SecurityFocus Newsletter #267

Peter Laborge <[email protected]> 21 Sep 2004 17:55:31 -0000

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #267
------------------------------

This issue sponsored by: BindView

Webinar: COMPLIANCE - DOES ACCESS CONTROL MATTER?
Who's authorized to see your data? Compliance with Sarbanes-Oxley, GLBA and
HIPAA mandates user documentation and "need-to-know" access policies. Learn
about key components of identity management (IDM), how to manage access
control for compliance and other critical information to apply strict
access policies across the IT infrastructure.
Register here & receive an IDM White Paper

http://www.securityfocus.com/sponsor/BindView_sf-news_040921

------------------------------------------------------------------------
I. FRONT AND CENTER
1. Examining a Public Exploit, Part 2
2. Academia Headaches
3. Metasploit Framework, Part 3
II. BUGTRAQ SUMMARY
1. John Sterling Mod_cplusplus Buffer Overflow Vulnerability
2. Webmin / Usermin Installation Insecure Temporary File Creati...
3. Apache mod_ssl Remote Denial of Service Vulnerability
4. RhinoSoft Serv-U FTP Server Remote Denial Of Service Vulnera...
5. Samba Multiple ASN.1 and MailSlot Parsing Remote Denial Of S...
6. Multiple Vendor MIME Encapsulation Content Checking Filter B...
7. Gadu-Gadu Image Send Feature Remote Heap Overflow Vulnerabil...
8. Jigunet TwinFTP Server Directory Traversal Vulnerability
9. PerlDesk Language Variable Server-Side Script Execution Vuln...
10. Pingtel Xpressa Handset Remote Denial Of Service Vulnerabili...
11. Lexar JumpDrive Secure USB Flash Drive Insecure Password Sto...
12. FocalMedia.net Turbo Seek Information Disclosure Vulnerabili...
13. QNX Photon MicroGUI Multiple Utility Server Flag Buffer Over...
14. QNX Crrtrap Path Environment Variable Local Command Executio...
15. Mozilla Firefox Default Installation File Permission Vulnera...
16. ZyXEL P681 ARP Request Information Disclosure Vulnerability
17. Multiple BEA Systems WebLogic Vulnerabilities
18. Mozilla Browser Non-ASCII Hostname Heap Overflow Vulnerabili...
19. Mozilla Multiple URI Processing Heap Based Buffer Overflow V...
20. Mozilla Browser BMP Image Decoding Multiple Integer Overflow...
21. Microsoft WordPerfect Converter Remote Buffer Overflow Vulne...
22. Microsoft GDI+ Library JPEG Segment Length Integer Underflow...
23. Mozilla Browser Vcard Handling Remote Buffer Overflow Vulner...
24. SUS Format String Vulnerability
25. Mozilla/Firefox Browsers URI Drag And Drop Cross-Domain Scri...
26. Inkra 1504GX Remote Denial Of Service Vulnerability
27. Mozilla/Firefox Browsers Unauthorized Clipboard Contents Dis...
28. SnipSnap HTTP Response Splitting Vulnerability
29. McAfee VirusScan System Scan Local Privilege Escalation Vuln...
30. Apache Web Server Configuration File Environment Variable Lo...
31. CUPS UDP Packet Remote Denial Of Service Vulnerability
32. LinuxPrinting.org Foomatic-Filter Command Execution Vulnerab...
33. Apache Mod_DAV LOCK Denial Of Service Vulnerability
34. Multiple Browser Cross-Domain Cookie Injection Vulnerability
35. Apache Web Server Remote IPv6 Buffer Overflow Vulnerability
36. HP Web Jetadmin Unspecified Arbitrary Command Execution Vuln...
37. MyServer Directory Traversal Vulnerability
38. PHP Unspecified Remote Arbitrary File Upload Vulnerability
39. BBS E-Market Professional Multiple File Disclosure Vulnerabi...
40. Mozilla/Firefox Browsers Tar.GZ Archive Weak Permissions Vul...
41. vBulletin SQL Injection Vulnerability
42. Mozilla/Firefox Browsers PrivilegeManager EnablePrivilege Di...
43. GDK-Pixbuf Multiple Vulnerabilities
44. LibXpm Image Decoding Multiple Remote Buffer Overflow Vulner...
45. SMC7004VWBR and SMC7008ABR Authentication Bypass Vulnerabili...
46. GNU Radius SNMP String Length Remote Denial Of Service Vulne...
47. IBM OEM Microsoft Windows XP And Windows XP SP1 Default Admi...
48. Microsoft Internet Explorer User Security Confirmation Bypas...
49. Snitz Forums Down.ASP HTTP Response Splitting Vulnerability
50. Microsoft Windows XP Explorer.EXE TIFF Image Denial of Servi...
51. Tech-Noel Pigeon Server Remote Denial Of Service Vulnerabili...
52. Sudo Information Disclosure Vulnerability
53. Xine-lib DVD Subpicture Decoder Heap Overflow Vulnerability
54. Xine-lib VideoCD And Text Subtitle Stack Overflow Vulnerabil...
55. Apple iChat Remote Link Application Execution Vulnerability
56. Business Objects WebIntelligence Access Control Bypass File ...
57. Business Objects WebIntelligence Remote File Name HTML Injec...
58. Google Toolbar About.HTML HTML Injection Vulnerability
59. MacOSXLabs RsyncX Local Privilege Escalation Vulnerability
60. MacOSXLabs RsyncX Insecure Temporary File Creation Vulnerabi...
61. DNS4Me Denial Of Service And Cross-Site Scripting Vulnerabil...
62. YaBB Administrator Command Execution Vulnerability
63. YaBB YaBB.pl IMSend Cross-Site Scripting Vulnerability
64. Samba Samba-VScan Undisclosed Denial Of Service Vulnerabilit...
III. SECURITYFOCUS NEWS ARTICLES
1. Feds say Lamo inspired other hackers
2. Microsoft warns of poisoned picture peril
3. Mitnick movie comes to the U.S.
4. WLANs go feral in corporate undergrowth
5. Merger creates world's biggest IT security services firm
6. Rise of the Botnets
IV. SECURITYFOCUS TOP 6 TOOLS
1. EPX Crypting Software 2.1
2. Hacme Bank 1.0
3. ID-Synch 3.1
4. Nmap v3.70
5. DmpE32 -Symbian Executable Information Dumper 1.0
6. IP Firewall Hook ATL/COM 1.2
V. SECURITYJOBS LIST SUMMARY
1. [SJ-JOB] Security Architect, London, GB (Thread)
2. [SJ-JOB] Security Engineer, New York, US (Thread)
3. [SJ-JOB] Security Consultant, Chicago, US (Thread)
4. [SJ-JOB] Sales Engineer, Herndon, US (Thread)
5. [SJ-JOB] Sales Engineer, In or around New York City ... (Thread)
6. [SJ-JOB] Management, Foster City, US (Thread)
7. [SJ-JOB] Security Architect, Ft Lauderdale, US (Thread)
8. [SJ-JOB] Auditor, Chicago, US (Thread)
9. [SJ-JOB] Security Engineer, Boise, US (Thread)
10. [SJ-JOB] Manager, Information Security, Rancho Cordo... (Thread)
11. [SJ-JOB] Security Consultant, Atlanta, US (Thread)
12. [SJ-JOB] Security Architect, San Francisco , US (Thread)
13. [SJ-JOB] Developer, San Rafael, US (Thread)
14. [SJ-JOB] Account Manager, Dallas, US (Thread)
15. [SJ-JOB] Security Consultant, London, GB (Thread)
16. [SJ-JOB] Security Engineer, Metro DC, US (Thread)
17. [SJ-JOB] Security Engineer, Seattle, US (Thread)
18. [SJ-JOB] Director, Computer Security, Boston, US (Thread)
19. [SJ-JOB] Manager, Information Security, London, GB (Thread)
20. [SJ-JOB] Sr. Product Manager, Cupertino, US (Thread)
21. [SJ-JOB] Sales Engineer, New York, US (Thread)
22. [SJ-JOB] Sr. Security Analyst, Boise, US (Thread)
23. [SJ-JOB] Account Manager, San Francisco, US (Thread)
24. [SJ-JOB] Security Architect, New York, US (Thread)
25. [SJ-JOB] Chief Security Strategist, San Francisco , ... (Thread)
26. [SJ-JOB] Account Manager, Any city, US (Thread)
27. [SJ-JOB] Sales Engineer, Waltham, US (Thread)
28. [SJ-JOB] Security Architect, Westborough, US (Thread)
29. [SJ-JOB] Account Manager, Kansas City, US (Thread)
30. [SJ-JOB] Manager, Information Security, West London,... (Thread)
31. [SJ-JOB] Security Consultant, Milwaukee, US (Thread)
32. [SJ-JOB] Security Engineer, Champaign, US (Thread)
33. [SJ-JOB] Information Assurance Analyst, Chantilly, U... (Thread)
34. [SJ-JOB] Sr. Product Manager, San Diego, US (Thread)
35. [SJ-JOB] Management, Boston, US (Thread)
36. [SJ-JOB] Management, Chicago, US (Thread)
37. [SJ-JOB] Security Engineer, Elgin, US (Thread)
38. [SJ-JOB] Management, New York, surrounding Areas, US (Thread)
39. [SJ-JOB] Sr. Security Analyst, San Francisco, US (Thread)
40. [SJ-JOB] Management, Irvine or Bay Area, US (Thread)
VI. INCIDENTS LIST SUMMARY
1. Yahoo Account hacking (Thread)
2. suspicous activities... (Thread)
3. Systems compromised with ShellBOT perl script - part... (Thread)
4. unusual 1.11.0.0/16 outbound traffic (Thread)
5. Wireless router behaviour (Thread)
6. Odd mail traffic (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. FreeBSD shellcode (Thread)
2. Problem with keyboard forwarding to cmd.exe shellcod... (Thread)
3. Apache 1.3 (Thread)
4. challenge (Thread)
5. ALPHA 2: Zero-tolerance (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Restrict Clinet IP address on Terminal Service (Thread)
2. VBScript to audit shares and share permissions (Thread)
3. How to Enforce Complex Password Policy for Selected ... (Thread)
4. Hardening Desktop (Thread)
5. tool for user disk quota (Thread)
6. Windows2000 Security events (Thread)
7. AW: tool for user disk quota (Thread)
8. RES: How to Recovering files encrypted with Microsof... (Thread)
9. RKDetect - behaviour based rootkit detection (update... (Thread)
10. XP-SP2 "Feature" (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Solaris 9 authentication and access control into Act... (Thread)
2. allowing ordinary users to open privileged ports (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Network "Change Management" (Thread)
2. LIDS 1.2.2rc3 for Linux kernel 2.4.27 released (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Examining a Public Exploit, Part 2
By Don Parker

The purpose of this article is to analyze a public exploit in a lab
environment, see the alerts generated by an intrusion detection system, and
then do some packet analysis of the malicious binary in order to better
understand what it does and how you may have been compromised. Part 2 of 2.

http://www.securityfocus.com/infocus/1801

2. Academia Headaches
By Scott Granneman

Academic institutions who have to add, manage, and secure thousands of new
users within a period of just a few days face political and social issues
on top of the immense technical ones.

http://www.securityfocus.com/columnists/267

3. Metasploit Framework, Part 3
By Pukhraj Singh and K.K. Mookhey

This third and final article in the Metasploit series covers the msfcli
scripting interface as well as the intuitive web interface to the
Framework. The article also discusses what's new with version 2.2, and then
introduces the exploit development process through an example.

http://www.securityfocus.com/infocus/1800

II. BUGTRAQ SUMMARY
-------------------
1. John Sterling Mod_cplusplus Buffer Overflow Vulnerability
BugTraq ID: 11152
Remote: Yes
Date Published: Sep 10 2004
Relevant URL: http://www.securityfocus.com/bid/11152
Summary:
John Sterling mod_cplusplus is a framework for creating Apache modules in C++. This is designed to function in a similar fashion as mod_perl.

It is reported that mod_cplusplus contains a buffer overflow vulnerability.

This may allow attacker-supplied data to overwrite a fixed size memory buffer, corrupting adjacent memory regions. This may allow for denial of service conditions, or possible remote code execution.

Versions prior to 1.4.1 are reported susceptible to this vulnerability.

2. Webmin / Usermin Installation Insecure Temporary File Creati...
BugTraq ID: 11153
Remote: No
Date Published: Sep 10 2004
Relevant URL: http://www.securityfocus.com/bid/11153
Summary:
It is reported that Webmin and Usermin create insecure temporary files during installation. The result of this is that temporary files created by the applications may use predictable filenames.

A local attacker may possibly exploit this vulnerability to execute symbolic link file overwrite attacks.

Versions of Usermin prior to version 1.090 are reported prone to this vulnerability. Webmin 1.150 and prior versions are affected as well.

3. Apache mod_ssl Remote Denial of Service Vulnerability
BugTraq ID: 11154
Remote: Yes
Date Published: Sep 10 2004
Relevant URL: http://www.securityfocus.com/bid/11154
Summary:
Apache 2.x mod_ssl is reported prone to a remote denial of service vulnerability. This issue likely exists because the application fails to handle exceptional conditions. The vulnerability originates in the 'char_buffer_read' function of the 'ssl_engine_io.c' file.

It is likely that this issue only results in a denial of service condition in child process. This BID will be updated as more information becomes available.

Apache 2.0.50 is reported to be affected by this issue, however, it is possible that other versions are vulnerable as well.

4. RhinoSoft Serv-U FTP Server Remote Denial Of Service Vulnera...
BugTraq ID: 11155
Remote: Yes
Date Published: Sep 11 2004
Relevant URL: http://www.securityfocus.com/bid/11155
Summary:
Serv-U FTP Server is reported prone to a denial of service vulnerability. This issue presents itself because the application fails to handle exceptional conditions.

The vulnerability is a result of Serv-U FTP Server processing certain 'STOU' commands. All versions of Serv-U are reportedly affected by this vulnerability.

5. Samba Multiple ASN.1 and MailSlot Parsing Remote Denial Of S...
BugTraq ID: 11156
Remote: Yes
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11156
Summary:
Samba is reportedly affected by multiple remote denial of service vulnerabilities. These issues are due to a failure to properly parse ASN.1 and MailSlot packets.

An attacker may leverage these issues to cause the affected Samba server to become inaccessible, and to crash the NetBIOS name server, effectively denying service to legitimate users.

6. Multiple Vendor MIME Encapsulation Content Checking Filter B...
BugTraq ID: 11157
Remote: Yes
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11157
Summary:
Multiple filter bypass vulnerabilities have been reported in numerous software implementations due to ambiguities in MIME encapsulation standards (RFCs 822, and 2045 through 2049).

The following types of software may be impacted by these issues:
- Email clients
- Web clients
- Antivirus products
- Email content filters
- Web content filters

The source of the problem is that affected implementations may not handle malformed or incorrect MIME encapsulated data. As a result, various MIME encapsulation techniques could be used to allow MIME attachments to pass on through when they should be rejected due to being malformed or incorrect. This could have various consequences depending on the implementation, but will also generally require that the client receiving the attachment will be able to interpret the malformed attachment.

A conclusive list of affected implementations is not available at this time. This BID will be updated as more vendor products are determined to be vulnerable.

7. Gadu-Gadu Image Send Feature Remote Heap Overflow Vulnerabil...
BugTraq ID: 11158
Remote: Yes
Date Published: Sep 12 2004
Relevant URL: http://www.securityfocus.com/bid/11158
Summary:
Gadu-Gadu is reported prone to a remote heap overflow vulnerability in the image sending feature. This issue results due to insufficient boundary checks performed by the application. Successful exploitation of this vulnerability may allow a remote attacker to execute arbitrary code to gain unauthorized access to a vulnerable computer.

Gadu-Gadu version 6.0 build 149 is reported prone to this issue, however, prior versions are likely to be affected as well.

8. Jigunet TwinFTP Server Directory Traversal Vulnerability
BugTraq ID: 11159
Remote: Yes
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11159
Summary:
It is reported that TwinFTP Server is susceptible to a directory traversal vulnerability.

This vulnerability presents itself when certain arguments for FTP commands passed to the FTP server contain '../' directory traversal characters.

This vulnerability allows a remote attacker to read and write files outside of the FTP document root directory.

9. PerlDesk Language Variable Server-Side Script Execution Vuln...
BugTraq ID: 11160
Remote: Yes
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11160
Summary:
It is reported that PerlDesk is susceptible to a server-side script execution vulnerability.

This vulnerability may be exploited to execute the contents of Perl scripts contained on the affected server filesystem. This will execute script code in the context of the affected CGI application, typically with the privileges of the web server process.

If a remote attacker does not have access to the affected server in a manner sufficient to place malicious a Perl script to exploit this vulnerability, they may still exploit it for information disclosure purposes. Error messages that will reportedly be displayed when PerlDesk attempts to include files requested by the attacker may contain potentially sensitive information. With sufficient knowledge of the affected system, an attacker may also cause other preexisting scripts to be executed that may also aid them in further attacks.

This vulnerability may aid the attacker in further application, or system attacks.

10. Pingtel Xpressa Handset Remote Denial Of Service Vulnerabili...
BugTraq ID: 11161
Remote: Yes
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11161
Summary:
Pingtel Xpressa handsets are reported prone to a remote denial of service vulnerability. The issue is reported to exist because of a lack of sufficient boundary checks performed on HTTP request data handled by the Xpressa administration web server.

It is reported that a remote attacker may exploit this vulnerability to effectively deny service to the affected handset. Due to the nature of this vulnerability, it is reported that this issue may be exploited in order to execute arbitrary code.

11. Lexar JumpDrive Secure USB Flash Drive Insecure Password Sto...
BugTraq ID: 11162
Remote: No
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11162
Summary:
Lexar JumpDrive Secure USB Flash Drive is reportedly affected by an insecure password storage vulnerability. This issue is due to a design error which causes the password to be stored insecurely on the affected device.

An attacker can exploit this issue to gain access to the password protecting the secure private zone of the affected drive, facilitating unauthorized access.

12. FocalMedia.net Turbo Seek Information Disclosure Vulnerabili...
BugTraq ID: 11163
Remote: Yes
Date Published: Sep 12 2004
Relevant URL: http://www.securityfocus.com/bid/11163
Summary:
It is reported that Turbo Seek is prone to an information disclosure vulnerability.

Successful exploitation reportedly causes the affected application to display the contents of requested files to the attacker. This allows attackers to retrieve the contents of potentially sensitive web-server accessible files. This may aid them in further attacks.

Versions prior to 1.7.2 are reported to be affected by this vulnerability.

13. QNX Photon MicroGUI Multiple Utility Server Flag Buffer Over...
BugTraq ID: 11164
Remote: No
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11164
Summary:
Reportedly QNX Photon MicroGUI is affected by multiple buffer overflow vulnerabilities in MicroGUI utilities. These issues are due to a failure of the affected applications to validate user-supplied string lengths before copying them into finite process buffers.

An attacker may leverage these issues to execute arbitrary code on the affected system within the context of the vulnerable applications; the applications are typically setuid applications.

14. QNX Crrtrap Path Environment Variable Local Command Executio...
BugTraq ID: 11165
Remote: No
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11165
Summary:
A problem is reported in the handling of paths to external executables that are used by crrtrap. Because of this, an attacker may be able to gain elevated privileges on a host with a vulnerable version of crrtrap installed.

15. Mozilla Firefox Default Installation File Permission Vulnera...
BugTraq ID: 11166
Remote: No
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11166
Summary:
Mozilla Firefox is reported susceptible to an improper file permission vulnerability. This vulnerability is reported to exist only in the Linux archive as published by the Mozilla Foundation. If the browser is installed by package management software contained in many distributions of Linux, this vulnerability is likely not present.

This allows attackers with local interactive access to computers hosting installations of Firefox to overwrite binaries and scripts used by Firefox. This allows script, or code execution in the context of the user running the affected package.

If this method of installation is used to install a system-wide version of the browser by the superuser, then root-owned files are world writable, allowing for code execution in the context of any user utilizing the affected package.

The installation package from Mozilla.org for versions 0.9.x of Firefox for Linux is reported to contain this vulnerability.

16. ZyXEL P681 ARP Request Information Disclosure Vulnerability
BugTraq ID: 11167
Remote: Yes
Date Published: Sep 13 2004
Relevant URL: http://www.securityfocus.com/bid/11167
Summary:
It is reported that ZyXEL Prestige 681 SDSL routers are susceptible to an information disclosure vulnerability.

An attacker sniffing network traffic on an attached network would be able to retrieve partial contents of network packets that have traversed the affected device.

This information may assist malicious users in attacks on systems and services that utilize the affected device.

ZyNOS version Vt020225a is reported vulnerable to this issue. Due to code reuse among products, it is likely that other devices and versions are also affected by this issue.

17. Multiple BEA Systems WebLogic Vulnerabilities
BugTraq ID: 11168
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11168
Summary:
BEA Systems has released advisories to address multiple vulnerabilities in WebLogic Server and Express. These issues may permit unauthorized access, information disclosure, or pose threats to role and policy security.

18. Mozilla Browser Non-ASCII Hostname Heap Overflow Vulnerabili...
BugTraq ID: 11169
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11169
Summary:
Mozilla is prone to a remotely exploitable heap overflow that is exposed when the browser handles non-ASCII characters in URIs.

This issue could be exploited by enticing a user to open a hyperlink that references a malicious URI. Successful exploitation will allow execution of arbitrary code in the context of the client user.

19. Mozilla Multiple URI Processing Heap Based Buffer Overflow V...
BugTraq ID: 11170
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11170
Summary:
Mozilla is reportedly affected by multiple heap based buffer overflow vulnerabilities when processing URIs in emails. These issues are due to a failure of the affected application to validate user-supplied string lengths before copying them into finite process buffers.

An attacker might leverage these issues to have arbitrary code executed in the context of the user running the vulnerable application.

20. Mozilla Browser BMP Image Decoding Multiple Integer Overflow...
BugTraq ID: 11171
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11171
Summary:
Mozilla Browser is reportedly prone to multiple integer overflow vulnerabilities in the image parsing routines. These issues exist due to insufficient boundary checks performed by the application. A remote attacker may cause denial of service conditions in the client or execute arbitrary code to gain unauthorized access to a vulnerable computer.

These vulnerabilities were researched on Mozilla 1.7, however, other versions may be affected as well. Thunderbird 0.7 was also tested.

21. Microsoft WordPerfect Converter Remote Buffer Overflow Vulne...
BugTraq ID: 11172
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11172
Summary:
Microsoft WordPerfect Converter is reported prone to a remote buffer overflow vulnerability when handling malformed files. This vulnerability may allow a remote attacker to execute arbitrary code on a vulnerable computer to gain unauthorized access. To carry out an attack, the attacker may create a malicious file and entice a user to open the file through an application that employs WordPerfect Converter.

Microsoft WordPerfect Converter is installed by default in various versions of Microsoft Office, Microsoft Word, Microsoft FrontPage, Microsoft Publisher, and Microsoft Works Suite. Microsoft Office 2003 Service Pack 1 is not affected by this vulnerability.

This issue may be similar in nature to BID 8538 (Microsoft WordPerfect Converter Buffer Overrun Vulnerability).

22. Microsoft GDI+ Library JPEG Segment Length Integer Underflow...
BugTraq ID: 11173
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11173
Summary:
Microsoft (Graphics Device Interface) GDI+ JPEG handler is reported prone to an integer underflow vulnerability when handling JPEG format images. This issue presents itself due to a lack of sufficient sanity checks performed on certain JPEG data before this data employed as a bounds value for a memory copy operation.

A specially crafted JPEG image may trigger this vulnerability and result in the execution of arbitrary attacker-supplied code. Code execution would occur in the context of the user who is running the vulnerable software.

**Update: This issue is similar in nature to BID 1503, discovered by Solar Designer.

23. Mozilla Browser Vcard Handling Remote Buffer Overflow Vulner...
BugTraq ID: 11174
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11174
Summary:
Mozilla Browser is reported prone to a remote buffer overflow vulnerability when processing malicious vcard files. This issue presents itself due to insufficient boundary checks performed by the application and may allow a remote attacker to gain unauthorized access to a vulnerable computer.

It is reported that the issue originates in the 'nsVCardObj.cpp' file and may allow an attacker to overflow a finite buffer by creating a malformed vcard (vcf) file and sending the file to a vulnerable user in email. Reportedly, this issue occurs when the mail is previewed in the browser.

These vulnerabilities were researched on Mozilla 1.7, however, other versions may be affected as well. Thunderbird 0.7 was tested as well.

24. SUS Format String Vulnerability
BugTraq ID: 11176
Remote: No
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11176
Summary:
It is reported that SUS contains a format string vulnerability in its logging function. This issue is due to a failure of the applications to properly sanitize user-supplied input before using it as the format specifier in a formatted printing function.

Due to improper message sanitization, any format string specifiers are interpreted literally by the syslog() function, giving the attacker control over process memory.

Due to the nature of the SUS package, an attacker with local interactive access could exploit this vulnerability to gain superuser privileges.

SUS versions prior to 2.0.6 are reported vulnerable.

25. Mozilla/Firefox Browsers URI Drag And Drop Cross-Domain Scri...
BugTraq ID: 11177
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11177
Summary:
Both Mozilla and Firefox are reported to be prone to a cross-domain scripting vulnerability. It is reported that URI links that are dragged from one browser window and dropped into another browser window will bypass the browser same-origin policy security checks.

Certain URI types may be employed by a malicious website in order to trigger this vulnerability. If successful, this attack will result in the execution of arbitrary script code in the context of a target domain.

26. Inkra 1504GX Remote Denial Of Service Vulnerability
BugTraq ID: 11178
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11178
Summary:
It is reported that the Inkra 1504GX is susceptible to a denial of service vulnerability.

This vulnerability presents itself when the device receives particular malformed IP packets. The switch must be configured in a particular state for this vulnerability to be exploited.

This vulnerability allows a remote attacker to crash affected devices, denying service to legitimate users.

Inkra 1504GX routers with VSM release 2.1.4.b003 is reportedly vulnerable to this issue. Other versions are also likely affected.

27. Mozilla/Firefox Browsers Unauthorized Clipboard Contents Dis...
BugTraq ID: 11179
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11179
Summary:
A vulnerability is reported in Mozilla and Firefox browsers that could permit a remote site to gain access to contents of the client user's clipboard.

This vulnerability exists because certain unsafe scripting operations are permitted on TextAreas. This can lead to the disclosure of clipboard contents and malicious Web sites having the ability to write to a users clipboard.

28. SnipSnap HTTP Response Splitting Vulnerability
BugTraq ID: 11180
Remote: Yes
Date Published: Sep 14 2004
Relevant URL: http://www.securityfocus.com/bid/11180
Summary:
SnipSnap is reported prone to an HTTP response splitting vulnerability. The issue exists in the 'referer' parameter. The issue presents itself due to a flaw in the application that allows an attacker to manipulate how POST requests are handled.

This issue was identified in SnipSnap 0.5.2a and prior.

29. McAfee VirusScan System Scan Local Privilege Escalation Vuln...
BugTraq ID: 11181
Remote: No
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11181
Summary:
Reportedly McAfee VirusScan is affected by a local privilege escalation vulnerability. This issue is caused by a design error that causes the application to fail to drop SYSTEM privileges after acquiring them.

A local attacker may leverage this issue to escalate their privileges to SYSTEM on an affected Microsoft Windows computer.

** UPDATE: Additional versions later than 4.5.1 were added to this BID due to a report that a similar attack was possible against those versions. These versions have since been removed from the BID due to subsequent reports that indicated this attack was not possible against the reported versions.

30. Apache Web Server Configuration File Environment Variable Lo...
BugTraq ID: 11182
Remote: No
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11182
Summary:
Reportedly the Apache Web Server is affected by a configuration file environment variable local buffer overflow vulnerability. This issue is due to a failure of the affected application to validate user-supplied string lengths before copying them into finite process buffers.

An attacker may leverage this issue to execute arbitrary code on the affected computer with the privileges of the Apache Web Server process.

31. CUPS UDP Packet Remote Denial Of Service Vulnerability
BugTraq ID: 11183
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11183
Summary:
CUPS is prone to a remotely exploitable denial of service vulnerability that may be triggered through port 631 by a zero-length UDP packet.

32. LinuxPrinting.org Foomatic-Filter Command Execution Vulnerab...
BugTraq ID: 11184
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11184
Summary:
Reportedly the LinuxPrinting.org Foomatic-Filter is affected by an arbitrary command execution vulnerability. Although unconfirmed, it is likely that this issue is due to a failure of the affected script to properly validate input when issuing shell commands.

An attacker may exploit this issue to execute arbitrary commands as the printer user on a computer running the vulnerable software.

33. Apache Mod_DAV LOCK Denial Of Service Vulnerability
BugTraq ID: 11185
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11185
Summary:
Apache's 'mod_dav' module is reported susceptible to a denial of service vulnerability.

This vulnerability presents itself when Apache is configured to use the 'mod_dav' module, and it receives a specific sequence of LOCK commands from an authorized user.

This vulnerability can be exploited by remote attackers to crash Apache processes. If Apache is configured to use the threaded process model, an attacker could completely crash Apache. If Apache is configured to use multiple processes as apposed to threads, an attacker could crash individual web server processes. With a sustained attack, they could crash multiple server processes, and still likely deny service to legitimate users.

All versions of Apache 2.0, prior to 2.0.51 are reported vulnerable.

34. Multiple Browser Cross-Domain Cookie Injection Vulnerability
BugTraq ID: 11186
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11186
Summary:
Multiple Browsers are reported prone to a cross-domain cookie injection vulnerability. This issue is identified in Microsoft Internet Explorer, KDE Konqueror, and Mozilla and may allow an attacker to carry out session hijacking attacks.

The issue presents itself due to a design error in multiple browsers that allows cookies to be incorrectly sent to other domains.

This BID will be divided and updated as more information becomes available.

35. Apache Web Server Remote IPv6 Buffer Overflow Vulnerability
BugTraq ID: 11187
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11187
Summary:
Apache Web Server is reportedly affected by a remote buffer overflow vulnerability. This issue is due to a buffer boundary condition error that fails to provide a valid string length parameter while using libc memory copy functions.

It has been reported that this issue can be exploited to execute arbitrary code on computers running BSD based Unix variants. This issue is reportedly due to the implementation of the 'memcpy()' function.

On Linux based Unix variants this issue can only be exploited to trigger a denial of service condition.

36. HP Web Jetadmin Unspecified Arbitrary Command Execution Vuln...
BugTraq ID: 11188
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11188
Summary:
HP Web Jetadmin is prone to an unspecified arbitrary arbitrary command execution vulnerability. This issue was reported by the vendor and it may allow a remote attacker to execute arbitrary commands on a vulnerable computer running Web Jetadmin. This may allow the attacker to gain unauthorized access to the computer.

HP Web Jetadmin version 7.5 is reported prone to this issue.

Due to a lack of details, further information is not available at the moment. This BID will be updated as more information becomes available.

37. MyServer Directory Traversal Vulnerability
BugTraq ID: 11189
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11189
Summary:
MyServer is reported prone to a remote directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. This vulnerability results in improper access to potentially sensitive files located outside of the document root of the web server.

MyServer version 0.7 is reportedly affected by this issue, however, other versions may be vulnerable as well.

38. PHP Unspecified Remote Arbitrary File Upload Vulnerability
BugTraq ID: 11190
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11190
Summary:
Reportedly PHP is vulnerable to an unspecified arbitrary file upload vulnerability. The details of this issue are currently unavailable. This BID will be updated when more information is released.

An attacker may exploit this issue to upload arbitrary files to a computer running the affected software. This may facilitate arbitrary server-side script code execution as well as other attacks.

39. BBS E-Market Professional Multiple File Disclosure Vulnerabi...
BugTraq ID: 11191
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11191
Summary:
BBS E-Market Professional is reported prone to multiple file disclosure vulnerabilities. These issues exist due to insufficient sanitization of user-supplied data.

A remote attacker can disclose arbitrary Web-readable files by supplying directory traversal sequences such as '../' to the server. This results in improper access to potentially sensitive files located outside of the document root of the web server.

BBS E-Market patch level bf_130 (v1.3.0) and prior are affected by these issues.

40. Mozilla/Firefox Browsers Tar.GZ Archive Weak Permissions Vul...
BugTraq ID: 11192
Remote: No
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11192
Summary:
Mozilla and Mozilla Firefox browsers tar.gz archive that contains the installation files is reported susceptible to an improper file permissions vulnerability. It is reported that if the archive is extracted in a certain manner, then the archive is extracted with world read/writeable permissions on its contents.

This allows attackers with local interactive access to overwrite or modify installation files used during the installation of the browser.

41. vBulletin SQL Injection Vulnerability
BugTraq ID: 11193
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11193
Summary:
vBulletin is reported vulnerable to a remote SQL injection vulnerability. This issue is due to a failure of the application to properly validate user-supplied input prior to including it in an SQL query.

An attacker may exploit this issue to manipulate and inject SQL queries onto the underlying database. It will be possible to leverage this issue to steal database contents including administrator password hashes and user credentials as well as to make attacks against the underlying database.

Versions 3.0 through to 3.0.3 are reportedly affected by this issue.

42. Mozilla/Firefox Browsers PrivilegeManager EnablePrivilege Di...
BugTraq ID: 11194
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11194
Summary:
A vulnerability is reported in the Mozilla 'enablePrivilege' method. Because the argument data of a 'enablePrivilege' method is used as text in a prompt dialog if the user has not accessed the principal previously, it is possible to manipulate dialog contents.

A remote attacker may exploit this condition to influence a victim user into permitting a malicious script to run.

43. GDK-Pixbuf Multiple Vulnerabilities
BugTraq ID: 11195
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11195
Summary:
Multiple vulnerabilities have been reported in gdk-pixbuf.

The first vulnerability in the library presents itself upon attempting to decode BMP images. In certain circumstances, the library may enter into an infinite loop, consuming CPU resources, and halting further execution of applications utilizing the library.

The second and third vulnerabilities are exist when the library attempts to decode XPM images. Specially crafted image files could either crash applications utilizing the affected library, or allow for the execution of attacker-supplied code.

The forth and last vulnerability in the library presents itself upon attempting to decode ICO images. Specially crafted ICO files could cause applications to crash.

These vulnerabilities allow attackers to crash applications, or execute arbitrary code in the context of applications that use the affected library.

44. LibXpm Image Decoding Multiple Remote Buffer Overflow Vulner...
BugTraq ID: 11196
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11196
Summary:
Multiple vulnerabilities are reported to exist in the libXpm. These issues may be triggered when the library handles malformed XPM images. The vulnerabilities exist due to insufficient boundary checks performed by the application and may allow for unauthorized access to a vulnerable computer.

An attacker can exploit these issues by crafting a malicious XPM file and having unsuspecting users view the file through an application that uses the affected library.

LibXpm shipped with X.org X11R6 6.8.0 is reported vulnerable to this issue.

This BID will be divided and updated as more information becomes available.

45. SMC7004VWBR and SMC7008ABR Authentication Bypass Vulnerabili...
BugTraq ID: 11197
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11197
Summary:
SMC 7004VWBR, and 7008ABR devices are reportedly susceptible to an authentication bypass vulnerability in their web administration interface.

This vulnerability exists due to the method by which the web administration software validates authenticated users. Reportedly, the software uses the source IP address of the web client to differentiate between users accessing the administration interface.

This vulnerability allows attackers to gain administrative access to affected devices.

46. GNU Radius SNMP String Length Remote Denial Of Service Vulne...
BugTraq ID: 11198
Remote: Yes
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11198
Summary:
GNU Radius is reported prone to a remote integer overrun vulnerability. When GNU Radius handles SNMP string lengths that contain a large unsigned number, a memory access violation will occur this will cause the affected service to crash.

A remote attacker may exploit this condition to cause the affected server to crash.

47. IBM OEM Microsoft Windows XP And Windows XP SP1 Default Admi...
BugTraq ID: 11199
Remote: No
Date Published: Sep 15 2004
Relevant URL: http://www.securityfocus.com/bid/11199
Summary:
IBM OEM Microsoft Windows XP And Windows XP SP1 are both reported to contain a default passwordless administrative account.

Reportedly, during the installation process of IBMs OEM version of Windows XP and Windows XP SP1, the process automatically creates an administrator account and fails to set a password for it. The user is not made aware of the account during installation.

Users installing this version of Microsoft Windows may fail to properly secure this account, allowing for local attackers to gain administrative privileges. Network access to accounts without passwords is denied, so this is only a local vulnerability.

This vulnerability reportedly only affects IBMs OEM version of Microsoft Windows XP and Windows XP Service Pack 1.

48. Microsoft Internet Explorer User Security Confirmation Bypas...
BugTraq ID: 11200
Remote: Yes
Date Published: Sep 16 2004
Relevant URL: http://www.securityfocus.com/bid/11200
Summary:
Reportedly, Microsoft Internet Explorer is affected by a user security confirmation bypass vulnerability. This issue is due to a design error that allows malicious users to trivially bypass the requirement for user confirmation.

An attacker may leverage this issue by hosting a web page or pages designed to bypass the required user confirmation; this would facilitate the execution of arbitrary client side scripts such as JavaScript and ActiveX objects in the browsers of unsuspecting users that visit the site.

49. Snitz Forums Down.ASP HTTP Response Splitting Vulnerability
BugTraq ID: 11201
Remote: Yes
Date Published: Sep 16 2004
Relevant URL: http://www.securityfocus.com/bid/11201
Summary:
Snitz Forums is reported prone to a HTTP response splitting vulnerability. The issue exists in a parameter of the 'down.asp' script. The issue presents itself due to a flaw in the affected script that allows an attacker to
manipulate how GET requests are handled.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted.

50. Microsoft Windows XP Explorer.EXE TIFF Image Denial of Servi...
BugTraq ID: 11202
Remote: Yes
Date Published: Sep 16 2004
Relevant URL: http://www.securityfocus.com/bid/11202
Summary:
Explorer.exe that ships with Microsoft Windows XP prior to Windows XP SP2 is reported prone to a denial of service vulnerability.

The vulnerability is reported to exist when Explorer.exe handles certain TIFF format images.

A remote attacker may exploit this vulnerability by presenting a malicious image to a victim user. When this image is processed in a sufficient manner, system resources will be consumed. This will impact the performance of the computer, effectively denying service to legitimate users.

51. Tech-Noel Pigeon Server Remote Denial Of Service Vulnerabili...
BugTraq ID: 11203
Remote: Yes
Date Published: Sep 16 2004
Relevant URL: http://www.securityfocus.com/bid/11203
Summary:
Reportedly the Tech-Noel Pigeon Server is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to handle exceptional user input.

An attacker may exploit this issue to cause the affected server to hang, effectively denying service to legitimate users.

52. Sudo Information Disclosure Vulnerability
BugTraq ID: 11204
Remote: No
Date Published: Sep 16 2004
Relevant URL: http://www.securityfocus.com/bid/11204
Summary:
Sudo is reported prone to an information disclosure vulnerability.

This vulnerability presents itself when sudo is called with the '-e' option, or the 'sudoedit' command is invoked. In certain circumstances, attackers may access the contents of arbitrary files with superuser privileges.

Version 1.6.8 is reported susceptible to this vulnerability.

53. Xine-lib DVD Subpicture Decoder Heap Overflow Vulnerability
BugTraq ID: 11205
Remote: Yes
Date Published: Sep 16 2004
Relevant URL: http://www.securityfocus.com/bid/11205
Summary:
A buffer overflow in the DVD subpicture component, exploitable through malicious DVD or MPEG content, may allow for the execution of arbitrary code. The Xine-lib decoder converts subpicture data into an internal representation and stores it in dynamically allocated memory. There exists a flaw in the calculation of required buffer space that may result in allocation of a buffer that is too small. Consequently, neighboring data in the heap may be corrupted when data is written to the buffer.

This vulnerability can theoretically be exploited to write arbitrary words to nearly arbitrary locations in memory. The Linux and Windows dynamic memory allocation subsystems may be more susceptible than BSD-based systems.

54. Xine-lib VideoCD And Text Subtitle Stack Overflow Vulnerabil...
BugTraq ID: 11206
Remote: Yes
Date Published: Sep 16 2004
Relevant URL: http://www.securityfocus.com/bid/11206
Summary:
Two buffer overflows are reported to exist in Xine-lib. These issues are exploitable through malicious VideoCDs or subtitle text content, and may allow for the execution of arbitrary code in the context of the user invoking Xine. Attackers can overwrite critical memory structures and return addresses in order to control the flow of execution of the application.

The first vulnerability presents itself when the affected application attempts to read malicious ISO disk labels from VideoCDs. The second vulnerability presents itself when the affected application attempts to parse malicious text subtitle data.

Xine-lib versions 1-rc2 though 1-rc5 are reported vulnerable to these issues.

55. Apple iChat Remote Link Application Execution Vulnerability
BugTraq ID: 11207
Remote: Yes
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11207
Summary:
Reportedly Apple iChat is vulnerable to a remote link application execution vulnerability. This issue is due to a design error that allows attacker to execute arbitrary commands through a vulnerable application.

An attacker can leverage this issue to execute arbitrary application on an unsuspecting user's computer. The impact of this issue may be increased when an attacker entices a victim to first download an application or has another means of placing an application on the victim's computer, and then exploits this issue to execute it.

56. Business Objects WebIntelligence Access Control Bypass File ...
BugTraq ID: 11208
Remote: Yes
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11208
Summary:
It is reported that WebIntelligence is susceptible to an access control bypass vulnerability allowing for the deletion of files from the application.

This vulnerability is reported to exist as access controls are only enforced on the client. The server fails to enforce access control restriction and allows delete requests to succeed when they are not authorized.

Only authenticated users are able to exploit this vulnerability.

57. Business Objects WebIntelligence Remote File Name HTML Injec...
BugTraq ID: 11209
Remote: Yes
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11209
Summary:
Reportedly Business Objects WebIntelligence is affected by a remote file name HTML injection vulnerability. This issue is due to a failure to sanitize file names prior to including them in dynamic web page content.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user, facilitating theft of cookie based authentication credentials. Other attacks are also possible.

58. Google Toolbar About.HTML HTML Injection Vulnerability
BugTraq ID: 11210
Remote: Yes
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11210
Summary:
Google Toolbar is reported prone to a HTML injection vulnerability. It is reported that the Google Toolbar 'ABOUT.HTML' page allows the injection of HTML and JavaScript code.

This vulnerability may allow an attacker to inject malicious HTML and script code into the about page of the vulnerable application.

59. MacOSXLabs RsyncX Local Privilege Escalation Vulnerability
BugTraq ID: 11211
Remote: No
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11211
Summary:
It is reported that RsyncX is prone to a local privilege escalation vulnerability.

RsyncX is installed setuid root and setgid wheel. It is reported that RsyncX drops root privileges properly but fails to drop setgid wheel privileges before executing a third party binary.

A local attacker may exploit this vulnerability to execute arbitrary code with group wheel privileges.

60. MacOSXLabs RsyncX Insecure Temporary File Creation Vulnerabi...
BugTraq ID: 11212
Remote: No
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11212
Summary:
RsyncX is reported to contain an insecure temporary file creation vulnerability. The result of this is that temporary files created by the application may use predictable filenames.

A local attacker may exploit this vulnerability to execute symbolic link file overwrite attacks.

61. DNS4Me Denial Of Service And Cross-Site Scripting Vulnerabil...
BugTraq ID: 11213
Remote: Yes
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11213
Summary:
DNS4Me is reported to be susceptible to a denial of service vulnerability, and a cross-site scripting vulnerability. These vulnerabilities affect the built-in web server contained in the package.

The first vulnerability reportedly allows attackers to cause the web server to consume all available CPU resources, and eventually crash the application.

The second vulnerability is due to a failure of the application to properly sanitize user-supplied URI input. This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

Although these vulnerabilities are reported to exist in version 3.0.0.4 of DNS4Me, other versions may also be affected.

62. YaBB Administrator Command Execution Vulnerability
BugTraq ID: 11214
Remote: Yes
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11214
Summary:
It is reported that YaBB is affected by an administrator command execution vulnerability. This issue is due to a failure of the application to properly validate access to administrative commands.

This issue permits a remote attacker to create a malicious URI link or embed a malicious URI between IMG tags, which includes hostile YaBB administrative commands. If an unsuspecting forum administrator views a post that contains this IMG tag, they will inadvertently activate the malicious URI, the attacker-supplied command is carried out with the administrator's privileges.

63. YaBB YaBB.pl IMSend Cross-Site Scripting Vulnerability
BugTraq ID: 11215
Remote: Yes
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11215
Summary:
A cross-site scripting vulnerability is reported in the YaBB forum 'YaBB.pl' script.

As a result, it is possible for a remote attacker to create a malicious link to the affected page of a site hosting the web forum. The malicious link may contain arbitrary HTML and JavaScript code in URI parameters. When this link is visited by an unsuspecting web user, the attacker-supplied code will be executed in their browser in the security context of the vulnerable website.

64. Samba Samba-VScan Undisclosed Denial Of Service Vulnerabilit...
BugTraq ID: 11216
Remote: Yes
Date Published: Sep 17 2004
Relevant URL: http://www.securityfocus.com/bid/11216
Summary:
An undisclosed denial of service vulnerability is reported to exist that may result in a denial of service for both the smbd and nmbd daemons. It is reported that the counter and pointer-handling present in 'samba-vscan' may provide an exploit vector for this vulnerability.

This BID will be updated when further information regarding this vulnerability is made available.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Feds say Lamo inspired other hackers
By: Kevin Poulsen

Prosecutors blame the New York Times hacker for inspiring others of his generation to become cyber outlaws.

http://www.securityfocus.com/news/9520

2. Microsoft warns of poisoned picture peril
By: Kevin Poulsen

A vulnerability in Windows XP and other products means JPEG viruses may not remain just a hoary myth.

http://www.securityfocus.com/news/9508

3. Mitnick movie comes to the U.S.
By: Kevin Poulsen

Trouble-plagued hacker film won't stay dead.
http://www.securityfocus.com/news/9470

4. WLANs go feral in corporate undergrowth
By: Stephen West, The Register

Frustrated employees are taking IT into their own hands by installing DIY Wi-Fi access points (APs) in their offices while their IT departments don't even notice, according to Gartner.

http://www.securityfocus.com/news/9553

5. Merger creates world's biggest IT security services firm
By: John Leyden, The Register

IT security firms TruSecure and Betrusted are to merge in order to create the "biggest security services company in the world".

http://www.securityfocus.com/news/9552

6. Rise of the Botnets
By: John Leyden, The Register

The first half of 2004 saw a huge increase in zombie PCs. Also called bots, their average numbers monitored by security firm Symantec rose between January and June from under 2,000 to more than 30,000 per day - peaking at 75,000 on one day.

http://www.securityfocus.com/news/9543

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. EPX Crypting Software 2.1
By: EdronSoft
Relevant URL: http://www.edronsoft.com/epx_pro.php
Platforms: Windows XP
Summary:

Protect your documents from others by encrypting them with DES and Triple DES strong algorithms. No need to remember passwords because you keep the key used for the decryption in a removable media device such as usb pen-drive (or floppy disk).
Wipe function to destroy data and full Drag'N Drop support.

2. Hacme Bank 1.0
By: Mark Curphey / Rudolph Araujo
Relevant URL: http://www.foundstone.com/s3i
Platforms: Windows XP
Summary:

A web application security training application

3. ID-Synch 3.1
By: M-Tech Information Technology, Inc.
Relevant URL: http://idsynch.com/
Platforms: AIX, AS/400, DG-UX, Digital UNIX/Alpha, HP-UX, IRIX, Linux, MacOS, MPE/iX, Netware, OpenBSD, OpenVMS, OS/2, OS/390, RACF, Solaris, SunOS, True64 UNIX, Ultrix, VM, VMS, VSE, Windows 2000, Windows NT
Summary:

ID-Synch is enterprise user provisioning software. It reduces the cost of user administration, helps new and reassigned users get to work more quickly, and ensures prompt and reliable access termination. This is accomplished through automatic propagation of changes to user profiles from systems of record to managed systems, with self service workflow for security change requests, through consolidated and delegated user administration, and with federation.

4. Nmap v3.70
By: Fyodor
Relevant URL: http://www.insecure.org/nmap/
Platforms: AIX, BSDI, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD, Solaris, SunOS, UNIX
Summary:

Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols (UDP, TCP, ICMP, etc.). Nmap supports Vanilla TCP connect() scanning, TCP SYN (half open) scanning, TCP FIN, Xmas, or NULL (stealth) scanning, TCP ftp proxy (bounce attack) scanning, SYN/FIN scanning using IP frag

5. DmpE32 -Symbian Executable Information Dumper 1.0
By: Jimmy Shah
Relevant URL: http://www.geocities.com/jfldars/DmpE32.zip
Platforms:
Summary:

Symbian Exe File dumper
* Useful for analysis of potential malware.

* Determine wheteher or not an executable has been inappropiately modified(Mosquitos "Trojan").

* Provides information on:
- Header
(UIDs,Section sizes, Entry Point, Application Type)
- Imported functions list
(DLL name and number of functions by default)

6. IP Firewall Hook ATL/COM 1.2
By: Egemen Tas
Relevant URL: http://www.modemwall.com/tipfwhook.htm
Platforms: Windows 2000, Windows XP
Summary:

IP Firewall Hook is a *FREE and open source* ATL/COM component based on "Windows Firewall-Hook Driver" technology. It is a powerful packet filtering component for Windows 2000/XP. A sample application firewall is also provided with it.

V. SECURITYJOBS LIST SUMMARY
----------------------------
1. [SJ-JOB] Security Architect, London, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375833

2. [SJ-JOB] Security Engineer, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375830

3. [SJ-JOB] Security Consultant, Chicago, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375829

4. [SJ-JOB] Sales Engineer, Herndon, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375823

5. [SJ-JOB] Sales Engineer, In or around New York City ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375822

6. [SJ-JOB] Management, Foster City, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375818

7. [SJ-JOB] Security Architect, Ft Lauderdale, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375817

8. [SJ-JOB] Auditor, Chicago, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375815

9. [SJ-JOB] Security Engineer, Boise, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375805

10. [SJ-JOB] Manager, Information Security, Rancho Cordo... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375803

11. [SJ-JOB] Security Consultant, Atlanta, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375801

12. [SJ-JOB] Security Architect, San Francisco , US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375792

13. [SJ-JOB] Developer, San Rafael, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375791

14. [SJ-JOB] Account Manager, Dallas, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375790

15. [SJ-JOB] Security Consultant, London, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375789

16. [SJ-JOB] Security Engineer, Metro DC, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375788

17. [SJ-JOB] Security Engineer, Seattle, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375787

18. [SJ-JOB] Director, Computer Security, Boston, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375783

19. [SJ-JOB] Manager, Information Security, London, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375774

20. [SJ-JOB] Sr. Product Manager, Cupertino, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375770

21. [SJ-JOB] Sales Engineer, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375767

22. [SJ-JOB] Sr. Security Analyst, Boise, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375763

23. [SJ-JOB] Account Manager, San Francisco, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375761

24. [SJ-JOB] Security Architect, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375756

25. [SJ-JOB] Chief Security Strategist, San Francisco , ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375755

26. [SJ-JOB] Account Manager, Any city, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375752

27. [SJ-JOB] Sales Engineer, Waltham, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375744

28. [SJ-JOB] Security Architect, Westborough, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375738

29. [SJ-JOB] Account Manager, Kansas City, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375215

30. [SJ-JOB] Manager, Information Security, West London,... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375210

31. [SJ-JOB] Security Consultant, Milwaukee, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375191

32. [SJ-JOB] Security Engineer, Champaign, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375183

33. [SJ-JOB] Information Assurance Analyst, Chantilly, U... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375181

34. [SJ-JOB] Sr. Product Manager, San Diego, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375179

35. [SJ-JOB] Management, Boston, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375152

36. [SJ-JOB] Management, Chicago, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375151

37. [SJ-JOB] Security Engineer, Elgin, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375145

38. [SJ-JOB] Management, New York, surrounding Areas, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375134

39. [SJ-JOB] Sr. Security Analyst, San Francisco, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375117

40. [SJ-JOB] Management, Irvine or Bay Area, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/375115

VI. INCIDENTS LIST SUMMARY
--------------------------
1. Yahoo Account hacking (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/375777

2. suspicous activities... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/375707

3. Systems compromised with ShellBOT perl script - part... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/375694

4. unusual 1.11.0.0/16 outbound traffic (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/375566

5. Wireless router behaviour (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/375189

6. Odd mail traffic (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/375166

VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. FreeBSD shellcode (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/375797

2. Problem with keyboard forwarding to cmd.exe shellcod... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/375685

3. Apache 1.3 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/375249

4. challenge (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/375226

5. ALPHA 2: Zero-tolerance (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/375116

VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Restrict Clinet IP address on Terminal Service (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375878

2. VBScript to audit shares and share permissions (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375864

3. How to Enforce Complex Password Policy for Selected ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375862

4. Hardening Desktop (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375858

5. tool for user disk quota (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375718

6. Windows2000 Security events (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375504

7. AW: tool for user disk quota (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375390

8. RES: How to Recovering files encrypted with Microsof... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375326

9. RKDetect - behaviour based rootkit detection (update... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375304

10. XP-SP2 "Feature" (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/375148

IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Solaris 9 authentication and access control into Act... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/375786

2. allowing ordinary users to open privileged ports (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/375190

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Network "Change Management" (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/375863

2. LIDS 1.2.2rc3 for Linux kernel 2.4.27 released (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/375239

XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XII. SPONSOR INFORMATION
-----------------------

This issue sponsored by: BindView

http://www.securityfocus.com/sponsor/BindView_sf-news_040921

------------------------------------------------------------------------