SecurityFocus Newsletter #165

John Boletta <[email protected]> Mon, 7 Oct 2002 11:42:51 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #165
-----------------------------

This Issue is Sponsored By: BorderWare

36 Email Security Risks: are you vulnerable?

There's more to email security than viruses. Find out how your email
systems measure up to emerging threats:

* Malformed messages that disguise malicious code from virus scanners
* New hacks against MS Exchange
* Operating systems vulnerabilities
* Remote access (OWA) exposures

Analysts and auditors are calling for a new breed of product - the Mail
Firewall, a perimeter security appliance to protect internal email systems
from these new attacks.

Check out the industry leader at http://www.mxtreme.com.

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Assessing Internet Security Risk, Part Four: Custom Web...
2. Evaluating Network Intrusion Detection Signatures, Part Two
3. One Patch to Rule Them All
4. SecurityFocus DPP Program
5. IIR's 3G Fraud & Security Forum
6. InfoSec World Conference and Expo/2003
7. Bulletproof Your Network: FREE Guide
II. BUGTRAQ SUMMARY
1. VBulletin Calendar.PHP Command Execution Vulnerability
2. Jetty Servlet Engine Cross Site Scripting Vulnerability
3. Apache Server Side Include Cross Site Scripting Vulnerability
4. SafeTP Passive Mode Internal IP Address Revealing Vulnerability
5. EmuMail Web Root Path Disclosure Vulnerability
6. EmuMail Email Form Script Injection Vulnerability
7. Eric S. Raymond Fetchmail Email Header Parsing Buffer Overflow...
8. Eric S. Raymond Fetchmail Multidrop Mode Denial Of Service...
9. Eric S. Raymond Fetchmail Multidrop Mode Email Header Parsing...
10. Sun ONE Starter Kit / ASTAware SearchDisc Search Engine...
11. WN Server Malformed GET Request Buffer Overflow Vulnerability
12. Monkey HTTP Server Multiple Cross Site Scripting Vulnerabilities
14. Nullsoft Winamp 3 Skin File Buffer Overflow Vulnerability
15. GNU Tar Hostile Destination Path Variant Vulnerability
16. MyNewsGroups Subject Header HTML Injection Vulnerability
17. Apache Tomcat Mod_JK /Mod_JServ Directory Disclosure...
18. HP-UX LDAP-UX Integration Pam-Authz Privilege Escalation...
19. FreeBSD Rogue Local Buffer Overflow Vulnerability
20. GV GZip Archive Malicious File Name Command Execution...
21. Microsoft Internet Explorer Document Reference Zone Bypass...
22. NetGear FVS318 Username/Password Disclosure Vulnerability
23. Bugzilla Group Creation With Elevated Privileges Vulnerability
24. Bugzilla Account Creation SQL Injection Vulnerability
25. Bugzilla Bugzilla_Email_Append.pl Arbitrary Command Execution...
III. SECURITYFOCUS NEWS ARTICLES
1. Report: Satellites at Risk of Hacks
2. Defense Agency Leaves Shopping List Online
3. Apache fixes scripting flaw
4. Help! MS issues another critical security fix
IV.SECURITYFOCUS TOP 6 TOOLS
1. Pafwert
2. EPS v1.2
3. NTLM authentication library v0.3.0
4. Graphical certification authority v0.2.6
5. adcfw-log v0.2.0
6. BanShee Linux/R v0.51
V. SECURITYJOBS LIST SUMMARY
1. CISSP looking for DC infosec position (Thread)
2. Senior Perimeter Systems Engineer (Firewall Architect)...
3. Security Position With Documentation Expertise (Thread)
4. Seeking senior security position (Thread)
5. While my newfound career at Home Depot is deeply...
6. Jr to mid level security analyst opening in Bethesda, MD (Thread)
7. Seeking Computer Forensics Intern / Assistant position (Thread)
8. Network Security Support Engineer needed in Southern Cal. (Thread)
9. Security (Sales) Engineer Opening at Sygate Technologies Inc...
10. Firewall Security Engineer position available in sunny Orlando,
FL (Thread)
11. PKI Positions in Washington DC (Thread)
12. Security Administrator Position Available in Port St Lucie...
13. NJ-based security professional looking for spot with up to...
14. Resume - Information Systems Security Professional (Thread)
15. INFOSEC Management or Auditing (Thread)
16. Network/Security Administrator position wanted in MD (Thread)
17. Job Available for Information Security Auditor/Internal...
18. Job *Offered* : Firewall And VPN Developers Wanted...
19. Network Security Support Engineer Position In Southern Cal...
20. Desired- Position- Network Security or Engineering in SPAIN...
21. Addendum - Ohio Security Infrastructure Manager - Cincinatti...
22. CISSP / Security Analyst looking for oppty in DC Metro Area...
23. Network Security Position in Norther Virginia (Thread)
24. Dead Threads (Thread)
VI. INCIDENTS LIST SUMMARY
1. high number of code red events (Thread)
2. Unusual volume: UDP:137 probes (Thread)
3. maybe a simple problem (Thread)
4. question about slapper (Thread)
5. slapper changed to udp 1812? (Thread)
6. Possible remote vulnerability in SSH-1.2.27 (Thread)
7. Interesting new DDoS method? (Thread)
8. UDP:137 source IP distribution (Thread)
9. Increase in SSH scans (Thread)
10. DNS servers outbound connections. (Thread)
11. IIS Using Port 1843 (Thread)
12. SV: Unusual volume: UDP:137 probes (Thread)
13. Port 137 probes (Thread)
14. W2K Compromise - PipeCmdSrv (Thread)
15. WinXP integrated packet filtering (Thread)
16. Strange random-number.file entries in Apache logs (Thread)
17. FW: DNS servers outbound connections. (Thread)
18. AIM-based worm? (Thread)
19. E-Card Remote Code Execution Scam (Thread)
20. Snake in the grass (Thread)
21. Port 608/trojan/spam (Thread)
22. VS: slapper worm varient "cinik" (Thread)
23. Modap Worm Infection and Subsequent Scanning (Thread)
24. new IIS worm? (rcp lsass.exe) (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Shell code -RVA techniques or something similar (Thread)
2. OpenSSH Vulns (new?) Priv seperation (Thread)
3. Office 97 Word document vulnerability (Thread)
4. dictionary (Thread)
5. Group Policy Disable Command Prompt access (allow scripting)...
6. Need help analyzing apache-scalp code (Thread)
7. Microsoft FrontPage Server Extensions SmartHTML Buffer Overflow...
VIII. MICROSOFT FOCUS LIST SUMMARY
1. SecurityFocus Microsoft Newsletter #106 (Thread)
IX. SUN FOCUS LIST SUMMARY
1. No New Posts For The Week Of 9/30/02 - 10/06/02
X. LINUX FOCUS LIST SUMMARY
1. VPN Choices for RedHat 7.3 (Thread)
2. openssl (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Assessing Internet Security Risk, Part Four: Custom Web Applications
By Charl van der Walt

This article is the fourth in a series that is designed to help readers to
assess the risk that their Internet-connected systems are exposed to. This
installment will discuss a relatively unexplored aspect of Internet
security, custom Web applications.

http://online.securityfocus.com/infocus/1631

2. Evaluating NID Signatures, Part Two
byKaren Kent Frederick

In this series of articles, we present recommendations that will help
readers to evaluate the quality of network intrusion detection (NID)
signatures, either through hands-on testing or through careful
consideration of third-party product reviews and comparisons. The first
installment discussed some of the basics of evaluating NID signature
quality, as well selecting attacks to be used in testing. This article
will conclude the discussion on criteria for choosing attacks and then
provide recommendations for generating attacks and creating a good testing
environment. We begin by discussing some methods of acquiring attacks and
attack traffic.

http://online.securityfocus.com/infocus/1630

3. One Patch to Rule Them All
By Tim Mullen

A recent XP security hole begs the question, do we really want Microsoft
to release individual fixes for every bug?

http://online.securityfocus.com/columnists/112

4. SecurityFocus DPP Program

Attention Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

5. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud

6. InfoSec World Conference and Expo/2003

March 10-12, 2003, Orlando, FL
Optional Workshops March 8, 9, 12, 13, & 14
Vendor Expo March 10 & 11

Solutions to today's security concerns; hands-on experts; blockbuster
vendor expo; the CISO Executive Summit; invaluable networking
opportunitiesInfoSec World has it all!

Go to: http://www.misti.com/10/os03nl37inf.h

7. Bulletproof Your Network: FREE Guide

Existing security products -- firewalls, anti-virus and IDS -- are simply
no longer enough to ensure your networks are safe against sophisticated
attacks and worms such as Code Red and Nimda. FREE Guide shows you how to
ensure TOTAL security for your network. Get it now.

Visit us at:
https://www.qualys.com/forms/guide_220.php

II. BUGTRAQ SUMMARY
-------------------
1. VBulletin Calendar.PHP Command Execution Vulnerability
BugTraq ID: 5820
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5820
Summary:

vBulletin is commercial web forum software written in PHP and back-ended
by a MySQL database. It will run on most Linux and Unix variants, as well
as Microsoft operating systems.

A remote command execution vulnerability has been reported for vBulletin.
The vulnerability is due to vBulletin failing to properly sanitize
user-supplied input from URI parameters.

The vulnerability occurs in the 'calendar.php' file included with
vBulletin. Reportedly, modifying certain URI parameters may result in the
execution of attacker-supplied commands on the vulnerable system with the
privileges of the webserver process.

2. Jetty Servlet Engine Cross Site Scripting Vulnerability
BugTraq ID: 5821
Remote: Yes
Date Published: Sep 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5821
Summary:

Jetty is a freely available, open source Java Web Server and Servlet
Container. It is available for Linux, Unix, and Microsoft Windows
platforms.

A problem with Jetty may make it possible for users to launch cross-site
scripting attacks.

It has been reported that Jetty does not properly sanitize requests.
This could result in a user clicking a malicious link that would execute
script or HTML code in the security context of the site hosted by the
Jetty server. An attacker could exploit this vulnerability to gain
authentication cookies, or other sensitive information.

This vulnerability occurs when the script code is appended with two hex
linefeed (0a) characters in the requested URL. This vulnerability may
affect other versions of Jetty.

3. Apache Server Side Include Cross Site Scripting Vulnerability
BugTraq ID: 5847
Remote: Yes
Date Published: Oct 02 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5847
Summary:

The Apache HTTP Server is a popular open-source HTTP server for multiple
platforms, including Windows and Unix.

Apache is reported to be vulnerable to cross site scripting attacks. This
vulnerability is due to the SSI (Server Side Include) error pages of the
webserver not being properly sanitized of malicious HTML code.

Specifically, this vulnerability is a result of Apache failing to filter
HTTP/1.1 'Host' headers that are sent by browsers. Reportedly, Apache
webserver does not filter specially crafted 'Host' headers that contain
malicous HTML code before passing them onto the browser as entity data.

An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link. Attacker-supplied HTML and script code may be
executed on a web client visiting the malicious link in the context of the
webserver.

Attacks of this nature may make it possible for attackers to manipulate
web content or to steal cookie-based authentication credentials. It may be
possible to take arbitrary actions as the victim user.

4. SafeTP Passive Mode Internal IP Address Revealing Vulnerability
BugTraq ID: 5822
Remote: Yes
Date Published: Sep 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5822
Summary:

SafeTP is a freely available, open source secure ftp client-server
software package. It is available for Unix, Linux, and Microsoft
Operating Systems.

A problem with SafeTP may result in the disclosure of sensitive
information.

It has been reported that under some circumstances, the SafeTP server may
reveal sensitive network information. When a passive session is initiated
in a specific manner, SafeTP may return the address of a system serving
files that is behind at NAT firewall.

This disclosure of information could give an attacker limited information
about network configuration behind a NAT firewall. It could be used to
launch further, directed attacks against network resources.

5. EmuMail Web Root Path Disclosure Vulnerability
BugTraq ID: 5823
Remote: Yes
Date Published: Sep 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5823
Summary:

Emumail is an open source web mail application. It is available for the
Unix, Linux, and Microsoft Windows operating systems.

A problem with Emumail could make it possible for an attacker to gain
sensitive information.

Under some conditions, Emumail may reveal sensitive configuration
information. When unexpected characters are inserted into some fields in
web mail forms, the form generates an error. The error page returned may
contain the directory to the web root on the Emumail server.

6. EmuMail Email Form Script Injection Vulnerability
BugTraq ID: 5824
Remote: Yes
Date Published: Sep 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5824
Summary:

Emumail is an open source web mail application. It is available for the
Unix, Linux, and Microsoft Windows operating systems.

A problem with EmuMail could make it possible for a user to execute
arbitrary script code.

It has been reported that EmuMail does not properly sanitize input.
Under some conditions, it is possible to pass an email containing script
or html code through the EmuMail web mail interface. This would result in
execution of the script code in the security context of the EmuMail site.

This could allow an attacker to potentially steal cookie information.

7. Eric S. Raymond Fetchmail Email Header Parsing Buffer Overflow Vulnerability
BugTraq ID: 5825
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5825
Summary:

Fetchmail is a freely available, open source mail retrieval utility. It is
maintained by Eric S. Raymond.

A buffer overflow vulnerability has been reported for Fetchmail 6.0.0 and
earlier. Reportedly, this vulnerability is due to improper checks of
user-supplied values for email headers. The vulnerability occurs in the
readheaders() function which is used to parse email headers.

Fetchmail does not properly check the size of some user-specified data
when copying information into stack buffers. Reportedly, the function,
nxtaddr() limits the size of user-supplied data to BUFSIZ bytes. BUFSIZ is
usually defined to be 1024 bytes. Some systems running glibc, however,
define BUFSIZ to be 8192 bytes. Thus a remote attacker is able to trigger
the overflow condition, by composing an email consisting of overly large
email headers, and cause Fetchmail to improperly allocate space on the
system stack.

It is believed that an attacker could potentially exploit this condition
to overwrite stack variables with malicious attacker-supplied values. It
is possible that exploitation could result in execution of malicious
attacker-supplied code as the Fetchmail process.

This vulnerability has been reported for Fetchmail 6.0.0 and earlier.

8. Eric S. Raymond Fetchmail Multidrop Mode Denial Of Service Vulnerability
BugTraq ID: 5826
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5826
Summary:

Fetchmail is a freely available, open source mail retrieval utility. It is
maintained by Eric S. Raymond.

A denial of service vulnerability has been reported for Fetchmail 6.0.0
and earlier. The vulnerability is due to improper boundary checks when
processing email headers. Specifically, the vulnerability occurs when
Fetchmail is in multidrop mode and attempts to obtain DNS information
through the getmxrecord() function.

A remote attacker is able to exploit this vulnerability by sending a
large, specially crafted DNS packet to a vulnerable version of Fetchmail.
This may be possible if the attacker controls a malicious DNS server or is
able to forge DNS replies. This will cause Fetchmail to crash when
processing the malformed packet.

This vulnerability has been reported for Fetchmail 6.0.0.

9. Eric S. Raymond Fetchmail Multidrop Mode Email Header Parsing Heap Overflow Vulnerability
BugTraq ID: 5827
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5827
Summary:

Fetchmail is a freely available, open source mail retrieval utility. It is
maintained by Eric S. Raymond.

A remotely exploitable heap overflow vulnerability has been reported for
Fetchmail 6.0.0 and earlier. The vulnerability occurs in the
parse_received() function which is used to parse the 'Received:' email
headers. This vulnerability affects Fetchmail in multidrop mode and will
cause Fetchmail to corrupt heap memory with attacker-supplied values.

Reportedly, certain parts of the 'Received:' header get copied into memory
buffers without any checks being performed. An attacker can exploit this
vulnerability by composing an email that includes a specially crafted
'Received:' header and sending this email to a victim Fetchmail user. When
Fetchmail processes the malicious email, the overflow condition will be
triggered and memory in the heap will be corrupted.

An attacker may exploit this condition to overwrite arbitrary words in
memory. This may allow for the execution of arbitrary code.

This vulnerability has been reported for Fetchmail 6.0.0 and earlier.

10. Sun ONE Starter Kit / ASTAware SearchDisc Search Engine Directory Traversal Vulnerability
BugTraq ID: 5828
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5828
Summary:

A vulnerability has been reported for the Sun ONE Starter Kit 2.0 and
ASTAware SearchDisc. The search engine included with the ONE Starter Kit
is a modified version of ASTAWare SearchDisc. SearchDisc is a Java-based
seach engine facility provided for information retrieval. Reportedly, the
search engine is vulnerable to directory traversal attacks.

The search engine does not properly sanitize web requests. This could
allow an attacker to send web requests for private resources on vulnerable
installations. Through this method, the attacker can retrieve various
information about the files residing on the vulnerable system, including
password files.

An attacker can use the information obtained through this manner to launch
potentially destructive attacks against a vulnerable system.

This vulnerability affects both the Sun ONE Starter Kit and ASTAware
SearchDisc.

11. WN Server Malformed GET Request Buffer Overflow Vulnerability
BugTraq ID: 5831
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5831
Summary:

WN Server is a freely available webserver. It is included in the FreeBSD
ports collection.

WN Server is prone to a remotely exploitable buffer overflow. This is due
to insufficient bounds checking of data received in HTTP GET requests.
It is possible to send an overly long request to the server and cause
process memory to be corrupted with attacker-supplied data. Stack
variables, including the return address, may be overwritten with
attacker-supplied data as a result of exploitation. An attacker may
leverage this condition to execute arbitrary instructions.

Code execution that results from successful exploitation will occur in the
context of webserver process, and may allow a remote attacker to gain
access to the host with the privileges of the webserver.

This issue is reported to be present in WN Server version 1.18.2 through
2.0.0. It is possible that other versions may also be affected by this
vulnerability.

12. Monkey HTTP Server Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 5829
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5829
Summary:

Monkey is an open source Web server written in C, based on the HTTP/1.1
protocol. It is available for the Linux platform.

It has been reported that Monkey HTTP server is prone to cross site
scripting vulnerabilities.

13. Trolltech Qt Assistant Default Port Unauthorized Access Weakness
BugTraq ID: 5833
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5833
Summary:

Qt is a C++ toolkit for application development. It is designed for use
with various platforms including Linux and Unix variants as well as
Microsoft Windows operating environments.

A weakness has been reported for the Qt Assistant. The Qt Assistant is a
browser for the Qt documentation and is typically used in conjuntion with
Qt Designer. Reportedly, the Qt Assistant opens port 7358 for
communication with Qt Designer. This port, however, can be accessed
remotely.

An attacker can exploit this weakness by connecting to a vulnerable system
on port 7358 and making requests for HTML pages. The requests will be
processed by the Qt Assistant and will be displayed on the screen of the
user that is currently using the Assistant.

Numerous simultaneous requests may cause the Qt Assistant from responding
to legitimate requests in a timely manner.

14. Nullsoft Winamp 3 Skin File Buffer Overflow Vulnerability
BugTraq ID: 5832
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5832
Summary:

Nullsoft Winamp is a skinable media player for Microsoft Windows
supporting MP3 and other filetypes. Winamp 3 skin files use a .wal
extension by default.

The .wal file is an archive that contains images and configuration files
for the skin. When these files are downloaded through a web browser, they
are in turn automatically opened and applied to the Winamp player.

The .wal file typically contains a skin.xml file with configuration
information for the skin. This file contains <include file=""/> tags
which point to other XML configuration files for the skin. This
information is processed by wsabi.dll for Winamp.

By supplying an exceptionally long string for the path, it is possible to
overrun the buffer in wsabi.dll, causing memory to be to be corrupted with
attacker-supplied data. Execution of code is possible in the security
context of the user running the Winamp application.

15. GNU Tar Hostile Destination Path Variant Vulnerability
BugTraq ID: 5834
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5834
Summary:

GNU Tar 1.13.25 contains a vulnerability in the handling of pathnames for
archived files.

By specifying a path for an archived item which points outside the
expected directory scope, the creator of the archive can cause the file to
be extracted to arbitrary locations on the filesystem - including paths
containing system binaries and other sensitive or confidential
information.

Since tar can override umask settings, the output file can be rendered
executable.

This can be used to create or overwrite binaries in any desired location.
Properly exploited, this grants the archive creator an elevation of
privileges, potentially to 'root'.

This issue is a variant of the vulnerability described in BID 3024. It is
not known whether earlier versions are also affected by this variant.

16. MyNewsGroups Subject Header HTML Injection Vulnerability
BugTraq ID: 5836
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5836
Summary:

MyNewsGroup is a USENET news client, written in PHP4. It is publicly
available under the GNU Public license.

It has been reported that the MyNewsGroups news client is prone to HTML
injection attacks. It is possible to exploit this issue by injecting
arbitrary HTML and script code into the Subject headers of news messages.

These attacks can be mounted against a vulnerable client processing
malformed Subject headers in the maliciously constructed news messages.

Exploitation of this issue may make it possible for attackers to
manipulate web content or steal cookie-based authentication credentials.
It may be possible to take arbitrary actions as the victim user.

17. Apache Tomcat Mod_JK /Mod_JServ Directory Disclosure Vulnerability
BugTraq ID: 5838
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5838
Summary:

Apache Tomcat is reported to be prone to a vulnerability which may enable
remote attackers to disclose the contents of directories. It is possible
to submit a malicious web request which is capable of disclosing directory
contents.

An attacker may use the information gathered in this manner to mount
further attacks against the host.

This issue is reported to affect Apache Tomcat 3.2.x on HP-UX 11.04 (VVOS)
systems. The source of the problem is a connector issue. It is not known
whether other systems are also affected.

18. HP-UX LDAP-UX Integration Pam-Authz Privilege Escalation Vulnerability
BugTraq ID: 5839
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5839
Summary:

The HP-UX LDAP-UX Integration pam-authz component is prone to a
vulnerability which may allow for "r-commands" to be executed under an
incorrect user-id, with elevated privileges. In turn, an attacker may
exploit this condition to gain the same privileges that the "r-commands"
are incorrectly executed with.

This issue affects LDAP-UX Integration versions B.02.00 and B.03.00.

19. FreeBSD Rogue Local Buffer Overflow Vulnerability
BugTraq ID: 5837
Remote: No
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5837
Summary:

Rogue is a game included with FreeBSD. Games are invoked by the
/usr/games/dm binary, which is setgid games by default. Normal game
behaviour involves revoking privileges. Rogue fails to drop privileges,
potentially resulting in privilege escalation.

A buffer overflow has been discovered in Rogue when restoring saved games.
By passing an overly large string to the 'read_string' function in save.c,
it is possible to corrupt memory.

By exploiting this issue it may be possible for an attacker to overwrite
values in the programs Global Offset Table, resulting in the execution of
arbitrary attacker-supplied code.

Successful exploitation would result in the escalation of privileges to
the 'games' group, which could result in the corruption of saved game
data, as well as storage consumption.

20. GV GZip Archive Malicious File Name Command Execution Vulnerability
BugTraq ID: 5840
Remote: No
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5840
Summary:

gv is a freely available, open source Portable Document Format (PDF) and
PostScript (PS) viewing utility. It is available for Unix and Linux
operating systems.

A problem with gv could make the execution of arbitrary commands possible.

Under some circumstances, gv does not properly handle file names. When a
PostScript (PS) or Portable Document Format (PDF) file contained within a
compressed archive such as a gzip archive is opened with gv, command
execution may occur. A file name containing special characters such as
backticks (`), quotes ("), and ampersands (&) will be interpretted as
commands, and executed by gv.

This problem could make the execution of arbitrary commands possible.
Any commands executed through gv would be executed with the permissions of
the gv user.

21. Microsoft Internet Explorer Document Reference Zone Bypass Vulnerability
BugTraq ID: 5841
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5841
Summary:

A vulnerability has been reported in Microsoft Internet Explorer that may
allow for remote attackers to execute script code in the context of other
domains/security Zones.

The cause appears to be a lack of access control checks when access to a
document object is attempted through a separate reference to it. A
malicious webmaster may exploit this vulnerability by creating a reference
to the method "document.location.assign" of the target child window. The
attacker may then have the child window open a website in a different
domain/Zone while retaining the ability to execute
"document.location.assign()" by reference. As the domain/Zone is
different in the child window, this should not be possible.

Exploitation of this vulnerability may allow for theft of cookie
information, website impersonation or disclosure of local files.

22. NetGear FVS318 Username/Password Disclosure Vulnerability
BugTraq ID: 5830
Remote: No
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5830
Summary:

NetGear distributes commercially available Firewall/VPN/Router hardware
devices.

A vulnerability has been reported in NetGear FVS318 Firewall/VPN/Routers
when certain configuration options are enabled.

An optional backup setting is included on NetGear devices. When enabled, a
backup file containing configuration settings is created. Certain
sensitive information, such as ISP usernames and remote web administration
passwords are stored in plain text.

An attacker accessing the backup file, could obtain sensitive information,
which could aid the attacker in compromising the web administrative
interface of the device.

It should be noted that the backup option is not enabled by default, but
is a common feature used by administrators.

23. Bugzilla Group Creation With Elevated Privileges Vulnerability
BugTraq ID: 5843
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5843
Summary:

Bugzilla is a freely available, open source bug tracking software package.
It is available for Linux, Unix, and Microsoft Operating Systems.

A vulnerability has been reported for Bugzilla. This vulnerability affects
sites that use the 'usebuggroups' feature of Bugzilla. This feature, when
enabled, allows sites to track bugs based on products and allows site
administrators to restrict access to bugs on a per-product basis. The
'editgroups.cgi' page will show a listing of all current groups.

The vulnerability is the result of improper mathematical calculations done
when a site has 47, or more, bug groups. When a new product is added to a
site that has 47, or more, bug groups, the new group will be created with
extra privileges set. Any new users that are added to this group will
automatically gain access to other group privileges.

An attacker can exploit this vulnerability to obtain access to a
privileged group and perform actions pertaining to that group.

Site administrators may be able to find groups with extra privileges by
viewing the 'editgroups.cgi' page and looking for 'bit' values that end in
'0'. A large value such as, '4503599627370480', is indicative of an error
in large integer math. Administrators may be able to change the group bit
values and check permissions of users belonging to the offending groups.

This vulnerability affects Mozilla Bugzilla 2.14.3 and earlier and
Bugzilla 2.16 and earlier.

24. Bugzilla Account Creation SQL Injection Vulnerability
BugTraq ID: 5842
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5842
Summary:

Bugzilla is a freely available, open source bug tracking software package.
It is available for Linux, Unix, and Microsoft Operating Systems.

Bugzilla is prone to SQL injection attacks. This issue is due to
insufficient sanitization of apostrophes (') from e-mail addresses during
account creation. Maliciously formatted SQL injected via the e-mail
address field will be included in a SQL query.

An attacker could exploit this condition to modify the logic of SQL
queries, potentially resulting in disclosure of sensitive information or
database corruption. SQL injection may also enable a remote attacker to
exploit other existing vulnerabilities in the underlying datbase
implementation.

25. Bugzilla Bugzilla_Email_Append.pl Arbitrary Command Execution Vulnerability
BugTraq ID: 5844
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5844
Summary:

Bugzilla is a freely available, open source bug tracking software package.
It is available for Linux, Unix, and Microsoft Operating Systems.

A problem with Bugzilla could make it possible to execute arbitrary
commands.

Under some circumstances, it may be possible to execute arbitrary commands
on a Bugzilla server. A user may be able to insert maliciously formatted
entries into the Bugzilla database that would be handled by the
bugzilla_email_append.pl script. A maliciously formatted entry passed to
this script could result in the execution of arbitrary commands.

This problem could allow a remote user to execute arbitrary code on a
Bugzilla server. This could lead to a remote attacker gaining access to
the system with the privileges of the web server process.

26. BEA WebLogic Server and Express Inadvertent Security Removal Weakness
BugTraq ID: 5846
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5846
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

Under some circumstances, BEA WebLogic Server and Express are prone to a
weakness which may inadvertently cause security constraints to be removed.

This issue occurs when applications containing Servlets or EJBs are
deployed on multiple servers. When such an application is undeployed from
one server, the specified security constraints and role mappings for
Servlets or EJBs will be removed on all servers. The consequence of this
weakness is that all Servlets or EJBs will be left exposed.

Applications will be undeployed when a server shuts down or when the
application is untargetted from the server. This issue is present during
the time period when an appropriate application has been undeployed. The
application may be re-deployed when the server is restarted or when it is
targetted on another server.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. Report: Satellites at Risk of Hacks
By Kevin Poulsen Oct 3 2002

Want to find the most-ignored cybersecurity hole in America's critical
infrastructure? Congressional investigators say, Look up!

http://online.securityfocus.com/news/942

2. Defense Agency Leaves Shopping List Online
By Brian McWilliams Sep 30 2002

Faulty access controls open DISA's technology requisition system to
snoops...

http://online.securityfocus.com/news/911

3. Apache fixes scripting flaw
By John Leyden, The Register Oct 4, 2002

Apache is vulnerable to a number of cross-site scripting attacks.

According to a posting to BugTraq this week, the popular Web server
platform is vulnerable due to "SSI error pages of the Web server not being
properly sanitised of malicious HTML code".

http://online.securityfocus.com/news/943

4. Help! MS issues another critical security fix
By John Leyden, The Register Oct 3 2002

Microsoft has released a patch to fix critical flaws within Windows Help
Facility which could enable attackers to execute arbitrary code on a
victim's PC.

http://online.securityfocus.com/news/941

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Pafwert
by IISSecurity.net
Relevant URL:
http://www.iissecurity.net/pafwert/
Platforms: N/A
Summary:

Pafwert generates patterned random passwords that are much easier to
remember than totally random passwords. Most of the passwords it generates
are very strong yet follow patterns that make them easier for humans to
remember. Pafwert uses over 200 pattern algorithms and more than 300,000
words to generate trillions of password combinations.

2. EPS v1.2 by
Volatile Relevant URL: http://www.inter7.com/eps/
Platforms: POSIX
Summary:

EPS (Email Processing System) is a set of API for parsing email messages.
It is fast, thread-safe, understands content types and MIME, and has been
extensively tested. It features re-entry routines to cut down on memory
allocation and de-allocation.

3. NTLM authentication library v0.3.0
by Grant Edwards [email protected]
Relevant URL:
http://josefsson.org/libntlm/
Platforms: UNIX
Summary:

The NTLM library contains utilities for authenticating against Microsoft
servers that require NTLM authentication. The goal of this project is to
make libntlm easier to build (by using autoconf, automake, and libtool)
for use by other projects.

4. Graphical certification authority v0.2.6
by chris
Relevant URL:
http://www.hohnstaedt.de/xca.html
Platforms: Linux, POSIX
Summary:

Graphical certification authority is an interface for managing RSA keys
and certificates, and the creation and signing of PKCS#10 requests. It
uses the OpenSSL library and a Berkeley DB for key and certificate
storage. It supports importing and exporting keys and PEM DER PKCS8
certificates, signing and revoking of PEM DER PKCS12, and the selection of
x509v3 extensions. A tree view of certificates is presented.

5. adcfw-log v0.2.0
by Alessandro Dotti Contra
Relevant URL:
http://online.securityfocus.com/tools/2878
Platforms: Linux, POSIX
Summary:

adcfw-log is a tool for analyzing firewall logs in order to extract
meaningful information. It is designed to be a standalone script with very
few requirements that can generate different kinds of reports, such as
fully formatted reports of what had been logged, with summaries by source
or destination host, the type of service, or protocol. There are also
options to filter the input data by date, host, protocol, service, and so
on.

6. BanShee Linux/R v0.51
by Sean Rima
Relevant URL:
http://www.banshee-linux.org/
Platforms: Linux, POSIX
Summary:

BanShee Linux/R is a two-floppy rescue system using uClibc and Busybox to
make sure that the system is as small as possible.

V. SECURITY JOBS SUMMARY
------------------------
1. CISSP looking for DC infosec position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294015

2. Senior Perimeter Systems Engineer (Firewall Architect) - Cleveland, Ohio (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294016

3. Security Position With Documentation Expertise (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294059

4. Seeking senior security position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293981

5. While my newfound career at Home Depot is deeply fulfilling.....(resume posted) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293991

6. Jr to mid level security analyst opening in Bethesda, MD (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293864

7. Seeking Computer Forensics Intern / Assistant position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293868

8. Network Security Support Engineer needed in Southern Cal. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293784

9. Security (Sales) Engineer Opening at Sygate Technologies Inc based in Chicago, IL (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293787

10. Firewall Security Engineer position available in sunny Orlando, FL (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293786

11. PKI Positions in Washington DC (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293785

12. Security Administrator Position Available in Port St Lucie, Florida (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293782

13. NJ-based security professional looking for spot with up to 100% travel (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293783

14. Resume - Information Systems Security Professional (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293603

15. INFOSEC Management or Auditing (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293602

16. Network/Security Administrator position wanted in MD (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293601

17. Job Available for Information Security Auditor/Internal Technical Consultant - WebMD, Nashville TN (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293599

18. Job *Offered* : Firewall And VPN Developers Wanted. (SF Bay Area) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293489

19. Network Security Support Engineer Position In Southern Cal. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293484

20. Desired- Position- Network Security or Engineering in SPAIN (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293483

21. Addendum - Ohio Security Infrastructure Manager - Cincinatti (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293482

22. CISSP / Security Analyst looking for oppty in DC Metro Area (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293488

23. Network Security Position in Norther Virginia (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293487

24. Dead Threads (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/293268

VI. INCIDENTS LIST SUMMARY
-------------------------
1. high number of code red events (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294039

2. Unusual volume: UDP:137 probes (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293996

3. maybe a simple problem (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294038

4. question about slapper (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293995

5. slapper changed to udp 1812? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293956

6. Possible remote vulnerability in SSH-1.2.27 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293958

7. Interesting new DDoS method? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293954

8. UDP:137 source IP distribution (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293860

9. Increase in SSH scans (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293828

10. DNS servers outbound connections. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293834

11. IIS Using Port 1843 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293708

12. SV: Unusual volume: UDP:137 probes (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293706

13. Port 137 probes (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293705

14. W2K Compromise - PipeCmdSrv (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293711

15. WinXP integrated packet filtering (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293587

16. Strange random-number.file entries in Apache logs (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293596

17. FW: DNS servers outbound connections. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293570

18. AIM-based worm? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293501

19. E-Card Remote Code Execution Scam (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293474

20. Snake in the grass (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293473

21. Port 608/trojan/spam (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293558

22. VS: slapper worm varient "cinik" (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293406

23. Modap Worm Infection and Subsequent Scanning (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293405

24. new IIS worm? (rcp lsass.exe) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/293403

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Shell code -RVA techniques or something similar (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/293992

2. OpenSSH Vulns (new?) Priv seperation (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/294028

3. Office 97 Word document vulnerability (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/293740

4. dictionary (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/293597

5. Group Policy Disable Command Prompt access (allow scripting), doesn't really disable it. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/293598

6. Need help analyzing apache-scalp code (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/293341

7. Microsoft FrontPage Server Extensions SmartHTML Buffer Overflow Vulnerability (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/293363

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #106 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/293696

IX. SUN FOCUS LIST SUMMARY
----------------------------
No New Posts For The Week Of 9/30/02 - 10/06/02

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. VPN Choices for RedHat 7.3 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/293950

2. openssl (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/293850

XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored By: BorderWare

36 Email Security Risks: are you vulnerable?

There's more to email security than viruses. Find out how your email
systems measure up to emerging threats:

* Malformed messages that disguise malicious code from virus scanners
* New hacks against MS Exchange
* Operating systems vulnerabilities
* Remote access (OWA) exposures

Analysts and auditors are calling for a new breed of product - the Mail
Firewall, a perimeter security appliance to protect internal email systems
from these new attacks.

Check out the industry leader at http://www.mxtreme.com.
-------------------------------------------------------------------------------