrong user identity. This would occur on the second connection and any subsequent connections. The cause of this may be related to re-use of SSL sessions, however, this has not been confirmed. 26. BEA WebLogic Server/Express Potential Administrator Password... BugTraq ID: 9503 Remote: No Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9503 Summary: WebLogic Server and WebLogic Express are enterprise application server products distributed by BEA Systems. BEA has reported a weakness affecting WebLogic Server and WebLogic Express 8.1 and 8.1 SP1. Due to a programmatic flaw, vulnerable versions of WebLogic Server/Express may write the cleartext administrator password used to boot the server to the configuration file "config.xml". The immediate risk is lowered because not all potential attackers may have access to this file. The threat may be more pronounced if the same password is used on multiple systems and untrusted users have access to the filesystem of the affected server. The weakness is corrected in Service Pack 2. 27. Apple Security Update 2004-01-26 Released To Fix Multiple Vu... BugTraq ID: 9504 Remote: Yes Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9504 Summary: Apple has released Security Update 2004-01-26 to address multiple previously known and newly discovered security vulnerabilities in Mac OS X (Client and Server) 10.1.x through 10.3.x. The individual security fixes include: Unspecified security enhancements for AFP over the Security Update released on 2003-12-19. Apache updates for the mod_alias and mod_rewrite buffer overflows (BID 8911/CAN-2003-0542). Also included are updates for BID 8926 "Apache Web Server mod_cgid Module CGI Data Redirection Vulnerability" (CAN-2003-0789). Fixes are available for Apache 1.3.x on Client versions of Mac OS X and for Apache 2.x on Server versions of the operating system. An unspecified security vulnerability (CAN-2004-0089) in Classic that is related to handling of environment variables. Two unspecified vulnerabilities (CAN-2004-0085 and CAN-2004-0086) in the Mac OS X Mail application. One unspecified vulnerability (CAN-2004-0092) in the Safari web browser. An unspecified security vulnerability (CAN-2004-0090) involving Windows File Sharing where the service failed to shutdown properly. Security flaws (CAN-2004-0087 and CAN-2004-0088) in the SystemConfiguration subsystem that allows unprivileged users to make unauthorized configuration changes. These issues are currently undergoing further analysis. Where it is appropriate, each individual issue will be assigned a unique BID and any existing BIDs will be updated accordingly to reflect the release of this Security Update. **Update: The issue described as unspecified (CAN-2004-0089) in this BID has been assigned a new BID (9509). Further details may be found in BID 9509. 28. BEA WebLogic Incorrect Operator Permissions Password Disclos... BugTraq ID: 9505 Remote: No Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9505 Summary: WebLogic Server and WebLogic Express are enterprise application server products distributed by BEA Systems. BEA WebLogic Server and WebLogic Express have been reported prone to a vulnerability that may allow server Operators to view sensitive credentials. The issue is reported to exist because the Operator role is erroneously assigned access to MBean attributes that contain user passwords. Specifically, the Operator role is erroneously permitted to access ServerStartMBean.Password and the NodeManagerMBean.CertificatePassword. An attacker, who is a member of the Operator role, may potentially exploit this vulnerability to disclose sensitive user credentials. Information harvested in this manner may be used to aid in further attacker launched against the affected server. 29. WebLogic Server and Express HTTP TRACE Credential Theft Vuln... BugTraq ID: 9506 Remote: Yes Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9506 Summary: WebLogic Server and WebLogic Express are enterprise application server products distributed by BEA Systems. A vulnerability has been reported to exist in the software that may allow a remote attacker to steal sensitive information such as cookie-based authentication credentials. It has been reported that WebLogic Server responds to the HTTP TRACE request by default. The HTTP TRACE request used for debugging purposes allows a web server to echo the contents of the request back to the client. The complete request, including HTTP headers, is returned in the entity-body of a TRACE response. This request also allows web sites to cause user browsers to issue TRACE requests. Enabling HTTP TRACE functionality by default may allow an attacker to compromise user accounts by gaining access to sensitive header information. This issue may be combined with other attacks such as cross-site scripting, to steal cookie-based authentication credentials. 30. TCPDump ISAKMP Decoding Routines Denial Of Service Vulnerabi... BugTraq ID: 9507 Remote: Yes Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9507 Summary: tcpdump is a freely available, open source network monitoring tool. It is available for the Unix, Linux, and Microsoft Windows operating systems. A vulnerability has been identified in the software that may allow a remote attacker to cause a denial of service condition in the software. The issue occurs due to the way tcpdump decodes Internet Security Association and Key Management Protocol (ISAKMP) packets. A remote attacker may cause the software to enter an infinite loop by sending malformed ISAKMP packets resulting in a crash or hang. Although unconfirmed, due to the nature of this issue, an attacker may leverage the issue by exploiting an unbounded memory copy operation to overwrite the saved return address/base pointer, causing an affected procedure to return to an address of their choice. Successful exploitation of this issue may allow an attacker to execute arbitrary code with the privileges of the tcpdump process in order to gain unauthorized access. tcpdump versions prior to 3.8.1 have been reported to be prone to this issue. 31. Novell Groupwise Webacc Cross Site Scripting Vulnerability BugTraq ID: 9508 Remote: Yes Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9508 Summary: GroupWise is the commercial groupware package distributed and maintained by Novell. A vulnerability has been reported to exist in Novell Groupwise that may allow a remote attacker to execute HTML or script code in a user's browser. The issue is reported to present itself due to insufficient sanitization of user-supplied input via the 'GWAP.version' and 'User.id' parameters of the 'servlet/webacc' module. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the vulnerable site. Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible. Novell Groupwise version 6.5 has been reported to be prone to this issue, however, other versions may be affected as well. 32. Apple Mac OS X TruBlueEnvironment Local Buffer Overflow Vuln... BugTraq ID: 9509 Remote: No Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9509 Summary: TruBlueEnvironment is a component of the Mac OS Classic emulator that is shipped and installed by default as a part of Mac OS X. TruBlueEnvironment has been reported prone to a local buffer overflow vulnerability. The issue has been reported to exist due to a lack of sufficient boundary checks performed on data contained in Environment variables, before they are copied into a reserved buffer in TruBlueEnvironment stack based memory. A local attacker may exploit this vulnerability by specifying a value for the affected environment variable that exceeds the size of the reserved buffer in TruBlueEnvironment memory. Excessive data that is supplied in this manner will overrun the boundary of the reserved buffer and will corrupt adjacent memory. Ultimately this may allow a local attacker to overwrite sensitive values that are required to control TruBlueEnvironment execution flow. In doing so the attacker may influence TruBlueEnvironment execution flow into attacker supplied instructions. Because TruBlueEnvironment is setuid root, these instructions will be executed with root privileges. It should be noted that this vulnerability was originally described as an unspecified issue in 9504. It is now being assigned a unique BID. 33. Microsoft Internet Explorer CLSID File Extension Misrepresen... BugTraq ID: 9510 Remote: Yes Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9510 Summary: A vulnerability has been reported in Microsoft Internet Explorer that may allow files to be misrepresented to client users. The following proof-of-concept example was released which specifies the CLSID for HTML applications as a file extension and includes an additional file name and extension after the CLSID: malware.{3050f4d8-98B5-11CF-BB82-00AA00BDCE0B}fun_ball_gites_pie_throw%2Empeg The browser appears to present the content to the user as the file name and type specified after the CLSID, when the actual content type is determined by the CLSID (which specifies an HTML application). It is not known at this time where the security flaw lies but it has been demonstrated that such a filename may be used to misrepresent the file type. The dot to separate the additional file extension may need to be URL-encoded (%2E) for exploitation to be successful, though this has not been confirmed. This issue could be exploited to disguise executable content in the form of an HTML application (HTA) file as a file type that may appear innocuous to a victim user. The file will appear to be of an attacker-specified type in the file download dialog presented to the user. The user may then download/open that file under the assumption it is safe, which could result in execution of malicious code on the client system in the context of the victim user. It should also be noted that the file name may be prepended by '...' in the download dialog, to abbreviate the malicious file name and CLSID extension in the prefix. This issue could be exploited via a malicious web page or possibly through e-mail. This issue was reported in Internet Explorer 6.0. Earlier versions of the browser may also be affected. 34. IBM Informix Multiple Local Privilege Escalation Vulnerabili... BugTraq ID: 9511 Remote: No Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9511 Summary: Informix is an enterprise database distributed and maintained by IBM. The Informix Dynamic Server module is an online transaction processing database designed as an enterprise solution. Multiple vulnerabilities have been found in the IBM Informix Dymanic Server and Informix Extended Parallel Server that may allow a malicious user to gain escalated privileges on a local machine. It has been reported that the individual vulnerabilities exist in multiple setuid and setgid binaries that are included with the Informix software. The following setuid/setgid binaries may be affected: oninit, onmode, onedcu, ifmxgcore, ontape, ondblog, onbar_d, onsmsync, onmonitor, sgidsh, mkdbsdir, onshowaudit, onaudit, xtree, onspaces, onparams, onlog, oncheck, onpload, onstat, onedpu, onload, onunload, onload. 1) There is a buffer overflow in the handling of the GL_PATH environment variable by the affected binaries. It is possible to overflow the buffer that stores the GL_PATH environment variable as no bounds checking is performed. This issue may also complicated by possible calls to free() on unallocated variables. 2) It has been reported that format string vulnerabilities exists in the handling of message files. The affected binaries search for message files used in displaying various error messages. This search is conducted relative to the value held in the INFORMIXDIR global variable. It is possible for an attacker to identify the files searched for, create copies of these files and edit them to contain print format characters. By changing the value of the INFORMIXDIR environment variable to point to the directory containing the edited files, the attacker can carry out print format string attacks against the affected binaries. IBM Informix Dynamic Server 9.40.UC2 and earlier and IBM Informix Extended Parallel Server versions prior to 8.40.UD1 have been reported to be vulnerable to these issues. 35. IBM Informix Dynamic Server/Informix Extended Parallel Serve... BugTraq ID: 9512 Remote: No Date Published: Jan 27 2004 Relevant URL: http://www.securityfocus.com/bid/9512 Summary: IBM Informix Dynamic Server and IBM Informix Extended Parallel Server have been reported prone to multiple vulnerabilities. The first issue exists in the onedcu binary. Specifically, when the binary is invoked a predictable temporary file is created, called "\001". To exploit this issue, a local attacker may create a symbolic link in the appropriate directory with a name that represents the vulnerable temporary filename. The link will point to an arbitrary file that the attacker wishes to target. When the vulnerable binary is invoked, operations that were supposed for the temporary file will be carried out on the file that is linked by the malicious symbolic link. Because the file is created with 666 permissions, a local attacker may exploit this issue to gain elevated privileges. The second issue has been reported to exist in the ontape binary. The ontape binary has been reported to be prone to a local stack based buffer overflow vulnerability. The issue is reported to present itself when the affected binary handles excessive data contained in environment variables. The attacker must have DBSA (database system administrator) privileges prior to exploiting this vulnerability. By supplying 495 bytes of data as a value for the ONCONFIG environment variable, the attacker may potentially corrupt a saved instruction pointer. Ultimately the attacker may exploit this condition to influence execution flow of the vulnerable binary into attacker-controlled memory. This may lead to the execution of arbitrary instructions with elevated privileges. A third issue has been reported to affect the onshowaudit binary. Specifically, the onshowaudit binary reads data from temporary files contained in the "temporary" directory. These files have predictable filenames and the read operation is performed without dropping privileges. A local attacker, who has AAO (audit analysis officer) privileges, may create a symbolic link in the appropriate directory with a name that represents a vulnerable temporary filename (".0" to ".98"). The link will point to an arbitrary file, the contents of which the attacker wishes to disclose. When the vulnerable binary is invoked, privileged operations that were supposed for the temporary file will be carried out on the file that is linked by the malicious symbolic link. The attacker may exploit this issue to disclose data that may be used in further attacks launched against the vulnerable system. Each issue described in this BID will be given individual BID's once further analysis is complete. 36. Internet Security Systems BlackICE PC Protection Upgrade Fil... BugTraq ID: 9513 Remote: No Date Published: Jan 28 2004 Relevant URL: http://www.securityfocus.com/bid/9513 Summary: Internet Security Systems BlackICE PC Protection is a firewall/IDS implementation for desktop systems running Microsoft Windows. BlackICE PC Protection is reported to install various .ini files with insecure permissions after an upgrade. This may allow non-administrative users to modify or replace these files, facilitating other attacks. This could affect various security properties as configuration information for the software may be altered by an unauthorized user. There is also a buffer overrun that exists in the software when parsing various directives included in .ini files, as described in BID 9514. This additional issue could be exploited once the permissions have been lowered. The following files are reported to have lowered permissions after an upgrade: blackice.ini firewall.ini protect.ini sigs.ini It should be noted that exploitation of other latent vulnerabilities, such as those described in BID 8577 could create a situation where a remote attacker could place a hostile .ini on the local file system that is designed to weaken the security provided by the software or exploit the buffer overrun described in BID 9514. It has also been reported that the Application Protection feature, if enabled, will prevent various files associated with the software from unauthorized modification. This issue has been reported to occur when the software is upgraded to version 3.6.cbz. It is not known if other upgrades present the same security risk. 37. Internet Security Systems BlackICE PC Protection blackd.exe ... BugTraq ID: 9514 Remote: No Date Published: Jan 28 2004 Relevant URL: http://www.securityfocus.com/bid/9514 Summary: Internet Security Systems BlackICE PC Protection is a firewall/IDS implementation for desktop systems running Microsoft Windows. It is reported that BlackICE PC Protection is prone to a locally exploitable buffer overrun when handling excessive input in certain configuration directives for various .ini files included with the software. While these files are allegedly not writeable by non-administrative users in the default install, it has been reported that they may be globally writeable by all system users after a software upgrade (as described in BID 9513). The issue is reportedly exposed when a 'packetLog.fileprefix=' directive of 217+ bytes in length is included in the blackice.ini file. This will allow the attacker to influence the contents of various system registers such as EIP and ECX, effectively permitting the attacker to control execution flow of the blackd.exe process. Given the ability of a local attacker to modify the contents of these files, it will be possible to execute arbitrary with SYSTEM privileges since the blackd.exe process runs in SYSTEM context. This issue could also be exploited remotely if an attacker can exploit other vulnerabilities to cause a malicious version of a .ini file to be placed on the local system. This might occur through exploitation of latent vulnerabilities in Internet Explorer, such as those described in BID 8577. 38. OracleAS TopLink Mapping Workbench Weak Encryption Algorithm... BugTraq ID: 9515 Remote: No Date Published: Jan 28 2004 Relevant URL: http://www.securityfocus.com/bid/9515 Summary: OracleAS TopLink Mapping Workbench is a tool included with OracleAS TopLink, a Java-based database integration development framework that is included as a component of various Oracle Application Server releases. OracleAS TopLink Mapping Workbench is reported to use a weak encryption algorithm when storing passwords in XML files. A proof-of-concept has been released that demonstrates how passwords are encrypted. The encryption scheme uses a simplistic substitution cipher and then appends a static string to the end of the encrypted password. The following encryption mechanism is used by the software, as described in the proof-of-concept: Characters with an even index in the password string are encrypted by taking the decimal ASCII value of the character, adding 4 and then subtracting the position of the current character. The result will then be converted into the hexadecimal representation of the ASCII value for the character. Characters with an odd index in the password string are encrypted using a number of expressions, the first of which takes the decimal ASCII value of the character and adds 4. Then the algorithm will perform an additional expression which takes the position of the character, subtracts 1, divides this value by 2 and then multiplies the value by 6. The end result of the second expression will be added to the initial expression and then the final value will be converted into the hexadecimal representation of the ASCII value for the character. The algorithm will iterate through these steps for each character in the plaintext password, appending the result to the encrypted string. When these iterations are complete, the algorithm then appends a static string of "A7FCAA504BA7E4FC" to the encrypted password. By reversing the process described in the proof-of-concept, an attacker with access to XML files generated by the software could decrypt embedded passwords. This could disclose credentials included in sessions and deployment XML files generated by the TopLink Mapping Workbench. The discoverer of this issue has not specified which Oracle Application Server releases are affected, though later releases such as 10g include support for the Java Cryptography Extension as well as user-specified custom encryption algorithms. Later releases are also backwards compatible with older encryption schemes, so could still be affected. This BID will be updated if further information is made available about affected releases. 39. BRS WebWeaver ISAPISkeleton.dll Cross-Site Scripting Vulnera... BugTraq ID: 9516 Remote: Yes Date Published: Jan 28 2004 Relevant URL: http://www.securityfocus.com/bid/9516 Summary: BRS WebWeaver is an HTTP/FTP server implementation for Microsoft Windows platforms. BRS WebWeaver has been reported prone to a cross-site scripting vulnerability. The issue is known to exist in the ISAPISkeleton.dll script. Arguments supplied to this script in web requests will be output in dynamically generated web pages without adequate sanitization of HTML and script code. As a result, an attacker may create a malicious link to the vulnerable server that includes embedded HTML and script code. If this link is followed by a victim user, hostile code embedded in the link may be rendered in the user's browser in the context of the server. Successful exploitation could permit theft of cookie-based authentication credentials. The attacker could also theoretically influence how server pages will be rendered to the victim user, allowing for other attacks. This issue could affect various web applications hosted on the server, since these web applications could be in the same domain as the server and therefore hostile script code may be able to access properties of these applications. This issue was reported in BRS WebWeaver 1.07. Earlier versions may also be affected. 40. DotNetNuke Multiple Vulnerabilities BugTraq ID: 9518 Remote: Yes Date Published: Jan 28 2004 Relevant URL: http://www.securityfocus.com/bid/9518 Summary: DotNetNuke (formerly known as the IBuySpy Workshop) is a web based content management system. Multiple vulnerabilities have been identified in the software that may allow a remote attacker to access sensitive files and source code, carry out SQL injection and cross-site scripting attacks. The following specific vulnerabilities have been reported: It has been reported that the software allows anyone to download and view files and source code with a HTTP GET request. An attacker may download the 'Web.config' file and access authentication information such as the username and passwords for the SQL server. This vulnerability could lead to an attacker gaining unauthorized access to a vulnerable system. SQL injection vulnerabilities have been reported in 'LinkClick.aspx' and related modules. These scripts do not adequately filter SQL syntax from user-supplied input before including it in a database query. As a result, remote attackers may influence the logic and structure of database queries made by the software. In particular, data supplied via the 'table' and 'field' variables of 'LinkClick.aspx' is not sufficiently sanitized. A cross-site scripting vulnerability has been reported to exist in the 'EditModule.aspx' script. This issue exists due to improper sanitizing of user-supplied data. HTML and script code may be parsed via the 'tabid' and/or 'def' URI parameters of the vulnerable script. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site. DotNetNuke versions 1.0.6 to 1.0.10d have been reported to be vulnerable to these issues. 41. Loom Software SurfNow Remote HTTP GET Request Denial Of Serv... BugTraq ID: 9519 Remote: Yes Date Published: Jan 28 2004 Relevant URL: http://www.securityfocus.com/bid/9519 Summary: SurfNOW is a commercially-available proxy software package designed to obscure identity and protect privacy on the Internet. It is available for the Microsoft Windows platform. A problem has been identified in the handling of specific types of requests by SurfNOW. Upon receiving specially crafted requests, it is possible for a remote attacker to crash a vulnerable implementation, denying service to the user. The problem is in the handling of excessive data in HTTP header fields. An attacker with access to the proxy server can potentially submit a request of excessive length, causing the server to become unstable. It has been reported that this can reliably produce a crash in the proxy server after multiple such requests are submitted. The attacker must reportedly send HTTP GET requests that are 490k in length to reproduce this issue. This issue may be indicative of a boundary condition error. This information, however, is conjecture based on reports by the researcher. If this information does prove to be true, it may likely be possible to exploit this condition to execute code with the privileges of the proxy server process. 42. TRR19 Privilege Escalation Vulnerability BugTraq ID: 9520 Remote: No Date Published: Jan 28 2004 Relevant URL: http://www.securityfocus.com/bid/9520 Summary: TRR19 is a typing game on GNU Emacs. TRR19 has been reported prone to a privilege escalation vulnerability. The issue presents itself, because the TRR19 binaries do not drop privileges before executing user-supplied commands. A local attacker may exploit this vulnerability to execute arbitrary commands with group 'game' privileges. 43. Macromedia ColdFusion MX Security Sandbox Circumvention Vuln... BugTraq ID: 9521 Remote: No Date Published: Jan 28 2004 Relevant URL: http://www.securityfocus.com/bid/9521 Summary: ColdFusion MX is the application server for developing and hosting infrastructure distributed by Macromedia. It is available as a standalone product for Unix, Linux, and Microsoft Operating Systems. ColdFusion MX has been reported prone to a security sandbox circumvention vulnerability. The issue is reported to exist because programmers have the ability to create instances of classes without using "CreateObject()" or "<cfobject>" tags. It has been reported that the security sandbox does not prevent this behavior. This issue cannot be exploited remotely, but the vulnerability may present a danger in a shared hosted environment. An attacker may exploit this issue to circumvent the security sandbox of ColdFusion MX. This issue has been reported to affect ColdFusion MX 6.1. 44. Macromedia ColdFusion MX Form Fields Denial of Service Vulne... BugTraq ID: 9522 Remote: Yes Date Published: Jan 28 2004 Relevant URL: http://www.securityfocus.com/bid/9522 Summary: A denial of service vulnerability has been reported to exist in Macromedia ColdFusion MX that may allow a remote attacker to cause the service to crash or hang. The issue presents itself when an attacker issues a malicious HTTP request containing a large number of HTML variables such as form fields. Specifically, this issue occurs if a form is submitted with several hundred inputs that use range or type validation. Due to this, the software may take a very long time to process the request. Successful exploitation will cause a denial of service condition in the application, causing the affected process to hang or crash and denying service to legitimate users. Macromedia ColdFusion MX 6.1 has been reported to be vulnerable to this issue. 45. Third-party CVSup Binary Insecure ELF RPATH Library Replacem... BugTraq ID: 9523 Remote: No Date Published: Jan 29 2004 Relevant URL: http://www.securityfocus.com/bid/9523 Summary: CVSup is a network file distribution utility that is intended to be used with CVS repositories. It is available for various Unix/Linux derivatives. It has been reported that some third-party vendor-supplied CVSup binaries may have an insecure ELF RPATH that includes world-writeable directories in the path. This variable is used to specify the run-time search path for ELF objects. A local attacker could exploit this issue by placing malicious libraries in these directories, which would be dynamically linked against at run-time when the cvsup, cvsupd or cvpasswd programs are executed. This would result in execution of arbitrary code with elevated privileges. This issue was reported to affect CVSup RPMs that ship with SuSE Linux. Other distributions may also be affected. In the instance of SuSE, the /home/anthon and /usr/src/packages directories included in the search path may be world-writeable, depending on the value of the PERMISSIONS_SECURITY setting in the /etc/sysconfig/security configuration file. Statically linked versions of the software should not be affected by this version. 46. PJ CGI Neo Review Directory Traversal Vulnerability BugTraq ID: 9524 Remote: Yes Date Published: Jan 29 2004 Relevant URL: http://www.securityfocus.com/bid/9524 Summary: PJ CGI Neo Review is a web based software. A vulnerability has been reported to exist in PJ CGI Neo Review that may allow a remote attacker to access information outside the server root directory. The problem exists due to insufficient sanitization of user-supplied data via the 'p' parameter of the 'PJreview_Neo.cgi' script. The issue may allow a remote attacker to traverse outside the server root directory by using '../' character sequences. Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system. 47. Kerio Personal Firewall Local Privilege Escalation Vulnerabi... BugTraq ID: 9525 Remote: No Date Published: Jan 29 2004 Relevant URL: http://www.securityfocus.com/bid/9525 Summary: Kerio Personal Firewall (KPF) is a desktop firewall solution that performs stateful packet inspection. It is available for the Microsoft Windows platform. A vulnerability has been reported to be present in the software that may allow a local attacker to gain elevated privileges. The problem occurs due to a function used to load configuration files. It has been reported that this function can be exploited to execute malicious applications with SYSTEM privileges. Successful exploitation of this issue may allow an attacker to execute malicious applications with SYSTEM privileges on a vulnerable system that may lead to full compromise. Kerio Personal Firewall 2.1.5 has been reported to be prone to this issue, however, other versions could be affected as well. 48. CPAN WWW::Form HTML Injection Vulnerability BugTraq ID: 9526 Remote: Yes Date Published: Jan 29 2004 Relevant URL: http://www.securityfocus.com/bid/9526 Summary: CPAN WWW::Form is an extendable Perl module that allows developers to handle HTML form validation. A vulnerability has been reported in the software that may allow a remote attacker to execute HTML and script code in a user's browser. The problem is reported to exist due to improper sanitizing of user-supplied data in the Perl module. It may be possible for an attacker to include malicious HTML code in one of the vulnerable fields. The injected code could then be interpreted by the browser of a user visiting the vulnerable site. This attack would occur in the security context of the affected site. Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible. CPAN WWW::Form versions 1.12 and prior have been reported to be vulnerable to this issue. III. SECURITYFOCUS NEWS ARTICLES -------------------------------- 1. DARPA-funded Linux security hub withers By: Kevin Poulsen System to reward auditors with karma points dies on the vine. http://www.securityfocus.com/news/7947 2. 'Warspying' San Francisco By: Kevin Poulsen Hobbyists explore the City by the Bay, as seen though its wireless cameras. http://www.securityfocus.com/news/7931 3. Online fraud, I.D. theft soars By: Kevin Poulsen A U.S. government report counts half-a-million fraud complaints in 2003, most of them Internet-related. http://www.securityfocus.com/news/7897 4. 'Mydoom' computer virus brings down SCO Group's Web site By: Mark Thiessen, The Associated Press http://www.securityfocus.com/news/7952 5. MS posts $250,000 MyDoom worm bounty By: John Leyden, The Register http://www.securityfocus.com/news/7946 6. Microsoft offers $250,000 reward for arrest of author of lat... By: Ted Bridis, The Associated Press http://www.securityfocus.com/news/7941 IV. SECURITYFOCUS TOP 6 TOOLS ----------------------------- 1. Andutteye Surveillance (server) v1.16 By: andutt Relevant URL: http://www.utterberg.com Platforms: Linux Summary: Andutteye is surveillance software for Linux and Unix systems. Its used to monitor your system, resolve local actions, and send alarms to a central point. You can manage your client configurations, view and handle the incoming alarms, and have FAQ entries on well known alarms. 2. PIKT - Problem Informant/Killer Tool v1.16.1 By: Robert Osterlund, [email protected] Relevant URL: http://pikt.org Platforms: AIX, FreeBSD, HP-UX, IRIX, Linux, Solaris, SunOS Summary: PIKT is a cross-platform, multi-functional toolkit for monitoring systems, reporting and fixing problems, and managing system configurations. It consists of an embedded scripting language with unique, labor-saving features, a script and system config file preprocessor, a scheduler, an installer, and other tools. 3. Jailkit v0.5 By: Olivier Relevant URL: http://olivier.sessink.nl/jailkit/ Platforms: POSIX Summary: Jailkit is a set of utilities to allow quick creation of limited user accounts. It contains a safe logging daemon, shells that can restrict users and utilities for easy setup. 4. File Integrity Command & Control v1.2.1 By: Terry Ott Relevant URL: http://www.firsttracks.net/ficc Platforms: Os Independent Summary: File Integrity Command & Control (FICC) helps system administrators manage multiple Tripwire installations across their network. It maintains MD5 hashes for the three key Tripwire files (the config file, executable, and TW database) for every system it monitors. Using SCP, it retrieves these key files from each system and compares the computed signature against the signatures in the FICC signature database. If all three signatures match the database, FICC then connects to the host via SSH and runs Tripwire. In the event that any of the signatures do not match the database or Tripwire detects files changes, an email is sent to the "FICC administrator" of the system in question. 5. DNS Blacklist Packet Filter v0.1 By: Russell Miller Relevant URL: Platforms: FreeBSD, Linux, NetBSD, OpenBSD, POSIX Summary: DNS Blacklist Packet Filter is a BSD/Linux netfilter client that decides whether to accept or drop packets based on the results of a DNS blacklist query (such as MAPS, SORBS, or SPEWS, to name a few). One use is to filter all incoming SMTP SYN packets for spam filtering. 6. Revelation v0.1.1 By: SnadBoy Software Relevant URL: http://www.snadboy.com/Revelation.shtml Platforms: Summary: Revelation enables you to obtain passwords that have been cached on your computer. It essentially decodes those asterisks that automatically appear in some log-in dialog boxes such as in Windows Dial-Up networking. With the utility running, you drag an icon onto the password field you can't remember and the software divulges the text. V. SECURITYJOBS LIST SUMMARY ---------------------------- 1. Security Researcher, Silicon Valley, ArcSight (Thread) Relevant URL: http://www.securityfocus.com/archive/77/352090 2. Security Sales Engineer-Atlanta region (Thread) Relevant URL: http://www.securityfocus.com/archive/77/352037 3. Symantec Looking for Sr. Security Consultant - VA, C... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/352024 4. Technology & Operational Risk Management Executive -... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/352000 5. Director of Sales - NY/NJ (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351991 6. Security Software Developer(s) (Contract), Mechanics... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351933 7. Security Job Opportunities - New Zealand (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351932 8. Sr. Network Planning Security Engineer with Verizon ... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351902 9. Security Consultant - Software Security Audit (Bueno... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351901 10. CISSP seeks Information Security Officer position (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351898 11. Channel Manager/Director Need - Security Technologie... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351896 12. Principle Software Engineer - Security Research - Wa... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351789 13. 2 Security Analysts needed in DC/ Northern VA (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351787 14. Security Analyst Position (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351785 15. Direct Hire Positions - LOCATION (Please Read) (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351781 16. Vulnerability Detection Engineer North Bay (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351754 17. Security Engineer Position (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351746 18. Entry-level Security Jobs in Los Angeles Area (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351744 19. Direct Company Hire - Information Assurance Speciali... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351743 20. Direct Hire #2 - Security Engineer Position (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351742 21. Product Marketing Manager Silicon Valley CA (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351741 22. standards (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351740 23. standards: update (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351686 24. Senior Security Architect (East Coast-NYC Metro) Exc... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351685 25. Vulnerability Detection Eng Silicon Valley CA (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351679 26. Director Marketing Communications (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351674 27. InfoSec Engineers - Experienced Associates needed in... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351671 28. Architect/Program Manager - Security Hardware/OS (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351666 29. IT Director position in Los Angeles area (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351662 30. VA/MD/DC Account Executive- Urgent Need (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351660 31. Manager of Penetration Testers (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351649 32. Highly experienced security professional looking for... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351399 33. Security Software Sales Manager (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351387 34. Pre Sales Engineer Manager (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351383 35. Management / Security engineer (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351341 36. Seeking a Security Engineer in Columbus, OH (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351339 37. IT Auditor vacancy (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351338 38. Security Software Implementation Opportunities (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351264 39. Looking for a Hero - Technology 'Neutral' Manager of... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351263 40. Network Security Planning Engineer with Verizon Wire... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351262 41. experience vs. cert/degree - trade vs. profession (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351218 42. InfoSec Engineers - Sr. Associate needed in Los Ange... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351216 43. Looking for position in Wash DC/Baltimore MD area (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351214 44. Two week giving notice/no notice when being terminat... (Thread) Relevant URL: http://www.securityfocus.com/archive/77/351212 VI. INCIDENTS LIST SUMMARY -------------------------- 1. Novarg (Thread) Relevant URL: http://www.securityfocus.com/archive/75/352192 2. new IIS exploit? (Thread) Relevant URL: http://www.securityfocus.com/archive/75/352185 3. exact signature for mydoom / novarg (Thread) Relevant URL: http://www.securityfocus.com/archive/75/352178 4. Yet another Visa scam scheme (Thread) Relevant URL: http://www.securityfocus.com/archive/75/352177 5. Blaster Recurrence (Thread) Relevant URL: http://www.securityfocus.com/archive/75/352172 6. Good Advice Anti-Virus Companies had a Virus Update... (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351997 7. Novarg - Stopping .Zip Files (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351925 8. best defense (was: Re: Novarg (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351924 9. Novarg DOS Payload (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351920 10. Dead Threads: Novarg/filtering/policies/usereducatio... (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351913 11. (Fwd) how to filter the Novarg virus (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351864 12. Does Anyone have the MyDoom.B Virus? (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351861 13. how to filter the Novarg virus (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351841 14. New variant of Virus ? --> issue identified. (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351836 15. New variant of Virus ? (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351827 16. (Moderator Note) Re: Anyome else seeing a rise in My... (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351675 17. (Moderator Note) Re: Anyome else seeing a rise in My... (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351669 18. [Securityfocus-incidents] Re: Fw: Anyome else seeing... (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351668 19. Anyome else seeing a rise in Mydoom Viruses over ema... (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351659 20. Fw: Anyome else seeing a rise in Mydoom Viruses over... (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351597 21. RES: Novarg (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351591 22. Novarg/Mydoom coming in through web pages? (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351579 23. (Moderator Note) Re: Anyome else seeing a rise in My... (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351535 24. Announcement: New Search Engine at SecurityFocus.com (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351533 25. (Moderator Note) Anyome else seeing a rise in Mydoo... (Thread) Relevant URL: http://www.securityfocus.com/archive/75/351384 VII. VULN-DEV RESEARCH LIST SUMMARY ----------------------------------- 1. Obfuscated shellcode (Thread) Relevant URL: http://www.securityfocus.com/archive/82/352135 2. Hacking USB Thumbdrives, Thumprint authentication (Thread) Relevant URL: http://www.securityfocus.com/archive/82/351720 3. Oracle toplink mapping workbench password algorithm (Thread) Relevant URL: http://www.securityfocus.com/archive/82/351719 4. Alphanumeric GetPC: alphanumeric_opcodes_defines.h (Thread) Relevant URL: http://www.securityfocus.com/archive/82/351565 5. Alphanumeric GetPC code. (was: GetPC code (was: Shel... (Thread) Relevant URL: http://www.securityfocus.com/archive/82/351528 6. vBulletin Patch Information (vBulletin Security Vuln... (Thread) Relevant URL: http://www.securityfocus.com/archive/82/351346 7. vBulletin Security Vulnerability - POC (Thread) Relevant URL: http://www.securityfocus.com/archive/82/351345 8. --== Fragementation Attacks ==-- (Thread) Relevant URL: http://www.securityfocus.com/archive/82/351258 VIII. MICROSOFT FOCUS LIST SUMMARY ---------------------------------- 1. Controlling Admin Access (Thread) Relevant URL: http://www.securityfocus.com/archive/88/352161 2. SMTP Service in private DMZ OK? (Thread) Relevant URL: http://www.securityfocus.com/archive/88/352158 3. terminal server (Thread) Relevant URL: http://www.securityfocus.com/archive/88/352041 4. Encrypt data - SQL Server 2000 (Thread) Relevant URL: http://www.securityfocus.com/archive/88/351981 5. SecurityFocus Microsoft Newsletter #173 (Thread) Relevant URL: http://www.securityfocus.com/archive/88/351305 IX. SUN FOCUS LIST SUMMARY -------------------------- 1. SPARC assembly training courses? (Thread) Relevant URL: http://www.securityfocus.com/archive/92/351525 X. LINUX FOCUS LIST SUMMARY --------------------------- 1. UNIX Authentication (Thread) Relevant URL: http://www.securityfocus.com/archive/91/352108 2. Shadow files and the password "!!". (Thread) Relevant URL: http://www.securityfocus.com/archive/91/351826 XI. UNSUBSCRIBE INSTRUCTIONS ---------------------------- To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website. If your email address has changed email [email protected] and ask to be manually removed. XII. SPONSOR INFORMATION ----------------------- This issue sponsored by: Tenable Network Security Doing network vulnerability scanning? Did you have to ask for permission? Did you have to beg for forgiveness from the admins you caused panic and disruption to? Try NeVO, the worlds only 100% passive vulnerability scanner, from Tenable Network Security! http://www.securityfocus.com/sponsor/TenableSecurity_sf-news_040202 For your 30 day demo please contact: [email protected] ------------------------------------------------------------------------