SecurityFocus Newsletter #163

Stephen Entwisle <[email protected]> Mon, 23 Sep 2002 11:25:28 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #163
-----------------------------

This Issue is Sponsored by: SPI Dynamics

ALERT! - Cross-site scripting vulnerabilities in web applications allow
hackers to compromise confidential information, manipulate or steal
cookies, and create requests that can be mistaken for those of a valid
user!! All via port 80 and 443! Download this *FREE* white paper from SPI
Dynamics for a complete guide to protection!

Please visit us at: http://www.spidynamics.com/mktg/xss1/

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Detecting and Removing Trojans and Malicious Code from Win2K
2. Who Goes There? An Introduction to On-Access Virus Scanning...
3. Configuring IPsec and IKE on Solaris, Part Three
4. Slapped Silly
5. Privacy Losses Around the World
6. A Cybersecurity Sleeping Pill
7. Hackback or the High Road? The question goes beyond Nimda
8. SecurityFocus DPP Program
9. IIR's 3G Fraud & Security Forum
II. BUGTRAQ SUMMARY
1. PlanetWeb Long GET Request Buffer Overflow Vulnerability
2. Microsoft Netmeeting Local Session Hijacking Vulnerability
3. Opera Oversized Image Width Denial Of Service Vulnerability
4. ASMon Kernel Memory File Descriptor Leakage Vulnerability
5. ASCPU Kernel Memory File Descriptor Leakage Vulnerability
6. BubbleMon Kernel Memory File Descriptor Leakage Vulnerability
7. WMMon Memory Character File Open File Descriptor Read...
8. WMNet2 Kernel Memory File Descriptor Leakage Vulnerability
9. NetBSD Repeated TIOSCTTY IOCTL Buffer Overflow Vulnerability
10. KDE Konqueror Oversized Image Width Denial of Service...
11. DB4Web File Disclosure Vulnerability
12. NetBSD LibC SetLocale Buffer Overflow Vulnerability
13. DB4Web Connection Proxy Vulnerability
14. NetBSD IPv4 Multicast Tools Buffer Overflow Vulnerability
15. Lycos HTMLGear guestGear CSS HTML Injection Vulnerability
16. Heimdal Kerberos Forwarding Daemon File Overwriting Vulnerability
17. Heimdal Kerberos Forwarding Daemon Zero Terminated String...
18. Joe Text Editor Backup SetUID Executable Editing Permission...
19. Purity Local Buffer Overflow Vulnerabilities
20. Enterasys SSR8000 SmartSwitch Port Scan Denial Of Service...
21. Avaya IP Office Malformed Packets Denial Of Service Vulnerability
22. Savant Webserver cgitest.exe Denial Of Service Vulnerability
23. Savant Webserver File Disclosure Vulnerability
24. Savant Webserver Malformed Content-Length Denial Of Service...
25. Mac OS X NetInfo Manager Unauthorized Access Vulnerability
26. BRU XBRU Insecure Temporary File Vulnerability
27. Microsoft Windows Encrypted RDP Packet Information Leakage...
28. Microsoft Windows RDP Keystroke Injection Vulnerability
29. Microsoft Windows XP Professional Remote Desktop Denial Of...
III. SECURITYFOCUS NEWS ARTICLES
1. Cybersecurity Plan Offends No One
2. Flaws in Microsoft VM. Fix now
3. Linux rootkit hacker suspect arrested in UK
4. White House panel's cybersecurity plan avoids calls for new...
IV.SECURITYFOCUS TOP 6 TOOLS
1. Server Scan 2002
2. GFI LANguard Network Security Scanner (N.S.S.) v3.0
3. archivemail v0.5.1
4. the Anomy mail sanitizer v1.54
5. bcrypt v1.1
6. Demarc PureSecure v1.6
V. SECURITYJOBS LIST SUMMARY
1. InfoSec professional seeking job (Thread)
2. Corporate Risk Assessment Consultant - OH (Thread)
3. Senior Vice President, Strategic Development - #300...
4. VP of Engineering - #727 - San Mateo, CA (Thread)
5. Security Position in St. Louis (Thread)
6. Salary Cap's PLEASE! (Thread)
7. FW: Management Security Consultants based in Germany needed...
8. FW: Management Security Consultants based in France needed...
9. Unix System Administrator and former SIGINT-er looking...
10. Sr. Net Sec Engineer seeking in FL (Thread)
11. Security Architect position in Kansas City (Thread)
12. Am I getting the wrong end of the stick????? (Thread)
13. Washington, DC area security engineer looking for job (Thread)
14. Cleared Network Security Analyst to work in Clarendon, VA or...
15. Cleared Security Database Engineer for Ft. Meade, Maryland...
16. Information System Security Engineer (Orlando, Florida) (Thread)
17. Looking for Security QA position. (Thread)
18. Information Security Officer - Risk Managment - EUROPE Based...
VI. INCIDENTS LIST SUMMARY
1. Linux Slapper Worm and Linksys (Thread)
2. Good practicle php attack example (Thread)
3. What's on udp/2002 ? (Thread)
4. Thank you all for your responses to "Huge Autoexec.bat" (Thread)
5. Huge Autoexec.bat (Thread)
6. slaper trafic (Thread)
7. Another Nimda attack?? (Thread)
8. Interesting packets (Thread)
9. Win2K Advaned Server compromise report available (Thread)
10. [unisog] non worm ssl attacks (Thread)
11. non worm ssl attacks (Thread)
12. Analysis of Modap worm (Thread)
13. strange output from chkrootkit (Thread)
14. possible ssh hack (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Cisco VPN Concentrator 3000 ISAKMP DoS details (Thread)
2. dictionary (Thread)
3. NetScreen Slipstream (Thread)
4. Windows Licensing (was Windows XP Service Pack1 problem...
5. Windows XP Service Pack1 problem with activation (Thread)
6. UPNP protocol problem (was) Windows XP Service Pack1 problem...
7. Any Vulnerability Associated with Sharing single printer? (Thread)
8. [Full-Disclosure] openssl exploit code (Thread)
9. Linux Slapper Worm code (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. XP Hardening (Thread)
2. win xp sp1 changes ICF settings/rules and/or default behavior...
3. Hosting multiple sites/ASP.NET security (Thread)
4. AW: XP Hardening (Thread)
5. AW: Hosting multiple sites/ASP.NET security (Thread)
6. Database security (Thread)
7. Restricting access to a CD-WR drive on a Win2K Server (Thread)
8. 3 Strikes Your Out Password Policy (Thread)
9. win xp sp1 changes ICF settings/rules and/or default behavior...
10. Internet Explorer using LoopBack (Thread)
11. Authentication problems using VPN on MS ISA (Thread)
12. Does W2K hold user's email, EFS etc private key securely ?...
13. RRAS with PPTP connections security (Thread)
14. SecurityFocus Microsoft Newsletter #104 (Thread)
15. AW: Database security (Thread)
16. Remote Shutdown (Thread)
17. AW: Suspicious URLScan.log (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Solaris Basic Security Module (Thread)
2. PAM and FTP in Solaris 7 (Thread)
3. OpenSSL worm (Thread)
X. LINUX FOCUS LIST SUMMARY
1. route add to block IP's (Thread)
2. OpenSSL worm (Thread)
3. Openssh and sendmail signatures (Thread)
4. MD5 checksum's for Redhat 7.3 binaries? (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Detecting and Removing Trojans and Malicious Code from Win2K
By H. Carvey

The amount of malicious code directed at Windows systems seems to be
increasing on a continual curve The purpose of this article is to
recommend steps that an administrator can use to determine whether or not
a Win2K system has been infected with malicious code or "malware" and, if
so, to remove it.

http://online.securityfocus.com/infocus/1627

2. Who Goes There? An Introduction to On-Access Virus Scanning, Part Two
by Bill Hayes

By now, most savvy computer users have anti-virus software (AV) installed
on their machines and use it as part of their regular computing routine.
However, most average users do not know how anti-virus software works.
This article is the second in a two-part series that will offer a brief
overview of a particular type of anti-virus technique known as on-access
scanning.

http://online.securityfocus.com/infocus/1626

3. Configuring IPsec and IKE on Solaris, Part Three
By Ido Dubrawsky

This is the third article in a three-part series on configuring IPsec and
the Internet Key Exchange (IKE) on Solaris hosts. The first two articles
covered the basics of IPsec and IKE as well as configuring IPsec to
protect traffic between two Solaris hosts. This article will discuss the
configuration of an IPsec VPN tunnel between two Solaris hosts.

http://www.securityfocus.com/infocus/1628

4. Slapped Silly By Jon Lasser

Lessons I learned from falling prey to the latest Linux virus ...

http://online.securityfocus.com/

5. Privacy Losses Around the World
By David Banisar

It has now been one year since the horrific events of September 11th,
2001. It is often said that "everything has changed." That includes
privacy, and the changes are not limited to the United States.

http://online.securityfocus.com/columnists/108

6. A Cybersecurity Sleeping Pill
By George Smith

From a White House given to dramatic warnings of electronic Pearl Harbors
comes an incongruously meek national strategy. Did industry lobbyists slip
someone a Mickey?

http://online.securityfocus.com/columnists/110

7. Hackback or the High Road? The question goes beyond Nimda

A SecurityFocus Guest Feature by Markus DeShon, Ph.D.

http://online.securityfocus.com/guest/16531

8. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

9. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud

II. BUGTRAQ SUMMARY
-------------------
1. PlanetWeb Long GET Request Buffer Overflow Vulnerability
BugTraq ID: 5710
Remote: Yes
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5710
Summary:

PlanetWeb is a commercially available web server distributed by PlanetDNS.
It is available for the Microsoft Windows platform.

PlanetWeb is vulnerable to a buffer overflow condition when handling GET
requests of excessive length. Upon receiving a GET request containing a
1024 byte or greater URL, an exploitable buffer overflow occurs.

By sending a maliciously crafted GET request, it is possible for an
attacker to corrupt memory, and potentially execute arbitrary
instructions. This may result in the remote execution of arbitrary code
within the context of the web server process.

2. Microsoft Netmeeting Local Session Hijacking Vulnerability
BugTraq ID: 5715
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5715
Summary:

Microsoft Netmeeting is a real-time collaboration and conferencing client
for Microsoft Windows. Netmeeting contains a Remote Desktop Sharing (RDS)
component that allows a remote user to take control of the client desktop
similarly to remote administration utilities.

Netmeeting can be configured to use a password-protected screensaver if
the Remote Desktop Sharing session is interrupted in any way. While the
RDS session is active, the actions being performed by the remote user can
be observed on the display of the host system.

A local user can monitor the actions during the session and wait for the
user to modify a document of some sort. If the local user enters a
CTRL-ALT-DEL sequence, the remote user will lose control of the session
and the local user will be given the option to log off or shut down the
system. If the local user chooses to log off, the system will begin the
log off process, but while closing the modified document, the system will
ask the user if they want to save changes to the document. The system
will remain in this state until the user chooses to save or abandon the
changes. During this time, the local user has access to the local system
with the privileges of the locally logged on user.

3. Opera Oversized Image Width Denial Of Service Vulnerability
BugTraq ID: 5717
Remote: Yes
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5717
Summary:

Opera is a web browser created by Opera Software. It is available for a
range of operating systems including Windows and Linux.

It has been reported that Opera is prone to a denial of service
vulnerability, when processing overly wide images.

When Opera attempts to process a valid image containing a width of 32759
pixels, the condition is triggered, causing Opera to crash.

This vulnerability may result in memory corruption. If memory can be
corrupted with attacker-supplied data, then it may be possible to execute
arbitrary code within the context of the client.

Although not confirmed, it has been reported that this may actually be a
bug in QImage, which Opera uses to display image files.

This issue was reported in Opera on Linux platforms. Other versions may
also be affected.

4. ASMon Kernel Memory File Descriptor Leakage Vulnerability
BugTraq ID: 5720
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5720
Summary:

asmon is a freely available, open source system monitoring application for
the AfterStep desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that asmon is vulnerable to a leakage of open file
descriptors that may result in unauthorized disclosure of kernel memory.
It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through asmon. The program that is executed can be specified by the
attacker at the command line.

Upon exploiting this vulnerability, an attacker would have read-access to
kernel memory. The attacker could use this access to gain sensitive
information such as passwords, or other information. It should be assumed
that total compromise is imminent if an attacker has read access to kernel
memory.

5. ASCPU Kernel Memory File Descriptor Leakage Vulnerability
BugTraq ID: 5716
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5716
Summary:

ascpu is a freely available, open source system monitoring application for
the AfterStep desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that ascpu is vulnerable to a leakage of open file
descriptors that may result in unauthorized disclosure of kernel memory.
It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through ascpu. The program that is executed can be specified by the
attacker at the command line.

6. BubbleMon Kernel Memory File Descriptor Leakage Vulnerability
BugTraq ID: 5714
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5714
Summary:

BubbleMon is a freely available, open source system monitoring application
for the Gnome desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that BubbleMon is vulnerable to a leakage of open
file descriptors that may result in unauthorized disclosure of kernel
memory. It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through BubbleMon. The program that is executed can be specified by the
attacker at the command line.

7. WMMon Memory Character File Open File Descriptor Read Vulnerability
BugTraq ID: 5718
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5718
Summary:

wmmon is a freely available, open source system monitoring application for
the WindowMaker desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that wmmon is vulnerable to a leakage of open file
descriptors that may result in unauthorized disclosure of kernel memory.
It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through wmmon. The program that is executed can be specified by the
attacker at the command line.

8. WMNet2 Kernel Memory File Descriptor Leakage Vulnerability
BugTraq ID: 5719
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5719
Summary:

wmnet2 is a freely available, open source system monitoring application
for the WindowMaker desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that wmnet2 is vulnerable to a leakage of open file
descriptors that may result in unauthorized disclosure of kernel memory.
It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through wmnet2. The program that is executed can be specified by the
attacker at the command line.

9. NetBSD Repeated TIOSCTTY IOCTL Buffer Overflow Vulnerability
BugTraq ID: 5722
Remote: No
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5722
Summary:

A vulnerability has been reported in NetBSD. Reportedly, flaws exist in
the TIOSCTTY (set controlling TTY) ioctl kernel calls. TIOSCTTY is used to
set the session controlling TTY.

A call to TIOSCTTY will increment the hold count of a kernel structure
shared between processes in the same session. Thus, repeated calls to
TIOSCTTY will cause an internal buffer to be incremented indefinitely and
overflow. The flaw will allow a local attacker to cause the memory
structure to be freed prematurely. This may cause a kernel panic or cause
faulty teminal sessions.

A local attacker can exploit this vulnerability to cause the system to
panic and experience a denial of service condition.

10. KDE Konqueror Oversized Image Width Denial of Service Vulnerability
BugTraq ID: 5721
Remote: Yes
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5721
Summary:

Konqueror is an Open Source web browser, shipped with the KDE desktop. It
is available on Linux platforms.

It has been reported that Konqueror is prone to a denial of service
vulnerability when processing overly wide images.

When Konqueror attempts to process a valid image containing a reported
width of 32759 pixels, the condition is triggered, causing Konqueror to
temporarily consume system resources and then crash.

This vulnerability may result in memory corruption. If memory can be
corrupted with attacker-supplied data, then it may be possible to execute
arbitrary code within the context of the client.

The problem reportedly exists on Mandrake 8.2 running KDE 3.0.2 Although
unconfirmed, it likely exists on all systems running KDE 3.0.2

11. DB4Web File Disclosure Vulnerability
BugTraq ID: 5723
Remote: Yes
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5723
Summary:

DB4Web is an application server that allows read and write access to
relational databases and other information sources, via the web. The
application is available for Windows, Linux, and various Unix platforms.

A directory traversal bug exists in DB4Web.

By passing a maliciously crafted query to the application, such as encoded
"dot-dot" sequences (../), an attacker can potentially gain access to
arbitrary system files. This is due to the application insufficiently
validating the user supplied input.

An attacker can access the DB4Web application binary via the 'cgi-bin'
directory on Unix and Linux servers, or the 'scripts' directory on windows
servers.

12. NetBSD LibC SetLocale Buffer Overflow Vulnerability
BugTraq ID: 5724
Remote: No
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5724
Summary:

A buffer overflow vulnerability has been discovered in NetBSD versions
1.5.3 and earlier.

The buffer overflow is reported to occur in the setlocale() function in
libc. The setlocale() function is used to query or set a program's
current locale. This vulnerability is reportedly exploitable when certain
specific conditions are met. The vulnerability when successfully
exploited, will give a local user root access to the system.

The buffer overflow condition occurs due to insufficient boundary checking
on the arguments to the setlocale() function. When an attacker calls the
setlocale() function using 'LC_ALL' category and an overly long second
argument, the buffer overflow condition is met.

A successful exploit requires that the second argument is derived from
externally supplied data, such as environment variables or command line
arguments, from a setuid/setgid application. NetBSD has stated that most
applications using Xt, including the setuid program, xterm, may satisfy
this condition. As well, the zsh package is another program that may
satisfy these conditions.

A local attacker may be able to exploit this vulnerability by invoking the
setlocale() function with malformed arguments and obtain elevated
privileges.

13. DB4Web Connection Proxy Vulnerability
BugTraq ID: 5725
Remote: Yes
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5725
Summary:

By requesting a specially crafted URL, it is possible to initiate a TCP
connect from the vulnerable server to a remote IP address and arbitrary
port.

The application will send TCP SYN requests which will produce information
displayed in a debug error page. Information displayed such as "connect()
ok" or "connect() failed: Connection refused", can be used to determine
port status information on the specified host.

14. NetBSD IPv4 Multicast Tools Buffer Overflow Vulnerability
BugTraq ID: 5727
Remote: No
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5727
Summary:

NetBSD has reported buffer overflow vulnerabilities in several of its IPv4
multicast tools as well as the pppd service. The mrinfo(1), mtrace(1) and
the pppd(8) daemon are affected by this vulnerability.

The buffer overflow vulnerability is a result of improper boundary
checking when performing FD_SET() operations. An attacker is able to
exploit this vulnerability by filling the file descriptor table and then
invoking the tools. The tools make use of select() which supports only
FD_SETSIZE (256) file descriptors. Thus, when executed and select is
allocated a file descriptor equal to or larger than FD_SETSIZE (256), the
buffer overflow condition is met.

The multicast tools and the pppd service are setuid root applications. An
attacker can exploit this vulnerability to obtain root privileges on
vulnerable systems.

15. Lycos HTMLGear guestGear CSS HTML Injection Vulnerability
BugTraq ID: 5728
Remote: Yes
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5728
Summary:

Lycos htmlGEAR is a set of web-based applications which are available to
users of the Lycos network, but may also be used for other websites.
guestGEAR is guestbook software.

guestGEAR does not sanitize HTML from CSS (Cascading Style-Sheets)
elements in guestbook fields. An attacker could capitalize on this
situation to include arbitrary HTML and script code in a guestbook
entries, which would be rendered in the web client of users who view the
malicious guestbook entry.

Code injected in this manner will be executed in the security context of
the website hosting the guestbook. Exploitation of this vulnerability may
allow an attacker to steal cookie-based authentication credentials,
redirect users to other sites, manipulate content or launch other attacks.

It has also been reported that it is possible, in some versions of the
software, to inject HTML into image tags.

16. Heimdal Kerberos Forwarding Daemon File Overwriting Vulnerability
BugTraq ID: 5729
Remote: Yes
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5729
Summary:

Heimdal Kerberos is an implementation of the Kerberos protocol distributed
and maintained by the Center for Parallel Computers, KTH. It is open
source, and available for Unix and Linux operating systems.

A problem with the implementation could make it possible for remote users
to overwrite files on a vulnerable system.

The Heimdal Kerberos Forwarding Daemon does not properly protect some
information sent from a client to a server. Because of this, it may be
possible to overwrite files accessible via the authenticated user's id.
This could result in a denial of service, or potential loss of data.

It should be noted that this vulnerability may be exploited to overwrite
files that are write-accessible by the victim.

No further details are known at this time.

17. Heimdal Kerberos Forwarding Daemon Zero Terminated String Passing Buffer Overflow Vulnerability
BugTraq ID: 5731
Remote: Yes
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5731
Summary:

A problem with the implementation could make it possible for remote users
to launch remote buffer overflow attacks.

The Heimdal Kerberos Forwarding Daemon does not properly check information
sent from a client to a server for the termination of strings. As this
information is often passed to additional programs that may be executed
with elevated privileges, it could be possible to exploit a buffer
overflow in one of these programs.

This could lead to the execution of arbitrary code with elevated
privileges, and potential compromise of administrative access.

18. Joe Text Editor Backup SetUID Executable Editing Permission Elevation Vulnerability
BugTraq ID: 5732
Remote: No
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5732
Summary:

Joe is a freely available, open source text editor. It is available for
Unix and Linux operating systems.

A problem with Joe could make it possible for local users to gain elevated
privileges.

When joe is used to edit a file, joe automatically creates a backup of the
file with the name filename~ where filename represents the name of the
file being edited.

When joe is used to edit a setuid file, joe automatically creates a copy
of the setuid file. The permissions on the file are preserved with the
exception of ownership. This could result in an arbitrary copy of a
setuid file being created with the permissions of the joe user.

It should be noted that this vulnerability is limited in it's application,
as it would require social engineering, and the editing of a setuid file
by either a privileged user, or a user in a world-writeable directory.

19. Purity Local Buffer Overflow Vulnerabilities
BugTraq ID: 5702
Remote: No
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5702
Summary:

Purity is an automated version of the purity test. It will run on most
Unix and Linux variants and ships with Debian.

Purity is reported to be prone to a number of buffer overflows, making it
possible for local attackers to corrupt memory with attacker-supplied
data. As a result, it is possible for an attacker to execute arbitrary
code. This issue is due to insufficient bounds checking of input supplied
via the command line when the program is invoked.

The game is installed setgid, and successful exploitation of these issues
may allow for elevation of privileges. In most installations the program
is owned by the games group.

20. Enterasys SSR8000 SmartSwitch Port Scan Denial Of Service Vulnerability
BugTraq ID: 5703
Remote: Yes
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5703
Summary:

The SSR8000 is a SmartSwitch distributed and maintained by Enterasys.

A problem with the switch may make it possible for remote users to crash
the system. The problem is in the handling of some types of traffic.

SSR8000 SmartSwitches listen on ports 15077 and 15078 to provide
Multiprotocol Over ATM (MPOA). MPOA is designed to carry IP traffic at
layers two and three over ATM links.

It has been discovered that SSR8000 switches react unpredictably when
portscanned. When these switches are scanned using specific types of TCP
traffic, and scanned on certain ports, the switch becomes unstable. It
has been reported that this can be reproduced consistently to cause the
switch to crash.

This problem could be exploited to cause a denial of service attack.

21. Avaya IP Office Malformed Packets Denial Of Service Vulnerability
BugTraq ID: 5704
Remote: Yes
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5704
Summary:

Avaya IP Office is an IP telephony solution.

A vulnerability has been reported in IP office that may be exploited to
cause a denial of service condition.

Avaya IP Office devices crash when handling malformed packets on the ports
for the user and administrative applications. It has been reported that
this may be exploited by attackers in the local network.

No further details are known.

22. Savant Webserver cgitest.exe Denial Of Service Vulnerability
BugTraq ID: 5706
Remote: Yes
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5706
Summary:

Savant webserver is a free webserver that runs on Windows platforms.

A buffer overflow vulnerability has been reported in the "cgitest.exe"
file, which is inserted by default into the cgi-bin directory.

The cgitest.exe acceptable character limit is 128 bytes, therefore a 136
byte string will overflow the buffer causing the server to crash.

This condition may also potentially be exploited to corrupt memory with
attacker-supplied data, which may result in execution of arbitrary code
with the privileges of the webserver. Though it has been reported that
due to size constraints of the buffer, exploitation to execute arbitrary
code may not be possible.

It should be noted that versions below 3.1 may also be vulnerable to this
issue.

23. Savant Webserver File Disclosure Vulnerability
BugTraq ID: 5709
Remote: Yes
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5709
Summary:

Savant webserver is a free webserver that runs on Windows platforms.

By adding an encoded space (%20) or period (%2e) at the end of a filename
request, it is possible for an attacker to view user folders, which would
otherwise be password protected.

Using this method it is also possible to bypass network class access
limitations set by an administrator, allowing users outside of the
specified class to gain unauthorized access to folders.

As an example, if an administrator restricted access to certain folders to
network class D, it would possible for unauthorized users to bypass this
restriction.

It should be noted that when using space to exploit this issue, a forward
slash (/) must also be appended to the request.

It should also be noted that versions below 3.1 may also be vulnerable to
this issue.

24. Savant Webserver Malformed Content-Length Denial Of Service Vulnerability
BugTraq ID: 5707
Remote: Yes
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5707
Summary:

Savant webserver is a free webserver that runs on Windows platforms.

Savant webserver expects an integer for the client Content-Length value.
Encountering a negative number will result in a denial of service attack.

It should be noted that until the Windows error message produced by this
condition is acknowledged, the service will continue to operate.

It should also be noted that versions below 3.1 may also be vulnerable to
this issue.

25. Mac OS X NetInfo Manager Unauthorized Access Vulnerability
BugTraq ID: 5705
Remote: No
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5705
Summary:

NetInfo Manager is a utility for Mac OS X, distributed and maintained by
Apple.

A problem has been discovered in the NetInfo Manager that could allow a
local user to perform unauthorized actions.

It has been reported that the NetInfo Manager does not sufficiently drop
privileges prior to execution. Because of this, operations carried out
through the program are executed with elevated privileges. Due to
insecure design of the program, this issue could be exploited to abuse
system resources.

This issue is exploited through the "Domain: Print" print dialog. By
exploiting this issue, a user could potentially list root-restricted
directories, or launch a symbolic link attack from a file ending in a
suffix of .pdf.

Although not confirmed, it may also be possible to exploit this issue to
run a copy of Terminal.App as root.

26. BRU XBRU Insecure Temporary File Vulnerability
BugTraq ID: 5708
Remote: No
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5708
Summary:

BRU is a backup and restore utility distributed by The Tolis Group. This
problem affects the utility on the Linux platform.

Under some circumstances, it may be possible for a local user to gain
elevated privileges.

xbru does not properly check for the existence of temporary files prior to
execution. Because of this, it is possible for a local user to create
symbolic links to other files, which will be overwritten by the BRU user.
As BRU is typically run by the root user, this could result in the
overwriting of root-owned files.

It is possible that this vulnerability could be exploited to execute
arbitrary commands. This problem could also be exploited to overwrite
critical system files, such as the passwd file. In this situation, it
would be possible for a local user to gain administrative access if
successfully exploited.

27. Microsoft Windows Encrypted RDP Packet Information Leakage Vulnerability
BugTraq ID: 5711
Remote: Yes
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5711
Summary:

Microsoft Windows Remote Desktop Protocol (RDP) allows for remote display
and input over network connections.

Microsoft Windows Terminal Services encrypted RDP is prone to a weakness
which has the potential to leak information to attackers with the ability
to intercept network traffic.

It is possible to enable encryption for RDP. RDP packets are encrypted
using the RC4 algorithm. An 8 byte HMAC checksum of the packet plaintext
is prepended to each packet. While the key for the RC4 encryption changes
every 4096 packets, the HMAC key remains static for the entire session.
The checksum is derived from packet length, contents and the HMAC key and
is 8 bytes in length. As a result, packets with identical contents will
have the same checksum. If the same packet is sent repeatedly, this has
the potential to leak potentially useful information to attackers who can
intercept the traffic. An attacker may be able to deduce certain things
about the nature of the traffic, such as when certain events occur during
the session.

Any plug-ins which use Microsoft's Terminal Services Virtual Channels are
also affected by this vulnerability.

28. Microsoft Windows RDP Keystroke Injection Vulnerability
BugTraq ID: 5712
Remote: Yes
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5712
Summary:

Microsoft Windows Remote Desktop Protocol (RDP) allows for remote display
and input over network connections.

Microsoft Windows Remote Desktop Protocol (RDP) version 5.0 introduced a
feature which may potentially be abused by remote attackers with the
ability to intercept network traffic.

When common commands and input events are sent during a RDP session, a
checksum is added to each packet. In older versions of RDP, the checksum
is calculated using a unique timestamp, key code and key event type.
This ensured that the checksum for each of these packets was unique.

Version 5.0 of Microsoft Windows RDP introduced support for abbreviating
packets for common commands and input events. As a result, the method
used to calculate the checksum does not use a unique timestamp. This
makes it possible to deduce particular events (such as individual
keystrokes) based on the checksum.

Given the ability to observe network traffic and deduce which events are
occurring, it is possible for an attacker to inject maliciously crafted
packets into a session which may cause certain events to occur.

29. Microsoft Windows XP Professional Remote Desktop Denial Of Service Vulnerability
BugTraq ID: 5713
Remote: Yes
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5713
Summary:

Microsoft Windows XP Professional includes a single-user Remote Desktop
Protocol (RDP) Server, which allows for remote display and input over
network connections.

The Microsoft Windows XP Professional Remote Desktop implementation is
prone to a denial of service.

It is possible for a malicious client to trigger this condition by sending
a maliciously crafted packet to the vulnerable host during the negotiation
of client/server graphics capabilities. Graphic capabilities are
negotiated with PDU Confirm Active packets.

Clients may specify drawing commands based on what is supported. If the
Pattern BLT command is specified in the PDU Confirm Active packet,
Microsoft Windows XP Professional will crash when it tries to render the
pattern. It is possible to custom craft a packet with the Pattern BLT
command toggled, and cause this condition to occur.

The server is exposed to this issue before authentication occurs, when the
login screen is being drawn.

Microsoft Windows XP Professional is only prone to this issue when the
Remote Desktop has been enabled. This issue also exists in Microsoft
Windows .NET Standard Server Beta 3.

III. SECURITYFOCUS NEWS AND COMMENTARY
------------------------------------------
1. Cybersecurity Plan Offends No One
By Kevin Poulsen

The White House's strategy to secure cyberspace adopts a hands-off
approach. Critics say that's not enough.

http://online.securityfocus.com/news/677

2. Flaws in Microsoft VM. Fix now
By John Leyden, The Register

Microsoft has alerted the world+dog to a trio of vulns in its
implementation of Java Virtual Machine. The most serious enables an
attacker to gain "complete control" over a victim's system. So get
patching now.

http://online.securityfocus.com/news/704

3. Linux rootkit hacker suspect arrested in UK
By John Leyden, The Register

A 21-year old from Surbiton, Surrey has been arrested on suspicion of
writing and distributing the T0rn rootkit, which dumbs down the process of
hacking Linux servers.

http://online.securityfocus.com/news/703

4. White House panel's cybersecurity plan avoids calls for new government
rules
By Matthew Fordahl, The Associated Press

A White House panel said Wednesday that the nation should deal with
potential threats to computer security by educating users and by letting
market forces -- not government mandates -- fix problems.

http://online.securityfocus.com/news/670

IV.SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Server Scan 2002
by Security Storm http://www.securitystorm.com
Relevant URL:
http://www.securitystorm.net/products/tools/serverscan/index.asp
Platforms: Windows 2000, Windows 95/98, Windows NT
Summary:

Server Scan is a simple tool for detecting web servers on a network.
Created originally to detect unauthorized web servers on a network, server
scan can serve many purposes from detecting unauthorized web servers to
checking what types of web servers are running on your network. Server
Scan is compatible with Windows 95, Windows 98, Windows Me, Windows NT 4,
Windows 2000, and Windows XP.

2. GFI LANguard Network Security Scanner (N.S.S.) v3.0
by GFI
Relevant URL:
http://www.gfisoftware.com/lannetscan/index.htm
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

GFI LANguard Network Security Scanner (N.S.S.) is a tool that checks your
network for all potential methods that a hacker might use to attack your
network. By analyzing the operating system and the applications running on
your network, GFI LANguard N.S.S. identifies possible security holes in
your network. In other words, it plays the devil's advocate and alerts you
to weaknesses before a hacker can find them, enabling you to deal with
these issues before a hacker can exploit them.

3. archivemail v0.5.1
by Paul Rodger [email protected]
Relevant URL:
http://archivemail.sourceforge.net/
Platforms: POSIX
Summary:

archivemail is a tool written in Python for archiving and compressing old
email in mailboxes. It can move messages older than the specified number
of days to a separate mbox-format mailbox that is compressed with gzip, or
optionally just delete old email. It supports archiving mbox, MH, and
maildir format mailboxes.

4. the Anomy mail sanitizer v1.54
by Juggler
Relevant uRL:
http://mailtools.anomy.net/
Platforms: POSIX
Summary:

The Anomy mail sanitizer is a filter designed to block email-based
security risks, such as trojans and viruses. It can scan an arbitrarily
complex RFC822 or MIME message and remove or rename attachments, truncate
unusually long MIME header fields and sanitize HTML by disabling
Javascript, etc. It uses a single-pass pure Perl MIME parser, which can
make it both more efficient and more precise than other similar programs.
The sanitizer has built-in support for third-party virus scanners.

5. bcrypt v1.1
by johnny
Relevant URL:
http://bcrypt.sourceforge.net/index.html
Platforms: POSIX
Summary:

bcrypt is a blowfish file encryption utility which aims for cross-platform
portability. In addition to providing 448-bit encryption, bcrypt
overwrites input files with random garbage before deletion in order to
make low-level data recovery much more difficult.

6. Demarc PureSecure v1.6
by DEMARC Security
Relevant URL:
http://www.demarc.com/
Platforms: BSDI, FreeBSD, HP-UX, Linux, NetBSD, OpenBSD, Perl (any system
supporting perl), UNIX, Windows 2000, Windows NT, Windows XP
Summary:

Instead of having one program perform file integrity checks, another
program monitoring the connectivity and health of your network, and yet
another monitoring your network for intrusion detection attempts, Demarc
PureSecure combines all these services into one powerful client/server
program. Not only can you monitor the status of the different machines in
your network, but you can also respond to changes in your network all from
one centralized location.

V. SECURITY JOBS SUMMARY
------------------------
1. InfoSec professional seeking job (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292563

2. Corporate Risk Assessment Consultant - OH (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292573

3. Senior Vice President, Strategic Development - #300 - New Jersey (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292568

4. VP of Engineering - #727 - San Mateo, CA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292569

5. Security Position in St. Louis (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292562

6. Salary Cap's PLEASE! (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292593

7. FW: Management Security Consultants based in Germany needed!!!! (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292577

8. FW: Management Security Consultants based in France needed!!!! (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292579

9. Unix System Administrator and former SIGINT-er looking forrelocation (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292565

10. Sr. Net Sec Engineer seeking in FL (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292567

11. Security Architect position in Kansas City (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292572

12. Am I getting the wrong end of the stick????? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292397

13. Washington, DC area security engineer looking for job (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292426

14. Cleared Network Security Analyst to work in Clarendon, VA or Bolling AFB (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292367

15. Cleared Security Database Engineer for Ft. Meade, Maryland (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292308

16. Information System Security Engineer (Orlando, Florida) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292040

17. Looking for Security QA position. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291846

18. Information Security Officer - Risk Managment - EUROPE Based (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/291764

VI. INCIDENTS LIST SUMMARY
-------------------------
1. Linux Slapper Worm and Linksys (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292545

2. Good practicle php attack example (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292476

3. What's on udp/2002 ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292348

4. Thank you all for your responses to "Huge Autoexec.bat" (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292331

5. Huge Autoexec.bat (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292291

6. slaper trafic (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292249

7. Another Nimda attack?? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292342

8. Interesting packets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292116

9. Win2K Advaned Server compromise report available (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292110

10. [unisog] non worm ssl attacks (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292094

11. non worm ssl attacks (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292096

12. Analysis of Modap worm (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292111

13. strange output from chkrootkit (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291790

14. possible ssh hack (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/291796

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Cisco VPN Concentrator 3000 ISAKMP DoS details (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292506

2. dictionary (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292271

3. NetScreen Slipstream (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292240

4. Windows Licensing (was Windows XP Service Pack1 problem withactivation) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292290

5. Windows XP Service Pack1 problem with activation (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292153

6. UPNP protocol problem (was) Windows XP Service Pack1 problem with activation (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292264

7. Any Vulnerability Associated with Sharing single printer? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292234

8. [Full-Disclosure] openssl exploit code (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292493

9. Linux Slapper Worm code (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/291871

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. XP Hardening (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292585

2. win xp sp1 changes ICF settings/rules and/or default behavior for snmp packet processing on udp 162? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292591

3. Hosting multiple sites/ASP.NET security (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292588

4. AW: XP Hardening (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292583

5. AW: Hosting multiple sites/ASP.NET security (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292586

6. Database security (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292535

7. Restricting access to a CD-WR drive on a Win2K Server (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292536

8. 3 Strikes Your Out Password Policy (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292540

9. win xp sp1 changes ICF settings/rules and/or default behavior for snmp packet processing on udp 162? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292544

10. Internet Explorer using LoopBack (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292415

11. Authentication problems using VPN on MS ISA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292380

12. Does W2K hold user's email, EFS etc private key securely ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292390

13. RRAS with PPTP connections security (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292325

14. SecurityFocus Microsoft Newsletter #104 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292228

15. AW: Database security (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292372

16. Remote Shutdown (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292061

17. AW: Suspicious URLScan.log (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/291708

IX. SUN FOCUS LIST SUMMARY
----------------------------
1. Solaris Basic Security Module (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/292154

2. PAM and FTP in Solaris 7 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/292080

3. OpenSSL worm (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/291784

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. route add to block IP's (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/292321

2. OpenSSL worm (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291794

3. Openssh and sendmail signatures (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291787

4. MD5 checksum's for Redhat 7.3 binaries? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291785

XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: SPI Dynamics

Please visit us at: http://www.spidynamics.com/mktg/xss1/

-------------------------------------------------------------------------------