SecurityFocus Newsletter #161

John Boletta <[email protected]> Mon, 9 Sep 2002 13:38:27 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #161
-----------------------------

This Issue is Sponsored By: Qualys

Bulletproof Your Network: FREE Guide

Existing security products -- firewalls, anti-virus and IDS -- are simply
no longer enough to ensure your networks are safe against sophisticated
attacks and worms such as Code Red and Nimda. FREE Guide shows you how to
ensure TOTAL security for your network. Get it now.

Visit us at:
https://www.qualys.com/forms/guide_220.php
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Win2K First Responder's Guide
2. Who Goes There? An Introduction to On-Access Virus Scanning...
3. Cheap Thrills on the Cyberterror Beat
4. SecurityFocus DPP Program
5. IIR's 3G Fraud & Security Forum
II. BUGTRAQ SUMMARY
1. Blue Coat Systems Error Page Cross Site Scripting Vulnerability
2. Multiple Cisco VPN 3000 Vulnerabilities
3. Microsoft Internet Explorer HTML Same Origin Policy Violation...
4. Aestiva HTML/OS Cross-Site Scripting Vulnerability
5. Cisco VPN 3000 Series Concentrator User Credential Disclosure...
6. Cisco Internal Group Authentication External Access Vulnerability
7. Cisco HTTP Interface Long Request Denial Of Service Vulnerability
8. Cisco VPN 3000 Series Concentrator Certificate Credential...
9. Cisco VPN Concentrator SSH Banner Device Information Leakage...
10. Cisco VPN Concentrator FTP Banner Device Information Leakage...
11. Cisco VPN Concentrator HTTP Error Page Device Information...
12. Cisco VPN Concentrator PPTP Client Remote Denial Of Service...
13. Cisco VPN 3000 Series Concentrator Web Interface Information...
14. Cisco VPN 3000 Series Concentrator XML Filter Misconfigured...
15. Cisco VPN 3000 Series Concentrator Posted User Credential...
16. Cisco VPN 3000 Series Concentrator Client Authentication...
17. Cisco VPN 3000 Concentrator IPSEC Tunnel Denial of Service...
18. Cisco VPN 3000 Series Concentrator ISAKMP Denial of Service...
19. Alan Ward A-Cart Web Accessable Database File Vulnerability
20. Red Hat PXE Server DHCP Packet Denial Of Service Vulnerability
21. Sun Solaris CDE ToolTalk Set Default Session Memory Corruption...
22. HP Tru64 UNIX Multiple Local and Remote Buffer Overflow...
23. FactoSystem Weblog Multiple SQL Injection Vulnerabilities
24. Cerulean Studios Trillian Skins Colors File Name Buffer Over...
25. Dan Mueth ScrollKeeper Tempfile Symbolic Link Vulnerability
26. NullLogic Null HTTPd Error Page Cross-Site Scripting...
28. Check Point Firewall-1 SecuRemote IKE Username Guessing...
29. Super Site Searcher Remote Command Execution Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Bug Triad Whacks Microsoft Browser
2. Computer Security Standards Ready
3. MS patches bogus certificate hole on NT, XP
4. Taking Security Concerns Private: U.S. Appeals to IT Firms
IV.SECURITYFOCUS TOP 6 TOOLS
1. HIFN 7951 Linux Driver v1.0beta1
2. SpamProbe v0.6
3. SQLScan v1.0
4. AIM Sniff v0.2
5. Prelude Manager v0.8.4
6. Security Filter v1.0-b3
V. SECURITYJOBS LIST SUMMARY
1. Unix Software Developer (managed security products) - Madison...
2. Security Engineer (Thread)
3. Expert IT Consultant with a focus on secure system integration...
4. contract in DC (Thread)
5. Risk Analyst Security Bank - London (Thread)
6. Security Policy Standards Manager London Bank Wanted (Thread)
7. Am I getting the wrong end of the stick????? (Thread)
8. Senior Security and Business Continuity Architect - East Bay...
9. Threat/Incident Analyst Positions Open for DeepSight TMS (Thread)
10. Senior Risk Manager #248 - NJ - $120k (Thread)
11. Resume - Information Systems Security Professional (Thread)
12. Fw: contract in DC (Thread)
13. Management Security Consultants wanted in Europ (Thread)
14. Sales Engineer description - minor edit (Thread)
15. Sales Engineer (Thread)
16. Information Security Analyst, Greenbelt MD (Thread)
17. Windows NTFS/ Security Administrator (Thread)
18. Programmer / Security individual looking in Houston, TX (Thread)
19. Security Engineer position in San Francisco, CA (Thread)
20. Searching for a Position (Thread)
21. Enterprise Software Sales - So. Cal. (Thread)
22. IT/GSM Security Software Engineer (Thread)
23. Job for a CISA,CISSP, Chartered Accountant, ISA, Grad CWA...
VI. INCIDENTS LIST SUMMARY
1. new type of formmail probes (Thread)
2. Odd sendmail behavior (Thread)
3. Re: Odd sendmail behavior (Thread)
4. Strange back-orifice looking scan... (Thread)
5. Any tcp/608 activity? (Thread)
6. [incidents] Bots hitting my web server? (Thread)
7. What's going on here? (Thread)
8. Trojan? DDOS Bot? (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Vendor Changelogs /Notifications (Thread)
2. The generated binary code has different main? (Thread)
3. Plain text files in internet explorer (Thread)
4. LC_COLLATE=en_US (Thread)
5. SPIKE 2.6 (Thread)
6. GIFs Good, Flash Executable Bad [Was: Plain text files in...
7. SUMMARY: SMB overflow attacks (Thread)
8. IE without Images (Thread)
9. PHP 4.2.2 - File Upload Problem (Thread)
10. Possible Buffer Overflow in CesarFTP (Thread)
11. FactoSystem CMS Contains Multiple Vulnerabilities (Thread)
12. SUMMARY: Disabling Port 445 (SMB) Entirely (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. SMBdie exploit testing (Thread)
2. Does W2K hold user's email, EFS etc private key securely...
3. SecurityFocus Microsoft Newsletter #102 (Thread)
4. Anyone know what "piiserviceO" is? (Thread)
5. IUSR_machinename (Thread)
6. SecureIIS - protecting IIS (Thread)
7. Windows 2000 Application log corruption (Thread)
8. IIS and Frontpage Extensions Vulnerability. (Thread)
IX. SUN FOCUS LIST SUMMARY
1. which process bind some port (Thread)
X. LINUX FOCUS LIST SUMMARY
1. MD5 checksum's for Redhat 7.3 binaries? (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Win2K First Responder's Guide
By H. Carvey

This article will offer a brief overview of some of the steps security
administrators and incident handlers should take as part of the first
response to security incidents. This article will focus on incidents in
Microsoft Windows 2000, due to its popularity in both the corporate and
server environments.

http://online.securityfocus.com/infocus/1624

2. Who Goes There: An Introduction to On-Access Virus Scanning, Part One
by Bill Hayes

By now, most savvy computer users have anti-virus software (AV) installed
on their machines and use it as part of their regular computing routine.
However, most average users do not know how anti-virus software works.
This two-part series will offer a brief overview of a particular type of
anti-virus mechanism know as on-access virus scanners. These programs are
loaded at during the operation system start-up and interact with programs
in the background until the system is shut down. In the Microsoft Windows
world, which this article will focus on, they must function reliably and
speedily across a range of Windows flavors. They must also be able to
correctly identify and disinfect thousands of viruses -- known and
unknown. On-access scanners must stand in the gap, ensuring that nothing
passes the ground they defend.

http://online.securityfocus.com/infocus/1622

3. Cheap Thrills on the Cyberterror Beat
By George Smith

Are computer viruses really on the verge of becoming instruments of
bloodshed, or is the press just addicted to disaster journalism?

http://online.securityfocus.com/

4. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

5. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud

II. BUGTRAQ SUMMARY
-------------------
1. Blue Coat Systems Error Page Cross Site Scripting Vulnerability
BugTraq ID: 5608
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5608
Summary:

Blue Coat Systems are the maintainers of the former Cacheflow web cache
and security products.

A problem with some Cacheflow products may make it possible to launch a
cross-site scripting attack. The problem is in the handling of some
characters.

It has been discovered that the error pages of older Cacheflow systems
firmware may allow certain characters used in HTML tags to be displayed in
error pages. By visiting a custom-crafted URI supplied by an attacker,
inclusion of these special characters could result in the execution of
arbitrary script code by a visiting client. Any code executed on the
client would be in the security context of the local user, and in the
security zone of the Cacheflow device.

This problem stems from the ability of users to pass special characters
through the HTTP error page. These special characters include the <, >,
and & characters.

2. Multiple Cisco VPN 3000 Vulnerabilities
BugTraq ID: 5609
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5609
Summary:

Cisco has reported a number of vulnerabilities in the VPN 3000 series
concentrators. These issues affect models 3005, 3015, 3030, 3060, 3080
and the Cisco VPN 3002 Hardware Client.

The first issue affects PPTP and IPSEC internal authentication. It is
possible for a user to login to the VPN from the external network using
group authentication credentials designed for the internal network. This
can occur when the concentrator is configured for group accounts but no
user accounts have been created. This may allow a malicious user to
violate the security policy. The Cisco VPN 3002 Hardware Client is not
affected by this issue.

The second issue is a denial of service condition in the HTML interface of
the concentrators. An overly long request may cause the IP stack of the
device to stop responding, due to resource exhaustion. The device is said
to recover approximately 5 minutes after the overly long request is
processed.

The third issue is an information disclosure problem with the affected
devices. Sensitive information is disclosed in the SSH and FTP banners.
HTTP error pages also give out sensitive information about the device.
An attacker may use this sensitive information to assist in mounting
further attacks against the device.

The fourth issue is a buffer overflow in the telnet daemon included with
the device. It is reported that this may be exploited to cause a denial
of service. It should be noted that the telnetd interface is not enabled
by default in the affected concentrators, nor can it be enabled on Cisco
VPN 3002 Hardware Client.

The fifth issue could result in a denial of service attack against a
vulnerable device. A native Microsoft Windows PPTP client connecting with
the "No Encryption" option set cause result in a VPN 3000 series
concentrator arbitrarily reloading. This could result in a denial of
service.

The sixth issue has the potential to disclose user credentials to remote
attackers. Any administrative HTML pages which contain user credentials
will disclose the plaintext password in the page source code. This may
allow restricted access administrative users to gain access to the
credentials.

The seventh issue also has the potential to disclose sensitive
authentication credentials. Certificate credentials are contained in
plaintext in the source code of Certificate Management HTML pages and will
be viewable by administrative users.

The eighth issue may potentially allow traffic for any protocol to be sent
across an arbitrary port on the concentrator. This issue occurs when the
XML filter is enabled on the public interface, causing a misconfigured
rule to be added to the device.

The ninth issue is that users may access a limited number of HTML pages
for the device without authentication being required. This has the
potential to disclose some amount of sensitive information.

The tenth issue is a denial of service condition related to handling of
overly long username and password strings submitted via a modified HTML
page. If the attacker posts overly long values for these strings, the
device will reportedly reload.

The eleventh issue is also a denial of service condition related to the
handling of an overly long username string. The malformed string may be
submitted with a VPN client and may cause the device to reload when it is
processed.

The twelfth issue is a failure to drop a new incoming LAN-to-LAN
connection in circumstances when the connection already has a security
association with the same remote network on another device. The previous
connection will be dropped and a connection will be made with the new,
possibly untrusted device on the remote network. This may potentially
allow unauthorized access by untrusted devices on a supposedly trusted
network. The device also reportedly does not verify the data coming
across the connection to determine if it is coming from the correct
network.

The final issue is a denial of service condition which may be caused by
malformed ISAKMP packets. Various types of malformed packets may cause
the device to reload, under different settings.

** These issues will be divided seperated into individual Bugtraq IDs when
further analysis is completed. A new alert with more detailed information
will be sent out for each individual record.

3. Microsoft Internet Explorer HTML Same Origin Policy Violation Vulnerability
BugTraq ID: 5610
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5610
Summary:

A vulnerability exists in Microsoft Internet Explorer that can allow for a
violation of the same origin policy.

In modern browsers, script code executing in the context of one website
should not be able to access the properties of another. This is a
security feature known as the 'same origin policy', and it is put in place
to prevent malicious websites from interacting with and possibly stealing
sensitive information from others in different windows.

When MSIE is evaluating whether access across windows should be permitted,
the domain of the parent window is compared to the child. A vulnerability
in this process has been reported that is related to the handling of HTTP
usernames included in the URL. If the username value is suffixed with
"%2f", MSIE will not remove the username when performing the same-origin
check. Therefore it is possible to bypass the check if a username is
included in a URL that matches the domain of the parent window and is
appended with "%2f". For example, the URL:

www.childdomain.ooo%2f@otherdomain will match 'www.childdomain.ooo' when
the same origin check is carried out.

Attackers can construct websites that, for example:

- Steal cookies associated with arbitrary websites. - Perform actions on
different websites through script code (for example, may be possible to
delete mail on a webmail system). - Transmit the contents of local files
(parseable as type text/html) to attacker-controlled webservers. - Write
to windows containing different websites, effectively 'spoofing' the
content. This is probably the most serious consequence, as trusted
websites can be replaced with entirely attacker-created HTML. - Access
other objects through MSIE, such as MSN contacts.

4. Aestiva HTML/OS Cross-Site Scripting Vulnerability
BugTraq ID: 5618
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5618
Summary:

Aestiva HTML/OS is a database engine and development suite for building
websites and web-based software products.

HTML/OS does not sufficiently sanitize metacharacters from error message
output. In particular, attackers may inject HTML error pages. It is
possible to cause the server to generate an error page by appending script
code to the end of a URL ending with a '/' character. The resulting error
page will echo back the request without filtering any metacharacter data.
Arbitrary HTML and script code will be executed by the web client of the
user visiting the server, in the security context of the server.

5. Cisco VPN 3000 Series Concentrator User Credential Disclosure Vulnerability
BugTraq ID: 5611
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5611
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

Cisco VPN 3000 series concentrators are prone to an issue which may cause
user credentials to be disclosed to remote attackers under some
circumstances.

It has been reported that some web pages accessible to restricted access
administrative users contain plaintext user credentials in the source
code. An attacker may use their web client to view the HTML source of
these pages and gain access to the user credentials.

This issue is known to affect releases earlier than 3.5.1. Releases
earlier than 3.1.4 are also affected, in addition to 3.0.x and 2.x.x.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

6. Cisco Internal Group Authentication External Access Vulnerability
BugTraq ID: 5613
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5613
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

A problem with the VPN 3000 Series Concentrators may allow a remote user
to gain unintended access to network resources.

In a configuration using internal authentication, and allowing access via
configured group/password combinations, it may be possible for a remote
user to gain local access via the group. This particular vulnerability
affects VPN Concentrators that do not have seperate user/password accounts
configured.

It has been discovered that remote users can gain access to the network
behind the VPN Concentrator through both IPSEC and PPTP through accounts
that may not be intended for this type of access. By using a group
account configured on the VPN Concentrator, remote users may access the
network with group privileges afforded those on the network behind the VPN
Concentrator. This could result in unintended privileges and access.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

7. Cisco HTTP Interface Long Request Denial Of Service Vulnerability
BugTraq ID: 5615
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5615
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

A problem has been discovered that may make it possible for users to deny
service to legitimate users of VPN Concentrators. The problem occurs in
the HTML interface.

It has been discovered that under some circumstances, it is possible to
cause a resource consumption issue on a VPN Concentrator that can result
in a denial of service. By placing a malicious HTTP request to a
vulnerable system, the system becomes unstable.

It is reported that this problem occurs when a request of excessive length
is placed to the HTTP interface. Such a request causes the CPU of the
device to reach 100%, and consistently stay resource-bound for a period of
up to five minutes.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

8. Cisco VPN 3000 Series Concentrator Certificate Credential Disclosure Vulnerability
BugTraq ID: 5612
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5612
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

Cisco VPN 3000 series concentrators will disclose the certificate password
in the Certificate Management web page source code. This may enable an
administrative user to gain unauthorized access to the Certificate
Management interface. The administrative user may use their web client to
view the source code of affected pages and view the credentials in
plaintext.

This would only be an issue in circumstances where the policy of an
organization using the device restricts certificate management privileges
to particular administrative users.

This issue is known to affect releases prior to 3.5.2.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

9. Cisco VPN Concentrator SSH Banner Device Information Leakage Vulnerability
BugTraq ID: 5621
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5621
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

A problem with the VPN 3000 Concentrator firmware may make it possible to
gain access to sensitive information. The problem is in the SSH banner.

Under some circumstances, it may be possible for a remote user to gain
access to sensitive information. The SSH banner reveals more information
than necessary to negotiate a session. This could lead to intelligence
gathering, and a directed attack against network resources.

The SSH banner typically includes the SSH version number. However, by
default, the SSH banner also includes sensitive information about the
device itself. Though Cisco has not made the details available, this
information is likely to include the type of interface, time on the
system, and revision of firmware.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

10. Cisco VPN Concentrator FTP Banner Device Information Leakage Vulnerability
BugTraq ID: 5623
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5623
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

A problem with the VPN 3000 Concentrator firmware may make it possible to
gain access to sensitive information. The problem is in the FTP banner.

Under some circumstances, it may be possible for a remote user to gain
access to sensitive information. The FTP banner reveals more information
than necessary to negotiate a session. This could lead to intelligence
gathering, and a directed attack against network resources.

The FTP banner typically includes generic information, such as the device
hostname. However, by default, the FTP banner also includes sensitive
information about the device itself. Though Cisco has not made all
details available, this information is know to include the time on the
system, and may also include the revision of firmware, or type of device.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

11. Cisco VPN Concentrator HTTP Error Page Device Information Leakage Vulnerability
BugTraq ID: 5624
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5624
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

A problem with the VPN 3000 Concentrator firmware may make it possible to
gain access to sensitive information. The problem is in the HTTP error
page.

Under some circumstances, it may be possible for a remote user to gain
access to sensitive information. The HTTP error page reveals more
information than necessary when an erroneous page is visited. This could
lead to intelligence gathering, and a directed attack against network
resources.

Typically, HTTP error pages give at least the hostname of the device on
which the erroneous page was requested. However, VPN Concentrators reveal
extensive information, including the name of the person who compiled the
VPN Concentrator firmware, the time the firmware was compiled, and
additional unspecified information about the device.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

12. Cisco VPN Concentrator PPTP Client Remote Denial Of Service Vulnerability
BugTraq ID: 5625
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5625
Summary:

Cisco VPN 3000 series concentrators are a family of products for

facilitating secure communications via VPN (Virtual Private Networks).

A problem with the VPN Concentrators has been discover that could result
in a denial of service. The problem is in the handling of some types of
PPTP connections.

Under some circumstances, it may be possible for a remote PPTP client to
cause a denial of service. By connecting to a vulnerable device with the
"No Encryption" option specified in the client, the VPN Concentrator can
be made to become unstable. This could result in a denial of service to
legitimate users of the device.

It has been reported that a connection to the device via PPTP under these
circumstances causes a reload. This problem has been reported as being
reproducable with the Windows native PPTP client. Though the system will
resume normal operation after it has rebooted, it is possible that an
attacker could set up an automated process to force continual reboots of
the vulnerable device.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

13. Cisco VPN 3000 Series Concentrator Web Interface Information Disclosure Vulnerability
BugTraq ID: 5616
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5616
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

Cisco VPN 3000 series concentrators leave some areas of the web interface
exposed to unauthenticated web users. It has been reported that some of
the exposed web pages may contain a limited amount of sensitive
information which may potentially be of use to remote attackers.

Attackers may use the sensitive information disclosed in this manner to
potentially aid in mounting further attacks against the device and the
network.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

14. Cisco VPN 3000 Series Concentrator XML Filter Misconfigured Access Vulnerability
BugTraq ID: 5614
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5614
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

Cisco VPN 3000 series concentrators are prone to an issue with XML filters
which may inadvertently allow unauthorized network access to occur. This
issue occurs when XML filters have been enabled on the public interface of
the device. When an XML filter is added, the following rule is created:

"HTTPS on Public Inbound (XML-Auto)(forward/in)"

The protocol is mistakenly set to "ANY" and the value for the destination
port is set to 443. The vulnerable concentrator checks the destination
port only when the value for the protocol is set to "TCP" or "UDP".
Since the protocol is mistakenly set to "ANY", this will allow network
connections using any protocol to an arbitrary port to occur through the
concentrator. This will have the effect of invalidating other network
access control rules provided through the device as well.

An attacker who discovers a vulnerable device with the XML filters enabled
will be able to exploit this condition to gain unauthorized access to the
network.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

15. Cisco VPN 3000 Series Concentrator Posted User Credential Denial Of Service Vulnerability
BugTraq ID: 5617
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5617
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

Cisco VPN 3000 series concentrators are prone to a denial of service
condition when handling overly long username/password strings via login
pages for the web interface of the device. To exploit this condition, the
attacker must submit overly long values for the username/password strings
using the POST method. The attacker might, for example, submit a modified
version of the form for the login page to trigger this condition.

Successful exploitation will cause the device to reload.

This condition may be due to a buffer overflow.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

16. Cisco VPN 3000 Series Concentrator Client Authentication Denial Of Service Vulnerability
BugTraq ID: 5620
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5620
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

Cisco VPN 3000 series concentrators are prone to a denial of service
condition when receiving an overly long username string during
authentication from a VPN client. Remote attackers may exploit this to
deny service to legitimate users of the device.

Successful exploitation will cause the device to reload.

This condition may be due to a buffer overflow.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

17. Cisco VPN 3000 Concentrator IPSEC Tunnel Denial of Service Vulnerability
BugTraq ID: 5622
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5622
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

Cisco has reported a security vulnerability in VPN 3000 series
concentrator devices. The vulnerability is related to handling of
incoming LAN-to-LAN IPSEC tunnel connections. When a connection is
initiated on behalf of a remote network for which the device already has a
security association, the existing connection is terminated. Correct
behaviour is for the device to drop the incoming connection when it is
determined that a security association already exists.

According to Cisco, this condition may be exploitable as a denial of
service attack.

Furthermore, affected devices do not ensure that the data transmitted
across a LAN-to-LAN IPSEC tunnel is sourced from the appropriate network.
The implications of this potentially separate issue are not yet known.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

18. Cisco VPN 3000 Series Concentrator ISAKMP Denial of Service Vulnerabilities
BugTraq ID: 5619
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5619
Summary:

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

There are a number of circumstances where maliciously constructed Internet
Security Association and Key Management Protocol (ISAKMP) packets may
cause the affected device to reload.

Cisco has reported that the following will trigger the condition:

- Receipt of a 'malformed' ISAKMP packet. Precisely how the packet must
be malformed is not currently known.

- Receipt of various 'malformed' ISAKMP packets while debug mode is
enabled. Precisely how the packets are malformed is not currently known.

- Receipt of a ISAKMP packet containing a very large number of payloads.

- Receipt of large ISAKMP packets while debug mode is enabled.

Each of these circumstances may result in the device reloading. Repeated
attacks may result in a denial of network/VPN service.

** This issue was originally covered in Bugtraq ID 5609 "Multiple Cisco
VPN 3000 Vulnerabilities" and is now being assigned an individual Bugtraq
ID.

19. Alan Ward A-Cart Web Accessable Database File Vulnerability
BugTraq ID: 5597
Remote: Yes
Date Published: Aug 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5597
Summary:

Alan Ward's A-Cart is a web based shopping cart application. It is
implemented in ASP, and designed for use with Microsoft Access under
Microsoft Windows based servers.

A vulnerability has been reported in some versions of A-Cart. By default,
the database file 'acart2_0.mdb' is stored within the web directory. If
the web server is not configured to deny access to this file or the .mdb
extension, the database may be available to any remote user.

Exploitation of this issue could result in the contents of the A-Cart
system being exposed to remote attackers. It is possible that this data
includes sensitive information on orders and customers, although this has
not been confirmed.

This issue has been reported in A-Cart 2.0. Other versions may share this
vulnerability, this has not however been confirmed.

20. Red Hat PXE Server DHCP Packet Denial Of Service Vulnerability
BugTraq ID: 5596
Remote: Yes
Date Published: Aug 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5596
Summary:

Red Hat Linux includes a Preboot eXecution Environment (PXE) server. PXE
can be used to boot a Linux based system from a remote disk image.

An error has been reported in the PXE server included with some versions
of Red Hat. If certain DHCP packets are received by the server, it may
crash. This may create a denial of service condition for legitimate
systems which rely on the server. A restart may be required in order to
regain normal functionality.

In particular, this behavior has been reported to occur when DHCP packets
generated by some Voice Over IP (VoIP) phone devices are received by the
vulnerable server.

21. Sun Solaris CDE ToolTalk Set Default Session Memory Corruption Vulnerability
BugTraq ID: 5598
Remote: No
Date Published: Aug 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5598
Summary:

A problem in the Common Desktop Environment (CDE) ToolTalk infrastructure
has been discovered. This problem has been reported as affecting the
Solaris operating system.

Under some circumstances, it may be possible to cause a core dump in
ToolTalk. Under certain conditions, a program making use of the
_Tt_c_procid::set_default_session function may cause a core dump within
the program. It is currently unknown whether this is an exploitable
issue.

In the case that this is an exploitable memory corruption issue, it may be
possible to launch a denial of service, or execute code.

22. HP Tru64 UNIX Multiple Local and Remote Buffer Overflow Vulnerabilities
BugTraq ID: 5599
Remote: Yes
Date Published: Aug 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5599
Summary:

HP has reported multiple local and remote buffer overflow vulnerabilities
in various binaries that ship with Tru64 UNIX. HP has also announced an
undisclosed denial of service issue in /usr/sbin/ping, which is covered in
the advisory and addressed in the included fixes.

Many of the issues have been addressed in previous vendor advisories. HP
has released a list of affected binaries, with the applicable vendor
tracking numbers:

SSRT2277 /usr/bin/ypmatch
SSRT2261 /usr/sbin/traceroute
SSRT2260 /usr/sbin/lpc
/usr/bin/lprm
/usr/bin/lpq
/usr/bin/lpr
/usr/lbin/lpd
SSRT0796U /usr/bin/binmail
SSRT0794U /usr/bin/ipcs
SSRT2191 /usr/sbin/quot
SSRT2189 /usb/bin/at
SSRT2256 /usr/bin/ps
SSRT2275 /usr/bin/uux
/usr/bin/uucp
/usr/bin/csh
/usr/bin/rdist
/usr/bin/mh/inc
/usr/bin/mh/msgchk
/usr/sbin/imapd
/usr/bin/deliver
/sbin/.upd..loader
SSRT2193 /usr/dt/bin/mailcv
SSRT2280 /usr/dt/bin/dtterm
SSRT2282 /usr/dt/bin/dtsession
SSRT2274 /usr/dt/bin/rpc.ttdbserverd
SSRT2279 /usr/bin/X11/dxterm
SSRT2275 /usr/bin/X11/dxconsole
/usr/bin/X11/dxpause
/usr/bin/X11/dxsysinfo
SSRT2340 /usr/sbin/telnetd
SSRT2270 BIND resolver glibc
SSRT2309 rpc XDR_ARRAY

A number of these utilities may potentially be exploited by an attacker to
execute code with elevated privileges or to cause a denial of service
condition. The nature of these issues is that an attacker can corrupt
memory with attacker-supplied values, which may potentially result in
execution of arbitrary code.

In the instance of the local buffer overflows, exploitation of some of
these binaries may not yield any extra privileges for the attacker, if
they are not installed setuid/setgid. With remote buffer overflows,
successful exploitation may allow an attacker to execute arbitrary code
with the privileges of the user running the utility or server.

** This vulnerability record will be divided into multiple Bugtraq IDs
when analysis of the individual issues is complete. Some of these issues
may already be known. Where it is appropriate, existing Bugtraq IDs will
also be updated to reflect the information in the advisory.

23. FactoSystem Weblog Multiple SQL Injection Vulnerabilities
BugTraq ID: 5600
Remote: Yes
Date Published: Aug 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5600
Summary:

FactoSystem Weblog is a freely available, open source software package for
weblogging and managing content. It is available for Microsoft Windows
operating systems.

A problem with FactoSystem could lead to a possible SQL injection attack.

FactoSystem does not adequately filter special characters from requests.
Because of this, it may be possible for a remote user to submit a request
containing encoded special characters and SQL, and execute arbitrary
commands. This could lead to execution of SQL commands in the security
context of web database user.

By passing custom requests through the authornumber, discussblurbid, name,
and email fields in the author.asp, discuss.asp, and holdcomment.asp
pages, an attacker could potentially execute SQL commands on the database
backending the weblog. It is possible to pass special characters through
the Weblog by sending them as their hex values.

It should be noted that this problem affects systems that run IIS and have
ASP enabled. This problem may allow an attacker to perform various
functions on a vulnerable server, and could potentially lead to the
retrieval of sensitive information.

24. Cerulean Studios Trillian Skins Colors File Name Buffer Overflow Vulnerability
BugTraq ID: 5601
Remote: No
Date Published: Aug 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5601
Summary:

Trillian is a freely available instant message software package. It is
designed for use on the Microsoft Windows operating system.

A problem with the handling a variable in the skins file may make it
possible to execute arbitrary code.

Trillian skins files are XML forms designed to allow the easy creation of
custom interfaces, or "skins" for the Trillian client. When a colors file
name of excessive length is supplied in a skin, a buffer overflow occurs.
This could make it possible deny service to a Trillian client, and
possibly to execute arbitrary code through a malicious skin.

This buffer overflow occurs when the colors file field contains 4096 or
more characters. It should be noted it can be determined whether a skin
is malicious or not by auditing the skin for a color file field containing
malicious content. Exploitation of this overflow to execute code would
result in the execution of code in the security context of the Trillian
user.

25. Dan Mueth ScrollKeeper Tempfile Symbolic Link Vulnerability
BugTraq ID: 5602
Remote: No
Date Published: Sep 02 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5602
Summary:

Dan Mueth ScrollKeeper is a documentation cataloging system that acts as a
middle layer between applications and help browsers.

When a ScrollKeeper aware browser makes a call to get a category tree
using scrollkeeper-get-cl, the content list is passed through tempfiles in
the /tmp directory with permissions of the current user. The tempfiles
are named scrollkeeper-tempfile.[0-4].

While creating these tempfiles, scrollkeeper-get-cl will follow symbolic
links. This could allow an attacker to overwrite files as the currently
logged on user.

26. NullLogic Null HTTPd Error Page Cross-Site Scripting Vulnerability
BugTraq ID: 5603
Remote: Yes
Date Published: Sep 02 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5603
Summary:

NullLogic Null HTTPd is a small multithreaded webserver for Linux and
Windows.

It is possible for attackers to construct a URL that will cause scripting
code to be embedded in error pages.

Null HTTPd fails to check URLs for the presence of script commands when
generating error pages, allowing attacker supplied code to execute. As a
result, when an innocent user follows such a link, the script code will
execute within the context of the hosted site.

Successful exploitation of this vulnerability could enable an attacker to
execute code in the security context of a trusted site. This vulnerability
may be exploited to steal cookie-based authentication credentials from
legitimate users of Null HTTPd.

27. Microsoft SQL Server Stored Procedure Low Privilege Weakness
BugTraq ID: 5604
Remote: Yes
Date Published: Sep 02 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5604
Summary:

Microsoft SQL Server 2000 uses various stored procedures to allow database
administrators to perform simplified administration.

Two of the stored procedures supplied by Microsoft contain weak
permissions and can be accessed by an unprivileged user:
sp_MSSetServerProperties sp_MSsetalertinfo

sp_MSSetServerProperties can be used by the administrator to configure
whether the SQL server starts manually or automatically at startup.
sp_MSsetalertinfo can be used to configure the email address that alerts
should be sent to.

Neither of these stored procedures can be used to compromise the server or
its data, however, they may be combined with other SQL vulnerabilities to
allow system compromise.

28. Check Point Firewall-1 SecuRemote IKE Username Guessing Vulnerability
BugTraq ID: 5607
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5607
Summary:

A design error exists in Check Point Firewall-1 SecuRemote IKE that may
result in a disclosure of sensitive information. Certain versions of
Firewall-1 reportedly send different responses when Phase-1 aggressive
mode IKE packets are received with valid and invalid usernames.

When packets containing invalid usernames are received, vulnerable
versions of Firewall-1 will return a IKE notification response to indicate
so. Some versions of Firewall-1 (4.0, 4.1, NG excluding FP1 and FP2) will
include information about why the username is invalid. This may be even
more helpful for certain attacks.

Some of the responses are:

"User guessed-username unknown." - This indicates that the user does not
exist.

"User cannot use IKE" - This indicates that the user exists but cannot use
IKE. The user may be valid for FWZ or regular authentication.

"Login expired on 1-jan-2002." - This indicates that the user account
expired on the date January 1, 2002.

"IKE is not properly defined for user." - This indicates that the user
exists, however IKE has not been properly configured for them.

Disclosure of usernames may assist in many other attacks against the
network. It should also be noted that usernames are communicated in
cleartext when in aggressive mode. Attackers with the ability to monitor
network traffic may also collect IKE usernames by sniffing them.

29. Super Site Searcher Remote Command Execution Vulnerability
BugTraq ID: 5605
Remote: Yes
Date Published: Sep 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5605
Summary:

Super Site Searcher is a search engine script, implemented in Perl. It is
intended to run on Unix and Linux variants.

Super Site Searcher is prone to remote command execution. Shell
metacharacters are not adequately filtered from query string parameters in
a request to the vulnerable search engine script. In particular, the lack
of input validation affects the "page" query string parameter, which is
processed by "site_searcher.cgi". The parameter is used in a function
which passes commands directly through the shell.

A remote attacker may exploit this condition to execute arbitrary commands
on the shell with the privileges of the webserver process, which will
enable the attacker to gain local access to the underlying host.

Simple Site Searcher, released by the same vendor, is also prone to this
issue.

III. SECURITYFOCUS NEWS AND COMMENTARY
------------------------------------------
1. Bug Triad Whacks Microsoft Browser
By Brian McWilliams

Researchers discover that three "low risk" bugs can combine to send a
Windows system up in flames.

http://online.securityfocus.com/

2. Computer Security Standards Ready
By Shannon Henry, Washington Post

In a high-tech, high-powered version of a neighborhood watch, a group of
government agencies and private businesses plan to announce today a common
set of standards and software to fight computer hacking.

http://online.securityfocus.com/news/609

3. MS patches bogus certificate hole on NT, XP
By Thomas C. Greene, The Register

Microsoft has finally begun patching a severe security flaw in its
implementation of digital-certificate basic-constraints checking which
we've been ranting about for nearly a month. The stuff-up makes it
possible for SSL and e-mail signature certs to be forged.

http://online.securityfocus.com/news/608

4. Taking Security Concerns Private: U.S. Appeals to IT Firms
By Michael Barbaro, Washington Post

It is the common cry of the federal administrator sitting across the table
from the private entrepreneur: "I do not have the staff with the
technological experience to do what you do."

That was how Sallie McDonald, assistant commissioner of the General
Services Administration's Office of Information Assurance and Critical
Infrastructure, characterized efforts to protect federal information
technology systems and develop rapid national response mechanisms. And it
underscores a new consensus among many top technology advisers in
government that the only way to protect the nation's vital computer
systems is to reach deeper into the private sector, while making federal
agencies more accessible to innovative and little-known companies.

http://online.securityfocus.com/news/607

IV.SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. HIFN 7951 Linux Driver v1.0beta1
by SecurityData [email protected]
Relevant URL:
http://sourceforge.net/projects/hifn7951/
Platforms: Linux, POSIX
Summary:

HIFN 7951 Linux Driver can manage up to 64 HiFn7951 based cards. It uses
the API provided by the cryptolib designed by Martin Gadbois, and should
work with both 2.2 and 2.4 kernels.

2. SpamProbe v0.6
by Brian Burton
Relevant URL:
http://sourceforge.net/projects/spamprobe/
Platforms: Linux, POSIX
Summary:

SpamProbe is a spam detection program that uses a Bayesian analysis of the
frequencies of terms used in the email. Because it filters email based on
content rather than on general rules, it easily adapts itself to the types
of email that each individual user normally receives.

3. SQLScan v1.0
by NTSleuth [email protected]
Relevant URL:
http://ntsleuth.0catch.com/
Platforms: Windows 2000, Windows NT, Windows XP
Summary:

Brute force password guessing utility for Microsoft SQL Server. Ability to
scan a range of IP addresses with an optional dictionary file. Ability to
create an administrative NT backdoor account.

4. AIM Sniff v0.2
by Shawn Grimes
Relevant URL:
http://aimsniff.sourceforge.net
Platforms: UNIX
Summary:

AIM Sniff is a utility for monitoring and archiving AOL Instant Messenger
messages across a network. It can be used to monitor for cases of
harassment or warez trading. It has the ability to do a live dump
(actively sniff the network) or read a PCAP file and parse the file for IM
messages. You also have the option of dumping the information to a MySQL
database or STDOUT. Also included is smbInfo.pl, which is used to match IM
handles with NT domain user names. This portion of the project is probably
still a bit buggy or lacking error checking. A Web front end to view and
generate reports of captured AIM conversations is planned.

5. Prelude Manager v0.8.4
by yoann
Relevant URL:
http://www.prelude-ids.org/
Platforms: POSIX
Summary:

Prelude Manager is the main program of the Prelude Hybrid IDS suite. It is
a multithreaded server which handles connections from the Prelude sensors.
It is able to register local or remote sensors, let the operator configure
them remotely, receive alerts, and store alerts in a database or any
format supported by reporting plugins, thus providing centralized logging
and analysis. It also provides relaying capabilities for failover and
replication. The IDMEF standard is used for alert representation. Support
for filtering plugins allows you to hook in different places in the
Manager to define custom criteria for alert relaying and logging.

6. Security Filter v1.0-b3
by Max Cooper
Relevant URL:
http://securityfilter.sourceforge.net/
Platforms: Os Independent
Summary:

SecurityFilter is intended for use by Java Web application developers. It
provides robust security and automatic authentication services for Web
applications. It mimics the behavior and configuration format of
container-managed security, but has several important advantages that make
it an ideal solution for single-context, public Web sites, or when it is
necessary or simply desirable to avoid the server configuration hassles
and portability issues associated with container-managed security.

V. SECURITY JOBS SUMMARY
------------------------
1. Unix Software Developer (managed security products) - Madison, WI (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290623

2. Security Engineer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290640

3. Expert IT Consultant with a focus on secure system integration (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290636

4. contract in DC (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290622

5. Risk Analyst Security Bank - London (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290638

6. Security Policy Standards Manager London Bank Wanted (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290621

7. Am I getting the wrong end of the stick????? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290620

8. Senior Security and Business Continuity Architect - East Bay, CA - Greythorn (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290637

9. Threat/Incident Analyst Positions Open for DeepSight TMS (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290457

10. Senior Risk Manager #248 - NJ - $120k (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290459

11. Resume - Information Systems Security Professional (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290422

12. Fw: contract in DC (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290440

13. Management Security Consultants wanted in Europ (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290420

14. Sales Engineer description - minor edit (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290458

15. Sales Engineer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290419

16. Information Security Analyst, Greenbelt MD (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290421

17. Windows NTFS/ Security Administrator (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290221

18. Programmer / Security individual looking in Houston, TX (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290135

19. Security Engineer position in San Francisco, CA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290080

20. Searching for a Position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290083

21. Enterprise Software Sales - So. Cal. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/289997

22. IT/GSM Security Software Engineer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/289898

23. Job for a CISA,CISSP, Chartered Accountant, ISA, Grad CWA - 20 years experience (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/289897

VI. INCIDENTS LIST SUMMARY
-------------------------
1. new type of formmail probes (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290605

2. Odd sendmail behavior (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290606

3. Re: Odd sendmail behavior (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290604

4. Strange back-orifice looking scan... (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290584

5. Any tcp/608 activity? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290550

6. [incidents] Bots hitting my web server? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290096

7. What's going on here? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290116

8. Trojan? DDOS Bot? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/289987

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Vendor Changelogs /Notifications (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290586

2. The generated binary code has different main? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290469

3. Plain text files in internet explorer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290471

4. LC_COLLATE=en_US (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290454

5. SPIKE 2.6 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290328

6. GIFs Good, Flash Executable Bad [Was: Plain text files in internet explorer] (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290171

7. SUMMARY: SMB overflow attacks (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290122

8. IE without Images (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290060

9. PHP 4.2.2 - File Upload Problem (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290034

10. Possible Buffer Overflow in CesarFTP (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290030

11. FactoSystem CMS Contains Multiple Vulnerabilities (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290029

12. SUMMARY: Disabling Port 445 (SMB) Entirely (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/289985

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SMBdie exploit testing (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/290595

2. Does W2K hold user's email, EFS etc private key securely ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/290596

3. SecurityFocus Microsoft Newsletter #102 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/290385

4. Anyone know what "piiserviceO" is? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/290405

5. IUSR_machinename (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/290407

6. SecureIIS - protecting IIS (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/290213

7. Windows 2000 Application log corruption (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/289994

8. IIS and Frontpage Extensions Vulnerability. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/289941

IX. SUN FOCUS LIST SUMMARY
----------------------------
1. which process bind some port (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/290426

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. MD5 checksum's for Redhat 7.3 binaries? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/290453

XI. SPONSOR INFORMATION
-----------------------

This Issue is Sponsored By: Qualys

Bulletproof Your Network: FREE Guide

Visit us at:
https://www.qualys.com/forms/guide_220.php
-------------------------------------------------------------------------------