SecurityFocus Newsletter #254

Peter Laborge <[email protected]> 22 Jun 2004 17:10:21 -0000

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #254
------------------------------

This Issue is Sponsored By: SecurityFocus

Want to keep up on the latest security vulnerabilities? Don't have time
to visit a myriad of mailing lists and websites to read the news? Just
add the new SecurityFocus RSS feeds to your freeware RSS reader, and see
all the latest posts for Bugtraq and the SF Vulnernability database in
one convenient place. Or, pull in the latest news, columnists and feature
articles in the SecurityFocus aggregated news feed, and stay on top of
what's happening in the community!

http://www.securityfocus.com/rss/index.shtml

------------------------------------------------------------------------
I. FRONT AND CENTER
1. Securing Apache 2: Step-by-Step
2. Time to Dump Internet Explorer
II. BUGTRAQ SUMMARY
1. Virtual Programming VP-ASP Shopping Cart Shop$DB.ASP Cross-S...
2. Horde Chora Viewer Remote Command Execution Vulnerability
3. Mozilla Browser URI Obfuscation Weakness
4. Linksys Web Camera Software Next_file Parameter Cross-Site S...
5. Virtual Programming VP-ASP Shoperror Script Cross-Site Scrip...
6. Immunix StackGuard Canary Corruption Handler Evasion Vulnera...
7. Virtual Programming VP-ASP Shopproductselect Script SQL Inje...
8. Multiple Vendor Anti-Virus Scanner Remote Denial Of Service ...
9. Linux Kernel Assembler Inline Function Local Denial Of Servi...
10. Invision Power Board SSI.PHP Cross-Site Scripting Vulnerabil...
11. Sygate Personal Firewall Pro Local Fail-Close Bypass Vulnera...
12. FreeIPS Protected Service Denial Of Service Vulnerability
13. Sygate Personal Firewall Pro Local Denial Of Service Vulnera...
14. VICE Monitor Memory Dump Format String Vulnerability
15. BEA WebLogic Server And WebLogic Express Remote Denial of Se...
16. BEA WebLogic Server And WebLogic Express Java RMI Incorrect ...
17. KAME Racoon IDE Daemon X.509 Improper Certificate Verificati...
18. SGI IRIX Undisclosed MapElf32Exec Local Denial Of Service Vu...
19. SGI IRIX SYSSGI() System Call Unprivileged User Kernel Memor...
20. SGI IRIX Undisclosed Init Denial Of Service Vulnerability
21. Thy HTTP Daemon Null Pointer Exception Denial Of Service Vul...
22. HP-UX Local X Font Server Buffer Overflow Vulnerability
23. Microsoft Internet Explorer HREF Save As Denial of Service V...
24. Pivot Remote module_db.PHP File Include Vulnerability
25. Microsoft Internet Explorer Wildcard DNS Cross-Site Scriptin...
26. Web Wiz Forums Registration_Rules.ASP Cross-Site Scripting V...
27. PHPHeaven PHPMyChat Multiple Remote Vulnerabilities
28. Symantec Enterprise Firewall DNSD DNS Cache Poisoning Vulner...
29. Check Point Firewall-1 Internet Key Exchange Information Dis...
30. Invision Power Board Potential IP Address Spoofing Vulnerabi...
31. Cisco IOS Border Gateway Protocol Denial Of Service Vulnerab...
32. IBM ACPRunner ActiveX Control Dangerous Method Vulnerability
33. IBM EGatherer ActiveX Control Dangerous Method Vulnerability
34. Linux Kernel Inter Intergrated Circuit Bus Driver Integer Ov...
35. Snitz Forums Register Script HTML Injection Vulnerability
36. ASP-Rider Malformed Cookie Administrative Access Vulnerabili...
37. Linux Kernel Multiple Device Driver Vulnerabilities
38. Nmap Potential Insecure File Creation Vulnerability
39. MoinMoin Group Name Privilege Escalation Vulnerability
40. Asterisk PBX Multiple Logging Format String Vulnerabilities
41. Epic Games Unreal Engine Memory Corruption Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. U.S. moves towards anti-spyware law
2. Court clips DirecTV piracy suits
3. Backdoor program gets backdoored
4. Feds, Private Groups to Educate Consumers About Phishing Sca...
5. 'Spam King' Richter get legal roasting
6. Thieves lift PCs from security show
IV. SECURITYFOCUS TOP 6 TOOLS
1. Wasabi 0.2
2. Athena 1.0
3. SnortNotify 1.02
4. CryptoHeaven v2.4.0
5. Auditor security collection
6. XArp 0.1
V. SECURITYJOBS LIST SUMMARY
1. IP Network Security Architect (Thread)
2. IDS position (Thread)
3. Sales Engineer - NY or Boston (Thread)
4. ezmlm warning (Thread)
5. Security Admin/Engineer Available Philadelphia, Wilm... (Thread)
6. Security Engineer/Researcher - Southern California -... (Thread)
7. Technical Account Manager - Bay Area (Thread)
8. Security Engineer - Saint Louis (Thread)
9. Looking for next opportunity (Thread)
10. Security Technical Architect - UK - Short Term Contr... (Thread)
11. GA - North Atlanta - QA Manager Position - Ref: CF23... (Thread)
12. VP of Software - Biometric Security (Thread)
13. Security Services Product Manager (Thread)
14. Network Security Engineer Available - NYC and New En... (Thread)
15. Security Engineer - Systems Omaha NE (Thread)
16. Security Product Manager, Enterprise Products / Mark... (Thread)
17. Sales / Systems Engineer - Eastern USA (Thread)
18. Security Engineer - Top Secret Omaha NE (Thread)
19. Jr Information Security Analyst - Jersey City, NJ (Thread)
20. seeking CISSP challenge in Switzerland !! (Thread)
21. Sales Representative Opportunity at Core Security Te... (Thread)
22. C&A Security Analysts Needed in MD, DC, PA (Thread)
23. security auditor (Thread)
24. VP of Western Regional Sales Opening - Security Solu... (Thread)
25. Security Engineer - Belmont, CA (Thread)
26. RACF Mainframe Security - Bloomington, IL (Thread)
27. VISA CISP Security Compliance Consultant (SF Bay Are... (Thread)
28. Sales Rep - Denver, Colorado (Thread)
29. Want to join the best? LONDON UK ROLE - Have any of... (Thread)
30. Enterprise Security Software Sales-Chicago & NY (Thread)
31. Seeking an Entry-level position in Network/Informati... (Thread)
32. Sr. Security Product Manager San Diego, CA (Thread)
33. MI - Information Security Opportunity (Thread)
34. Senior QA Position Calgary, Canada (Thread)
35. Senior Dev. Position Calgary, Canada (Thread)
36. Regional Sales Manager--Southeast (Thread)
37. NY Sales Executive (Thread)
38. Technical Support Engineer--Tier III (San Francisco) (Thread)
39. Security Engineer--San Diego (Thread)
VI. INCIDENTS LIST SUMMARY
1. IE/WMP Exploit (Thread)
2. [ok] Simple Windows incident response methodology (Thread)
3. Simple Windows incident response methodology (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Antivirus/Trojan/Spyware scanners DoS [summary] (Thread)
2. TOORCON 2004: Call For Papers (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. SecurityFocus Microsoft Newsletter #193 (Thread)
IX. SUN FOCUS LIST SUMMARY
1. secure NFS problem (Thread)
2. DNS problem on Solaris X86 (Thread)
X. LINUX FOCUS LIST SUMMARY
1. OpenVPN? (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Securing Apache 2: Step-by-Step
By Artur Maj

Continuing the very popular "Securing" series from last year, this
article discusses step-by-step how to compile, install, chroot and
configure a secure Apache 2 web server.

http://www.securityfocus.com/infocus/1786

2. Time to Dump Internet Explorer
By Scott Granneman

It's time to tell our users, our clients, our associates, our families,
and our friends to abandon Internet Explorer.

http://www.securityfocus.com/columnists/249

II. BUGTRAQ SUMMARY
-------------------
1. Virtual Programming VP-ASP Shopping Cart Shop$DB.ASP Cross-S...
BugTraq ID: 10530
Remote: Yes
Date Published: Jun 12 2004
Relevant URL: http://www.securityfocus.com/bid/10530
Summary:
VP-ASP is prone to a cross-site scripting vulnerability. This issue exists due to insufficient sanitization of user-supplied data. The problem presents itself in a parameter of the 'shop$db.asp' script.

An attacker may be able to steal the site administrator's credentials by exploiting this issue.

2. Horde Chora Viewer Remote Command Execution Vulnerability
BugTraq ID: 10531
Remote: Yes
Date Published: Jun 13 2004
Relevant URL: http://www.securityfocus.com/bid/10531
Summary:
Horde Chora Viewer is reported to be prone to a remote command execution vulnerability. The vulnerability is reported to exist due to a lack of sanitization performed on values that may be user-supplied.

Shell metacharacters that are included as a value for the affected URI parameter may result in attacker specified shell commands being executed in an exec() call. Command execution will occur in the context of the affected web server.

Chora versions up to an including version 1.2.1 are reported to be affected by this vulnerability.

3. Mozilla Browser URI Obfuscation Weakness
BugTraq ID: 10532
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10532
Summary:
A weakness is reported in Mozilla that may allow an attacker to obfuscate the URI of a link. This could facilitate the impersonation of legitimate web sites in order to steal sensitive information from unsuspecting users.

It is reported that the weakness exists when form method GET action URI's that are appended with the %2F encoded character, several space characters and an appended '.' URI are followed.

Mozilla 1.6 and 1.7rc3 for Windows and Firefox 0.8 and 0.9rc for Windows are reportedly affected by this issue.

4. Linksys Web Camera Software Next_file Parameter Cross-Site S...
BugTraq ID: 10533
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10533
Summary:
It is reported that Linksys Web Camera software is prone to a cross-site scripting vulnerability that may allow a remote attacker to steal cookie-based authentication credentials or carry out other attacks.

The problem presents itself when an attacker passes malicious HTML or script code to the application via the 'next_file' parameter of the 'main.cgi' script.

Linksys Web Camera software version 2.10 is reportedly prone to this issue, however, it is possible that other versions are affected as well.

5. Virtual Programming VP-ASP Shoperror Script Cross-Site Scrip...
BugTraq ID: 10534
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10534
Summary:
A vulnerability exists in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in the 'shoperror.asp' script.

An attacker can exploit this issue to steal cookie authentication credentials, or perform other types of attacks.

VP-ASP versions 5.0 and prior may be prone to this issue. It is possible that a vendor-supplied fix addresses this issue, however, this has not been confirmed at the moment.

6. Immunix StackGuard Canary Corruption Handler Evasion Vulnera...
BugTraq ID: 10535
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10535
Summary:
Immunix StackGuard is affected by a canary corruption handler evasion vulnerability. this issue is due to a design error that allows an attacker to influence the execution flow of the canary corruption handling function.

This issue may allow an attacker to bypass the security features of StackGuard and allow an attacker to manipulate the execution flow of the canary corruption handling function. It has been speculated that this issue will allow for code execution, although this has not been verified.

This issue reportedly affects Immunix OS version 7.0, however it is likely that other versions are affected as well.

7. Virtual Programming VP-ASP Shopproductselect Script SQL Inje...
BugTraq ID: 10536
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10536
Summary:
It is reported that the VP-ASP Shopping Cart is prone to a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user input before using it in an SQL query. The problem presents itself when a malevolent user supplies SQL syntax to the application via the 'shopproductselect.asp' script.

VP-ASP versions 5.0 and prior may be prone to this issue. It is possible that a vendor-supplied fix addresses this issue, however, this has not been confirmed at the moment.

8. Multiple Vendor Anti-Virus Scanner Remote Denial Of Service ...
BugTraq ID: 10537
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10537
Summary:
Multiple vendor anti-virus scanning software is reported prone to a remote denial of service vulnerability.

The issue is reported to present itself when certain malicious archives containing large quantities of data are scanned.

In the supplied example approximately 300 Gigabytes of data is archived in many different archive types. This archive may be transmitted to a client or submitted to an online anti-virus scanning service in order to crash the anti-virus software.

9. Linux Kernel Assembler Inline Function Local Denial Of Servi...
BugTraq ID: 10538
Remote: No
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10538
Summary:
The Linux Kernel is reportedly to be affected by a local denial of service vulnerability surrounding inline assembly functions. This issue is due to a design error that causes the application to fail to properly handle stack frame management.

This issue may be leveraged by an attacker to cause the affected system to crash, denying service to legitimate users.

Although only select linux kernels are reported to be affected, it is likely that various other versions are vulnerable as well.

10. Invision Power Board SSI.PHP Cross-Site Scripting Vulnerabil...
BugTraq ID: 10539
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10539
Summary:
Invision Power Board 'ssi.php' script reported prone to a cross-site scripting vulnerability. The issue presents itself due to a lack of sufficient sanitization performed by functions in the 'ssi.php' script on user-influenced 'f' parameter. This can permit the theft of cookie-based authentication credentials; other attacks may also be possible.

11. Sygate Personal Firewall Pro Local Fail-Close Bypass Vulnera...
BugTraq ID: 10540
Remote: No
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10540
Summary:
A vulnerability is reported to affect the Sygate Personal Firewall fail-closed functionality. It is reported that the kernel-space NDIS driver does not verify the origin of messages that are received through the associated device. As a result of this it is possible for a local user to transmit a message to the kernel-space NDIS driver device in order to disable the firewall fail-closed functionality.

A local attacker may exploit this condition to disable the affected firewall completely.

12. FreeIPS Protected Service Denial Of Service Vulnerability
BugTraq ID: 10541
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10541
Summary:
It is reported that FreeIPS is susceptible to a denial of service vulnerability.

FreeIPS scans TCP connections for particular strings, defined by regular expressions. If a packet matches the regular expression, FreeIPS assumes malicious intent and attempts to close the TCP connection. It accomplishes this by sending TCP RST packets to both the client (attacker) and the server (victim TCP server).

The software correctly generates a TCP RST+ACK packet to the originating client, but the packet sent to the server is incorrectly generated. The packet sent to the server contains invalid sequence and acknowledgment numbers and is ignored.

An attacker can deny service to any TCP application protected by FreeIPS, denying network service to legitimate users.

The attacker would have to know or guess a string pattern that matches a regular expression in FreeIPS to successfully exploit this vulnerability.

13. Sygate Personal Firewall Pro Local Denial Of Service Vulnera...
BugTraq ID: 10542
Remote: No
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10542
Summary:
A local denial of service vulnerability is reported to affect the Sygate Personal Firewall. It is reported that the smc.exe service may be crashed using the List-View Control in the Sygate Personal Firewall GUI.

This issue may be exploited in conjunction with the issue described in BID 10540, in order to completely disable the affected firewall as an unprivileged user.

This vulnerability is reported to affect Sygate Personal Firewall PRO version 5.5 Build 2525. Other versions might also be affected.

14. VICE Monitor Memory Dump Format String Vulnerability
BugTraq ID: 10543
Remote: No
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10543
Summary:
VICE monitor is reported prone to a format string vulnerability. The issue is reported to exist when output from the monitor "memory dump" command is displayed. Memory contents are used without sanitization as the format string for a print formatted function. As a result, malicious memory contents containing format specifiers will be interpreted literally when a memory dump is performed; this may result in attacker-specified memory being corrupted in the context of the user who is running the VICE monitor memory dump command.

15. BEA WebLogic Server And WebLogic Express Remote Denial of Se...
BugTraq ID: 10544
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10544
Summary:
It is reported that WebLogic Server and WebLogic Express are affected by a remote denial of service vulnerability. Due to certain unspecified reasons, the server does not close connections properly, ultimately running out of sockets.

WebLogic Server and WebLogic Express 8.1 SP2 and prior are vulnerable to this issue.

16. BEA WebLogic Server And WebLogic Express Java RMI Incorrect ...
BugTraq ID: 10545
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10545
Summary:
A flaw in the BEA WebLogic documentation for the implementation of Java Remote Method Invocation (RMI) may result in a privilege escalation vulnerability in products that are developed while following the documentation guidelines.

17. KAME Racoon IDE Daemon X.509 Improper Certificate Verificati...
BugTraq ID: 10546
Remote: Yes
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10546
Summary:
It is reported that racoon improperly validates X.509 certificates when negotiating IPSec connections.

When checking certificate validity, racoon ignores many errors from OpenSSL and grants access to invalid certificates.

When ignoring these errors, racoon would allow improper certificates to be used when authenticating connections. This vulnerability would allow attackers to forge certificates and potentially gain access to IPSec VPNs. This would also effectively make all certificates permanent.

It is unknown the exact versions of racoon that are vulnerable at this time.

18. SGI IRIX Undisclosed MapElf32Exec Local Denial Of Service Vu...
BugTraq ID: 10547
Remote: No
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10547
Summary:
SGI IRIX is reported prone to a local denial of service vulnerability. The issue is reported to present itself when a mapelf32exec() call is made on a malicious binary.

It is reported that a local attacker may exploit this condition to crash the affected UNIX host.

19. SGI IRIX SYSSGI() System Call Unprivileged User Kernel Memor...
BugTraq ID: 10548
Remote: No
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10548
Summary:
The syssgi() system call function SGI_IOPROBE is reported to contain a flaw allowing non-privileged users to read and write kernel memory.

A local attacker would exploit this vulnerability to gain superuser privileges, or to crash the system.

SGI has released patches addressing this issue. Versions up to 6.5.25 are reported vulnerable.

20. SGI IRIX Undisclosed Init Denial Of Service Vulnerability
BugTraq ID: 10549
Remote: No
Date Published: Jun 14 2004
Relevant URL: http://www.securityfocus.com/bid/10549
Summary:
SGI IRIX is reported prone to an undisclosed denial of service vulnerability. The issue is reported to present itself due to page invalidation issues that exist in init.

It is reported that a init may panic, and this may result in a local denial of service.

21. Thy HTTP Daemon Null Pointer Exception Denial Of Service Vul...
BugTraq ID: 10550
Remote: Yes
Date Published: Jun 15 2004
Relevant URL: http://www.securityfocus.com/bid/10550
Summary:
Thy HTTP Daemon is reportedly affected by a NULL pointer exception denial of service vulnerability. This issue is due to a failure of the application to handle malformed requests.

Successful exploitation of this issue will cause the affected server to crash, denying service to legitimate users.

22. HP-UX Local X Font Server Buffer Overflow Vulnerability
BugTraq ID: 10551
Remote: No
Date Published: Jun 15 2004
Relevant URL: http://www.securityfocus.com/bid/10551
Summary:
HP-UX X Font Server is reportedly affected by a local buffer overflow vulnerability. This issue is due to a failure of the application to properly validate the length of a user-supplied string before copying it into a finite buffer.

This issue may result in corruption of the affected application's memory space. This may be exploited to manipulate the execution flow of the vulnerable application, allowing for the execution of arbitrary machine code with the privileges of the 'bin' group.

23. Microsoft Internet Explorer HREF Save As Denial of Service V...
BugTraq ID: 10552
Remote: Yes
Date Published: Jun 15 2004
Relevant URL: http://www.securityfocus.com/bid/10552
Summary:
A vulnerability is reported to exist in Internet Explorer that may allow an attacker to cause the application to crash. The issue presents itself when a user attempts to invoke the "Save As" option on a malicious HREF URI.

When this URI is processed the issue leads to a crash in the running instance of Internet Explorer and all windows spawned from this instance.

24. Pivot Remote module_db.PHP File Include Vulnerability
BugTraq ID: 10553
Remote: Yes
Date Published: Jun 15 2004
Relevant URL: http://www.securityfocus.com/bid/10553
Summary:
It has been reported that Pivot is affected by a remote file include vulnerability contained within the module_db.php script. This issue is due to a failure of the application to properly sanitize user-supplied input before including it as a parameter to a file include function call.

This issue may be exploited to force the affected application to execute attacker supplied PHP script code. This may allow for command execution on the underlying system as well as other attacks.

25. Microsoft Internet Explorer Wildcard DNS Cross-Site Scriptin...
BugTraq ID: 10554
Remote: Yes
Date Published: Jun 15 2004
Relevant URL: http://www.securityfocus.com/bid/10554
Summary:
Microsoft Internet Explorer is reported to contain a cross-site scripting vulnerability for sites that have a wildcard DNS entry.

A web server with a wildcard DNS entry will respond to any hostname requested. An example DNS entry of *.example.com would allow a hostname of whatevertheattackerwanted.example.com to properly resolve.

Internet Explorer improperly interprets text inside of an anchor tag as HTML, rather than plaintext.

To exploit this issue, an attacker must either find a preexisting web site using a wildcard DNS entry or create their own. The web site must also be configured to display the hostname received in the request in the HTML returned to the user. A remote attacker may exploit this issue to potentially execute HTML or script code in the security context of the vulnerable site.

An attacker can exploit this issue to steal cookie authentication credentials, or perform other types of attacks.

26. Web Wiz Forums Registration_Rules.ASP Cross-Site Scripting V...
BugTraq ID: 10555
Remote: Yes
Date Published: Jun 15 2004
Relevant URL: http://www.securityfocus.com/bid/10555
Summary:
A vulnerability exists in the Web Wiz Forums software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data passed to the 'registration_rules.asp' script.

An attacker can exploit this issue to steal cookie authentication credentials, or perform other types of attacks.

27. PHPHeaven PHPMyChat Multiple Remote Vulnerabilities
BugTraq ID: 10556
Remote: Yes
Date Published: Jun 15 2004
Relevant URL: http://www.securityfocus.com/bid/10556
Summary:
phpHeaven phpMyChat is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data and design flaws. The following specific issues can affect the application:

phpMyChat is prone to a HTML injection vulnerability. The issue affects the 'input.php3' script. Due to a lack of sufficient sanitization of user-supplied data, this HTML Injection vulnerability may permit an attacker to inject malicious HTML or script code into the affected application. Users who are connected to this session would have the attacker supplied HTML code rendered in their browser in the context of the vulnerable site.

phpMyChat is prone to multiple SQL injection vulnerabilities. Again the issues are due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the URI parameters of the 'usersL.php3' script. The offending parameters are used in SQL queries prior to proper sanitization.

An authentication bypass vulnerability is reported to affect the phpMyChat authentication system. It is reported that by saving and modifying the phpMyChat authentication screen an attacker may potentially bypass the authentication system.

Finally phpMyChat is reported to be prone to a file disclosure vulnerability. A user who is authenticated as a site administrator can exploit the issue. The vulnerability presents itself because directory traversal sequences are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for a URI parameter passed to the 'admin.php3' script.

28. Symantec Enterprise Firewall DNSD DNS Cache Poisoning Vulner...
BugTraq ID: 10557
Remote: Yes
Date Published: Jun 15 2004
Relevant URL: http://www.securityfocus.com/bid/10557
Summary:
It is reported that dnsd is prone to a cache poisoning vulnerability.

Dnsd does not ensure that the data returned from a remote DNS server contains related information about the requested records.

An attacker could exploit this vulnerability to deny service to legitimate users by redirecting traffic to inappropriate hosts. Man-in-the-middle attacks, impersonation of sites, and other attacks may be possible.

29. Check Point Firewall-1 Internet Key Exchange Information Dis...
BugTraq ID: 10558
Remote: Yes
Date Published: Jun 16 2004
Relevant URL: http://www.securityfocus.com/bid/10558
Summary:
Check Point Firewall-1 is affected by an information disclosure vulnerability during an Internet Key Exchange (IKE) phase. This issue is due to a design error that may present sensitive information to an attacker.

An attacker can leverage this issue to disclose information about the affected firewall product including the version number and various details about the firewall's capabilities. Furthermore this issue would facilitate fingerprinting or identifying a firewall by carrying out active scans.

30. Invision Power Board Potential IP Address Spoofing Vulnerabi...
BugTraq ID: 10559
Remote: Yes
Date Published: Jun 16 2004
Relevant URL: http://www.securityfocus.com/bid/10559
Summary:
It is reported that Invision Power Board is prone to an IP address spoofing vulnerability. If an attacker is using a proxy to access a remote forum, the application logs the attacker's internal IP address on the LAN, instead of the real IP address of the proxy.

This issue is reported to affect Invision Power Board version 1.3, however, it is likely that other versions are affected as well.

31. Cisco IOS Border Gateway Protocol Denial Of Service Vulnerab...
BugTraq ID: 10560
Remote: Yes
Date Published: Jun 16 2004
Relevant URL: http://www.securityfocus.com/bid/10560
Summary:
The problem presents itself when an affected device handles a malformed or invalid Border Gateway Protocol (BGP) packet. During processing the offending packet the affected device will reset.

It should be noted that this issue only affects devices with BGP enabled; BGP is not enabled by default. It has been reported that this issue would be very difficult to exploit as it would require injecting malicious packets into communication between trusted peers.

An attacker may exploit this issue to cause the affected device to reset, taking several minutes to become functional. It is possible to create a persistent denial of service condition by continually transmitting malformed packets to the affected device.

32. IBM ACPRunner ActiveX Control Dangerous Method Vulnerability
BugTraq ID: 10561
Remote: Yes
Date Published: Jun 16 2004
Relevant URL: http://www.securityfocus.com/bid/10561
Summary:
It is reported that the IBM acpRunner ActiveX control contains dangerous methods that may result in a remote compromise of a system on which the ActiveX control is installed. These methods may be accessed by a malicious website and may result in the silent installation of a malicious executable.

A remote attacker may exploit this vulnerability in order to silently install a malicious executable on an affected system.

33. IBM EGatherer ActiveX Control Dangerous Method Vulnerability
BugTraq ID: 10562
Remote: Yes
Date Published: Jun 16 2004
Relevant URL: http://www.securityfocus.com/bid/10562
Summary:
It is reported that the IBM eGatherer ActiveX control contains dangerous methods that may result in a remote compromise of a system on which the ActiveX control is installed. These methods may be accessed by a malicious website and may result in the silent installation of a malicious executable.

A remote attacker may exploit this vulnerability in order to silently install a malicious executable on an affected system.

34. Linux Kernel Inter Intergrated Circuit Bus Driver Integer Ov...
BugTraq ID: 10563
Remote: No
Date Published: Jun 17 2004
Relevant URL: http://www.securityfocus.com/bid/10563
Summary:
The Linux kernel has been reported to be vulnerable to an integer overflow in the inter integrated circuit (I2C) bus driver. This issue is due to a failure of the offending driver to properly validate user-reported size values.

This issue could be leveraged by an attacker to execute machine code with the privileges of the affected driver; potentially leading to privilege escalation and ring 0 access.

It should be noted that in most cases I2C device files are by default only readable and writable by superusers; in such a case an attacker would have to have superuser privileges.

35. Snitz Forums Register Script HTML Injection Vulnerability
BugTraq ID: 10564
Remote: Yes
Date Published: Jun 17 2004
Relevant URL: http://www.securityfocus.com/bid/10564
Summary:
Snitz Forums is prone to an HTML injection vulnerability. User-supplied data through the 'Email' field of 'register.asp' script is not properly sanitized. It is reported that an attacker can supply malicious HTML or script code through this field that will be posted on a vulnerable forum.

Snitz Forums versions 3.4.04 and prior are affected by this issue.

36. ASP-Rider Malformed Cookie Administrative Access Vulnerabili...
BugTraq ID: 10565
Remote: Yes
Date Published: Jun 17 2004
Relevant URL: http://www.securityfocus.com/bid/10565
Summary:
ASP-Rider is reported prone to an administrative account access vulnerability that can allow a remote attacker to gain administrative access to a vulnerable site. The issue presents itself when an attacker sends a specially crafted malformed cookie to a vulnerable site.

ASP-Rider version 1.6 is reported prone to this vulnerability, however, other versions could be affected as well.

37. Linux Kernel Multiple Device Driver Vulnerabilities
BugTraq ID: 10566
Remote: No
Date Published: Jun 18 2004
Relevant URL: http://www.securityfocus.com/bid/10566
Summary:
It has been reported that the Linux kernel is vulnerable to multiple device driver issues. These issues were found during a recent audit of the Linux kernel source.

Drivers reportedly affected by these issues are: aironet, asus_acpi, decnet, mpu401, msnd, and pss.

These issues may reportedly allow attackers to gain access to kernel memory or gain escalated privileges on the affected computer.

38. Nmap Potential Insecure File Creation Vulnerability
BugTraq ID: 10567
Remote: No
Date Published: Jun 18 2004
Relevant URL: http://www.securityfocus.com/bid/10567
Summary:
Nmap is reportedly prone to a potential insecure file creation vulnerability. A local user may exploit this vulnerability to cause files to be overwritten with the privileges of the user running Nmap. This issue occurs when Nmap is launched with the '-oN' option.

All versions of Nmap are considered to be vulnerable to this issue.

Further analysis has showed that this issue is not a vulnerability. This BID is being retired.

39. MoinMoin Group Name Privilege Escalation Vulnerability
BugTraq ID: 10568
Remote: Yes
Date Published: Jun 18 2004
Relevant URL: http://www.securityfocus.com/bid/10568
Summary:
It is reported that MoinMoin contains a privilege escalation vulnerability whereby regular users can gain administrative privileges.

MoinMoin allows remote web clients to create their own user accounts without administrative intervention or approval. It is reported that if a user creates an account with the same name as an administrative group, the user will inherit the privileges of that same administrative group.

An attacker would use this vulnerability to gain complete access to the MoinMoin Wiki, and could gain access to sensitive information, or destroy information.

Versions before 1.2.2 are reported vulnerable.

40. Asterisk PBX Multiple Logging Format String Vulnerabilities
BugTraq ID: 10569
Remote: Yes
Date Published: Jun 18 2004
Relevant URL: http://www.securityfocus.com/bid/10569
Summary:
It is reported that Asterisk is susceptible to format string vulnerabilities in its logging functions.

An attacker may use these vulnerabilities to corrupt memory, and read or write arbitrary memory. Remote code execution is likely possible.

Due to the nature of these vulnerabilities, there may exist many different avenues of attack. Anything that can potentially call the logging functions with user-supplied data is vulnerable.

Versions 0.7.0 through to 0.7.2 are reported vulnerable.

41. Epic Games Unreal Engine Memory Corruption Vulnerability
BugTraq ID: 10570
Remote: Yes
Date Published: Jun 18 2004
Relevant URL: http://www.securityfocus.com/bid/10570
Summary:
Unreal Engine is reportedly prone to a memory corruption vulnerability. This issue presents itself when a remote attacker sends an excessive value to a vulnerable game server through a '\secure\' query.

An attacker can exploit this issue to potentially overwrite sensitive memory addresses leading to a variety of attacks including denial of service and possible remote code execution.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. U.S. moves towards anti-spyware law
By: Kevin Poulsen

Legislation would demand companies get a user's consent before spying.

http://www.securityfocus.com/news/8941

2. Court clips DirecTV piracy suits
By: Kevin Poulsen

Satellite company promises a kinder, gentler anti-piracy crackdown.
http://www.securityfocus.com/news/8925

3. Backdoor program gets backdoored
By: Kevin Poulsen

Popular malware author pulls a fast one on his underground user base.

http://www.securityfocus.com/news/8893

4. Feds, Private Groups to Educate Consumers About Phishing Sca...
By: David McGuire, Washington Post

The federal government and some of the nation's leading consumer organizations and financial institutions today kicked off a campaign to educate consumers about the growing threat posed by "phishing," a sophisticated form of identity theft conducted via e-mail and conterfeit Web sites.

http://www.securityfocus.com/news/8936

5. 'Spam King' Richter get legal roasting
By: Lester Haines, The Register

Spam King Scott Richter's plans to launch a global clothing line under the "Spam King" and "SK" brands have come apart at the seams.
http://www.securityfocus.com/news/8932

6. Thieves lift PCs from security show
By: Lester Haines, The Register

It may not be daring as the attempted heist of the Millennium Star diamond from the Millennium Dome - an audacious Sweeney-style blag involving JCB, speedboat and nail gun - but at least the wags who lifted two PCs from Asia Securitex 2004 in Hong Kong appear to have got away with it.

http://www.securityfocus.com/news/8929

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Wasabi 0.2
By: Andrea Barisani
Relevant URL: http://www.gentoo.org/proj/en/infrastructure/wasabi
Platforms: Perl (any system supporting perl)
Summary:

Wasabi is a log monitoring program, designed to watch a log file for lines matching user defined regular expression and report on the matches. The regular expressions are assigned to queues which have an alert interval and a list of mail recipients.

Queues can be set to send a notification as soon as there is a log line assigned to it, or to send periodic reports.

Additionally, uninteresting fields in the log lines (such as PID numbers) can be masked with the standard regular ex

2. Athena 1.0
By: Steve Lord
Relevant URL: http://www.buyukada.co.uk/projects/athena/
Platforms: Windows 2000, Windows XP
Summary:

Athena is a search engine query tool designed to help find information leakage vulnerabilties using 'googledork' strings. Athena uses an extensible configuration format that supports multiple search engines (Yahoo and Google included). Athena is designed with ease of use in mind and a full illustrated manual is included featuring a full walkthrough.

3. SnortNotify 1.02
By: Adam Ely
Relevant URL: http://www.780inc.com/snortnotify/
Platforms: Linux
Summary:

Running from cron at a specified interval SnortNotify will search a snort database for new alerts. If new alerts match a pre configured priority level, an email will be sent to the contact. The email will include Sensor name, the signaturename, and the timestamp.

4. CryptoHeaven v2.4.0
By: Marcin Kurzawa <[email protected]>
Relevant URL: http://www.cryptoheaven.com/
Platforms: UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

CryptoHeaven offers secure email and online file sharing/storage. Its main features are secure and highly encrypted services such as group collaboration, file sharing, email, online storage, and instant messaging. It integrates multi-user based security into email, instant messaging, and file storage and sharing in one unique package. It provides real time communication for text and data transfers in a multi-user secure environment. The security and usability of CryptoHeaven is well-balanced; even the no-so-technically oriented computer users can enjoy this crypto product with very high level of encryption.

5. Auditor security collection
By: Max Moser - Moser Informatik
Relevant URL: http://moser-informatik.ch/?page=products&lang=eng
Platforms: Os Independent
Summary:

The Auditor security collection is a Live-System based on KNOPPIX. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes. Independent of the hardware in use, the Auditor security collection offers a standardised working environment, so that the build-up of know-how and remote support is made easier. Even during the planning and development stages, our target was to achieve an excellent user-friendliness combined with an optimal toolset.

6. XArp 0.1
By: Christoph Mayer
Relevant URL: http://www.chrismc.de
Platforms: Windows 2000, Windows XP
Summary:

XArp is a graphical tool to monitor the ARP cache. It periodically requests the local ARP cache and reports changes in the IP to MAC mapping. Thus it can be used to recognize ARP poisoning which is used to prepare 'man in the middle' attacks on switched networks.

V. SECURITYJOBS LIST SUMMARY
----------------------------
1. IP Network Security Architect (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366621

2. IDS position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366564

3. Sales Engineer - NY or Boston (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366528

4. ezmlm warning (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366513

5. Security Admin/Engineer Available Philadelphia, Wilm... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366359

6. Security Engineer/Researcher - Southern California -... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366358

7. Technical Account Manager - Bay Area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366354

8. Security Engineer - Saint Louis (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366352

9. Looking for next opportunity (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366347

10. Security Technical Architect - UK - Short Term Contr... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366346

11. GA - North Atlanta - QA Manager Position - Ref: CF23... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366339

12. VP of Software - Biometric Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366334

13. Security Services Product Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366333

14. Network Security Engineer Available - NYC and New En... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366332

15. Security Engineer - Systems Omaha NE (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366330

16. Security Product Manager, Enterprise Products / Mark... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366327

17. Sales / Systems Engineer - Eastern USA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366326

18. Security Engineer - Top Secret Omaha NE (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366322

19. Jr Information Security Analyst - Jersey City, NJ (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366279

20. seeking CISSP challenge in Switzerland !! (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366271

21. Sales Representative Opportunity at Core Security Te... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366270

22. C&A Security Analysts Needed in MD, DC, PA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366267

23. security auditor (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366263

24. VP of Western Regional Sales Opening - Security Solu... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366260

25. Security Engineer - Belmont, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366256

26. RACF Mainframe Security - Bloomington, IL (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366245

27. VISA CISP Security Compliance Consultant (SF Bay Are... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366228

28. Sales Rep - Denver, Colorado (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366217

29. Want to join the best? LONDON UK ROLE - Have any of... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366215

30. Enterprise Security Software Sales-Chicago & NY (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366208

31. Seeking an Entry-level position in Network/Informati... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366207

32. Sr. Security Product Manager San Diego, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366204

33. MI - Information Security Opportunity (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366150

34. Senior QA Position Calgary, Canada (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366147

35. Senior Dev. Position Calgary, Canada (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366136

36. Regional Sales Manager--Southeast (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366094

37. NY Sales Executive (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366089

38. Technical Support Engineer--Tier III (San Francisco) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366087

39. Security Engineer--San Diego (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/366086

VI. INCIDENTS LIST SUMMARY
--------------------------
1. IE/WMP Exploit (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/366180

2. [ok] Simple Windows incident response methodology (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/366067

3. Simple Windows incident response methodology (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/366066

VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Antivirus/Trojan/Spyware scanners DoS [summary] (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/366395

2. TOORCON 2004: Call For Papers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/366148

VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. SecurityFocus Microsoft Newsletter #193 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/366221

IX. SUN FOCUS LIST SUMMARY
--------------------------
1. secure NFS problem (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/366128

2. DNS problem on Solaris X86 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/366100

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. OpenVPN? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/366447

XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XII. SPONSOR INFORMATION
-----------------------

This Issue is Sponsored By: SecurityFocus

http://www.securityfocus.com/rss/index.shtml

------------------------------------------------------------------------