SecurityFocus Newsletter #167

John Boletta <[email protected]> Mon, 21 Oct 2002 13:01:29 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #167
-----------------------------

This Issue Is Sponsored By: Wiley & Sons

SAVE 40% ON KEVIN MITNICK'S NEW BOOK

THE ART OF DECEPTION, the explosive new book from Kevin Mitnick, is
available now, and for a limited time, you can get it for 30% off the
cover price. Don't miss the book that made Bruce Schneier say, "The bad
guys don't need to read this book. But the good guys need to know what
the criminals are doing."

For more information, visit www.amazon.com/mitnick

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Security Concerns in Licensing Agreements, Part Two...
2. Polymorphic Macro Viruses, Part One
3. Identifying and Tracking Emerging and Subversive Worms...
4. Stupid Bugbear Tricks
5. Ten Things to Do With IIS
6. SecurityFocus DPP Program
7. InfoSec World Conference and Expo/2003
II. BUGTRAQ SUMMARY
1. SquirrelMail Options.PHP Web Root Path Disclosure Vulnerability
2. OpenOffice Installation Insecure Temporary File Symbolic Link...
3. KDE KPF Icon Option File Disclosure Vulnerability
4. Microsoft TSAC ActiveX Control Cross Site Scripting Vulnerability
5. PHPNuke Multiple Script Code Filtering Vulnerabilities
6. My Web Server Long Get Request Denial Of Service Vulnerability
7. Linux-HA Heartbeat Remote Buffer Overflow Vulnerability
8. ATP httpd Single Byte Buffer Overflow Vulnerability
9. Meunity Script Injection Vulnerability
10. Multiple Symantec HTTP Proxy Denial of Service Vulnerability
11. Multiple Symantec HTTP Proxy Information Disclosure Vulnerability
12. ghttpd Log() Function Buffer Overflow Vulnerability
13. TelCondex SimpleWebServer Denial Of Service Vulnerability
14. Polycom ViaVideo Denial Of Service Vulnerability
15. Microsoft Internet Explorer Unauthorized Document Object Model...
16. Polycom ViaVideo Buffer Overflow Vulnerability
17. Avaya Cajun Firmware Undocumented Default Accounts...
18. RadioBird Software WebServer 4 All Buffer Overflow Vulnerability
19. RadioBird Software WebServer 4 All Directory Traversal...
21. Ingenium Learning Management System Information Disclosure
22. Microsoft Windows 2000/XP Full Event Log Administrative Alert...
23. BEA WebLogic Server/Express/Integration Application Migration...
24. CoolForum Source Disclosure Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Secure Linux desktop begins shipping to UK police force
2. Cisco Catalyst switches in DoS risk
3. UK firm touts alternative to digital certs
4. MS beta site cracked
IV.SECURITYFOCUS TOP 6 TOOLS
1. Minimal-router v1.0
2. JSch v0.0.1
3. Packit v0.3.5
4. MAIL PASSWORD RECOVERY v1.0.0.0
5. Project SCIM v1.6
6. auditunlink v0.0.1
V. SECURITYJOBS LIST SUMMARY
1. (Seeker) D.C. Area - UNIX/Win/Mac Admin w/ INFOSEC (Thread)
2. Permanent Security Management Engineer role UK Essex (Thread)
3. Contract Opportunitites: SCADA Vulnerability Assessment and...
4. Security S/W Developer Wanted in Vienna, Austria (Thread)
5. Security Professional Looking for Employment (Thread)
6. Seeking QA Engineer (Thread)
7. Looking for a security job in the Washington DC metro area...
8. Managed Security Services Developer (Thread)
9. Strong Security/Software Engineer needed @ Intruvert (Thread)
10. Computer Incident Response Team Job (Thread)
11. WhiteHat Security seeks Silicon Valley Perl Developer (Thread)
12. consultant with too much time (Thread)
13. Security Engineer -- St. Louis, Winston-Salem or Atlanta (Thread)
14. Seeking a Director of Security Architecture - Product...
15. VP, Sales - #730 - NJ (Thread)
16. Security Sales Person (Thread)
17. work with S E C U R I T Y sales/SE recruiting specialist (Thread)
18. pki, vpn engineer available asap (Thread)
19. Sr. Information Security Engineer needed ASAP in Orange County...
20. pki systems engineer and technical support (Thread)
VI. INCIDENTS LIST SUMMARY
1. DoS and Windows Login (Thread)
2. HTTP attack looking for /sumthin ? (Thread)
3. Source of Windows PopUp SPAM (Thread)
4. Slapper worm "ink" instead of "cinik" (Re: slapper worm varient...
5. apache problem (Thread)
6. Linux Kernel Exploits / ABFrag (Thread)
7. Help me identify this IIS DoS attack (Thread)
8. Security problem in installation IE sp1 ? (Thread)
9. Cacheflow proxy abuse (was: no subject) (Thread)
11. ...continuing saga of Windows Messenger SPAM, was re: (blank)...
12. popup msg spamming (Thread)
13. RPC-Spam issue, was => (Thread)
14. RES: SNMP vulnerability test? (Thread)
15. MD5 mystery (Thread)
16. Strange Message (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Covert Channels (Thread)
2. Application Vulnerability Analysis (Thread)
3. CROSS SITE-SCRIPTING Protection with PHP (Thread)
4. Designing Shellcode Demystified (Thread)
5. /instmsg/alias/annoying_web_logs ;) (Thread)
6. Hashes,File protection,etc (Thread)
7. shellcode -> asm? (Thread)
8. CALL FOR PAPERS - SANTA DIED LAST YEAR (Thread)
9. Covert channel application using libnet and libpcap (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Win2K Security Training (Thread)
2. SecurityFocus Microsoft Newsletter #108 (Thread)
3. Can I delete Wscript.exe? (Thread)
4. Updated Patches with SUS. (Thread)
IX. SUN FOCUS LIST SUMMARY
1. No New Posts For The Week Ending 10.21.02
X. LINUX FOCUS LIST SUMMARY
1. Continuous medium traffic fake Syn packets (Thread)
2. Followup: Continuous medium traffic fake Syn packets (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Security Concerns in Licensing Agreements, Part Two: Negotiating
Security Provisions
by Steven Robinson last updated October 21, 2002

In the first article in this series, we looked at security concerns
related to clickwrap and shrinkwrap agreements, used by vendors for
mass-market licenses and service agreements. In these cases, no
negotiations are involved. If you want what the vendor is selling, you are
required to agree to "a one size fits all" agreement, including whatever
provisions it contains, if any, that pertain to information security. This
type of agreement is typical of the licensing agreements that individual
users and small organizations enter into.

http://wwwdev.securityfocus.com/infocus/1636

2. Polymorphic Macro Viruses, Part One
By Gabor Szappanos

Polymorphic viruses change their code in fundamental ways, such as
changing the encryption routine or the sequence of instructions, in order
to avoid detection by anti-virus scanners. This article is the first of a
two-part series that will offer a brief overview of the use of polymorphic
strategies in macro viruses.

http://online.securityfocus.com/infocus/1635

3. Identifying and Tracking Emerging and Subversive Worms Using
Distributed Intrusion Detection Systems
by Nathan Einwechter

Worms continually become more sophisticated, as new propagation methods
and stealth techniques are developed and implemented. As worms continue to
evolve, so must our ability to detect and track them. One solution is the
use of distributed intrusion detection systems (dIDS) to identify new and
emerging worms that utilize new subversive propagation techniques. This
paper will discuss how and why the dIDS design is able to identify,
detect, and track worms even as they implement more advanced propagation
methods.

http://online.securityfocus.com/infocus/1634

4. Stupid Bugbear Tricks
By George Smith

Despite the virus' success at slamming unwary netizens, there's evidence
that its author is no rocket scientist.

http://online.securityfocus.com/columnists/116

5. Ten Things to Do With IIS
by Matt J. Foley ([email protected])

As an IIS administrator it sometimes gets downright annoying having to
fend off all the insults from Apache admins I meet claming innate server
superiority. Generally the discussion about Web administration starts
first with all the various security holes plaguing IIS and the negative
press the platform garnered over the last year.

http://online.securityfocus.com/guest/16819

6. SecurityFocus DPP Program

Attention Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

7. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud

II. BUGTRAQ SUMMARY
-------------------
1. SquirrelMail Options.PHP Web Root Path Disclosure Vulnerability
BugTraq ID: 5949
Remote: Yes
Date Published: Oct 11 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5949
Summary:

SquirrelMail is a feature rich webmail program implemented in the PHP4
language. It is available for Linux and Unix based operating systems.

A problem with SquirrelMail could make it possible for an attacker to gain
sensitive information.

Under some conditions, SquirrelMail may reveal sensitive configuration
information. When a malformed 'optpage' file argument is given to the
'options.php' script,an error page will be generated. The error page
returned contains absolute pathname of the options.php script.

An attacker can exploit this vulnerability to obtain potentially sensitive
information about a vulnerable system. Information obtained in this manner
may be used by an attacker to launch further, potentially destructive,
attacks against a vulnerable system.

This vulnerability was reported for SquirrelMail 1.2.7.

2. OpenOffice Installation Insecure Temporary File Symbolic Link Vulnerability
BugTraq ID: 5950
Remote: No
Date Published: Oct 11 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5950
Summary:

OpenOffice is an open source office software package distributed and
maintained by the OpenOffice project. It is available for Unix, Linux,
and Microsoft Windows operating systems.

A problem with OpenOffice could make it possible for a local user to
destroy arbitrary files. This vulnerability only affects Unix and Linux
systems.

When OpenOffice is installed, it insecurely creates temporary files.
Temporary files created by the office suite are created with a predictable
file name. Additionally, a check is not performed prior to the attempted
writing to the file. This could result in the destruction of files with
the permissions of the user installation OpenOffice if attackers create
symbolic links with the correct filename.

The vulnerable file is typically created as
/tmp/$USERNAME_autoresponse.conf, where $USERNAME is the name of the user
installing the office suite. It should be noted that the office suite is
typically installed by the administrative user.

3. KDE KPF Icon Option File Disclosure Vulnerability
BugTraq ID: 5951
Remote: Yes
Date Published: Oct 11 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5951
Summary:

kpf is a file sharing utility shipped with the KDE desktop. It uses a
subset of the HTTP protocol internally and acts much similiar to a
webserver. KDE is available for the Linux operating system.

A vulnerability has been discovered in the kpf file sharing utility.

It has been reported that by passing a malicious file request to kpf, it
is possible for a remote attacker to gain access to files outside of the
'shared directory' root. The ability to read files outside of the shared
root directory would be dependent upon the privileges of the kpf process.

The problem is in the handling of the '?icon=' option used by kpf. The
'?icon=' option allows a user to remotely specify a directory for an icon
image. However, if a directory is supplied instead of an image, it is
possible for a user to gain a listing of the contents of the directory.
Any files readable by the kpf process will also be disclosed to the remote
user.

By exploiting this issue it may be possible for a remote attacker to view
or download arbitrary kpf readable files. Access to sensitive files may
aid the attacker in future exploit attempts made against the target
system.

4. Microsoft TSAC ActiveX Control Cross Site Scripting Vulnerability
BugTraq ID: 5952
Remote: Yes
Date Published: Oct 11 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5952
Summary:

Microsoft offers Terminal Services client functionality over the web
through the Terminal Services Advanced Client (TSAC) ActiveX control. It
is an optional component that is installed by end-users.

Microsoft TSAC is reported to be prone to cross-site scripting attacks.

An attacker could construct a malicious link to a vulnerable host that
contains arbitrary HTML and script code. If this link is visited by a web
user, the attacker-supplied code will be rendered in their browser, in the
security context of the vulnerable site.

This issue is reported to be present in the 'connect.asp' script.

This vulnerability can be exploited to steal cookie-based credentials from
authenticated users. Other attacks are also possible.

5. PHPNuke Multiple Script Code Filtering Vulnerabilities
BugTraq ID: 5953
Remote: Yes
Date Published: Oct 11 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5953
Summary:

PHPNuke is a web based Portal system. Implemented in PHP, it is available
for a range of systems, including Unix, Linux, and Microsoft Windows.

Multiple script code vulnerabilities have been discovered in various
PHPNuke features. These problem could potentially result in the execution
of arbitrary code within the context of the vulnerable website.
Exploitation of this issue may allow remote attackers to steal user's
cookie-based authentication credentials, or launch other attacks.

The following vulnerabilities have been reported in PHPNuke:

The RDF/RSS parser fails to strip HTML tags. A user could inject script
code into an RSS file that would bypass filtering, and execute in another
user's browser.

Private Messages in PHPNuke are not sufficiently sanitized. A user may
input HTML into the body of a message that could result in the execution
of code in a user's browser.

The PHPNuke Journal fails to properly sanitize input. A malicious user
could take advantage of this issue to execute code in a user's browser.

The PHPNuke 'Your Info' section does not properly sanitize input. A user
could place arbitrary code in one of the following fields that would be
executed in the browser of a user: Real Name, Fake Email, Your Location,
Your Interests, Your Occupation Signature. This could allow the creation
of malicious fields.

The 'Downloads' and 'Web Links' sections do not sufficiently sanitize user
input. Both allow <a href> tags in the following fields: Program Name,
File Link, Author's Name, Author's Email, and Homepage.

6. My Web Server Long Get Request Denial Of Service Vulnerability
BugTraq ID: 5954
Remote: Yes
Date Published: Oct 12 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5954
Summary:

My Web Server is a web server software package distributed and maintained
by MyWebServer LLC. It is designed for the Microsoft Windows operating
system.

A problem with My Web Server could make it possible for a user to deny
service to legitimate users of the server.

It has been reported that My Web Server does not properly handle long
requests. Because of this, a remote user placing a HTTP GET request of
excessive length could cause the server to become unstable. In most
cases, a long GET request causes the web server to crash, requiring a
manual restart of the service. The request capable of reliably
reproducing this result has been reported as being 994 or more bytes.

This vulnerability is likely a boundry condition error. In the case of
this vulnerability being an exploitable buffer overflow vulnerability, it
would be possible to execute arbitrary code through a vulnerable web
server. Any code executed through this vulnerability would be with the
privileges of the My Web Server process, typically run as the SYSTEM user.

7. Linux-HA Heartbeat Remote Buffer Overflow Vulnerability
BugTraq ID: 5955
Remote: Yes
Date Published: Oct 14 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5955
Summary:

Heartbeat is a utility designed to indicate the availability of a Linux
system. It is made available as part of the High-Availability Linux
(Linux-HA) project.

The heartbeat utility is vulnerable to a remotely exploitable buffer
overflow condition. Attackers may exploit the vulnerability to execute
arbitrary code. It has been reported that the condition is related to the
handling of TCP packets.

Any code executed will run with root privileges.

8. ATP httpd Single Byte Buffer Overflow Vulnerability
BugTraq ID: 5956
Remote: Yes
Date Published: Oct 14 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5956
Summary:

ATP httpd is a lightweight HTTP server. A vulnerability has been reported
in ATP httpd that may result in compromise of root access to remote
attackers.

Data received from remote clients is read into a local variable and
terminated with a NULL byte. An off-by-one error is present in the
termination of the buffer. It is possible to overwrite the least
significant byte of the saved base pointer with zero if a string of
maximum length is transmitted to the server. This creates a potentially
exploitable condition if the saved base pointer is corrupted such that it
points to attacker-controlled memory. If that occurs, the attacker may
force the calling function to return into shellcode.

ATP httpd does not drop privileges after binding to port 80. Any code
executed will run with root privileges.

9. Meunity Script Injection Vulnerability
BugTraq ID: 5957
Remote: Yes
Date Published: Oct 14 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5957
Summary:

Meunity is a web-based community system that includes a forum. A script
injection vulnerability has been reported in the Meunity forum that may
allow for theft of cookies, content manipulation and other attacks.

According to the report, script code is not removed from IMG tags in forum
topics. A malicious user may create a topic with script code embedded in
an image tag. When other users view the topic, the script code will
execute. The code will run in the context of the website domain/the
user's session and may result in a compromise depending on the
server/application.

Potential attacks include (but are not limited to) theft of session
cookies/authentication information, content manipulation and performing
unauthorized actions as the target user.

10. Multiple Symantec HTTP Proxy Denial of Service Vulnerability
BugTraq ID: 5958
Remote: Yes
Date Published: Oct 14 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5958
Summary:

The "Simple, Secure Webserver" is a HTTP proxy included with Raptor
Firewall, Symantec Enterprise Firewall, VelociRaptor and Symantec Gateway
Security. A denial of service vulnerability has been reported in this
component.

According to the report, the proxy blocks while attempting to resolve
hostnames specified in CONNECT requests. While this is occuring, requests
from other clients are not handled.

This behaviour can be exploited to cause a denial of service condition.
Malicious users may connect to the proxy server and issue a CONNECT
request for a hostname hosted on an unresponsive server. Any hostname can
be used as the lookup occurs before the hostname is evaluated against
access control lists.

11. Multiple Symantec HTTP Proxy Information Disclosure Vulnerability
BugTraq ID: 5959
Remote: Yes
Date Published: Oct 14 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5959
Summary:

The "Simple, Secure Webserver" is a HTTP proxy included with Raptor
Firewall, Symantec Enterprise Firewall, VelociRaptor and Symantec Gateway
Security. An information disclosure vulnerability has been reported in
this component.

According to the report, it is possible for external hosts to identify
responsive hosts on the network connected to the internal interface.
Responsive and unresponsive hosts can be distinguished based on the
response to a CONNECT request for a guessed internal IP address.

This behaviour may be exploited by attackers to enumerate internal hosts.

12. ghttpd Log() Function Buffer Overflow Vulnerability
BugTraq ID: 5960
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5960
Summary:

ghttpd is a freely available, open source web server for Unix and Linux
variant systems.

A buffer overflow has been reported in ghttpd which will allow arbitrary
code to be executed with the privileges of the webserver.

The overflow occurs when the argument to a 'GET' request is of excessive
length. It is a stack-based overflow which may allow for attackers to
overwrite stack variables and execute arbitrary code on the underlying
host. The vulnerability occurs when excessively long 'GET' requests are
logged using the log() function without adequate bounds checking.

The webserver minimizes the risk of root compromise by dropping privileges
after it has bound to port 80. This vulnerability is still a serious
threat however, as remote attackers can gain access.

This vulnerability affects ghttpd versions 1.4.3 and earlier.

13. TelCondex SimpleWebServer Denial Of Service Vulnerability
BugTraq ID: 5961
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5961
Summary:

TelCondex SimpleWebServer is a Web server designed for use with the
Microsoft Windows operating systems.

A problem with SimpleWebServer could make it possible for a user to deny
service to legitimate users of the server.

It has been reported that SimpleWebServer does not properly handle long
requests. Because of this, a remote user placing a HTTP request of
excessive length could cause the server to become unstable. In most cases,
a long request causes the web server to crash, requiring a manual restart
of the service. The request capable of reliably reproducing this result
has been reported as being 539 or more bytes.

An attacker can exploit this vulnerability by causing SimpleWebServer from
responding to legitimate requests for service.

This vulnerability has been reported to affect TelCondex SimpleWebServer
2.06.

14. Polycom ViaVideo Denial Of Service Vulnerability
BugTraq ID: 5962
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5962
Summary:

Polycom ViaVideo is an integrated USB device used for video conferencing.
The ViaVideo devices allow remote access via HTTP.

Polycom ViaVideo devices are prone to a denial of service condition upon
receipt of numerous incomplete HTTP requests. This may restrict
availability of the device for legitimate users.

An attacker can exploit this vulnerability by making four or more
incomplete HTTP connections to TCP port 3603. This port is used by the
device for HTTP requests. Further HTTP requests issued to the device will
not be honoured. System performance may be affected as exploitation of
this vulnerability will also result in excessive CPU utilization.

The device may need to be restarted to regain normal functionality. This
issue has been reported to affect ViaVideo 2.2 and 3.0.

15. Microsoft Internet Explorer Unauthorized Document Object Model Access Vulnerability
BugTraq ID: 5963
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5963
Summary:

Microsoft Internet Explorer is prone to a vulnerability that may enable a
frame or iframe to gain unauthorized access to the Document Object Model
(DOM) of other frames/iframes in a different domain.

This is possible because MSIE does not perform adequate access control
checks on all frame properties. While access to the 'document' property
across domains is properly restricted, access to 'Document' is not. This
issue is present in Microsoft Internet Explorer 5.5 and 6.0.

This may allow an attacker to violate the browser Same Origin Policy and
gain unauthorized access to the properties of frames and iframes that are
in a different domain. It has been demonstrated that an attacker may
exploit this issue to steal cookie-based authentications from other
domains. Local files may also be read via exploitation of this issue.
Other attacks are also possible.

The vulnerability may be exploited by a malicious webpage or potentially
through malicious HTML e-mail. The issue is also present in other
software that relies upon the Internet Explorer browser engine.

16. Polycom ViaVideo Buffer Overflow Vulnerability
BugTraq ID: 5964
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5964
Summary:

Polycom ViaVideo is an integrated USB device used for video conferencing.
The ViaVideo devices allow remote access via HTTP.

A buffer overflow vulnerability has been reported for ViaVideo v2.2 and
v3.0.

An attacker can exploit this vulnerability by issuing excessively long
'GET' requests, consisting of at least 4132 characters, to ViaVideo
devices on TCP port 3603. This will cause an error in the 'vvws.dll'
library and will cause the ViaVideo service to crash.

Although unconfirmed, it may be possible for a remote attacker to exploit
this issue to execute arbitrary system commands with the privileges of the
ViaVideo process.

17. Avaya Cajun Firmware Undocumented Default Accounts Vulnerability
BugTraq ID: 5965
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5965
Summary:

Vulnerable versions of firmware for the Avaya Cajun line of network
switches include multiple undocumented users.

It has been reported that Avaya Cajun switches contain two undocumented
developer accounts, with default passwords. The accounts are the 'diag'
and 'manuf' user accounts with the passwords 'danger' and 'xxyyzz'. These
accounts provide developer-level access to the switch, which may allow an
attacker to have read and write access to the configuration settings of
the switch.

Exploitation of this issue may allow a remote attacker to gain privileged
access to the vulnerable device, resulting in arbitrary configuration
settings to be modified. Gaining access to the device may also aid in
further attacks against the target network.

18. RadioBird Software WebServer 4 All Buffer Overflow Vulnerability
BugTraq ID: 5967
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5967
Summary:

RadioBird Software WebServer 4 All is a Web server designed for use with
Microsoft Windows operating systems.

A buffer overflow vulnerability has been reported for WebServer 4 All.

An attacker can exploit this vulnerability by issuing excessively long
'GET' requests, consisting of at least 3000 characters, to a system
running a vulnerable version of WebServer 4 All. This will cause the Web
server to crash.

Although unconfirmed, it may be possible for a remote attacker to exploit
this issue to execute arbitrary system commands with the privileges of the
WebServer 4 All process.

This vulnerability was reported for WebServer 4 All versions 1.23 and
1.27.

19. RadioBird Software WebServer 4 All Directory Traversal Vulnerability
BugTraq ID: 5968
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5968
Summary:

RadioBird Software WebServer 4 All is a Web server designed for use with
Microsoft Windows operating systems.

It has been reported that WebServer 4 All does not properly sanitize web
requests. By sending a malicious web request to the vulnerable server,
using URL encoded characters, it is possible for a remote attacker to
access sensitive resources located outside of the web root.

An attacker is able to traverse outside of the established web root by
encoding the slash (/) character as '%2f'. An attacker may be able to
obtain any web server readable files from outside of the web root
directory.

Disclosure of sensitive system files may aid the attacker in launching
further attacks against the target system.

This vulnerability was reported for WebServer 4 All version 1.23 and 1.27.

20. Ingenium Learning Management System Reversible Password Hash Weakness
BugTraq ID: 5970
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5970
Summary:

Ingenium Learning Management System uses a weak algorithm to encrypt user
and administrative credentials. Passwords may be trivially obtained by
reversing the cipher.

A simple shift cipher is used to obfuscate the plaintext password. Each
letter is assigned the value of the difference of the plaintext character
and a letter in a fixed key at the corresponding location. If the
password is greater than 10 characters in length, the key repeats.
Additionally, passwords are converted to uppercase before they are
obfuscated. User credentials are also obfuscated using a similar
algorithm.

An attacker must be able to gain unauthorized access to the password
hashes for this issue to be exploited. This may be achieved by taking
advantage of the issues described in Bugtraq ID 5969. Hashed user
credentials will also be stored in the database, and may potentially be
retrieved by an attacker with the ability to construct or influence SQL
queries.

21. Ingenium Learning Management System Information Disclosure Vulnerability
BugTraq ID: 5969
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5969
Summary:

Click2Learn Ingenium Learning Management System is a web-based learning
environment that runs on Microsoft Windows operating systems.

The default installation of Ingenium Learning Management System leaves
sensitive configuration information in a directory which is publicly
accessible via the web. This may lead to disclosure of the hash for the
administrative password, database authentication credentials and other
sensitive information.

Further attacks may result as a consequence of this type of sensitive
information being disclosed to a remote attacker.

22. Microsoft Windows 2000/XP Full Event Log Administrative Alert Weakness
BugTraq ID: 5972
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5972
Summary:

Microsoft Windows 2000 and XP can be configured to send administrative
alerts when certain events are recorded in the Event Log. There are three
individual logs that are maintained: Application, Security, and System.

The Event Logs allow administrators to set the maximum allowed size for
each log, as well as the action to take when the log reaches the maximum
size.

If the option 'Do not overwrite events (clear log manually)' is selected
and the log reaches the maximum allowed size, the Event Log must be
manually cleared by an administrator before further event logging occurs.
If the log is full and events are no longer being recorded, any configured
administrative alerts will not be sent.

23. BEA WebLogic Server/Express/Integration Application Migration Security Policy Weakness
BugTraq ID: 5971
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5971
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

The affected products supported undocumented extensions for the Servlet
2.3 specification. These extensions included additional URL mapping
syntax for web applications. Since these extensions are no longer
supported in recent versions of the software, role mappings and security
policies may not carry over when web applications are migrated. The
extensions allowed for URL patterns in web.xml files that did not start
with a '*.' or a '/' to be treated as though they were prefixed a '/'
character.

This may cause security to be inadvertently lowered when applications are
migrated.

24. CoolForum Source Disclosure Vulnerability
BugTraq ID: 5973
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5973
Summary:

CoolForum is a bulletin board system written in PHP and is available for
the Microsoft Windows operating system.

A vulnerability has been discovered in CoolForum v0.5 beta.

'avatar.php' is used to display requested image files located in the
forums 'logo' directory.

It has been reported that CoolForum fails to sufficiently validate user
supplied input when processing requests via the 'avatar.php' script file.
By passing maliciously constructed image requests to 'avatar.php', it is
possible for an attacker to gain access to arbitrary PHP files located
outside the 'logo' root directory. It has also been reported that
requesting files with this method will allow an attacker bypass .htaccess
list restrictions and obtain any web server readable files from outside of
the web root directory.

By exploiting this issue to access sensitive files, it may be possible for
an attacker to obtain information required to launch further attacks
against the other resources.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. Secure Linux desktop begins shipping to UK police force
By John Lettice, The Register

A pilot scheme which could see police forces throughout England and Wales
switching to Linux desktops has kicked off with delivery of the first
systems to the West Yorkshire force. The deployment is taking place under
a contract awarded to netproject earlier this year by the UK Police IT
Organisation, and if successful will cover over 60,000 desktops. In West
Yorks alone the installed base is around 3,500, and a spokesman reckoned
that the savings from this would be around £1 million a year.

http://online.securityfocus.com/news/1312

2. Cisco Catalyst switches in DoS risk
By John Leyden, The Register

Cisco yesterday warned of a potential DoS risk affecting its popular line
of Catalyst LAN switches. Catalyst switches running specific versions of
Cisco CatOS software are vulnerable to a buffer overflow in an embedded
HTTP server.

http://online.securityfocus.com/news/1311

3. UK firm touts alternative to digital certs
By John Leyden, The Register

Two factor authentication, using secure tokens is being backed as an
alternative to digital certificates by a UK company, which is enjoying
support from the Parliamentary All Party Export Group.

http://online.securityfocus.com/news/1273

4. MS beta site cracked
By Thomas C. Greene, The Register

The server on which Microsoft makes its beta programs available for
testing has been infiltrated by outsiders who have downloaded an
unspecified cornucopia of programs. Among the items available are
forthcoming editions of Win-XP, .NET Server, and some confidential works
in progress.

http://online.securityfocus.com/news/1266

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Minimal-router v1.0
by Christian Laursen [email protected]
Relevant URL:
http://borderworlds.dk/projects/#mr
Platforms: Perl (any system supporting perl)
Summary:

Minimal-router is a Linux-based router containing only the neccesary tools
to setup basic networking and firewalling. It aims to be easily
configurable while staying as secure as the Linux kernel itself.

2. JSch v0.0.1
by ymnk [email protected]
Relevant URL:
http://www.jcraft.com/jsch/
Platforms: Os Independent
Summary:

JSch is a pure Java implementation of SSH2. It allows you to connect to an
sshd server and use port forwarding, X11 forwarding, file transfer, etc.
You can integrate its functionality into your own Java programs.

3. Packit v0.3.5
by Darren Bounds
Relevant URL:
http://www.intrusense.com/~dbounds/?select=projects
Platforms: FreeBSD, Linux, POSIX
Summary:

Packit is a network auditing tool that allows you to monitor, manipulate,
and inject customized IPv4 traffic into your network. This can be
extremely valuable for testing firewalls, intrusion detection systems,
port scanning, and general TCP/IP auditing. It currently supports the
ability to define nearly all Ethernet, TCP, and UDP header options, as
well as ICMP injection and packet capture. It requires libnet and libpcap,
and runs on FreeBSD and Linux.

4. MAIL PASSWORD RECOVERY v1.0.0.0
by Aleksandar Boros
Relevant URL:
http://members.ams.chello.nl/a.boros/mpr/
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

Mail Password Recovery allows you to recover your email password for any
POP3 account, as long as it is stored in an email program on your
computer. You just need to temporarily change the settings in your email
program , so that it connects to Mail Password Recovery instead, and your
password will be revealed. Mail Password Recovery works by emulating a
local POP server, your email program hands over the password when it
connects, and Mail Password Recovery will show it to you. Only works with
email accounts/passwords that have the login information stored in your
email program (Outlook Express, Eudora, The Bat! etc.) Program can only
recover the passwords that are stored on your computer

Program does NOT recover passwords from web based email accounts such as
Hotmail, Yahoo, MSN, AOL etc.

5. Project SCIM v1.6
by the Project SCIM team
Relevant URL:
http://www.projectscim.com
Platforms: Java
Summary:

The Secure Cryptographic Instant messenger now has a new release (this is
now version 1.6) with a load of extra features including encrypted multi
user chat, hyperlink support, conversation archiving as well as the
classics of P2P fully encrypted chat.

6. auditunlink v0.0.1
by DJ Flux
Relevant URL:
http://sourceforge.net/projects/auditunlink
Platforms: Linux, POSIX
Summary:

auditunlink is a Linux shared library that intercepts the unlink system
call, and logs which process, program, and user initiated it, and to which
file the call was applied. It is designed to be loaded with LD_PRELOAD or
/etc/ld.so.preload, and allows system administrators to log file deletions
even if a user has the proper file system permissions to perform the
deletion.

V. SECURITY JOBS SUMMARY
------------------------
1. (Seeker) D.C. Area - UNIX/Win/Mac Admin w/ INFOSEC (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295805

2. Permanent Security Management Engineer role UK Essex (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295788

3. Contract Opportunitites: SCADA Vulnerability Assessment and Penetration Test Expert (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295582

4. Security S/W Developer Wanted in Vienna, Austria (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295575

5. Security Professional Looking for Employment (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295497

6. Seeking QA Engineer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295484

7. Looking for a security job in the Washington DC metro area (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295469

8. Managed Security Services Developer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295518

9. Strong Security/Software Engineer needed @ Intruvert (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295175

10. Computer Incident Response Team Job (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/295174

11. WhiteHat Security seeks Silicon Valley Perl Developer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294931

12. consultant with too much time (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294936

13. Security Engineer -- St. Louis, Winston-Salem or Atlanta (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294935

14. Seeking a Director of Security Architecture - Product Marketing for the World's Leading eBusiness Software provider - Siebel Systems (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294945

15. VP, Sales - #730 - NJ (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294828

16. Security Sales Person (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294847

17. work with S E C U R I T Y sales/SE recruiting specialist (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294846

18. pki, vpn engineer available asap (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294934

19. Sr. Information Security Engineer needed ASAP in Orange County, CA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294827

20. pki systems engineer and technical support (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/294845

VI. INCIDENTS LIST SUMMARY
-------------------------
1. DoS and Windows Login (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295894

2. HTTP attack looking for /sumthin ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295887

3. Source of Windows PopUp SPAM (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295845

4. Slapper worm "ink" instead of "cinik" (Re: slapper worm varient "cinik") (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295873

5. apache problem (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295870

6. Linux Kernel Exploits / ABFrag (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295891

7. Help me identify this IIS DoS attack (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295732

8. Security problem in installation IE sp1 ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295704

9. Cacheflow proxy abuse (was: no subject) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295576

10. No subject
Relevant URL:

http://online.securityfocus.com/archive/75/295549

11. ...continuing saga of Windows Messenger SPAM, was re: (blank) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295561

12. popup msg spamming (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295356

13. RPC-Spam issue, was => (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295400

14. RES: SNMP vulnerability test? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295271

15. MD5 mystery (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295173

16. Strange Message (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/295167

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Covert Channels (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/295843

2. Application Vulnerability Analysis (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/295760

3. CROSS SITE-SCRIPTING Protection with PHP (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/295526

4. Designing Shellcode Demystified (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/295435

5. /instmsg/alias/annoying_web_logs ;) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/295410

6. Hashes,File protection,etc (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/295495

7. shellcode -> asm? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/295109

8. CALL FOR PAPERS - SANTA DIED LAST YEAR (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/295101

9. Covert channel application using libnet and libpcap (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/294818

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Win2K Security Training (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/295676

2. SecurityFocus Microsoft Newsletter #108 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/295319

3. Can I delete Wscript.exe? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/295218

4. Updated Patches with SUS. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/295213

IX. SUN FOCUS LIST SUMMARY
----------------------------
No New Posts For The Week Ending 10.21.02

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Continuous medium traffic fake Syn packets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/295684

2. Followup: Continuous medium traffic fake Syn packets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/294988

XI. SPONSOR INFORMATION
-----------------------
This Issue Is Sponsored By: Wiley & Sons

SAVE 40% ON KEVIN MITNICK'S NEW BOOK

For more information, visit www.amazon.com/mitnick

-------------------------------------------------------------------------------