SecurityFocus Newsletter #260

Peter Laborge <[email protected]> 3 Aug 2004 21:28:13 -0000

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #260
------------------------------

This Issue is Sponsored By: SecurityFocus

Want to keep up on the latest security vulnerabilities? Don't have time to
visit a myriad of mailing lists and websites to read the news? Just add the
new SecurityFocus RSS feeds to your freeware RSS reader, and see all the
latest posts for Bugtraq and the SF Vulnernability database in one
convenient place. Or, pull in the latest news, columnists and feature
articles in the SecurityFocus aggregated news feed, and stay on top of
what's happening in the community!

http://www.securityfocus.com/rss/index.shtml

------------------------------------------------------------------------
I. FRONT AND CENTER
1. Data Driven Attacks Using HTTP Tunneling
2. Email Privacy is Lost
II. BUGTRAQ SUMMARY
1. EasyWeb FileManager Module Directory Traversal Vulnerability
2. PostNuke Install Script Administrator Password Disclosure Vu...
3. eSeSIX Thintune Thin Client Devices Multiple Vulnerabilities
4. EasyIns Stadtportal Site Parameter Remote File Include Vulne...
5. Mozilla Firefox Refresh Security Property Spoofing Vulnerabi...
6. Pavuk Remote Digest Authentication Buffer Overflow Vulnerabi...
7. Nucleus CMS Action.PHP SQL Injection Vulnerability
8. XLineSoft ASPRunner Multiple Vulnerabilities
9. Subversion 'mod_authz_svn' Access Control Bypass Vulnerabili...
10. MoinMoin PageEditor Unspecified Privilege Escalation Vulnera...
11. PostNuke Reviews Module Cross-Site Scripting Vulnerability
12. Dropbear SSH Server Digital Signature Standard Unspecified A...
13. Invision Power Board Index.php Query String Cross-Site Scrip...
14. MoinMoin Unspecified Privilege Escalation Vulnerability
15. Apple Mac OSX Internet Connect Insecure Temporary File Handl...
16. OpenDocMan Access Control Bypass Vulnerability
17. Zero G InstallAnywhere Insecure Temporary File Creation Vuln...
18. Opera Web Browser Location Replace URI Obfuscation Weakness
19. Unreal IRCD Multiple Vulnerabilities
20. RiSearch/RiSearch Pro Open Proxy Vulnerability
21. phpMyFAQ Image Manager Authentication Bypass Vulnerability
22. FTPGlide Insecure Local Profile Storage Vulnerability
23. Microsoft Internet Explorer Style Tag Comment Memory Corrupt...
24. Hitachi Web Page Generator Unspecified Denial Of Service Vul...
25. Hitachi Web Page Generator Cross-Site Scripting and Informat...
26. SoX WAV File Buffer Overflow Vulnerability
27. Check Point VPN-1 ASN.1 Buffer Overflow Vulnerability
28. AntiBoard Multiple Input Validation Vulnerabilities
29. Phorum Search Script Cross-Site Scripting Vulnerability
30. DansGuardian Hex Encoded File Extension URI Content Filter B...
31. Comersus Cart SQL Injection Vulnerability
32. Verylost LostBook Message Entry HTML Injection Vulnerability
33. JAWS ControlPanel.PHP SQL Injection Vulnerability
34. LinPHA Session Cookie SQL Injection Vulnerability
35. Oracle Database Default Library Directory Privilege Escalati...
36. OpenFTPD Remote Message Format String Vulnerability
37. MyServer Multiple Remote math_sum.mscgi Example Script Vulne...
38. Mozilla Firefox XML User Interface Language Browser Interfac...
39. Citadel/UX Username Buffer Overflow Vulnerability
40. SapporoWorks Black JumboDog FTP Server Buffer Overflow Vulne...
41. PowerPortal Private Message HTML Injection Vulnerability
42. FusionPHP Fusion News Administrator Command Execution Vulner...
III. SECURITYFOCUS NEWS ARTICLES
1. ATM keypads get a security boost
2. Companies adapt to a zero day world
3. VoIP hacks gut Caller I.D.
4. Anti-spam spamvertisers agree to quit
5. Mozilla to pay bounty on bugs
6. Singapore holds computer hacking contest to find city-state'...
IV. SECURITYFOCUS TOP 6 TOOLS
1. DiskLogon 1.0.17.112
2. UndeleteSMS 1.0
3. Macshift 1.0
4. Advanced LAN Scanner 1.0
5. Firewall Builder 2.0
6. Lepton's Crack 20031130
V. SECURITYJOBS LIST SUMMARY
1. ezmlm warning (Thread)
2. [SJ-JOB] Security Architect, Basel, CH (Thread)
3. [SJ-JOB] Information Assurance Engineer, San Marcos,... (Thread)
4. [SJ-JOB] Security Engineer, New York, US (Thread)
5. [SJ-RESUME] Jr. Security Analyst (Thread)
6. [SJ-JOB] Quality Assurance, Los Gatos, US (Thread)
7. [SJ-JOB] Account Manager, Boston, US (Thread)
8. [SJ-JOB] Technical Writer, Capital Federal, AR (Thread)
9. [SJ-JOB] Security Auditor, San Jose, US (Thread)
10. [SJ-JOB] Sr. Security Analyst, San Jose, US (Thread)
11. [SJ-JOB] Sr. Security Analyst, Boise, US (Thread)
12. [SJ-RESUME] Incident Handler (Thread)
13. [SJ-RESUME] Forensics Engineer (Thread)
14. [SJ-JOB] Developer, San Marcos, US (Thread)
15. [SJ-JOB] Security Engineer, Denver, US (Thread)
16. [SJ-RESUME] Sales Engineer (Thread)
17. [SJ-JOB] Security Engineer, Basel, CH (Thread)
18. [SJ-RESUME] Manager, Information Security (Thread)
19. [SJ-JOB] Security Auditor, Los Gatos, US (Thread)
20. [SJ-JOB] Sr. Security Analyst, Toronto, CA (Thread)
21. [SJ-JOB] Security Product Manager, San Diego, US (Thread)
22. [SJ-JOB] Sales Engineer, 3 Openings - No Mid-West/ D... (Thread)
23. [SJ-RESUME] Security System Administrator (Thread)
24. [SJ-JOB] Information Assurance Analyst, McLean, US (Thread)
25. [SJ-RESUME] Security Consultant (Thread)
26. [SJ-JOB] Quality Assurance, Portland, US (Thread)
27. [SJ-JOB] Sr. Security Analyst, Torrance, US (Thread)
28. [SJ-RESUME] CSO (Thread)
29. [SJ-RESUME] Developer (Thread)
30. [SJ-RESUME] Sr. Security Analyst (Thread)
31. [SJ-RESUME] VP of Regional Sales (Thread)
32. [SJ-JOB] Developer, Torrance, US (Thread)
33. [SJ-JOB] Security Architect, Portland, US (Thread)
34. [SJ-JOB] Security Product Manager, Portland, US (Thread)
35. [SJ-JOB] Application Security Engineer, Boston (flex... (Thread)
36. [SJ-JOB] Security Researcher, Bay Area, CA, US (Thread)
37. [SJ-JOB] Sales Engineer, Bay Area, CA, US (Thread)
38. [SJ-JOB] Security Director, Washington D.C, US (Thread)
39. [SJ-JOB] Application Security Engineer, Redwood Shor... (Thread)
VI. INCIDENTS LIST SUMMARY
1. SSH login attempts: tcpdump packet capture (Thread)
2. Anyone else seeing SSH scans? (Thread)
3. SSH attacks? (Thread)
4. SSHd spider attempts (Thread)
5. FW: [Intrusions] Linux SSH scanning - test/guest (Thread)
6. About SSH scanning (Thread)
7. New Virus / Trojan ? (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Problem with format string exploit dev in FreeBSD 5.... (Thread)
2. Problem with format string exploit dev in FreeBSD 5... (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. ezmlm warning (Thread)
2. ISA/VPN comparison (Thread)
3. Microsoft to release out-of-cycle patch (Thread)
4. SecurityFocus Microsoft Newsletter #199 (Thread)
5. Windows Update v5 and XPSP2RC2 (Thread)
6. Proxy Server/ISA (Thread)
IX. SUN FOCUS LIST SUMMARY
1. How to Restrict a user, not a root, Login to the Co... (Thread)
2. trouble setting up routing (Thread)
3. Has anyone been able to get a jabber client (Thread)
X. LINUX FOCUS LIST SUMMARY
1. SSO on Linux (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Data Driven Attacks Using HTTP Tunneling
By Ido Dubrawsky

In this article we will look at a means to bypass the access control
restrictions of a company's router or firewall. This information is
intended to provide help for those who are legitimately testing the
security of a network (whether they are in-house expertise or outside
consultants).

http://www.securityfocus.com/infocus/1793

2. Email Privacy is Lost
By Scott Granneman

As if the common use of "web bugs" inside spam was not enough, companies
are using new techniques to watch and track the private emails you read,
forward, print, and more.

http://www.securityfocus.com/columnists/258

II. BUGTRAQ SUMMARY
-------------------
1. EasyWeb FileManager Module Directory Traversal Vulnerability
BugTraq ID: 10792
Remote: Yes
Date Published: Jul 23 2004
Relevant URL: http://www.securityfocus.com/bid/10792
Summary:
EasyWeb is prone to a directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. The issue occurs if a remote attacker sends a request to the 'ew_filemanager' script for a file containing directory traversal character sequences to the application.

EasyWeb FileManager 1.0 RC-1 is prone to this issue.

Update: Conflicting reports suggest that this issue may not be a vulnerability as access to various files can be limited by an EasyWeb administrator. An attacker with valid account credentials may only be able to carry out an attack. This BID will be updated as more information becomes available.

2. PostNuke Install Script Administrator Password Disclosure Vu...
BugTraq ID: 10793
Remote: Yes
Date Published: Jul 24 2004
Relevant URL: http://www.securityfocus.com/bid/10793
Summary:
It is reported that PostNuke may disclose administrator authentication credentials to remote attackers. This issue presents itself because the application fails to remove the install script 'install.php' after installation. This can allow an attacker to gain unauthorized access to the content management system. The attacker may then carry out further attacks against other users or the computer running the vulnerable application.

3. eSeSIX Thintune Thin Client Devices Multiple Vulnerabilities
BugTraq ID: 10794
Remote: Yes
Date Published: Jul 24 2004
Relevant URL: http://www.securityfocus.com/bid/10794
Summary:
Thintune Linux-based devices are reported prone to multiple vulnerabilities. These issues can allow remote attackers to gain complete access to a vulnerable device.

The issues include backdoor accounts that can be accessed over the network and an information disclosure issue that can disclose user accounts and passwords.

Thintune devices with firmware version 2.4.38 and prior are affected by these issues. Reportedly, Thintune devices based on Windows CE are not affected.

4. EasyIns Stadtportal Site Parameter Remote File Include Vulne...
BugTraq ID: 10795
Remote: Yes
Date Published: Jul 24 2004
Relevant URL: http://www.securityfocus.com/bid/10795
Summary:
EasyIns Stadtportal is reported prone to a vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable computer.

EasyIns Stadtportal version 4 is reported prone to this issue. Other versions may be affected as well.

5. Mozilla Firefox Refresh Security Property Spoofing Vulnerabi...
BugTraq ID: 10796
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10796
Summary:
Mozilla Firefox may permit malicious Web pages to spoof security properties of a trusted site.

An attacker can exploit this issue to spoof the URI and SSL certificate of a site trusted by an unsuspecting user. The attacker can then use this spoofing to steal sensitive or private information, facilitating phishing attacks

6. Pavuk Remote Digest Authentication Buffer Overflow Vulnerabi...
BugTraq ID: 10797
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10797
Summary:
It has been reported that Pavuk is affected by a remote digest authentication buffer overflow vulnerability. This issue is due to a failure of the application to validate string lengths when copying user-supplied data into finite buffers in process memory.

Ultimately a remote malicious web site may exploit this issue to execute arbitrary code on the affected computer with the privileges of the user who started the affected application.

7. Nucleus CMS Action.PHP SQL Injection Vulnerability
BugTraq ID: 10798
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10798
Summary:
An SQL injection vulnerability is identified in the Nucleus CMS application that may allow attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks.

This vulnerability exists due to insufficient sanitization of user-supplied input through the 'action.php' script. It may be possible for a remote user to inject arbitrary SQL queries into the underlying database used by the application. This could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

8. XLineSoft ASPRunner Multiple Vulnerabilities
BugTraq ID: 10799
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10799
Summary:
ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files.

ASPRunner versions 2.4 and prior are affect by these issues.

9. Subversion 'mod_authz_svn' Access Control Bypass Vulnerabili...
BugTraq ID: 10800
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10800
Summary:
Subversion is reported to contain access control bypass vulnerabilities in its 'mod_authz_svn' Apache module.

These access control vulnerabilities present themselves when users have mixed access to a repository.

These vulnerabilities exist in several server operations, such as COPY and DELETE. These operations fail to properly implement the operator assigned access controls, allowing users improper access to repositories.

These issues are only present when using the WebDAV access method with the Apache 'mod_authz_svn' module, with the 'AuthzSVNAccessFile' configuration directive.

The vulnerabilities are present in version 1.0.5 and prior. Versions 1.0.6 and 1.1.0-rc1 have been released to address these vulnerabilities.

10. MoinMoin PageEditor Unspecified Privilege Escalation Vulnera...
BugTraq ID: 10801
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10801
Summary:
MoinMoin is reported prone to an unspecified privilege escalation vulnerability. This issue is related to the PageEditor functionality. Specifically this vulnerability may arise due to improper implementation of access control lists. A remote attacker may exploit this to gain elevated privileges.

Due to a lack of details, further information is not available at the moment. This BID will be updated as more information becomes available.

This issues is identified in MoinMoin version 1.2.2, however, other versions may be affected as well.

11. PostNuke Reviews Module Cross-Site Scripting Vulnerability
BugTraq ID: 10802
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10802
Summary:
PostNuke is reported prone to a cross-site scripting vulnerability. This issue affects the 'title' parameter of 'Reviews' script. Exploitation of this issue could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

It should be noted, that although this vulnerability has been reported to affect PostNuke version 0.726-3 and 0.75-RC3, other versions might also be affected.

12. Dropbear SSH Server Digital Signature Standard Unspecified A...
BugTraq ID: 10803
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10803
Summary:
Reportedly Dropbear SSH is affected by an unspecified digital signal standard (DSS) authentication vulnerability; an upgrade is available.

The impact of this issue is currently unknown, although it is speculated that this issue could be used to gain unauthorized access to a computer running the vulnerable application. It should be noted that this is not confirmed. This BID will be updated as more information becomes available.

13. Invision Power Board Index.php Query String Cross-Site Scrip...
BugTraq ID: 10804
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10804
Summary:
A vulnerability has been reported to exist in Invision Power Board that may allow a remote user to launch cross-site scripting attacks.

This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

14. MoinMoin Unspecified Privilege Escalation Vulnerability
BugTraq ID: 10805
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10805
Summary:
MoinMoin is reported prone to an unspecified privilege escalation vulnerability. It is reported that this issue presents itself if access control lists are not applied. An unspecified erroneous function allows remote attackers to carry out privileged tasks without proper access validation. Remote attackers may gain read and write access to sensitive data.

Due to a lack of details, further information is not available at the moment. This BID will be updated as more information becomes available.

This issues is identified in MoinMoin versions 1.2.2 and prior.

15. Apple Mac OSX Internet Connect Insecure Temporary File Handl...
BugTraq ID: 10806
Remote: No
Date Published: Jul 25 2004
Relevant URL: http://www.securityfocus.com/bid/10806
Summary:
It is reported that Internet Connect is prone to a local insecure temporary file handling symbolic link vulnerability. This issue is due to a design error that allows the application to insecurely create a file with a predictable name in the 'tmp' directory.

A successful attack can eventually allow a local attacker to gain super user privileges.

This issue is reported to affect Mac OS X 10.3.4. It is likely that other versions are affected as well.

16. OpenDocMan Access Control Bypass Vulnerability
BugTraq ID: 10807
Remote: Yes
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10807
Summary:
It is reported that OpenDocMan contains an access bypass vulnerability.

This vulnerability could be exploited to create, update, or delete users, departments or categories without proper authorization.

An attacker requires an account in the application. Once logged into the application, they can issue requests to the vulnerable script and commit changes that only the administrator should be able to do.

By exploiting this vulnerability, an attacker can gain administrator privileges in the application. They could also delete all user accounts, denying access to legitimate users. Other attacks are possible.

Versions prior to 1.2 are reported vulnerable.

17. Zero G InstallAnywhere Insecure Temporary File Creation Vuln...
BugTraq ID: 10808
Remote: No
Date Published: Jul 26 2004
Relevant URL: http://www.securityfocus.com/bid/10808
Summary:
It is reported that InstallAnywhere is prone to a local insecure temporary file handling symbolic link vulnerability. This issue is due to an error that allows the application to insecurely create a file with a predictable name in the '/tmp' directory.

A successful attack can eventually allow a local attacker to gain super user privileges.

Versions 5.0.6 and 5.0.7 are reported vulnerable. Other versions may also be affected by this issue.

18. Opera Web Browser Location Replace URI Obfuscation Weakness
BugTraq ID: 10810
Remote: Yes
Date Published: Jul 27 2004
Relevant URL: http://www.securityfocus.com/bid/10810
Summary:
Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information. This issue is due to a race condition error.

This issue may be leveraged by an attacker to display false information in the address bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to be derived from a trusted location. This may facilitate phishing attacks; attempted theft of user information for the purpose of identity theft.

Although this issue and those outlined in BIDs 10337, 10452, and 10679 have a similar affect, they are not related.

19. Unreal IRCD Multiple Vulnerabilities
BugTraq ID: 10811
Remote: Yes
Date Published: Jul 27 2004
Relevant URL: http://www.securityfocus.com/bid/10811
Summary:
Unreal ircd is prone to multiple vulnerabilities that may allow a remote attacker to execute arbitrary code on a vulnerable computer. If successful, the attacker may gain unauthorized access to the computer. The application is reportedly affected by a buffer overflow, a format string issue, and a command execution vulnerability.

A lack of details in the report does not allow for further information. This issue will be updated as more information becomes available.

It is reported that the process does not drop privileges properly, which could allow the attacker to gain super user access to a vulnerable computer.

Unreal ircd version 3.2.1 is reported prone to these issues. It is possible that other version are affected as well.

Update: Upon further analysis, it was discovered that most of these issues do not pose a security threat. One issue dealing with chroot is deemed to be a weakness and is assigned BID 10814 (Unreal IRCD CHRoot Local Privilege Escalation Weakness). This BID is being retired.

20. RiSearch/RiSearch Pro Open Proxy Vulnerability
BugTraq ID: 10812
Remote: Yes
Date Published: Jul 27 2004
Relevant URL: http://www.securityfocus.com/bid/10812
Summary:
RiSearch and RiSearch Pro are reported prone to an open proxy vulnerability. It is reported that the issue presents itself due to a lack of sufficient sanitization performed on user supplied URI parameters.

A remote attacker may exploit this condition in order to launch attacks against local and public services in the context of the site that is hosting the vulnerable script.

21. phpMyFAQ Image Manager Authentication Bypass Vulnerability
BugTraq ID: 10813
Remote: Yes
Date Published: Jul 27 2004
Relevant URL: http://www.securityfocus.com/bid/10813
Summary:
It is reported that phpMyFAQ contains an authentication bypass vulnerability in its image manager.

This vulnerability can be exploited by remote anonymous attackers to upload or delete images in the phpMyFAQ application without authorization.

A remote attacker could deface the application, or delete all images in the database.

Version 1.4 is reported vulnerable. The vendor has released version 1.4a that corrects this issue.

22. FTPGlide Insecure Local Profile Storage Vulnerability
BugTraq ID: 10815
Remote: No
Date Published: Jul 27 2004
Relevant URL: http://www.securityfocus.com/bid/10815
Summary:
FTPGlide is reported prone to an insecure profile storage vulnerability. FTPGlide provides functionality where a user can save an FTP or HTTP site profile; this profile contains the server address, the username and may contain the password if the option to save the password is selected.

Any user who has access to the installation directory will have access to all saved profiles.

23. Microsoft Internet Explorer Style Tag Comment Memory Corrupt...
BugTraq ID: 10816
Remote: Yes
Date Published: Jul 28 2004
Relevant URL: http://www.securityfocus.com/bid/10816
Summary:
A vulnerability identified in Internet Explorer may allow an attacker to cause the application to crash. It is reported that the issue presents itself when a comment character sequence that is not terminated is encountered after a STYLE tag.

This issue could be exploited by a remote attacker to cause a denial of service condition in the browser. The attacker would likely create a malicious HTML page and host it on a site. The attacker would then attempt to entice a user to visit the malicious page to carry out a
successful attack.

24. Hitachi Web Page Generator Unspecified Denial Of Service Vul...
BugTraq ID: 10817
Remote: Yes
Date Published: Jul 28 2004
Relevant URL: http://www.securityfocus.com/bid/10817
Summary:
It is reported that Web Page Generator contains an unspecified denial of service vulnerability. This vulnerability is only reported to affect the Microsoft Windows version of the application.

Reportedly, sending multiple invalid requests to the affected application can potentially cause the application to crash.

A remote attacker can exploit this vulnerability to crash Web Page Generator, denying service to legitimate users.

No further information is available at this time. This BID will be updated as more information is disclosed.

25. Hitachi Web Page Generator Cross-Site Scripting and Informat...
BugTraq ID: 10818
Remote: Yes
Date Published: Jul 28 2004
Relevant URL: http://www.securityfocus.com/bid/10818
Summary:
It is reported that Web Page Generator contains a cross-site scripting vulnerability, and an information disclosure vulnerability.

The error transaction facility does not sufficiently sanitize user-supplied data, making it prone to cross-site scripting attacks. This could allow for execution of hostile HTML and script code in the web client of a user who visits a web page that contains the malicious code. This would occur in the security context of the site hosting the software.

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

The error transaction facility, can also disclose information about an internal directory. This may assist an attacker with further compromise against the server.

These vulnerabilities are only present when the application is in debugging mode, (when 'DEBUG_MODE=on'), and the default error template is used.

26. SoX WAV File Buffer Overflow Vulnerability
BugTraq ID: 10819
Remote: No
Date Published: Jul 28 2004
Relevant URL: http://www.securityfocus.com/bid/10819
Summary:
The WAV header handling code in SoX is reported to contain a buffer overflow vulnerability. This issue is due to a failure of the application to validate string lengths when copying user-supplied data into finite buffers in process memory.

The attacker must be able to present a malicious WAV file to an unsuspecting user. The user must employ the affected application to either listen to, or process the malicious file.

Ultimately a malicious attacker may exploit this issue to execute arbitrary code on the affected computer with the privileges of the user who started the affected application.

27. Check Point VPN-1 ASN.1 Buffer Overflow Vulnerability
BugTraq ID: 10820
Remote: Yes
Date Published: Jul 28 2004
Relevant URL: http://www.securityfocus.com/bid/10820
Summary:
A remote buffer overflow vulnerability is reported in Check Point VPN-1 that may allow a remote attacker to execute arbitrary code in order to gain unauthorized access. This issue results from insufficient boundary checks performed by the application when processing user-supplied data.

This overflow occurs during the initial key exchange process, and can be triggered with a single UDP packet. Since ISAKMP uses the UDP transport, a spoofed source address can be used in an attack.

Check Point reports that for a single packet attack to succeed, VPN-1 must be configured for aggressive mode key exchange. Without aggressive mode, an attacker must initiate a real key negotiation session.

This vulnerability can lead to remote code execution in the context of the VPN-1 process. This can lead to a complete system compromise.

Check Point has released an advisory and fixes for this issue.

28. AntiBoard Multiple Input Validation Vulnerabilities
BugTraq ID: 10821
Remote: Yes
Date Published: Jul 28 2004
Relevant URL: http://www.securityfocus.com/bid/10821
Summary:
Multiple vulnerabilities are reported to exist in the application due to insufficient sanitization of user-supplied data. The issues include various instances of SQL injection and a cross-site scripting vulnerability.

AntiBoard versions 0.7.2 and prior are affected by these issues.

29. Phorum Search Script Cross-Site Scripting Vulnerability
BugTraq ID: 10822
Remote: Yes
Date Published: Jul 28 2004
Relevant URL: http://www.securityfocus.com/bid/10822
Summary:
A cross-site scripting vulnerability is reported to affect Phorum. This issue affects the 'search.php' script. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user.

This vulnerability was reported to affect Phorum 5.0.7 beta.

30. DansGuardian Hex Encoded File Extension URI Content Filter B...
BugTraq ID: 10823
Remote: Yes
Date Published: Jul 29 2004
Relevant URL: http://www.securityfocus.com/bid/10823
Summary:
It is reported that DansGuardian contains a content filter bypass vulnerability when handling hex encoded file extensions in URIs.

Under some installations, this may violate security policy, or allow users to inadvertently access malicious web content.

31. Comersus Cart SQL Injection Vulnerability
BugTraq ID: 10824
Remote: Yes
Date Published: Jul 29 2004
Relevant URL: http://www.securityfocus.com/bid/10824
Summary:
Comersus Cart is reportedly affected by a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI parameter input before using it in an SQL query.

The problem presents itself when malicious SQL statements are passed as a value for the username field when authenticating to the application.

As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

32. Verylost LostBook Message Entry HTML Injection Vulnerability
BugTraq ID: 10825
Remote: Yes
Date Published: Jul 29 2004
Relevant URL: http://www.securityfocus.com/bid/10825
Summary:
Reportedly Verylost lostBook is affected by an HTML injection vulnerability in its message entry functionality. This issue is due to a failure of the application to properly validate and sanitize user-supplied input before including it in dynamically generated web page content.

This may allow an attacker inject malicious HTML and script code into the application. An unsuspecting user viewing the post will have the attacker-supplied script code executed within their browser in the context of the vulnerable site. This issue may be leverage to steal cookie based authentication credentials. Other attacks are also possible.

33. JAWS ControlPanel.PHP SQL Injection Vulnerability
BugTraq ID: 10826
Remote: Yes
Date Published: Jul 29 2004
Relevant URL: http://www.securityfocus.com/bid/10826
Summary:
JAWS is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the controlpanel.php script due to a failure of the application to properly sanitize user-supplied URI parameter input before using it in an SQL query.

Because of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

34. LinPHA Session Cookie SQL Injection Vulnerability
BugTraq ID: 10827
Remote: Yes
Date Published: Jul 29 2004
Relevant URL: http://www.securityfocus.com/bid/10827
Summary:
LinPHA is reported to contain an SQL injection vulnerability in its session cookie handling code. This issue is due to a failure of the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in compromise of the application, disclosure or modification of data or may permit an attacker to exploit vulnerabilities in the underlying database implementation. It is demonstrated that an attacker may exploit this vulnerability in order to gain administrative access to the application.

Version 0.9.4 has been reported susceptible to this vulnerability. Prior versions may also be affected.

35. Oracle Database Default Library Directory Privilege Escalati...
BugTraq ID: 10829
Remote: No
Date Published: Jul 30 2004
Relevant URL: http://www.securityfocus.com/bid/10829
Summary:
Oracle database implementations are reportedly prone to a default library directory privilege escalation vulnerability. This issue arises due to a default configuration error that will permit the attacker to replace libraries required by setuid root applications with arbitrary code.

This issue would allow an Oracle software owner to execute code as the superuser, taking control of the entire system.

It should be noted that this vulnerability only affects Oracle on UNIX/Linux platforms.

36. OpenFTPD Remote Message Format String Vulnerability
BugTraq ID: 10830
Remote: Yes
Date Published: Jul 30 2004
Relevant URL: http://www.securityfocus.com/bid/10830
Summary:
Reportedly OpenFTPD is affected by a remote message format string vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input before using it as the format specifier in a formatted printing function.

Successful exploitation of this issue will allow an attacker to execute arbitrary code on the affected computer with the privileges of the user that invoked the affected FTP server software.

37. MyServer Multiple Remote math_sum.mscgi Example Script Vulne...
BugTraq ID: 10831
Remote: Yes
Date Published: Jul 30 2004
Relevant URL: http://www.securityfocus.com/bid/10831
Summary:
Reportedly MyServer is affected by multiple remote vulnerabilities in the 'math_sum.mscgi' example script. These issues are due to a boundary condition error and a failure to properly sanitize user-supplied URI input.

An attacker could exploit the boundary condition issue to execute arbitrary code on the affected computer with the privileges of the user that started the affected application. The input validation issue could be leveraged to carry out cross-site scripting attacks against the affected computer.

These issues are reported to affect MyServer version 0.6.2, it is likely other versions are also affected.

38. Mozilla Firefox XML User Interface Language Browser Interfac...
BugTraq ID: 10832
Remote: Yes
Date Published: Jul 30 2004
Relevant URL: http://www.securityfocus.com/bid/10832
Summary:
Mozilla Firefox is reported prone to an interface spoofing vulnerability. The issue presents itself because JavaScript code is allowed to hide the Mozilla Firefox interface and status bar by default. A fake Mozilla firefox interface may be created using the XML User Interface Language API, this interface may aid in phishing style attacks.

This misrepresentation may fool a user into trusting a malicious site, which would likely ask the user to submit sensitive or private information.

39. Citadel/UX Username Buffer Overflow Vulnerability
BugTraq ID: 10833
Remote: Yes
Date Published: Jul 30 2004
Relevant URL: http://www.securityfocus.com/bid/10833
Summary:
A buffer overrun vulnerability is reported for Citadel/UX. The problem occurs due to insufficient bounds checking when processing 'USER' command arguments.

An anonymous remote attacker may be capable of exploiting this issue to execute arbitrary code. This however has not been confirmed. Failed exploit attempts may result in a denial of service.

40. SapporoWorks Black JumboDog FTP Server Buffer Overflow Vulne...
BugTraq ID: 10834
Remote: Yes
Date Published: Jul 30 2004
Relevant URL: http://www.securityfocus.com/bid/10834
Summary:
Black JumboDog is reported to contain a buffer overflow vulnerability in its FTP server. This issue results from insufficient boundary checks performed by the application when processing user-supplied data. This issue can be exploited before authenticating to the FTP server.

This issue may lead to arbitrary code execution if an attacker can direct program execution to attacker supplied memory locations containing malicious shellcode. The attacker may ultimately gain unauthorized access to a vulnerable computer in the context of the FTP server process.

Version 3.6.1 is reported vulnerable. Other prior versions may also be affected.

41. PowerPortal Private Message HTML Injection Vulnerability
BugTraq ID: 10835
Remote: Yes
Date Published: Jul 30 2004
Relevant URL: http://www.securityfocus.com/bid/10835
Summary:
A vulnerability is reported for PowerPortal which may make it prone to HTML injection attacks. The problem is said to occur due to a lack of sufficient sanitization performed on private message data.

Specifically, when creating PowerPortal private messages, the subject field may not be sufficiently sanitized of malicious content. This may make it possible for an attacker to place HTML or script code within the subject field of a private PowerPortal message for another user.

42. FusionPHP Fusion News Administrator Command Execution Vulner...
BugTraq ID: 10836
Remote: Yes
Date Published: Jul 30 2004
Relevant URL: http://www.securityfocus.com/bid/10836
Summary:
It is reported that Fusion News is affected by an administrator command execution vulnerability. This issue is due to a failure of the application to properly validate access to administrative commands.

This issue permits a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activates this URI, the attacker-supplied command would be carried out with the administrator's privileges. This occurs in the security context of the affected web site and would cause various administrator actions to be taken.

Version 3.6.1 and prior are reported to be affected by this vulnerability.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. ATM keypads get a security boost
By: Kevin Poulsen

Credit card companies are responding to a host of high and low-tech attacks on the sanctity of your ATM code.
http://www.securityfocus.com/news/9161

2. Companies adapt to a zero day world
By: Deborah Radcliff

Financial institutions with critical systems and cash on the line are reorganizing to deal with the closing gap between the hole and the patch.
http://www.securityfocus.com/news/9100

3. VoIP hacks gut Caller I.D.
By: Kevin Poulsen

Implementation quirks in Voice over IP are making it easy for hackers to spoof Caller I.D., and to unmask blocked numbers.

http://www.securityfocus.com/news/9061

4. Anti-spam spamvertisers agree to quit
By: John Leyden, The Register

A Californian company last week promised to stop promoting its ad-blocking software using Internet pop-up ads.

http://www.securityfocus.com/news/9257

5. Mozilla to pay bounty on bugs
By: John Leyden, The Register

Users who identify and report serious security vulnerabilities involving Mozilla are to be rewarded for finding bugs in the open source Web browser software.

http://www.securityfocus.com/news/9255

6. Singapore holds computer hacking contest to find city-state'...
By: , The Associated Press

http://www.securityfocus.com/news/9253

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. DiskLogon 1.0.17.112
By: DiskLogon Development Team
Relevant URL: http://www.disklogon.com/DiskLogon.exe
Platforms: Windows 2000, Windows XP
Summary:

DiskLogon, like a Smart Card logon, is a software that enables you to log on to your computer with a removable disk.
DiskLogon saves you the trouble of entering your user name and password every time you log on. All you have to do is to plug in your removable disk, and you can log on to your computer quickly and safely. When you plug out your removable disk, your computer will automatically lock up you're your safety.

2. UndeleteSMS 1.0
By: Arne Vidstrom
Relevant URL: http://vidstrom.net/downloads/undeletesms.exe
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

UndeleteSMS can recover deleted SMS messages from a GSM SIM card.

3. Macshift 1.0
By: Nathan True
Relevant URL: http://students.washington.edu/natetrue/macshift/macshift.zip
Platforms: Windows 2000, Windows XP
Summary:

Macshift is a free and open-source tool to change the MAC address of any network adapter under Windows 2k / XP. It has a simple scriptable commandline interface.

4. Advanced LAN Scanner 1.0
By: Famatech
Relevant URL: http://www.radmin.com/download/lscan1b1.exe
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

Advanced Lan Scanner is a fast, small, easy-to-use, highly configurable network scanner for Win32. Advanced Lan Scanner uses multithreading technique, that gives it ability to scan more than 1000 elements per second. If used to scan ports, Advanced Lan Scanner can check all 65536 ports in less that minute. Advanced LAN Scanner performs exact scan upon each computer you wish, extracting users, services, shares and a lot of over useful information.

5. Firewall Builder 2.0
By: Vadim Kurland
Relevant URL: http://www.fwbuilder.org/
Platforms: FreeBSD, Linux, MacOS, Solaris, Windows 2000, Windows XP
Summary:

Firewall Builder consists of a GUI and set of policy compilers for various firewall platforms. It helps users maintain a database of objects and allows policy editing using simple drag-and-drop operations. The GUI and policy compilers are completely independent, and support for a new firewall platform can be added to the GUI without any changes to the program (only a new policy compiler is needed). This provides for a consistent abstract model and the same GUI for different firewall platforms. It currently supports iptables, ipfilter, and OpenBSD pf.

6. Lepton's Crack 20031130
By: Lepton and Nekromancer
Relevant URL: http://www.nestonline.com/lcrack/lcrack-20031130-beta.zip
Platforms: Linux, MacOS, Os Independent, UNIX, Windows 2000, Windows NT, Windows XP
Summary:

Lepton's Crack is a generic password cracker. It is easily-customizable with a simple plugin system and allows system administrators to review the quality of the passwords being used on their systems. It can perform a dictionary-based (wordlist) attack as well as a brute force (incremental) password scan. It supports standard MD4 hash, standard MD5 hash, NT MD4/Unicode, Lotus Domino HTTP password (R4), and SHA-1 hash formats. LM (LAN Manager) plus appending and prepending

V. SECURITYJOBS LIST SUMMARY
----------------------------
1. ezmlm warning (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370671

2. [SJ-JOB] Security Architect, Basel, CH (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370541

3. [SJ-JOB] Information Assurance Engineer, San Marcos,... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370532

4. [SJ-JOB] Security Engineer, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370482

5. [SJ-RESUME] Jr. Security Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370476

6. [SJ-JOB] Quality Assurance, Los Gatos, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370471

7. [SJ-JOB] Account Manager, Boston, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370470

8. [SJ-JOB] Technical Writer, Capital Federal, AR (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370450

9. [SJ-JOB] Security Auditor, San Jose, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370434

10. [SJ-JOB] Sr. Security Analyst, San Jose, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370428

11. [SJ-JOB] Sr. Security Analyst, Boise, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370426

12. [SJ-RESUME] Incident Handler (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370425

13. [SJ-RESUME] Forensics Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370422

14. [SJ-JOB] Developer, San Marcos, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370417

15. [SJ-JOB] Security Engineer, Denver, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370416

16. [SJ-RESUME] Sales Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370410

17. [SJ-JOB] Security Engineer, Basel, CH (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370404

18. [SJ-RESUME] Manager, Information Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370401

19. [SJ-JOB] Security Auditor, Los Gatos, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370396

20. [SJ-JOB] Sr. Security Analyst, Toronto, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370395

21. [SJ-JOB] Security Product Manager, San Diego, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370387

22. [SJ-JOB] Sales Engineer, 3 Openings - No Mid-West/ D... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370371

23. [SJ-RESUME] Security System Administrator (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370370

24. [SJ-JOB] Information Assurance Analyst, McLean, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370367

25. [SJ-RESUME] Security Consultant (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370345

26. [SJ-JOB] Quality Assurance, Portland, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370328

27. [SJ-JOB] Sr. Security Analyst, Torrance, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370327

28. [SJ-RESUME] CSO (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370306

29. [SJ-RESUME] Developer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370287

30. [SJ-RESUME] Sr. Security Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370279

31. [SJ-RESUME] VP of Regional Sales (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370254

32. [SJ-JOB] Developer, Torrance, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370240

33. [SJ-JOB] Security Architect, Portland, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370226

34. [SJ-JOB] Security Product Manager, Portland, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370223

35. [SJ-JOB] Application Security Engineer, Boston (flex... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370222

36. [SJ-JOB] Security Researcher, Bay Area, CA, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370082

37. [SJ-JOB] Sales Engineer, Bay Area, CA, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370077

38. [SJ-JOB] Security Director, Washington D.C, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370076

39. [SJ-JOB] Application Security Engineer, Redwood Shor... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/370075

VI. INCIDENTS LIST SUMMARY
--------------------------
1. SSH login attempts: tcpdump packet capture (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/370752

2. Anyone else seeing SSH scans? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/370663

3. SSH attacks? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/370595

4. SSHd spider attempts (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/370592

5. FW: [Intrusions] Linux SSH scanning - test/guest (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/370488

6. About SSH scanning (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/370354

7. New Virus / Trojan ? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/370101

VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Problem with format string exploit dev in FreeBSD 5.... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/370609

2. Problem with format string exploit dev in FreeBSD 5... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/370608

VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. ezmlm warning (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/370651

2. ISA/VPN comparison (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/370560

3. Microsoft to release out-of-cycle patch (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/370388

4. SecurityFocus Microsoft Newsletter #199 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/370301

5. Windows Update v5 and XPSP2RC2 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/370300

6. Proxy Server/ISA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/370135

IX. SUN FOCUS LIST SUMMARY
--------------------------
1. How to Restrict a user, not a root, Login to the Co... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/370700

2. trouble setting up routing (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/370698

3. Has anyone been able to get a jabber client (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/370277

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. SSO on Linux (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/370342

XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XII. SPONSOR INFORMATION
-----------------------

This Issue is Sponsored By: SecurityFocus

http://www.securityfocus.com/rss/index.shtml

------------------------------------------------------------------------