SecurityFocus Newsletter #164

SecurityFocus Newsletter #164
-----------------------------

This Issue Sponsored by: Wiley and Sons

SPECIAL FREE PREVIEW OF NEW KEVIN MITNICK BOOK

See what Publishers Weekly called a "tour de force, a series of tales of
how some old-fashioned blarney and high-tech skills can pry any
information from anyone..." For more information and how to order "The Art
of Deception : Controlling the Human Element of Security", visit

Please visit us at:

http://search.barnesandnoble.com/booksearch/isbnInquiry.asp?userid=5OZAUOSEB
Z&isbn=0471237124&displayonly=excerpt

-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Remote Management of Win2K Servers: Three Secure Solutions
     2. Shredding the Paper Tiger of Cyberterrorism
     3. SecurityFocus DPP Program
     4. IIR's 3G Fraud & Security Forum
II. BUGTRAQ SUMMARY
     1. Rudi Benkovic JAWMail Script Injection Vulnerability
     2. Microsoft Virtual Machine Unauthorized ODBC Data Access...
     3. HP WEBES Service Tools Compaq Analyze Unauthorized File Access...
     4. Null HTTPd Remote Heap Overflow Vulnerability
     5. Microsoft Internet Explorer SSL Certificate Expiration...
     6. phpWebsite PHP File Include Vulnerability
     7. Eric Prevoteau DCTC NULL Byte Denial Of Service Vulnerability
     8. Dino's Webserver File Disclosure Vulnerability
     9. HP Compaq Insight Manager Web Interface Cross-Site Scripting...
     11. XOOPS HTML Injection Vulnerability
     12. Apache Tomcat DefaultServlet File Disclosure Vulnerability
     13. HP Procurve 4000M Switch Device Reset Denial Of Service...
     14. Apache Oversized STDERR Buffer Denial Of Service Vulnerability
     15. PHPNuke Search Form Cross-Site Scripting Vulnerability
     16. Invision Board PHPINFO.PHP Information Disclosure Vulnerability
     17. OpenVMS UCX POP Server Arbitrary File Modification Vulnerability
     18. HP VirtualVault Apache mod_ssl Denial Of Service Vulnerability
     19. Monkey HTTP Server File Disclosure Vulnerability.
     20. NullLogic Null Webmail Format String Vulnerability
     21. ACWeb Cross-Site Scripting Vulnerability
     22. Shana Informed Information Disclosure Vulnerability
     23. PHPNuke Modules.PHP SQL Injection Vulnerability
     24. PHPNuke News Message HTML Injection Vulnerability
     25. NPDS News Message HTML Injection Vulnerability
     26. DaCode News Message HTML Injection Vulnerability
     27. Drupal News Message HTML Injection Vulnerability
     28. PHPWebSite News Message HTML Injection Vulnerability
     29. Microsoft FrontPage Server Extensions SmartHTML Buffer...
     30. Zope Incorrect XML-RPC Request Information Disclosure...
     31. MDG Web Server 4D Insecure Credential Storage Vulnerability
     32. Microsoft PPTP Server Buffer Overflow Vulnerability
     33. Interbase GDS_Lock_MGR UMask File Permission Changing...
     34. GV Malformed File Local Buffer Overflow Vulnerability
     35. PostNuke Remote SQL Injection Vulnerability
     36. PostNuke Modules.PHP Cross Site Scripting Vulnerability
     37. Multiple OpenVMS WASD HTTP Server Vulnerabilities
     38. WatchGuard Firebox VClass CLI Interface Format String...
     39. WatchGuard Firebox VClass CLI Interface Improperly Terminated...
     40. Apache 2 mod_dav Denial Of Service Vulnerability
     41. Zope ZCatalog Plug-In Remote Method Vulnerability
     42. Zope Through The Web Code Remote Denial Of Service Vulnerability
     43. Citrix MetaFrame Client-Specified Published Applications...
     44. VBulletin Calendar.PHP Command Execution Vulnerability
     45. BEA WebLogic Server and Express HTTP Response Information...
III. SECURITYFOCUS NEWS ARTICLES
     1. 'T0rn' Arrest Alarms White Hats, Advocates
     2. Secret Service agents probe wireless networks in Washington
     3. FTC pens Dewie the Turtle to promote Internet safety
     4. China implicated in Dalai Lama hack plot
IV.SECURITYFOCUS TOP 6 TOOLS
     1. PASP vRC-1b
     2. C++ Elliptic Curve Cryptography library v0.1.0
     3. Logrep v1.12
     4. Netfilter logs analyzer v0.1
     5. ipkungfu v0.1
     6. bogofilter v0.7.4
V. SECURITYJOBS LIST SUMMARY
     1. Job *Offered* : Firewall And VPN Developers Wanted. (SF Bay...
     2. Network Security Support Engineer  Position In Southern Cal...
     3. Desired- Position- Network Security or Engineering in SPAIN...
     4. Addendum - Ohio Security Infrastructure Manager - Cincinatti...
     5. CISSP / Security Analyst looking for oppty in DC Metro Area...
     6. Network Security Position in Norther Virginia (Thread)
     7. Dead Threads (Thread)
     8. Director of Security (California) (Thread)
     9. Southern California Resume (Thread)
     10. Information Security Senior Project Consultant - #701 - ...
     11. IT Security Architect / IT Security Consultant - London UK...
     12. Technical Support Opportunity at Entercept Security...
     13. NJ area Security Technician (Thread)
     14. Tivoli SecureWay - Security Consultant - Middle East (Thread)
     15. Salary Ranges and Posting:  From a  Corporate Tech Recruiter...
     16. Salary ranges for InfoSec professionals (was Salary Cap's...
     17. Opportunity at Entercept Security Technologies (Thread)
     18. Senior Information Risk Consultant / Security Consultant...
     19. Need job in FL (Thread)
     20. Resume - (BS in MIS/CCNP/CSS1) seeking position in Florida...
     21. Salary Cap's PLEASE! (Thread)
     22. Senior Information Security Analyst - IN - $70k-$80k (Thread)
     23. Corporate Risk Assessment Consultant(s) - OH - $85k-$95k...
VI. INCIDENTS LIST SUMMARY
     1. Unusual volume: UDP:137 probes (Thread)
     2. AIM-based worm? (Thread)
     3. E-Card Remote Code Execution Scam (Thread)
     4. Snake in the grass (Thread)
     5. VS: slapper worm varient "cinik" (Thread)
     6. Modap Worm Infection and Subsequent Scanning (Thread)
     7. new IIS worm? (rcp lsass.exe) (Thread)
     8. slapper worm varient "cinik" (Thread)
     9. Port 11890 (Thread)
     10. New worm? (Thread)
     11. Slapper worm DoS (Thread)
     12. Analysis of Modap worm (Thread)
     13. "Worm riders" on 4156? (Thread)
     14. New variants of Slapper worm using UDP ports other than 2002...
VII. VULN-DEV RESEARCH LIST SUMMARY
     1. Need help analyzing apache-scalp code (Thread)
     2. Microsoft FrontPage Server Extensions SmartHTML Buffer Overflow...
     3. Shell code -RVA techniques or something similar (Thread)
     4. DHCP mitm clarification (Thread)
     5. RES: OpenSSL Vulnerability and OpenSSH (Thread)
     6. R: OpenSSL Vulnerability and OpenSSH (Thread)
     7. OpenSSL Vulnerability and OpenSSH (Thread)
     8. DHCP man in the middle attack (Thread)
     9. ToorCon 2002 This Weekend (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
     1. Why does W2k allow blank passwords even with GPO configured?...
     2. win xp sp1 changes ICF settings/rules and/or default behavior...
     3. I'm falling my hairs with this domain gpo problem (Thread)
     4. SecurityFocus Microsoft Newsletter #105 (Thread)
     5. FW: Hosting multiple sites/ASP.NET security (Thread)
     6. FW: I'm falling my hairs with this domain gpo problem (Thread)
IX. SUN FOCUS LIST SUMMARY
     1. how to have syslogd not replay kernel ring buffer at startup...
X. LINUX FOCUS LIST SUMMARY
     1. openssl (Thread)
XI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Remote Management of Win2K Servers: Three Secure Solutions
By Mark Burnett

Remote management of servers presents several problems, the most obvious
being that the traffic between the administrator and the server is
travelling across the public Internet, available for others to sniff. This
article will discuss three methods to make the remote management of Win2K
servers more secure.

http://online.securityfocus.com/infocus/1629

2. Shredding the Paper Tiger of Cyberterrorism
By Richard Forno

Government appointees and politicos should stop spreading fear,
uncertainty, and doubt with empty threats of cyberterrorism and focus on
the real issues surrounding information security.

http://online.securityfocus.com/columnists/111

3. SecurityFocus DPP Program

Attention Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

4. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space.  This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud?  We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud


II. BUGTRAQ SUMMARY
-------------------
1. Rudi Benkovic JAWMail Script Injection Vulnerability
BugTraq ID: 5771
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5771
Summary:

JAWMail is a freely available, open source web-based mail software package
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with JAWMail could make it possible to execute arbitrary script
code in a vulnerable client.

JAWMail does not sufficiently filter malicious HTML code from e-mails. As
a result, when a user opens an email in JAWMail that contains malicious
HTML code, the code contained in the mail would be executed in the browser
of the mail user.

This could allow an attacker to send malicious javascript or HTML to an
unsuspecting user of JAWMail, which would be executed in the security
context of the site hosting JAWMail.

Attackers may potentially exploit this issue to hijack web content or to
steal cookie-based authentication credentials. It may be possible to take
arbitrary actions as the victim user.

This vulnerability was reported for JAWMail 1.0-rc1. It is not known
whether other versions are affected.

2. Microsoft Virtual Machine Unauthorized ODBC Data Access Vulnerability
BugTraq ID: 5772
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5772
Summary:

Microsoft Virtual Machine contains Java Database Classes (JDBC) and
support for the use of XML by Java applications.

A vulnerability has been reported in a Java class that provides ODBC (Open
Data Base Connectivity) support. Reportedly, due to errors in security
checking code, it is possible for an attacker to obtain unauthorized
access to ODBC data sources of a victim system.

The java class, com.ms.jdbc.odbc.JdbcOdbcDriver does not provide adequate
security checks. To make an ODBC connection, the method connect() is used
to verify that a calling applet is trusted. An applet is established as a
legitimate source by the trusted() method which is invoked by connect().
Due to errors in the trusted() method, any calling applet is always
considered to be legitimate and is allowed access to ODBC data sources.

An attacker that knows the names of ODBC data sources residing on a victim
system will have access to those data sources. It may be possible for an
attacker to make modifications to the ODBC data sources that may have
serious security implications. It should also be noted that ODBC data
sources may also require further authentication and thus an attacker would
need to make efforts to obtain further access to such data sources.

3. HP WEBES Service Tools Compaq Analyze Unauthorized File Access
Vulnerability
BugTraq ID: 5773
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5773
Summary:

HP WEBES Service Tools Compaq Analyze is a set of hardware diagnostic
tools available for a number of platforms including OpenVMS, Windows NT,
and Tru64 UNIX.

HP has reported that WEBES Service Tools Compaq Analyze is prone to an
issue which may allow unauthorized file access.  It may be possible for
remote attackers to exploit this issue through the user web interface.

Further details have not been disclosed.  If further details become
available, they will be added to this entry.

4. Null HTTPd Remote Heap Overflow Vulnerability
BugTraq ID: 5774
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5774
Summary:

Null httpd is a small multithreaded web server for Linux and Windows,
mantained by NullLogic.

A remotely exploitable heap overflow has been discovered in Null httpd.
The ReadPOSTData() function allocates in_ContentLength+1024 for the
servers recv buffer. It is possible to pass a negative value to
'in_ContentLength', which is a signed integer, due to insufficient content
validation.

A negative in_ContentLength will result in the allocation of a buffer less
then 1024 bytes in size. The server then attempts to read 1024 bytes from
the network socket, resulting in an overflow.

An attacker may exploit this condition to overwrite arbitrary words in
memory through the free() function.  This may allow for the execution of
arbitrary code.

It should be noted that although reported on v0.5.0, earlier versions are
likely vulnerable.

5. Microsoft Internet Explorer SSL Certificate Expiration Vulnerability
BugTraq ID: 5778
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5778
Summary:

A security weakness has been reported in the PKI implementation used by
Microsoft Internet Explorer for SSL.  According to the report, the browser
does not warn the user if the root CA certificate is expired.  This occurs
when the browser has a "newer" version of the CA certificate in its store.

If the CA certificate in the certificate chain is expired, the chain
should be considered "invalid" and the user should be warned.  It appears
that Microsoft Internet Explorer will use a newer certificate if the
public key and issuer is the same without user knowledge.  This is not
correct behaviour and should be considered a theoretical weakness in the
underlying PKI/SSL implementation.

It should be noted that this vulnerability may lie in the operating system
rather than Explorer.  If this is the case, other applications may be
affected.  Version 6.0SP1 was reported vulnerable.  It is likely that
prior releases are as well.

6. phpWebsite PHP File Include Vulnerability
BugTraq ID: 5779
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5779
Summary:

phpWebSite is a website content management system written in PHP.

A vulnerability has been discovered in phpWebsite which allows an attacker
to remotely include a malicious PHP file. It is possible for an attacker
to specify a remote location for phpWebsite to download an
attacker-supplied htmlheader.php script.

This issue occurs because modsecurity.php makes a call to include the
htmlheader.php script. Since attackers are able to influence the variable
used for the location of htmlheader.php, it is possible to force
modsecurity.php to include an arbitrary file.

This issue could be exploited to execute arbitrary commands within the
context of the webserver process.

7. Eric Prevoteau DCTC NULL Byte Denial Of Service Vulnerability
BugTraq ID: 5781
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5781
Summary:

DCTC (Direct Connect Text Clone) is a text based interface to the Direct
Connect network for Linux operating environments.

A vulnerability has been reported for DCTC 0.83.3 that results in the
client crashing. This vulnerability occurs due to inadequate checks when
processing requests.

The DCTC client will crash if it receives a string that contains a NULL
byte. When the client attempts to parse the string, it results in the DCTC
client crashing thereby leading to a denial of service condition.

The vulnerability occurs in the file, dc_manage.c.

This vulnerability is no longer present in DCTC 0.83.4.

8. Dino's Webserver File Disclosure Vulnerability
BugTraq ID: 5782
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5782
Summary:

Dino's Webserver is a small web server designed for personal use,
maintained by FunSoft. It is available for Microsoft Windows based
machines.

A directory traversal bug exists in Dino's Webserver.

By appending encoded dot-dot-slash sequences (..%2f) in a request to the
web server, it is possible to access arbitrary web server readable files.

This is due to the server insufficiently validating the user supplied
input.

Successful exploitation has the potential to disclose sensitive
information which may be used in further attacks. The webserver will
typically run in the SYSTEM context.  This issue is a variant of the
vulnerability described in Bugtraq ID 3861.

9. HP Compaq Insight Manager Web Interface Cross-Site Scripting
Vulnerability
BugTraq ID: 5780
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5780
Summary:

It has been reported that Compaq Insight Manager web interface is prone to
cross-site scripting attacks.

It is possible to construct a malicious link to a Compaq Insight Manager
web interface that includes arbitrary script code.  When the link is
visited with a web client, the script code will execute in the context of
the Compaq Insight Manager web interface.

This may allow for theft of cookie-based authentication credentials and
other attacks.

The component which appears to be affected is Compaq Insight Management
Agents.  However, further details about which software is vulnerable are
not available.  The vulnerability was discovered in an automated scan.

10. Trillian AIM Remote Denial Of Service Attack
BugTraq ID: 5783
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5783
Summary:

Trillian is an instant messaging client that supports a number of
protocols (including IRC, ICQ, MSN). It is available for Microsoft Windows
systems.

A vulnerability has been reported for Trillian. Reportedly, Trillian is
prone to a denial of service condition when processing malicously
constructed AIM messages.

Due to improper HTML/XML parsing, it is possible to dereference a bad
pointer in Trillian, by including '< >' or '> <' (bracket, space, bracket)
in an AOL message. This will cause the client to crash.

It should be noted that this issue has varying effects on vulnerable
clients.

11. XOOPS HTML Injection Vulnerability
BugTraq ID: 5785
Remote: Yes
Date Published: Sep 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5785
Summary:

XOOPS is a freely available, open source portal script software package
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with XOOPS could make it possible for an attacker to inject
arbitrary HTML in XOOPS messages.

XOOPS does not sufficiently filter potentially malicious HTML code from
posted messages. As a result, when a user chooses to view a message
posting that contains malicious HTML code, the code contained in the
message would be executed in the browser of the vulnerable user. This will
occur in the context of the site hosting the XOOPS software.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for XOOPS 1.0-rc3. It is not known whether
other versions are affected.

12. Apache Tomcat DefaultServlet File Disclosure Vulnerability
BugTraq ID: 5786
Remote: Yes
Date Published: Sep 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5786
Summary:

Tomcat is a popular web server and JSP/Servlet container that is developed
by Apache as part of the Jakarta project.

The servlet "org.apache.catalina.servlets.DefaultServlet" is included with
Tomcat by default.  A file disclosure vulnerability has been reported in
DefaultServlet.  An attacker may cause the contents of "target.jsp" to be
output by making a request for the servlet in the following format:

http://target/servlets/org.apache.catalina.servlets.DefaultServlet/target.jsp

Attackers may exploit this vulnerability to view the contents of arbitrary
files within the webroot.  This includes JSP source code which may contain
sensitive data such as database usernames and passwords.

13. HP Procurve 4000M Switch Device Reset Denial Of Service Vulnerability
BugTraq ID: 5784
Remote: Yes
Date Published: Sep 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5784
Summary:

The HP Procurve 4000M is a extremely common, managed switch, which
provides scalable ethernet switching. When multiple Procurve switches are
used interconnected, it is common practice for an administrator to enable
a feature allowing each switch to be viewed through a single interface,
accessible via the web.

It has been reported that HP Procurve Switches are vulnerable to a denial
of service attack due to a flaw discovered in the remote interface. It is
possible for an attacker to reset member switches by issuing a device
reset command to a vulnerable device. Devices can be reset with the
following request:

http://<IP ADDRESS>/sw2/cgi/device_reset?

Vulnerable devices do not require authentication before accepting this
command. Multiple device reset commands could result in a complete denial
of service of all interconnected switches.

It should be noted that the web interface is not enabled by default.

14. Apache Oversized STDERR Buffer Denial Of Service Vulnerability
BugTraq ID: 5787
Remote: Yes
Date Published: Sep 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5787
Summary:

Apache is an freely available, open-source webserver.  It runs on a number
of operating systems including Unix and Linux variants and Microsoft
Windows.

Apache is prone to a denial of service condition when an excessive amount
of data is written to stderr.  This condition reportedly occurs when the
amount of data written to stderr is over the default amount allowed by the
operating system.  When the condition is triggered, the webserver will
hang, resulting in a denial of service.  To regain service, the webserver
process must be restarted.

This may potentially be an issue in web applications that write
user-supplied data to stderr.  Additionally, locally based attackers may
exploit this issue.

This issue has been confirmed in Apache 2.0.39/2.0.40 on Linux operating
systems.  Apache on other platforms may also be affected.  This issue does
not appear to be present in versions prior to 2.0.x.

15. PHPNuke Search Form Cross-Site Scripting Vulnerability
BugTraq ID: 5788
Remote: Yes
Date Published: Sep 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5788
Summary:

PHPNuke is a website creation/maintenance tool.

PHPNuke 6.0 is prone to cross-site scripting attacks.

HTML tags are not filtered from links to the 'modules.php' script.

Reportedly, the problem lies in the 'Search' page of the 'modules.php'
script. It is possible for a malicious attacker to submit a search string
that contains HTML code. The value of this search string is not sanitized
before it is included in PHP generated HTML and output to the client.

As a result, it is possible to create a link to this page on a PHPNuke
site, which contains malicious script code. When the link is clicked by an
unsuspecting web user, the malicious script code will be executed on the
user in the context of the site running PHPNuke.

This attack may be used to steal a user's cookie-based authentication
credentials for the vulnerable PHPNuke site.

16. Invision Board PHPINFO.PHP Information Disclosure Vulnerability
BugTraq ID: 5789
Remote: Yes
Date Published: Sep 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5789
Summary:

Invision Board is web forum software implemented in PHP.

Invision Board, in the suggestion installation, may disclose sensitive
information to remote attackers.

The suggested installation procedure suggests that users include the
'phpinfo.php' script.  This script provides information about the
environment that the software is running in.

If remote attackers access this script, this may disclose sensitive
information which may assist in further attacks.  Information disclosed by
this script includes information about the webserver version and
configuration.

The 'phpinfo.php' script would typically be used for debugging and should
not be left exposed to arbitrary web users.

17. OpenVMS UCX POP Server Arbitrary File Modification Vulnerability
BugTraq ID: 5790
Remote: No
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5790
Summary:

OpenVMS is a mainframe-like Operating System originally developed by
Digital. It is maintained and distributed by Compaq.

An issue with the UCX POP (Post Office Protocol) server used by OpenVMS
has been reported. It is possible for a malicous local user to overwrite
arbitrary files on the filesystem by exploiting a vulnerability in the UCX
POP server.

The vulnerability is the result of the default permissions of the UCX POP
server. Reportedly, the POP server is installed with SYSPRV and BYPASS
privileges. This allows it to have system-level privileges and also allows
it to bypass any file permission restrictions.

A local attacker can exploit this vulnerability by calling the UCX POP
server with the '-logfile' commandline option and causing the POP server
to create a log file anywhere on the filesystem. The attacker can easily
specify critical system files as the POP server's log file and cause those
files to be overwritten. This could result in a denial of service, or
potential loss of data.

18. HP VirtualVault Apache mod_ssl Denial Of Service Vulnerability
BugTraq ID: 5791
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5791
Summary:

Mod_SSL is the implementation of SSL (Secure Socket Layer) for the Apache
webserver.

It has been reported that the mod_ssl module for Apache Web Server on HP
VirtualVault systems is prone to a denial of service condition. The
vulnerability occurs due to the processing of SSL requests by the module.

Reportedly, when mod_ssl processes an SSL request, it will cause the
Apache web server to drop the connection resulting in the denial of
service.

Further details of this vulnerability are not known at this time.

19. Monkey HTTP Server File Disclosure Vulnerability.
BugTraq ID: 5792
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5792
Summary:

Monkey is an open source Web server written in C, based on the HTTP/1.1
protocol. It is available for the Linux platform.

A directory traversal bug has been discovered in Monkey HTTP server.

It is possible for an attacker to bypass Monkeys input validation by
constructing a request containing an extra slash, appended with a typical
directory traversal string containing "dot-dot-slash" sequences (../).

For example:

http://vulnerable.com//../../../sensitive/file

By exploiting this issue an attacker can potentially break out of the web
root and gain access to arbitrary web server readable files.

20. NullLogic Null Webmail Format String Vulnerability
BugTraq ID: 5794
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5794
Summary:

Null Webmail is a small web-based email system designed for use with Linux
and Unix variant operating environments.

A format string vulnerability has been reported for Null Webmail 0.6.4.
Allegedly, there exists errors in the file 'wmserver.c'. Specifically,
this issue is known to exist in the wmprintf() function.

This may allegedly allow an attacker to supply Null Webmail with
maliciously constructed format strings which may cause memory to be
corrupted with attacker-supplied data.  The consequence of successful
exploitation may result in arbitrary code execution with the privileges of
the server.

The possibility of arbitrary code execution has not been confirmed.

This vulnerability has been reported for Null Webmail 0.6.4. It is not
known whether other versions are affected.

21. ACWeb Cross-Site Scripting Vulnerability
BugTraq ID: 5793
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5793
Summary:

acWEB is an open-source HTTP server intended for use on Microsoft Windows
operating systems.

acWEB is prone to cross-site scripting attacks.  It is possible to
construct a malicious link to the web server which contains arbitrary
script code.  When the link is visited, the script code will be executed
in the web client of the user visiting the link.  The code will be
executed in the context of the webserver.

This issue may potentially be exploited to steal cookie-based
authentication credentials for sites hosted by the webserver.  Other
attacks are also possible.

22. Shana Informed Information Disclosure Vulnerability
BugTraq ID: 5795
Remote: No
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5795
Summary:

Informed is an eForm management package, maintained by Shana Corporation.

An information disclosure issue has been discovered in the way Informed
pads encrypted documents.

When encrypted documents which are saved from Inform begin to expand in
size, the file saving functions fail to properly check whether or not hard
disk blocks contain "zeroed out" data or not. While expanding, under some
circumstances, the file may expand over and capture information stored in
blocks containing data.

By opening the encrypted document with a text/hex editor, it is possible
view the captured data in clear text. This data may hold sensitive data
from the encrypted form, or arbitrary files on the system.

It should be noted that documents created under on the Windows XP platform
are not vulnerable to this issue.

23. PHPNuke Modules.PHP SQL Injection Vulnerability
BugTraq ID: 5799
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5799
Summary:

PHPNuke is a web based Portal system. Implemented in PHP, it is available
for a range of systems, including Microsoft Windows and Linux.

A SQL injection vulnerability has been discovered in all versions of
PHPNuke.

Due to insufficient sanitization of variables used to construct SQL
queries in the 'modules.php' script. It is possible to modify the logic of
SQL queries through malformed query strings in requests for the vulnerable
script.

By injecting SQL code into variables, it may be possible for an attacker
to cause a denial of service or corrupt database information.

This issue was reported in PHPNuke version 6.0. Other versions may also be
affected.

24. PHPNuke News Message HTML Injection Vulnerability
BugTraq ID: 5796
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5796
Summary:

PHPNuke is a freely available, open source content management system
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with PHPNuke could make it possible for an attacker to inject
arbitrary HTML in PHPNuke news posts.

PHPNuke does not sufficiently filter potentially malicious HTML code from
news posts. As a result, when a user chooses to view a news posting that
contains malicious HTML code, the code contained in the posted message
would be executed in the browser of the vulnerable user. This will occur
in the context of the site hosting the PHPNuke software. It should be
noted that administrative approval may be required before news posts are
actually displayed on the vulnerable site. If this is the case and a post
requires approval through a Web-based interface, then an administrator of
the vulnerable site may be the intended target of attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for PHPNuke 6.0. It is not known whether
other versions are affected.

25. NPDS News Message HTML Injection Vulnerability
BugTraq ID: 5797
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5797
Summary:

NPDS (Nuke Permanent Double-Side Portal System)  is a freely available,
open source content management system implemented in PHP. It is available
for the Unix, Linux, and Microsoft operating environments.

Problems with NPDS could make it possible for an attacker to inject
arbitrary HTML in NPDS news posts.

NPDS does not sufficiently filter potentially malicious HTML code from
news posts. As a result, when a user chooses to view a news posting that
contains malicious HTML code, the code contained in the posted message
would be executed in the browser of the vulnerable user. This will occur
in the context of the site hosting the NPDS software. It should be noted
that administrative approval may be required before news posts are
actually displayed on the vulnerable site. If this is the case and a post
requires approval through a Web-based interface, then an administrator of
the vulnerable site may be the intended target of attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for NPDS 4.8. It is not known whether
other versions are affected.

26. DaCode News Message HTML Injection Vulnerability
BugTraq ID: 5798
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5798
Summary:

DaCode is a freely available, open source content management system
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with DaCode could make it possible for an attacker to inject
arbitrary HTML in DaCode news posts.

DaCode does not sufficiently filter potentially malicious HTML code from
news posts. As a result, when a user chooses to view a news posting that
contains malicious HTML code, the code contained in the posted message
would be executed in the browser of the vulnerable user. This will occur
in the context of the site hosting the DaCode software. It should be noted
that administrative approval may be required before news posts are
actually displayed on the vulnerable site. If this is the case and a post
requires approval through a Web-based interface, then an administrator of
the vulnerable site may be the intended target of attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for DaCode 1.2.0. It is not known whether
other versions are affected.

27. Drupal News Message HTML Injection Vulnerability
BugTraq ID: 5801
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5801
Summary:

Drupal is a freely available, open source content management system
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with Drupal could make it possible for an attacker to inject
arbitrary HTML in Drupal news posts.

Drupal does not sufficiently filter potentially malicious HTML code from
news posts. As a result, when a user chooses to view a news posting that
contains malicious HTML code, the code contained in the posted message
would be executed in the browser of the vulnerable user. This will occur
in the context of the site hosting the Drupal software. It should be noted
that administrative approval may be required before news posts are
actually displayed on the vulnerable site. If this is the case and a post
requires approval through a Web-based interface, then an administrator of
the vulnerable site may be the intended target of attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for Drupal 4.0.0. It is not known whether
other versions are affected.

28. PHPWebSite News Message HTML Injection Vulnerability
BugTraq ID: 5802
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5802
Summary:

phpWebSite is a freely available, open source portal content management
system implemented in PHP. It is available for the Unix, Linux, and
Microsoft operating environments.

Problems with phpWebSite could make it possible for an attacker to inject
arbitrary HTML in phpWebSite news posts.

phpWebSite does not sufficiently filter potentially malicious HTML code
from news posts. As a result, when a user chooses to view a news posting
that contains malicious HTML code, the code contained in the posted
message would be executed in the browser of the vulnerable user. This will
occur in the context of the site hosting the phpWebSite software. It
should be noted that administrative approval may be required before news
posts are actually displayed on the vulnerable site. If this is the case
and a post requires approval through a Web-based interface, then an
administrator of the vulnerable site may be the intended target of
attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for phpWebSite 0.8.3. It is not known
whether other versions are affected.

29. Microsoft FrontPage Server Extensions SmartHTML Buffer Overflow
Vulnerabili$
BugTraq ID: 5804
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5804
Summary:

Microsoft FrontPage Server Extensions is a feature included by default
with Internet Information Server 4.0, 5.0 and 5.1.  A vulnerability has
been reported in the SmartHTML (shtml.dll) interpreter component of
FrontPage Server Extensions.

According to Microsoft, the issue is related to handling of certain
requests for a specific type of file.  In FrontPage Server Extensions
2000, the vulnerability is only exploitable as a denial of service.  It is
possible to cause consumption of CPU due to an infinite loop condition.
This may adversely affect the server ability to perform other functions.

On vulnerable FrontPage Server Extensions 2002 installations, remote
attackers may exploit this vulnerability to execute arbitrary code on
target hosts.  This is due to it being a buffer overflow condition.

30. Zope Incorrect XML-RPC Request Information Disclosure Vulnerability
BugTraq ID: 5806
Remote: Yes
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5806
Summary:

Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.

A vulnerability has been reported for Zope 2.5.1 and earlier. Reportedly,
Zope does not handle XML-RPC requests properly. Specially crafted XML-RPC
requests may cause Zope to respond to a request with an error page with
system specific details.

An attacker can exploit this vulnerability by making a special XML-RPC
request to the Zope server. Zope will fail when attempting to process this
request and will divulge sensitive information to the attacker.

It has also been reported that this vulnerability exists even when
starting Zope without the '-D' option.

This could result in information disclosure, and could potentially be used
to gain intelligence in launching an attack against a system.

31. MDG Web Server 4D Insecure Credential Storage Vulnerability
BugTraq ID: 5803
Remote: No
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5803
Summary:

MDG Web Server 4D is a HTTP Server implemented on top of the 4th Dimension
relational database. It runs on Microsoft Windows and other operating
systems.

Web Server 4D is reported to store various types of credentials for
optional modules in plaintext on the local filesystem.  Local attackers
who can read the file containing the credentials may then use the
credentials to gain access to other types of sensitive information or
perform unauthorized actions.

Authentication credentials for the modules are stored in the 'Ws4d.4DD'
file in the Web Server 4D directory.  These credentials will allow
unauthorized access to Storefronts, the Console, and the WebServer.
Database administration credentials are also stored in plaintext.

This issue has been reported in Web Server 4D 3.6.  Other versions may
also be affected.

32. Microsoft PPTP Server Buffer Overflow Vulnerability
BugTraq ID: 5807
Remote: Yes
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5807
Summary:

A buffer overflow vulnerability has been reported for Microsoft's PPTP
(Point to Point Tunneling Protocol) implementation. The vulnerability
reportedly exists in both the PPTP server and client applications. The
PPTP service listens to traffic on TCP port 1973.

Reportedly it is possible to exploit the buffer overflow condition prior
to authentication. A remote attacker who sends a specially crafted PPTP
packet to a vulnerable system may be able to cause the application to
corrupt kernel memory.

It is also possible for an attacker to include malicious shell code and
have it execute with the privileges of the PPTP process.

This vulnerability has been reported for PPTP implementations in Microsoft
Windows 2000 and Windows XP operating systems.

33. Interbase GDS_Lock_MGR UMask File Permission Changing Vulnerability
BugTraq ID: 5805
Remote: No
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5805
Summary:

Interbase is a SQL database distributed and maintained by Borland.  It is
available for Unix and Linux operating systems.

A problem with Interbase may make it possible for a local user to gain
elevated privileges.

The gds_lock_mgr program within Interbase is typically installed setuid.
This program does not properly handle user-supplied umasks, and may allow
the creation of files with insecure permissions as a privileged user.

When executed, the gds_lock_mgr program creates a predictable temporary
file.  Combined with the flaw in the umask handling, a user can execute a
symbolic link attack to create an arbitrary file with insecure permissions
as a privileged user.  This could result in the user gaining elevated
privileges.

34. GV Malformed File Local Buffer Overflow Vulnerability
BugTraq ID: 5808
Remote: No
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5808
Summary:

gv is a freely available, open source Portable Document Format (PDF) and
PostScript (PS) viewing utility.  It is available for Unix and Linux
operating systems.

A problem with gv could make it possible for an attacker to execute
arbitrary code in the security context of a local user.

It has been reported that an insecure sscanf() function exists in gv.
Due to this function, an attacker may be able to put malicious code in the
%%PageOrder: portion of a file.  When this malicious file is opened with
gv, the code would be executed in the security context of the local user.

It should be noted that this vulnerability may also affect other packages.
As gv is originally derived from the 1.5 release of GhostView, this
vulnerability may affect GhostView releases also.

35. PostNuke Remote SQL Injection Vulnerability
BugTraq ID: 5810
Remote: Yes
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5810
Summary:

PostNuke is a weblog/Content Management System (CMS). It is available on
both Windows and Unix platforms.

A SQL injection vulnerability has been discovered in all versions of
PHPNuke.

Due to insufficient sanitization of variables used to construct SQL
queries. It is possible to modify the logic of SQL queries through
malformed query strings in requests for vulnerable PostNuke scripts.

By injecting SQL code into variables, it may be possible for an attacker
to cause a denial of service or corrupt database information.

36. PostNuke Modules.PHP Cross Site Scripting Vulnerability
BugTraq ID: 5809
Remote: Yes
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5809
Summary:

PostNuke is a content management system originally forked from the
PHP-Nuke project. It is implemented in PHP, and available for Windows,
Linux and other Unix based systems.

A cross site scripting vulnerability has been reported for PostNuke.

An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link. Attacker-supplied HTML and script code may be
executed on a web client in the context of the site hosting the webmail
system.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

37. Multiple OpenVMS WASD HTTP Server Vulnerabilities
BugTraq ID: 5811
Remote: Yes
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5811
Summary:

Multiple vulnerabilities have been reported in WASD HTTP Server for
OpenVMS.  The consequences of successful exploitation of these issues may
range from information disclosure to varing degrees of remote compromise.
Many of these problems are the result of a few core issues in the default
configuration of the server.

The following issues were reported:

Weaknesses in default components which may lead to disclosure of arbitrary
webserver readable files.  This may disclose sensitive information that
may be useful in further attacks.  It has been reported that it is
possible to exploit these file disclosure issues to disclose some OpenVMS
system files.  User home directories may also be disclosed.

Sensitive files are contained in the webserver root by default.  This may
allow remote attackers to gain access to information which may be useful
in mounting further attacks.

Trivial bypassing of server access control lists may allow for
unauthorized remote access to occur.  Exploitation of this and the other
issues may cause configuration information and webserver logs to be
disclosed to remote attackers.

A path disclosure vulnerability may expose the location of the server
document root directory to remote attackers.

Some restricted directories employ an additional layer of directory
protection which may also be trivially bypassed.

A number of CGI scripts that ship with the server are enabled by default,
some of which are reported to contain serious vulnerabilities.
Additionally, information may be disclosed in some of the default
components (such as cgi_process.com) which may aid in further attacks.
Attackers may also gain a full listing of CGI scripts on the server.
Script source code may also be disclosed.

A potential denial of service condition has been reported in the print.com
service.

Exploitation of these issues in tandem is reported to yield unauthorized
system level access to a vulnerable host.

** When analysis of these issues is complete, each unique issue which be
given an individual Bugtraq ID.

38. WatchGuard Firebox VClass CLI Interface Format String Vulnerability
BugTraq ID: 5814
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5814
Summary:

Firebox is the firewall solution designed and distributed by WatchGuard.
Firebox is designed as an enterprise level firewall with security features
and filtering customizations.

A format string vulnerability has been reported for the Firebox Vclass and
legacy RSSA line of security appliances. The vulnerability is due to
inadequate checking of user-supplied input for passwords in the CLI
(command line interface) binary. A remote attacker is able to supply a
password comprised of malicious format specifiers.  This may result in
memory being overwritten by remote attackers, possibly to execute
arbitrary code.  Any attacker-supplied code will executed with root
privileges.

A remote attacker can exploit this vulnerability to fully compromise a
vulnerable Firebox Vclass appliance.

39. WatchGuard Firebox VClass CLI Interface Improperly Terminated
Connection Vu$
BugTraq ID: 5815
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5815
Summary:

Firebox is the firewall solution designed and distributed by WatchGuard.
Firebox is designed as an enterprise level firewall with security features
and filtering customizations.

A vulnerability has been reported that affects Firebox Vclass security
appliances as well as legacy RSSA (RapidStream Security Appliances)
devices. The vulnerability is due to the CLI (command line interface)
binary failing to properly terminate a failed login connection. This
results in an attacker having access to the CLI with administrative
privileges.

The vulnerability occurs because the CLI binary, which is used for
authentication, fails to properly check for authentication credentials.
When a remote attacker logs in to the security appliance with a '-N'
option, the connection is not properly terminated. The '-N' option is used
to disable execution of remote commands.

An attacker can exploit this vulnerability by attempting to authenticate
with a '-N' option. When the authentication fails, the connection will not
be closed and thus the attacker has access to the CLI binary with
administrative privileges.

40. Apache 2 mod_dav Denial Of Service Vulnerability
BugTraq ID: 5816
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5816
Summary:

The Apache HTTP Server a popular open-source HTTP server for multiple
platforms, including Windows and Unix. Apache ships with the Distributed
Authoring and Versioning component (mod_dav).

A vulnerability has been discovered in the mod_dav component, under
certain configurations, which could allow for a remote attacker to cause a
denial of service.

By sending a maliciously constructed HTTP request to a Apache server
specifically configured with certain back-end providers, it is possible to
cause mod_dav to reference a NULL pointer.

The HTTP request can not be issued from a browser. The request must be
constructed via a DAV client or exploit program.

41. Zope ZCatalog Plug-In Remote Method Vulnerability
BugTraq ID: 5812
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5812
Summary:

Zope is a freely available, open source content management system.  It is
available for Unix, Linux, and Microsoft operating systems.

It has been reported that a problem in Zope may lead to users gaining
access to intended information.

Under some circumstances, it may be possible for a remote user to take
advantage of the plug-ins functionality of ZCatalog, included with the
Zope package.  Due to insecure default settings, it may be possible for
remote users to call arbitrary methods of catalog indexes anonymously.

It should also be noted that untrusted code run on the Zope system could
also allow the calling of arbitrary methods, and potentially call
malicious catalog indexes.

42. Zope Through The Web Code Remote Denial Of Service Vulnerability
BugTraq ID: 5813
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5813
Summary:

Zope is a freely available, open source content management system.  It is
available for Unix, Linux, and Microsoft operating systems.

A problem with Zope could make it possible for a remote user to launch a
denial of service.

Zope systems that permit users to write "Through The Web Code" could be
vulnerable to a denial of service.  Due to insufficient validation of
input, it is possible for a remote user to submit a malicious piece of
code that will result in the shutdown of the vulnerable Zope server.

It should be noted that if a system running a vulnerable version of the
software allows remote users to write Python Scripts, DTML Methods, or
Page Templates via "Through The Web Code," the system is vulnerable to
denial of service.

43. Citrix MetaFrame Client-Specified Published Applications Vulnerability
BugTraq ID: 5817
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5817
Summary:

Citrix MetaFrame XP is a series of commerical products for allowing remote
desktop access.  Client access is facilitated via the Citrix ICA Client,
which is freely available.

Citrix MetaFrame XP family servers may rely on client-supplied
configuration when permitting access to published applications.  In some
Citrix networks, access to published applications is handled via a
distributed Independent Computing Architecture (.ICA) client-side
configuration file.  The .ICA file contains a list of servers and
published applications.

Attackers may change the list of published applications in the .ICA file
to execute arbitrary programs instead of legitimate published
applications.

Exploitation of this vulnerability may allow for remote compromise.  The
attacker must possess details about valid servers/published applications
and be able to authenticate to exploit this issue.

.ICA files are only relied upon in Citrix networks that do not use a NFuse
server to handle access to published applications.

44. VBulletin Calendar.PHP Command Execution Vulnerability
BugTraq ID: 5820
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5820
Summary:

vBulletin is commercial web forum software written in PHP and back-ended
by a MySQL database. It will run on most Linux and Unix variants, as well
as Microsoft operating systems.

A remote command execution vulnerability has been reported for vBulletin.
The vulnerability is due to vBulletin failing to properly sanitize
user-supplied input from URI parameters.

The vulnerability occurs in the 'calendar.php' file included with
vBulletin. Reportedly, modifying certain URI parameters may result in the
execution of attacker-supplied commands on the vulnerable system with the
privileges of the webserver process.

45. BEA WebLogic Server and Express HTTP Response Information Disclosure
Vulner$
BugTraq ID: 5819
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5819
Summary:

BEA Systems WebLogic Server is a web and wireless application server for
Microsoft Windows and most Unix and Linux distributions.  BEA WebLogic
Express provides a platform for serving dynamic data to web and wireless
applications.

BEA WebLogic Server and Express are reported to be prone to an issue which
has the potential to disclose sensitive information to malicious parties.
The vulnerable software occasionally returns two responses for a HTTP
request.  This condition has to do with how the affected software buffers
HTTP response data.

As a result, two users may receive responses from a single user's request,
which may unintentionally expose sensitive information to a malicious
party.  The nature of the information disclosed is entirely dependent on
what resource was requested when the condition occurs.

It has been reported by the vendor that there is no way for an attacker to
trigger this vulnerability, and that the condition may occur randomly.


III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. 'T0rn' Arrest Alarms White Hats, Advocates
By  Kevin Poulsen

A raid on the alleged author of a well-known hacker toolkit is raising
eyebrows among electronic civil libertarians, and putting security
researchers on guard.

http://online.securityfocus.com/news/813

2. Secret Service agents probe wireless networks in Washington
By D. Ian Hopper, The Associated Press

Secret Service agents are putting a high-tech twist on the idea of a cop
walking the beat. Using a laptop computer and an antenna fashioned from a
Pringles potato chip can, they are looking for security holes in wireless
networks in the nation's capital.

http://online.securityfocus.com/news/899

3. FTC pens Dewie the Turtle to promote Internet safety
By Wilson P. Dizard III, Government Computer News

Dewie the Turtle, a symbol for safe Internet practices, today joined
Smokey Bear and Woodsy Owl in the federal government's menagerie of
mascots for public-spirited practices. The Federal Trade Commission
unveiled Dewie, an upbeat green cartoon, at the Privacy2002 conference in
Cleveland.

http://online.securityfocus.com/news/885

4. China implicated in Dalai Lama hack plot
By John Leyden, The Register

China has repeatedly attempted to crack into the Dalai Lama's computer
network, according to its administrators.

Over the last month there have been repeated attempts to infect systems
used by the exiled spiritual leader. This takes the form of a computer
virus which attempts to send information back to China, Jigme Tsering,
manager of the Tibetan Computer Resource Centre told AP.

http://online.securityfocus.com/news/884


IV.SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. PASP vRC-1b
by josiahcarlson
Relevant URL:
http://www.sourceforge.net/projects/pasp
Platforms: Os Independent
Summary:

PASP is a Bayesian-like spam filter that can be used as a POP3 proxy.

2. C++ Elliptic Curve Cryptography library v0.1.0
by Carlo Wood
Relevant URL:
http://libecc.sourceforge.net/
Platforms: Os Independent
Summary:

Libecc is a C++ elliptic curve cryptography library that supports
fixed-size keys for maximum speed. The goal of this project is to become
the first free Open Source library providing the means to generate safe
elliptic curves, and to provide an important source of information for
anyone with general interest in ECC.

3. Logrep v1.12
by Tevfik Karagulle
Relevant URL:
http://logrep.sourceforge.net/
Platforms: Linux, POSIX, Windows 2000, Windows NT
Summary:

Logrep is a framework for extraction and presentation of information from
various logfiles. Currently Snort, Squid, Postfix, Apache, Trend Micro
VirusWall, and Microsoft IIS are supported. HTML reports, 2D analysis,
overview page, secure communication, and bar charts are available.

4. Netfilter logs analyzer v0.1
by gege
Relevant URL:
http://www.gege.org/iptables/
Platforms: Linux, POSIX
Summary:

IPTables log analyzer displays Linux 2.4 iptables logs (rejected packets)
in a nice HTML page. This page is easy to read and understand to reduce
the manual analysis time, and contains statistics on packets and links to
more detailed information on a given host, port, domain, etc.

5. ipkungfu v0.1
by Trappist
Relevant URL:
http://online.securityfocus.com/tools/2868
Platforms: Linux, POSIX
Summary:

IPKungFu is a script aiming to simplify the configuration of your
firewall/NAT/port forwarding. It takes advantage of advanced features of
iptables and tcpwrappers.

6. bogofilter v0.7.4
by MA
Relevant URL:
http://bogofilter.sourceforge.net/
Platforms: POSIX
Summary:

Bogofilter is a Bayesian spam filter. In its normal mode of operation, it
takes an email message or other text on standard input, does a statistical
check against lists of "good" and "bad" words, and returns a status code
indicating whether or not the message is spam. Bogofilter is designed with
fast algorithms (including Berkeley DB system), coded directly in C, and
tuned for speed, so it can be used for production by sites that process a
lot of mail.


V. SECURITY JOBS SUMMARY
------------------------
1. Job *Offered* : Firewall And VPN Developers Wanted. (SF Bay Area)
(Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293489

2. Network Security Support Engineer  Position In Southern Cal. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293484

3. Desired- Position- Network Security or Engineering in SPAIN (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293483

4. Addendum - Ohio Security Infrastructure Manager - Cincinatti (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293482

5. CISSP / Security Analyst looking for oppty in DC Metro Area (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293488

6. Network Security Position in Norther Virginia (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293487

7. Dead Threads (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293268

8. Director of Security (California) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293263

9. Southern California Resume (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293262

10. Information Security Senior Project Consultant - #701 - Cleveland, OH
(Thre$
Relevant URL:

http://online.securityfocus.com/archive/77/293275

11. IT Security Architect / IT Security Consultant - London UK (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293276

12. Technical Support Opportunity at Entercept Security Technologies in
San Jos$
Relevant URL:

http://online.securityfocus.com/archive/77/293277

13. NJ area Security Technician (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293278

14. Tivoli SecureWay - Security Consultant - Middle East (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293260

15. Salary Ranges and Posting:  From a  Corporate Tech Recruiter (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293274

16. Salary ranges for InfoSec professionals (was Salary Cap's PLEASE)
(Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293273

17. Opportunity at Entercept Security Technologies (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293272

18. Senior Information Risk Consultant / Security Consultant- Scotland
(Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292993

19. Need job in FL (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292997

20. Resume - (BS in MIS/CCNP/CSS1) seeking position in Florida. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292991

21. Salary Cap's PLEASE! (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292995

22. Senior Information Security Analyst - IN - $70k-$80k (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292879

23. Corporate Risk Assessment Consultant(s) - OH - $85k-$95k + bonus
(Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/292858


VI. INCIDENTS LIST SUMMARY
-------------------------
1. Unusual volume: UDP:137 probes (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293502

2. AIM-based worm? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293501

3. E-Card Remote Code Execution Scam (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293474

4. Snake in the grass (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293473

5. VS: slapper worm varient "cinik" (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293406

6. Modap Worm Infection and Subsequent Scanning (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293405

7. new IIS worm? (rcp lsass.exe) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293403

8. slapper worm varient "cinik" (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293287

9. Port 11890 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293288

10. New worm? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293094

11. Slapper worm DoS (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292966

12. Analysis of Modap worm (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292964

13. "Worm riders" on 4156? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/292949

14. New variants of Slapper worm using UDP ports other than 2002 today --
1978 $
Relevant URL:

http://online.securityfocus.com/archive/75/292935


VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Need help analyzing apache-scalp code (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/293341

2. Microsoft FrontPage Server Extensions SmartHTML Buffer Overflow
Vulnerabilit$
Relevant URL:

http://online.securityfocus.com/archive/82/293363

3. Shell code -RVA techniques or something similar (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/293159

4. DHCP mitm clarification (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/293011

5. RES: OpenSSL Vulnerability and OpenSSH (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292841

6. R: OpenSSL Vulnerability and OpenSSH (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292903

7. OpenSSL Vulnerability and OpenSSH (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292825

8. DHCP man in the middle attack (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292848

9. ToorCon 2002 This Weekend (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/292823


VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Why does W2k allow blank passwords even with GPO configured? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/293087

2. win xp sp1 changes ICF settings/rules and/or default behavior    for
snmp pa$
Relevant URL:

http://online.securityfocus.com/archive/88/293061

3. I'm falling my hairs with this domain gpo problem (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/293006

4. SecurityFocus Microsoft Newsletter #105 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292884

5. FW: Hosting multiple sites/ASP.NET security (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292892

6. FW: I'm falling my hairs with this domain gpo problem (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/292890


IX. SUN FOCUS LIST SUMMARY
----------------------------
1. how to have syslogd not replay kernel ring buffer at startup (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/293227


X. LINUX FOCUS LIST SUMMARY
---------------------------
1. openssl (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/293225


XI. SPONSOR INFORMATION
-----------------------
This Issue Sponsored by: Wiley and Sons

SPECIAL FREE PREVIEW OF NEW KEVIN MITNICK BOOK

See what Publishers Weekly called a "tour de force, a series of tales of
how some old-fashioned blarney and high-tech skills can pry any
information from anyone..." For more information and how to order "The Art
of Deception : Controlling the Human Element of Security", visit

Please visit us at:

http://search.barnesandnoble.com/booksearch/isbnInquiry.asp?userid=5OZAUOSEB
Z&isbn=0471237124&displayonly=excerpt

-------------------------------------------------------------------------------