SecurityFocus Newsletter #166

John Boletta <[email protected]> Tue, 15 Oct 2002 08:55:15 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #166
-----------------------------

This Issue Sponsored by: Wiley and Sons

SPECIAL FREE PREVIEW OF NEW KEVIN MITNICK BOOK

See what Publishers Weekly called a "tour de force, a series of tales of
how some old-fashioned blarney and high-tech skills can pry any
information from anyone..." For more information and how to order "The Art
of Deception : Controlling the Human Element of Security", visit us at:

http://search.barnesandnoble.com/booksearch/isbnInquiry.asp?userid=5OZAUOSEB
Z&isbn=0471237124&displayonly=excerpt

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Footprints in the Sand, Part One
2. Assessing Internet Security Risk, Part Five: Custom Web Applications
3. Mozilla's 'Code of Silence' Isn't
4. Shutting Down Spyware Loopholes
5. SecurityFocus DPP Program
6. InfoSec World Conference and Expo/2003
II. BUGTRAQ SUMMARY
1. Microsoft Content Management Server 2001 Cross-Site Scripting...
2. VBZoom Arbitrary File Upload Vulnerability
3. phpLinkat Multiple Cross Site Scripting Vulnerabilities
4. BearShare File Disclosure Variant Vulnerability
6. IRIX 'mv' Insecure Directory Permissions Vulnerability
7. IRIX rpcbind Symlink Vulnerability
8. IRIX Insecure Desktop File Permissions Vulnerability
9. IRIX uux Buffer Overflow Vulnerability
10. Cisco Unity Default Restrictions International Operator Call...
11. IRIX fsr_efs Symlink Vulnerability
12. Logsurfer Off-By-One Buffer Overflow Vulnerability
13. Cooolsoft PowerFTP Server Remote Denial Of Service Vulnerability
14. Microsoft IIS IDC Extension Cross Site Scripting Vulnerability
15. Oracle E-Business Suite Authentication Bypassing Vulnerability
16. Oracle 9i Application Server Web Cache Administration Tool...
17. Zope Failed Login Information Disclosure Vulnerability
18. Macromedia Flash Player File Access Vulnerability
19. Killer Protection Information Disclosure Vulnerability.
20. ArGoSoft Mail Server Pro E-Mail HTML Injection Vulnerability
21. Microsoft IIS Malformed HTTP HOST Header Field Denial Of...
22. Symantec VelociRaptor Denial of Service Vulnerability
23. NetBSD talkd Buffer Overflow Vulnerability
24. HP Tru64 Unspecifed Remote Route Daemon Vulnerability
25. TkMail Insecure Temporary Files Vulnerability
26. Multiple Platforms ypserv Remote File Disclosure Vulnerability
27. Multiple Platforms ypxfrd Remote File Disclosure Vulnerability
28. SSGBook Image Tag HTML Injection Vulnerabilities
30. VBZoom Remote SQL Injection Vulnerability
31. Check Point VPN-1 IKE Aggressive Mode Forcing Vulnerability
32. Sendmail Trojan Horse Vulnerability
33. Citrix Published Applications Information Disclosure...
34. PHPBB2 Avatar Images Information Disclosure Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Clues, Vandalism, Litter Sendmail Trojan Trail
2. Outlook Express in crypto processing flaw
3. Scottish ISP in repeat DDoS attack
4. FBI Misused Secret Wiretaps, According to Memo
IV.SECURITYFOCUS TOP 6 TOOLS
1. Modular Access Control System v0.6pre3 alpha
2. libGringotts v1.0.0
3. SEPPL v200210082244
4. Network-Accounting Daemon for Netfilter v0.2.1
5. MudPit v1.0
6. SASL Library v0.0.0
V. SECURITYJOBS LIST SUMMARY
1. VP, Sales - #730 - NJ (Thread)
2. Sr. Information Security Engineer needed ASAP in Orange...
3. experienced UNIX engineer seeking entry level security...
4. Seeking security management or engineering position worldwid...
5. Policy position at NYC firm (Thread)
6. Information Security Sales and Marketing Positions (Thread)
7. Security Consultant wanting Oceania, Pacific, Asia-Pac position...
8. Senior Security Consultant - Canberra, Australia (Thread)
9. Linux Kernel Developer - NW Security Appliance (Thread)
10. Director of Product Management or Sr PM - Security startup...
11. RTOS Embedded Software Engineer - Security Startup (Thread)
12. UT-Austin: InfoSec Office Opening -- Network Security Analyst...
13. VP Engineering - Security Startup (Thread)
14. Security Project Consultant (Thread)
15. CISSP infosec specialist seeking opportunity (Thread)
16. Senior Web Manager Needed (Thread)
17. CORRECTION: London Security Jobs URL (Thread)
18. IS Security engineer (Thread)
19. Security Techncial Lead (Thread)
20. Security Systems Administrator (Thread)
21. Security Compliance and Reporting Lead (Thread)
22. Looking for Security Engineer Position in Turkey/Europe/Middle...
23. Seeking Security Analyst job in San Francisco or East Bay...
24. Firewall Security Engineer (Thread)
25. Sr. Information Security Consultant (Thread)
26. Information Security Architect Opening (Thread)
27. Security Engineer sought, SF Bay Area (Thread)
28. Security/Firewall SE needed in Mid-Atlantic area (Thread)
29. Security Engineer needed (Thread)
VI. INCIDENTS LIST SUMMARY
1. Strange Message (Thread)
2. Forensics CD (Thread)
3. Forensics CD (was: Strange Folder (Thread)
4. CfP: 19C3 Chaos Communication Congress 2002 (Thread)
5. Why can I see other traffic at switch environment just tcpdump?...
6. Interesting Logs to port 8941 (Thread)
7. VS: Why can I see other traffic at switch environment just...
8. Antwort: Forensics CD (was: Re: Strange Folder (Thread)
9. W2K Compromise - PipeCmdSrv (Thread)
10. Strange Folder (Thread)
11. high number of code red events (Thread)
12. maybe a simple problem (Thread)
13. Possible remote vulnerability in SSH-1.2.27 (Thread)
14. Unusual volume: UDP:137 probes (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Covert channel application using libnet and libpcap (Thread)
2. CROSS SITE-SCRIPTING Protection with PHP (Thread)
3. shellcode -> asm? (Thread)
4. CfP: 19C3 Chaos Communication Congress 2002 (Thread)
5. OpenSSH Vulns (new?) Priv seperation (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Can I delete Wscript.exe? (Thread)
2. Security issues, purchasing a new, pre-loaded, Windows XP...
3. Security issues, purchasing a new, pre-loaded, Windows XP com...
4. SecurityFocus Microsoft Newsletter #107 (Thread)
5. Summary (was Security issues ... pre-loaded, Windows XP...
6. FW: Can I delete Wscript.exe? (Thread)
7. AW: Can I delete Wscript.exe? (Thread)
8. Security issues, purchasing a new, pre-loaded, Windows XP...
IX. SUN FOCUS LIST SUMMARY
1. NO NEW POSTS FOR THE WEEK ENDING 10.14.02
X. LINUX FOCUS LIST SUMMARY
1. Continuous medium traffic fake Syn packets (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Footprints in the Sand, Part One - Fingerprinting Exploits in System
and Application Log Files
By Eric Hines, Alan Neville and Joseph Kelly

Forensic analysts must be able to understand and recognize footprints that
exploits leave on system logfiles. Identifying these signatures, is the
key to understanding what took place. This article will focus on the
identification of the footprints that exploits leave on system logfiles
and what they mean, as well as some of the most common traces that some
recent exploits leave.

http://online.securityfocus.com/infocus/1633

2. Assessing Internet Security Risk, Part Five: Custom Web Applications
Continued
by Charl van der Walt

This article is the fifth and final in a series that is designed to help
readers to assess the risk that their Internet-connected systems are
exposed to. In the first installment, we established the reasons for doing
a technical risk assessment. In the second article, we started to discuss
the methodology that we follow in performing this kind of assessment. The
third part discussed methodology in more detail, focussing on visibility
and vulnerability scanning. The fourth installment discussed a relatively
unexplored aspect of Internet security, custom Web applications. This
article will conclude the discussion of security risks of Web
applications.

http://online.securityfocus.com/infocus/1632

3. Mozilla's 'Code of Silence' Isn't
By Jon Lasser

Developers are accused of not publicizing the browser's security
vulnerabilities enough. But do we really need world wide alerts for every
bug?

http://online.securityfocus.com/columnists/114

4. Shutting Down Spyware Loopholes
By Mark Rasch

I have this terrible recurring nightmare. One night, there is a knock on
the door, and Bill Gates and Steve Ballmer are there. When I ask why, they
reply, "We are here for your kidney. Don't you remember the contract you
clicked on when you downloaded the beta version of Internet Explorer?
Don't you read those things?"

http://online.securityfocus.com/columnists/113

5. SecurityFocus DPP Program

Attention Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

6. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud

II. BUGTRAQ SUMMARY
-------------------
1. Microsoft Content Management Server 2001 Cross-Site Scripting Vulnerability
BugTraq ID: 5922
Remote: Yes
Date Published: Oct 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5922
Summary:

Microsoft Content Management Server (MCMS) 2001 is a .NET Enterprise
Server product for development and management of e-business websites.

Microsoft Content Management Server 2001 is reported to be prone to
cross-site scripting attacks.

An attacker could construct a malicious link to a vulnerable host that
contains arbitrary HTML and script code. If this link is visited by a web
user, the attacker-supplied code will be rendered in their browser, in the
security context of the vulnerable site.

This issue is present in the 'ManualLogin.asp' script. An attacker could
inject malicious script code via the 'REASONTXT' URI parameter of the
script.

This vulnerability can be exploited to steal cookie-based credentials from
authenticated users. Other attacks are also possible.

2. VBZoom Arbitrary File Upload Vulnerability
BugTraq ID: 5926
Remote: Yes
Date Published: Oct 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5926
Summary:

VBZoom is a bulletin board system written in PHP.

It has been reported that VBZoom 1.01 may allow attackers to upload
arbitrary files to a vulnerable system.

The vulnerability is the result of VBZoom failing to properly validate the
types of files that are received. Validation is done through the use of
JavaScript on the client side. The vulnerability is present in the
'add-subject.php' script file. An attacker can exploit this vulnerability
by specifying an arbitrary file to be uploaded.

Files uploaded in this manner will be stored on the system in the
'download/' directory. Given the ability to upload arbitrary files to the
host, an attacker can exploit this vulnerability to upload malicious PHP
scripts to the vulnerable system. Any malicious PHP files referenced will
be executed in the security context of the site hosting VBZoom.

This vulnerability has been reported for VBZoom 1.01. It is not known
whether other versions are affected.

3. phpLinkat Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 5890
Remote: Yes
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5890
Summary:

phpLinkat is Web-based link indexing system. It is implemented in PHP, and
available for Windows, Linux and other Unix based systems.

Reportedly, phpLinkat is prone to cross site scripting attacks. The
vulnerabilities are present in the files 'showcat.php' and
'addyoursite.php'.

An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link containing HTML and script code. The
attacker-supplied HTML and script code may be executed on a web client in
the context of the site hosting phpLinkat.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for phpLinkat 0.1.0.

4. BearShare File Disclosure Variant Vulnerability
BugTraq ID: 5888
Remote: Yes
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5888
Summary:

BearShare is a file-sharing utility for Microsoft Windows operating
systems.

BearShare can be run in Website mode, which allows users to host files via
a webserver which is bundled in the product.

The BearShare webserver is prone to directory traversal attacks. This may
allow remote attackers to break out of the web root directory and browse
the filesystem of the host running the software. An attacker may
accomplished this by sending a malicious web request uses URL encoded
values, such as:

http://target:6346/%5c..%5c..%5c..%5cwindows%5cwin.ini

This issue is a variant of the vulnerability described in Bugtraq ID 2672.
The variant issue was unsuccessfully addressed in version 4.0.6. It is
still possible to disclose files with a URL encoded request to the
webserver. The following variant of the attack will still work on
BearShare 4.0.6:

http://target:6346/%5c..%5c..%5c..%5cwindows%5cwin%2eini

5. Microsoft Windows XP System Restore Folder Permissions Weakness
BugTraq ID: 5894
Remote: No
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5894
Summary:

Microsoft Windows XP contains a feature called System Restore that allows
a user to roll the system back to a certain point in case of problems
arising from installation of software or hardware drivers. This feature
stores information in a folder called 'System Volume Information'. This
folder in turn contains subfolders for each restore point, including
registry information that is normally not accessible by an unprivileged
user.

The 'System Volume Information' folder is only accessible by users with
administrative permissions. However, the subfolders within do not contain
any access controls and can be accessed by unpivileged users.

An unprivileged user can obtain the path to these subfolders with a
registry query such as: > reg query
"HKLM\System\CurrentControlSet\Control\BackupRestore\FilesNotToBackup" /v
"System Restore"

Once the user obtains this information, they can browse directly to that
directory, bypassing the access controls on the parent folder. The
unprivileged user will then have full access to all files and folders
contained within that folder.

6. IRIX 'mv' Insecure Directory Permissions Vulnerability
BugTraq ID: 5893
Remote: No
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5893
Summary:

The 'mv' command is a program used to rename files and directories. It is
a standard tool installed by default on most Unix implementations.

A vulnerability has been discovered in the 'mv' command installed on the
IRIX operating system.

Reportedly, when used to rename directories, the 'mv' command fails to
create the new directory with permissions inherited from the previous
directory. The new directory will be created with world-writeable
permissions.

This issue could allow unauthorized users to read and modify sensitive
system files and resources.

7. IRIX rpcbind Symlink Vulnerability
BugTraq ID: 5889
Remote: No
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5889
Summary:

rpcbind is a server that converts RPC program numbers into universal
addresses. It must be running on the host to be able to make RPC calls on
a server on that machine. It is included in the 'eoe.sw.svr4net' package
shipped with IRIX.

A vulnerability has been discovered in rpcbind when using the '-w' switch.
rpcbind incorrectly followings symbolic links, potentially resulting
resulting in arbitrary files being corrupted/overwritten.

The '-w' command line switch is used to enabled a warm boot, which may
allow rpcbind to recover gracefully after being terminated.

When starting rpcbind with the '-w' switch, the program attempts to locate
a registered services list located in files in the /tmp directory. These
files are written to when the rpcbind process receives a SIGINT or SIGTERM
signal. Since rpcbind incorrectly follows symbolic links, this may
possibly result in arbitrary files being corrupted/overwritten when a
SIGINT or SIGTERM signal is received by rpcbind.

Critical files which are writeable by the rpcbind process may be
corrupted, resulting in a denial of service. If an attacker can cause
files to be corrupted with custom data, then it may be possible to elevate
privileges.

It should be noted that rpcbind is included in the 'eoe.sw.svr4net'
package, which is not installed by default.

8. IRIX Insecure Desktop File Permissions Vulnerability
BugTraq ID: 5895
Remote: No
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5895
Summary:

SGI IRIX sets insecure permissions on some temporary files.

SGI has reported that some temporary desktop files in SGI IRIX are
world-writeable. Local attackers may potentially modify or trojan these
files with custom-data.

The impact of this vulnerability depends entirely on the nature of
specific temporary desktop files. This is reported to affect temporary
desktop files in user home directories.

9. IRIX uux Buffer Overflow Vulnerability
BugTraq ID: 5892
Remote: No
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5892
Summary:

The uux is a program used for 'Unix-to-Unix' system command execution, and
is shipped with the IRIX operating system.

A buffer overflow vulnerability has been discovered in the uux program.

The uux utility is installed setgid by default, exploitation of this issue
could result in the execution of arbitrary code with elevated privileges.
The precise technical details regarding the cause of the buffer
overfloware not yet known.

It should be noted that the uux program is part of the eoe.sw.uucp
package, which is not installed by default.

This vulnerability could be similar to the issue described in Bugtraq ID
2947.

10. Cisco Unity Default Restrictions International Operator Call Forwarding Vulnerability
BugTraq ID: 5896
Remote: No
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5896
Summary:

Unity is a Cisco software product designed to unify voice message, fax,
and e-mail into a user's inbox.

A problem with Unity could make it possible for users to make unauthorized
calls.

Under some circumstances, users may be able to forward calls to
unauthorized destinations. The default restrictions implemented by Unity
software prevent users from forwarding calls to operators with the 9 011
prefix. However, this does not prevent forwarding to International
operators.

International operators are typically reachable via the prefix 9 00. By
forwarding calls to this prefix, a user could make an International
Operator-assisted call to any location which would be billed to the site
hosting the Unity software. It should be noted that an attacker must have
access to an account on the vulnerable Unity system to exploit this issue.

11. IRIX fsr_efs Symlink Vulnerability
BugTraq ID: 5897
Remote: No
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5897
Summary:

fsr_efs is a utility that improves the organization of mounted EFS
filesystems. It is included in the eoe.sw.base package which is installed
by default on the IRIX operating system.

A vulnerability has been discovered in the fsr_efs utility.

fsr_efs writes information regarding the filesystem to /var/tmp/.fsrlast,
which it later references, when run again, to see where filesystem
reorganization left off.

It has been reported by SGI that fsr_efs incorrectly follows symbolic
links when accessing the /var/tmp/.fsrlast file.

This issue could be exploited by a malicious user and critical files which
are writeable by the fsr_efs process may be corrupted, resulting in a
denial of service.

12. Logsurfer Off-By-One Buffer Overflow Vulnerability
BugTraq ID: 5898
Remote: Yes
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5898
Summary:

Logsurfer is a log parsing program, similar to swatch, available for Unix
and Linux.

A vulnerability has been discovered in Logsurfer.

Reportedly under some circumstances, a malformed log entry could trigger
an off-by-one buffer overflow condition. The problem occurs when
calculating matched string lengths, and is located in the context_action()
function in context.c. Triggering the overflow will result in the
corruption of memory located in the heap. Under some cirumstances this may
result in the logsurfer process terminating.

Although not confirmed, it may also be possible for an attaker to cause
aribtrary code to be executed.

13. Cooolsoft PowerFTP Server Remote Denial Of Service Vulnerability
BugTraq ID: 5899
Remote: Yes
Date Published: Oct 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5899
Summary:

PowerFTP server is a shareware ftp server available for the Microsoft
Windows platform. It is distributed and maintained by Cooolsoft.

A problem with PowerFTP server could make it possible for remote users to
deny service to legitimate users of the server.

It has been reported that PowerFTP server does not properly handle long
user names. When a user name of 3000 or more characters is entered, the
server becomes unstable. Exploitation of this vulnerability typically
results in a crash of the server, requiring a manual restart to resume FTP
service.

It is possible that this vulnerability is an exploitable buffer overflow.
If this overflow does prove to be exploitable, a user could execute
arbitrary code with the privileges of the PowerFTP server. This service
would typically run with SYSTEM privileges.

14. Microsoft IIS IDC Extension Cross Site Scripting Vulnerability
BugTraq ID: 5900
Remote: Yes
Date Published: Oct 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5900
Summary:

A vulnerability in Microsoft Internet Information Server (IIS) may make
cross-site scripting attacks possible.

A problem has been reported in the Microsoft IIS Internet Database
Connector (.idc) file handling. idc files are a component of the
Microsoft Frontpage infrastructure. idc files are used to facilitate
communication with Microsoft Databases, and supply information to the web
server.

When IIS receives a request for an .idc file, the server typically returns
a 404 message when the page does not exist. However, when a request
containing a long URL and ending in the .idc extension is received by IIS,
the entire contents of the URL are returned on the error page without the
sanitizing of input. This could result in the execution of arbitrary
script code.

This vulnerability could allow an attacker to execute script code in the
security context of a vulnerable site. This vulnerability requires that
an URL of 334 bytes followed by script code in the URL be entered to be
exploited. It is not known if this vulnerability affects previous version
of IIS.

15. Oracle E-Business Suite Authentication Bypassing Vulnerability
BugTraq ID: 5901
Remote: Yes
Date Published: Oct 06 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5901
Summary:

E-Business Suite is an online business software package distributed and
maintained by Oracle.

A problem with E-Business Suite may make it possible for unauthorized
remote users to gain access.

It has been reported that a flaw in some patch levels of E-Business Suite
allow the bypassing of user authentication. The flaw, contained in the
AolSecurityPrivate.class file, could make it possible for a user with
knowledge of the E-Business Suite implementation to bypass authentication.

It should be noted that this vulnerability occurs only in systems with
AolSecurityPrivate.class files between the versions of 115.7 and 115.18.
This file is typically archived in the $JAVA_TOP directory in the apps.zip
archive.

16. Oracle 9i Application Server Web Cache Administration Tool Denial Of Service Vulnerability
BugTraq ID: 5902
Remote: Yes
Date Published: Oct 06 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5902
Summary:

Oracle 9i Application Server (9iAS) allows remote administration via a web
access module. This vulnerability affects Oracle 9iAS running on
Microsoft Windows.

It has been reported that an issue in the Web Administration module
included with 9iAS could lead to a denial of service.

When a custom request is sent to the Web Administration module, the module
may react unpredictably. By sending a malicious custom request to the
module, it is possible to cause the administration server to crash. A
manual restart of the server is required to resume service.

It should be noted that this issue only affects the web administration
module. The web administration module runs on it's on dedicated port.

17. Zope Failed Login Information Disclosure Vulnerability
BugTraq ID: 5903
Remote: Yes
Date Published: Oct 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5903
Summary:

Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.

Reportedly, Zope will disclose path information if a user hits 'Cancel'
after a failed login attempt to the management interface. This
information is leaked in a stack trace that is output after the error.

If an attacker can gain information about the details of the filesystem,
this information may be useful in further attacks against the host.

18. Macromedia Flash Player File Access Vulnerability
BugTraq ID: 5904
Remote: Yes
Date Published: Oct 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5904
Summary:

Macromedia Flash is a modular package designed to enhance web browsing and
enables users to view various multimedia web content. An error has been
reported in some versions of the Flash player. Malicious Flash animations
may be able to read arbitrary local files.

The vulnerability is due to an error in Flash Player when loading
animations from remote SMB network shares. When Flash Player loads an
animation from a SMB network share, it is treated as though it was loaded
from a user's local hard drive.

This vulnerability may allow an attacker to cause Flash Player to read the
contents of local files through Flash Player's XML control.

An attacker can exploit this vulnerability by enticing a victim user to
download and view a malicious flash animation. When loaded, the malicious
flash animation will cause Flash Player to read the contents of known
local files. Information obtained in this manner may allow an attacker to
launch further, potentially destructive, attacks against a vulnerable
system.

19. Killer Protection Information Disclosure Vulnerability.
BugTraq ID: 5905
Remote: Yes
Date Published: Oct 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5905
Summary:

Killer Protection is a script meant to protect sensitive information on a
webpage.

A vulnerability has been discovred in Killer Protection.

Reportedly, it is possible for unauthorized users to access the
'vars.inc', which Killer Protection uses to store user credentials. Using
the information from this file, and attacker could login to sensitive
pages as an arbitrary user.

The 'vars.inc' file can be accessed by specifying the full path and
filename in a malicously crafted HTTP request.

Information gathered from exploiting this issue could be used by the
attacker to further compromise sensitive webpages.

20. ArGoSoft Mail Server Pro E-Mail HTML Injection Vulnerability
BugTraq ID: 5906
Remote: Yes
Date Published: Oct 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5906
Summary:

ArGoSoft Mail Server is an SMTP, POP3 and Finger server for Microsoft
Windows environments. ArGoSoft has a built-in webserver to enable remote
access to mail.

The ArGoSoft Mail Server Pro web mail system does not sufficiently
sanitize HTML from e-mail messages. It is possible for a remote attacker
to inject arbitrary HTML and script code into e-mail messages, which will
be rendered in the user's web client when the malicious message is viewed.
The attacker-supplied code will execute in the context of the site hosting
the web mail system.

A remote attacker could potentially exploit this condition to steal
cookie-based authentication credentials from a legitimate user of the web
mail system. Additionally, it has been reported that user credentials are
stored in plaintext in cookies. An attacker could use these credentials
to gain unauthorized access to web mail accounts.

21. Microsoft IIS Malformed HTTP HOST Header Field Denial Of Service Vulnerability
BugTraq ID: 5907
Remote: Yes
Date Published: Oct 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5907
Summary:

Microsoft Internet Information Server (IIS) is reported to be prone to a
remotely exploitable denial of service.

This condition occurs upon receipt of a malformed HOST field in a HTTP
request for 'shtml.dll'. It is possible to reproduce this condition by
sending a HTTP POST request with a HOST header field that is composed of
an excessive number of slashes (/). It is reported that the server will
not respond to the request in a timely manner. Further disruption of
service may also occur.

The problem likely exists in 'shtml.dll' and may be reproducible via other
types of malformed requests.

Further details are not known at this time. This entry will be updated if
further details become available.

22. Symantec VelociRaptor Denial of Service Vulnerability
BugTraq ID: 5909
Remote: Yes
Date Published: Oct 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5909
Summary:

VelociRaptor Firewall is an enterprise level firewall originally developed
by Axent Technologies and is maintained and distributed by Symantec. It is
available for Microsoft Windows and Unix operating systems.

Symantec has reported that VelociRaptor firewalls are vulnerable to a
memory leak bug, that could potentially result in a denial of service
attack. Other security issues may also exist that were also corrected by
the fix.

Precise technical details regarding this bug are still unknown. Updates
will occur as more information regarding this issue becomes available.

23. NetBSD talkd Buffer Overflow Vulnerability
BugTraq ID: 5910
Remote: No
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5910
Summary:

talkd is a client-server application shipped with many Unix and Linux
variants that is used for communication between users locally or remotely.

A buffer overflow vulnerability has been reported for the talkd service
shipped with NetBSD. Reportedly, the talkd service does not perform proper
bounds checking on inbound messages before copying data to a destination
buffer. Specifically, the vulnerability occurs in the find_user() function
in the 'libexec/talkd/process.c' source file.

An attacker can exploit this vulnerability to obtain elevated privileges
on a vulnerable system.

As this vulnerability is due to a buffer overflow condition, it is
possible for a malicious attacker to cause talkd to execute code. This,
however, has not been confirmed.

talkd ships as a core component for a number of Linux and Unix variants
and is independently maintained by the various distributions, so it is
highly probable that many other operating systems are affected by this
vulnerability.

24. HP Tru64 Unspecifed Remote Route Daemon Vulnerability
BugTraq ID: 5913
Remote: Yes
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5913
Summary:

Tru64 is the Unix Operating System variant originally developed by DEC,
and now distributed and maintained by HP.

A problem with Tru64 may allow remote users to gain unauthorized access to
resources.

A problem has been reported in the route daemon (routed) that may allow
users to gain unauthorized access to files. This vulnerability has been
reported as being a remotely exploitable issue. Few details are available
about this vulnerability.

As routed is typically a privileged process, this problem could make
exploitation of the daemon useful in gaining access to sensitive system
files. Exploitation of this vulnerability to read files could allow an
attacker to gain access to the shadow file, or other root-owned files
containing sensitive information.

25. TkMail Insecure Temporary Files Vulnerability
BugTraq ID: 5911
Remote: No
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5911
Summary:

TkMail is a X Windows based e-mail client implemented with Perl and
Tcl/Tk.

TkMail creates temporary files in an insecure manner. When the client
attempts to create a temporary file, it does not check to see if the file
already exists. Additionally, it will follow symbolic links.

A locally based attacker could create a malicious symlink pointing to an
arbitrary file, in place of one of the temporary files created by TkMail.

An attacker could exploit this issue to cause files owned by the user
running the client to be overwritten.

26. Multiple Platforms ypserv Remote File Disclosure Vulnerability
BugTraq ID: 5914
Remote: Yes
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5914
Summary:

ypserv is a Network Information Service (NIS) server, available on unix
operating systems.

HP has announced that the ypserv server is vulnerable to a file disclosure
bug.

Reportedly, by exploiting this issue, it may be possible for a local or
remote attacker to gain unauthorized read access to sensitive files
located on the YP server.

Precise technical details regarding this vulnerability are unknown at this
time. This bid will be updated as more information is made available.

27. Multiple Platforms ypxfrd Remote File Disclosure Vulnerability
BugTraq ID: 5912
Remote: Yes
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5912
Summary:

ypxfrd is a NIS map transfer daemon, available on unix operating systems.

HP has announced that the ypxfrd deamon is vulnerable to a file disclosure
bug.

Reportedly, by exploiting this issue, it may be possible for a local or
remote attacker to gain unauthorized read access to sensitive files
located on the YP server.

Precise technical details regarding this vulnerability are unknown at this
time. This bid will be updated as more information is made available.

28. SSGBook Image Tag HTML Injection Vulnerabilities
BugTraq ID: 5915
Remote: Yes
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5915
Summary:

SSGbook is guestbook software implemented in ASP.

SSGbook includes codes for allowing users to specify HTML formatting and
layout inside of guestbook entries. For example, a user can include an
image by including it inside of [image] or [img] tags. However, arbitrary
HTML and script code are not sufficiently sanitized in these tags.

As a result, users may include malicious HTML and script code inside of
guestbook entries. The attacker-supplied code will be rendered in the web
client of the user who views a malicious guestbook entry, and will be
executed in the security context of the site hosting the guestbook
software.

If administrative access is enabled in the software, this may allow the
attacker to steal cookie-based authentication credentials from the
administrative guestbook user. Other attacks are also possible.

29. Multiple Vendor PC Firewall Auto Block Denial Of Service Weakness
BugTraq ID: 5917
Remote: Yes
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5917
Summary:

A weakness has been reported in some PC Firewall packages that could allow
remote denial of service attacks. The problem is in the handling of
spoofed traffic.

Various PC Firewall packages include an auto block option. This option is
designed to automatically add a rule to block traffic from a host when
traffic meeting the criteria of being malicious according to the signature
database is encountered. Once traffic from a host is encountered that is
deemed malicious, a rule is automatically added, and any further traffic
received from the host is automatically blocked.

Under some circumstances, it is possible for remote users to deny service
to various sites for users of PC Firewall software. By sending spoofed
traffic that could be deemed malicious by the firewall software package,
an attacker could effectively limit the sites a system is capable of
reaching. This could result in a denial of service which would only be
resolved when the firewall rules are removed manually.

30. VBZoom Remote SQL Injection Vulnerability
BugTraq ID: 5919
Remote: Yes
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5919
Summary:

VBZoom is a bulletin board system written in PHP.

A SQL injection vulnerability has been discovered in VBZoom v1.01.

Due to insufficient sanitization of variables used to construct the SQL
query in the register.php file, it is possible for an attacker to reset an
arbitrary user's password.

By submitting malicious form data to register.php, which sets the value of
the $ChangeProfile variable to a value of '1', it is possible for an
attacker to access a SQL query. From this point an attacker can influence
that the data is included in the query.

The nature of this issue may enable an attacker to corrupt the underlying
database.

31. Check Point VPN-1 IKE Aggressive Mode Forcing Vulnerability
BugTraq ID: 5920
Remote: Yes
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5920
Summary:

VPN-1 is the firewall and virtual private network software package
distributed by Check Point Software Technologies.

A problem with VPN-1 could make it possible for users to arbitrarily
reveal sensitive information.

VPN-1 supports the IKE standard aggressive mode when establishing a
session. This mode may also be changed to the normal session mode, or the
Check Point-specific Hybrid Mode. This prevents connecting hosts from
inadvertently revealing potentially sensitive data.

Under some circumstances, VPN-1 can be forced into negotiating sessions in
aggressive mode. If the system has been configured to a mode other than
aggressive, and a user attempts to establish a session using aggressive
mode, VPN-1 will negotiate the session. This may result in the disclosure
of sensitive information.

32. Sendmail Trojan Horse Vulnerability
BugTraq ID: 5921
Remote: Yes
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5921
Summary:

Sendmail is a freely available mail transport agent. It is distributed and
maintained by the Sendmail Consortium.

Reportedly, the server hosting sendmail, ftp.sendmail.org, was compromised
recently. It has been reported that the intruder made modifications to the
source code of sendmail to include trojan horse code. Downloads of the
sendmail source code from ftp.sendmail.org between September 28, 2002 and
October 6, 2002 likely contain the trojan code.

Reports say that the trojan will run once upon compilation of sendmail.
Once the trojan is executed, it attempts to connect to host
spatula.aclue.com (66.37.138.99) on port 6667.

Although unconfirmed, it has been reported that the service listening on
port 6667 of host spatula.aclue.com (66.37.138.99) has been disabled.

It has also been reported that versions of sendmail available via HTTP
distribution on the Sendmail Consortium site are not affected.

It is not known whether, or what other sites are affected in addition to
ftp.sendmail.org.

The Sendmail Consortium has signed all valid distributions of the sendmail
software with the following PGP key:

pub 1024R/678C0A03 2001-12-18 Sendmail Signing Key/2002
<[email protected]> Key fingerprint = 7B 02 F4 AA FC C0 22 DA 47 3E 2A
9A 9B 35 22 45

Additionally, the following checksums have been made available to verify
packages against:

73e18ea78b2386b774963c8472cbd309 sendmail.8.12.6.tar.gz
cebe3fa43731b315908f44889d9d2137 sendmail.8.12.6.tar.Z
8b9c78122044f4e4744fc447eeafef34 sendmail.8.12.6.tar.sig

33. Citrix Published Applications Information Disclosure Vulnerability
BugTraq ID: 5908
Remote: Yes
Date Published: Oct 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5908
Summary:

Citrix is a popular Remote Desktop application. Client access is
facilitated via the Citrix ICA Client, which is freely available.

A vulnerability has been discovered in Citrix.

Reportedly, it is possible for an attacker to determine Published
Applications by sending the server specially crafted requests, and
examining server responses.

Requesting an invalid Published Application will result in a 32 byte
packet respones from the Citrix server, whereas requesting a valid
Published Application will result in a 64 byte response.

It is possible to use this information to bruteforce a Citrix servers
Published Application list. By accessing this information it may be
possible for an attacker to launch further attacks against the server.

34. PHPBB2 Avatar Images Information Disclosure Vulnerability
BugTraq ID: 5923
Remote: Yes
Date Published: Oct 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5923
Summary:

phpBB2 is an open-source web forum application that is written in PHP and
backended by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

It has been reported that phpBB2 reveals a user's IP address. This
vulnerability is due to phpBB2's file naming scheme for avatar files.
Avatar files are typically GIF images files uploaded by users that wish to
personalize their posts.

When a user elects to upload an avatar file to a system using phpBB2, the
system will save the file with a random name. This random name consists of
the user's IP address, encoded in hexadecimal values, followed by other
characters.

A malicious attacker can exploit this vulnerability to find out IP
addresses of the users of the system hosting phpBB2. This information may
be used by attackers to launch attacks against users of the system hosting
phpBB2 forums.

This vulnerability was reported for phpBB2 2.0.0 to 2.0.3. Other versions
may also be affected.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. Clues, Vandalism, Litter Sendmail Trojan Trail
By Kevin Poulsen

The backdoor secretly distributed with the popular mail server is linked
to an earlier hack, but miscues in the alerting process may have let the
culprits cover their tracks.

http://online.securityfocus.com/news/1113

2. Outlook Express in crypto processing flaw
By John Leyden, The Register

Code used to authenticate messages to Outlook Express users might be
turned against them by attackers to run hostile code on victims' machines.

http://online.securityfocus.com/news/1127

3. Scottish ISP in repeat DDoS attack
By John Lettice, The Register

Edinburgh-based ISP edNET was hit by a distributed denial of service
attack, again.

http://online.securityfocus.com/news/1126

4. FBI Misused Secret Wiretaps, According to Memo
By Dan Eggen, Washington Post

The FBI illegally videotaped suspects, improperly recorded telephone calls
and intercepted e-mails without court permission in more than a dozen
secret terrorism and intelligence investigations, according to an internal
memorandum obtained by a member of Congress.

http://online.securityfocus.com/news/1105

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Modular Access Control System v0.6pre3 alpha
by Mario D. Santana
Relevant URL:
http://macs.sf.net/
Platforms: Os Independent
Summary:

Modular Access Control System (MACS) is a system for global
authentication, authorization, user/group/resource management, and
application services.

2. libGringotts v1.0.0
by Germano Rizzo
Relevant URL:
http://prosa.com/people/grizzo/libgringotts/index.php?page=home
Platforms: POSIX, UNIX
Summary:

libGringotts is a small, easy-to-use, thread-safe C library originally
developed for Gringotts. Its purpose is to encapsulate data in an
encrypted and compressed file. It uses strong encryption algorithms
(RIJNDAEL 128/256, SERPENT, TWOFISH, CAST256, SAFER+, LOKI97, and 3DES) to
ensure the data are as safe as possible, and allow the user to have the
complete control over all the encryption, hashing, and compression
algorithms used in the process. It also provides functions for encrypting
temporary files and to securely manage memory.

3. SEPPL v200210082244
by Mezcalero
Relevant URL:
http://www.ring2.org/seppl/
Platforms: Linux, POSIX
Summary:

SEPPL is both a protocol definition and a software implementation of a new
encryption layer for IPv4. It is extremely leightweight and easy to use.
It is implemented for the Linux kernel and makes use of netfiler and the
Linux CryptoAPI. It is intended as a software replacement for WEP but may
be used on non-wireless lans as well. It even fits for VPN solutions.

4. Network-Accounting Daemon for Netfilter v0.2.1
by Hilko Bengen
Relevant URL:
https://savannah.nongnu.org/projects/ulog-acctd/
Platforms: Linux, POSIX
Summary:

ulog-acctd is a userspace network accounting daemon which generates log
files of network traffic for accounting purposes. It collects headers of
IP packets that travel through the Linux 2.4+ netfilter. It writes
accounting information to a log which can include protocol type, source
and destination address, port numbers, byte and packet count, and incoming
and outgoing interfaces. It is easily possible to generate CISCO "IP
accounting output packets" style logs with this tool.

5. MudPit v1.0
by Gene Savchuk [email protected]
Relevant URL:
http://www.fidelissec.com/mudpit/
Platforms: Linux, POSIX
Summary:

MudPit is a spool processor for the Snort intrusion detection system. It
is similar to the Barnyard project, but is able to process both log and
alert streams at the same time. It is simple, modular, and reliable.

6. SASL Library v0.0.0
by Simon Josefsson
Relevant URL:
http://josefsson.org/libgsasl/
Platforms: POSIX
Summary:

Libgsasl is a library that implements the IETF Simple Authentication and
Security Layer (SASL) framework and some SASL mechanisms. SASL is used in
servers (e.g. IMAP, SMTP, etc.) to request authentication from clients,
and in clients to authenticate against servers.

V. SECURITY JOBS SUMMARY
------------------------
1. VP, Sales - #730 - NJ (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294828

2. Sr. Information Security Engineer needed ASAP in Orange County, CA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294827

3. experienced UNIX engineer seeking entry level security position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294693

4. Seeking security management or engineering position worldwide (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294728

5. Policy position at NYC firm (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294589

6. Information Security Sales and Marketing Positions (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294564

7. Security Consultant wanting Oceania, Pacific, Asia-Pac position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294512

8. Senior Security Consultant - Canberra, Australia (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294516

9. Linux Kernel Developer - NW Security Appliance (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294515

10. Director of Product Management or Sr PM - Security startup (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294510

11. RTOS Embedded Software Engineer - Security Startup (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294514

12. UT-Austin: InfoSec Office Opening -- Network Security Analyst (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294511

13. VP Engineering - Security Startup (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294513

14. Security Project Consultant (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294439

15. CISSP infosec specialist seeking opportunity (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294438

16. Senior Web Manager Needed (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294436

17. CORRECTION: London Security Jobs URL (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294444

18. IS Security engineer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294327

19. Security Techncial Lead (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294359

20. Security Systems Administrator (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294269

21. Security Compliance and Reporting Lead (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294391

22. Looking for Security Engineer Position in Turkey/Europe/Middle East (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294273

23. Seeking Security Analyst job in San Francisco or East Bay (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294575

24. Firewall Security Engineer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294264

25. Sr. Information Security Consultant (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294397

26. Information Security Architect Opening (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294379

27. Security Engineer sought, SF Bay Area (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294254

28. Security/Firewall SE needed in Mid-Atlantic area (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294373

29. Security Engineer needed (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294179

VI. INCIDENTS LIST SUMMARY
-------------------------
1. Strange Message (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294825

2. Forensics CD (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294699

3. Forensics CD (was: Strange Folder (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294682

4. CfP: 19C3 Chaos Communication Congress 2002 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294617

5. Why can I see other traffic at switch environment just tcpdump? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294633

6. Interesting Logs to port 8941 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294618

7. VS: Why can I see other traffic at switch environment just tcpdump? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294616

8. Antwort: Forensics CD (was: Re: Strange Folder (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294608

9. W2K Compromise - PipeCmdSrv (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294477

10. Strange Folder (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294319

11. high number of code red events (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294294

12. maybe a simple problem (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294171

13. Possible remote vulnerability in SSH-1.2.27 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294168

14. Unusual volume: UDP:137 probes (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/294167

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Covert channel application using libnet and libpcap (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/294818

2. CROSS SITE-SCRIPTING Protection with PHP (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/294758

3. shellcode -> asm? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/294592

4. CfP: 19C3 Chaos Communication Congress 2002 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/294586

5. OpenSSH Vulns (new?) Priv seperation (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/294434

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Can I delete Wscript.exe? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/294385

2. Security issues, purchasing a new, pre-loaded, Windows XP computer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/294415

3. Security issues, purchasing a new, pre-loaded, Windows XP com puter (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/294386

4. SecurityFocus Microsoft Newsletter #107 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/294239

5. Summary (was Security issues ... pre-loaded, Windows XP computer) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/294260

6. FW: Can I delete Wscript.exe? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/294262

7. AW: Can I delete Wscript.exe? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/294296

8. Security issues, purchasing a new, pre-loaded, Windows XP computer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/294293

IX. SUN FOCUS LIST SUMMARY
----------------------------
1. NO NEW POSTS FOR THE WEEK ENDING 10.14.02

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Continuous medium traffic fake Syn packets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/294722

XI. SPONSOR INFORMATION
-----------------------
This Issue Sponsored by: Wiley and Sons

SPECIAL FREE PREVIEW OF NEW KEVIN MITNICK BOOK

http://search.barnesandnoble.com/booksearch/isbnInquiry.asp?userid=5OZAUOSEB
Z&isbn=0471237124&displayonly=excerpt

-------------------------------------------------------------------------------