SecurityFocus Newsletter #240
Conrad Schilbe <[email protected]> Mon, 15 Mar 2004 15:41:49 -0700 (MST)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #240
------------------------------
This Issue is Sponsored by: Check Point
Introducing the world's first and only complete Internal Security Gateway:
Check Point InterSpect.
Built specifically to protect internal networks, Check Point InterSpect
provides intelligent worm defense, network zone segmentation, quarantine
capabilities, and LAN protocol protection - all in one easy to deploy
appliance that protects your network from threats within.
Learn more about Check Point InterSpect at:
http://www.securityfocus.com/sponsor/CheckPoint_sf-news_040315
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Voice over IP Security
2. Anti-Spam Solutions and Security, Part 2
3. Where to Turn?
4. Googling Up Passwords
II. BUGTRAQ SUMMARY
1. Seattle Lab Software SLWebMail Multiple Buffer Overflow Vuln...
2. Seattle Lab Software SLMail Pro Remote Buffer Overflow Vulne...
3. Invision Power Board Error Message Path Disclosure Vulnerabi...
4. Norton AntiVirus 2002 ASCII Control Character Denial Of Serv...
5. VirtuaSystems VirtuaNews Multiple Module Cross-Site Scriptin...
6. NFS-Utils rpc.mountd Denial Of Service Vulnerability
7. Norton AntiVirus 2002 Nested File AutoProtect Bypass Vulnera...
8. Apple Safari Large JavaScript Array Handling Denial Of Servi...
9. GNU Automake Insecure Temporary Directory Creation Symbolic ...
10. PWebServer Remote Directory Traversal Vulnerability
11. Network Time Protocol Daemon Integer Overflow Vulnerability
12. VirtuaSystems VirtuaNews Admin.PHP Cross-Site Scripting Vuln...
13. IBM DB2 Remote Command Server Privilege Escalation Vulnerabi...
14. Invision Power Board Pop Parameter Cross-Site Scripting Vuln...
15. LionMax Software Chat Anywhere User IP Address Obfuscation V...
16. F-Secure SSH Server Password Authentication Policy Evasion V...
17. Microsoft Windows Media Services Remote Denial of Service Vu...
18. Apache Mod_SSL HTTP Request Remote Denial Of Service Vulnera...
19. Microsoft Outlook Mailto Parameter Quoting Zone Bypass Vulne...
20. Microsoft MSN Messenger Information Disclosure Vulnerability
21. Apache Mod_Access Access Control Rule Bypass Vulnerability
22. Confixx DB Parameter SQL Injection Vulnerability
23. Confixx Perl Debugger Remote Command Execution Vulnerability
24. WU-FTPD restricted-gid Unauthorized Access Vulnerability
25. IBM WebSphere Unspecified Security Vulnerability
26. IBM DFSMS/MVS Tape Utility Unspecified Vulnerability
27. IBM AIX Rexecd Privilege Escalation Vulnerability
28. Python getaddrinfo Function Remote Buffer Overflow Vulnerabi...
29. Sun Solaris Multiple Unspecified Local UUCP Buffer Overrun V...
30. Sysstat Insecure Temporary File Creation Vulnerability
31. Invicta WMCam Server Remote Denial Of Service Vulnerability
32. Epic Games Unreal Tournament Server Engine Remote Format Str...
33. Multiple Vendor Internet Browser Cookie Path Argument Restri...
34. GdkPixbuf Unspecified Bitmap Handling Denial Of Service Vuln...
35. F-Secure Anti-Virus For Linux Unspecified Scanner Bypass Vul...
36. Sysstat Isag Temporary File Creation Vulnerability
37. Courier Multiple Remote Buffer Overflow Vulnerabilities
38. GNU MyProxy Cross-Site Scripting Vulnerability
39. Pegasi Web Server Multiple Input Validation Vulnerabilities
40. cPanel Resetpass Remote Command Execution Vulnerability
41. Targem Games Battle Mages Remote Denial Of Service Vulnerabi...
III. SECURITYFOCUS NEWS ARTICLES
1.
Hosting company reveals hacks, citing disclosure law
2. Feds: E-mail subpoena ruling hurts law enforcement
3. Pranksters bedevil TV weather announcment system
4. Regulator says he's not optimistic about success for do-not-...
5. Israeli teen quizzed over US cop file hack
6. More NetSky worms. So much for quitting
IV. SECURITYFOCUS TOP 6 TOOLS
1. filewatcher v2.3.9
2. CryptoHeaven v2.3.2
3. NetMRG v0.14
4. Syslog Management Tool v1.0
5. Nmap Parser v0.76
6. passwd_exp v1.0.0
V. SECURITYJOBS LIST SUMMARY
1. SAP Security and Authorizations consultant- Seattle (Thread)
2. Software Development Engineer - Columbia, MD (Thread)
3. Information Analyst (Network Security) Clearance Req... (Thread)
4. Systems Engineer MA (Thread)
5. CISSP-type Security Job Rate Survey (Thread)
6. Network perimeter control position in central New Je... (Thread)
7. Security Software Sales - VA/DC metro (commercial) (Thread)
8. Security Analyst Needed (Thread)
9. CISSP Seeking a Position (Thread)
10. Info Security Technical Manager- Dallas, TX (Thread)
11. Cisco Security Engineer (Thread)
12. Beginning in the field (Thread)
13. Senior Manager IT Audit (job opening) - Columbus, OH (Thread)
14. IT Audit Management, position open - Columbus, OH (Thread)
15. CISSP, GSEC, CISA, BIG 5 Consulting Seeks Job in Den... (Thread)
16. Security Trainer - Contract (Thread)
17. Senior Information Systems Security Analyst (Thread)
18. Professional Services / Implementation Engineer Need... (Thread)
19. High quality of life with low cost of living- Iowa (Thread)
20. Immediate need in Chicago for 2 top tier Sales profe... (Thread)
21. IT Security Specialist available in California (Thread)
22. Technical Marketing Manager Needed for Internet Secu... (Thread)
23. Network Security Engineer MA (Thread)
24. Information Systems Security Evaluator (Thread)
25. Trade Union Advice (Thread)
26. Senior Penetration Tester (Thread)
27. Security Marketing Manager #861JS - Boston, MA - $12... (Thread)
28. Perimeter Security staff level needs in San Francisc... (Thread)
29. Host Sensor Software Engineer, Columbia MD (Thread)
30. InfoSec Evangelist Available (Thread)
31. one opening: AOL Incident Response in Northern VA (Thread)
32. Security Research Engineer Columbia MD (Thread)
33. New Articles @ SecurityFocus (Thread)
34. IT Audit opportunity - Milwaukee Wisconsin (Thread)
35. Product Marketing Engineer Need - Network Security (Thread)
36. Identity Management Business Analyst position in NYC... (Thread)
37. Technical Training Manager Need - Network Security (Thread)
38. I'm looking for work in the Washington DC Metro Area (Thread)
39. Senior Corporate Security Analyst - San Jose, CA (Thread)
40. UT-AUSTIN: IT POLICY COORDINATOR (Thread)
41. Security Sales Position- UK, London area (Thread)
42. Position Available -- Security Software - Marketing ... (Thread)
43. Penetration testers required (Thread)
44. CISSP Seeking a Position in Orlando, FL (Thread)
VI. INCIDENTS LIST SUMMARY
1. Port 2979 Activity (Thread)
2. DHCP or Probe? (Thread)
3. Is it possible to derease gradually the number of Cl... (Thread)
4. Is it possible to derease gradually the number of Cl... (Thread)
5. Is it possible to derease gradually the number of Cl... (Thread)
6. Is it possible to derease gradually the number of Cl... (Thread)
7. Port 2492 (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Linux exploits and random post-argv/ envp injection (Thread)
2. [oracle] - passwords in clear text and password prot... (Thread)
3. problem with RET & debian debuggin' (Thread)
4. Vulnerability in X server (Thread)
5. A little help?? (Thread)
6. NAV bugs! (Thread)
7. Looking For Vulnerability Researchers (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Microsoft XP/SP2 security (Thread)
2. SecurityFocus Microsoft Newsletter #179 (Thread)
3. Article Announcement: IIS 6.0 Security (Thread)
IX. SUN FOCUS LIST SUMMARY
1. PAM & Auth (Thread)
2. sunscreen and stealth interfaces (Thread)
3. Problems chrooting BIND 9.2.2 in a Solaris 8 box (Thread)
X. LINUX FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2004-03-08 to 2004-03-15.
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Voice over IP Security
By Matthew Tanase
This article discusses some of the advantages, disadvantages and security
concerns with Voice over IP telephony.
http://www.securityfocus.com/infocus/1767
2. Anti-Spam Solutions and Security, Part 2
By Dr. Neal Krawetz
The second and final part of this article series focuses on the various
types of challenge-based systems and cryptographic solutions that can be
used to combat spam and its related security issues.
http://www.securityfocus.com/infocus/1766
3. Where to Turn?
By Tim Mullen
When everyone in the security world has something to sell, it's harder
than ever to get straight answers about genuine threats.
http://www.securityfocus.com/columnists/225
4. Googling Up Passwords
By Scott Granneman
Google is in many ways the most useful tool available to the bad guys, and
the most dangerous Web site on the Internet for many, many thousands of
individuals and organizations.
http://www.securityfocus.com/columnists/224
II. BUGTRAQ SUMMARY
-------------------
1. Seattle Lab Software SLWebMail Multiple Buffer Overflow Vuln...
BugTraq ID: 9808
Remote: Yes
Date Published: Mar 05 2004
Relevant URL: http://www.securityfocus.com/bid/9808
Summary:
It has been reported that SLWebMail is prone to multiple buffer overflow
vulnerabilities that may allow an attacker gain unauthorized access. The
vulnerabilities are reported to exist in user.dll, loadpageadmin.dll and
loadpageuser.dll.
SLWebMail shipped with SLMail Pro versions 2.0.9 and prior is reported to
be affected by these issues.
2. Seattle Lab Software SLMail Pro Remote Buffer Overflow Vulne...
BugTraq ID: 9809
Remote: Yes
Date Published: Mar 05 2004
Relevant URL: http://www.securityfocus.com/bid/9809
Summary:
A vulnerability has been discovered in the SLMail mail server that would
allow an attacker to overflow a stack based buffer with a malicious HTTP
request.
It may be possible for attackers to leverage this vulnerability to execute
instructions of their design. Any code executed would be in the security
context of the vulnerable mail server process.
3. Invision Power Board Error Message Path Disclosure Vulnerabi...
BugTraq ID: 9810
Remote: Yes
Date Published: Mar 05 2004
Relevant URL: http://www.securityfocus.com/bid/9810
Summary:
It has been reported that Invision Power Board may be prone to an
information disclosure vulnerability that may allow an attacker to
disclose the installation path. This issue can be exploited by issuing an
invalid request for uploading an image file. The path is reportedly
included in an error message displayed by the server.
Invision Board version 1.3 is reported to be vulnerable to this issue;
however, it is possible that other versions are affected as well.
4. Norton AntiVirus 2002 ASCII Control Character Denial Of Serv...
BugTraq ID: 9811
Remote: Yes
Date Published: Mar 05 2004
Relevant URL: http://www.securityfocus.com/bid/9811
Summary:
Norton AntiVirus 2002 has been reported to crash when performing manual
scans on files contained in certain folders. This is related to how the
software handles ASCII control characters (represented by decimal values
in the range of 1-31).
Although unconfirmed this issue may allow a malicious file to go
un-scanned, and so lead a user into a false sense of security.
It should be noted that the vulnerability that is described in this BID is
reported to affect manual scans only; it is not reported to affect the NAV
Auto-Protect Engine.
5. VirtuaSystems VirtuaNews Multiple Module Cross-Site Scriptin...
BugTraq ID: 9812
Remote: Yes
Date Published: Mar 05 2004
Relevant URL: http://www.securityfocus.com/bid/9812
Summary:
It has been reported that the VirtuaNews non-default modules 'Files' and
'Vulns' are prone to multiple cross-site scripting vulnerabilities. These
problems surround the application's failure to properly validate user
supplied URI input. When exploited an attacker can execute arbitrary
script and HTML code in the context of the vulnerable application.
The supplied code is rendered in the browser in the context of the
affected application. This may allow an attacker to craft a malicious
link, facilitating a cross-site scripting attack.
Attackers may exploit this vulnerability to steal authentication
credentials. Other attacks may also be possible.
6. NFS-Utils rpc.mountd Denial Of Service Vulnerability
BugTraq ID: 9813
Remote: No
Date Published: Mar 06 2004
Relevant URL: http://www.securityfocus.com/bid/9813
Summary:
An unspecified denial of service vulnerability exists in nfs-utils. It
has been reported that certain DNS configurations may cause rpc.mountd to
crash, potentially impacting availability of the DNS client at mount time.
7. Norton AntiVirus 2002 Nested File AutoProtect Bypass Vulnera...
BugTraq ID: 9814
Remote: No
Date Published: Mar 06 2004
Relevant URL: http://www.securityfocus.com/bid/9814
Summary:
A vulnerability has been alleged in Norton AntiVirus 2002 that may
potentially permit a nested executable file to bypass the AutoProtect
feature when it is executed.
This issue has not been confirmed and is currently under investigation.
8. Apple Safari Large JavaScript Array Handling Denial Of Servi...
BugTraq ID: 9815
Remote: Yes
Date Published: Mar 06 2004
Relevant URL: http://www.securityfocus.com/bid/9815
Summary:
Apple Safari Web Browser is reported to be prone to a security
vulnerability related to handling of large JavaScript arrays (with
99999999999999999999999 or 0x23000000 elements). By declaring such an
array and then attempting to access it, it may be possible to cause a
browser crash.
This issue is likely due to memory corruption but it is not known if it
could be further exploitable to execute arbitrary code.
9. GNU Automake Insecure Temporary Directory Creation Symbolic ...
BugTraq ID: 9816
Remote: No
Date Published: Mar 08 2004
Relevant URL: http://www.securityfocus.com/bid/9816
Summary:
It has been reported that GNU Automake may be prone to a symbolic link
vulnerability that may allow an attacker to modify data or gain elevated
privileges on a vulnerable system. This issue results due to insecure
creation of directories during compilation. The attacker may potentially
create symbolic links in the place of files contained in the affected
directories, which may potentially lead to elevated privileges due to
modification of data.
GNU Automake versions prior to 1.8.3 are reported to be affected by this
vulnerability.
10. PWebServer Remote Directory Traversal Vulnerability
BugTraq ID: 9817
Remote: Yes
Date Published: Mar 08 2004
Relevant URL: http://www.securityfocus.com/bid/9817
Summary:
It has been reported that PWebServer is prone to a remote directory
traversal vulnerability. This issue is due to a failure of the server
process to properly filter user supplied URI requests.
Information acquired by exploiting this issue may be used to aid further
attacks against a vulnerable system.
11. Network Time Protocol Daemon Integer Overflow Vulnerability
BugTraq ID: 9818
Remote: No
Date Published: Mar 08 2004
Relevant URL: http://www.securityfocus.com/bid/9818
Summary:
The Network Time Protocol daemon (NTPd) may be prone to an integer
overflow vulnerability that may cause integrity loss in a machine.
It has been reported that if a client issues a request to a NTP server
containing a date that is more than 34 years of the server's date, the
server may calculate an erroneous offset reply. This issue could lead to
a loss of integrity in a machine issuing a request to the NTP server as an
erroneous time value would not correspond to logs and file creation and
modification times, possibly disrupting the audit trail for
security-related system and network events.
NTPd versions 3 and prior are reported to be affected by this issue.
12. VirtuaSystems VirtuaNews Admin.PHP Cross-Site Scripting Vuln...
BugTraq ID: 9819
Remote: Yes
Date Published: Mar 08 2004
Relevant URL: http://www.securityfocus.com/bid/9819
Summary:
It has been reported that the VirtuaNews 'admin.php' script is prone to a
cross-site scripting vulnerability. These problems surround the
application's failure to properly validate user supplied URI input. When
exploited an attacker can execute arbitrary script and HTML code within
the context of the vulnerable application.
The supplied code is rendered in the browser in the context of the
affected application. This may allow an attacker to craft a malicious
link, facilitating a cross-site scripting attack.
Attackers may exploit this vulnerability to steal authentication
credentials. Other attacks may also be possible.
13. IBM DB2 Remote Command Server Privilege Escalation Vulnerabi...
BugTraq ID: 9821
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9821
Summary:
IBM DB2 Remote Command Server is prone to a vulnerability that may permit
authenticated users to gain administrative access to the underlying
database. This is because when the server accepts commands from
legitimate users, it spawns another process with elevated privileges to
execute the commands. In this manner, a user may execute arbitrary
commands with the privileges of the db2admin account.
This issue is only known to exist on Windows platforms, though there have
been conflicting details reported that seem to indicate that this issue
may also affected DB2 releases for other platforms.
14. Invision Power Board Pop Parameter Cross-Site Scripting Vuln...
BugTraq ID: 9822
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9822
Summary:
It has been reported that Invision Power Board may be prone to a
cross-site scripting vulnerability. This may allow a remote attacker to
cause hostile HTML or script code to be rendered in a user's browser via a
malicious link to a vulnerable site.. The issue presents itself due to
insufficient sanitization of user-supplied data via the 'pop' URI
parameter, which will be included in dynamically generated web pages.
Invision Power Board 1.3 Final has been reported to be affected by this
issue, however, it is possible that other versions are vulnerable as well.
15. LionMax Software Chat Anywhere User IP Address Obfuscation V...
BugTraq ID: 9823
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9823
Summary:
It has been reported that Chat Anywhere may be prone to a user IP address
obfuscation vulnerability that may allow an attacker to hide their IP
address from the administrator. The issue presents itself if an attacker
uses '%00' characters at the beginning of their nickname. Due to this, it
may not be possible to ban or remove abusive users from a chat room.
Chat Anywhere 2.72 and prior are reported to be affected by this issue.
16. F-Secure SSH Server Password Authentication Policy Evasion V...
BugTraq ID: 9824
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9824
Summary:
The F-Secure SSH server is vulnerable to a password authentication policy
evasion vulnerability. This issue is due to a design error that
potentially allows a user to use password authentication when the SSH
server is configured to deny it.
This issue may give rise to weak password issues, as administrators that
believe that password authentication is disallowed may not be enforcing
strong password policies.
17. Microsoft Windows Media Services Remote Denial of Service Vu...
BugTraq ID: 9825
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9825
Summary:
It has been reported that Microsoft Windows Media Services is prone to a
remote denial of service vulnerability. This may allow an attacker to
cause the services to effectively deny access to legitimate users by
sending specially crafted TCP/IP packets on TCP ports 7007 and/or 7778.
Microsoft Windows Media Services 4.1 included with Microsoft Windows 2000
Server Service Pack 2, Service Pack 3, and Service Pack 4 is reported to
be vulnerable to this issue. Windows Media Services 4.1 for Windows NT
4.0 is not vulnerable.
18. Apache Mod_SSL HTTP Request Remote Denial Of Service Vulnera...
BugTraq ID: 9826
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9826
Summary:
mod_ssl has been reported to be prone to a remote denial of service
vulnerability. It has been reported that the issue is as a result of a
memory leak and will present itself when standard HTTP requests are
handled on the SSL port of an affected Apache server.
19. Microsoft Outlook Mailto Parameter Quoting Zone Bypass Vulne...
BugTraq ID: 9827
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9827
Summary:
Microsoft Outlook is prone to a vulnerability that may permit execution of
arbitrary code on client systems. This issue is exposed through Outlook,
but will reportedly cause Internet Explorer to load malicious content in
the Local Zone.
This is related to how mailto URIs are handled by the software and may be
exploited from a malicious web page or through HTML e-mail. This issue
will permit a remote attacker to influence how Outlook invoked via mailto
URIs, allowing for execution of malicious scripting in the Local Zone
through an attacker-specified Outlook profile parameter.
** It was initially reported that exploitation of this issue will depend
on the Outlook Today page being the default folder homepage. Additional
details have been made available to indicate that in situations where this
is not the default page, it is possible to use two mailto URIs to exploit
the issue. The first URI would display the Outlook Today view and the
second would include an embedded JavaScript URI.
20. Microsoft MSN Messenger Information Disclosure Vulnerability
BugTraq ID: 9828
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9828
Summary:
Microsoft MSN Messenger is prone to an information disclosure
vulnerability. When a malformed file transfer request is initiated by a
remote user, they may be able to view the contents of files on the remote
system.
21. Apache Mod_Access Access Control Rule Bypass Vulnerability
BugTraq ID: 9829
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9829
Summary:
Apache mod_access has been reported to be prone to an access rule bypass
vulnerability. When an Allow or Deny rule is specified and an IP address
is used in the rule without a netmask, the affected module may fail to
match the rule. As a result of this vulnerability, access controls may not
be enforced correctly.
22. Confixx DB Parameter SQL Injection Vulnerability
BugTraq ID: 9830
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9830
Summary:
It has been reported that an input validation error with the potential for
use in a SQL injection attack is present in the "db_mysql_loeschen2.php"
script. When a user is requesting the "db_mysql_loeschen2.php" script, one
of the parameters that can be passed to the script is "db". There are no
checks on the value of this variable before it is used in an SQL query
string.
Consequently, malicious users may corrupt the resulting SQL queries by
specially crafting a value for the "db" variable.
23. Confixx Perl Debugger Remote Command Execution Vulnerability
BugTraq ID: 9831
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9831
Summary:
The Confixx PERL debugging utility functionality has been reported to be
prone to a remote command execution vulnerability. The issue is reported
to occur when a command sequence is appended to a HTTP request for a PERL
script resource, the command sequence must contain a prefixed ';'
semi-colon character. When this request is processed, the command sequence
will be reportedly executed with the privileges of the process that
invokes the Confixx PERL debugging utility.
24. WU-FTPD restricted-gid Unauthorized Access Vulnerability
BugTraq ID: 9832
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9832
Summary:
It has been reported that WU-FTPD FTP server is prone to an unauthorized
access vulnerability. The issue is related to the "restricted-gid"
feature supported by WU-FTPD. This feature allows for an administrator to
restrict FTP user access to certain directories. The vulnerability
reportedly allows users to bypass those restrictions through modifying the
permissions on their home directory so that they themselves can no longer
access it. Under such circumstances, the server may grant the user
unauthorized access to the root directory.
Further technical details are not known at this time. This record will be
updated as more information becomes available.
This BID is created in response to Two Possibly New WU-FTPD
Vulnerabilities BID 9820. BID 9820 is being retired.
25. IBM WebSphere Unspecified Security Vulnerability
BugTraq ID: 9833
Remote: Unknown
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9833
Summary:
IBM WebSphere for z/OS platforms has been reported prone to an unspecified
security vulnerability. It has been conjectured that this issue may be
exploited to compromise an affected system to some degree, however there
are insufficient details to determine cause or consequences at this
present time.
This BID will be updated as further details regarding this vulnerability
are released.
26. IBM DFSMS/MVS Tape Utility Unspecified Vulnerability
BugTraq ID: 9834
Remote: Unknown
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9834
Summary:
An unspecified vulnerability has been reported to exist in the DFSMS/MVS
Tape utility.
This BID will be updated as more technical information is made available.
27. IBM AIX Rexecd Privilege Escalation Vulnerability
BugTraq ID: 9835
Remote: Yes
Date Published: Mar 09 2004
Relevant URL: http://www.securityfocus.com/bid/9835
Summary:
IBM AIX implementation of rexecd has been reported prone to a remote
vulnerability that may provide for privilege escalation.
The issue may result in a negotiated connection receiving the privileges
of an alternate user.
28. Python getaddrinfo Function Remote Buffer Overflow Vulnerabi...
BugTraq ID: 9836
Remote: Yes
Date Published: Mar 10 2004
Relevant URL: http://www.securityfocus.com/bid/9836
Summary:
It has been reported that Python may be prone to a remote buffer overflow
vulnerability that may allow an attacker to execute arbitrary code on a
vulnerable system in order to gain unauthorized access. The issue exists
due to insufficient boundary checks performed by the 'getaddrinfo'
function and occurs when an IPv6 address of excessive length is sent to a
vulnerable host via DNS.
It has been reported that this issue affects Python versions 2.2 and
2.2.1.
Due to a lack of information, further details cannot be outlined at the
moment. This BID will be updated as more information becomes available.
29. Sun Solaris Multiple Unspecified Local UUCP Buffer Overrun V...
BugTraq ID: 9837
Remote: No
Date Published: Mar 04 2004
Relevant URL: http://www.securityfocus.com/bid/9837
Summary:
Sun has reported that Solaris is prone to multiple unspecified local
buffer overruns in the uucp utility. This could permit an unprivileged
local user to execute arbitrary code with the privileges of the uucp user.
If the uucp user is compromised, it would also be possible to gain root
privileges.
These issues may be related to the vulnerability reported in BID 6600.
30. Sysstat Insecure Temporary File Creation Vulnerability
BugTraq ID: 9838
Remote: No
Date Published: Mar 10 2004
Relevant URL: http://www.securityfocus.com/bid/9838
Summary:
The Sysstat system monitoring utility is prone to an issue that may allow
malicious local users to corrupt system files, most likely resulting in
loss of data or a denial of service.
The source of this vulnerability is that the utility creates temporary
files in an insecure manner, facilitating creation of malicious symbolic
links in the /tmp directory.
31. Invicta WMCam Server Remote Denial Of Service Vulnerability
BugTraq ID: 9839
Remote: Yes
Date Published: Mar 10 2004
Relevant URL: http://www.securityfocus.com/bid/9839
Summary:
It has been reported that wMCam is prone to a remote denial of service
vulnerability. This issue is due to a failure of the application to
handle malformed requests.
Successful exploitation of this issue will cause a denial of service
condition in the affected software.
32. Epic Games Unreal Tournament Server Engine Remote Format Str...
BugTraq ID: 9840
Remote: Yes
Date Published: Mar 10 2004
Relevant URL: http://www.securityfocus.com/bid/9840
Summary:
A format string vulnerability has been reported to exists in the Unreal
Tournament server engine. This issue is due to a failure of the server
application to properly sanitize user supplied network data.
Ultimately this vulnerability could allow for execution of arbitrary code
on the system implementing the affected server software, which would occur
in the security context of the server process.
33. Multiple Vendor Internet Browser Cookie Path Argument Restri...
BugTraq ID: 9841
Remote: Yes
Date Published: Mar 10 2004
Relevant URL: http://www.securityfocus.com/bid/9841
Summary:
Multiple vendor Internet Browsers have been reported to be prone to a
cookie path argument restriction bypass vulnerability. The issue presents
itself due to a failure to properly sanitize encoded URI content, this may
make it possible for an attacker to craft a URI that will contain encoded
directory traversal sequences sufficient to provide access to a supposedly
path exclusive cookie from an alternate path.
34. GdkPixbuf Unspecified Bitmap Handling Denial Of Service Vuln...
BugTraq ID: 9842
Remote: Yes
Date Published: Mar 10 2004
Relevant URL: http://www.securityfocus.com/bid/9842
Summary:
The GdkPixbuf library has been reported prone to an unspecified denial of
service vulnerability. This issue is reported to cause the Evolution email
client to crash when a malicious Bitmap file is handled. Other
applications that rely on the library may be similarly affected.
35. F-Secure Anti-Virus For Linux Unspecified Scanner Bypass Vul...
BugTraq ID: 9843
Remote: Yes
Date Published: Mar 10 2004
Relevant URL: http://www.securityfocus.com/bid/9843
Summary:
F-Secure has reported an unspecified vulnerability in their Anti-Virus For
Linux product that may enable malicious code to bypass scanning. This
issue is reportedly related to detections of W32.Sober.D@mm.
36. Sysstat Isag Temporary File Creation Vulnerability
BugTraq ID: 9844
Remote: No
Date Published: Mar 10 2004
Relevant URL: http://www.securityfocus.com/bid/9844
Summary:
The Sysstat Isag command is prone to an issue that may allow malicious
local users to corrupt system files, most likely resulting in loss of data
or a denial of service.
The source of this vulnerability is that the utility creates temporary
files in an insecure manner, facilitating creation of malicious symbolic
links in the /tmp directory.
37. Courier Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 9845
Remote: Yes
Date Published: Mar 11 2004
Relevant URL: http://www.securityfocus.com/bid/9845
Summary:
Multiple buffer overflow vulnerabilities have been identified in Courier
MTA, Courier SqWebMail, and Courier-IMAP. These vulnerabilities may allow
a remote attacker to execute arbitrary code on a vulnerable system in
order to gain unauthorized access.
The issues exist in the 'SHIFT_JIS' converter in 'shiftjis.c' and
'ISO2022JP' converter in 'so2022jp.c'. An attacker may be able to exploit
these issues by supplying Unicode characters that exceed BMP (Basic
Multilingual Plane) range.
These issues have been reported to affect Courier MTA 0.44.2 and prior,
Courier-IMAP 2.2.1 and prior, and Courier SqWebMail 3.6.2 and prior. It
has also been reported that the vulnerable codeset mappings may be
employed by the Courier IMAP and Webmail service, however, they are not
enabled by default.
These issues are being further analyzed and this BID will be updated once
analysis is complete.
38. GNU MyProxy Cross-Site Scripting Vulnerability
BugTraq ID: 9846
Remote: Yes
Date Published: Mar 11 2004
Relevant URL: http://www.securityfocus.com/bid/9846
Summary:
It has been reported that GNU MyProxy may be prone to a cross-site
scripting vulnerability that may allow a remote attacker to execute HTML
or script code in a user's browser. The issue presents itself due to
insufficient sanitization of user-supplied data.
Due to the possibility of attacker-specified HTML and script code being
rendered in a victim's browser, it is possible to steal cookie-based
authentication credentials from that user. Other attacks are possible as
well.
GNU MyProxy version 20030629 has been reported to be affected by this
issue, however, it is possible that other versions are vulnerable as well.
39. Pegasi Web Server Multiple Input Validation Vulnerabilities
BugTraq ID: 9847
Remote: Yes
Date Published: Mar 11 2004
Relevant URL: http://www.securityfocus.com/bid/9847
Summary:
Multiple vulnerabilities have been identified in the application that may
allow a remote attacker to carry out directory traversal and cross-site
scripting attacks. A successful cross-site scripting attack may make it
possible for an attacker to create a malicious link to a vulnerable site
that includes hostile HTML and script code. This code may be rendered in
the browser of a victim user who visits the malicious link and this will
occur in the security context of the site hosting the software. The
directory traversal vulnerability may allow a malicious user to request
files outside of the web-server root directory with directory traversal
strings such as '../'.
Pegasi Web Server version 0.2.2 has been reported to be prone to these
issues, however, it is possible that other versions are affected as well.
40. cPanel Resetpass Remote Command Execution Vulnerability
BugTraq ID: 9848
Remote: Yes
Date Published: Mar 11 2004
Relevant URL: http://www.securityfocus.com/bid/9848
Summary:
A potential remote command execution vulnerability has been discovered in
the cPanel Application. This issue occurs due to insufficient sanitization
of externally supplied data to the script that handles resetting user
passwords.
An attacker may exploit this problem by crafting a malicious URI request
for the affected script; the attacker may then supply shell metacharacters
and arbitrary commands as a value for the affected variable.
41. Targem Games Battle Mages Remote Denial Of Service Vulnerabi...
BugTraq ID: 9849
Remote: Yes
Date Published: Mar 11 2004
Relevant URL: http://www.securityfocus.com/bid/9849
Summary:
The Battle Mages game server has been reported to be prone to a remote
denial of service vulnerability. The issue is reported to present itself
when the server receives incomplete client data. Specifically the affected
server will attempt to read the expected data size infinitely until it is
received, this may allow a remote attacker to tie up server resources and
effectively deny service to legitimate users.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Hosting company reveals hacks, citing disclosure law
By: Kevin Poulsen
Thousands of customers of a Texas-sized Web hosting company enjoy full
disclosure of a recent security breach, thanks in part to a California
law.
http://www.securityfocus.com/news/8240
2. Feds: E-mail subpoena ruling hurts law enforcement
By: Kevin Poulsen
An appeals court refuses to reconsider a ruling that an overbroad subpoena
for stored e-mail can qualify as a computer intrusion, despite a plea from
the Justice Department to rethink the decision.
http://www.securityfocus.com/news/8199
3. Pranksters bedevil TV weather announcment system
By: Kevin Poulsen
Hacked newscast warns viewers: "All your base are belong to us."
http://www.securityfocus.com/news/8191
4. Regulator says he's not optimistic about success for do-not-...
By: Jennifer C. Kerr, The Associated Press
http://www.securityfocus.com/news/8235
5. Israeli teen quizzed over US cop file hack
By: John Leyden, The Register
http://www.securityfocus.com/news/8231
6. More NetSky worms. So much for quitting
By: John Leyden, The Register
http://www.securityfocus.com/news/8230
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. filewatcher v2.3.9
By: Mark Nagel
Relevant URL: http://filewatcher.sourceforge.net/
Platforms: POSIX
Summary:
filewatcher is a Perl program that uses RCS to maintain a local file
archive repository. A configuration file details which files and
directories to monitor and to whom reports should be delivered.
2. CryptoHeaven v2.3.2
By: Marcin Kurzawa <[email protected]>
Relevant URL: http://www.cryptoheaven.com/
Platforms: UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:
CryptoHeaven offers secure email and online file sharing/storage. Its main
features are secure and highly encrypted services such as group
collaboration, file sharing, email, online storage, and instant messaging.
It integrates multi-user based security into email, instant messaging, and
file storage and sharing in one unique package. It provides real time
communication for text and data transfers in a multi-user secure
environment. The security and usability of CryptoHeaven is well-balanced;
even the no-so-technically oriented computer users can enjoy this crypto
product with very high level of encryption.
3. NetMRG v0.14
By: Brady Alleman
Relevant URL: http://www.netmrg.net/
Platforms: Linux
Summary:
NetMRG is a network monitoring, reporting, and graphing system. Using
MySQL, PHP, C++, pthreads, and RRDTOOL, it is capable of monitoring
thousands of variables on five-minute intervals. Graph templating allows
network admins to begin monitoring devices with minimal overhead. NetMRG
is also capable of responding to programmable events, such as variables
exceeding accepted tolerances. It can accommodate server hosting and
Internet service provider environments with different users allowed to
view only their own equipment's graphs.
4. Syslog Management Tool v1.0
By: Jeremy Guthrie
Relevant URL: http://smt.dangermen.com
Platforms: FreeBSD, Linux, NetBSD, OpenBSD
Summary:
The Syslog Management Tool (SMT) is a Web-based system that collects
syslog messages using a modified version of Modular Syslog. It processes
them for errors and generate alerts, launches programs, or sends emails
based on user-defined actions. Since it uses a Web console, rules, hosts,
and much more can be centrally managed. It is designed to be disaster
resilient by distributing components throughout a global enterprise to
survive Web console loss, database loss, or syslog server loss.
5. Nmap Parser v0.76
By: Anthony G Persaud
Relevant URL: http://npx.sourceforge.net
Platforms: Os Independent
Summary:
Nmap Parser is a Perl module that simplifies the process of developing
scripts and collecting information the XML nmap scan data, which can be
obtained by using nmap's -oX switch or from the file handle of a pipe to
an nmap process. It uses the XML twig library for parsing, and supports
filters. A module such as Nmap::Scanner is required to actually perform a
scan.
6. passwd_exp v1.0.0
By: Sam
Relevant URL: http://frida.fri.utc.sk/~sam/devel/passwd_exp
Platforms:
Summary:
Passwd_exp notifies users via email of password or account expiration.
Administrators can review expired accounts in the system. Its modular
architecture allows you to perform expiration checks on any data source
you use (databases, LDAP, NIS, etc.).
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. SAP Security and Authorizations consultant- Seattle (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357375
2. Software Development Engineer - Columbia, MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357368
3. Information Analyst (Network Security) Clearance Req... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357298
4. Systems Engineer MA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357296
5. CISSP-type Security Job Rate Survey (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357293
6. Network perimeter control position in central New Je... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357278
7. Security Software Sales - VA/DC metro (commercial) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357274
8. Security Analyst Needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357273
9. CISSP Seeking a Position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357269
10. Info Security Technical Manager- Dallas, TX (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357266
11. Cisco Security Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357263
12. Beginning in the field (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357262
13. Senior Manager IT Audit (job opening) - Columbus, OH (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357259
14. IT Audit Management, position open - Columbus, OH (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357118
15. CISSP, GSEC, CISA, BIG 5 Consulting Seeks Job in Den... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357113
16. Security Trainer - Contract (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357111
17. Senior Information Systems Security Analyst (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357109
18. Professional Services / Implementation Engineer Need... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357107
19. High quality of life with low cost of living- Iowa (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357106
20. Immediate need in Chicago for 2 top tier Sales profe... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357104
21. IT Security Specialist available in California (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357100
22. Technical Marketing Manager Needed for Internet Secu... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357094
23. Network Security Engineer MA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357092
24. Information Systems Security Evaluator (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357091
25. Trade Union Advice (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356995
26. Senior Penetration Tester (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356950
27. Security Marketing Manager #861JS - Boston, MA - $12... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356949
28. Perimeter Security staff level needs in San Francisc... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356943
29. Host Sensor Software Engineer, Columbia MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356938
30. InfoSec Evangelist Available (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356933
31. one opening: AOL Incident Response in Northern VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356930
32. Security Research Engineer Columbia MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356927
33. New Articles @ SecurityFocus (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356829
34. IT Audit opportunity - Milwaukee Wisconsin (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356828
35. Product Marketing Engineer Need - Network Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356819
36. Identity Management Business Analyst position in NYC... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356817
37. Technical Training Manager Need - Network Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356815
38. I'm looking for work in the Washington DC Metro Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356766
39. Senior Corporate Security Analyst - San Jose, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356765
40. UT-AUSTIN: IT POLICY COORDINATOR (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356764
41. Security Sales Position- UK, London area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356683
42. Position Available -- Security Software - Marketing ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356682
43. Penetration testers required (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356681
44. CISSP Seeking a Position in Orlando, FL (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/356680
VI. INCIDENTS LIST SUMMARY
--------------------------
1. Port 2979 Activity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357435
2. DHCP or Probe? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357297
3. Is it possible to derease gradually the number of Cl... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357035
4. Is it possible to derease gradually the number of Cl... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357033
5. Is it possible to derease gradually the number of Cl... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357032
6. Is it possible to derease gradually the number of Cl... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/356767
7. Port 2492 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/356669
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Linux exploits and random post-argv/ envp injection (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/357414
2. [oracle] - passwords in clear text and password prot... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/357413
3. problem with RET & debian debuggin' (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/357377
4. Vulnerability in X server (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/357175
5. A little help?? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/357168
6. NAV bugs! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/356860
7. Looking For Vulnerability Researchers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/356686
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Microsoft XP/SP2 security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/356883
2. SecurityFocus Microsoft Newsletter #179 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/356731
3. Article Announcement: IIS 6.0 Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/356588
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. PAM & Auth (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/357230
2. sunscreen and stealth interfaces (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/357225
3. Problems chrooting BIND 9.2.2 in a Solaris 8 box (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/357222
X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2004-03-08 to 2004-03-15.
XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
[email protected] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer.
Alternatively you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.
If your email address has changed email [email protected] and
ask to be manually removed.
XII. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Check Point
Introducing the world's first and only complete Internal Security Gateway:
Check Point InterSpect.
Built specifically to protect internal networks, Check Point InterSpect
provides intelligent worm defense, network zone segmentation, quarantine
capabilities, and LAN protocol protection - all in one easy to deploy
appliance that protects your network from threats within.
Learn more about Check Point InterSpect at:
http://www.securityfocus.com/sponsor/CheckPoint_sf-news_040315
------------------------------------------------------------------------