SecurityFocus Newsletter #168

John Boletta <[email protected]> Mon, 28 Oct 2002 13:45:26 -0700 (MST)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #168
-----------------------------

This Issue is Sponsored By: SpiDynamics

ALERT: "Learn how to Combat Web Application Attackers"- Hackers exploiting
Web applications gain entry to backend data via Port 80 and 443! Firewalls
and IDS don't stop these attacks because hackers using the Web App Layer
are NOT seen as intruders. Learn why 75% of today's successful system
hacks involve Web Application vulnerabilities, not network security flaws.
Are you vulnerable? 15-Day *Free* Trial! Download now!

http://www.spidynamics.com/mktg/freewebinspect11

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Reverse Engineering Hostile Code
2. Certifiably Certified
3. SecurityFocus DPP Program
4. InfoSec World Conference and Expo/2003
5. Proactive Network Security Guide from Qualys
II. BUGTRAQ SUMMARY
1. Multiple VBulletin Cross Site Scripting Vulnerabilities
2. Perlbot Remote Command Execution Vulnerability
3. Perlbot Email Sending Remote Command Execution Vulnerability
4. Windows Media Player For Solaris Default World Writeable...
5. Microsoft Windows 2000 RPC Service Denial of Service Vulnerability
6. YaBB Login Cross-Site Scripting Vulnerability
7. Software602 Web602 Web Server Unauthorized Admin Directory...
8. Hans Persson Molly Multiple Remote Command Execution...
9. Perlbot Text Variable Remote Command Execution Vulnerability
10. Perlbot Filename Variable Remote Command Execution Vulnerability
11. IPFilter FTP Proxy Unauthorized Access Vulnerability
12. Multiple Vendor IPSec Implementation Denial of Service...
13. AN HTTPD Malformed SOCKS4 Request Buffer Overflow Vulnerability
14. D-Link DWL-900AP+ TFTP Server Arbitrary File Retrieval...
15. KMMail E-Mail HTML Injection Vulnerability
16. Microsoft Internet Explorer Document.Write() Zone Bypass...
17. YPServ Remote Network Information Leakage Vulnerability
18. Fragrouter Trojan Horse Vulnerability
19. PHP Arena PAFileDB Rate File Cross-Site Scripting Vulnerability
20. PHP Arena PAFileDB Email To Friend Cross-Site Scripting...
21. PHP Arena PAFileDB Download Cross-Site Scripting Vulnerability
22. PHP Arena PAFileDB Search Cross-Site Scripting Vulnerability
23. Multiple Firewall Vendor Packet Flood State Table Filling...
24. Multiple Vendor kadmind Remote Buffer Overflow Vulnerability
25. SCO UnixWare/OpenUnix Proc File System RCP Denial Of Service...
26. Multiple Microsoft Internet Explorer Cached Objects Zone...
27. AOL Instant Messenger Local File Execution Vulnerability
28. Mod_SSL Wildcard DNS Cross Site Scripting Vulnerability
29. Microsoft Windows 2000 SNMP Printer Query Denial of Service...
30. Virgil CGI Scanner Remote Command Execution Vulnerability
31. FlashFXP FTP Password Disclosure Vulnerability
32. Radiobird Software WebServer 4 All Host Field Header Buffer...
III. SECURITYFOCUS NEWS ARTICLES
1. E-card Sneakware Delivers Web Porn
2. Attack On Internet Called Largest Ever
3. IE hopelessly bug ridden
4. Powerful attack cripples majority of key Internet computers
IV.SECURITYFOCUS TOP 6 TOOLS
1. CRM114 v2002-10-24
2. softflowd v0.7.1
3. TestMaker v3.0
4. Remote packet filter control daemon v0.10
5. Rule Set Based Access Control v1.2.1
6. ggsniff v1.1d
V. SECURITYJOBS LIST SUMMARY
1. Bayarea Network Security Architect Seeking a Job (Thread)
2. Forensics Expert/Computer Crime Investigator Needed (Thread)
3. Sr. Information Security Scientist, Risk Assessments - Chicago...
4. Pre-Sales Security Engineers wanted for East Coast (Thread)
5. UNIX System Administrator with security skills seeking job in...
6. Seeking Sr Security Analyst position in NYC or Philly (Thread)
7. Lead Technical Security Analyst - London, UK. (Thread)
8. IT Security Training & Awareness Manager, London UK. (Thread)
9. Application Security Engineer - Chicago, ILL (Thread)
10. NEEDED - Sr. Security architects for Long Island, NY (Thread)
11. Seeking Bored/Part-time Programmers (C/C++/JAVA) (Thread)
12. Security Recruiter (Thread)
13. Seeking Position-Big 5 Experience-Silicon Valley (Thread)
14. Software Security Engineering Manager (Applications) San Diego...
15. Security Software Sales Executive - Security Management...
16. Lead Information Risk Analyst - London, UK. (Thread)
17. Sr. Microsoft Security Engineer - NYC (Thread)
18. Needed GISRA Policy Wonk (Thread)
19. Pre Sales Engineer- New York Metro (Thread)
20. Seeking IT Security Job In Europe (Thread)
21. Position wanted as senior consultant or manager (Thread)
22. Senior Security Consultant - Sydney, Australia (Thread)
23. Senior Security Architect looking (Thread)
24. Consulting Engineer (Thread)
25. NEEDED - Sr. Assurance Security Engineer - San Diego (Thread)
26. Senior Account Executive (Thread)
27. Security Data Management Sales Opportunity (Thread)
28. NEED: Senior Network Security Engineer (Thread)
29. Security professional available in the Boston area (Thread)
30. Vice President Technical Services (Thread)
31. Where are you located? (Thread)
32. CISSP CCSE Infosec expert having 8 years of exp,seeking an...
33. Contract - Sr. Security NIAP Consultant - San Diego (Thread)
34. CISSP Seeking Security Analyst/IT Audit Position in South...
VI. INCIDENTS LIST SUMMARY
1. Slapper questions (Thread)
2. ABfrag followup / WITHOUT ATTACHMENT (Thread)
3. unusual packet (tcpdump shows): rad-#0 41 [id 0] Attr[ (Thread)
4. a different, stranger port 137 activity (Thread)
5. Invalid IP address (Thread)
6. Unusual ICMP Traffic (Thread)
7. Hiding IP addresses in trace data (Thread)
8. Connection Attempts - Port 8047 (Thread)
9. Linux Kernel Exploits / ABFrag (Thread)
10. W2K Compromise - PipeCmdSrv (Thread)
11. Source of Windows PopUp SPAM (Thread)
12. HTTP attack looking for /sumthin ? (Thread)
13. Security problem in installation IE sp1 ? (Thread)
14. Thanks on NetBios DoSing... (Thread)
15. apache problem (Thread)
16. DoS and Windows Login (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. shellcode -> asm? (Thread)
2. Covert Channels (Thread)
3. UserID and hashed password for Lotus Domino (Thread)
4. Call For Papers Announcement: Black Hat Windows Security (Thread)
5. Re[2]: UserID and hashed password for Lotus Domino (Thread)
6. Help with a Clariion 4500 (aka dell fc450) raid array (Thread)
7. /instmsg/alias/annoying_web_logs ;) (Thread)
8. HTML email and external embedded links. (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. How ISA rule base works and how to bind users IP with MAC...
2. Subject: How ISA rule base works and how to bind users IP...
3. Some Useful Security Tools (Thread)
4. Securing Citrix NFuse and IIS 5 (Thread)
5. SecurityFocus Microsoft Newsletter #109 (Thread)
6. GetAd.exe testing (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Antwort: Current Solaris security infodocs (Thread)
2. Current Solaris security infodocs (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Continuous medium traffic fake Syn packets (Thread)
2. iptables firewall and forwarding. (Thread)
3. Linux FTP/Firewall combo suggestion requested (Thread)
4. How to get rid of spoofed IP-Address responses (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Reverse Engineering Hostile Code
By Joe Stewart

This article outlines the process of reverse engineering hostile code.
Armed with this knowledge, even someone who is not an expert at assembly
language programming should be able to look at the internals of a hostile
program and determine what it is doing, at least on a surface level.

http://online.securityfocus.com/infocus/1637

2. Certifiably Certified
By Richard Forno

Despite impressive acronyms that look great on a resume, security
certifications don't guarantee that the holder is qualified to secure
vital information.

http://online.securityfocus.com/columnists/118

3. SecurityFocus DPP Program

Attention Organizations and Universities!! Sign-up now for preferred
pricing on the only global early-warning system for cyber attacks -
SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

4. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud

5. Proactive Network Security: FREE Guide

Fight back against hackers-AUTOMATICALLY. New FREE Guide shows you how to
deploy full service vulnerability assessment solution for your NETWORK and
simplify your security audits--with anywhere, anytime, on-demand browser
access. Click here now to get a head-start on hackers!

https://www.qualys.com/forms/guide_228.php

II. BUGTRAQ SUMMARY
-------------------
1. Multiple VBulletin Cross Site Scripting Vulnerabilities
BugTraq ID: 5997
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5997
Summary:

vBulletin is commercial web forum software written in PHP and back-ended
by a MySQL database. It will run on most Linux and Unix variants, as well
as Microsoft operating systems.

vBulletin does not filter HTML tags from URI parameters, making it prone
to cross-site scripting attacks. The vulnerability exists due to
inadequate filtering of the '$scriptpath' and '$url' parameters. The
contents of these variables will be displayed in a few error pages.

As a result, it is possible for a remote attacker to create a malicious
link containing script code which will be executed in the browser of a
legitimate user, in the context of the website running vBulletin.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. Cookie-based authentication credentials may be used by the
attacker to hijack the session of the legitimate user.

2. Perlbot Remote Command Execution Vulnerability
BugTraq ID: 5998
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5998
Summary:

Perlbot is an IRC bot written in Perl. It depends on Net::IRC and its
goals are simplicity and modularity. It is available for Linux and Unix
operating systems.

A remote command execution vulnerability has been discovered in Perlbot
v1.0 beta.

Reportedly, the script does not properly sanitize the input for the
'$word' variable. Additionally, this input is passed through a function
which invokes the shell directly. If a user enters a command into this
variable, the commands will executed on the host with the privileges of
Perlbot.

This issue was reported for Perlbot v1.0 beta.

3. Perlbot Email Sending Remote Command Execution Vulnerability
BugTraq ID: 5999
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5999
Summary:

Perlbot is an IRC bot written in Perl. It depends on Net::IRC and its
goals are simplicity and modularity. It is available for Linux and Unix
operating systems.

A remote command execution vulnerability has been discovered in Perlbot
v1.0 beta.

Reportedly, the script does not properly sanitize the input for the
'$recipient' variable. Additionally, this input is passed through the
open() function which invokes the shell directly. If a user enters a
command into this variable, the commands will executed on the host with
the privileges of Perlbot.

This issue was reported for Perlbot v1.0 beta.

4. Windows Media Player For Solaris Default World Writeable Permissions Vulnerability
BugTraq ID: 6003
Remote: No
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6003
Summary:

Microsoft Windows Media Player is media software available for various
operating systems including Microsoft Windows and Solaris.

A vulnerability has been reported for Windows Media Player 6.3 for
Solaris. Reportedly, the installer will ignore the existing system umask
and install files with world writeable permissions.

An attacker can exploit this vulnerability to obtain elevated privileges
to the vulnerable system by modifying, or replacing, the installed files
with arbitrary attacker-supplied files. Any unsuspecting user that
attempts to execute any Windows Media Player files may inadvertently
execute malicious attacker supplied files.

5. Microsoft Windows 2000 RPC Service Denial of Service Vulnerability
BugTraq ID: 6005
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6005
Summary:

Microsoft Windows 2000 uses Remote Procedure Calls (RPC) for client-server
communications in a distributed computing environment (DCE). TCP Port 135
is typically used for DCE endpoint resolution.

A vulnerability in the Windows 2000 DCE-RPC stack could allow a remote
user to disable RPC services. If a specifically malformed packet is sent
to TCP port 135 on a vulnerable system, a null pointer dereference will
cause the RPC service to fail.

This vulnerability has been confirmed on Windows 2000 Service Pack 3,
however, other versions of Windows may also be vulnerable.

6. YaBB Login Cross-Site Scripting Vulnerability
BugTraq ID: 6004
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6004
Summary:

YaBB (Yet Another Bulletin Board) is freely available web forum software
that is written in Perl. YaBB will run on most Unix/Linux variants, MacOS,
and Microsoft Windows 9x/ME/NT/2000/XP platforms.

A cross-site scripting vulnerability has been reported in the YaBB forum
login script. When a user enters an erroneous username/password, the YaBB
forum login script will display an error page containing the values the
user entered. However, HTML tags or script code are not sanitized from
the password error output.

As a result, it is possible for a remote attacker to create a malicious
link to the login page of a site hosting the web forum. The malicious
link may contain arbitrary HTML and script code in the password field.
When this link is visited by an unsuspecting web user, the
attacker-supplied code will be executed in their browser in the security
context of the vulnerable website.

It has been demonstrated that this vulnerability may be exploited to steal
cookie-based authentication credentials. Furthermore, once an attacker
has hijacked a user's session with the credentials it is possible to
change that user's password without needing to further authenticate.

7. Software602 Web602 Web Server Unauthorized Admin Directory Access Vulnerability
BugTraq ID: 6006
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6006
Summary:

Web602 is a Web server designed for use with Microsoft Windows operating
systems. Web602 is included as part of Software602's LAN Suite 2002
package.

An unauthorized administrative access vulnerability has been reported for
Web602 web server. Reportedly, Web602 allows access to the '/admin/'
folder without any authorization.

An attacker can exploit this vulnerability to obtain access to the admin
folder and perform any administrative actions.

This vulnerability has been reported to affect the Czech version of Web602
earlier than 2002.0.02.0916.

8. Hans Persson Molly Multiple Remote Command Execution Vulnerabilities
BugTraq ID: 6007
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6007
Summary:

Molly is a small IRC bot that is intended for use in intra-office
environments. It is written in Perl and is maintained by Hans Persson. It
is available for Unix and Linux variant operating systems.

Several remote command execution vulnerabilities have been discovered in
Molly v0.5.

The script 'plugins/nslookup.pl' does not adequately sanitize the input
for the '$host' variable. Additionally, this variable is passed, without
any checks, through the script and invokes the shell directly. If a user
enters a command into this variable, the commands will executed on the
host with the privileges of Molly.

Other script files that exist in the unsupported 'unusedplugins' folder
are also vulnerable to similar attacks. The files are called 'sms.pl',
'pop.pl', and 'hpled.pl'.

9. Perlbot Text Variable Remote Command Execution Vulnerability
BugTraq ID: 6008
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6008
Summary:

Perlbot is an IRC bot written in Perl. It depends on Net::IRC and its
goals are simplicity and modularity. It is available for Linux and Unix
operating systems.

A remote command execution vulnerability has been discovered in Perlbot
v1.0 beta.

Reportedly, the Plugins/Misc/SpelCheck/SpelCheck.pm script fails to
properly sanitize the input for the '$text' variable. Additionally, this
input is passed through a function which invokes the shell directly. If a
user enters a semi-colon (;) followed by a command into this variable,
attacker-supplied commands will executed on the host with the privileges
of Perlbot.

This issue was reported for Perlbot v1.9.2.

10. Perlbot Filename Variable Remote Command Execution Vulnerability
BugTraq ID: 6009
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6009
Summary:

Perlbot is an IRC bot written in Perl. It depends on Net::IRC and its
goals are simplicity and modularity. It is available for Linux and Unix
operating systems. A remote command execution vulnerability has been
discovered in Perlbot v1.0 beta.

Reportedly, the 'Plog.pl' script does not properly sanitize the input for
the '$filename variable. Additionally, this input is passed through the
open() function which invokes the shell directly. If a user enters a
command into this variable, the commands will executed on the host with
the privileges of Perlbot.

This issue was reported for Perlbot v1.0 beta.

11. IPFilter FTP Proxy Unauthorized Access Vulnerability
BugTraq ID: 6010
Remote: Yes
Date Published: Oct 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6010
Summary:

IPFilter is a packet filtering implementation that is in wide use on a
variety of Unix systems. IPFilter includes an in-kernel FTP proxy that
attempts to make access control decisions based on the state of FTP
sessions. A vulnerability has been reported in this component.

In versions of IPFilter prior to 3.4.29, the FTP proxy was vulnerable to a
flaw that allowed for attackers to open ports on FTP servers under certain
circumstances. Attackers may fool vulnerable versions of IPFilter into
opening ports if a FTP server is in use that will echo text from a client
back to the client.

Ths may result in a violation of security policy and subsequent compromise
if the attacker can exploit services listening on vulnerable ports.

12. Multiple Vendor IPSec Implementation Denial of Service Vulnerabilities
BugTraq ID: 6011
Remote: Yes
Date Published: Oct 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6011
Summary:

IPSec is a set of extensions to IP that provides encryption and
authentication. A vulnerability in several implementations of IPSec
related to handling of malformed ESP packets has been reported. On many
systems, the conditions may be exploited to cause kernel panics.

According to the report, many implementations lack adequate sanity checks
on the header fields of ESP packets. By "spoofing" short ESP packets with
high sequence numbers, it is allegedly possible to cause invalid memory
accesses that will often result in a total system crash.

Implementations based on KAME and FreeSWAN are vulnerable.

13. AN HTTPD Malformed SOCKS4 Request Buffer Overflow Vulnerability
BugTraq ID: 6012
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6012
Summary:

AN HTTPD is a general purpose server that is also able to function as a
SOCKS4 server. It is designed for use on Microsoft Windows operating
systems.

A buffer overflow vulnerability has been reported for AN HTTPD. The
vulnerability is due to insufficient bounds checking of usernames for
SOCKS4 requests.

When AN HTTPD acts as a SOCKS4 server, it handles user names in an unsafe
manner. An attacker can exploit this vulnerability by sending an overly
long username as part of a SOCKS4 request. This may overflow a buffer used
by AN HTTPD and cause the server to overwrite adjacent memory. It may be
possible to modify sensitive information stored on the stack, including
return addresses. Successful exploitation may, in turn, lead to the
execution of arbitrary code as the AN HTTPD process.

This vulnerability is known to affect AN HTTPD versions 1.30 to 1.41c.

14. D-Link DWL-900AP+ TFTP Server Arbitrary File Retrieval Vulnerability
BugTraq ID: 6015
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6015
Summary:

The DWL-900AP+ is a wireless access point distributed by D-Link.

A problem with DWL-900AP+ systems could make it possible for remote users
to gain access to sensitive information.

The DWL-900AP+ offers an undocumented feature. By default, DWL-900AP+
systems come with a TFTP server enabled by default.

The TFTP server included in DWL-900AP+ firmware may reveal sensitive
information. An attacker logging into the TFTP server may be able to
request various binary data files from the router. This could lead to the
disclosure of sensitive information.

An attacker exploiting this issue could log into the TFTP server to
download the config.img, which contains sensitive information such as the
WEP keys, admin password to the HTTP interface, and network configuration
data. The attacker could also gain access to files eeprom.dat, mac.dat,
wtune.dat, rom.img, normal.img.

15. KMMail E-Mail HTML Injection Vulnerability
BugTraq ID: 6013
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6013
Summary:

kmMail is an open source web based e-mail client.

kmMail does not sufficiently sanitize HTML and script code from the body
of e-mail messages. As a result, an attacker may send a malicious message
to a user of kmMail that includes arbitrary HTML and script code. If a
user of the webmail system views the malicious message, then the
attacker-supplied code will execute in their web browser in the security
context of the webmail system.

This may allow an attacker to steal cookie-based authentication
credentials from users of the webmail system. Other attacks are also
possible.

This is a variant of the issue described in Bugtraq ID 5173.

16. Microsoft Internet Explorer Document.Write() Zone Bypass Vulnerability
BugTraq ID: 6017
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6017
Summary:

A vulnerability has been reported in Microsoft Internet Explorer that may
allow for remote attackers to execute script code in the context of other
domains/security Zones.

The cause appears to be a lack of access control checks when access to a
document object is attempted through a separate reference to it. A
malicious webmaster may exploit this vulnerability by creating a reference
to the method "document.write" of the target child window. The attacker
may then have the child window open a website in a different domain/Zone
and obtain control of the newly created window to execute malicious code.
As the domain/Zone is different in the child window, this should not be
possible.

Exploitation of this vulnerability may allow for theft of cookie
information, website impersonation or disclosure of local files.

This vulnerability is similar to the vulnerability described in BugTraq ID
5841.

17. YPServ Remote Network Information Leakage Vulnerability
BugTraq ID: 6016
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6016
Summary:

The ypserv daemon is a component of the Network Information Service (NIS),
and is available for Linux and Unix operating systems.

A remotely exploitable information leakage vulnerablity has been
discovered in the ypserv daemon. Versions prior to 2.5 are affected.

The 'lib/yp_db.c' file fails to verify whether a request map exists before
allocating memory for needed space, resulting in memory leakage. It has
been reported that by passing a malicious reqest for a non-existing map to
the ypserv daemon, a remote attacker could potentially access information
from an old domainname and mapname.

Information obtained through exploiting this issue may aid an attacker in
launching further attacks against the target network.

It should be noted that this issue may be similar to the issue described
in bid 5914.

18. Fragrouter Trojan Horse Vulnerability
BugTraq ID: 6022
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6022
Summary:

fragrouter is a freely available, open source intrusion detection evasion
tool. It is available for the Unix and Linux operating systems.

It has been announced that the server hosting fragrouter, www.anzen.com,
was compromised recently. It has been reported that the intruder made
modifications to the source code of fragrouter to include trojan horse
code. Downloads of the fragrouter source code from www.anzen.com between
October 18, 2002 and October 19, 2002 likely contain the trojan code.

Reports say that the trojan will run once upon compilation of fragrouter.
Once the trojan is executed, it attempts to connect to host
210.224.164.100 on port 6667.

Although unconfirmed, it has been reported that the service listening on
port 6667 of host 210.224.164.100 has been disabled.

It is not known whether, or what other sites are affected in addition to
www.anzen.com.

The maintainers of fragrouter have stated that the fragrouter source code
has not been maintained since release 1.6, a period of approximately 3
years, and that release 1.7 is bogus. The MD5 hash of the bogus release
is 8329c34704287a1fb1e5d6f1ba81f456.

The posting of the trojaned version of fragrouter was additionally
announced on the cisco-nsp and linux-kernel mailing lists. Additionally,
the trojan displays similarity to those found in irssi, fragroute, BitchX,
OpenSSH, and Sendmail.

19. PHP Arena PAFileDB Rate File Cross-Site Scripting Vulnerability
BugTraq ID: 6019
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6019
Summary:

PHP Arena paFileDB is an application which allows webmasters to post files
for download on a website. It is implemented in PHP and is available for
Unix and Linux variants as well as Microsoft Windows operating systems.

paFileDB is prone to cross-site scripting attacks.

An attacker may construct a malicious link to the vulnerable script which
contains arbitrary HTML and script code. If this link is visited by a web
user, the attacker-supplied code will execute in their web client in the
security context of the paFileDB site.

This issue is in the "Rate File" function of the paFileDB script.

An attacker may potentially exploit this to steal cookie-based
authentication credentials. Other attacks are also possible.

20. PHP Arena PAFileDB Email To Friend Cross-Site Scripting Vulnerability
BugTraq ID: 6018
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6018
Summary:

paFileDB is prone to cross-site scripting attacks.

This issue is in the "Email to Friend" function of the paFileDB script.

An attacker may potentially exploit this to steal cookie-based
authentication credentials. Other attacks are also possible.

21. PHP Arena PAFileDB Download Cross-Site Scripting Vulnerability
BugTraq ID: 6020
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6020
Summary:

paFileDB is prone to cross-site scripting attacks.

This issue is in the "Download" function of the paFileDB script.

An attacker may potentially exploit this to steal cookie-based
authentication credentials. Other attacks are also possible.

22. PHP Arena PAFileDB Search Cross-Site Scripting Vulnerability
BugTraq ID: 6021
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6021
Summary:

paFileDB is prone to cross-site scripting attacks.

This issue is reported to be exploitable by providing HTML and script code
as a search string.

An attacker may potentially exploit this to steal cookie-based
authentication credentials. Other attacks are also possible.

23. Multiple Firewall Vendor Packet Flood State Table Filling Vulnerability
BugTraq ID: 6023
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6023
Summary:

A vulnerability has been discovered in multiple firewall systems that
could make denial of service attacks possible.

It has been reported that many firewalls do not properly handle certain
types of input. Firewall systems that maintain state could be attacked
and forced into a situation where all service is denied. This condition
would occur as a result of certain types of traffic floods.

It has been reported that this vulnerability may be exploited through
various attack methods.

One method that can be used is a TCP Syn flood. By launching a TCP Syn
flood, especially one using multiple spoofed source IP addresses, an
attacker could fill the state table of a vulnerable firewall.

Another method is to use UDP packets with numerous spoofed source
addresses. By sending large amounts of UDP packets to a vulnerable
firewall, an attacker could fill the state table to the point that further
entries could not be made.

The final method identified for this type of attack is one called the
"Crikey CRC Flood". An attacker sending transport-layer (layer 4 of the
OSI model) packets such as TCP or UDP with invalid checksums could fill
the firewall state table.

The use of these types of attacks require a fundamental flaw in firewall
design, or configuration. The flaw requires that the firewall state table
be designed, or at least configured, to eliminate firewall state table
entries at a slower speed than they are added.

A comprehensive listing of affected products is not available at this
time. Updates will be made if more information about affected vendors and
products becomes available.

24. Multiple Vendor kadmind Remote Buffer Overflow Vulnerability
BugTraq ID: 6024
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6024
Summary:

The kadmind daemon is a server for allowing remote administrative access
to Kerberos databases.

A vulnerability has been discovered in the kadmind daemon.

It has been reported that kadmind is vulnerable to a remotely exploitable
buffer overflow. This issue is due to insufficient bounds checking in the
kadm_ser_in() function. The function fails to verify the size of
'authent.length' before copying data, of 'authent.length' size, into
'authent.dat', resulting in a buffer being overrun.

An attacker can exploit this issue by making a request that will overflow
the buffer on the system stack. This could potentially allow an attacker
to overwrite sensitive locations in memory, such as a return address,
resulting in the execution of arbitrary code with the privileges of the
kadmind process.

25. SCO UnixWare/OpenUnix Proc File System RCP Denial Of Service Vulnerability
BugTraq ID: 6025
Remote: No
Date Published: Oct 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6025
Summary:

UnixWare and Open Unix are operating systems distributed by SCO.

A problem in these operating systems may make it possible for local users
to launch a denial of service.

It has been reported that SCO systems react unpredictably when certain
copy operations are performed. A regular user using the rcp program may
cause the system to become unstable when copying the /proc file system.
A regular user performing this action can cause the system to become
unusable, resulting in a denial of service.

26. Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability
BugTraq ID: 6028
Remote: Yes
Date Published: Oct 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6028
Summary:

Multiple vulnerabilities have been reported for Microsoft Internet
Explorer. These vulnerabilities have been reported to affect Internet
Explorer 5.5 to 6.0. Internet Explorer 6.0 with Service Pack 1 and
Internet Explorer 5 with Service Pack 2 are reportedly not vulnerable.

The vulnerabilities are due to how Internet Explorer handles cached
objects. This vulnerability may allow remote attackers to execute script
code in the context of other domains and security zones.

The cause appears to be a lack of access control checks when access to a
document object is attempted through a separate reference to it. A
malicious webmaster may exploit this vulnerability by creating a reference
to several methods of the target child window. The attacker may then have
the child window open a website in a different domain/Zone and obtain
control of the newly created window to execute malicious code. As the
domain/Zone is different in the child window, this should not be possible.

The following methods have been reported to be exploitable and will result
in an attacker obtaining the ability to execute code in the 'My Computer'
security zone.

external()
document.selection.createRange()
document.elementFromPoint()
document.getElementById()
document.getElementsByName()
document.getElementsByTagName()
document.execCommand()

An attacker who exploits this vulnerability using the clipboardData()
method will obtain read/write access to contents of the clipboard.

Exploitation of this vulnerability may allow for theft of cookie
information, website impersonation or disclosure and manipulation of local
files.

** Some reports indicate that Internet Explorer 6 with Service Pack 1 may
be vulnerable.

27. AOL Instant Messenger Local File Execution Vulnerability
BugTraq ID: 6027
Remote: Yes
Date Published: Oct 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6027
Summary:

AOL Instant Messenger (AIM) is an instant messenging client for Microsoft
Windows, MacOS, and other platforms.

AIM is prone to an issue which may allow attackers to execute arbitrary
files on the client system. It is possible to send a malicious link which
references local files to a user of the client. When the link is visited,
the referenced file on the client's local filesystem will be executed.

To exploit this issue, the attacker must know the exact location of the
file to be executed. Additionally, there can be no spaces in the path or
filename. This limits exploitability, since files must be on the same
partition and command line arguments cannot be supplied. Though the
attacker may use dot-dot-slash (../) sequences to traverse to the root
directory of the partition. If through some other means an attacker can
cause an arbitrary file to be placed on the victim filesystem, then an
attacker might exploit this issue to execute that file.

Versions other than AOL Instant Messenger 4.8.2790 do not seem to be
affected by this vulnerability. The vulnerability was reported for
Microsoft Windows versions of the client.

28. Mod_SSL Wildcard DNS Cross Site Scripting Vulnerability
BugTraq ID: 6029
Remote: Yes
Date Published: Oct 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6029
Summary:

Mod_SSL is an implementation of SSL (Secure Socket Layer) for the Apache
webserver. The Apache HTTP Server is a popular open-source HTTP server for
multiple platforms, including Windows and Unix.

A cross site scripting vulnerability has been discovered in mod_ssl.

It has been reported that Apache v1.x, when using the mod_ssl module will
return an unescaped server name in response to HTTP requests on SSL ports.

When Apache must construct a self-referencing URL, it will behave in one
of two manners, depending on the value of the 'UseCanonicalName' option.
With the option enabled, Apache will use the ServerName and Port values to
form a canonical name. With this option turned off, Apache will attempt to
use the hostname and port supplied by the client.

It should be noted that the existance of this vulnerability is limited to
configurations with both the 'UseCanonicalName' option turned off and
wildcard DNS enabled.

If all of these circumstances are met, an attacker may be able to exploit
this issue via a malicious link containing arbitrary HTML and script code
as part of the hostname. When the malicious link is clicked by an
unsuspecting user, the attacker-supplied HTML and script code will be
executed by their web client. This will occur because the server will echo
back the malicious hostname supplied in the client's request, without
sufficiently escaping HTML and script code.

An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link. Attacker-supplied HTML and script code may be
executed on a web client visiting the malicious link in the context of the
webserver.

Attacks of this nature may make it possible for attackers to manipulate
web content or to steal cookie-based authentication credentials. It may be
possible to take arbitrary actions as the victim user.

29. Microsoft Windows 2000 SNMP Printer Query Denial of Service Vulnerability
BugTraq ID: 6030
Remote: Yes
Date Published: Oct 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6030
Summary:

Microsoft Windows 2000 is vulnerable to a denial of service due to
resource exhaustion.

When the SNMP Agent service (snmp.exe) is installed on Windows 2000, the
LANMAN MIB (lmmib2.dll) is also installed. If the Print Spooler service
(spoolsv.exe) has not been started while the SNMP Agent is running, the
system could be vulnerable to the denial of service.

Querying the SNMP Agent using a GET or GETNEXT request for print queue
related values while the Print Spooler is not active will consume
approximately 30 MB of memory per request. Sending the vulnerable system
a large number of these requests will eventually cause the system to
consume all available memory and stop responding.

A valid 'read' string would have to be known in order to exploit this
vulnerability. This string is 'Public' by default.

Systems would have to be rebooted in order to resume normal operation.

30. Virgil CGI Scanner Remote Command Execution Vulnerability
BugTraq ID: 6031
Remote: Yes
Date Published: Oct 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6031
Summary:

Virgil CGI Scanner is a remote vulnerability auditing tool written in the
Bash Scripting language. It is available for the Linux and Unix operating
systems.

A vulnerability has been discovered in Virgil CGI Scanner.

It has been reported that the Virgil CGI Scanner fails to sufficiently
sanitize user-supplied input in the $TARGET and $ZIELPORT variables. The
software passes these variables as part of a command line argument,
potentially allowing characters to be passed, which could cause arbitrary
commands to be executed.

By exploiting this issue, a remote attacker may be able to cause arbitrary
commands to be executed on the system, with the privileges of the
webserver process.

31. FlashFXP FTP Password Disclosure Vulnerability
BugTraq ID: 6032
Remote: No
Date Published: Oct 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6032
Summary:

FlashFXP is a FTP implementation that allows client-server file transfers
in addition to site-to-site file transfers. It is available for Microsoft
Windows.

FlashFXP is prone to a vulnerability which may cause FTP authentication
credentials to be disclosed to local attackers.

When users authenticate with FTP sites, passwords are echoed with
asterisks. However, FlashFXP stores these passwords in plaintext in the
properties for queued file transfers. FTP passwords will be revealed to
local attackers who edit the transfer queue properties.

This may allow local attackers to gain unauthorized access for FTP sites
that other local users have access to.

32. Radiobird Software WebServer 4 All Host Field Header Buffer Overflow Vulnerability
BugTraq ID: 6034
Remote: Yes
Date Published: Oct 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6034
Summary:

RadioBird Software WebServer 4 All is a Web server designed for use with
Microsoft Windows operating systems.

A buffer overflow vulnerability has been reported for WebServer 4 All. The
vulnerability is due to inadequate bounds checking on the 'Host:' HTTP
header field.

An attacker can exploit this vulnerability by issuing excessively long
HTTP request that contains a malformed 'Host:' header consisting of at
least 2000 characters, to a system running a vulnerable version of
WebServer 4 All. This will cause the Web server to crash.

Although unconfirmed, it may be possible for a remote attacker to exploit
this issue to execute arbitrary system commands with the privileges of the
WebServer 4 All process.

This vulnerability was reported for WebServer 4 All version 1.28.

III. SECURITYFOCUS NEWS AND COMMENTARY
------------------------------------------
1. E-card Sneakware Delivers Web Porn
By Kevin Poulsen

A Trojan horse program created by an Internet adult entertainment company
routes surfers to racy sites.

http://online.securityfocus.com/news/1350

2. Attack On Internet Called Largest Ever
By David McGuire and Brian Krebs, Washington Post

The heart of the Internet sustained its largest and most sophisticated
attack ever, starting late Monday, according to officials at key online
backbone organizations.

http://online.securityfocus.com/news/1413

3. IE hopelessly bug ridden
By John Leyden, The Register

Nine closely-related Internet Explorer flaws leave users open to a variety
of powerful attacks, security researchers at Israeli firm GreyMagic
Software warned yesterday.

http://online.securityfocus.com/news/1410

4. Powerful attack cripples majority of key Internet computers
By Ted Bridis, The Associated Press

An unusually powerful electronic attack briefly crippled nine of the 13
computer servers that manage global Internet traffic this week, officials
disclosed Tuesday. But most Internet users didn't notice because the
attack only lasted one hour.

http://online.securityfocus.com/news/1400

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. CRM114 v2002-10-24
by Crah the Merciless
Relevant URL:
http://crm114.sourceforge.net/
Platforms: Linux, POSIX
Summary:

CRM114 is a Controllable Regex Mutilator and Smart Filter, designed for
easy creation of filters for things like incoming mail, system logs, or
monitoring processes. Filtering rules can be either hard-coded (such as
regexes), soft-coded (calculated at runtime or read from an external file
or process), or learned dynamically by phrase matching (by SBPH hashing).
This makes it possible to create very accurate filters with very little
actual work.

2. softflowd v0.7.1
by Damien Miller
Relevant URL:
http://www.mindrot.org/softflowd.html
Platforms: OpenBSD
Summary:

softflowd is a software flow-based network monitor. It tracks network
traffic flows and report aggregate statistics as well as (optionally)
export Cisco Netflow v1 compatible datagrams. It can listen on a
promiscuous network interface or read store pcap capture files, and
includes a sophisticated control interface.

3. TestMaker v3.0
by Frank Cohen
Relevant URL:
http://www.PushToTest.com/ptt
Platforms: Os Independent
Summary:

TestMaker tests Web Services (HTTP, HTTP, SOAP, .NET, XML-RPC, etc.) for
functionality, scalability, and performance. TestMaker is used to develop
intelligent agents which drive a Web service just like a real user to
check system configuration and to as simulate real-world environments
where heavy load from users or virus attacks can potentially bring down a
Web service. It comes with a scripting language to create the intelligent
test agents, a test object library for simulating user actions, a
graphical interface for creating and editing agents, and a utility to run
agents concurrently.

4. Remote packet filter control daemon v0.10
by haver
Relevant URL:
http://www.insecure.dk/rpfcd/
Platforms: OpenBSD, POSIX
Summary:

rpfcd (Remote packet filter control daemon) allows remote control and
monitoring of OpenBSD's packet filter. It communicates with clients using
the RPFC protocol running on top of SSL. The protocol is designed to be
relatively forgiving and easy to use. Its goal is to provide a common
framework for pf control and monitoring. Instead of running
pfctl/tcpdump/pflogd, writing ad-hoc parsing scripts, and sending the
results by mail, rpfcd will provide the same and much more via a
transparent server-client interface. Together with a decent CLI/GUI
client, pf firewall monitoring becomes rather easy. This is especially
interesting if you have several pf firewalls to control and monitor.

5. Rule Set Based Access Control v1.2.1
by Amon Ott [email protected]
Relevant URL:
http://www.rsbac.org/
Platforms: Linux
Summary:

Rule Set Based Access Control (RSBAC) is a Free Software security
extension for current Linux kernels. It is based on the Generalized
Framework for Access Control (GFAC) by Abrams and LaPadula and provides a
flexible system of access control based on several modules. All security
relevant system calls are extended by security enforcement code. This code
calls the central decision component, which in turn calls all active
decision modules and generates a combined decision. This decision is then
enforced by the system call extensions.

6. ggsniff v1.1d
by Ryba
Relevant URL:
http://sourceforge.net/projects/ggsniff/
Platforms: Linux, POSIX
Summary:

ggsniff is a sniffer that allows you to record Gadu-Gadu messages. It is
not currently a standalone application. Rather, it is a patch for dsniff
that adds the ability to record Gadu-Gadu messages to msgsnarf.

V. SECURITY JOBS SUMMARY
------------------------
1. Bayarea Network Security Architect Seeking a Job (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/297058

2. Forensics Expert/Computer Crime Investigator Needed (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/297057

3. Sr. Information Security Scientist, Risk Assessments - Chicago, IL - up to $120,000 - Greythorn (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/297087

4. Pre-Sales Security Engineers wanted for East Coast (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/297056

5. UNIX System Administrator with security skills seeking job in South Florida or East Coast (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296825

6. Seeking Sr Security Analyst position in NYC or Philly (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296824

7. Lead Technical Security Analyst - London, UK. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296812

8. IT Security Training & Awareness Manager, London UK. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296814

9. Application Security Engineer - Chicago, ILL (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296811

10. NEEDED - Sr. Security architects for Long Island, NY (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296764

11. Seeking Bored/Part-time Programmers (C/C++/JAVA) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296763

12. Security Recruiter (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296765

13. Seeking Position-Big 5 Experience-Silicon Valley (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296667

14. Software Security Engineering Manager (Applications) San Diego (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296665

15. Security Software Sales Executive - Security Management Software (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296608

16. Lead Information Risk Analyst - London, UK. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296599

17. Sr. Microsoft Security Engineer - NYC (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296601

18. Needed GISRA Policy Wonk (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296600

19. Pre Sales Engineer- New York Metro (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296595

20. Seeking IT Security Job In Europe (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296598

21. Position wanted as senior consultant or manager (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296612

22. Senior Security Consultant - Sydney, Australia (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296597

23. Senior Security Architect looking (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296611

24. Consulting Engineer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296472

25. NEEDED - Sr. Assurance Security Engineer - San Diego (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296474

26. Senior Account Executive (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296458

27. Security Data Management Sales Opportunity (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296464

28. NEED: Senior Network Security Engineer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296457

29. Security professional available in the Boston area (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296381

30. Vice President Technical Services (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296372

31. Where are you located? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296286

32. CISSP CCSE Infosec expert having 8 years of exp,seeking an opportunity (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296285

33. Contract - Sr. Security NIAP Consultant - San Diego (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296284

34. CISSP Seeking Security Analyst/IT Audit Position in South Florida (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/296156

VI. INCIDENTS LIST SUMMARY
-------------------------
1. Slapper questions (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/297094

2. ABfrag followup / WITHOUT ATTACHMENT (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/297071

3. unusual packet (tcpdump shows): rad-#0 41 [id 0] Attr[ (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/297047

4. a different, stranger port 137 activity (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/297083

5. Invalid IP address (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296883

6. Unusual ICMP Traffic (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296675

7. Hiding IP addresses in trace data (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296495

8. Connection Attempts - Port 8047 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296492

9. Linux Kernel Exploits / ABFrag (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296482

10. W2K Compromise - PipeCmdSrv (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296466

11. Source of Windows PopUp SPAM (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296312

12. HTTP attack looking for /sumthin ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296200

13. Security problem in installation IE sp1 ? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296194

14. Thanks on NetBios DoSing... (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296172

15. apache problem (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296174

16. DoS and Windows Login (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/296168

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. shellcode -> asm? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/297031

2. Covert Channels (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/297020

3. UserID and hashed password for Lotus Domino (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/296774

4. Call For Papers Announcement: Black Hat Windows Security (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/296553

5. Re[2]: UserID and hashed password for Lotus Domino (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/296362

6. Help with a Clariion 4500 (aka dell fc450) raid array (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/296373

7. /instmsg/alias/annoying_web_logs ;) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/296287

8. HTML email and external embedded links. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/296794

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. How ISA rule base works and how to bind users IP with MAC. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/297030

2. Subject: How ISA rule base works and how to bind users IP with MAC. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/296961

3. Some Useful Security Tools (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/296815

4. Securing Citrix NFuse and IIS 5 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/296589

5. SecurityFocus Microsoft Newsletter #109 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/296462

6. GetAd.exe testing (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/296358

IX. SUN FOCUS LIST SUMMARY
----------------------------
1. Antwort: Current Solaris security infodocs (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/297013

2. Current Solaris security infodocs (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/297059

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Continuous medium traffic fake Syn packets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/296849

2. iptables firewall and forwarding. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/296618

3. Linux FTP/Firewall combo suggestion requested (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/296614

4. How to get rid of spoofed IP-Address responses (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/296452

XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored By: SpiDynamics

http://www.spidynamics.com/mktg/freewebinspect11

-------------------------------------------------------------------------------