SecurityFocus Newsletter #270

Peter Laborge <[email protected]> 12 Oct 2004 19:31:06 -0000

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #270
------------------------------

This issue sponsored by: Internet Security Systems

Internet Security Systems - Keeping You Ahead of the Threat
When business losses are measured in seconds, Internet threats must be
stopped before they impact your network. To learn how Internet Security
Systems keeps organizations ahead of the threat with preemptive intrusion
prevention, download the new whitepaper, Defining the Rules of Preemptive
Protection, and end your reliance on reactive security technology.

http://www.securityfocus.com/sponsor/ISS_sf-news_041012

------------------------------------------------------------------------
I. FRONT AND CENTER
1. Defeating Honeypots: Network Issues, Part 2
2. Fueling the Fire
II. BUGTRAQ SUMMARY
1. Mozilla Firefox DATA URI File Deletion Vulnerability
2. Xerces C++ Duplicated Attributes XML Parsing Denial Of Servi...
3. Debian GNU/Linux Telnetd Invalid Memory Handling Vulnerabili...
4. Yappa-NG Show Random Image AddOn Unauthorized Locked Album A...
5. Roaring Penguin PPPoE Arbitrary File Overwrite Vulnerability
6. Macromedia ColdFusion MX Template Handling Privilege Escalat...
7. Sun Solaris Gzip File Permission Modification Vulnerability
8. DistCC Access Control Bypass Vulnerability
9. INCOGEN BugPort Unspecified Remote Vulnerability
10. FreeBSD Syscons CONS_SCRSHOT Kernel Memory Disclosure Vulner...
11. Apple Mac OS X Multiple Security Vulnerabilities
12. Apple Mac OS X Postfix Release SMTPD AUTH Username Denial Of...
13. CUPS Error_Log Local Password Disclosure Vulnerability
14. FuzzyMonkey My Blog Multiple Input Validation Vulnerabilitie...
15. NetworkActiv Web Server Remote Denial of Service Vulnerabili...
16. IBM DB2 Multiple Critical Remote Vulnerabilities
17. Symantec Norton AntiVirus MS-DOS Name Scan Evasion Vulnerabi...
18. PHPLinks Multiple Input Validation Vulnerabilities
19. Jetty Directory Traversal Vulnerability
20. Macromedia ColdFusion MX Remote File Content Disclosure Vuln...
21. Invision Power Board Referer Cross-Site Scripting Vulnerabil...
22. Sticker Unauthorized Secure Message Sending Vulnerability
23. RealOne Player and RealPlayer Multiple Unspecified Remote Vu...
24. BlackBoard Internet Newsboard System Remote File Include Vul...
25. Brooky CubeCart SQL Injection Vulnerability
26. DCP-Portal Multiple Cross-Site Scripting Vulnerabilities
27. DCP-Portal Multiple HTML Injection Vulnerabilities
28. DCP-Portal Calendar.PHP HTTP Response Splitting Vulnerabilit...
29. Microsoft ASP.NET URI Canonicalization Remote Information Di...
30. TriDComm Built-in FTP Server Directory Traversal Vulnerabili...
31. Apple Mac OS X ServerAdmin Default SSL Certificate Vulnerabi...
32. Microsoft Internet Explorer Local XML Document Disclosure Vu...
33. MySQL MaxDB WebDBM Server Name Denial of Service Vulnerabili...
34. Cyrus SASL Multiple Remote And Local Vulnerabilities
35. Wordpress Wp-login.PHP HTTP Response Splitting Vulnerability
36. Jean-Yves Lefort Mail Notification Multiple Undisclosed Vuln...
37. Microsoft Word Multiple Remote Denial Of Service Vulnerabili...
38. Jera Technology Flash Messaging Server Remote Denial of Serv...
39. Real Networks Helix Universal Server Remote Integer Handling...
40. Nathaniel Bray Yeemp File Transfer Public Key Verification B...
41. Monolith Lithtech Game Engine Remote Buffer Overflow Vulnera...
III. SECURITYFOCUS NEWS ARTICLES
1. Shifting cyber threats menace factory floors
2. Warspammer guilty under new federal law
3. U.N. warns of nuclear cyber attack risk
4. Webroot: Spyware is Windows-only
5. Botched maintenance - not worm - blamed for MS IM glitch
6. Word open to exploit
IV. SECURITYFOCUS TOP 6 TOOLS
1. DiskInternals Uneraser 2.01
2. DiskInternals NTFS Reader 1.01
3. Airscanner Mobile Firewall 1.0
4. PHP_Sec (Wasp Project) 0.0.1
5. SiVuS, The VoIP Vulnerability Scanner 1.07
6. XArp 0.1.5
V. SECURITYJOBS LIST SUMMARY
1. [SJ-JOB] Auditor, Minneapolis, US (Thread)
2. [SJ-JOB] Auditor, Phoenix, US (Thread)
3. [SJ-JOB] Application Security Engineer, Amsterdam, N... (Thread)
4. [SJ-JOB] Sales Engineer, Columbia, US (Thread)
5. [SJ-JOB] Security Auditor, London, GB (Thread)
6. [SJ-JOB] Sales Engineer, Atlanta, US (Thread)
7. [SJ-JOB] Security Architect, Los Angeles, US (Thread)
8. [SJ-JOB] Sales Engineer, Washington DC, US (Thread)
9. [SJ-JOB] Technical Writer, Cupertino, US (Thread)
10. [SJ-JOB] Manager, Information Security, Los Angeles,... (Thread)
11. [SJ-JOB] Security Engineer, Paramus, US (Thread)
12. [SJ-JOB] Security Architect, Chantilly, US (Thread)
13. [SJ-JOB] CSO, McLean, US (Thread)
14. [SJ-JOB] Chief Security Strategist, Washington, DC, ... (Thread)
15. [SJ-JOB] Security Engineer, Jersey City, US (Thread)
16. [SJ-JOB] Security Architect, New York, US (Thread)
17. [SJ-JOB] Security Consultant, London - West London /... (Thread)
18. [SJ-JOB] Sales Engineer, Central Region, US (Thread)
19. [SJ-JOB] Information Assurance Analyst, Jersey City,... (Thread)
20. [SJ-JOB] Security Engineer, South East, GB (Thread)
21. [SJ-JOB] Sr. Security Analyst, Green Bay, US (Thread)
22. [SJ-JOB] Auditor, New York, US (Thread)
23. [SJ-JOB] Sr. Security Analyst, Herndon, US (Thread)
24. [SJ-JOB] Sr. Security Analyst, London, GB (Thread)
25. [SJ-JOB] Application Security Engineer, London, GB (Thread)
26. [SJ-JOB] Account Manager, Milton, CA (Thread)
27. [SJ-JOB] Developer, San Jose, US (Thread)
28. [SJ-JOB] Security Consultant, Boston, US (Thread)
29. [SJ-JOB] Management, Vevey, CH (Thread)
30. [SJ-JOB] Security Engineer, San Jose, US (Thread)
31. [SJ-JOB] Sr. Security Engineer, Bethesda, US (Thread)
32. [SJ-JOB] Developer, San Francisco, US (Thread)
VI. INCIDENTS LIST SUMMARY
1. Recent rise in Phishing attacks (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. confirm unsubscribe from [email protected] (Thread)
2. No body emails and Norton antivirus (Thread)
3. Re[2]: Kaspersky AntiVirus Window Caption GUI Bypass... (Thread)
4. Kaspersky AntiVirus Window Caption GUI Bypass Vulner... (Thread)
5. nmapbot: using instant messaging as platform for run... (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Can we really block users from installing applicatio... (Thread)
2. Can we really block users from installing applicatio... (Thread)
3. MS ISA activeX Filtering (Thread)
4. Can we really block users from installing applicatio... (Thread)
5. Can we really block users from installing applicatio... (Thread)
6. Restricting account to a computer only (Thread)
7. SecurityFocus Microsoft Newsletter #209 (Thread)
8. Application sniffer-next step (Thread)
IX. SUN FOCUS LIST SUMMARY
1. OffTopic - Solaris 9 & openldap (Thread)
X. LINUX FOCUS LIST SUMMARY
1. iptables & tcp wrappers (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Defeating Honeypots: Network Issues, Part 2
By Laurent Oudot and Thorsten Holz

The purpose of this paper is to explain how attackers behave when they
attempt to identify and defeat honeypots, and is useful information for
security professionals who need to deploy honeypots in a more stealthy
manner. Part 2 looks at Sebek-based honeypots, snort_inline, Fake AP, and
Bait and Switch honeypots.

http://www.securityfocus.com/infocus/1805

2. Fueling the Fire
By Scott Granneman

The latest Symantec Threat Report can provide us with information,
knowledge, and even a little bit of wisdom -- about what has truly become
an epidemic and an avenue for organized crime.

http://www.securityfocus.com/columnists/271

II. BUGTRAQ SUMMARY
-------------------
1. Mozilla Firefox DATA URI File Deletion Vulnerability
BugTraq ID: 11311
Remote: Yes
Date Published: Oct 02 2004
Relevant URL: http://www.securityfocus.com/bid/11311
Summary:
It is reported that Mozilla Firefox is susceptible to a file deletion vulnerability.

This vulnerability allows attackers that can lure unsuspecting users to view malicious HTML or script code to cause the recursive deletion of the victim users configured download directory. They can achieve this by crafting malicious web pages containing either HTML or script code that utilizes the 'data:' URI scheme.

This vulnerability is reported to exist in Mozilla Firefox in versions prior to 0.10.1.

2. Xerces C++ Duplicated Attributes XML Parsing Denial Of Servi...
BugTraq ID: 11312
Remote: Yes
Date Published: Oct 02 2004
Relevant URL: http://www.securityfocus.com/bid/11312
Summary:
It is reported that Xerces C++ is susceptible to a denial of service vulnerability. This issue is due to a failure of the application to properly handle exceptional XML input.

This vulnerability allows remote attackers to consume all available CPU resources by passing maliciously crafted XML data to an application that utilizes the affected library.

Version 2.5.0 of Xerces C++ is reported to be affected by this vulnerability. Other prior versions may also be affected.

3. Debian GNU/Linux Telnetd Invalid Memory Handling Vulnerabili...
BugTraq ID: 11313
Remote: Yes
Date Published: Oct 03 2004
Relevant URL: http://www.securityfocus.com/bid/11313
Summary:
Telnetd as provided by Debian/GNU Linux is reported susceptible to an invalid memory handling vulnerability. This issue is due to a failure of the application to ensure that memory buffers are properly allocated and deallocated.

It is conjectured that attackers may potentially leverage this vulnerability to execute code in the context of the telnetd process. Debian GNU/Linux runs the process as the unprivileged 'telnetd' user by default.

Versions of telnetd prior to 0.17-18woody1 for the stable branch, and 0.17-26 for the unstable branch are reported to be affected by this vulnerability.

4. Yappa-NG Show Random Image AddOn Unauthorized Locked Album A...
BugTraq ID: 11314
Remote: Yes
Date Published: Oct 04 2004
Relevant URL: http://www.securityfocus.com/bid/11314
Summary:
yappa-ng is prone to a security vulnerability in the AddOn that shows a random image from any homepage. This issue may let unauthorized users access images from locked albums.

5. Roaring Penguin PPPoE Arbitrary File Overwrite Vulnerability
BugTraq ID: 11315
Remote: No
Date Published: Oct 04 2004
Relevant URL: http://www.securityfocus.com/bid/11315
Summary:
Roaring Penguin PPPoE is vulnerable to a local arbitrary file overwrite vulnerability. This issue is due to a failure of the affected driver to properly validate the existence of temporary files prior to writing to them.

An attacker may exploit this vulnerability to overwrite any file on the affected computer if the setuid superuser bit is set privileges. It should be noted that this application is not installed with the setuid bit set by default.

6. Macromedia ColdFusion MX Template Handling Privilege Escalat...
BugTraq ID: 11316
Remote: Yes
Date Published: Oct 04 2004
Relevant URL: http://www.securityfocus.com/bid/11316
Summary:
Reportedly Macromedia ColdFusion MX is affected by privilege escalation vulnerability when handling templates. This issue is due to an access validation error that allows a user to perform actions with administrator privileges.

An attacker may exploit this issue to gain administrative privileges on a computer running the vulnerable application.

7. Sun Solaris Gzip File Permission Modification Vulnerability
BugTraq ID: 11318
Remote: No
Date Published: Oct 01 2004
Relevant URL: http://www.securityfocus.com/bid/11318
Summary:
Sun Solaris gzip(1) is reported prone to a file permission modification vulnerability. This issue can disclose sensitive information and allocate write permission on files to unprivileged local users.

Sun Solaris 8 is reported to be affected by this issue.

8. DistCC Access Control Bypass Vulnerability
BugTraq ID: 11319
Remote: Yes
Date Published: Oct 04 2004
Relevant URL: http://www.securityfocus.com/bid/11319
Summary:
It is reported that the distcc access controls may malfunction under certain circumstances. This may result in access controls not being enforced.

A remote attacker may potentially exploit this vulnerability to gain access to the affected distcc service regardless of access control rules that are set in place.

This vulnerability is addressed in distcc 2.16.

9. INCOGEN BugPort Unspecified Remote Vulnerability
BugTraq ID: 11320
Remote: Yes
Date Published: Oct 01 2004
Relevant URL: http://www.securityfocus.com/bid/11320
Summary:
BugPort is reported prone to an unspecified remote vulnerability. This issue arises due to improper handling of file attachments by the application. Further details were not provided, however, it is conjectured that this issue may allow an attacker to upload arbitrary files to a server running the vulnerable application.

If an attacker is able to upload and execute arbitrary files containing script code to a server, this issue may lead to various attacks resulting in a compromise of the underlying Web server.

This issue is reported to affect BugPort versions 1.133 and prior.

10. FreeBSD Syscons CONS_SCRSHOT Kernel Memory Disclosure Vulner...
BugTraq ID: 11321
Remote: No
Date Published: Oct 04 2004
Relevant URL: http://www.securityfocus.com/bid/11321
Summary:
It is reported that it is possible to trigger a memory disclosure vulnerability in the FreeBSD syscons driver.

An attacker may leverage this issue to read portions of kernel memory. This could allow an attacker to read sensitive data such as a file cache or terminal buffers that may contain a password. Data harvested through exploiting this vulnerability may be used to aid in further attacks launched against the affected computer.

11. Apple Mac OS X Multiple Security Vulnerabilities
BugTraq ID: 11322
Remote: Yes
Date Published: Oct 04 2004
Relevant URL: http://www.securityfocus.com/bid/11322
Summary:
Multiple security vulnerabilities are reported in Mac OS X. A security update is available to address these issues and to provide other enhancements. The following issues are reported:

Apple AFP server is reported prone to a remote denial of service vulnerability.

A weak permissions vulnerability is reported to affect the AFP server. This may result in a false sense of security for an administrator.

A vulnerability is reported to exist in the NetInfoManager utility. It is reported that the utility will, under certain circumstances, report the status of certain accounts as disabled when they are not.

A heap-based buffer overrun is reported to exist in the QuickTime utility. An attacker may exploit this vulnerability to execute arbitrary instructions in the context of the user that is running the vulnerable software.

Finally, ServerAdmin is reported prone to a weak default configuration vulnerability. This may result in ServerAdmin traffic being intercepted and decrypted by a remote attacker. This vulnerability has been split into BID 11344.

Some of these issues may already be described in previous BIDs. This BID will be split up into unique BIDs when further analysis of this update is complete.

12. Apple Mac OS X Postfix Release SMTPD AUTH Username Denial Of...
BugTraq ID: 11323
Remote: Yes
Date Published: Oct 04 2004
Relevant URL: http://www.securityfocus.com/bid/11323
Summary:
A vulnerability exists in the Postfix release distributed with Mac OS X that is related to the handling of usernames supplied through SMTPD AUTH. This may potentially be exploited to deny certain users access to the server.

This condition may only occur if SMTPD AUTH has been enabled.

This issue reportedly does not affect the upstream release of Postfix but rather only the version distributed with Apple Mac OS X Panther.

13. CUPS Error_Log Local Password Disclosure Vulnerability
BugTraq ID: 11324
Remote: No
Date Published: Oct 04 2004
Relevant URL: http://www.securityfocus.com/bid/11324
Summary:
CUPS is reported prone to a local password disclosure vulnerability. This issue is reported to present itself when an authenticated user carries out certain methods of remote printing. Reportedly, local attackers can disclose user passwords in the printing system log files.

CUPS 1.1.21 and prior are considered vulnerable to this issue.

Due to a lack of detail, further information is not available at the moment. This BID will be updated as more information becomes available.

14. FuzzyMonkey My Blog Multiple Input Validation Vulnerabilitie...
BugTraq ID: 11325
Remote: Yes
Date Published: Oct 05 2004
Relevant URL: http://www.securityfocus.com/bid/11325
Summary:
FuzzyMonkey My Blog is vulnerable to multiple input validation vulnerabilities. These issues are caused by a failure to validate and filter user-supplied strings before including them in dynamic Web page content.

An attacker could leverage these issues to carry out cross-site scripting attacks against unsuspecting users, facilitating theft of cookie-based authentication credentials as well as other attacks.

15. NetworkActiv Web Server Remote Denial of Service Vulnerabili...
BugTraq ID: 11326
Remote: Yes
Date Published: Oct 05 2004
Relevant URL: http://www.securityfocus.com/bid/11326
Summary:
NetworkActiv Web Server is reported prone to a remote denial of service vulnerability. This issue arises because the application fails to handle exceptional conditions leading to a crash.

NetworkActiv Web Server version 1.0 is reported prone to this vulnerability. It is possible that other versions are affected as well.

16. IBM DB2 Multiple Critical Remote Vulnerabilities
BugTraq ID: 11327
Remote: Yes
Date Published: Oct 05 2004
Relevant URL: http://www.securityfocus.com/bid/11327
Summary:
The reported vulnerabilities include 20 remote vulnerabilities, most of which are buffer overflows. All of these issues are apparently of 'critical' severity.

Details about any of the vulnerabilities are not known at this time. This BID will be updated and split into individual BIDs as further information becomes available.

17. Symantec Norton AntiVirus MS-DOS Name Scan Evasion Vulnerabi...
BugTraq ID: 11328
Remote: Yes
Date Published: Oct 05 2004
Relevant URL: http://www.securityfocus.com/bid/11328
Summary:
Norton AntiVirus is affected by a scan evasion vulnerability when handling files with MS-DOS reserve device names. This issue is due to a design error that allows the files to avoid being scanned. It should be noted that this vulnerability only arises once the file is already present on a vulnerable computer. All Norton AntiVirus products are able to detect malicious files through incoming email.

18. PHPLinks Multiple Input Validation Vulnerabilities
BugTraq ID: 11329
Remote: Yes
Date Published: Oct 05 2004
Relevant URL: http://www.securityfocus.com/bid/11329
Summary:
PHPLinks is reported prone to multiple input validation vulnerabilities.

A file include vulnerability is reported to affect the 'index.php' script. This may allow an attacker to include and execute arbitrary PHP scripts. Code execution will occur in the context of the web server process that is hosting the vulnerable script.

SQL injection issues are reported to exist in the application as well. Due to this, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries.

19. Jetty Directory Traversal Vulnerability
BugTraq ID: 11330
Remote: Yes
Date Published: Oct 05 2004
Relevant URL: http://www.securityfocus.com/bid/11330
Summary:
It is reported that Jetty is susceptible to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize HTTP request URIs.

This vulnerability allows remote attackers to retrieve the contents of arbitrary, potentially sensitive files located on the serving computer with the credentials of the affected process.

It is unclear at this time exactly which versions of Jetty are affected by this vulnerability. This BID will be updated as further information is disclosed.

This vulnerability may be related to BID 4360.

20. Macromedia ColdFusion MX Remote File Content Disclosure Vuln...
BugTraq ID: 11331
Remote: Yes
Date Published: Oct 05 2004
Relevant URL: http://www.securityfocus.com/bid/11331
Summary:
Macromedia ColdFusion MX is affected by a remote file content disclosure vulnerability. This vulnerability is caused by access validation issue that allows an attacker to bypass protections to reveal the contents of files.

It should be noted that this issue does not reveal directory contents, therefore attackers must have prior knowledge of target files.

An attacker may leverage this issue to read the contents of files contained under the webroot directory that are readable by the ColdFusion process on the affected computer; affectively bypassing access restrictions set in the IIS management system.

21. Invision Power Board Referer Cross-Site Scripting Vulnerabil...
BugTraq ID: 11332
Remote: Yes
Date Published: Oct 05 2004
Relevant URL: http://www.securityfocus.com/bid/11332
Summary:
Reportedly Invision Power Board is affected by a remote cross-site scripting vulnerability. This issue is due to a failure of the application to validate or sanitize user supplied input prior to including it in dynamic Web content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the vulnerable application, facilitating the theft of cookie-based authentication credentials as well as other attacks.

22. Sticker Unauthorized Secure Message Sending Vulnerability
BugTraq ID: 11333
Remote: Yes
Date Published: Oct 05 2004
Relevant URL: http://www.securityfocus.com/bid/11333
Summary:
It is reported that Sticker is susceptible to an unauthorized secure message sending vulnerability.

This vulnerability reportedly exists because of a flaw in the application that allows for senders to send messages to groups when they do not hold the specified, shared private key of the group. This allows unauthenticated, unauthorized users to send messages to groups.

This vulnerability is reported to exist in version 3.1 beta 1 of Sticker.

23. RealOne Player and RealPlayer Multiple Unspecified Remote Vu...
BugTraq ID: 11335
Remote: Yes
Date Published: Oct 06 2004
Relevant URL: http://www.securityfocus.com/bid/11335
Summary:
NGSSoftware have reported that multiple buffer overflow and unauthorized file access vulnerabilities exist in RealOne and RealPlayer. Details about these vulnerabilities have been withheld until a later date, but it appears that some of the issues may overlap with existing BIDs 11307 and 11308. There also appears to be other vulnerabilities that are not covered in these two BIDs.

Real Networks have reportedly released fixes for all of the issues.

24. BlackBoard Internet Newsboard System Remote File Include Vul...
BugTraq ID: 11336
Remote: Yes
Date Published: Oct 06 2004
Relevant URL: http://www.securityfocus.com/bid/11336
Summary:
BlackBoard Internet Newsboard System is reported prone to a remote file include vulnerability. This issue presents itself because the application fails to sanitize user-supplied data properly. This issue may allow an attacker to include malicious files containing arbitrary script code to be executed on a vulnerable computer.

BlackBoard Internet Newsboard System version 1.5.1 is reported prone to this vulnerability. It is possible that prior versions are affected as well.

25. Brooky CubeCart SQL Injection Vulnerability
BugTraq ID: 11337
Remote: Yes
Date Published: Oct 06 2004
Relevant URL: http://www.securityfocus.com/bid/11337
Summary:
It is reported that CubeCart is susceptible to an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI data prior to including it in an SQL query.

An attacker may exploit this issue to manipulate SQL queries, potentially revealing or corrupting sensitive database data. This issue may also facilitate attacks against the underlying database software.

This vulnerability is reported to exist in version 2.0.1 of CubeCart. Other versions may also be affected.

26. DCP-Portal Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 11338
Remote: Yes
Date Published: Oct 06 2004
Relevant URL: http://www.securityfocus.com/bid/11338
Summary:
DCP-Portal is reported prone to multiple cross-site scripting vulnerabilities. It is reported that DCP-Portal does not sufficiently filter URI parameters supplied to several scripts.

Because of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user if the link is followed. The script code contained in the URI parameter will be executed in the context of the vulnerable website.

This may allow for theft of cookie-based authentication credentials and other attacks.

27. DCP-Portal Multiple HTML Injection Vulnerabilities
BugTraq ID: 11339
Remote: Yes
Date Published: Oct 06 2004
Relevant URL: http://www.securityfocus.com/bid/11339
Summary:
DCP-Portal is reported prone to multiple HTML injection vulnerabilities. It is reported that DCP-Portal does not sufficiently filter data submitted via input fields in several scripts.

These vulnerabilities may permit execution of hostile script code when a user views pages that include the injected code. The hostile code would be rendered in the context of the site hosting the vulnerable software. Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible since the attacker may influence how pages within the DCP-Portal are rendered to users.

28. DCP-Portal Calendar.PHP HTTP Response Splitting Vulnerabilit...
BugTraq ID: 11340
Remote: Yes
Date Published: Oct 06 2004
Relevant URL: http://www.securityfocus.com/bid/11340
Summary:
DCP-Portal is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.

29. Microsoft ASP.NET URI Canonicalization Remote Information Di...
BugTraq ID: 11342
Remote: Yes
Date Published: Oct 06 2004
Relevant URL: http://www.securityfocus.com/bid/11342
Summary:
Microsoft ASP.NET is reported prone to a remote information disclosure vulnerability. This issue is due to a failure of the application to properly secure documents when handling malformed URI requests.

An attacker may leverage this issue to bypass authentication required to access files in secured directories.

30. TriDComm Built-in FTP Server Directory Traversal Vulnerabili...
BugTraq ID: 11343
Remote: Yes
Date Published: Oct 06 2004
Relevant URL: http://www.securityfocus.com/bid/11343
Summary:
It is reported that TriDComm is susceptible to a directory traversal vulnerability in its built-in FTP server. The FTP server is not enabled by default.

This vulnerability allows attackers to write, or access files contained outside of the configured document root of the affected FTP server with the privileges of the affected process. This may allow them to overwrite critical files, resulting in denial of service conditions, or assist them in full system compromise. They may also retrieve the contents of potentially sensitive files, aiding them in further attacks.

This vulnerability is reported to exist in versions 1.2 and 1.3 of the package.

31. Apple Mac OS X ServerAdmin Default SSL Certificate Vulnerabi...
BugTraq ID: 11344
Remote: Yes
Date Published: Oct 06 2004
Relevant URL: http://www.securityfocus.com/bid/11344
Summary:
It is reported that Mac OS X comes with a default private SSL certificate vulnerability.

This vulnerability allows attackers to decrypt all communications between ServerAdmin servers and clients. This facilitates the theft of authentication credentials by sniffing networks containing the affected application, and then utilizing the known private key in applications such as 'ssldump'.

Once authentication credentials are stolen, attackers can then utilize ServerAdmin for full system compromise.

Mac OS X Server 10.2.8 and 10.3.5 are reported affected by this vulnerability. Previous versions may also be affected.

This BID has been split from BID 11322 (Apple Mac OS X Multiple Security Vulnerabilities).

32. Microsoft Internet Explorer Local XML Document Disclosure Vu...
BugTraq ID: 11345
Remote: Yes
Date Published: Oct 07 2004
Relevant URL: http://www.securityfocus.com/bid/11345
Summary:
Reportedly Microsoft Internet Explorer is affected by a vulnerability that could expose sensitive information from client computers. This issue is due to an access validation error that allows a malicious Web page to access XML documents on a client computer.

An attacker may leverage this issue to read XML documents on an unsuspecting user's computer when they open a malicious HTML document. The reading of such files will take place with the privileges of the user running the vulnerable Web browser.

**UPDATE: This appears to be the same issue as BID 5560, discovered by GreyMagic Software and patched in MS02-047. It appears that the vulnerability is present in patched systems when the <script> tag is in a static HTML document. Exploitation of this vulnerability using dynamic insertion (e.g. document.write) of the <script> tag into a document is blocked.

33. MySQL MaxDB WebDBM Server Name Denial of Service Vulnerabili...
BugTraq ID: 11346
Remote: Yes
Date Published: Oct 07 2004
Relevant URL: http://www.securityfocus.com/bid/11346
Summary:
A remotely exploitable denial of service vulnerability exists in MaxDB. The cause of this condition is an input validation error that is exposed when an internal function in the WebDBM handles a client-supplied 'Server' name in an HTTP request that includes specific values.

This will reportedly trigger an exception due to an assert directive failing, resulting in a denial of service condition in the web agent.

This issue was reportedly tested on Windows and Linux versions. Other versions could also be affected.

34. Cyrus SASL Multiple Remote And Local Vulnerabilities
BugTraq ID: 11347
Remote: Yes
Date Published: Oct 07 2004
Relevant URL: http://www.securityfocus.com/bid/11347
Summary:
Cyrus SASL is affected by multiple critical vulnerabilities that may be remotely exploitable. The first issue is due to a boundary condition error, the second issue is due to a failure of the application to properly handle environment variables.

Information currently available regarding these issues is insufficient to provide a more detailed analysis. This BID will be updated and split into separate BIDs when more information becomes available.

An attacker can leverage the boundary condition issue to exploit arbitrary code on the affected computer. The impact of the environment variable issue is currently unknown.

35. Wordpress Wp-login.PHP HTTP Response Splitting Vulnerability
BugTraq ID: 11348
Remote: Yes
Date Published: Oct 07 2004
Relevant URL: http://www.securityfocus.com/bid/11348
Summary:
Wordpress is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled.

36. Jean-Yves Lefort Mail Notification Multiple Undisclosed Vuln...
BugTraq ID: 11349
Remote: No
Date Published: Oct 07 2004
Relevant URL: http://www.securityfocus.com/bid/11349
Summary:
Jean-Yves Lefort Mail Notification is reported prone to two undisclosed security vulnerabilities. The cause or impact of these vulnerabilities is not known at this time.

Details regarding these vulnerabilities are not available. This BID will be updated as further information regarding these vulnerabilities is announced.

37. Microsoft Word Multiple Remote Denial Of Service Vulnerabili...
BugTraq ID: 11350
Remote: Yes
Date Published: Oct 07 2004
Relevant URL: http://www.securityfocus.com/bid/11350
Summary:
Reportedly Microsoft Word is affected by multiple remote denial of service vulnerabilities. These issues are due to input validation errors surrounding malformed '.doc' formatted files.

An attacker may leverage these issues to cause the affected software to hang or crash, denying service to legitimate users.

38. Jera Technology Flash Messaging Server Remote Denial of Serv...
BugTraq ID: 11351
Remote: Yes
Date Published: Oct 07 2004
Relevant URL: http://www.securityfocus.com/bid/11351
Summary:
Flash Messaging server is reported prone to a remote denial of service vulnerability. This issue arises due to the inability of the server to handle exceptional conditions properly. A remote attacker may cause a vulnerable server to crash, denying service to legitimate users.

Flash Messaging server 5.2.0g and prior versions are reported prone to this issue.

39. Real Networks Helix Universal Server Remote Integer Handling...
BugTraq ID: 11352
Remote: Yes
Date Published: Oct 07 2004
Relevant URL: http://www.securityfocus.com/bid/11352
Summary:
A remote integer handling denial of service vulnerability affects the Real Networks Helix Universal Server. The problem surrounds the mishandling of some POST headers values.

An attacker can exploit this issue to cause the affected server to consume excessive computer resources and hang, denying service to legitimate users.

40. Nathaniel Bray Yeemp File Transfer Public Key Verification B...
BugTraq ID: 11353
Remote: Yes
Date Published: Oct 08 2004
Relevant URL: http://www.securityfocus.com/bid/11353
Summary:
It is reported that Yeemp does not properly verify public keys when a file is transferred. Yeemp clients are assigned public keys and Yeemp uses public keys to authenticate users and encrypt messages. Reportedly, the application does not verify keys on incoming files. Due to this, remote attackers are able to spoof sender information and send potentially malicious files to users.

Yeemp versions 0.9.9 and earlier are affected by this issue.

41. Monolith Lithtech Game Engine Remote Buffer Overflow Vulnera...
BugTraq ID: 11354
Remote: Yes
Date Published: Oct 08 2004
Relevant URL: http://www.securityfocus.com/bid/11354
Summary:
Monolith Lithtech game engine is affected by a remote buffer overflow vulnerability. This issue is due to a failure of the application to verify the length of a string before copying it into a finite process buffer.

An attacker may leverage this issue to cause the affected game application to crash, denying service to legitimate users. This issue may also be leveraged to execute arbitrary code on the affected computer with the privileges of the user that activated the vulnerable game.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Shifting cyber threats menace factory floors
By: Kevin Poulsen

A new report says that external attackers have overtaken insiders as the most likely cyber threat to remote-controlled factory equipment.
http://www.securityfocus.com/news/9671

2. Warspammer guilty under new federal law
By: Kevin Poulsen

A Los Angeles man who spewed electronic porn advertisements from his car likely faces up to six months in jail.

http://www.securityfocus.com/news/9606

3. U.N. warns of nuclear cyber attack risk
By: Kevin Poulsen

The International Atomic Energy Agency warns of the possibility of plant sabotage by intruders and corrupt insiders.

http://www.securityfocus.com/news/9592

4. Webroot: Spyware is Windows-only
By: John Leyden, The Register

Spyware, those annoying programs that snoop on a user's actions, remain a Windows-only phenomenon.

http://www.securityfocus.com/news/9696

5. Botched maintenance - not worm - blamed for MS IM glitch
By: John Leyden, The Register

MSN Messenger, Microsoft's instant message service, is back up and running this morning after a routine maintenance operation went wrong, rendering the service sporadically unavailable for three days.

http://www.securityfocus.com/news/9695

6. Word open to exploit
By: John Leyden, The Register

An unpatched security vulnerability in popular older versions of Microsoft Word poses a severe threat to users, security reporting firm Secunia warned yesterday.

http://www.securityfocus.com/news/9676

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. DiskInternals Uneraser 2.01
By: Alexey Babenko
Relevant URL: http://diskinternals.com/download/Uneraser_Setup.zip
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

DiskInternals Uneraser can recover any deleted file, including documents, photos, mp3 and zip files, or even folders and damaged disks. In addition to HDD, the program supports any type of storage media (music sticks, cameras, flash drives, USB drives, etc)! It works with encrypted files and helps you undelete file lost because of a virus attack or an employee's malicious behavior. No special skills needed; 100% free to try.

2. DiskInternals NTFS Reader 1.01
By: Alexey Babenko
Relevant URL: http://diskinternals.com/download/NTFS_Reader_Setup.zip
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

Provides read access to NTFS disks from Windows 95, 98 and Me. Allows you to save any files to any disk visible on the system or on the network. Supports saving compressed or encrypted files.

While saving, it ignores file security policies. It means that it is possible to access absolutely any file on a NTFS disk from Windows 9x.

3. Airscanner Mobile Firewall 1.0
By: Airscanner Corp
Relevant URL: http://www.airscanner.com/downloads/fw/amfw.exe
Platforms: Windows CE
Summary:

A Full-Strength Personal Firewall for Your Windows Mobile/Pocket PC handheld.

Airscanner Mobile Firewall for Windows Mobile Pocket PC is a low-level, bi-directional, packet filtering firewall that examines all incoming and outgoing TCP/IP traffic.

This personal firewall ensures that data is permitted based on access control lists that you select from a set of predefined filters, or from filters that you create yourself.

The firewall parses packets as they come in (or go out)

4. PHP_Sec (Wasp Project) 0.0.1
By: Jose Antonio Coret (Joxean Koret)
Relevant URL: http://savannah.nongnu.org/projects/wasp
Platforms: PHP
Summary:

PHP_Sec is a library for PHP, designed to detect possible Web attacks, use encryption and log information quickly and easily.

The library acts as an IDS but at script level detecting possible SQL Injection, Cross Site Scripting, Directory Traversal, Evasion Techniques and various other vulnerabilties.

By adding 2 lines of code we can protect any application PHP application in an easy way.

5. SiVuS, The VoIP Vulnerability Scanner 1.07
By: SiVuS
Relevant URL: http://www.vopsecurity.org/html/downloads.html
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

New release of the first free VoIP vulnerability scanner with enhanced features. Additional vulnerability checks, faster discovery scanner, ability to save and reload configurations and more. SiVuS can be downloaded from www.vopsecurity.org

6. XArp 0.1.5
By: Christoph Mayer
Relevant URL: http://www.chrismc.de
Platforms: Windows 2000, Windows XP
Summary:

XArp is a graphical tool to monitor the ARP cache. It periodically requests the local ARP cache and reports changes in the IP to MAC mapping. Thus it can be used to recognize ARP poisoning which is used to prepare 'man in the middle' attacks on switched networks.

V. SECURITYJOBS LIST SUMMARY
----------------------------
1. [SJ-JOB] Auditor, Minneapolis, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377829

2. [SJ-JOB] Auditor, Phoenix, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377828

3. [SJ-JOB] Application Security Engineer, Amsterdam, N... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377827

4. [SJ-JOB] Sales Engineer, Columbia, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377826

5. [SJ-JOB] Security Auditor, London, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377825

6. [SJ-JOB] Sales Engineer, Atlanta, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377824

7. [SJ-JOB] Security Architect, Los Angeles, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377822

8. [SJ-JOB] Sales Engineer, Washington DC, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377821

9. [SJ-JOB] Technical Writer, Cupertino, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377820

10. [SJ-JOB] Manager, Information Security, Los Angeles,... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377819

11. [SJ-JOB] Security Engineer, Paramus, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377817

12. [SJ-JOB] Security Architect, Chantilly, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377815

13. [SJ-JOB] CSO, McLean, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377813

14. [SJ-JOB] Chief Security Strategist, Washington, DC, ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377812

15. [SJ-JOB] Security Engineer, Jersey City, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377811

16. [SJ-JOB] Security Architect, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377810

17. [SJ-JOB] Security Consultant, London - West London /... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377808

18. [SJ-JOB] Sales Engineer, Central Region, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377807

19. [SJ-JOB] Information Assurance Analyst, Jersey City,... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377806

20. [SJ-JOB] Security Engineer, South East, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377796

21. [SJ-JOB] Sr. Security Analyst, Green Bay, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377795

22. [SJ-JOB] Auditor, New York, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377792

23. [SJ-JOB] Sr. Security Analyst, Herndon, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377791

24. [SJ-JOB] Sr. Security Analyst, London, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377790

25. [SJ-JOB] Application Security Engineer, London, GB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377785

26. [SJ-JOB] Account Manager, Milton, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377784

27. [SJ-JOB] Developer, San Jose, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377610

28. [SJ-JOB] Security Consultant, Boston, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377609

29. [SJ-JOB] Management, Vevey, CH (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377605

30. [SJ-JOB] Security Engineer, San Jose, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377602

31. [SJ-JOB] Sr. Security Engineer, Bethesda, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377598

32. [SJ-JOB] Developer, San Francisco, US (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/377597

VI. INCIDENTS LIST SUMMARY
--------------------------
1. Recent rise in Phishing attacks (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/378031

VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. confirm unsubscribe from [email protected] (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/378036

2. No body emails and Norton antivirus (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/378034

3. Re[2]: Kaspersky AntiVirus Window Caption GUI Bypass... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/377704

4. Kaspersky AntiVirus Window Caption GUI Bypass Vulner... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/377608

5. nmapbot: using instant messaging as platform for run... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/377588

VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Can we really block users from installing applicatio... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/378105

2. Can we really block users from installing applicatio... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/378101

3. MS ISA activeX Filtering (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/377991

4. Can we really block users from installing applicatio... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/377988

5. Can we really block users from installing applicatio... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/377970

6. Restricting account to a computer only (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/377710

7. SecurityFocus Microsoft Newsletter #209 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/377607

8. Application sniffer-next step (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/377563

IX. SUN FOCUS LIST SUMMARY
--------------------------
1. OffTopic - Solaris 9 & openldap (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/377765

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. iptables & tcp wrappers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/377742

XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

XII. SPONSOR INFORMATION
-----------------------

This issue sponsored by: Internet Security Systems

http://www.securityfocus.com/sponsor/ISS_sf-news_041012

------------------------------------------------------------------------