SecurityFocus Newsletter #162

John Boletta <[email protected]> Mon, 16 Sep 2002 11:29:45 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #162
-----------------------------

This Issue Sponsored by: Wiley and Sons

SPECIAL FREE PREVIEW OF NEW KEVIN MITNICK BOOK

See what Publishers Weekly called a "tour de force, a series of tales of
how some old-fashioned blarney and high-tech skills can pry any
information from anyone..." For more information and how to order "The Art
of Deception : Controlling the Human Element of Security", visit

Please visit us at:

http://search.barnesandnoble.com/booksearch/isbnInquiry.asp?userid=5OZAUOSEB
Z&isbn=0471237124&displayonly=excerpt
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Evaluating Network Intrusion Detection Signatures, Part 1
2. SecurityFocus DPP Program
3. IIR's 3G Fraud & Security Forum
II. BUGTRAQ SUMMARY
1. Multiple Browser Zero Width GIF Image Memory Corruption...
2. Ultimate PHP Board Unauthorized Administrative Access...
3. NetGear FM114P Prosafe URL Filter Bypassing Vulnerability
4. Netscreen-Remote VPN Client IKE Packet Excessive Payloads...
5. PHP Header Function Script Injection Vulnerability
6. Multiple Microsoft JVM Vulnerabilities
7. Microsoft Internet Explorer IFrame/Frame Cross-Site/Zone Script...
8. Wordtrans-web Remote Command Execution Vulnerability
9. Wordtrans-web Script Injection Vulnerability
10. WoltLab Burning Board Board.PHP SQL Injection Vulnerability
12. Netris Remote Memory Corruption Vulnerability
13. phpGB SQL Injection Vulnerability
14. phpGB HTML Injection Vulnerability
15. PHP Function CRLF Injection Vulnerability
16. phpGB PHP Code Injection Vulnerability
17. Alleged Outlook Express Link Denial of Service Vulnerability
18. HP Tru64 Initial Random TCP Sequence Number DoS Vulnerability
19. Apple Quicktime ActiveX Component Buffer Overrun Vulnerability
20. Savant Webserver Buffer Overflow Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Sprint Cleared of Negligence in Vice Hacks
2. Insecurity Plagues Emergency Alert System
3. Word 97 feature spawns no-brainer pilfering exploit
4. Outlook Express becomes attack platform, of sorts
IV. SECURITYFOCUS TOP 6 TOOLS
1. gateProtect v3.1
2. Throughput Monitor v2.0
3. PsycologIcal Security System v1.0
4. video-entropyd v0.1
5. herbix v1.0-36
6. Palm::Zetetic::Strip v1.01
V. SECURITYJOBS LIST SUMMARY
1. Seeking Employment, Sydney Australia. (Thread)
2. Avaya Security Consulting; Policy, HIPAA, GLB (Thread)
3. Senior Consultant - Information Systems Security (Thread)
4. Principal Consultant - Information Systems Security (Thread)
5. Position in KC (Thread)
6. Focusing on secure system integration and customer satisfaction...
7. Request (Thread)
8. Security Analyst - Indiana (Thread)
9. Information Systems Auditor Position - Technical (Thread)
10. Sr. Security Specialist Position (Thread)
11. Gibraltar Solutions - SECURITY OPERATOR: 1-2 years of...
12. Gibraltar Solutions - SENIOR SECURITY ANALYST: security
13. SENIOR SECURITY ANALYST: security certification by SANS, CSI...
14. SECURITY OPERATOR: 1-2 years&#8217; operations experience; MS...
15. Seeking Security Position (Thread)
16. (job offered) Senior Security Developer (Thread)
17. Security Position desired (Thread)
18. Boston Contract Opportunity (Thread)
19. Network Security position wanted (Thread)
20. Am I getting the wrong end of the stick????? (Thread)
21. Looking for a trainee position in London (Thread)
22. Resume- CISSP (Thread)
23. Intrusion Detection Engineer Position in Washington DC (Thread)
VI. INCIDENTS LIST SUMMARY
1. strange output from chkrootkit (Thread)
2. [Full-Disclosure] remote kernel exploits? (Thread)
3. possible ssh hack (Thread)
4. What's the tool? (iis, ftp, 57/tcp) (Thread)
5. Strange back-orifice looking scan... (Thread)
6. Q328691 ? (Thread)
7. UDP flood on port 2001 (Thread)
8. remote kernel exploits? (Thread)
9. weird b.cgi (Thread)
10. prisoner.iana.org (Thread)
11. Code Red / Nimda Antidote? (Thread)
12. UDP port 22321 (Thread)
13. IH FAQ (Thread)
14. Possible PHP worm ? (Thread)
15. SV: Q328691 ? (Thread)
16. [Full-Disclosure] remote kernel exploits? (Thread)
17. Lame website scanner scanning subnets (Thread)
18. new type of formmail probes (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. NETAPI32.DLL code injection (Thread)
2. Any Vulnerability Associated with Sharing single printer? (Thread)
3. Windows XP authentification (Thread)
4. PHP header() CRLF Injection (Thread)
5. netris-0.5. (Thread)
6. x509 cert parsing in web browsers (Thread)
7. x509 cert parsing in web browsers (Thread)
8. old netscape vuln - affecting XP/explorer? (Thread)
9. Plain text files in internet explorer (Thread)
10. Syskey (Thread)
11. Vendor Changelogs /Notifications (Thread)
12. LC_COLLATE=en_US (Thread)
13. Possible cable modem denial of service ? (Thread)
14. zero-width gif: exploit PoC for NS6.2.3 (fixed in 7.0) [Was...
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Authentication problems using VPN on MS ISA (Thread)
2. Suspicious URLScan.log (Thread)
3. Windows XP file deletion (Thread)
4. AW: ASP Dot Net Security Guidelines (Thread)
5. ASP Dot Net Security Guidelines (Thread)
6. new unknown ms problem... (Thread)
7. Thanks and a follow-up question on private keys (Thread)
8. track acount activity in W2K (Thread)
9. Administrivia: Spamarrest (Thread)
10. SecurityFocus Microsoft Newsletter #103 (Thread)
11. Does W2K hold user's email, EFS etc private key securely ?...
12. SMBdie exploit testing (Thread)
IX. SUN FOCUS LIST SUMMARY
1. CDE Without ToolTalk? (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Openssh and sendmail signatures (Thread)
2. Strange SSHD Behaviour (Thread)
3. MD5 checksum's for Redhat 7.3 binaries? (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Evaluating Network Intrusion Detection Signatures, Part 1
By Karen Kent Frederick

This article is the first is a series that will help readers to evaluate
NID signatures. Properly testing NID signatures is a surprisingly complex
topic. This installment will discuss some of the basics of evaluating NID
signature quality, and then look at issues relating to selecting attacks
to be used in testing.

http://online.securityfocus.com/infocus/1623

2. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

3. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud

II. BUGTRAQ SUMMARY
-------------------
1. Multiple Browser Zero Width GIF Image Memory Corruption Vulnerability
BugTraq ID: 5665
Remote: Yes
Date Published: Sep 06 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5665
Summary:

Multiple web browsers are prone to memory corruption when handling GIF
image files with a width field set to zero. Browsers reported to be
affected are Netscape, Mozilla and Opera on Linux platforms. Other
browsers and platforms may also be affected.

It may be possible to exploit this issue to cause a denial of service or
potentially execute arbitrary code. It is reported that the malformed GIF
may enable an attacker to corrupt the heap with attacker-supplied data,
which may lead to execution of arbitrary code.

As multiple browsers are affected, this vulnerability may be due to a
common issue in a library used to render GIF images (such as libungif).
This possibility has not been confirmed.

2. Ultimate PHP Board Unauthorized Administrative Access Vulnerability
BugTraq ID: 5666
Remote: Yes
Date Published: Sep 06 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5666
Summary:

Ultimate PHP Board is a freely available, open source PHP bulletin board.
It is available for Unix, Linux, and Microsoft Operating Systems.

Ultimate PHP Board does not sufficiently validate whether authenticated
users possess administrative privileges before granting access to some
administrative facilities.

Access is not sufficiently validated for the following administrative
scripts:

admin_members.php, admin_config.php, admin_cat.php, admin_forum.php

Ultimate PHP Board checks that the scripts are being accessed by a user
who is currently logged in, but does not validate the permissions of the
user before allowing access.

Authenticated users may exploit this issue to perform administrative
actions.

3. NetGear FM114P Prosafe URL Filter Bypassing Vulnerability
BugTraq ID: 5667
Remote: Yes
Date Published: Sep 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5667
Summary:

FM114P Prosafe firewalls are a hardware solution manufactured and
distributed by Netgear.

A problem with these firewalls could make it possible for a user to
circumvent restrictions placed on URLs.

It has been reported that FM114P firewalls do not sufficiently check
addresses when requests are made. Because of this, it would be possible
for a user behind the system to reach a restricted-access site by
requesting the site on the basis of IP address.

It should be noted that this is potentially a configuration issue. The
design of URL filtering software typically requires that all sites be
blacklisted by default, with a whitelist of authorized sites specified.

4. Netscreen-Remote VPN Client IKE Packet Excessive Payloads Vulnerability
BugTraq ID: 5668
Remote: Yes
Date Published: Sep 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5668
Summary:

The Netscreen-Remote VPN Client is Virtual Private Network software. It is
available for the Microsoft Windows platform. The Netscreen-Remote Client
is prone to a remotely exploitable buffer overflow condition. It is
possible to trigger this condition by sending malformed IKE packets to the
client. The overflow is known to occur when the client attempts to process
an IKE packet with several valid payloads. When the malformed packet is
handled by the client, memory can be corrupted with attacker-supplied
values.

An attacker would most likely exploit this vulnerability with a malicious
server. It may also be possible to exploit this issue by injecting a
malicious packet into a legitimate VPN connection. The ability to inject
data will depend on network proximity of the attacker, however VPN
connections are commonly made when traffic must pass through untrusted
network space.

It may be possible to exploit this condition to execute arbitrary code
with the privileges of the client, though this has not been confirmed. It
has been confirmed that this issue can result in a denial of service to
the client system, causing a consumption of resources, and making the
client system unresponsive.

This issue is reported to be exploitable when the client software is
operating in Aggressive Mode during a phase 1 IKE exchange.

5. PHP Header Function Script Injection Vulnerability
BugTraq ID: 5669
Remote: Yes
Date Published: Sep 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5669
Summary:

PHP is a freely available, open source web scripting language package.
It is available for Microsoft Windows, Linux, and Unix operating systems.

A problem with PHP may make it possible to execute arbitrary script code.

It has been reported that a vulnerability in the PHP header function
exists. It may be possible for a user to supply arbitrary script code in
an URL that would allow the injection of script code into the HTTP header.

In such a scenario, a piece of code using the header function as in the
following example would be vulnerable:

<?php header("Location: $_GET['$url']"); ?>

This problem could lead to the execution of arbitrary script code in the
security context of the redirected site.

6. Multiple Microsoft JVM Vulnerabilities
BugTraq ID: 5670
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5670
Summary:

A reliable source has reported multiple vulnerabilities in Microsoft's
implementation of the Java Virtual Machine (JVM). According to the
report, the vulnerabilities are related to Microsoft-specific native
methods used within the various classes.

There are numerous input validation and memory corruption issues in these
methods. It is possible to invoke them through other, public methods that
are accessible by Applets. Attackers may write applets designed to
exploit the vulnerabilities and place them on websites or embed them in
HTML mail. Exploitation occurs when the applets are run.

It may be possible for attackers to exploit these vulnerabilities to
access the file system or execute hostile code on the target system
outside of the sandbox restrictions. The individual who reported this
issue has stated that the Sun JVM was tested and found not vulnerable.

7. Microsoft Internet Explorer IFrame/Frame Cross-Site/Zone Script Execution Vulnerability
BugTraq ID: 5672
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5672
Summary:

When a Microsoft Internet Explorer (MSIE) window opens another window,
security checks should prevent the parent from accessing the child if the
latter is of another domain or Security Zone. Several vulnerabilities
have been reported in the past related to this process.

It has been reported that such checks fails to occur against attempts to
access the frames of child window documents. It is possible for a parent
window to set the URL of frames or iframes within a child window
regardless of the domain or Security Zone. This has serious security
implications as the parent can cause script code to be executed within the
context of the child domain by setting the URL to the "javascript"
protocol, followed by the desired code.

Attackers may exploit this vulnerability to obtain cookie values for other
domains/websites, modify content, and perform other similar attacks.
Attackers may also execute script code within the "My Computer" Zone.
This may have more severe consequences. This is possible if a HTML file
exists on the client filesystem that contains frames. For users of MSIE6,
the file "res://shdoclc.dll/privacypolicy.dlg" may be used. There may
exist similar files for users of earlier versions of MSIE.

8. Wordtrans-web Remote Command Execution Vulnerability
BugTraq ID: 5671
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5671
Summary:

Wordtrans-web provides an interface to query multilingual dictionaries
through a web browser.

Wordtrans-web fails to validate input parameters properly, allowing the
inclusion of operating system commands. The wordtrans.php script will
pass the parameters to the Wordtrans binary for execution. Commands will
be executed with the privileges of the webserver process.

All versions of Wordtrans-web up to and including version 1.1pre8 are
vulnerable to this issue.

9. Wordtrans-web Script Injection Vulnerability
BugTraq ID: 5674
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5674
Summary:

Wordtrans-web provides an interface to query multilingual dictionaries
through a web browser.

The Wordtrans-web interface does not properly validate input parameters.
These input parameters in turn will be used in output generated by the
software. This could allow injection of arbitrary HTML and script code,
which will be executed by the web client in the context of the
Wordstrans-web interface.

All versions of Wordtrans-web up to and including version 1.1pre8 are
vulnerable to this issue.

10. WoltLab Burning Board Board.PHP SQL Injection Vulnerability
BugTraq ID: 5675
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5675
Summary:

WoltLab Burning Board is a free web-based bulletin board package based on
PHP and MySQL.

WoltLab is prone to SQL injection attacks. This is due to insufficient
sanitization of variables which are used in SQL queries by the 'board.php'
script. It is possible to supply parameters to the script externally via
the query string in a web request, and these parameters in turn will be
used directly to construct database queries.

The logic of a SQL query made by the script may be modified, resulting in
the potential for database corruption. It has also been demonstrated that
it is possible to exploit this condition to gain administrative privileges
within the bulletin board system. SQL injection may also expose the
database to other types of attacks, such as exploitation of existing
vulnerabilities in the underlying database software.

11. Trillian Instant Messaging Credential Encryption Weakness
BugTraq ID: 5677
Remote: No
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5677
Summary:

Trillian is an instant messaging client that supports a number of
protocols (including IRC, ICQ, MSN). It is available for Microsoft
Windows systems.

Users of the software may opt to save their credentials for instant
messaging services to allow automatic access.

Trillian uses weak encryption to store saved authentication credentials
for instant messaging services. The credentials are encrypted by using
XOR with a static key that is used with every installation of the
software. The encryption may be trivially reversed, yielding
authentication credentials for instant messaging services.

Exploit code has been released which will allow local attackers to decrypt
the instant messaging credentials of other users on the system.

12. Netris Remote Memory Corruption Vulnerability
BugTraq ID: 5680
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5680
Summary:

Netris is a freely available network "Tetris" clone. It is available for
Unix and Linux variants.

Netris is prone to a remotely exploitable memory corruption issue. An
attacker may exploit this to cause a denial of service to occur. It may
also be possible to cause memory to be corrupted with attacker-supplied
data, which may result in execution of arbitrary code with the privileges
of the user running the program. The possibility of code execution has
not been confirmed.

13. phpGB SQL Injection Vulnerability
BugTraq ID: 5673
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5673
Summary:

phpGB is a PHP/MySQL based guestbook. It is available for all operating
systems that support PHP, including Unix, Linux, and Microsoft Windows.

The cause of the issue is that the bulletin board relies on the PHP
magic_quotes_gpc directive to sanitize variables that are used in SQL
queries.

If magic_quotes_gpc is not enabled, then it will be possible for attackers
to mount SQL injection attacks through the guestbook. Variables will not
be properly sanitized of potentially malicious input, which may allow an
attacker to inject SQL code into variables which will be used to construct
database queries.

It is possible to exploit this issue to modify the logic of SQL queries,
which may allow attackers to corrupt the database. It is also possible to
exploit this issue to gain administrative guestbook privileges.

14. phpGB HTML Injection Vulnerability
BugTraq ID: 5676
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5676
Summary:

phpGB is a PHP/MySQL based guestbook. phpGB is available on all platforms
that support PHP, including Unix, Linux, and Windows.

phpGB fails to check for the presence of HTML tags when generating
guestbook entries. It is reported that an attacker may inject HTML and
script code into guestbook entries, which will be executed in the web
client of the administrative guestbook user when the admin attempts to
delete the entry.

This issue may be exploited to obtain sensitive information such as the
session ID of the guestbook administrator.

15. PHP Function CRLF Injection Vulnerability
BugTraq ID: 5681
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5681
Summary:

PHP is a freely available, open source web scripting language package. It
is available for Microsoft Windows, Linux, and Unix operating systems.

PHP includes a number of functions, such as fopen() and file(), which are
used to reference external resources, such as other PHP files. If the
allow_url_fopen() PHP directive is enabled, these functions may be used to
access resources that exist on remote hosts by supplying a URL as an
argument to the function. When these functions are used to reference a
remote resource, PHP constructs a request for the resource using the
appropriate protocol.

A vulnerability has been discovered in PHP which may allow an attacker to
add arbitrary data to headers constructed by PHP when remote resources are
retrieved using these functions. This may be accomplished by embedding
CRLF (carriage returns/linefeed pairs) in variables included in the URL.
For example, if fopen() is called with an include_path to a remote web
server, then a HTTP GET request will be constructed to access the remote
resource. It is possible, by injecting CRLFs into parameters of a
vulnerable script, to add arbitrary header information (such as the Host:
field, cookies, etc) to the request that is constructed by PHP.

This input validation condition may allow for a number of attacks. For
example, attackers may modify the Host: field. This may theoretically
result in a file other than that expected being included in a PHP script.
Furthermore, under some circumstances it is possible to trick the PHP
interpreter into connecting to an arbitrary port and transmitting
commands. This was demonstrated by the individual who reported this
issue.

16. phpGB PHP Code Injection Vulnerability
BugTraq ID: 5679
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5679
Summary:

phpGB is a PHP/MySQL based guestbook. phpGB is available on all platforms
that support PHP, including Unix, Linux, and Microsoft Windows.

phpGB is subject to a PHP code injection vulnerability.

It is possible to inject code into the guestbook configuration file
(config.php) by supplying malicious parameters for the savesettings.php
script. The configuration file is referenced in most of the other
guestbook scripts, so each time one of the scripts is accessed the
attacker-supplied PHP code will be executed.

It should be noted that normally authentication is required to access the
savesettings.php script, however, the script authenticates by checking
that it was request via a HTTP POST request and does not further
authenticate users.

Injection of improper syntax will result in a denial of service on the
entire guestbook, since this will cause an error to occur when the
configuration file is interpreted.

It is also possible for an attacker to exploit this condition to execute
operating system commands with the privileges of the webserver via PHP
code injection.

17. Alleged Outlook Express Link Denial of Service Vulnerability
BugTraq ID: 5682
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5682
Summary:

A denial of service issue has been reported in Microsoft Outlook Express.

Reportedly, when decoding a HTML email, Outlook Express will stop
responding upon encountering a <A HREF> link longer than 4095 characters.
It is not confirmed why this behaviour occurs or clear whether the
vulnerability is in Outlook or Internet Explorer. Though the reported
issue cannot always be reproduced, Microsoft has confirmed it's existence.
It may affect only certain, localized versions.

18. HP Tru64 Initial Random TCP Sequence Number DoS Vulnerability
BugTraq ID: 5683
Remote: Yes
Date Published: Sep 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5683
Summary:

HP has reported a potential denial of service vulnerability in the TRU64
Unix due to the creation of predictable TCP Initial Sequence Numbers
(ISNs). Weak random number generation poses a security risk due to an
attackers ability to anticipate sequence numbers used in TCP sessions.

Though a denial of service was reported by the vendor, administrators
should keep in mind that TCP implementations with weak ISN generation are
typically exploited to perform man-in-the-middle attacks and session
hijacking. This may be possible as a result of this vulnerability.

19. Apple Quicktime ActiveX Component Buffer Overrun Vulnerability
BugTraq ID: 5685
Remote: Yes
Date Published: Sep 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5685
Summary:

Quicktime is a popular multimedia file format developed by Apple that is
often used for online content. A vulnerability has been reported in the
Quicktime ActiveX component for Internet Explorer.

The vulnerability is a buffer overrun condition that is due to inadequate
bounds checking of supplied arguments. If the component is invoked with
the "pluginspage" argument set to a string value that is of excessive
length, the overrun will occur. This condition is reportedly exploitable
and may result in attacker supplied instructions being run on affected
client systems.

Remote attackers may leverage this issue to gain access to target hosts.

20. Savant Webserver Buffer Overflow Vulnerability
BugTraq ID: 5686
Remote: Yes
Date Published: Sep 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5686
Summary:

Savant webserver is a free webserver that runs on Windows platforms.

A buffer overflow vulnerability has been reported in Savant webserver.
If the argument to a GET request exceeds 291 bytes in length, a stack
overrun will occur. This condition may be exploited to execute arbitrary
instructions on the affected host.

Attackers may leverage this vulnerability to gain remote access to target
systems.

III. SECURITYFOCUS NEWS AND COMMENTARY
------------------------------------------
1. Sprint Cleared of Negligence in Vice Hacks
By Kevin Poulsen

State commission finds Sprint's security no worse than any other telephone
company.

http://online.securityfocus.com/news/628

2. Insecurity Plagues Emergency Alert System
By Kevin Poulsen

The FCC-mandated network that lets officials interrupt radio and
television broadcasts in an emergency is wide open to electronic
tampering, and the government has no plans to fix it ...

http://online.securityfocus.com/news/613

3. Word 97 feature spawns no-brainer pilfering exploit

By John Leyden, The Register

Microsoft is investigating a security vulnerability with Word 97 which
allows attackers to filch documents from victim's PCs using a craft social
engineering attack.

http://online.securityfocus.com/news/630

4. Outlook Express becomes attack platform, of sorts
By John Leyden, The Register Sep 13 2002 5:40AM

There's a pleasing symmetry about the latest security issue involving
Outlook Express. For the last couple of years Outlook (Lookout) Express
failings have been exploited to infect users. So why not take advantage of
its features to send viruses in such a way that they might fool detection
by AV and content checking tools?

http://online.securityfocus.com/news/629

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. gateProtect v3.1
by Till von Rennenkampff
Relevant URL:
http://www.gateprotect.com/
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

The firewall product line of gateProtect's high security systems enables
companies to completely secure their corporate networks against internal
and external attacks. gateProtect includes features to protect data from
Internet-based security risks, espionage, and virus attacks. Through the
use of an intrusion detection system, attacks are detected, prevented, and
located. gateProtect's all-in-one firewall products feature very easy
usage combined with a maximum of power, speed and security. The whole
firewall can be easily configured through a graphical interface with drag
& drop support. gateProtect's firewall software requires its own dedicated
PC to run.

2. Throughput Monitor v2.0
by Ragnar Kurm
Relevant URL:
http://home.uninet.ee/~ragnar/throughput_monitor/
Platforms: UNIX
Summary:

Throughput Monitor monitors or analyzes event frequency in log files. Its
main purpose is to detect if frequency crosses specified theresholds and
report about it. Alerts can be mailed or logged in realtime on running
logs. Old logs can also be analyzed. Log events are described by regexes,
so almost every format is readable. It can be used to detect spam,
too-frequent system resource usage (for example POP or IMAP), etc.

3. PsycologIcal Security System v1.0
by Ismael Olea [email protected]
Relevant URL:
http://piss.olea.org/
Platforms: N/A
Summary:

The PsychologIcal Security System (P.I.S.S.) is the last barrier and
desperate security system for the lazy trusted system administrator. It's
based on a deep investigation process trying to find the most generalized
psychological system intrusion profile. The protection scheme is included
both in English and Spanish.

4. video-entropyd v0.1
by Folkert van Heusden
Relevant URL:
http://www.vanheusden.com/ved/
Platforms: Linux, POSIX
Summary:

video-entropyd is a program to add entropy data from video4linux devices
to the kernel random driver.

5. herbix v1.0-36
by herbi
Relevant URL:
http://cuodan.net/~sina
Platforms: Linux, POSIX
Summary:

Herbix is a Linux server that fits on a floppy. It supports ipchains and
can serve FTP, HTTP, IRC, DHCP, SMTP, and IDENT.

6. Palm::Zetetic::Strip v1.01
by Dave Dribin
Relevant URL:
http://www.dribin.org/dave/software/perl-strip/
Platforms: Os Independent
Summary:

Palm::Zetetic::Strip is a set of Perl 5 modules that provides an interface
to the Palm database (PDB) files for Strip, a password and account manager
from zetetic.net for the Palm computing platform. It uses the IDEA and AES
algorithms to decrypt the data from PDB files.

V. SECURITY JOBS SUMMARY
------------------------
1. Seeking Employment, Sydney Australia. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291523

2. Avaya Security Consulting; Policy, HIPAA, GLB (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291522

3. Senior Consultant - Information Systems Security (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291477

4. Principal Consultant - Information Systems Security (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291418

5. Position in KC (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291420

6. Focusing on secure system integration and customer satisfaction (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291332

7. Request (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291338

8. Security Analyst - Indiana (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291331

9. Information Systems Auditor Position - Technical (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291223

10. Sr. Security Specialist Position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291236

11. Gibraltar Solutions - SECURITY OPERATOR: 1-2 years of operations experience; MS Windows, UNIX and X-Windows (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291213

12. Gibraltar Solutions - SENIOR SECURITY ANALYST: security certification by SANS, CSI or another recognized organization; 3-5 years of security-related experience (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291214

13. SENIOR SECURITY ANALYST: security certification by SANS, CSI or another recognized organization; 3-5 years of security-related experience (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291186

14. SECURITY OPERATOR: 1-2 years&#8217; operations experience; MS Windows, UNIX and X-Windows (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291198

15. Seeking Security Position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291169

16. (job offered) Senior Security Developer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291029

17. Security Position desired (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291042

18. Boston Contract Opportunity (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291063

19. Network Security position wanted (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290789

20. Am I getting the wrong end of the stick????? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290801

21. Looking for a trainee position in London (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290840

22. Resume- CISSP (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290792

23. Intrusion Detection Engineer Position in Washington DC (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/290796

VI. INCIDENTS LIST SUMMARY
-------------------------
1. strange output from chkrootkit (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291652

2. [Full-Disclosure] remote kernel exploits? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291653

3. possible ssh hack (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291646

4. What's the tool? (iis, ftp, 57/tcp) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291452

5. Strange back-orifice looking scan... (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291446

6. Q328691 ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291450

7. UDP flood on port 2001 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291434

8. remote kernel exploits? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291183

9. weird b.cgi (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291182

10. prisoner.iana.org (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291172

11. Code Red / Nimda Antidote? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291237

12. UDP port 22321 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291171

13. IH FAQ (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291019

14. Possible PHP worm ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291008

15. SV: Q328691 ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291056

16. [Full-Disclosure] remote kernel exploits? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290992

17. Lame website scanner scanning subnets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290720

18. new type of formmail probes (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/290707

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. NETAPI32.DLL code injection (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/291520

2. Any Vulnerability Associated with Sharing single printer? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/291444

3. Windows XP authentification (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/291165

4. PHP header() CRLF Injection (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/291017

5. netris-0.5. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290998

6. x509 cert parsing in web browsers (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290990

7. x509 cert parsing in web browsers (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290931

8. old netscape vuln - affecting XP/explorer? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290916

9. Plain text files in internet explorer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290862

10. Syskey (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290820

11. Vendor Changelogs /Notifications (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290715

12. LC_COLLATE=en_US (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290713

13. Possible cable modem denial of service ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290712

14. zero-width gif: exploit PoC for NS6.2.3 (fixed in 7.0) [Was: GIFs Good, Flash Executable Bad] (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/290726

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Authentication problems using VPN on MS ISA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291565

2. Suspicious URLScan.log (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291571

3. Windows XP file deletion (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291570

4. AW: ASP Dot Net Security Guidelines (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291564

5. ASP Dot Net Security Guidelines (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291436

6. new unknown ms problem... (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291404

7. Thanks and a follow-up question on private keys (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291389

8. track acount activity in W2K (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291320

9. Administrivia: Spamarrest (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291314

10. SecurityFocus Microsoft Newsletter #103 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291094

11. Does W2K hold user's email, EFS etc private key securely ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291083

12. SMBdie exploit testing (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/290787

IX. SUN FOCUS LIST SUMMARY
--------------------------
1. CDE Without ToolTalk? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/291346

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Openssh and sendmail signatures (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291557

2. Strange SSHD Behaviour (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291455

3. MD5 checksum's for Redhat 7.3 binaries? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291342

XI. SPONSOR INFORMATION
-----------------------
This Issue Sponsored by: Wiley and Sons

SPECIAL FREE PREVIEW OF NEW KEVIN MITNICK BOOK

Please visit us at:

http://search.barnesandnoble.com/booksearch/isbnInquiry.asp?userid=5OZAUOSEB
Z&isbn=0471237124&displayonly=excerpt
-------------------------------------------------------------------------------