SecurityFocus Newsletter #168

Stephen Entwisle <[email protected]> Mon, 4 Nov 2002 14:08:06 -0700 (MST)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #168
--------------------------------
This issue sponsored by: Qualys

Bulletproof Your Network: FREE Guide from Qualys

Existing security products -- firewalls, anti-virus and IDS -- are simply
no longer enough to ensure your networks are safe against sophisticated
attacks and worms such as Code Red and Nimda. FREE Guide shows you how to
ensure TOTAL security for your network. Get it now.

https://www.qualys.com/forms/guide_229.php
------------------------------------------

I. FRONT AND CENTER
1. Scary Movie
2. Responsible Disclosure by Corporate Fiat
3. Attack of the Mod Squads
4. SecurityFocus DPP Program
5. InfoSec World Conference and Expo/2003

II. BUGTRAQ SUMMARY
1. Alt-N MDaemon POP Server Buffer Overflow Vulnerability
2. AN HTTPD Cross Site Scripting Vulnerability
3. Benjamin Lefevre Dobermann Forum Remote File Include Vulnerability
4. phpBB2 Unauthorized Administrative Access Vulnerability
5. MailReader.com NPH-MR.CGI File Disclosure Vulnerability
6. MailReader.com Remote Command Execution Vulnerability
7. Cisco AS5350 Universal Gateway Portscan Denial Of Service Vuln
8. Sun Solaris Web-Based Enterprise Management Insecure Default File...
9. SonicWall Content Filtering Software URL Filter Bypassing Vuln
11. GTetrinet Multiple Remote Buffer Overflow Vulnerabilities
12. Apache 2 WebDAV CGI POST Request Information Disclosure Vuln
13. Microsoft PPTP Buffer Overrun Vulnerability
14. Multiple Microsoft IIS Vulnerabilities
15. Microsoft IIS Out Of Process Privilege Escalation Vulnerability
16. Microsoft IIS WebDAV Denial Of Service Vulnerability
17. Microsoft IIS Script Source Access File Upload Vulnerability
18. Microsoft IIS Administrative Pages Cross Site Scripting Vuln
19. Cisco ONS15454/ONS15327 Optical Transport Platforms Multiple Vuln
20. SmartMail Server Closed Connection Denial Of Service Vulnerability
21. SmartMail Server Oversized Request Denial Of Service Vulnerability
22. LPRNG runlpr Local Privilege Escalation Vulnerability
23. LPRNG html2ps Remote Command Execution Vulnerability
24. Cisco ONS15454/ONS15327 Optical Transport Platforms Plaintext...
25. Cisco ONS15454/ONS15327 Optical Transport Platforms Unauthorized...
26. Cisco ONS15454/ONS15327 Optical Transport Platforms HTTP Request...
27. Cisco ONS15454/ONS15327 Optical Transport Platforms Default Account...
28. Cisco ONS15454/ONS15327 Optical Transport Platforms CORBA IOR Denial...
29. Cisco ONS15454/ONS15327 Optical Transport Platforms Public SNMP...
30. Oracle 9i Database Server Malformed USERID Buffer Overflow Vuln...
31. Linksys BEFSR41 Gozila.CGI Denial Of Service Vulnerability
32. Jason Orcutt Prometheus Remote File Include Vulnerability
33. PHP-Nuke 5.6 Modules.PHP SQL Injection Vulnerability
34. Michael Krax log2mail Remote Buffer Overflow Vulnerability
35. ION Script Remote File Disclosure Vulnerability
36. Multiple Vendor Access Point Embedded HTTP Server Denial of Service...
37. Iomega NAS A300U CIFS/SMB Mounts Plaintext Authentication Vulnerability
38. Iomega NAS A300U Plaintext NAS Administration Credentials Vulnerability
39. Abuse Local Buffer Overflow Vulnerability

III. SECURITYFOCUS NEWS ARTICLES
1. Don't Touch that Dial
2. Email deletion bug bites Norton Internet Security
3. Wi-Fi Alliance tries again on wireless security
4. How to get certified security for Win2k, by Microsoft
5. BugBear tops virus charts as Klez refuses to die
6. The Day the Net Nearly Choked
7. Introducing Network Attached Encryption
8. MS gets top security rating for Win2k, makes big noise
9. Of mad snipers and cyber- terrorists

IV.SECURITYFOCUS TOP 6 TOOLS
1. Green Black List Creator for Procmail Recipes v0.1
2. PCX Firewall v2.17
3. E-pad v1.0
4. Apache DoS Evasive Maneuvers Module v1.3
5. Mail Master v1.01
6. softflowd v0.7.1

V. SECURITYJOBS LIST SUMMARY
1. Exciting Opportunity for Senior level InfoSec Engineer in Reston, VA
2. InfoSec Professional (BS Comp Sci, CISSP) Looking in San Diego Area
3. Mid-Level Computer Security Administrator/West Virginia (Thread)
4. Global Anti Virus Specialist - NAV - London, UK. (Thread)
5. Seeking So. Florida Opportunities [CISSP, GCFA, GSEC, MCSE] (Thread)
6. Job Opening for a Security Expert (Thread)
7. Anti Virus Consultant / Anti Virus Specialist - UK (NAV) (Thread)
8. Resume - Information Systems Security Professional (Thread)
9. SAFETY / SECURITY EXPERTS, NYC (Thread)
10. Enterprise Security Administrator / Anti Virus Lead (Thread)
11. Two Tivoli Access Manager positions available in Chicago! (Thread)
12. Senior Technical Support Engineer (Thread)
13. Incid Response / Digital Forensics Lead - Chicago, ILL (Thread)
14. Experienced UNIX Engineer looking for entry level security position
15. Pre Sales Consultant (Thread)
16. Network & Systems Security Administrator - Chicago, IL - up to $75,000
17. Need: PKI and IDS Positions in Washington DC (Thread)
18. Predictive Systems NYC - Sr Security Consultants (Thread)
19. Security Engineer (PKI & PKI Applications) in Washington DC (Thread)
20. CISSP willing to relocate travel etc (Thread)
21. AUSTRALIA SYDNEY TEAM LEADER REQUIRED (Thread)
22. AUSTRALIA ACT BDM REQUIRED (Thread)
23. AUSTRALIA SYDNEY PROGRAMMER/ANALYST (Thread)
24. AUSTRALIA SYDNEY SENIOR PROGRAMMER/ANALYST NEEDED (Thread)
25. Application Security Consultant, Northern, VA (Thread)

VI. INCIDENTS LIST SUMMARY
1. Port 1975 rogue service (Thread)
2. Fw: Port 1975 rogue service (Thread)
3. DOS ATTACK (Thread)
4. Apache 1.3.26 seg faults & bus errors (Thread)
5. DOS Attack Update (Thread)
6. Apache DoS Module Patch (WAS RE: DOS ATTACK) (Thread)
7. Strange attacks (Thread)
8. Slapper questions (Thread)
9. Web log abuse? (Thread)
10. Keep connecting to remote host on port 7869 (Thread)

VII. VULN-DEV RESEARCH LIST SUMMARY
1. Phenoelit Advisory 0815 ++ // Xedia (Thread)
2. Firewall bypassing tool (Thread)
3. TOTAL WIRELESS SECURITY (Thread)
4. Software leaves encryption keys, passwords lying around in memory (Thread)
5. Software leaves encryption keys, passwords lying around inmemory (Thread)
6. REDHAT 8.0 local root (Thread)
7. Retransmissions while blocking TCP Stack's RST? (Thread)
8. Fw: wu-ftpd glob vulnerability (Thread)
9. TCP Daytona and Fragroute?!? (Thread)
10. Generic protection in PHP (Thread)

VIII. MICROSOFT FOCUS LIST SUMMARY
1. Certification for Win2k Web Servers (Thread)
2. Access to well-known ports on Win2K (Thread)
3. Preventing copying files (Thread)
4. Priviledge escalation attack (Thread)
5. The death of shatter attacks? (Thread)
6. WINNT security priviledge escalation attack (Thread)
7. Securing ASP.NET for Hosting (Thread)
8. SecurityFocus Microsoft Newsletter #110 (Thread)

IX. SUN FOCUS LIST SUMMARY
1. Administrivia: Out for a wedding (Thread)
2. Hardening Solaris: Information resources (Thread)

X. LINUX FOCUS LIST SUMMARY
1. Administrivia: Out for a wedding (Thread)

I. FRONT AND CENTER
-------------------
1. Scary Movie

Hollywood's creative geniuses have launched a new horror genre: the
computer virus slasher film. How did we live without this?

http://online.securityfocus.com/columnists/121

2. Responsible Disclosure by Corporate Fiat

The new Organization for Internet Safety aims to make vulnerability
disclosure more responsible. It's a good idea, but is the group too
corporate to pull it off?

http://online.securityfocus.com/columnists/120

3. Attack of the Mod Squads

Game console mod chips can be used for everything from watching movies to
installing Linux on your X-Box. But under goofy copyright laws, the piracy
app kills all the others.

http://online.securityfocus.com/columnists/119

4. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:

http://www.securityfocus.com/corporate/products/dpsection.shtml

5. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)
Optional Workshops March 8, 9, 12, 13, & 14
Vendor Expo March 10 & 11

Solutions to today's security concerns; hands-on experts; blockbuster
vendor expo; the CISO Executive Summit; invaluable networking
opportunities. InfoSec World has it all! Go to:
http://www.misti.com/10/os03nl37inf.html

II. BUGTRAQ SUMMARY
-------------------

1. Alt-N MDaemon POP Server Buffer Overflow Vulnerability
BugTraq ID: 6053
Remote: Yes
Date Published: Oct 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6053
Summary:

Alt-N MDaemon is a Microsoft Windows based mail server product.

A buffer overflow vulnerability has been reported for MDaemon. The
vulnerability is due to inadequate bounds checking on the 'UIDL' and 'DELE'
POP server commands.

An attacker can exploit this vulnerability by submitting a very large
integer value for the UIDL, or DELE, command to the POP server. An integer
value greater than 2147483647 will cause the MDaemon service to crash.

Although unconfirmed, it may be possible for a remote attacker to exploit
this issue to execute arbitrary system commands with the privileges of the
MDaemon process.

This vulnerability was reported for MDaemon 6.0.7. It is likely that earlier
versions are affected as well.

2. AN HTTPD Cross Site Scripting Vulnerability
BugTraq ID: 6054
Remote: Yes
Date Published: Oct 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6054
Summary:

AN HTTPD is a Web server designed for use on Microsoft Windows operating
systems.

AN HTTPD does not filter HTML tags from URI parameters, making it prone to
cross-site scripting attacks. As a result, it is possible for a remote
attacker to create a malicious link containing script code which will be
executed in the browser of a legitimate user, in the context of the website
running AN HTTPD.

When AN HTTPD receives a HTTP request that contains a ':', it will generate
an error page. This error page is displayed to the user without any prior
sanitization. Any malicious HTML code that may be included in the URI will
be executed.

This issue may be exploited to steal cookie-based authentication credentials
from legitimate users of the website running the vulnerable software. The
attacker may hijack the session of the legitimate by using cookie-based
authentication credentials.

This vulnerability was reported for AN HTTPD 1.41d.

3. Benjamin Lefevre Dobermann Forum Remote File Include Vulnerability
BugTraq ID: 6057
Remote: Yes
Date Published: Oct 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6057
Summary:

Dobermann Forum is a Web forum implemented in PHP. It is available for Unix
and Linux variants as well as Microsoft Windows operating systems.

Dobermann Forum is prone to an issue which may allow remote attackers to
include arbitrary files located on remote servers. This issue is present in
the following PHP script files provided with Dobermann Forum:
entete.php
enteteacceuil.php topic/entete.php
index.php
newtopic.php

An attacker may exploit this by supplying a path to a maliciously created
'banniere.php' file, located on an attacker-controlled host as a value for
the 'subpath' parameter.

If the remote file is a PHP script, this may allow for execution of
attacker-supplied PHP code with the privileges of the webserver. Successful
exploitation may provide local access to the attacker.

4. phpBB2 Unauthorized Administrative Access Vulnerability
BugTraq ID: 6056
Remote: Yes
Date Published: Oct 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6056
Summary:

phpBB2 is an open-source web forum application that is written in PHP and
supported by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

The admin_ug_auth.php script is used by phpBB administrators to specify user
privileges. Depending on the permissions set via admin_ug_auth.php,
administrative privileges may be required to view certain pages.

A vulnerability has been discovered the admin_ug_auth.php script, which
allows malicious users to post responses to administrative pages, without
the need to view them. By constructing a malicious response, it may be
possible for an unauthorized user to grant 'administrator' privileges to
arbitrary users.

Exploiting this issue could allow a remote attacker to gain complete control
of a target forum.

It has been reported that third party utilities that use phpBB v2.0.0 may
also be vulnerable to this issue.

5. MailReader.com NPH-MR.CGI File Disclosure Vulnerability
BugTraq ID: 6055
Remote: Yes
Date Published: Oct 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6055
Summary:

Mailreader.com is a web-based e-mail client.

A vulnerability exists in Mailreader.com which may enable remote attackers
to disclose the contents of arbitrary webserver readable files. An attacker
may exploit this issue by submitting a malicious web request containing
dot-dot-slash (../) directory traversal sequences. The request must be for
a known resource, and the file request must be appended by a null byte
(%00). Such a request will break out of the webroot directory and cause the
attacker-specified file to be served, provided it is readable by the
webserver.

This problem exists in the 'nph-mr.cgi' and is due to insufficient
validation of the input supplied to the 'configLanguage' CGI parameter.

Exploitation of this vulnerability has the potential to disclose sensitive
information to attackers which may aid in further attacks.

6. MailReader.com Remote Command Execution Vulnerability
BugTraq ID: 6058
Remote: Yes
Date Published: Oct 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6058
Summary:

Mailreader.com is a web-based e-mail client.

A vulnerability has been reported in Mailreader.com which may allow remote
attackers to execute arbitrary commands on the underlying shell with the
privileges of the webserver.

This issue was introduced in version 2.3.30. User-supplied input is passed
to the sendmail Mail Transfer Agent (MTA), but is not sufficiently sanitized
of shell metacharacters before being passed through the shell. This input
is supplied via the '$CONFIG{RealEmail}' variable in the 'compose.cgi'
script. The input is then passed through the shell via the '$from' variable
in the 'network.cgi' script when the MTA is requested.

7. Cisco AS5350 Universal Gateway Portscan Denial Of Service Vulnerability
BugTraq ID: 6059
Remote: Yes
Date Published: Oct 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6059
Summary:

Cisco AS5350 Universal Gateway is a hardware gateway that is capable of
providing access to any service on any port.

The Cisco AS5350 Universal Gateway is reported to be prone to a denial of
service condition. It is possible to cause this condition by portscanning a
vulnerable device. This issue was demonstrated using the nmap portscanning
utility. Exploitation of this condition will cause a "hard" lockup,
requiring that the device is power-cycled before functionality is returned.

This issue was reported for Cisco AS5350 devices running Cisco IOS release
12.2(11)T. Other firmware and devices may also be affected.

There are conflicting reports regarding the existence of this vulnerability.
One source states that this condition reportedly does not occur if there are
no Access Control Lists (ACL) applied on the device and also mentions that
this may be related to a known SSH bug. Other sources have indicated that
the issue may be related to a configuration problem.

8. Sun Solaris Web-Based Enterprise Management Insecure Default File Permissions Vulnerability
BugTraq ID: 6061
Remote: No
Date Published: Oct 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6061
Summary:

A problem with some releases of Solaris 8 may make it possible for local
users to perform unintended actions. The problem is in the Web-Based
Enterprise Management (WBEM) component packaged with recent releases of
Solaris.

The WBEM packages included with some releases of Solaris install files with
insecure permissions. By default, some files contained within WBEM packages
are installed with default group-writable permissions, and in some cases
default world-writable permissions. This could lead to local users gaining
write access to potentially sensitive files, and potentially launching a
denial of service or privilege escalation attack.

This problem is known to exist in Solaris 8 Update 1/01 and later, and
exists primarily in the packages SUNWwbdoc, SUNWwbcou, SUNWwbdev, and
SUNWmgapp. It should be noted that WBEM was introduced with Solaris 8
Update 1/01, therefore versions Solaris 8, Solaris 8 Update 6/00 and Solaris
8 Update 10/00 are not vulnerable to this particular problem.

9. SonicWall Content Filtering Software URL Filter Bypassing Vulnerability
BugTraq ID: 6063
Remote: Yes
Date Published: Oct 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6063
Summary:

SonicWall Content Filtering software is designed for use with SonicWall
Appliances.

A problem with the software could make it possible for a user to circumvent
restrictions placed on URLs.

It has been reported that the SonicWall Content Filtering software does not
sufficiently check addresses when requests are made. Because of this, it
would be possible for a user behind the system to reach a restricted-access
site by requesting the site on the basis of IP addresses.

It should be noted that this is potentially a configuration issue. The
design of URL filtering software typically requires that all sites be
blacklisted by default, with a whitelist of authorized sites specified.

10. Arescom NetDSL-800 Firmware Undocumented Username/Password Weakness
BugTraq ID: 6064
Remote: Yes
Date Published: Oct 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6064
Summary:

The Arescom NetDSL 800 series ADSL modem/router is a stand-alone device. It
is compatible with various operating systems including Windows, MacOS, Unix,
and Linux.

A weakness has been discovered in NetDSL-800 router firmware.

It has been reported that NetDSL-800 firmware, configured by certain
Internet Service Providers(ISP), contain undocumented users. Undocumented
users have administrative privileges.

It is possible to obtain a target devices undocumented username and password
using a network sniffer and the Arescom NetDSL Remote Manager. Access to
this information could grant unauthorized administrative access to remote
attackers.

Administrative privileges gained on target routers may allow attackers to
corrupt configuration settings or cause a denial of service.

It should be noted that all firmware configurations may not contain
undocumented users. Firmware configured by the MSN ISP are reported to be
vulnerable.

It should also be noted that it has not yet been confirmed whether unique
username and passwords are generated for each device.

11. GTetrinet Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 6062
Remote: Yes
Date Published: Oct 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6062
Summary:

GTetrinet is a freely available, open source networked Tetris game client.
It is available for Linux and Microsoft Windows systems.

Several problems have been reported in the GTetrinet client that could
result in remote exploitation. Due to several bounds checking
vulnerabilities in GTetrinet, the user of a vulnerable client could allow
unintended actions on the part of a malicious server. Exploitation of these
vulnerabilities by a malicious server could result in a denial of service,
and potentially execution of arbitrary instructions in the security context
of the user.

These vulnerabilities are due to numerous insecure strcat and strcpy
functions in the GTetrinet code. Code executed through these
vulnerabilities could result in an attacker gaining access to the vulnerable
system with the privileges of the client.

12. Apache 2 WebDAV CGI POST Request Information Disclosure Vulnerability
BugTraq ID: 6065
Remote: Yes
Date Published: Oct 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6065
Summary:

WebDAV (Web-based Distributed Authoring and Versioning) is a set of HTTP
extensions that allows multiple users to edit and manage files on remote web
servers.

An information disclosure vulnerability has been for Apache 2. The
vulnerability occurs due to inadequate checks being performed on CGI
scripts. This vulnerability exists only when both WebDAV and CGI are enabled
for folders.

An attacker can exploit this vulnerability by making a POST request to a CGI
script. Due to improper interaction between WebDAV and CGI scripts, this
will result in the Web server returning the contents of the CGI script to
the remote attacker.

Information obtained in this manner may allow an attacker to launch further,
potentially destructive, attacks against a vulnerable system.

13. Microsoft PPTP Buffer Overrun Vulnerability
BugTraq ID: 6067
Remote: Yes
Date Published: Oct 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6067
Summary:

Microsoft has reported a buffer overrun in its implementation of the PPTP
service. The condition occurs when a vulnerable implementation processes
malformed control data. The precise nature of the control data involved and
how it is malformed has not been disclosed.

It is reportedly possible to exploit both PPTP servers and clients. To
exploit a server, a malicious client need only initiate a PPTP connection.
During this process, malformed control data may be transmitted to trigger
the overrun.

To exploit clients, a malicious server must transmit the malformed data to
the target after a connection has been initiated and is active.

As the overrun occurs in the kernel, attackers may exploit the vulnerability
to crash target hosts. It may also be possible to execute arbitrary code,
however this has not been confirmed.

**Note: It is likely that this is BID 5807. This has not been confirmed by
Microsoft. If this is the same issue, this BID will be retired.

14. Multiple Microsoft IIS Vulnerabilities
BugTraq ID: 6068
Remote: Yes
Date Published: Oct 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6068
Summary:

Microsoft Internet Information Services (IIS) is prone to multiple
vulnerabilities.

The first vulnerability may allow an attacker to obtain elevated privileges.
This vulnerability can be exploited by an attacker to load and execute
applications on the vulnerable server with SYSTEM level privileges. This
vulnerability can exploited when IIS is configured to run applications out
of process.

The second vulnerability may allow a remote attacker to cause a denial of
service condition. This vulnerability is related to how IIS allocates memory
for WebDAV (Web-based Distributed Authoring and Versioning) requests. Any
specially crafted WebDAV requests may result in IIS allocating an extremely
large amount of memory on the server. Several malformed requests sent to the
server will result in the vulnerable system failing to respond to further
legitimate requests for service. This vulnerability affects IIS 5.0 and 5.1
only.

The third vulnerability may allow a remote attacker to upload a file onto
the vulnerable server and possibly execute it. The vulnerability is a result
of inappropriate listing of file types that are subject to the script source
access permission in IIS 5.0. Files of type .COM are not on the list of
files that are subject to script source access. As a result an attacker may
be able to upload malicious .COM files to a vulnerable server and possibly
execute it. This vulnerability only affects IIS 5.0.

The final vulnerability is a cross site scripting vulnerability. The
vulnerability is a result of improper sanitization of user-supplied input by
IIS. Several web pages, provided by IIS for administrative purposes do not
adequately sanitize user-supplied input. Any malicious HTML code that may be
included in the URI will be executed.

** At the earliest possible convenience, this record will be divided up into
new vulnerability records where it is appropriate. Existing records will
also be updated to reflect the information contained in the Microsoft
Security Bulletin.

15. Microsoft IIS Out Of Process Privilege Escalation Vulnerability
BugTraq ID: 6069
Remote: Yes
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6069
Summary:

Microsoft IIS (Internet Information Services) is vulnerable to a privilege
elevation vulnerability.

IIS can be configured to run applications either 'in process' or 'out of
process'. The vulnerability is due to the way applications are executed when
IIS is configured to run applications out of process. By default, IIS 5.0
and 5.1 run applications run out of process for increased stability and
security. Applications executed out of process will be executed within the
security context of the IWAM_computername account.

When IIS is configured to run out of process, .asp requests and ISAPI dlls
are executed within the dllhost.exe process. The dllhost.exe process uses
CoImpersonateClient in order to obtain an impersonation token for the SYSTEM
account in order to process the request. It then uses a RevertToSelf call
in order to return to IWAM_computername privilege level.

It is possible for an attacker to manipulate the dllhost.exe memory space
while it is running with IWAM_computername privilege. This could cause
dllhost.exe to execute attacker supplied code when it impersonates SYSTEM
privileges.

It should be noted that exploitation is possible only when an attacker has
write and execute permissions on Web directories.

This vulnerability was originally described in BugTraq ID 6068. It is now
being assigned its own BugTraq ID.

16. Microsoft IIS WebDAV Denial Of Service Vulnerability
BugTraq ID: 6070
Remote: Yes
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6070
Summary:

A denial of service vulnerability has been reported for Microsoft IIS 5 and
5.1. The vulnerability is related to how WebDAV requests are handled by IIS.
WebDAV (Web-based Distributed Authoring and Versioning) is a set of HTTP
extensions that allows multiple users to edit and manage files on remote web
servers.

An attacker can exploit this vulnerability by making a specially crafted
WebDAV request to a vulnerable IIS server. This results in IIS allocating an
extremely large amount of memory on the server. Several such malformed
requests sent to the server will result in the vulnerable system consuming
all available memory resources and failing to respond to further legitimate
requests for service.

Exploitation of this vulnerability is possible only if the Indexing service
is enabled and WebDAV requests are allowed. By default, the Indexing service
is not enabled.

This vulnerability was originally described in BugTraq ID 6068. It is now
being assigned its own BugTraq ID.

17. Microsoft IIS Script Source Access File Upload Vulnerability
BugTraq ID: 6071
Remote: Yes
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6071
Summary:

A vulnerability has been reported for Microsoft IIS 5.0 that may allow a
remote attacker to upload certain files onto a vulnerable server and
possibly execute it.

The vulnerability is due to an inappropriate listing of file types that are
subject to the script source access permission.

It should be noted that exploitation is possible only when an attacker has
write permissions on Web directories. Files of type .COM are not on the list
of files that are subject to script source access. As a result an attacker
may be able to upload malicious .COM files to a vulnerable server. An
attacker who also has execute permissions on Web directories may be able to
execute the malicious file on the vulnerable server.

This vulnerability was originally described in BugTraq ID 6068. It is now
being assigned its own BugTraq ID.

18. Microsoft IIS Administrative Pages Cross Site Scripting Vulnerabilities
BugTraq ID: 6072
Remote: Yes
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6072
Summary:

Microsoft IIS is prone to cross-site scripting attacks.

The vulnerability is a result of improper sanitization of user-supplied
input by IIS. Several web pages, provided by IIS for administrative purposes
do not adequately sanitize user-supplied input. Any malicious HTML code that
may be included in the URI will be executed.

This vulnerability was originally described in BugTraq ID 6068. It is now
being assigned its own BugTraq ID.

19. Cisco ONS15454/ONS15327 Optical Transport Platforms Multiple Vulnerabilities
BugTraq ID: 6073
Remote: Yes
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6073
Summary:

Multiple vulnerabilities have been reported in the Cisco ONS15454 Optical
Transport and Cisco ONS15327 Edge Optical Transport platforms. To exploit
these issues, the attacker must be able to access the affected services on
TCC, TCC+ and XTC control cards.

The first vulnerability will allow an attacker to connect to FTP services on
TCC, TCC+ or XTC control cards with non-existent user and password
credentials. The consequence is unauthorized access for malicious users who
are able to access TCC, TCC+ or XTC control cards. Unauthorized FTP access
will enable an attacker to upload modified configuration files or delete
software images.

The second vulnerability may allow attackers with access to the running
image database for TCC, TCC+ or XTC control cards to gain unauthorized
access to authentication credentials. Authentication credentials are stored
in plaintext in the image database. If authentication credentials can be
obtained, the attacker may gain administrative control of the Cisco ONS
platform.

The third vulnerability is due to a default, unchangeable "public" SNMP
community string. This may allow for unauthorized SNMP access to TCC, TCC+
or XTC control cards. The attacker may gain access to the SNMP MIBs. At
the very least, this may disclose sensitive network information to
attackers.

The fourth issue is a denial of service condition which occurs when an
invalid CORBA Interoperable Object Reference (IOR) is requested via HTTP.
Such a request will cause TCC, TCC+ or XTC control cards to reset.

The fifth issue is another denial of service condition. This condition is
triggered when a malformed HTTP request is made to TCC, TCC+ or XTC control
cards. HTTP requests which start with any other character than a
forward-slash (/) will trigger the condition and cause the control cards to
reset.

The sixth issue is a problem with a default username/password for TCC, TCC+
and XTC control cards. The default VxWorks OS account password cannot be
changed, nor is it possible to disable the account. This may be exploited
if the attacker can connect to one of the control cards via telnet. The
attacker may gain administrative control of the Cisco ONS platform.

** When analysis of these issues is complete, each separate vulnerability
will be given an individual Bugtraq ID.

20. SmartMail Server Closed Connection Denial Of Service Vulnerability
BugTraq ID: 6074
Remote: Yes
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6074
Summary:

SmartMail Server is an e-mail server for Microsoft Windows operating
systems. SmartMail Server supports e-mail via SMTP, POP3 and HTTP.

SmartMail Server is reported to be prone to a denial of service when a
client is sending data and then closes the connection unexpectedly. This is
reported to cause an access violation error in the 'smartsvr.exe' module.

SmartMail Server will need to be restarted to regain normal functionality.

This issue was reported in SmartMail Server 2.0 Interim Build 83. It is not
known if other versions are affected.

21. SmartMail Server Oversized Request Denial Of Service Vulnerability
BugTraq ID: 6075
Remote: Yes
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6075
Summary:

SmartMail Server is an e-mail server for Microsoft Windows operating
systems. SmartMail Server supports e-mail via SMTP, POP3 and HTTP.

SmartMail Server is reported to be prone to a remote denial of service
condition. It is possible to trigger this condition by sending large
amounts (5MB+) of data to the server via TCP port 25 or 110. Exploitation
will cause all SmartMail Server services (POP/SMTP/HTTP) to shutdown.

SmartMail Server will need to be restarted to regain normal functionality.

This issue was reported in SmartMail Server 1.0 BETA 10. It is not known if
other versions are affected.

22. LPRNG runlpr Local Privilege Escalation Vulnerability
BugTraq ID: 6077
Remote: No
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6077
Summary:

The 'runlpr' utility is distributed with lprng and is used to allow regular
users to invoke the lpr process as the root user.

A vulnerability has been discovered in the 'runlpr' utility, which could
allow a malicious user to execute arbitrary commands with elevated
privileges.

An attacker can exploit this vulnerability by passing malicious commands to
lpr via the commandline. This will result in arbitrary attacker-supplied
commands being executed with root level privileges.

Precise technical details regarding this issue are unknown at this time.
This bid will updated accordingly, as more information regarding the
vulnerability becomes available.

23. LPRNG html2ps Remote Command Execution Vulnerability
BugTraq ID: 6079
Remote: Yes
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6079
Summary:

A vulnerability has been discovered in the html2ps filter which is included
in the lprng print system.

It has been reported that it is possible for a remote attacker to execute
arbitrary commands, with the privileges of the 'lp' user. Depending on the
method used to invoke the lpr daemon, it may be possible to execute commands
with root privileges.

Precise technical details regarding this issue are unknown at this time.
This bid will updated accordingly, as more information regarding the
vulnerability becomes available.

24. Cisco ONS15454/ONS15327 Optical Transport Platforms Plaintext Credentials Vulnerability
BugTraq ID: 6078
Remote: No
Date Published: Oct 31 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6078
Summary:

Cisco ONS15454 Optical Transport/Cisco ONS15327 Edge Optical Transport
platforms are optical networking devices that allow multiple network
elements to be combined on a single platform.

A vulnerability has been reported in the Cisco ONS15454 Optical Transport
and Cisco ONS15327 Edge Optical Transport platforms. Administrative
authentication credentials are stored in plaintext in the running image
database for TCC, TCC+ or XTC control cards. An attacker with access to the
backup of the running image database may trivially retrieve these
credentials. If authentication credentials can be obtained, the attacker
may gain administrative control of the Cisco ONS platform.