SecurityFocus Newsletter #238

SecurityFocus Newsletter #238
------------------------------

This issue sponsored by: Tenable Security

How do you manage your VULNERABILITIES?  Tenable Network Security can help
you actively and passively detect them with NeWT and NeVO as well as
communicate this information to the people who need to fix them through
the Lightning Console. Make recommendations, track remediations, correlate
vulnerabilities with IDS events, and create executive reports based on
organization, asset type or region. Visit us at:
http://www.securityfocus.com/sponsor/TenableSecurity_sf-news_040301
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Anti-Spam Solutions and Security
II. BUGTRAQ SUMMARY
     1. XFree86 Direct Rendering Infrastructure Buffer Overflow Vuln...
     2. TYPSoft FTP Server Remote CPU Consumption Denial Of Service ...
     3. Oracle 9i Application/Database Server SOAP XML DTD Denial Of...
     4. Oracle9i Lite Multiple Unspecified Vulnerabilities
     5. Oracle9i Database Server Unspecified Security Vulnerabilitie...
     6. PSOProxy Remote Buffer Overflow Vulnerability
     7. Microsoft Windows XP explorer.exe Multiple Memory Corruption...
     8. Singularity Software Team Factor Integer Handling Memory Cor...
     9. Multiple Outlook/Outlook Express Predictable File Location W...
     10. Jabber Software Jabber Gadu-Gadu Transport Multiple Remote D...
     11. W3C Jigsaw Unspecified Remote URI Parsing Vulnerability
     12. LGames LBreakout2 Multiple Environment Variable Buffer Overf...
     13. Synaesthesia Insecure File Creation Vulnerability
     14. Dell TrueMobile 1300 WLAN System Tray Applet Local Privilege...
     15. Samhain Labs HSFTP Remote Format String Vulnerability
     16. Proxy-Pro Professional GateKeeper Web Proxy Buffer Overrun V...
     17. nCipher Hardware Security Module Firmware Secrets Disclosure...
     18. Platform Load Sharing Facility EAuth Component Buffer Overfl...
     19. phpNewsManager Functions Script File Disclosure Vulnerabilit...
     20. Avirt Voice HTTP GET Remote Buffer Overrun Vulnerability
     21. Avirt Soho Server HTTP GET Buffer Overrun Vulnerability
     22. Avirt Soho Web Service HTTP GET Buffer Overrun Vulnerability
     23. Platform Load Sharing Facility EAuth Privilege Escalation Vu...
     24. EZBoard Font Tag HTML Injection Vulnerability
     25. XMB Forum Multiple Input Validation Vulnerabilities
     26. LiveJournal CSS HTML Injection Vulnerability
     27. Confirm E-Mail Header Remote Command Execution Vulnerability
     28. RobotFTP Server Remote Pre-authenticated Command Denial Of S...
     29. Apple Mac OS X PPPD Format String Memory Disclosure Vulnerab...
     30. Multiple Apple Mac OS X Local And Remote Vulnerabilities
     31. Opt-X header.php Remote File Include Vulnerability
     32. Apache Cygwin Directory Traversal Vulnerability
     33. Apple QuickTime/Darwin Streaming Server DESCRIBE Request Rem...
     34. Digital Reality Haegemonia Remote Denial Of Service Vulnerab...
     35. Working Resources BadBlue Server phptest.php Path Disclosure...
     36. RedStorm Ghost Recon Game Engine Remote Denial Of Service Vu...
     37. Seyeon Technology FlexWATCH Server Cross-Site Scripting Vuln...
     38. Gigabyte Gn-B46B Wireless Router Authentication Bypass Vulne...
     39. Gamespy Software Development Kit Remote Denial Of Service Vu...
     40. Microsoft ASN.1 Library Multiple Stack-Based Buffer Overflow...
     41. FreeChat Remote Denial Of Service Vulnerability
     42. Alcatel OmniSwitch 7000 Series Security Scan Denial Of Servi...
     43. MTools MFormat Privilege Escalation Vulnerability
     44. Mozilla Browser Zombie Document Cross-Site Scripting Vulnera...
     45. CalaCode @mail Webmail System Cross-Site Scripting Vulnerabi...
     46. CalaCode @mail Webmail System POP3 Remote Denial of Service ...
     47. Dell OpenManage Web Server POST Request Heap Overflow Vulner...
     48. RhinoSoft Serv-U FTP Server MDTM Command Time Argument Buffe...
     49. Internet Security Systems Protocol Analysis Module SMB Parsi...
     50. PerfectNav Malformed URI Denial Of Service Vulnerability
     51. eXtremail Authentication Bypass Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
     1. Alleged WebTV 911 hacker charged with cyberterrorism
     2. Gates 'optimistic' on security
     3. U.S. info-sharing program draws fire
     4. Fistful of Bagles shoot up the Net
     5. Spam villains: named and shamed
     6. Ferocious new Mydoom variant destroys files
IV. SECURITYFOCUS TOP 6 TOOLS
     1. Big Sister   v0.99b1
     2. snortalog v2.2RC2
     3. suPHP   v0.5.1
     4. Sentry Firewall CD-ROM v1.5.0-rc10(dev)
     5. Portable OpenSSH v3.8p1
     6. xmlBlaster v0.9
V. SECURITYJOBS LIST SUMMARY
     1. IT Security Consultant Needed (Thread)
     2. Regional Information Security Incident Response Co-o... (Thread)
     3. Global Head of Information Security Incident Respons... (Thread)
     4. Sr. Manager Development / DeepSight Product Team, Ca... (Thread)
     5. Senior Security Analyst Silicon Valley (Thread)
     6. job opening for Security Engineer - Huntsville, AL (Thread)
     7. NY Sales Executive (Thread)
     8. ArcSight-Senior Security Strategist needed in Sunnyv... (Thread)
     9. Seeking Sr. Information Security Position (Thread)
     10. Identity Management Professional - Tampa Bay, Florid... (Thread)
     11. Sales Engineer-Silicon Valley (Thread)
     12. ArcSight-Professional Services Security Consultant w... (Thread)
     13. Security professional available (Thread)
     14. Information Security Officer position in Orange Coun... (Thread)
     15. Penetration Tester London - (Thread)
     16. Job Opening in Maryland for Security  Researcher (Thread)
     17. soon to be graduate seeking full-time employement (Thread)
     18. Security & Policy Awareness Analyst #856 - Cleveland... (Thread)
     19. Weblogic Security Engineers-Northern Virginia (Thread)
     20. experienced channel sales professional available (Thread)
     21. Intermediate/Senior Sec. Analyst Position at Symante... (Thread)
     22. Looking for Security position in SF Bay Area (Thread)
     23. Network Security Engineer Available Immediately (Thread)
     24. Security Architect/ Consultant role in Toronto Canad... (Thread)
     25. Sr. Security Engineer -- Westlake Village, CA (Thread)
     26. Sr. Product Manager for the Metaframe Secure Access ... (Thread)
     27. Business Development Specialist  (Baltimore, DC or V... (Thread)
     28. Security Response Engineer (Thread)
     29. Looking for position - Infosec Manager or Managing C... (Thread)
VI. INCIDENTS LIST SUMMARY
     1. A basic Question from a new bie!! (Thread)
     2. Releasing patches is bad for security (Thread)
     3. Nmap - 3.50 changes mstask.exe? (Thread)
     4. FW: Nmap - 3.50 changes mstask.exe? (Thread)
     5. DoS Tool Identification (Thread)
     6. OpenSSH anomaly (Thread)
     7. FW: OpenSSH anomaly (Thread)
     8. incidents Digest 22 Feb 2004 13:01:58 -0000 Issue 51... (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
     1. VoIP Security (Thread)
     2. XFree86 font.alias exploit hangup.... (Thread)
     3. heap overflows (Thread)
     4. Extremail Security Problem (Thread)
     5. Format String vuln in Inktomi Search4.0 (Thread)
     6. THCimail (Thread)
     7. Exploiting the Wilderness (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
     1. Preventing OS Detection (Thread)
     2. SYN_SENT to port 8081 (Thread)
     3. Log Question (Thread)
     4. FPSE Admin Listner on IIS 6.0 (Thread)
     5. FW: Preventing OS Detection (Thread)
     6. Administrivia: Virus in email (Thread)
     7. SecurityFocus Microsoft Newsletter #177 (Thread)
     8. Tests to determine ASN.1 patch applicability (Thread)
     9. Article Announcement (Thread)
IX. SUN FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2004-02-23 to 2004-03-01.
X. LINUX FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2004-02-23 to 2004-03-01.
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Anti-Spam Solutions and Security
By Dr. Neal Krawetz

This article is the first of a two-part series that discusses the security
issues of spam as well as several current anti-spam methodologies.

http://www.securityfocus.com/infocus/1762


II. BUGTRAQ SUMMARY
-------------------
1. XFree86 Direct Rendering Infrastructure Buffer Overflow Vuln...
BugTraq ID: 9701
Remote: Yes
Date Published: Feb 20 2004
Relevant URL: http://www.securityfocus.com/bid/9701
Summary:
XFree86 is a freely available open-source implementation of the X Window
System.

It has been reported that XFree86 is prone to a denial of service.  The
condition reportedly can be caused by clients connecting to the X server
using the GLX extension and Direct Rendering Infrastructure.  The client
may cause the X server to fail due to insufficient bounds checking on
array indexes and integer sign errors.

Precise details of this vulnerability are not currently known.  This
record will be updated when more information becomes available.

2. TYPSoft FTP Server Remote CPU Consumption Denial Of Service ...
BugTraq ID: 9702
Remote: Yes
Date Published: Feb 20 2004
Relevant URL: http://www.securityfocus.com/bid/9702
Summary:
TYPSoft FTP Server is a freely available FTP server implemented for the
Windows platform.

TYPSoft FTP server has been reported to be prone to a remote denial of
service vulnerability. A malevolent user may leverage this issue to cause
the FTP server to crash, denying service to legitimate users.

This issue can be leveraged by first authenticating with the server, and
then supplying standard FTP commands with '//../qwerty' as a parameter.
The issue causes the software to exhaust CPU resources, inevitably forcing
the server to crash.

This vulnerability has been reported to affect version 1.10 of the
software, however, previous versions may also be affected.

3. Oracle 9i Application/Database Server SOAP XML DTD Denial Of...
BugTraq ID: 9703
Remote: Yes
Date Published: Feb 20 2004
Relevant URL: http://www.securityfocus.com/bid/9703
Summary:
Oracle 9i Application and Database services are prone to remote denial of
service attacks.  This issue is related to SOAP (Simple Object Access
Protocol) and XML, which are enabled by default when the Oracle HTTP
Server is installed with Oracle 9i Application or Database Server.  This
issue is reportedly triggered by passing malformed DTDs (Data Type
Definitions) via XML inside of a SOAP message.

This may be exposed if authentication for SOAP is not enabled or if the
attacker is able to gain unauthorized access to SOAP services through some
other means.

4. Oracle9i Lite Multiple Unspecified Vulnerabilities
BugTraq ID: 9704
Remote: Yes
Date Published: Feb 20 2004
Relevant URL: http://www.securityfocus.com/bid/9704
Summary:
Oracle has reported multiple unspecified vulnerabilities existing in
Oracle 9i Lite.  Oracle has reported that successful exploitation of these
vulnerabilities may result in unauthorized access to a connected Oracle
database server if Oracle9i Lite Mobile Server is installed.  It is
believed an attacker may gain unauthorized access as DBA to the Oracle
database server.

Due to a lack of information, further details cannot be outlined at the
moment.  This BID will be updated as more information becomes available.

Oracle9i Lite versions 5.0.0.0.0 to 5.0.2.9.0 have been reported to be
vulnerable to these issues.  Users running EBusiness 11i with Mobile Field
Service Laptop and Pocket PC using the Oracle9i Lite Mobile Server are
also reported to be vulnerable.

**New information has been provided by the discoverer of these
vulnerabilities.  It has been reported that several vulnerabilities
including cross-site scripting, SQL injection, and information disclosure
exist in the application.  Due to the nature of these issues, it is
possible that the application does not properly sanitize user-supplied
input.  The SQL injection vulnerability is reported to exist in the
authentication mask and may allow an attacker to execute SQL queries with
DBA privileges.  Furthermore, unlike previously reported, an attacker does
not require authenticated access in order to carry out these attacks.

5. Oracle9i Database Server Unspecified Security Vulnerabilitie...
BugTraq ID: 9705
Remote: Yes
Date Published: Feb 20 2004
Relevant URL: http://www.securityfocus.com/bid/9705
Summary:
Oracle has released an advisory reporting multiple unspecified security
vulnerabilities in Oracle9i Database Server.  These issues could be
exploited to launch denial of service attacks or to gain unauthorized
access to a user session.  These issues may reportedly be exploited by a
user with the ability to invoke SQL queries.  This could occur if the
attacker has direct authenticated access to the database, but may also
potentially be exposed by latent vulnerabilities in database driven
applications, such as web applications that are prone to SQL injection
attacks.

These issues may be related to BID 9587, though this has not been
confirmed.

This BID will be updated as more technical information is made available.

6. PSOProxy Remote Buffer Overflow Vulnerability
BugTraq ID: 9706
Remote: Yes
Date Published: Feb 20 2004
Relevant URL: http://www.securityfocus.com/bid/9706
Summary:
PSOProxy is a web server designed to work with the Gamecube web browser
facilitating copying and formatting Phantasy Star Online snapshot files to
a PC on the same network.  Implemented in C++, it has been designed to run
on Windows, Mac OS X, Unix and Unix like operating systems.

It has been reported that PSOProxy is prone to a remote buffer overflow
vulnerability.  The issue is due to the insufficient boundary checking of
all remote server requests.  Requests sent to the server of excessive
size, approximately one kilobyte, may trigger an overflow condition,
causing the process to raise an exception.  The immediate consequence of
such an exception is denial of service to legitimate users.

A malicious user may exploit this condition to potentially corrupt
sensitive process memory in the affected process and ultimately execute
arbitrary code with the privileges of the web server.

This issue has been reported to affect version 0.91 of the software, it is
likely however that this issue affects earlier version as well.

7. Microsoft Windows XP explorer.exe Multiple Memory Corruption...
BugTraq ID: 9707
Remote: Unknown
Date Published: Feb 20 2004
Relevant URL: http://www.securityfocus.com/bid/9707
Summary:
Microsoft Windows Explorer for Windows XP has been reported to be prone to
multiple overflow vulnerabilities.  The issues exist in the Metafile
processing code.

The first issue is reported to occur when a '.emf' (Extended Windows
Metafile Format) file with a 'total size' header field set to less than
the header size is processed.  The header size is used in the vulnerable
code to allocate a buffer. Due to insufficient verification of this size,
a heap overflow condition can occur if a malformed '.emf' file with a
'total size' field is less than the header size.   In order to exploit
this issue, an attacker would simply create a '.emf' file sufficient to
trigger this issue and place it in any directory.  The attacker would then
open the directory via Windows Explorer and view the contents as
Thumbnails.  Immediate consequences of this attack would result in a
denial of service condition.  This could also potentially allow for
execution of arbitrary code.

The second issue is reported to present itself following the above
scenario.  It is reported that the rest of the '.emf' file is read until
the size/headersize length has been reached and then the file is appended
to the header size buffer.  This issue could result in an integer overflow
condition.  Ultimately an attacker may exploit this condition to corrupt
sensitive variables in memory to influence execution flow of the affected
software into attacker-supplied instructions.

Furthermore, it has been reported that this issue may also affect the
image preview window in Windows Explorer resulting in a crash.

If these issues are exploited, it could allow for execution of arbitrary
code in the context of the user who invoked the Windows Explorer process.

These vulnerabilities have been tested in Microsoft Windows XP, however,
other operating systems provided by Microsoft may be vulnerable as well.
Although unconfirmed, these issues may also exist in Microsoft Internet
Explorer due to code similarities, possibly making these issues remote in
nature.

**Update: There have been reports that indicate that this issue may
actually present itself in the shell32.dll library. As a result of this,
all applications that are linked to the vulnerable library may also be
prone to this vulnerability.

8. Singularity Software Team Factor Integer Handling Memory Cor...
BugTraq ID: 9708
Remote: Yes
Date Published: Feb 20 2004
Relevant URL: http://www.securityfocus.com/bid/9708
Summary:
Team Factor is a stand-alone multiplayer game.

A vulnerability has been identified in the software that occurs due to
improper handling of integer data.  It has been reported that when
processing packets the software employs a 16 bit value that is used to
specify the size of data blocks in memory.   This value is reportedly read
as a signed short.  There exists a possibility of memory corruption, if a
negative value is supplied resulting in a denial of service condition.
This condition occurs because the application attempts to read unallocated
memory via a memcpy() operation.

Although unconfirmed, if the attacker can control arbitrary memory
corruption, the attacker might exploit this condition to execute arbitrary
instructions with elevated privileges.

Team Factor versions 1.25 and prior are reported to be prone to this
issue.

9. Multiple Outlook/Outlook Express Predictable File Location W...
BugTraq ID: 9709
Remote: Yes
Date Published: Feb 20 2004
Relevant URL: http://www.securityfocus.com/bid/9709
Summary:
Microsoft Outlook and Outlook Express are reported to be prone to store
various files which may contain attacker-supplied content in predictable
locations, aiding in exploitation of other possible security
vulnerabilities.

The following specifics examples of were provided:

Outlook Express stores a temporary copy of embedded sound files in a
predictable location (profile\Local Settings\Temp\[filename].[ext]) when
these files are opened.  The filename and extension in this instance are
attacker-specified.  An attacker may exploit this weakness in combination
with other issues by embedding a malicious HTML file in an e-mail message
with an appropriate extension such as .mid or .wav.

Both Outlook and Outlook Express also store temporary copies of HTML
documents sent via e-mail in the user's Temp folder using an .html
extension.  Again, other vulnerabilities may be used to reference the
malicious content directly.

Outlook Express is also alleged to store Address Book files in various
predictable locations on the client's file system.  While the impact of
this differs in nature, the Address Book may also be referenced via
exploitation of other vulnerabilities, which could disclose sensitive
information to remote attacks.

These issues may present a security risk because many known (and
potential) Internet Explorer vulnerabilities depend on the attacker being
able to directly reference malicious content on a victim system.  Given
both the ability to place such content on the file system and reference it
specifically by location, exploitation of many browser-based
vulnerabilities becomes possible.  This would often allow for execution of
malicious Active Content in the My Computer Zone.

10. Jabber Software Jabber Gadu-Gadu Transport Multiple Remote D...
BugTraq ID: 9710
Remote: Yes
Date Published: Feb 21 2004
Relevant URL: http://www.securityfocus.com/bid/9710
Summary:
Jabber Gadu-Gadu Transport is a gateway that bridges the Jabber and
Gadu-Gadu  instant messaging protocols, facilitating communication between
applications using the different protocols.

Multiple denial of service vulnerabilities have been identified in Jabber
Gadu-Gadu Transport.  These issues are due to the application failing to
handle exceptional conditions.

Activation of the 'roster import' functionality will cause the gateway to
crash when implemented using the Gadu-Gadu library libgadu 1.0 or greater,
ultimately denying service to legitimate users.  This issue is due to the
application failing to deal with the reduced functionality in the later
versions of the library.

The application fails to properly deal with registered users that attempt
to re-register.  If a user that is previously registered attempts to
re-register, the application will enter an infinite loop, ultimately
denying service to legitimate users.

Messages sent to the software that contain no '<priority/>' tag will cause
the application to fail, resulting in a denial of service condition.

Successful exploitation of any of these issues may cause the affected
server to crash, denying service to legitimate users.

11. W3C Jigsaw Unspecified Remote URI Parsing Vulnerability
BugTraq ID: 9711
Remote: Yes
Date Published: Feb 21 2004
Relevant URL: http://www.securityfocus.com/bid/9711
Summary:
Jigsaw is an HTTP server produced by W3C. It is implemented in Java, and
will run on a wide range of systems, including Microsoft Windows, Linux
and other Unix based systems.

Jigsaw is prone to an unspecified remote URI parsing vulnerability.  This
issue is reportedly due to a failure of the application to properly parse
and sanitize user supplied URI input.

The problem revolves around the web server failing to properly handle URI
separators.

The results of successful exploitation of this issue are currently
unknown, however it is conjectured that this issue may be leveraged to
compromise web server readable files outside of the server root directory.

This BID will be updated as further details regarding this issue are
disclosed.

12. LGames LBreakout2 Multiple Environment Variable Buffer Overf...
BugTraq ID: 9712
Remote: No
Date Published: Feb 21 2004
Relevant URL: http://www.securityfocus.com/bid/9712
Summary:
LBreakout2 is a freely available clone of the game Super Breakout.  It is
available for Unix and Unix like platforms as well as Windows.

Multiple buffer overflow vulnerabilities exist in the environment variable
handling of LBreakout2.  The issue is due to an insufficient boundary
checking of certain environment variables used by the affected
application.

This vulnerability surrounds the reading of the HOME environment variable.
The application reads the offending environment variable to save and
retrieve user specific configuration files.  Due to insecure copying of
the environment variable, it would be possible for a malicious user to set
manipulate it to overflow the allocated buffer.

A malicious user may exploit this condition to potentially corrupt
sensitive process memory in the affected process and ultimately execute
arbitrary code with the privileges of the game process.

13. Synaesthesia Insecure File Creation Vulnerability
BugTraq ID: 9713
Remote: No
Date Published: Feb 22 2004
Relevant URL: http://www.securityfocus.com/bid/9713
Summary:
Synaesthesia is an application designed to represent sounds visually.  It
is designed to run under Unix and Unix like platforms and has been ported
to run under Windows as well.

An insecure file creation vulnerability exists in Synaesthesia.  This
issue arises due to the creation of a configuration file by the process
while running with root privileges.

Upon execution the application creates the file '.synaesthesia' in the
home directory of the executing user while holding root privileges. This
issue is due to the software failing to properly determine if the file
exists before attempting to create it.

A local attacker could exploit this issue by creating a symbolic link
titled './synaesthesia' pointing to a target system file. Upon execution,
the Synaesthesia software will then write to the configuration file
symbolic link, potentially destroying sensitive system data at the end of
the link, which could result in denial of service.

14. Dell TrueMobile 1300 WLAN System Tray Applet Local Privilege...
BugTraq ID: 9714
Remote: No
Date Published: Feb 22 2004
Relevant URL: http://www.securityfocus.com/bid/9714
Summary:
The Dell TrueMobile 1300 Wireless System Tray Applet is a configuration
utility packaged with the Dell True Mobile 1300 WLAN Mini-PCI card.  It
allows a user to view and join wireless networks by easily activating  the
applet from the Windows system tray.

It has been reported that a privilege escalation vulnerability exists in
the Dell TrueMobile 1300 Wireless System Tray Applet.  The issue is due to
the software starting with SYSTEM privileges, to enable access to the
wireless hardware, and subsequently failing to drop them.

This may allow a local attacker to manipulate the GUI of the vulnerable
Wireless Applet session to spawn arbitrary processes with SYSTEM
privileges.

Although only version 3.10.39.0 of the utility has been reported
vulnerable, it is likely that other versions are prone as well.

15. Samhain Labs HSFTP Remote Format String Vulnerability
BugTraq ID: 9715
Remote: No
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9715
Summary:
hsftp is an ftp emulator, designed to provide the look and feel of ftp,
while providing secure network communication via the ssh protocol.  The
application is freely available under the GNU General Public license and
supports Linux and Unix like platforms.

hsftp has been found to be prone to a remote print format string
vulnerability. The problem presents itself when hsftp reads the contents
of a directory and a file contained within has been labeled with a
malicious name containing embedded format string specifiers.  The source
of the problem is incorrect use of a formatted printing function. As a
result, format specifiers supplied in this manner will be interpreted
literally and may result in attacker-specified memory being corrupted or
disclosed.

Ultimately this vulnerability could allow for execution of arbitrary code
on the system implementing the affected software, which would occur in the
security context of the server process.

It should be noted that when hsftp is installed with set SUID root
permissions it only uses the escalated privileges to acquire locked memory
containing the user password, and relinquishes them immediately
afterwards.

16. Proxy-Pro Professional GateKeeper Web Proxy Buffer Overrun V...
BugTraq ID: 9716
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9716
Summary:
Professional GateKeeper is a proxy server/firewall application.  It is
distributed and maintained by Proxy-Pro and available for Microsoft
Windows platforms.

Proxy-Pro Professional GateKeeper is prone to a remotely exploitable
buffer overrun that may be triggered by passing HTTP GET requests of
excessive length through the web proxy component (which listens on TCP
port 3128 by default).

It is possible to cause this condition by submitting an HTTP GET of 4100
bytes of more.  Due to insufficient bounds checking of this data, such a
request will overrun adjacent regions of memory with attacker-specified
data.  In this manner, it will be possible for the attacker to overwrite a
sensitive variable in memory such as an instruction pointer.  This could
be exploited to execute arbitrary code in the context of the software.

17. nCipher Hardware Security Module Firmware Secrets Disclosure...
BugTraq ID: 9717
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9717
Summary:
nCipher HSM(Hardware Security Module) is a software/appliance solution,
for a security infrastructure.

nCipher HSM firmware has been reported prone to a vulnerability that may
provide for the disclosure of infrastructure and application keys. It has
been reported that an attacker who has the ability to invoke commands with
a vulnerable nCipher HSM may potentially exploit this vulnerability to
peruse the affected module's run-time memory and disclose sensitive keys.

Information disclosed by an attacker in this manner may then be used to
aid in further attacks launched against the affected system.

It has been reported that only some versions of the nCipher HSM firmware
are vulnerable to this issue. The commands needed to exploit the issue are
available in some nCipher's `nForce' series key-management HSMs and later
only made available in the CodeSafe (SEE) procedures of the 'nShield'
series of HSMs. These versions are only vulnerable if the GeneralSEE
feature set has been enabled.

18. Platform Load Sharing Facility EAuth Component Buffer Overfl...
BugTraq ID: 9719
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9719
Summary:
Load Sharing Facility is a high availability and load balancing software
package distributed and maintained by Platform. It is available for Unix,
Linux, and Microsoft Windows.

Load Sharing Facility eauth component has been reported prone to a buffer
overflow vulnerability. The issue presents itself due to a lack of bounds
checks performed on data that is supplied as a value for the '-s' option
passed to eauth. By supplying excessive data, an attacker may corrupt data
adjacent to the affected buffer and thereby overwrite a saved instruction
pointer. An attacker may leverage this issue to influence program
execution flow into attacker-supplied instructions. Because the eauth
utility is installed setuid root in a default installation this
vulnerability may be exploited to gain root privileges.

Additionally it been reported that because eauth is called by daemons,
i.e. mbatchd with the '-s' option on attacker supplied data, a remote
attacker may exploit this vulnerability from a system that is a part of
the affected cluster.

19. phpNewsManager Functions Script File Disclosure Vulnerabilit...
BugTraq ID: 9720
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9720
Summary:
phpNewsManager is a web-based application for managing various types of
web content.

phpNewsManager is prone to a file disclosure vulnerability.  Remote
attackers may submit malicious requests to the software that contain
directory traversal sequences, potentially exposing sensitive resources
outside of the hosting web server root.  This issue exists in the
functions.php script and may be exploited by submitting directory
traversal sequences as a value for the 'clang' URI parameter.  Files
readable by the hosting web server may be disclosed in this manner.

Files disclosed via a successful attack may contain sensitive information
that would be useful to the attacker in further attempts to compromise
system resources.

20. Avirt Voice HTTP GET Remote Buffer Overrun Vulnerability
BugTraq ID: 9721
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9721
Summary:
Avirt Voice is an H.323 gateway product for Microsoft Windows operating
systems.

Avirt Voice is prone to a remotely exploitable buffer overrun when
handling HTTP GET requests of excessive length via the embedded server
component listening on TCP port 1080.  Due to insufficient bounds checking
of this data, an internal buffer will be overrun, corrupting regions of
memory adjacent to the buffer with attacker-specified data.  In this
manner, it may be possible to corrupt regions of memory and control
execution flow of the process, resulting in execution of arbitrary code.
The server may also crash when receiving this data.

This issue is reportedly triggered by sending 1113 or more characters in
the request.

This issue was reported in Avirt Voice 4.0.  Other versions may also be
affected.

21. Avirt Soho Server HTTP GET Buffer Overrun Vulnerability
BugTraq ID: 9722
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9722
Summary:
Avirt Soho is an Internet sharing application for Microsoft Windows
systems.

Avirt Soho is prone to a remotely exploitable buffer overrun when handling
HTTP GET requests of excessive length via the embedded server component
listening on TCP port 1080.  Due to insufficient bounds checking of this
data, an internal buffer will be overrun, corrupting regions of memory
adjacent to the buffer with attacker-specified data.  In this manner, it
may be possible to corrupt regions of memory and control execution flow of
the process, resulting in execution of arbitrary code.  The server may
also crash when receiving this data.

This issue is reportedly triggered by sending 1113 or more characters in
the request.

This issue was reported in Avirt Soho 4.3.  Other versions may also be
affected.

22. Avirt Soho Web Service HTTP GET Buffer Overrun Vulnerability
BugTraq ID: 9723
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9723
Summary:
Avirt Soho is an Internet sharing application for Microsoft Windows
systems.

Avirt Soho is prone to a remotely exploitable buffer overrun when handling
HTTP GET requests of excessive length via the embedded web service
component listening on TCP port 8080.  Due to insufficient bounds checking
of this data, an internal buffer will be overrun, corrupting regions of
memory adjacent to the buffer with attacker-specified data.  In this
manner, it may be possible to corrupt regions of memory and control
execution flow of the process, resulting in execution of arbitrary code.
The server may also crash when receiving this data.

This issue is reportedly triggered by sending 2061 or more % characters in
the request.

This issue was reported in Avirt Soho 4.3.  Other versions may also be
affected.

23. Platform Load Sharing Facility EAuth Privilege Escalation Vu...
BugTraq ID: 9724
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9724
Summary:
Load Sharing Facility is a high availability and load balancing software
package distributed and maintained by Platform. It is available for Unix,
Linux, and Microsoft Windows.

Load Sharing Facility eauth component has been reported prone to a
privilege escalation vulnerability. The eauth component is responsible for
controlling authentication procedures within Load Sharing Facility. An
issue has been reported where an attacker may send commands to Load
Sharing Facility as any user. The issue presents itself because eauth uses
an environment variable "LSF_EAUTH_UID" to determine the UID of the user
invoking the binary.

It has been reported that the attacker will require knowledge of
"lsfadmin" authentication data prior to the exploitation of this issue.
The attacker will exploit this issue by setting LSF_EAUTH_UID to the UID
of the targeted user, if successful, commands will be executed in Load
Sharing Facility as the targeted user.

24. EZBoard Font Tag HTML Injection Vulnerability
BugTraq ID: 9725
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9725
Summary:
ezboard is a web based bulletin board system.

ezboard is prone to an HTML injection vulnerability. An attacker may
exploit this issue by including hostile HTML and script code encapsulated
in [font] tags of posts to the bulletin board. This is because the script
that processes posts does not sufficiently sanitize user input, allowing
attackers to embed HTML and script commands within [font] tags of the
post. This code may be rendered in the web browser of a user who views
these areas of the site. This would occur in the security context of the
site hosting ezboard.

The attacker-supplied HTML and script code would be able to access
properties of the site, potentially allowing for theft of cookie-based
authentication credentials. An attacker could also exploit this issue to
control how the site is rendered to the user.

It should be noted that although this vulnerability has been reported to
affect ezboard version 7.3u, previous versions are also likely affected.

25. XMB Forum Multiple Input Validation Vulnerabilities
BugTraq ID: 9726
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9726
Summary:
XMB Forum is a web-based discussion forum.

XMB Forum has been reported prone to multiple cross-site scripting, HTML
injection and SQL injection vulnerabilities.

The issues present themselves due to insufficient sanitization of remote
user supplied data. The following specific issues were reported:

An attacker may supply HTML or script code as the 'member' URI parameter
passed to the member.php script or supply HTML and script code as a value
for the 'uid' URI parameter passed to the u2uadmin.php script.
Additionally it has been reported that an attacker may supply HTML or
script code as the 'user' URI parameter passed to the editprofile.php
script.

An attacker may also inject malicious HTML and script code into dynamic
content, by providing script code as a value for [IMG] and [ALIGN] BBcode
tags.

An attacker may exploit any one of the aforementioned vulnerabilities to
execute arbitrary script code in the browser of an unsuspecting user. It
may be possible to steal the unsuspecting user's cookie-based
authentication credentials, as well as other sensitive information. Other
attacks may also be possible.

Finally an attacker may pass malicious SQL syntax as values for URI
parameters of the following scripts:
viewthread.php, misc.php, forumdisplay.php and stats.php.

The attacker may exploit these vulnerabilities to influence SQL queries
that will be executed in the underlying database. This may provide for
data mining/corruption, credential stealing, forum compromise and attacks
on the database itself. Other attacks may also be possible.

26. LiveJournal CSS HTML Injection Vulnerability
BugTraq ID: 9727
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9727
Summary:
LiveJournal is freely available web based personal journal application
distributed under the GNU Public License.  It is implemented using Perl
scripts and requires a MySQL database back end.

LiveJournal is reportedly prone to HTML injection via Cascading Style
Sheet (CSS) tags.  This issue is due to insufficient sanitization of
journal input supplied in CSS styles.  This may be exploited by creating a
malicious style sheet with embedded script code in the journal entry,
which also includes a reference to the style using the HTML CLASS
attribute.  In this manner, it is possible to inject hostile HTML and
script code into journal entries.

This could potentially be exploited to steal cookies from other site
users.  Other attacks are also possible.

27. Confirm E-Mail Header Remote Command Execution Vulnerability
BugTraq ID: 9728
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9728
Summary:
Confirm is a Procmail script to prevent unsolicited e-mail using a
whitelist.

Confirm is prone to a remote command execution vulnerability.  The source
of the vulnerability is that Confirm does not sufficiently sanitize
malicious input before passing it through an external shell when invoking
other programs.  This issue is exposed when the script handles malicious
input such as shell metacharacters in e-mail headers.

Successful exploitation will allow for execution of shell commands in the
context of the user invoking the script.

28. RobotFTP Server Remote Pre-authenticated Command Denial Of S...
BugTraq ID: 9729
Remote: Yes
Date Published: Feb 23 2004
Relevant URL: http://www.securityfocus.com/bid/9729
Summary:
RobotFTP Server is an FTP Server for Microsoft Windows operating systems.

RobotFTP server has been reported prone to a denial of service
vulnerability. The issue presents itself when certain commands are sent to
the service, before authentication is negotiated.

Reportedly when the service handles LIST or CMD directives (or other
commands), represented as a hexadecimal string, prior to authentication,
the service will fail effectively denying service to legitimate users.

RobotFTP server versions up to and including version 2 are reported prone
to this issue.

29. Apple Mac OS X PPPD Format String Memory Disclosure Vulnerab...
BugTraq ID: 9730
Remote: No
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9730
Summary:
Apple Mac OS X ships with a (pppd) Point-to-Point Protocol daemon; the
daemon is installed by default.

The Apple Mac OS X pppd has been reported to be prone to a format string
vulnerability. The issue is reported to present itself within the
option_error() function. When the ppp daemon processes an invalid command
line argument, a function, error(), is called on the user-supplied data.
Format specifiers that are contained within the supplied data will be
interpreted literally, providing an attacker a conduit to read from pppd
process memory.

It has been reported that if the affected system is being used as a PPP
server, an attacker may potentially exploit this condition to disclose
regions of process memory that may contain PAP or CHAP authentication
credentials. Information harvested in this manner may be used to aid in
further attacks launched against the vulnerable system.

30. Multiple Apple Mac OS X Local And Remote Vulnerabilities
BugTraq ID: 9731
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9731
Summary:
Apple has reported multiple previously known and newly discovered security
vulnerabilities in Mac OS X (Client and Server).

The individual security issues include:

Improved notification logging (CAN-2004-0168).

Undisclosed DiskArbitration security improvements for handling writeable
removable media (CAN-2004-0167).

Undisclosed IPSec key exchange issue (CAN-2004-0164).

pppd daemon format string vulnerability described in BID 9730(Apple Mac OS
X PPPD Format String Memory Disclosure Vulnerability) (CAN-2004-0165).

Unspecified security vulnerability (CAN-2004-0089) in QuickTime Streaming
Server that is related to handling of request data.

URI display issue (CAN-2004-0166) in the Safari web browser.

Finally 3 vulnerabilities in tcpdump. These issues are described in BID
9507(TCPDump ISAKMP Decoding Routines Denial Of Service Vulnerability),
BID 7090(TCPDump Malformed RADIUS Packet Denial Of Service Vulnerability)
and BID 9423(TCPDump ISAKMP Decoding Routines Multiple Remote Buffer
Overflow Vulnerabilities).

These issues are currently undergoing further analysis. Where it is
appropriate, each individual issue will be assigned a unique BID and any
existing BIDs will be updated accordingly to reflect the release of this
Security Update.

31. Opt-X header.php Remote File Include Vulnerability
BugTraq ID: 9732
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9732
Summary:
Opt-X a network monitoring tool for content/urls and network services.
Opt-X is written in PHP.

A vulnerability has been reported to exist in the software that may allow
an attacker to include malicious files containing arbitrary code to be
executed on a vulnerable system. The problem reportedly exists because
remote users may influence the 'systempath' variable in the header.php
module.

Remote attackers could potentially exploit this issue by influencing the
include path to specify a remote malicious PHP script, which will be
executed in the context of the web server hosting the vulnerable software.

Opt-X version 0.7.2 has been reported to be prone to this issue.

32. Apache Cygwin Directory Traversal Vulnerability
BugTraq ID: 9733
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9733
Summary:
Apache is a freely available, open source web server software package. It
is distributed and maintained by the Apache Group.

A vulnerability has been reported to exist in Apache that may allow a
remote attacker to access information outside the server root directory.
The problem exists due to insufficient sanitization of user-supplied data.
The issue may allow a remote attacker to traverse outside the server root
directory by using encoded '\..' directory traversal character sequences.
This issue is only reported to present itself in Apache running on cygwin
platform.

Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive information that may be used to launch further
attacks against a vulnerable system.

33. Apple QuickTime/Darwin Streaming Server DESCRIBE Request Rem...
BugTraq ID: 9735
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9735
Summary:
Apple QuickTime/Darwin Streaming Server is server technology which allows
you to send streaming QuickTime media to clients across the Internet. It
is available for Apple MacOS X, Microsoft Windows and Linux operating
systems.

A vulnerability has been identified in Apple QuickTime/Darwin Streaming
Server that may allow a remote attacker to cause a denial of service
condition in the software.  The vulnerability is caused due to improper
handling of request data.  Specifically, the issue presents itself when
the software attempts to parse DESCRIBE requests with specially crafted
User-Agent fields.  It has been reported that by sending a request
containing over 255 characters via the User-Agent field, an attacker may
cause an assert error in the 'CommonUtilitiesLib/StringFormatter.h' file
leading to a denial of service condition.

Successful exploitation may allow an attacker to cause the affected server
to crash, denying service to legitimate users.

QuickTime/Darwin Streaming Server version 4.1.3 is reported to be prone to
this issue.

This issue was originally described in Apple Security Update 2004-02-23
Released To Fix Multiple Vulnerabilities (BID 9731).

34. Digital Reality Haegemonia Remote Denial Of Service Vulnerab...
BugTraq ID: 9736
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9736
Summary:
Haegemonia is a commercially available, network enabled strategic space
combat game.  It acts as both a client and a server and is available for
the Linux and Windows platforms.

It has been reported that Haegemonia is prone to a remote denial of
service vulnerability.  This issue is due to a failure of the application
to validate packet data size input supplied by a client.

The issue surrounds the data size field of an incoming packet.  If the
data size specified is excessively large, the application will attempt to
access memory outside of the affected process memory, causing an exception
to be raised.

The immediate consequences of a successful attack will cause the affected
server to crash.  It has been conjectured that this issue may also be
leveraged to execute arbitrary code in the context of the affected
application, however this has not been verified.

35. Working Resources BadBlue Server phptest.php Path Disclosure...
BugTraq ID: 9737
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9737
Summary:
BadBlue is a P2P file sharing application distributed by Working
Resources. It is available for Microsoft Windows operating systems.

A vulnerability has been reported to exist in the software that may allow
an attacker to disclose the installation path.  It has been reported that
an attacker may disclose the local path of the server by issuing a request
for 'phptest.php' script.  The path is reportedly included in the source
code of the requested page.

Successful exploitation of this vulnerability may allow an attacker to
gain sensitive information about the file system that may aid in launching
more direct attacks against the system.

BadBlue version 2.4 has been reported to be affected by this issue,
however, other versions may be vulnerable as well.

36. RedStorm Ghost Recon Game Engine Remote Denial Of Service Vu...
BugTraq ID: 9738
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9738
Summary:
Ghost Recon Game Engine is a computer game engine that is distributed and
maintained/developed by RedStorm. The game engine is used in several
RedStorm titles. It includes features that allow users to game locally or
across a network. It has been reported that this product is no longer
maintained.

The Ghost Recon Game Engine has been reported prone to a denial of service
vulnerability. When handling text strings, the Ghost Recon Game Engine
employs a 32-bit integer string size prefix in order to monitor the size
of the string. When a string is handled, functions that operate on the
integer fail to perform sufficient sanity checks on its value. An attacker
may supply an invalid large value, for example 0xffffffff. It has been
reported that when such a value is processed an exception will be
triggered causing a system wide denial of service.

37. Seyeon Technology FlexWATCH Server Cross-Site Scripting Vuln...
BugTraq ID: 9739
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9739
Summary:
FlexWATCH Network Video Server is used to deliver real time video over a
network. The server also allows users to use a web browser as a client.

A cross-site scripting vulnerability has been identified in the software.
It has been reported that due to insufficient sanitization of
user-supplied input, HTML and script code may be rendered in a user's
browser.  Although unconfirmed, this attack may result from an error page
generated by the server.  Reportedly, an attacker may send a large number
of characters via a URI request followed by script code to carry out an
attack.

Due to the nature of this vulnerability, it may be possible for a remote
attacker to create a malicious link to the vulnerable application that
includes hostile HTML and script code. If this link were followed, the
hostile code may be rendered in the web browser of the victim user. This
would occur in the security context of the web server and may allow for
theft of cookie-based authentication credentials or other attacks.

These issues have been reported to exist in FlexWATCH versions 2.2 and
prior.

38. Gigabyte Gn-B46B Wireless Router Authentication Bypass Vulne...
BugTraq ID: 9740
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9740
Summary:
Gigabyte Gn-B46B is a wireless router appliance. The appliance provides a
web-based interface for router configuration; this interface is protected
with an authentication procedure.

Gigabyte Gn-B46B has been reported prone to an authentication bypass
vulnerability. It has been reported that an attacker may save the router
HTML menu on a local machine, the attacker may then use this menu to
access and configure an accessible router without requiring prior
authentication.

An attacker may exploit this issue to disclose sensitive information, or
potentially to make configuration changes to the affected appliance.

39. Gamespy Software Development Kit Remote Denial Of Service Vu...
BugTraq ID: 9741
Remote: Yes
Date Published: Feb 24 2004
Relevant URL: http://www.securityfocus.com/bid/9741
Summary:
GameSpy Software Development Kit is a collection of ANSI-C source code
files facilitating development of the network component of online video
games.

It has been reported that the GameSpy SDK is prone to a remote denial of
service vulnerability.  This issue is due to the software failing to
handle exceptional conditions during network communication.

The vulnerability surrounds the query functionality of the game server.
The query is sent via a network packet and is enclosed in forward slashes
'\', ex: '\query\'.  The software uses the strchr() function to read the
number of characters residing between the backslashes.  It then subtracts
one from this number and assigns it to a signed integer without verifying
that the size is greater than zero.  This causes the size to be
interpreted as a negative number, which is subsequently used in a
strncpy() function call, which will necessarily fail.

The software then fails to check for failure of the strncpy() function.
When the target string of the strncpy function is subsequently
dereferenced, the server will generate an exception causing it to crash.

Exploitation of this issue may cause the affected GameSpy developed game
to crash, denying service to legitimate users.

40. Microsoft ASN.1 Library Multiple Stack-Based Buffer Overflow...
BugTraq ID: 9743
Remote: Yes
Date Published: Feb 25 2004
Relevant URL: http://www.securityfocus.com/bid/9743
Summary:
Microsoft Windows Abstract Syntax Notation 1 (ASN.1) handling Library
(MSASN1.dll) is shipped as a part of the Microsoft Windows Operating
System. The MSASN1 library provides an application programmer's interface
into Microsoft ASN.1 encoding/decoding and processing functions.

Multiple buffer overflow vulnerabilities have been reported in the
Microsoft ASN.1 library. These issues are related to insufficient checking
of data supplied via externally supplied length fields in ASN1BERDecDouble
and ASN1PERDecDouble functions.  Although unconfirmed, these issues could
allow an attacker to execute arbitrary code leading to unauthorized access
to a vulnerable system.

It has been reported that an attacker may be able to exploit the issue in
ASN1BERDecDouble function by passing a value that is larger than 0x10C via
'ASN1BERDecLength' field to the function.  Similar issues have been
identified in the ASN1PERDecDouble function as well, however, no further
details have been disclosed.

These vulnerabilities may have different attack vectors depending upon the
services and applications employing the affected functions.  Like
previously reported issues in the library (BIDs 9633 and 9635), the
vulnerable functions could theoretically be used in certificate handling
code in Microsoft or third-party software.

Reportedly, the first issue is not exploitable under Windows 2000 SP4 and
the second issue has been addressed by the fixes released in MS04-007.
This information has not been confirmed by Symantec.

These issues are pending further analysis and will likely be separated
into two individual BIDs.

41. FreeChat Remote Denial Of Service Vulnerability
BugTraq ID: 9744
Remote: Yes
Date Published: Feb 25 2004
Relevant URL: http://www.securityfocus.com/bid/9744
Summary:
FreeChat is a freely available web server that supports browser based
streaming chat.  It is implemented using Visual Basic 6 and designed to
run on Windows.

It has been reported that FreeChat is prone to a remote denial of service
vulnerability.  The issue surrounds the server's inability to handle
unexpected strings.

Upon sending an arbitrary string to the server, an exception will be
raised, causing the process to crash.

Successful exploitation will cause a denial of service condition in the
server application, forcing the affected process to crash and deny service
to legitimate users.

42. Alcatel OmniSwitch 7000 Series Security Scan Denial Of Servi...
BugTraq ID: 9745
Remote: Yes
Date Published: Feb 25 2004
Relevant URL: http://www.securityfocus.com/bid/9745
Summary:
The Alcatel OmniSwitch 7000 series switches are multi-layer switching
appliances.

A vulnerability has been reported in the handling of specific types of
network traffic by OmniSwitch 7000 series systems. Because of this, an
attacker may be able to deny service to legitimate users of a vulnerable
switch.

The problem is in the handling of scans by third-party security software.
It has been reported that several services run by default on an affected
switch (Ports 80, 260, 261 and 443). When the affected services of
OmniSwitch 7000 series systems are scanned by third-party security
software, the switch firmware becomes unstable. As a result of such scans,
the switch reportedly reboots, impacting performance. In some
circumstances the attack may result in a denial of service to the switched
network.

An attacker may exploit this issue to deny network services to hosts on a
vulnerable switched network.

It should be noted that although the OmniSwitch 7000 series (7700,7800)
switches have been reported prone to this vulnerability, other versions
including the OmniSwitch 8800 series might also be vulnerable.

43. MTools MFormat Privilege Escalation Vulnerability
BugTraq ID: 9746
Remote: No
Date Published: Feb 25 2004
Relevant URL: http://www.securityfocus.com/bid/9746
Summary:
Mtools are a collection of tools designed to allow users to access MS-DOS
formatted discs from Linux operating systems.  MFormat is a utility
designed to enable the addition of an MS-DOS filesystem to a low-level
formatted diskette. They are freely available under the GNU Public
License.

It has been reported that mformat is prone to an insecure file creation
vulnerability when installed as a setUID application.  This issue is due
to a design error allowing a user to create any arbitrary files with
permissions 0666 as the root user.

It has also been reported that the application retains root privileges
when reading local configuration files.

A local attacker could exploit this issue by forcing the creation of
sensitive system files that already exist.  When the application formats
the specified files, the target system file will be overwritten,
destroying sensitive system data.  Since the files that are given
permissions 0666 and owned by root, the attacker may alter overwritten
system configuration files, allowing for a escalation of privileges.

44. Mozilla Browser Zombie Document Cross-Site Scripting Vulnera...
BugTraq ID: 9747
Remote: Yes
Date Published: Feb 25 2004
Relevant URL: http://www.securityfocus.com/bid/9747
Summary:
Mozilla is a freely available web browser designed for a number of
platforms, including Microsoft Windows and Linux.

Mozilla has been reported to be prone to a cross-site scripting
vulnerability.  This issue is due to a design error that allows event
handlers in a web document from one domain to be executed in the context
of another.

This issue is due to the browser allowing a new web page to interact with
a previously visited web page before the new page is completely loaded;
producing a zombie document.  This allows any script events that are
activated within a certain time frame to be invoked in the context of the
new web page, and thus facilitate cross-site scripting attacks.

The problem surrounds the use of event handlers inside HTML tags.  Mozilla
does attempt to deactivate these, however they are possible to bypass.

This could permit a remote attacker to create a malicious web page that
includes hostile event handling script code. If this page were to redirect
to a target page when certain event handling code was activated, the
hostile code may be rendered in the web browser of the victim user. This
would occur in the security context of the new page and may allow for
theft of cookie-based authentication credentials or other attacks.

45. CalaCode @mail Webmail System Cross-Site Scripting Vulnerabi...
BugTraq ID: 9748
Remote: Yes
Date Published: Feb 26 2004
Relevant URL: http://www.securityfocus.com/bid/9748
Summary:
@mail Webmail System is a web based e-mail software package. It can be
installed with a SQL database or flat files.

A cross-site scripting vulnerability has been identified in the software
that may allow an attacker to execute HTML or script code in a user's
browser.

It has been reported that the @mail 'util.pl' script is prone to a
cross-site scripting vulnerability. The issue arises due to the script
failing to properly sanitize user-supplied information. The 'Displayed
Name' field is not properly sanitized of HTML tags. This could allow for
execution of hostile HTML and script code in the web client of a user who
visits a vulnerable web page. This would occur in the security context of
the site hosting the software.

Exploitation could allow for theft of cookie-based authentication
credentials. Other attacks are also possible.

It has been reported that this issue affects @mail version 3.64, however,
earlier versions may also be vulnerable.

46. CalaCode @mail Webmail System POP3 Remote Denial of Service ...
BugTraq ID: 9749
Remote: Yes
Date Published: Feb 26 2004
Relevant URL: http://www.securityfocus.com/bid/9749
Summary:
@mail webmail system is a web based e-mail software package. It can be
installed with a SQL database or flat files.

@mail webmail system has been reported to be prone to a remote denial of
service vulnerability. A malevolent user may leverage this issue to cause
the service to crash, denying service to legitimate users.  It has been
reported that this issue arises due to a problem in the POP3 service's
connection handling.  The vulnerability may be successfully exploited by
establishing about 600 connections via POP3.

Successful exploitation of this issue may result in a crash or hang,
leading to a denial of service for legitimate users.

It has been reported that this issue affects @mail version 3.64, however,
earlier versions may also be vulnerable.

47. Dell OpenManage Web Server POST Request Heap Overflow Vulner...
BugTraq ID: 9750
Remote: Yes
Date Published: Feb 26 2004
Relevant URL: http://www.securityfocus.com/bid/9750
Summary:
Dell OpenManage Web Server is a service used to aid remote system
management.

Dell OpenManage Web Server has been reported prone to a remote heap
overflow vulnerability. The issue presents itself due to a lack of
sufficient bounds checks performed on POST request data. Specifically, a
remote user may specify a hidden variable "application" in a post request,
this variable is later copied without any bounds checking into a 256 byte
buffer allocated in heap based memory.

A remote attacker may exploit this issue to corrupt heap based memory
management structures located adjacent to the affected buffer. The
immediate consequences of exploitation may result in a denial of service.
Although unconfirmed, it has been conjectured that due to the nature of
this vulnerability, a remote attacker may leverage the issue to have
arbitrary code executed on an affected system.

It should be noted that although this issue has been reported to affect
OpenManage Web Server version 3.4.0 and version 3.7.0, other versions
might also be vulnerable.

48. RhinoSoft Serv-U FTP Server MDTM Command Time Argument Buffe...
BugTraq ID: 9751
Remote: Yes
Date Published: Feb 26 2004
Relevant URL: http://www.securityfocus.com/bid/9751
Summary:
RhinoSoft Serv-U FTP Server is designed for use with Microsoft Windows
operating systems.

Serv-U FTP Server has been reported prone to a remote stack based buffer
overflow vulnerability when handling time/date arguments passed to the
MDTM FTP command.

The problem exists due to insufficient bounds checking. It has been
reported that when a specially crafted MDTM time/date argument is copied
into an allocated buffer in Serv-U FTP process memory, data that exceeds
the size of the buffer may overrun its bounds and trample adjacent memory.
This may allow the attacker to corrupt variables that are saved adjacent
to the affected buffer. Ultimately an attacker may leverage this issue to
have arbitrary instructions executed in the context of the SYSTEM user.

This vulnerability has been reported to affect Serv-U FTP Server up to but
not including version 5.0.0.4.

49. Internet Security Systems Protocol Analysis Module SMB Parsi...
BugTraq ID: 9752
Remote: Yes
Date Published: Feb 26 2004
Relevant URL: http://www.securityfocus.com/bid/9752
Summary:
The Internet Security Systems (ISS) Protocol Analysis Module is prone to a
remotely exploitable heap overrun vulnerability.  This module is used to
parse network protocols and is included in a number of products provided
by ISS, including various RealSecure and BlackICE releases.

The following software is affected by this issue:
RealSecure Network 7.0, XPU versions 20.15 through 22.9
RealSecure Server Sensor 7.0 XPU versions 20.16 through 22.9
Proventia A Series XPU versions 20.15 through 22.9
Proventia G Series XPU versions 22.3 through 22.9
Proventia M Series XPU versions 1.3 through 1.7
RealSecure Desktop 7.0 versions eba through ebh
RealSecure Desktop 3.6 versions ebr through ecb
RealSecure Guard 3.6 versions ebr through ecb
RealSecure Sentry 3.6 versions ebr through ecb
BlackICE PC Protection 3.6 versions cbr through ccb
BlackICE Server Protection 3.6 versions cbr through ccb

The issue exists in the SMB parsing routines provided by the module.  In
particular, there is insufficient bounds checking of data supplied in SMB
"Setup AndX" requests.  The particular issue may be triggered during
authentication by sending such a request with an AccountName parameter
string of 300 bytes or more in length.  This may reportedly be exploited
without needing to pass the negotiation phase of the protocol.

This issue could potentially be exploited to execute arbitrary code on
systems hosting the vulnerable software, potentially resulting in system
compromise.

50. PerfectNav Malformed URI Denial Of Service Vulnerability
BugTraq ID: 9753
Remote: Yes
Date Published: Feb 26 2004
Relevant URL: http://www.securityfocus.com/bid/9753
Summary:
PerfectNav is an adware plug-in for Internet Explorer; it is designed to
redirect unresolved URI's to the PerfectNav web page.

PerfectNav has been reported prone to a denial of service vulnerability.
The issue reportedly presents itself when the PerfectNav plug-in processes
a malformed URI. This will supposedly cause the PerfectNav plug-in to
fail, which in turn will crash the current instance of Internet Explorer.

A remote attacker may theoretically trigger a denial of service by
supplying a malformed URI to a target victim.

51. eXtremail Authentication Bypass Vulnerability
BugTraq ID: 9754
Remote: Yes
Date Published: Feb 26 2004
Relevant URL: http://www.securityfocus.com/bid/9754
Summary:
eXtremail is a mail server developed for Unix platforms.

eXtremail has been reported prone to an authentication bypass
vulnerability. The issue will only present itself under certain
circumstances. Specifically, if an account is created and the password
associated with that account consists of a single digit, or the password
begins with a digit, then an attacker may use this account to access the
service without supplying any password.

A remote attacker may exploit this vulnerability to gain access to
protected services.

It should be noted that while this vulnerability has been reported to
affect eXtremail version 1.5.9, other versions might also be affected.


III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Alleged WebTV 911 hacker charged with cyberterrorism
By: Kevin Poulsen

Louisiana man is charged under the USA PATRIOT Act for sending out a
malicious script that made set-top boxes call the police.

http://www.securityfocus.com/news/8136

2. Gates 'optimistic' on security
By: Kevin Poulsen

The Microsoft chairman announces new security initiatives at the RSA
Conference.

http://www.securityfocus.com/news/8111

3. U.S. info-sharing program draws fire
By: Kevin Poulsen

Critics take aim at a Department of Homeland Security
vulnerability-sharing program that keeps security holes secret from the
public.

http://www.securityfocus.com/news/8090

4. Fistful of Bagles shoot up the Net
By: John Leyden, The Register

http://www.securityfocus.com/news/8152

5. Spam villains: named and shamed
By: Lucy Sherriff, The Register

http://www.securityfocus.com/news/8143

6. Ferocious new Mydoom variant destroys files
By: Matti Huuhtanen, The Associated Press

http://www.securityfocus.com/news/8124


IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Big Sister   v0.99b1
By: Thomas Aeby
Relevant URL: http://bigsister.sourceforge.net/
Platforms: Linux, Windows 2000, Windows NT, Windows XP
Summary:

Big Sister is an SNMP-aware monitoring program consisting of a Web-based
server and a monitoring agent. It runs under various Unixes and Windows.

2. snortalog v2.2RC2
By: jeremy chartier
Relevant URL: http://jeremy.chartier.free.fr/snortalog/
Platforms: UNIX
Summary:

Snortalog (formerly known as Snort-ng) is a powerful Perl script that
summarizes Snort logs, making it easy to view any network attacks detected
by Snort. It can generate charts in HTML. It works with all versions of
Snort, and can analyze logs in two formats: syslog alerts and text alerts.
It does not include a database for maximum performance.

3. suPHP   v0.5.1
By: Sebastian Marsching
Relevant URL: http://www.suphp.org/
Platforms: Linux
Summary:

suPHP is a combination of an Apache module (mod_suphp) and an executable
which provides a wrapper for PHP. With both together, it is possible to
execute PHP scripts with the permissions of their owner without having to
place a PHP binary in each user's cgi-bin directory. suPHP doesn't need
Apache's suExec, and provides a logging function.

4. Sentry Firewall CD-ROM v1.5.0-rc10(dev)
By: Obsid
Relevant URL: http://www.SentryFirewall.com/
Platforms: Linux
Summary:

Sentry Firewall CD-ROM Version 1.0 is a Linux based bootable CD-ROM
suitable for use as an inexpensive and easy to maintain Firewall or
IDS(Intrusion Detection System) Node. The system is designed to be
immediately configurable for a variety of different operating environments
via a configuration file located on a floppy disk or a local hard drive.

5. Portable OpenSSH v3.8p1
By: Damien Miller <[email protected]>
Relevant URL: http://www.openssh.com/
Platforms: Linux, UNIX
Summary:

This is a Unix/Linux port of OpenBSD's excellent OpenSSH. OpenSSH is a
full implementation of the SSH1 protocol and a 99% implementation of the
SSH 2 protocol, including sftp client and server support.

6. xmlBlaster v0.9
By: Marcel
Relevant URL: http://www.xmlBlaster.org/
Platforms: Os Independent
Summary:

XmlBlaster is XML based MOM (Message oriented Middleware) with a lot of
features. It is a publish/subscribe and point-to-point MOM server which
exchanges XML-encoded messages. Communication with the server is based on
CORBA (using JacORB), RMI, XML-RPC, native socket, or a persistent HTTP
plugin. Subscribers can use XPath expressions to filter the messages they
wish to receive and add their own MIME-based filter plugins. C/C++, Java,
Perl and PHP client demos are included in the xmlBlaster test suite, and
Tcl and Python demo clients are scheduled. XmlBlaster also provides a
browser callback framework, allowing browsers (Netscape, Mozilla, MSIE) to
receive instant callbacks over a persistent http connection. A security
plugin framework allows authentication/authorization in many ways.
Currently there are LDAP- and passwd-based plugins available.


V. SECURITYJOBS LIST SUMMARY
----------------------------
1. IT Security Consultant Needed (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355653

2. Regional Information Security Incident Response Co-o... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355616

3. Global Head of Information Security Incident Respons... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355614

4. Sr. Manager Development / DeepSight Product Team, Ca... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355566

5. Senior Security Analyst Silicon Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355551

6. job opening for Security Engineer - Huntsville, AL (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355542

7. NY Sales Executive (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355540

8. ArcSight-Senior Security Strategist needed in Sunnyv... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355339

9. Seeking Sr. Information Security Position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355337

10. Identity Management Professional - Tampa Bay, Florid... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355336

11. Sales Engineer-Silicon Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355335

12. ArcSight-Professional Services Security Consultant w... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355334

13. Security professional available (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355333

14. Information Security Officer position in Orange Coun... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355332

15. Penetration Tester London - (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355244

16. Job Opening in Maryland for Security  Researcher (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355240

17. soon to be graduate seeking full-time employement (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355236

18. Security & Policy Awareness Analyst #856 - Cleveland... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355230

19. Weblogic Security Engineers-Northern Virginia (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355229

20. experienced channel sales professional available (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355217

21. Intermediate/Senior Sec. Analyst Position at Symante... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355215

22. Looking for Security position in SF Bay Area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355210

23. Network Security Engineer Available Immediately (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355203

24. Security Architect/ Consultant role in Toronto Canad... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355106

25. Sr. Security Engineer -- Westlake Village, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355074

26. Sr. Product Manager for the Metaframe Secure Access ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/355002

27. Business Development Specialist  (Baltimore, DC or V... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/354933

28. Security Response Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/354932

29. Looking for position - Infosec Manager or Managing C... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/354927


VI. INCIDENTS LIST SUMMARY
--------------------------
1. A basic Question from a new bie!! (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/355743

2. Releasing patches is bad for security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/355739

3. Nmap - 3.50 changes mstask.exe? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/355696

4. FW: Nmap - 3.50 changes mstask.exe? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/355618

5. DoS Tool Identification (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/355369

6. OpenSSH anomaly (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/355024

7. FW: OpenSSH anomaly (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/354836

8. incidents Digest 22 Feb 2004 13:01:58 -0000 Issue 51... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/354835


VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. VoIP Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/355764

2. XFree86 font.alias exploit hangup.... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/355693

3. heap overflows (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/355637

4. Extremail Security Problem (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/355452

5. Format String vuln in Inktomi Search4.0 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/355451

6. THCimail (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/355450

7. Exploiting the Wilderness (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/354959


VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Preventing OS Detection (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/355786

2. SYN_SENT to port 8081 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/355666

3. Log Question (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/355591

4. FPSE Admin Listner on IIS 6.0 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/355585

5. FW: Preventing OS Detection (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/355136

6. Administrivia: Virus in email (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/355131

7. SecurityFocus Microsoft Newsletter #177 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/355115

8. Tests to determine ASN.1 patch applicability (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/355096

9. Article Announcement (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/355028


IX. SUN FOCUS LIST SUMMARY
--------------------------
NO NEW POSTS FOR THE WEEK 2004-02-23 to 2004-03-01.


X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2004-02-23 to 2004-03-01.


XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
[email protected] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer.
Alternatively you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.

If your email address has changed email [email protected] and
ask to be manually removed.


XII. SPONSOR INFORMATION
-----------------------
This issue sponsored by: Tenable Security

How do you manage your VULNERABILITIES?  Tenable Network Security can help
you actively and passively detect them with NeWT and NeVO as well as
communicate this information to the people who need to fix them through
the Lightning Console. Make recommendations, track remediations, correlate
vulnerabilities with IDS events, and create executive reports based on
organization, asset type or region. Visit us at:
http://www.securityfocus.com/sponsor/TenableSecurity_sf-news_040301
------------------------------------------------------------------------