SecurityFocus Newsletter #262

Peter Laborge <[email protected]> 17 Aug 2004 21:27:21 -0000

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #262
------------------------------

This issue sponsored by: SafeNet

FREE Network Security Webinar - How to implement IPSec security into VPN
appliances

New threats and vulnerabilities require new high-performance IPSec VPN
solutions for network protection. Join the security experts from SafeNet on
August 26 at 1:00 PM (Eastern), and learn how to successfully integrate
IPSec security into VPN processors and appliances to provide powerful yet
cost-effective VPN solutions for your customers.
Register now:

http://www.securityfocus.com/sponsor/SafeNet_sf-news_040817

------------------------------------------------------------------------
I. FRONT AND CENTER
1. Examining a Public Exploit, Part 1
2. Detecting Worms and Abnormal Activities with NetFlow, Part 1
3. Big Brother's Last Mile
4. The Panacea of Information Security
II. BUGTRAQ SUMMARY
1. Moodle 'post.php' Cross-Site Scripting Vulnerability
2. PluggedOut Blog Blog_Exec.PHP Cross-Site Scripting Vulnerabi...
3. RhinoSoft Serv-U FTP Server Default Administration Account V...
4. Linux Kernel Unspecified chown Inode Time Vulnerability
5. Linux Kernel Unspecified Signal Denial Of Service Vulnerabil...
6. AOL Instant Messenger Away Message Remote Buffer Overflow Vu...
7. Xine-Lib Remote Buffer Overflow Vulnerability
8. YaPiG Remote Server-Side Script Execution Vulnerability
9. Linux Kernel Unspecified USB Vulnerability
10. PHPBB Fetch All Common Script SQL Injection Vulnerability
11. PluggedOut Blog Calendar Module Cross-Site Scripting Vulnera...
12. PHPGroupWare Plaintext Cookie Authentication Credentials Inf...
13. Bradley Chapman Tabbrowser Preferences (TBP) Mozilla Extensi...
14. Microsoft Windows XP SP2 Released - Multiple Vulnerabilities...
15. GNU CFEngine AuthenticationDialogue Remote Heap Based Buffer...
16. GNU CFEngine AuthenticationDialogue Remote Denial Of Service...
17. Microsoft Windows 2000/XP CRL File Failed Integrity Check De...
18. Microsoft Exchange Outlook Web Access HTTP Response Splittin...
19. Symantec Clientless VPN Gateway 4400 Series Multiple Vulnera...
20. Apple Mac OS X 10.3.5 Released - Multiple Vulnerabilities Fi...
21. ServerMask Improper Header Anonymization Weakness
22. VentaFax System Tray Application Local Privilege Escalation ...
23. HP-UX Process Resource Manager Potential Data Corruption Vul...
24. Sygate Secure Enterprise Enforcer Unauthenticated Broadcast ...
25. Sygate Secure Enterprise Remote Denial Of Service Vulnerabil...
26. Sygate Secure Enterprise Enforcer Remote Denial Of Service V...
27. Sun Solaris XDMCP Unspecified Denial Of Service Vulnerabilit...
28. Genova GeNUGate Multiple Unspecified Denial Of Service Vulne...
29. Multiple Vendor Graphics Driver Large JPEG Processing Remote...
30. WIDCOMM Bluetooth Communication Software Multiple Unspecifie...
31. Internet Security Systems BlackICE PC Protection Firewall.IN...
32. Shuttle FTP Suite TFTP Server Directory Traversal Vulnerabil...
33. Simple Form Unauthorized Mail Relay Vulnerability
34. Clearswift MIMEsweeper For Web Directory Traversal Vulnerabi...
35. Moodle Unspecified Text Strings Vulnerability
36. IceWarp Web Mail Multiple Undisclosed Remote Vulnerabilities
37. KDE Konqueror Cross-Domain Frame Loading Vulnerability
38. KDE Insecure Temporary Directory Symlink Vulnerability
39. KDE DCOPServer Insecure Temporary File Creation Vulnerabilit...
40. Nokia IPSO Unspecified Remote Denial of Service Vulnerabilit...
41. Mercantec Softcart CGI Buffer Overflow Vulnerability
42. MapInfo Discovery Multiple Remote Vulnerabilities
43. Stefan Westerfeld ARTS Unspecified Insecure Temporary File C...
44. Mutt PGP/GnuPG Verified Email Signature Spoofing Vulnerabili...
45. Microsoft Windows Internet Connection Firewall Filter Bypass...
46. Adobe Acrobat Reader Shell Metacharacter Remote Arbitrary Co...
47. Adobe Acrobat Reader For Unix UUDecode Buffer Overflow Vulne...
48. Keene Digital Media Server Directory Traversal and Authentic...
49. RealNetwork RealPlayer Unspecified Remote Vulnerability
50. Netgear DG834G Zebra Process Default Account Password Vulner...
51. Kerio Mailserver Embedded HTTP Server Multiple Unspecified V...
52. Clearswift MAILsweeper For SMTP PowerPoint Files Denial of S...
53. Rsync Sanitize_path Function Module Path Escaping Vulnerabil...
54. HanSoft 4tH Unspecified Vulnerability
55. Clearswift MAILsweeper for SMTP Archive File Filtering Bypas...
56. Sympa List Creation Authentication Bypass Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Sluggish movement on power grid cyber security
2. U.S. tackles Emergency Alert System insecurity
3. Wardriving guilty plea in Lowe's wi-fi case
4. UK police issue 'vicious' Trojan alert
5. UK scientists roll out Wi-Fi proof wallpaper
6. Minnesota teen pleads guilty to unleashing Blaster variant
IV. SECURITYFOCUS TOP 6 TOOLS
1. Pads 1.1
2. IDS Policy Manager v1.4.1
3. cenfw 0.3b
4. My Password Manager 0.1
5. Web Audit Library (WAL) 0.3
6. zigstack 5
V. SECURITYJOBS LIST SUMMARY
1. [SJ-JOB] Security Auditor, San Antonio, US (Thread)
2. [SJ-JOB] Management, Herndon, US (Thread)
3. [SJ-JOB] Sr. Security Analyst, Cleveland, US (Thread)
4. [SJ-JOB] Director, Information Security, Denver, US (Thread)
5. [SJ-JOB] Management, Washington DC, US (Thread)
6. [SJ-JOB] Sales Engineer, Atlanta, US (Thread)
7. [SJ-JOB] Security Consultant, Paramus and/or Asbury ... (Thread)
8. [SJ-JOB] Account Manager, Fort Lauderdale, Orlando, ... (Thread)
9. [SJ-JOB] Security Engineer, New York, US (Thread)
10. [SJ-JOB] Security Consultant, Kamloops, CA (Thread)
11. [SJ-JOB] Security Engineer, Baltimore, US (Thread)
12. [SJ-JOB] Sr. Security Engineer, Baltimore, US (Thread)
13. [SJ-JOB] Application Security Engineer, New York, US (Thread)
14. [SJ-JOB] Developer, Arlington, US (Thread)
15. [SJ-JOB] Forensics Engineer, Houston, US (Thread)
16. [SJ-JOB] Security Consultant, UK, GB (Thread)
17. [SJ-JOB] Forensics Engineer, New York, US (Thread)
18. [SJ-JOB] Security Architect, Baltimore, US (Thread)
19. [SJ-JOB] Security Consultant, Chicago, US (Thread)
20. [SJ-JOB] Jr. Security Analyst, New York, US (Thread)
21. [SJ-JOB] Developer, Cupertino, US (Thread)
22. [SJ-JOB] Security Consultant, Cupertino, US (Thread)
23. [SJ-JOB] Security Engineer, Reston, US (Thread)
24. [SJ-JOB] Sales Engineer, Hartford, US (Thread)
25. [SJ-JOB] Security Consultant, UK Wide, GB (Thread)
26. [SJ-JOB] Security Consultant, DC area, US (Thread)
27. [SJ-JOB] Technical Writer, Cupertino, US (Thread)
28. [SJ-JOB] Sr. Security Analyst, Torrance, US (Thread)
29. [SJ-JOB] Developer, Omaha, US (Thread)
30. [SJ-JOB] Sr. Security Engineer, New York, US (Thread)
31. [SJ-JOB] Security Engineer, Ft Lee, US (Thread)
32. [SJ-JOB] Security System Administrator, Ft. Lee, US (Thread)
33. [SJ-JOB] Account Manager, Boston, US (Thread)
34. [SJ-JOB] Account Manager, Atlanta, US (Thread)
35. [SJ-JOB] Security Consultant, Boston, US (Thread)
36. [SJ-JOB] Security Auditor, Ft Lauderdale, US (Thread)
37. [SJ-JOB] Auditor, Minneapolis, US (Thread)
38. [SJ-JOB] Sales Engineer, San Francisco, US (Thread)
39. [SJ-JOB] Account Manager, George Town, KY (Thread)
40. [SJ-RESUME] Security Consultant (Thread)
41. [SJ-RESUME] Sr. Security Analyst (Thread)
42. [SJ-RESUME] Security Researcher (Thread)
43. [SJ-RESUME] Manager, Information Security (Thread)
44. [SJ-JOB] Security Engineer, Santa Monica, US (Thread)
45. [SJ-RESUME] Security Engineer (Thread)
46. [SJ-JOB] Management, White River Junction, US (Thread)
47. [SJ-JOB] Compliance Officer, Whitehouse Station, US (Thread)
48. [SJ-JOB] Developer, Redmond, US (Thread)
49. [SJ-JOB] Sr. Security Engineer, Lombard (Chicago), U... (Thread)
50. [SJ-JOB] Sales Engineer, New York, US (Thread)
51. [SJ-JOB] Security Consultant, Maidenhead, GB (Thread)
52. [SJ-JOB] Director, Information Security, Whitehouse ... (Thread)
53. [SJ-JOB] Application Security Engineer, Chantilly, U... (Thread)
VI. INCIDENTS LIST SUMMARY
1. Snort signatures for rxbot / rbot.gl (Thread)
2. New SF Article: Network Analysis of a Public Exploit... (Thread)
3. Possible new Korgo variant. WAS: New SDBot variant (Thread)
4. New SDBot variant (Thread)
5. e-crime and computer evidence conference - CFP remin... (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. ISS BlackIce Server Protect Unprivileged User Attack (Thread)
2. Metasploit Framework v2.2 (with SDK) (Thread)
3. [Full-Disclosure] ISS BlackIce Server Protect Unpriv... (Thread)
4. CORE-2004-0705: Vulnerabilities in PuTTY and PSCP (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Windows 2000 Administrator lockout (Thread)
2. most avtive attack type (Thread)
3. RE : most avtive attack type (Thread)
4. Article Announcement: Redmond's Salvation (Thread)
5. SecurityFocus Microsoft Newsletter #201 (Thread)
IX. SUN FOCUS LIST SUMMARY
1. [ID 800047 auth.crit] fatal: monitor_read: unsupport... (Thread)
2. Password recovery (Thread)
3. cant block root login (Thread)
4. Réf. : [ID 800047 auth.crit] fatal: monitor_read: un... (Thread)
X. LINUX FOCUS LIST SUMMARY
1. can Hopster traffic be blocked? (Thread)
2. LIDS 1.2.2rc2 for Linux kernel 2.4.27 released (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Examining a Public Exploit, Part 1
By Don Parker

The purpose of this article is to analyze a public exploit in a lab
environment, see the alerts generated by an intrusion detection system, and
then do some packet analysis of the malicious binary in order to better
understand it.

http://www.securityfocus.com/infocus/1795

2. Detecting Worms and Abnormal Activities with NetFlow, Part 1
By Yiming Gong

This paper discusses the use of NetFlow, a traffic profile monitoring
technology available on many routers, for use in the early detection of
worms, spammers, and other abnormal network activity in large enterprise
networks and service providers.

http://www.securityfocus.com/infocus/1796

3. Big Brother's Last Mile
By Mark Rasch

The FCC's new ruling on broadband wiretaps will force customers to pay for
the privilege of making the Internet less secure.

http://www.securityfocus.com/columnists/261

4. The Panacea of Information Security
By Jason Miller

Step away from all the vendor hype. The one device that will always be the
best tool for information security is a competent security professional.

http://www.securityfocus.com/columnists/260

II. BUGTRAQ SUMMARY
-------------------
1. Moodle 'post.php' Cross-Site Scripting Vulnerability
BugTraq ID: 10884
Remote: Yes
Date Published: Aug 06 2004
Relevant URL: http://www.securityfocus.com/bid/10884
Summary:
It is reported that Moodle is vulnerable to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and would allow for theft of cookie-based authentication credentials or other attacks.

Versions of Moodle prior to 1.3.4 are reported susceptible to this vulnerability.

2. PluggedOut Blog Blog_Exec.PHP Cross-Site Scripting Vulnerabi...
BugTraq ID: 10885
Remote: Yes
Date Published: Aug 07 2004
Relevant URL: http://www.securityfocus.com/bid/10885
Summary:
PluggedOut Blog is reported prone to a cross-site scripting vulnerability.

This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site. This code execution would occur in the security context of the site hosting the vulnerable software.

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

3. RhinoSoft Serv-U FTP Server Default Administration Account V...
BugTraq ID: 10886
Remote: No
Date Published: Aug 08 2004
Relevant URL: http://www.securityfocus.com/bid/10886
Summary:
It is reported that the RhinoSoft Serv-U FTP server has a default administration account that is used to authenticate to the site maintenance interface.

The weak account can be used to log into the site maintenance interface on the loopback interface only, and to create user accounts. An ftp user account created with execute rights, may permit a local attacker to execute arbitrary binaries in the context of the vulnerable server.

4. Linux Kernel Unspecified chown Inode Time Vulnerability
BugTraq ID: 10887
Remote: No
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10887
Summary:
An unspecified vulnerability has been announced in the Linux Kernel implementation of the chown(2) system call. This issue is related to how inode time data is updated by the system call. The impact is not known at this time, though it is speculated that this could affect system integrity.

5. Linux Kernel Unspecified Signal Denial Of Service Vulnerabil...
BugTraq ID: 10888
Remote: No
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10888
Summary:
An unspecified denial of service vulnerability has been reported to exist in the Linux Kernel. This issue could occur when signals are handled by the kernel. Further details are not available at this time.

6. AOL Instant Messenger Away Message Remote Buffer Overflow Vu...
BugTraq ID: 10889
Remote: Yes
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10889
Summary:
AOL Instant Messenger is reported prone to a remote buffer overflow vulnerability when processing a malformed 'Away' message. This vulnerability may allow a remote attacker to execute arbitrary code on a vulnerable computer to gain unauthorized access.

AOL Instant Messenger versions 5.5.3595 and 5.5 are reported vulnerable to this issue, however, other versions may be affected as well.

7. Xine-Lib Remote Buffer Overflow Vulnerability
BugTraq ID: 10890
Remote: Yes
Date Published: Aug 08 2004
Relevant URL: http://www.securityfocus.com/bid/10890
Summary:
It is reported that the xine media library is affected by a remote buffer overflow vulnerability. This issue can allow a remote attacker to gain unauthorized access to a vulnerable computer.

xine-lib rc-5 and prior versions are reportedly affected by this issue. xine versions 0.99.2 and prior are also vulnerable.

8. YaPiG Remote Server-Side Script Execution Vulnerability
BugTraq ID: 10891
Remote: Yes
Date Published: Aug 08 2004
Relevant URL: http://www.securityfocus.com/bid/10891
Summary:
A vulnerability is reported to exist in YaPiG that may allow a remote attacker to execute malicious scripts on a vulnerable system. This issue exists due to a lack if sanitization of user-supplied data.

It is reported that an attacker may be able to upload content that will be saved on the server with a '.php' extension. When this file is requested by the attacker, the contents of the file will be parsed and executed by the PHP engine, rather than being sent.

Successful exploitation of this issue may allow an attacker to execute malicious script code on a vulnerable server.

Version 0.92b is reported vulnerable to this issue. Other versions may also be affected.

9. Linux Kernel Unspecified USB Vulnerability
BugTraq ID: 10892
Remote: No
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10892
Summary:
The Linux Kernel implementation of USB is reported prone to an unspecified vulnerability. The impact is not known at this time, though it is speculated that this vulnerability could affect system stability.

10. PHPBB Fetch All Common Script SQL Injection Vulnerability
BugTraq ID: 10893
Remote: Yes
Date Published: Aug 07 2004
Relevant URL: http://www.securityfocus.com/bid/10893
Summary:
It is reported that phpBB Fetch All is susceptible to an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input before using it in an SQL query.

The problem presents itself when malicious SQL statements are passed as a value for the 'forum_id' argument in the 'common.php' script. The script uses this argument without sanitization in an SQL query.

The successful exploitation of this vulnerability depends on the implementation of the web application that includes phpBB Fetch All as a component. It may or may not be possible to effectively pass malicious SQL statements to the underlying function.

Versions prior to 2.0.12 are reported to be affected.

11. PluggedOut Blog Calendar Module Cross-Site Scripting Vulnera...
BugTraq ID: 10894
Remote: Yes
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10894
Summary:
The Blog 'calendar' module does not sufficiently sanitize data supplied via URI parameters, making it prone to cross-site scripting attacks. This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site.

12. PHPGroupWare Plaintext Cookie Authentication Credentials Inf...
BugTraq ID: 10895
Remote: Yes
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10895
Summary:
PHPGroupWare is a freely available, open source groupware system written in PHP. It is distributed and maintained by the PHPGroupWare project.

PHPGroupWare is reported to contain a plaintext cookie authentication credentials information disclosure vulnerability.

If the web administration of PHPGroupWare is not conducted over an encrypted link, an attacker with the ability to sniff network traffic could easily retrieve these passwords. This may aid the attacker in further system compromise.

Versions prior to 0.9.16.002 are reported susceptible to this vulnerability.

13. Bradley Chapman Tabbrowser Preferences (TBP) Mozilla Extensi...
BugTraq ID: 10896
Remote: Yes
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10896
Summary:
Bradley Chapman Tabbrowser Preferences (TBP) is reported prone to an information disclosure vulnerability. The issue is reported to exist if certain TBP options are selected. When a URL is typed into the browser address bar, the new page is loaded in a new tab. The information disclosure occurs because the site in the new tab will receive a HTTP referrer URL of the site in the previous tab even though the domains are not related.

14. Microsoft Windows XP SP2 Released - Multiple Vulnerabilities...
BugTraq ID: 10897
Remote: Yes
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10897
Summary:
Microsoft has released Windows XP Service Pack 2. This release addresses a number of bugs, including some potential security vulnerabilities and weaknesses. Many of the bugs that have been fixed in this Service Pack may have a security impact that may be exploited by a local or remote attacker. Possible consequences include privilege escalation, lowered security settings, denial of service attacks, policy bypass, and remote code execution. The release also includes various security enhancements and roll-ups for previous security updates.

15. GNU CFEngine AuthenticationDialogue Remote Heap Based Buffer...
BugTraq ID: 10899
Remote: Yes
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10899
Summary:
GNU cfengine cfservd is reported prone to a remote heap-based buffer overrun vulnerability. The vulnerability presents itself in the cfengine cfservd AuthenticationDialogue() function.

The issue exists due to a lack of sufficient boundary checks performed on challenge data that is received from a client.

Because the size of the buffer, the size of data copied in a memcpy() operation, and the data copied are all controlled by the attacker, a remote attacker may likely exploit this condition to corrupt in-line heap based memory management data.

cfservd employs an IP based access control method. This access control must be bypassed prior to exploitation. This may hinder exploitation attempts.

This vulnerability is reported to affect versions 2.0.0 to 2.1.7p1 of cfengine cfservd.

16. GNU CFEngine AuthenticationDialogue Remote Denial Of Service...
BugTraq ID: 10900
Remote: Yes
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10900
Summary:
GNU cfengine cfservd is reported prone to a remote denial of service vulnerability. The vulnerability presents itself in the cfengine cfservd AuthenticationDialogue() function that is responsible for processing SAUTH commands and also performing RSA based authentication.

The vulnerability presents itself because return values for several statements within the AuthenticationDialogue() function are not checked.

This memcpy() operation based on the return values will fail resulting in a daemon crash. A remote attacker may exploit this vulnerability to crash the affected daemon effectively denying service to legitimate users.

cfservd employs an IP based access control method (AllowConnectionsFrom). This access control must be bypassed prior to exploitation. This may hinder exploitation attempts.

This vulnerability is reported to affect versions 2.0.0 to 2.1.7p1 of cfengine cfservd.

17. Microsoft Windows 2000/XP CRL File Failed Integrity Check De...
BugTraq ID: 10901
Remote: No
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10901
Summary:
It is reported that Microsoft Windows 2000/XP does not verify the integrity of CRL (Certificate Revocation Lists) files prior to accepting them as valid.

A local attacker, who has sufficient privileges to write to a CRL file, may exploit this vulnerability to deny X.509 based services to legitimate users.

This BID will be updated as further analysis of this vulnerability is completed.

18. Microsoft Exchange Outlook Web Access HTTP Response Splittin...
BugTraq ID: 10902
Remote: Yes
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10902
Summary:
Microsoft Exchange Outlook Web Access (OWA) is prone to HTTP response splitting attacks.

This issue could permit hostile script to be injected into client sessions, which could gain access to properties of the OWA server and Web pages hosted on the site.

It is noted that the attacker must authenticate to OWA to be in a position to exploit this issue. If successfully exploited, this could allow for various attacks, such as session hijacking, and content spoofing. This issue could also be used to exploit latent vulnerabilities in Web client software.

19. Symantec Clientless VPN Gateway 4400 Series Multiple Vulnera...
BugTraq ID: 10903
Remote: Yes
Date Published: Aug 06 2004
Relevant URL: http://www.securityfocus.com/bid/10903
Summary:
Multiple vulnerabilities have been addressed in Symantec Clientless VPN Gateway 4400 Series.

The issues include multiple vulnerabilities related to the ActiveX and HTML file browser, cross-site scripting vulnerabilities in the end user interface, and a vulnerability in the end user interface that will allow an unauthorized user to change another user's single signon information.

20. Apple Mac OS X 10.3.5 Released - Multiple Vulnerabilities Fi...
BugTraq ID: 10904
Remote: Yes
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10904
Summary:
Apple has released Mac OS X 10.3.5. This release addresses a number of security vulnerabilities.

The following new issues were reported:

A remote vulnerability in the Apple Safari Web browser may allow a remote attacker to steal potentially sensitive form data.

A denial of service vulnerability is identified in the operating system that may allow a remote attacker to disable network traffic.

These issues have been addressed in Mac OS X 10.3.5. Individual BIDs will be created upon further analysis.

21. ServerMask Improper Header Anonymization Weakness
BugTraq ID: 10905
Remote: Yes
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10905
Summary:
It is reported that ServerMask contains a weakness that allows servers to be identified as IIS, even when the product is functioning as advertised.

Unique traits of IIS servers are not properly filtered or altered in any way. This allows an attacker to remotely discern the type of web server, even in the presence of the ServerMask software.

ServerMask versions 2.2 and prior are reported to contain this weakness.

22. VentaFax System Tray Application Local Privilege Escalation ...
BugTraq ID: 10906
Remote: No
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10906
Summary:
It is reported that a privilege escalation vulnerability exists in the VentaFax System Tray application. The issue is due to the software starting with SYSTEM privileges, to enable access to the modem hardware, and subsequently failing to drop the privileges.

Although only VentaFax version 5.4 is reported vulnerable, it is likely that other versions are prone as well.

23. HP-UX Process Resource Manager Potential Data Corruption Vul...
BugTraq ID: 10907
Remote: No
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10907
Summary:
It is reported that HP-UX Process Resource Manager (PRM) is prone to a potential data corruption vulnerability. This issue affects the integrity of a computer and may allow an attacker to carry out denial of service attacks.

Further information about this vulnerability is currently unavailable. This BID will be updated as more information becomes available.

All computers running PRM C.02.01[.01] and prior and WLM versions A.02.01 and prior are affected by this issue.

24. Sygate Secure Enterprise Enforcer Unauthenticated Broadcast ...
BugTraq ID: 10908
Remote: Yes
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10908
Summary:
It is reported that the Enforcer component of Secure Enterprise is prone to a vulnerability that may allow unauthenticated broadcast traffic to bypass filtering and reach computers in the internal network.

Sygate Enforcer versions prior to 3.5MR1 are reported prone to this issue.

25. Sygate Secure Enterprise Remote Denial Of Service Vulnerabil...
BugTraq ID: 10909
Remote: Yes
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10909
Summary:
Sygate Secure Enterprise is reported prone to a denial of service vulnerability. The issue is reported to exist due to the weak methods used for communication between the agents and the server.

It is reported that an attacker who can capture a valid Sygate Secure Enterprise protocol session, may replay this session continuously and in doing so exhaust resources on the Sygate Secure Enterprise server.

All versions of Sygate Secure Enterprise prior to 3.5MR3 are reported to be prone to this vulnerability.

26. Sygate Secure Enterprise Enforcer Remote Denial Of Service V...
BugTraq ID: 10910
Remote: Yes
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10910
Summary:
Sygate Enforcer is reported to be susceptible to a remote denial of service vulnerability.

Malformed UDP packets can be broadcast on a local network segment, and reportedly crash all affected applications that receive it. These UDP discovery packets can also be send to unicast addresses, and can therefore be routed to remote networks to crash targeted computers. The origin of these packets could also likely be spoofed, hiding the source of the attack.

Sygate Enforcer versions 4.0 and prior are reported to be affected by this vulnerability.

27. Sun Solaris XDMCP Unspecified Denial Of Service Vulnerabilit...
BugTraq ID: 10911
Remote: Yes
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10911
Summary:
Sun Solaris xdm(1) daemon is reported prone to an unspecified denial of service vulnerability handling malformed XDMCP UDP packets.

UDP packets to port 177 of affected computers running a vulnerable instance of xdm(1) are reportedly capable of crashing xdm(1). The cause of this crash is unspecified. IP based access controls for xdm(1) are reportedly unable to block attackers from exploiting this vulnerability.

This BID will be updated as further information is disclosed.

Solaris 7, 8, and 9 for both SPARC, and x86 platforms are reported vulnerable.

28. Genova GeNUGate Multiple Unspecified Denial Of Service Vulne...
BugTraq ID: 10912
Remote: Yes
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10912
Summary:
It is reported that GeNUGate is prone to two unspecified denial of service vulnerabilities.

The first vulnerability is reported in the ISAKMP (Internet Security Association and Key Management Protocol) process. It is reported that an attacker sending malicious packets to the ISAKMP process can delete VPN security associations. This may be related to BID 10496.

The second vulnerability is reported in web applications embedded in GeNUGate utilizing OpenSSL. An unspecified OpenSSL denial of service vulnerability can reportedly crash the applications.

A remote attacker may exploit these vulnerabilities to deny service to legitimate users of the affected application.

29. Multiple Vendor Graphics Driver Large JPEG Processing Remote...
BugTraq ID: 10913
Remote: Yes
Date Published: Aug 10 2004
Relevant URL: http://www.securityfocus.com/bid/10913
Summary:
Multiple vendor graphics device drivers are reported prone to a denial of service vulnerability. The issue is alleged to manifest when a malicious JPEG image is rendered in a browser on an affected platform.

It is reported that this issue exists in the Intel VGA display drivers, it is also reported that the vulnerability is present in ATI display drivers. The discoverer of this issue reports that the issue may be triggered on a Microsoft Windows XP platform (SP1 & SP2), using Mozilla Firefox or Microsoft Internet Explorer.

This BID will be updated as further analysis of this vulnerability is completed.

30. WIDCOMM Bluetooth Communication Software Multiple Unspecifie...
BugTraq ID: 10914
Remote: Yes
Date Published: Aug 11 2004
Relevant URL: http://www.securityfocus.com/bid/10914
Summary:
WIDCOMM Bluetooth Communication Software is reported prone to multiple unspecified remote buffer overflow vulnerabilities. These vulnerabilities exist due to insufficient boundary checks performed by the application.

It is reported that an unauthenticated remote attacker can trigger the overflow conditions by supplying malformed service requests.

Various devices from multiple vendors are thought to be affected by these issues, as they are implemented with WIDCOMM software. These issues have been verified by the researchers in BTStackServer version 1.3.2.7 and 1.4.2.10 running on Microsoft Windows XP and Windows 98. HP IPAQ 5450 running WinCE 3.0 with Bluetooth software version 1.4.1.03 is reported prone as well.

WIDCOMM Bluetooth Communication Software BTW & BT-CE/PPC 3.0 do not appear to be affected by these issues.

This BID will be updated when more information is available.

31. Internet Security Systems BlackICE PC Protection Firewall.IN...
BugTraq ID: 10915
Remote: No
Date Published: Aug 11 2004
Relevant URL: http://www.securityfocus.com/bid/10915
Summary:
It is reported that BlackICE PC Protection is prone to a local buffer overrun when handling excessive input in certain configuration directives parsed from the firewall.ini file included with the software.

It is reported that when the system is restarted, and the affected software reads the malicious firewall.ini file both the blackice.exe and blackd.exe executables will crash.

32. Shuttle FTP Suite TFTP Server Directory Traversal Vulnerabil...
BugTraq ID: 10916
Remote: Yes
Date Published: Aug 11 2004
Relevant URL: http://www.securityfocus.com/bid/10916
Summary:
It is reported that the Shuttle FTP Suite TFTP server is susceptible to a directory traversal vulnerability.

This vulnerability allows a remote attacker to read and write files outside of the TFTP document root directory. An attacker may read and write files with the privileges of the TFTP server process.

An attacker may retrieve or overwrite sensitive files on the hosting computer, potentially aiding them in further system compromise.

Version 3.2 has been reported susceptible to this vulnerability. Other versions may also be affected.

33. Simple Form Unauthorized Mail Relay Vulnerability
BugTraq ID: 10917
Remote: Yes
Date Published: Aug 09 2004
Relevant URL: http://www.securityfocus.com/bid/10917
Summary:
Simple Form is prone to a vulnerability that may let the application be abused as a mail relay. This could be exploited by spammers or other malicious parties.

34. Clearswift MIMEsweeper For Web Directory Traversal Vulnerabi...
BugTraq ID: 10918
Remote: Yes
Date Published: Aug 11 2004
Relevant URL: http://www.securityfocus.com/bid/10918
Summary:
Clearswift MIMEsweeper For Web is reported prone to a directory traversal vulnerability due to insufficient sanitization of user-supplied data.

To carry out an attack an attacker may specify a relative path to a target file in a GET request to the vulnerable server, directory traversal character sequences may be supplied as a part of the request to escape the web root.

35. Moodle Unspecified Text Strings Vulnerability
BugTraq ID: 10919
Remote: Yes
Date Published: Aug 11 2004
Relevant URL: http://www.securityfocus.com/bid/10919
Summary:
It is reported that Moodle contains a possible vulnerability related to strings in Moodle texts.

Further information is unknown at this time. This BID will be updated as further information is disclosed.

Versions prior to 1.3.4 are reported susceptible to this vulnerability.

36. IceWarp Web Mail Multiple Undisclosed Remote Vulnerabilities
BugTraq ID: 10920
Remote: Yes
Date Published: Aug 11 2004
Relevant URL: http://www.securityfocus.com/bid/10920
Summary:
IceWarp Web Mail is reported prone to multiple unspecified vulnerabilities. It is reported that these issues may be exploited by a remote attacker to conduct SQL Injection, Account Manipulation, Cross-site Scripting, Information disclosure, Local file system access, and other attacks. Few details regarding the specific vulnerabilities are known.

This BID will be updated as further details regarding these vulnerabilities are released.

37. KDE Konqueror Cross-Domain Frame Loading Vulnerability
BugTraq ID: 10921
Remote: Yes
Date Published: Aug 11 2004
Relevant URL: http://www.securityfocus.com/bid/10921
Summary:
Konqueror reported prone to a cross-domain frame loading vulnerability. It is reported that if the name of a frame rendered in a target site is known, then an attacker may potentially render arbitrary HTML in the frame of the target site.

An attacker may exploit this vulnerability to spoof an interface of a trusted web site.

All versions of KDE up to KDE 3.2.3 are vulnerable to this issue.

38. KDE Insecure Temporary Directory Symlink Vulnerability
BugTraq ID: 10922
Remote: No
Date Published: Aug 11 2004
Relevant URL: http://www.securityfocus.com/bid/10922
Summary:
KDE is reported to contain a temporary directory symlink vulnerability. This vulnerability is due to improper validation of the ownership of temporary directories.

Local attackers can cause KDE applications to fail, denying service to users, or to overwrite arbitrary files with the privileges of the target user. Privilege escalation may be possible.

Source patches have been made available by KDE to resolve this issue.

39. KDE DCOPServer Insecure Temporary File Creation Vulnerabilit...
BugTraq ID: 10924
Remote: No
Date Published: Aug 11 2004
Relevant URL: http://www.securityfocus.com/bid/10924
Summary:
KDEs DCOPServer is reported to contain an insecure temporary file creation vulnerability. This is due to the use of the mktemp() function.

Since temporary files are used by the DCOP daemon for authentication purposes, a local attacker may possibly exploit this vulnerability to compromise the account of a targeted user running KDE.

A local attacker may also possibly exploit this vulnerability to execute symbolic link file overwrite attacks. This may allow an attacker to overwrite arbitrary files with the privileges of the targeted user. Privilege escalation may also be possible using this method of attack.

KDE versions from 3.2.0 to 3.2.3 are reported susceptible to this vulnerability.

40. Nokia IPSO Unspecified Remote Denial of Service Vulnerabilit...
BugTraq ID: 10925
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10925
Summary:
An unspecified denial of service vulnerability is reported in the Nokia IPSO operating system. This issue can allow remote attacker to cause a vulnerable device to crash or hang, resulting in a denial of service condition. Further details regarding this issue are currently unknown, however as more information is made available this bid will be updated accordingly.

IPSO versions 3.5, 3.5.1, 3.6, 3.7, 3.7.1, and 3.8 are affected by this issue.

41. Mercantec Softcart CGI Buffer Overflow Vulnerability
BugTraq ID: 10926
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10926
Summary:
The Mercantec SoftCart CGI executable is prone to a remotely exploitable buffer overflow. This may allow code execution in the context of the hosting Web server.

This issue is known to affect version 4.00b on BSDi/4.3 systems, other releases may also be affected.

42. MapInfo Discovery Multiple Remote Vulnerabilities
BugTraq ID: 10927
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10927
Summary:
Multiple remote vulnerabilities are reported in MapInfo Discovery.

The first issue is reported to be an information disclosure vulnerability. An attacker may gain access to potentially sensitive error log information that could aid an attacker in further system compromise.

The second issue is reported to be a cross-site scripting vulnerability. The application fails to properly sanitize user-supplied URI argument data. This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site. This code execution would occur in the security context of the site hosting the vulnerable software. Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

The third issue is reported to be a plaintext password information disclosure vulnerability. An attacker with the ability to sniff network traffic could capture user and SQL database credentials.

The fourth issue is reported to be an administrative login authentication bypass vulnerability. An attacker with a regular user account on the application can gain administrative access.

MapInfo Discovery versions 1.0 and 1.1 are reported susceptible to these vulnerabilities.

43. Stefan Westerfeld ARTS Unspecified Insecure Temporary File C...
BugTraq ID: 10928
Remote: No
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10928
Summary:
aRts is reported prone to an unspecified insecure temporary file creation vulnerability. This issue may allow a local attacker to carry out a symbolic link attack.

This issue was reported in a SUSE advisory. Further information is not available at the moment. This BID will be updated as more information becomes available.

All versions of aRts are considered vulnerable to this issue.

44. Mutt PGP/GnuPG Verified Email Signature Spoofing Vulnerabili...
BugTraq ID: 10929
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10929
Summary:
It is reported that Mutt contains a vulnerability that allows attackers to send email that spoofs the look of a successfully verified PGP/GnuPG email message.

An attacker may potentially simulate the look of the PGP/GnuPG output that Mutt usually includes when processing signed email messages. If a user employs Mutt with a specific configuration, the attacker may make email messages look almost identical to a properly signed and verified email.

This may allow an attacker to create a message that falsifies a correctly verified PGP/GnuPG signature. This could allow an attacker to spoof email from trusted sources. This will likely greatly increase the effectiveness of social engineering attacks.

In the index mode, messages with signatures have the 's' flag. Verified signatures change to 'S'. Ensuring that messages have the proper attributes will aid in the mitigation of this vulnerability.

Versions 1.3.28 and 1.5.6 are reported affected by this vulnerability. Other versions are also likely affected.

45. Microsoft Windows Internet Connection Firewall Filter Bypass...
BugTraq ID: 10930
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10930
Summary:
It is reported that the Internet Connection Firewall is susceptible to a filter bypass vulnerability.

This issue presents itself during the boot process of Microsoft Windows operating systems.

This vulnerability allows packets to pass, possibly in violation of the firewall rules. By exploiting this vulnerability, a remote attacker may be able to make network connections to services protected by the firewall. This may open up avenues of attack that were thought to have been protected by the firewall, providing a false sense of security.

Windows XP Service Pack 2 is reported to fix this vulnerability.

46. Adobe Acrobat Reader Shell Metacharacter Remote Arbitrary Co...
BugTraq ID: 10931
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10931
Summary:
A remote code execution vulnerability is identified in Adobe Acrobat Reader. This issue may allow an attacker gain unauthorized access to a vulnerable computer.

Acrobat Reader is affected by a shell metacharacter command execution vulnerability. This issue exists due to insufficient sanitization of user-supplied data by Acrobat Reader for Unix and Linux platforms. Successful exploitation can allow an attacker to use a specially crafted file name to execute arbitrary commands and applications through the shell.

Adobe Acrobat Reader version 5.0 for Unix and Linux platforms is reported vulnerable to this issue. Acrobat Reader for Microsoft Windows platforms is not affected by this issue.

47. Adobe Acrobat Reader For Unix UUDecode Buffer Overflow Vulne...
BugTraq ID: 10932
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10932
Summary:
Acrobat Reader for Unix is reported to be susceptible to a buffer overflow vulnerability when handling UUEncoded data files.

This vulnerability presents itself when Acrobat Reader attempts to view a malicious UUEncoded file. Upon opening a file, Acrobat Reader automatically attempts to decode files that have been UUEncoded.

Successful exploitation could result in execution of arbitrary code in the context of the user opening the malicious file.

Adobe Acrobat for Unix platforms versions 5.05 and 5.06 have been reported vulnerable, version 5.0.9 is reported fixed. Other versions are likely vulnerable as well.

48. Keene Digital Media Server Directory Traversal and Authentic...
BugTraq ID: 10933
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10933
Summary:
It is reported that DMS is susceptible to a directory traversal vulnerability, and an administrative access authentication bypass vulnerability.

The directory traversal issue is due to insufficient sanitization of user-supplied data. An attacker may exploit this vulnerability in order to disclose web server readable files that exist outside of the web root on the vulnerable server.

The administrative access authentication bypass vulnerability is present when an attacker directly accesses the URI of the administrative script.

These vulnerabilities allow a remote attacker to administer the application, or retrieve potentially sensitive files, possibly aiding them in further system compromise.

Version 1.0.2 of the software is reported vulnerable to these issues. Other versions may also be affected.

49. RealNetwork RealPlayer Unspecified Remote Vulnerability
BugTraq ID: 10934
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10934
Summary:
It is reported that RealNetwork RealPlayer contains an unspecified vulnerability that allows for execution of arbitrary code in the context of the user running the player.

No further information is available at this time. This BID will be updated as further information is disclosed.

50. Netgear DG834G Zebra Process Default Account Password Vulner...
BugTraq ID: 10935
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10935
Summary:
It is reported that Netgear DG834G devices contain a default password for their Zebra process. Zebra is a dynamic routing daemon, and contains a telnet-accessible configuration shell.

It is reported that Zebra listens on both the WAN and the internal network interfaces.

By gaining administrative access to Zebra, an attacker has the ability to modify network routes on the device, possibly redirecting traffic or denying network service to legitimate users. They may also be able to exploit latent vulnerabilities in Zebra itself.

Due to code reuse, it is possible that other devices similar to this one are also affected.

51. Kerio Mailserver Embedded HTTP Server Multiple Unspecified V...
BugTraq ID: 10936
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10936
Summary:
Kerio MailServer version 6.0.1 has been released. This release addresses various unspecified security vulnerabilities in the embedded HTTP server implemented with the Kerio MailServer application. The cause and impact of these issues is currently unknown.

All versions of Kerio MailServer prior to 6.0.1 are considered vulnerable.

52. Clearswift MAILsweeper For SMTP PowerPoint Files Denial of S...
BugTraq ID: 10937
Remote: Yes
Date Published: Aug 13 2004
Relevant URL: http://www.securityfocus.com/bid/10937
Summary:
MAILsweeper for SMTP is reported prone to a remote denial of service vulnerability. This issue presents itself when the application processes malformed Microsoft PowerPoint files.

MAILsweeper for SMTP versions 4.3.14 and prior are considered vulnerable to this issue.

53. Rsync Sanitize_path Function Module Path Escaping Vulnerabil...
BugTraq ID: 10938
Remote: Yes
Date Published: Aug 12 2004
Relevant URL: http://www.securityfocus.com/bid/10938
Summary:
If an rsync server is installed as a daemon with a read/write enabled module without using the 'chroot' option, it is possible that a remote attacker could read/write files outside of the configured module path. Rsync does not properly sanitize the paths when not running with chroot. The problem exists in the 'sanitize_path' function.

This could potentially be exploited to execute arbitrary code by corrupting or place arbitrary files on the system. Destruction of data could also result, possibly causing a denial of service condition. Other attacks could also occur, depending on the attacker's motives.

54. HanSoft 4tH Unspecified Vulnerability
BugTraq ID: 10939
Remote: Unknown
Date Published: Aug 13 2004
Relevant URL: http://www.securityfocus.com/bid/10939
Summary:
An unspecified vulnerability is reported in the HanSoft 4tH compiler.

This vulnerability is reported to be fixed in version 3.4e-pre4.

No further information was reported. This BID will be updated as new information is disclosed.

55. Clearswift MAILsweeper for SMTP Archive File Filtering Bypas...
BugTraq ID: 10940
Remote: Yes
Date Published: Aug 13 2004
Relevant URL: http://www.securityfocus.com/bid/10940
Summary:
It is reported that MAILsweeper for SMTP does not filter malicious archives of various formats. The application does not detect malicious content or file names of archives contained in email. Some of the formats not detected by the application include 7ZIP, ACE, ARC, BH, BZIP2, HAP, HPK, IMG, PAK, RAR, and ZOO.

Successful exploitation may allow malicious code to be executed on client systems. Exploitation can only occur if a user executes a malicious attachment and malicious files must also bypass any local anti virus software.

MAILsweeper for SMTP versions prior to 4.3.15 are reported affected by this issue. This issue may be related to BID 8982 (Clearswift MAILsweeper for SMTP Zip Archive Filtering Bypass Vulnerability).

56. Sympa List Creation Authentication Bypass Vulnerability
BugTraq ID: 10941
Remote: Yes
Date Published: Aug 13 2004
Relevant URL: http://www.securityfocus.com/bid/10941
Summary:
Sympa is reported to be prone to an authentication bypass vulnerability when creating new mailing lists.

This vulnerability presents itself upon creating a new mailing list. The list master approval process could reportedly be skipped by an attacker.

An attacker may exploit this issue to create unauthorized mailing lists. This may possibly be used to forward UCE messages, or possibly other attacks.

Versions prior to 4.1.2 are reportedly affected by this vulnerability.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Sluggish movement on power grid cyber security
By: Kevin Poulsen

Industry cyber security standards fail to reach some of the most vulnerable components of the power grid.

http://www.securityfocus.com/news/9328

2. U.S. tackles Emergency Alert System insecurity
By: Kevin Poulsen

The FCC acknowledges that the government-mandated network that lets officials interrupt radio and television broadcasts in an emergency is vulnerable to electronic tampering.

http://www.securityfocus.com/news/9324

3. Wardriving guilty plea in Lowe's wi-fi case
By: Kevin Poulsen

Federal prosecutors say a network engineer convicted for checking his e-mail over a hardware store's wi-fi network is likely the first U.S. wardriving conviction.

http://www.securityfocus.com/news/9281

4. UK police issue 'vicious' Trojan alert
By: John Leyden, The Register

Britain's top cybercrime fighters have joined up with the banking industry today in warning of the latest attempt to defraud online banking customers.

http://www.securityfocus.com/news/9326

5. UK scientists roll out Wi-Fi proof wallpaper
By: Tony Smith, The Register

British boffins have developed wallpaper that blocks Wi-Fi traffic but still allows other wireless transmissions to pass through in a bid to prevent unauthorised access to sensitive data via the WLAN.

http://www.securityfocus.com/news/9320

6. Minnesota teen pleads guilty to unleashing Blaster variant
By: Gene Johnson, The Associated Press

http://www.securityfocus.com/news/9315

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Pads 1.1
By: Matt Shelton
Relevant URL: http://freshmeat.net/projects/pads/?branch_id=52504&release_id=169973
Platforms: Linux
Summary:

Pads (Passive Asset Detection System) is a signature-based detection engine used to passively detect network assets. It is designed to complement IDS technology by providing context to IDS alerts.

2. IDS Policy Manager v1.4.1
By: ActiveWorx
Relevant URL: http://www.activeworx.com/idspm/
Platforms: Windows 2000, Windows XP
Summary:

IDS Policy Manager - is a powerful way to modify the snort configuration and rule files. Some key features are: Graphical interface for easily manageability of snort rule and configuration files - Merge new official snort rules into existing rule files - Merge Whitehat (arachNIDS) rules into existing rule files - Make quick changes to snort rules - Easy to manage multiple sensors with multiple policy files - Upload policy files via FTP or SCP - Full support for all Snort 1.8 Preprocessors - Full support for all Snort 1.8 output processors - Easy to learn more information about a signature from popular databases such as - - - CVE, BugTraq, Mcafee, arachNIDS and custom URL's - Add rules easily by line, multiple lines or make your own custom signatures

3. cenfw 0.3b
By: Peter Robinson
Relevant URL: http://www.securegateway.org
Platforms: Linux, Windows 2000, Windows NT, Windows XP
Summary:

The Centron IPTables Firewall Gui is an object oriented, database driven, windows interface to linux IPtables firewall rules.

4. My Password Manager 0.1
By: alpha-one
Relevant URL: http://freshmeat.net/projects/mpm/?branch_id=52458&release_id=169763
Platforms: Os Independent
Summary:

My Password Manager is a light-weight password manager. The files are saved in an XML file format. Triple DES is used to encrypt these files. It also includes a random password generator.

5. Web Audit Library (WAL) 0.3
By: Roses Labs Innovations (RL+I)
Relevant URL: http://www.roseslabs.com/en/freesoftware.html#wal
Platforms: Python
Summary:

Web Audit Library (Wal) is a python module that provides a powerful and easy API for writing web applications assessment tools, similar to what Libwhisker does for Perl. Wal comes from the need of such a library for python. Writing web security tools using Wal is very straightforward. Wal provides the following features send/receive/analyze HTTP 0.9/1.0/1.1, HTML parser, cookie support, anti-IDS, decoders/encoders and much more...
Needs python 2.3 or later.

6. zigstack 5
By: Alexander 'xaitax' Hagenah
Relevant URL: http://xaitax.de
Platforms: Windows 2000, Windows NT, Windows XP
Summary:

hardening your tcp/ip stack (e.g. against dos-attacks) of windowsnt/2k/xp/2003-based workstations and servers.
new* incl. 7 new methods and remote-registry functions.

V. SECURITYJOBS LIST SUMMARY
----------------------------
1. [SJ-JOB] Security Auditor, San Antonio, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371858

2. [SJ-JOB] Management, Herndon, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371857

3. [SJ-JOB] Sr. Security Analyst, Cleveland, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371855

4. [SJ-JOB] Director, Information Security, Denver, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371854

5. [SJ-JOB] Management, Washington DC, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371846

6. [SJ-JOB] Sales Engineer, Atlanta, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371839

7. [SJ-JOB] Security Consultant, Paramus and/or Asbury ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371838

8. [SJ-JOB] Account Manager, Fort Lauderdale, Orlando, ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371833

9. [SJ-JOB] Security Engineer, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371705

10. [SJ-JOB] Security Consultant, Kamloops, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371704

11. [SJ-JOB] Security Engineer, Baltimore, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371658

12. [SJ-JOB] Sr. Security Engineer, Baltimore, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371657

13. [SJ-JOB] Application Security Engineer, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371656

14. [SJ-JOB] Developer, Arlington, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371655

15. [SJ-JOB] Forensics Engineer, Houston, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371654

16. [SJ-JOB] Security Consultant, UK, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371653

17. [SJ-JOB] Forensics Engineer, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371652

18. [SJ-JOB] Security Architect, Baltimore, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371651

19. [SJ-JOB] Security Consultant, Chicago, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371591

20. [SJ-JOB] Jr. Security Analyst, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371563

21. [SJ-JOB] Developer, Cupertino, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371531

22. [SJ-JOB] Security Consultant, Cupertino, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371528

23. [SJ-JOB] Security Engineer, Reston, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371527

24. [SJ-JOB] Sales Engineer, Hartford, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371522

25. [SJ-JOB] Security Consultant, UK Wide, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371520

26. [SJ-JOB] Security Consultant, DC area, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371519

27. [SJ-JOB] Technical Writer, Cupertino, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371516

28. [SJ-JOB] Sr. Security Analyst, Torrance, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371514

29. [SJ-JOB] Developer, Omaha, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371513

30. [SJ-JOB] Sr. Security Engineer, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371481

31. [SJ-JOB] Security Engineer, Ft Lee, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371479

32. [SJ-JOB] Security System Administrator, Ft. Lee, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371478

33. [SJ-JOB] Account Manager, Boston, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371475

34. [SJ-JOB] Account Manager, Atlanta, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371468

35. [SJ-JOB] Security Consultant, Boston, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371467

36. [SJ-JOB] Security Auditor, Ft Lauderdale, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371466

37. [SJ-JOB] Auditor, Minneapolis, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371465

38. [SJ-JOB] Sales Engineer, San Francisco, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371464

39. [SJ-JOB] Account Manager, George Town, KY (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371376

40. [SJ-RESUME] Security Consultant (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371371

41. [SJ-RESUME] Sr. Security Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371366

42. [SJ-RESUME] Security Researcher (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371360

43. [SJ-RESUME] Manager, Information Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371359

44. [SJ-JOB] Security Engineer, Santa Monica, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371354

45. [SJ-RESUME] Security Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371352

46. [SJ-JOB] Management, White River Junction, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371349

47. [SJ-JOB] Compliance Officer, Whitehouse Station, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371348

48. [SJ-JOB] Developer, Redmond, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371346

49. [SJ-JOB] Sr. Security Engineer, Lombard (Chicago), U... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371345

50. [SJ-JOB] Sales Engineer, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371337

51. [SJ-JOB] Security Consultant, Maidenhead, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371336

52. [SJ-JOB] Director, Information Security, Whitehouse ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371335

53. [SJ-JOB] Application Security Engineer, Chantilly, U... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/371334

VI. INCIDENTS LIST SUMMARY
--------------------------
1. Snort signatures for rxbot / rbot.gl (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/371571

2. New SF Article: Network Analysis of a Public Exploit... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/371569

3. Possible new Korgo variant. WAS: New SDBot variant (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/371521

4. New SDBot variant (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/371370

5. e-crime and computer evidence conference - CFP remin... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/371323

VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. ISS BlackIce Server Protect Unprivileged User Attack (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/371687

2. Metasploit Framework v2.2 (with SDK) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/371642

3. [Full-Disclosure] ISS BlackIce Server Protect Unpriv... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/371639

4. CORE-2004-0705: Vulnerabilities in PuTTY and PSCP (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/371327

VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Windows 2000 Administrator lockout (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/371847

2. most avtive attack type (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/371746

3. RE : most avtive attack type (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/371701

4. Article Announcement: Redmond's Salvation (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/371494

5. SecurityFocus Microsoft Newsletter #201 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/371435

IX. SUN FOCUS LIST SUMMARY
--------------------------
1. [ID 800047 auth.crit] fatal: monitor_read: unsupport... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/371737

2. Password recovery (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/371735

3. cant block root login (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/371680

4. Réf. : [ID 800047 auth.crit] fatal: monitor_read: un... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/371620

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. can Hopster traffic be blocked? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/371590

2. LIDS 1.2.2rc2 for Linux kernel 2.4.27 released (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/371540

XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XII. SPONSOR INFORMATION
-----------------------

This issue sponsored by: SafeNet

FREE Network Security Webinar - How to implement IPSec security into VPN
appliances

http://www.securityfocus.com/sponsor/SafeNet_sf-news_040817

------------------------------------------------------------------------