SecurityFocus Newsletter #182

John Boletta <[email protected]> Mon, 3 Feb 2003 13:15:09 -0700 (MST)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #182
-----------------------------

This Issue is Sponsored by: GuardedNet - Transforming Security Data into
Knowledge

Event Correlation - Is it Security's Holy Grail?

neuSECURE isa centralized monitoring system that correlates and analyzes
event data from firewalls, IDS's, hosts and routers for real-time attack
detection and response. It's proven to improve attack detection and reduce
the time you spend investigating attacks.

Sign up to receive our White Paper about neuSECURE's correlation
capabilities entitled "Event Correlation: Security's Holy Grail?" at
http://www.guarded.net/sfocusfebruary_correlation.html
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Forensics on the Windows Platform, Part 1
2. The Busy Life of a Welsh Virus-Writer
3. New Book: Hacker's Challenge 2 Test Your Network Security...
4. SecurityFocus DPP Program
5. InfoSec World Conference and Expo/2003 (March10-12,2003,Orlando,FL)
II. BUGTRAQ SUMMARY
1. GNU Mailman 'email' Cross Site Scripting Vulnerability
2. GNU Mailman Error Page Cross Site Scripting Vulnerability
3. SpamAssassin BSMTP Mode Buffer Overflow Vulnerability
4. Sun Java Virtual Machine Illegal Access To Object Methods...
5. SyGate Insecure UDP Source Port Firewall Bypass Weak Default...
6. FTLS GuestBook Script Injection Vulnerability
7. Blackboard Learning System search.pl SQL Injection Variant...
9. List Site Pro User Database Delimiter Injection Vulnerability
10. Hypermail Message Attachment Buffer Overflow Vulnerability
11. Hypermail CGI Mail Reverse DNS Lookup Buffer Overflow...
12. PlatinumFTPServer File Disclosure Vulnerability
13. Sun Solaris AT Command Arbitrary File Deletion Vulnerability
14. Sun Solaris AT Command Race Condition Vulnerability
15. Noffle Remote Memory Corruption Vulnerability
16. Nuked-Klan Guestbook HTML Injection Vulnerability
17. Nuked-Klan Forum Module HTML Injection Vulnerability
18. Nuked-Klan Shoutbox HTML Injection Vulnerability
21. Finjan SurfinGate Active Content Filter Bypass Vulnerability
22. Finjan SurfinGate Java Applet Analyzer Bypass Vulnerability
23. Finjan SurfinGate File Extension File Filter Circumvention...
24. Finjan SurfinGate Compressed Archive File Filter Circumvention...
25. Finjan SurfinGate Unknown File Extension File Filter...
26. Replicom ProxyView Default Password Vulnerability
27. Solaris in.ftpd Remote Denial of Service Vulnerability
28. MIT Kerberos Remote Heap Corruption Vulnerability
29. MIT Kerberos Key Distribution Center Remote Format String...
30. MIT Kerberos / Key Distribution Center Shared Key User...
31. DotProject Remote File Include Vulnerability
32. PLP Tools plpnfsd Syslog Format String Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. E-Voting security debate comes home
2. 'Secure by design', claims MS op-ed ad
3. Canada's biggest Identity theft?
4. $1m hacking challenge' product is flawed
IV. SECURITYFOCUS TOP 6 TOOLS
1. coridoras v0.0.17
2. fwtrends v0.1
3. TinyMonitor v0.9b
4. GNU SASL v0.0.5
5. J2SSH v0.0.4
6. Darik's Boot and Nuke v2003013000
V. SECURITYJOBS LIST SUMMARY
1. LOOKING FOR INFOSEC POSITION WASH DC AREA (Thread)
2. Network Security Analyst opportunity for CLEARED individual at...
3. Sr. InfoSec Opportunity for Cleared individual in Reston...
4. NY/NJ - Security professional looking for a new opportunity...
5. Seeking Employment (Thread)
6. What is a good way to find CSO jobs? (Thread)
7. WILL WORK FOR FOOD (Thread)
8. SEEKING: Network Security position (Thread)
9. IL Security Analyst (Thread)
10. Looking for Work... (Thread)
11. Senior Network Security Analysts Needed (Thread)
12. Senior IDS Engineers (Thread)
13. Network Security Engineer (Thread)
14. Seeking employment - 20 years information security exp. (Thread)
15. IL Unix Security Specialist (Thread)
16. IT Director needed in San Francisco Bay Area (Thread)
17. SEEKING: InfoSec or Network Security Position in CA. (Thread)
18. SEEKING: InfoSec or Network Security Position (Thread)
19. Security Sales Position in Maryland (Thread)
20. Internship (Thread)
21. Seeking: Network Security Engineer - Herndon, VA - USA...
22. Common Criteria Security Engineer position in VA (Thread)
23. POSITION: Security Specialist - CA (Thread)
24. POSITION: Information Security Consultant - CA (Thread)
25. Sales Support / Tactical Marketing Position (Boston, MA) (Thread)
26. Inside Sales Position (Boston, MA) (Thread)
27. Seeking Entry Level Security Position (fwd) (Thread)
VI. INCIDENTS LIST SUMMARY
1. Packet from port 80 with spoofed microsoft.com ip (Thread)
2. Packets from 255.255.255.255(80) (was: Packet from port 80 with...
3. Firewall logging port 6346 (Thread)
4. HTML email bug [was: (Fwd) hi] (Thread)
5. MSDE contained in... (Thread)
6. MSDE contained in... (MS Office ? really ?) (Thread)
7. Variant or original posting to packetstormsecurity - long (Thread)
8. Scan UDP port 135 (Thread)
9. Incidents Mailing List Administrivia (Thread)
10. Take note of products that don't "advertise" they have...
11. SQL Sapphire Worm Analysis (Thread)
12. SNMP Weirdness (Thread)
13. wierd: udp port 0 traffic (Thread)
14. MS SQL server worm logs question (Thread)
15. graphical stats of new SQL worm (Thread)
16. internet status (Thread)
17. strange attacks - flood udp packets from 1030 to msql (Thread)
18. Paypal.com hosting IRC server, possible hack? (Thread)
19. New spam-probing wave? (Thread)
20. Increased activity on UDP/1434 (Thread)
21. Microsoft SQL Server 2000 worm - port 1434 (Thread)
22. strange traffic (Thread)
23. udp/1434 (Thread)
24. MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434! (Thread)
25. New MS SQL Server Worm (Thread)
26. Is anyone else seeing a real heavy incrase in TCP/1434? (Thread)
27. New Web Hack? (Thread)
28. Hacked web server (Thread)
29. SGI.com hosts HACKED and being abused by scriptkiddies on IRC...
VII. VULN-DEV RESEARCH LIST SUMMARY
1. re: slocate vulnerability (Thread)
2. Black Hat Announcements (Thread)
3. format strings vulns in /bin/login and /usr/bin/passwd (Thread)
4. SQL Sapphire Worm Analysis (Thread)
5. Administrivia: New Moderators (Thread)
6. What to do with a vulerability? (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. uh, oh (was:Re: w2k server compromised) (Thread)
2. Problems with Pwdump3e (Thread)
3. Win2k log management (Thread)
4. Bypass Traverse Checking? (Thread)
5. IIS 5.0 and Digest Authentication (Thread)
6. Securing IIS/5 with ASP (Thread)
7. At.exe Service Account - scripted or registry? (Thread)
8. Administrivia (Thread)
9. SecurityFocus Microsoft Newsletter #122 (Thread)
10. SQL Sapphire Worm Analysis (Thread)
11. w2k server compromised (Thread)
12. Attacking EFS through cached domain logon credentials (Thread)
13. AD replication over WAN (Thread)
14. Stopping Admin Alert SPAM (Thread)
15. Fw: Bypass Traverse Checking? (Thread)
IX. SUN FOCUS LIST SUMMARY
1. LDAP replacing NIS...? (Thread)
2. Setting TOS bit in related packets (Thread)
3. Administrivia: Please trim replies (Thread)
4. [focus-sun] LDAP replacing NIS...? (Thread)
X. LINUX FOCUS LIST SUMMARY
1. NIS with local root (Thread)
2. Secure Web-Based Administration (Thread)
3. Administrivia: Trimming replies (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Forensics on the Windows Platform, Part 1
By Jamie Morris

This article, the first in a two-part series about forensics on the
Windows platform, will examine the preparatory steps that can be taken by
both investigators and system administrators alike. While this series is
concerned with Windows-specific investigations, this article will examine
some basic, non-technical concepts that are applicable to all forensic
investigations.

http://online.securityfocus.com/infocus/1661

2. The Busy Life of a Welsh Virus-Writer
By George Smith

The prison-bound author of the Gokar virus loves shoes, pole dancers and
personal self-disclosure. His blog tells all.

http://online.securityfocus.com/columnists/138

3. New Book: Hacker's Challenge 2 Test Your Network Security & Forensic
Skills

Do you have what it takes to keep the bad guys out of your network? Find
out with the latest edition of this best-selling book featuring 20+ all
new hacking challenges for you to solve. Plus, you'll get in-depth
solutions for each, all written by experienced security consultants.

For more information visit:
http://shop.osborne.com/cgi-bin/osborne/0072226307.html

4. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only
global early-warning system for cyber attacks - SecurityFocus DeepSight
Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

5. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)

Optional Workshops March 8, 9, 12, 13, & 14 Vendor Expo March 10 & 11

Solutions to todays security concerns; hands-on experts; blockbuster
vendor expo; the CISO Executive Summit; invaluable networking
opportunities. InfoSec World has it all!

Go to: http://www.misti.com/10/os03nl37inf.html

II. BUGTRAQ SUMMARY
-------------------
1. GNU Mailman 'email' Cross Site Scripting Vulnerability
BugTraq ID: 6677
Remote: Yes
Date Published: Jan 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6677
Summary:

Mailman is software to help manage email discussion lists, much like
Majordomo and SmartList. It is written and maintained by the GNU Project
and is available for the Linux and Unix operating systems.

A cross site scripting vulnerability has been discovered in GNU Mailman.
The issue occurs due to insufficient sanitization of URI parameters.
Specifically, the 'email' URI parameter is not correctly filtered for
embedded HTML or script code.

As a result, attackers may embed malicious script code or HTML into a link
to a site running the vulnerable software. When this link is followed by a
web user, the attacker-supplied code will be interpreted in their web
browser in the security context of the site hosting the software.

It may be possible to steal the unsuspecting user's cookie-based
authentication credentials, as well as other sensitive information. Other
attacks are also possible.

2. GNU Mailman Error Page Cross Site Scripting Vulnerability
BugTraq ID: 6678
Remote: Yes
Date Published: Jan 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6678
Summary:

A cross site scripting vulnerability has been discovered in GNU Mailman.
The issue occurs due to insufficient sanitization of URI parameters.
Specifically, the 'language' variable is not sufficiently sanitized before
being included in error pages.

It may be possible to steal the unsuspecting user's cookie-based
authentication credentials, as well as other sensitive information. Other
attacks are also possible.

It has been reported that GNU Mailman 2.0.11 is not affected by this
issue.

3. SpamAssassin BSMTP Mode Buffer Overflow Vulnerability
BugTraq ID: 6679
Remote: Yes
Date Published: Jan 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6679
Summary:

SpamAssassin is a mail filter to identify and process spam. It is
available for Linux and Unix variant operating systems.

A buffer overflow vulnerability has been reported for SpamAssassin. The
vulnerability exists when SpamAssassin has been configured for use with
BSMTP (Batch Simple Mail Transfer Protocol) processing.

SpamAssassin uses the program spamc to process mail. 'spamc' is the client
program that feeds data to the spamd service that processes email. BSMTP
processing is enabled by executing spamc with the '-B' option.

The vulnerability occurs when SpamAssassin is escaping '.' characters when
processing email headers. Due to insufficient bounds checking performed by
the filter, it is possible for a remote attacker to trigger the buffer
overflow condition.

An attacker can exploit this vulnerability by composing a malicious email
with specific headers. This will cause the buffer overflow condition in
the program, spamc. This may result in malicious attacker-supplied code
being executed with the privileges of the spamc process.

It should be noted that this issue allows an attacker to write the value
of the '.' character to the LSB of the value stored above the affected
buffer. Under some circumstances this may be the function's saved frame
pointer but the exploitability of this issue is highly volatile.

This vulnerability was reported to affect SpamAssassin 2.40 to 2.43.

4. Sun Java Virtual Machine Illegal Access To Object Methods Vulnerability
BugTraq ID: 6681
Remote: Yes
Date Published: Jan 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6681
Summary:

A vulnerability has been reported in the Sun Java Virtual Machine that may
allow illegal access to protected fields or methods of an object.

Precise technical details of this vulnerability are not currently known
however this vulnerability may have security implications. It may be
possible to exploit this vulnerability to gain read/write access to system
files despite the security constraints placed on the Applet sandbox. The
ability to access protected values may also be leveraged to launch other
attacks.

It may be possible to execute commands on target systems if this
vulnerability is exploited in conjunction with others.

5. SyGate Insecure UDP Source Port Firewall Bypass Weak Default Configuration Vulnerability
BugTraq ID: 6684
Remote: Yes
Date Published: Jan 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6684
Summary:

Sygate Pro is a personal firewall application for Microsoft Windows
operating system.

It has been reported that the Sygate Pro firewall permits traffic
originating from UDP source port 137 or 138 by default. UDP packets
originating from either of these source ports will bypass the firewall.
Remote attackers attacker may potentially exploit this vulnerability to
get malicious network traffic past the firewall.

6. FTLS GuestBook Script Injection Vulnerability
BugTraq ID: 6686
Remote: Yes
Date Published: Jan 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6686
Summary:

FTLS Guestbook is freely available guestbook software. It will run on most
Unix and Linux variants, as well as Microsoft Windows operating systems.

Guestbook does not adequately filter HTML tags from various fields. This
may enable an attacker to inject arbitrary script code into pages that are
generated by the guestbook.

The attacker's script code may be executed in the web client of arbitrary
users who view the pages generated by the guestbook, in the security
context of the website running the software.

Attackers may potentially exploit this issue to hijack web content or to
steal cookie-based authentication credentials.

This vulnerability was reported for FTLS Guestbook 1.1.

7. Blackboard Learning System search.pl SQL Injection Variant Vulnerability
BugTraq ID: 6687
Remote: Yes
Date Published: Jan 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6687
Summary:

Blackboard Learning system is a suite of software products available for
Microsoft Windows, Linux and Solaris servers that power an "e-Education
Infrastructure" for education providers.

Blackboard Learning System, in some cases, does not sufficiently sanitize
user-supplied input which is used when constructing SQL queries. As a
result, attackers may supply malicious parameters to manipulate the
structure and logic of SQL queries. This may result in unauthorized
operations being performed on the underlying database.

This vulnerability was reported to exist in the search.pl script file. A
remote attacker can exploit this vulnerability to discover the passwords
of other users.

This vulnerability is a variant of the vulnerability described in BID
6655.

This vulnerability was reported for Blackboard Learning System 5.5.1,level
1 and 2. Previous releases may also be affected.

8. Qualcomm Eudora Email Message Deletion Weakness
BugTraq ID: 6688
Remote: No
Date Published: Jan 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6688
Summary:

Eudora is a graphical e-mail client for Windows operating environments.

A weakness has been reported for Qualcomm Eudora. The weakness exists in
the way Eudora deletes email from the "Trash" folder. When a message is
deleted from the "Trash" folder, it is only marked as 'deleted' and is
still exists in the Trash.mbx file.

The message is only removed from Trash.mbx when the user chooses to
compact mailboxes. This may lull a user into a false sense of security.

This weakness was reported for Eudora 5.2.0.9. It is likely that other
versions share this weakness.

9. List Site Pro User Database Delimiter Injection Vulnerability
BugTraq ID: 6685
Remote: Yes
Date Published: Jan 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6685
Summary:

List Site PRO is a top site ranking system that counts hits from member
sites and then ranks them according to the number of hits.

A problem has been reported for List Site PRO that would allow an attacker
to inject arbitrary values via html input form fields into the database
that the 'List Site Pro' ranking system uses.

The problem is caused by both:

The lack of input sanitization for the 'bannerurl' field. The form field
'bannerurl' accepts pipe characters '|' which are used as delimiters in
the List Site Pro database.

And:

In the way List Site PRO discloses the user id of a site in its relative
link.

An attacker may combine these vulnerabilities to modify or reset any
stored user credentials in the underlying List Site PRO flat-file
database.

10. Hypermail Message Attachment Buffer Overflow Vulnerability
BugTraq ID: 6689
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6689
Summary:

Hypermail is a freely available tool for converts email into HTML format.

A buffer overflow vulnerability has been reported for Hypermail. The
vulnerability occurs when Hypermail processes emails with overly long
attachment names. Specifically, the buffer overflow condition exists in
the source file, parse.c, when processing emails.

This vulnerability is only exploitable if Hypermail is configured to
output verbose information with the option 'progress = 2'. An attacker can
exploit this vulnerability by sending an email with an overly long
attachment name, consisting of more than 252 characters, to the vulnerable
Hypermail service. The buffer overflow condition will be triggered when
Hypermail parses the email and may result in malicious attacker-supplied
code being executed by the vulnerable hypermail process.

This vulnerability was reported for Hypermail 2.1.3 to 2.1.5.

11. Hypermail CGI Mail Reverse DNS Lookup Buffer Overflow Vulnerability
BugTraq ID: 6690
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6690
Summary:

Hypermail is a freely available tool for converts email into HTML format.

A buffer overflow vulnerability has been reported for Hypermail's CGI mail
program.

The vulnerability exists due to insufficient bounds checking performed by
the CGI mail program when resolving DNS replies. Specifically, the program
uses the function gethostbyaddr() to obtain a hostname from a given IP
address. If the DNS server's reply is greater than 80 characters, this
would result in a buffer overflow condition.

Operators of malicious DNS servers may exploit this condition to execute
arbitrary code on target hosts. It may also be possible for attackers who
do not control the DNS server to spoof malicious responses.

Successful exploitation of this vulnerability may result in the attacker
obtaining control of the execution of the vulnerable program.

This vulnerability was reported for Hypermail 2.1.3 to 2.1.5.

12. PlatinumFTPServer File Disclosure Vulnerability
BugTraq ID: 6691
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6691
Summary:

PlatinumFTPServer is an FTP server for Microsoft Windows systems. It is
commercially available, and distributed by BYTE/400.

A directory traversal vulnerability has been reported in
PlatinumFTPServer. The program does not sufficiently handle
backslash-dot-dot input, which could result in an attacker gaining access
to unauthorized resources.

This problem can allow an attacker to break out of the FTP root directory,
and access the entire file system of the vulnerable host. It has been
reported that an attacker may also be able to create and remove arbitrary
files and directories on the system by specifying the full path to the
file. This vulnerability requires an attacker to use the '\..' notation.

This vulnerability was reported for PlatinumFTPServer 1.0.7. It is likely
that earlier versions are affected.

13. Sun Solaris AT Command Arbitrary File Deletion Vulnerability
BugTraq ID: 6692
Remote: No
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6692
Summary:

/usr/bin/at is used to schedule jobs at a future time. The at utility
shipped with Sun Solaris may be prone to an issue which may allow
attackers to delete arbitrary files on the system.

The vulnerability occurs when using at with the '-r' option. This option
is used to remove previously scheduled at jobs. The vulnerability exists
because at does not properly sanitize parameters submitted as part of the
-r commandline option. Specifically, at does not properly sanitize '../'
character sequences to the parameters of the -r option.

A local attacker can exploit this vulnerability by invoking 'at -r' with a
malicious parameter involving '../' directory traversal sequences. This
will cause at to remove arbitrary files on the vulnerable system.

This vulnerability is further exacerbated by the fact that at is a setuid
root utility.

14. Sun Solaris AT Command Race Condition Vulnerability
BugTraq ID: 6693
Remote: No
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6693
Summary:

/usr/bin/at is used to schedule jobs at a future time. The at utility
shipped with Sun Solaris may be prone to an issue which may allow
unprivileged users to delete any file on the vulnerable system.

This vulnerability is a consequence of the issue described in BID 6692 and
also occurs when at is used with the -r commandline option.

at is prone to a race condition vulnerability that may result in the
deletion of a file other than the specified one. The issue exists in the
way the at utility first verifies ownership of a file via the stat()
function and then unlink()s a file. If the filesystem can be changed
slightly between these calls, it is possible to cause at to delete an
arbitrary file.

This vulnerability is further exacerbated by the fact that at is a setuid
root utility.

15. Noffle Remote Memory Corruption Vulnerability
BugTraq ID: 6695
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6695
Summary:

Noffle is a news (nntp) server designed to service few users and low speed
dial-up connections to the Internet. It is available for the Unix and
Linux operating systems.

A memory corruption bug has been discovered in Noffle. The issue can be
triggered remotely and may cause a segmentation violation in the affected
server. This issue is likely caused when Noffles is attempting to process
a malicious news group or entry.

Although unconfirmed, this issue may be exploitable by a remote attacker
to trigger a denial of service or possibly execute arbitrary code.
Attacker-supplied instructions would be executed with the privileges of
the invoker of Noffle, likely the 'news' user.

The technical details regarding this issue are currently unknown. This BID
will be updated when further information becomes available.

16. Nuked-Klan Guestbook HTML Injection Vulnerability
BugTraq ID: 6697
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6697
Summary:

A vulnerability has been discovered in the Nuked-Klan guestbook module. It
has been reported that Nuked-Klan fails to sufficiently sanitize HTML and
script code embedded in certain user-supplied variables. Specifically, the
guestbook module fails to filter the 'Author' variable for malicious
input.

As a result, attackers may embed malicious script code or HTML into forum
posts. When a malicious post is viewed by another user, the
attacker-supplied code will be interpreted in their web browser in the
security context of the site hosting the software.

It may be possible to steal the unsuspecting user's cookie-based
authentication credentials, as well as other sensitive information. Other
attacks are also possible.

17. Nuked-Klan Forum Module HTML Injection Vulnerability
BugTraq ID: 6699
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6699
Summary:

A vulnerability has been discovered in the Nuked-Klan 'Forum' module. It
has been reported that Nuked-Klan fails to sufficiently sanitize HTML and
script code embedded in certain user-supplied variables. Specifically, the
'Forum' module fails to filter the 'Pseudo' and 'Titre' forum post form
fields for malicious input.

It may be possible to steal the unsuspecting user's cookie-based
authentication credentials, as well as other sensitive information. Other
attacks are also possible.

18. Nuked-Klan Shoutbox HTML Injection Vulnerability
BugTraq ID: 6700
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6700
Summary:

A vulnerability has been discovered in the Nuked-Klan 'Shoutbox' module.
It has been reported that Nuked-Klan fails to sufficiently sanitize HTML
and script code embedded in certain user-supplied variables. Specifically,
the 'Shoutbox' module fails to filter the "The Opinion column" or "La
Tribune Libre" form field for malicious input.

As a result, attackers may embed malicious script code or HTML into
shoutbox messages. When a malicious message is viewed by another user, the
attacker-supplied code will be interpreted in their web browser in the
security context of the site hosting the software.

It may be possible to steal the unsuspecting user's cookie-based
authentication credentials, as well as other sensitive information. Other
attacks are also possible.

19. Finjan SurfinGate Password Ciphering Weaknesses
BugTraq ID: 6705
Remote: No
Date Published: Jan 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6705
Summary:

SurfinGate is a commercially available content filtering and application
firewall package. It is distributed by Finjan, and available for the Sun
Solaris and Microsoft Windows platforms.

A weakness has been discovered in the encryption algorithms implemented by
Finjan SurfinGate. The SurfinGate Console password is viewable through the
properties table and is obfuscated using an algorithm which may be trivial
for an attacker to reverse. SurfinGate uses the following algorithm to
obfuscate the Console password:

CHAR encrypted(n) = CHAR( ACSCII(CHAR cleartext(n)) + n )

Where n is the position of the character in the password beginning with 0.

When the SurfinGate console is used to access a Solaris installation the
Oracle protocol is used. For this to be possible a valid Oracle user must
exist for SurfinGate to use. The Oracle user credentials are stored in a
locally accessible configuration file. It has been reported that the
user's Oracle password is also obfuscated using a slightly more complex
algorithm, which would be trivial for an attacker to reverse.

If the password is discovered, this may lead to further attacks against
the target system and the filtering software.

The Oracle password is obfuscated used the following algorithm:

CHAR encrypted(n) = HEX( ASCII( CHAR cleartext(n) ) + 1 )

Where n is the position of the character in the password.

20. Finjan SurfinGate HTML Filtering Weakness
BugTraq ID: 6702
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6702
Summary:

SurfinGate is a commercially available content filtering and application
firewall package. It is distributed by Finjan, and available for the Sun
Solaris and Microsoft Windows platforms.

The HTML filter included with Finjan SurfinGate does not sufficiently
recognize certain types of malicious HTML which may pose a threat to end
users.

As a result, end users may be exposed to attacks which utilize malicious
HTML to cause a denial of service or impact the user in other ways.

Due to this weakness in the SurfinGate filter, it may be possible for
malicious HTML code to be accessed by a user. Specifically, HTML META-Tags
with a refresh set to 0, infinite recursive frame sets, and infinite
recursive iframes are not detected by the affected application. Processing
malicious HTML code sequences may result in a denial of service, depending
on the end user's web browser implementation.

21. Finjan SurfinGate Active Content Filter Bypass Vulnerability
BugTraq ID: 6701
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6701
Summary:

SurfinGate is a commercially available content filtering and application
firewall package. It is distributed by Finjan, and available for the Sun
Solaris and Microsoft Windows platforms.

A flaw was reported in the SurfinGate active content filter, which
provides functionality for analyzing various types of active content
(JavaScript, ActiveX, VBScript, etc.). The active content filter works by
filtering out specific code which is deemed dangerous and permitting
"safe" code to pass. However, the JavaScript parser included in the
active content filter does not sufficiently sanitize script code.

It is possible to bypass the filter by obfuscating the malicious
JavaScript. This may be accomplished by hex-encoding the malicious code
and then passing it through a function which decodes the string (such as
through the eval() method).

Successful exploitation will permit arbitrary JavaScript to bypass the
filter and reach end users.

22. Finjan SurfinGate Java Applet Analyzer Bypass Vulnerability
BugTraq ID: 6704
Remote: Yes
Date Published: Jan 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6704
Summary:

SurfinGate is a commercially available content filtering and application
firewall package. It is distributed by Finjan, and available for the Sun
Solaris and Microsoft Windows platforms.

A flaw was reported in the Java applet analyzer included with Finjan
SurfinGate. The analyzer works by filtering out specific code which is
deemed dangerous and permitting "safe" code to pass. The Java applet
analyzer scans the contents of a JAR archive and removes classes which are
on a blacklist.

However, the Finjan SurfinGate Java applet analyzer does not properly
detect the use of the Java Reflection API. As a result, this API may be
used to call methods and classes that may otherwise be restricted.

A malicious Java applet may use this technique to bypass the Finjan
SurfinGate filter. End users may not be protected from malicious Java
applets as a result.

23. Finjan SurfinGate File Extension File Filter Circumvention Vulnerability
BugTraq ID: 6703
Remote: Yes
Date Published: Jan 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6703
Summary:

SurfinGate is a commercially available content filtering and application
firewall package. It is distributed by Finjan, and available for the Sun
Solaris and Microsoft Windows platforms.

A problem with SurfinGate could make it possible for an attacker to
circumvent file filters that are set in place.

SurfinGate uses the file extension to determine if a file is of a type
that is blacklisted by the software. It has been reported that an
attacker may bypass SurfinGate file filtering rules by appending an extra
file extension of a type that is not blacklisted to the end of the file
name.

For example, an attacker may rename an executable file to
'filename.com.txt' to bypass the SurfinGate file filter.

It should be noted that an end user would still have interactively to open
or execute the malicious file.

24. Finjan SurfinGate Compressed Archive File Filter Circumvention Vulnerability
BugTraq ID: 6706
Remote: Yes
Date Published: Jan 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6706
Summary:

SurfinGate is a commercially available content filtering and application
firewall package. It is distributed by Finjan, and available for the Sun
Solaris and Microsoft Windows platforms.

A problem with SurfinGate could make it possible for an attacker to
circumvent file filters that are set in place.

It has been reported that SurfinGate does not sufficiently dissect archive
files for analysis. This may allow an attacker to circumvent the
SurfinGate file filter rules by including the malicious file of a
blacklisted type inside a file archive (such as '.ZIP' or '.RAR').

It should be noted that an end user would still have interactively to open
or execute the malicious file.

25. Finjan SurfinGate Unknown File Extension File Filter Circumvention Vulnerability
BugTraq ID: 6707
Remote: Yes
Date Published: Jan 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6707
Summary:

SurfinGate is a commercially available content filtering and application
firewall package. It is distributed by Finjan, and available for the Sun
Solaris and Microsoft Windows platforms.

A problem with SurfinGate could make it possible for an attacker to
circumvent file filters that are set in place.

SurfinGate uses the file extension to determine if a file is of a type
that is blacklisted by the software. It has been reported that an
attacker may bypass SurfinGate file filtering rules by using a file
extension that is not recognized by the filtering software.

It should be noted that an end user would still have interactively to open
or execute the malicious file. This may be suspicious if there is no
handler on the local system for the unknown file extension.

26. Replicom ProxyView Default Password Vulnerability
BugTraq ID: 6708
Remote: Yes
Date Published: Jan 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6708
Summary:

Replicom ProxyView is a remote access tool. It is intended for use by
network administrators to provide KVM functionality to remote servers. The
device's operating environment is Embedded Windows NT.

It has been reported that the ProxyView device has a default undocumented
password for the Administrator account for Embedded Windows NT.

An attacker can exploit this vulnerability by connecting to the ProxyView
device on port 139 and login as the 'Administrator' with the password
'Administrator'. This will provide the attacker with administrative access
to the device's operating system.

It is possible to exploit this vulnerability to obtain access to the
servers connected to the ProxyView device.

27. Solaris in.ftpd Remote Denial of Service Vulnerability
BugTraq ID: 6709
Remote: Yes
Date Published: Jan 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6709
Summary:

in.ftpd is the default File Transfer Protocol (FTP) daemon used by
Solaris.

A vulnerability has been discovered in the Solaris in.ftpd daemon. It has
been reported that a non-privileged remote attacker may be able to trigger
this condition. It has not yet been verified if authentication is required
to exploit this vulnerability.

A malicious user exploiting this vulnerability may cause the ftp service
to intermittently deny service to other legitimate users. This condition
will occur whenever the attacking ftp client issues a command and will
cause the service to hang for roughly 60 seconds. During this time
legitimate users may time out of their connection to the service.

The technical details regarding this vulnerability are currently unknown.
This BID will be updated as further details are made available.

28. MIT Kerberos Remote Heap Corruption Vulnerability
BugTraq ID: 6713
Remote: Yes
Date Published: Jan 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6713
Summary:

Kerberos is a network authentication protocol. It is designed to provide
strong authentication for client/server applications by using secret- key
cryptography. Kerberos is written and maintained by MIT. It is available
for a variety of platforms including the Microsoft Windows, Unix, and
Linux operating systems.

A vulnerability has been discovered in MIT Kerberos. It has been reported
that, due to insufficient bounds checking and sanitization of
user-supplied data, Kerberos is prone to memory corruption.

A remote attacker may trigger this condition my supplying a negative
length value in a malicious packet sent to a target server. This may
result in insufficient memory being allocated or cause invalid memory to
be referenced. Successful exploitation of this issue may result in a
denial of service.

Due to the nature of this vulnerability it may be possible for an attacker
to create a situation in which sensitive memory could be overwritten. If
successful this could allow for the execution of arbitrary code with the
privileges of Kerberos. The possibility of exploitation of this issue to
execute code, however, has not been confirmed.

As this issue affects older releases of Kerberos, a BID may already exist.
If this is issue proves to be covered in a previous database entry, this
BID will be retired and the correct BID will be updated accordingly.

29. MIT Kerberos Key Distribution Center Remote Format String Vulnerabilities
BugTraq ID: 6712
Remote: Yes
Date Published: Jan 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6712
Summary:

A number of vulnerabilities have been reported in the MIT Kerberos Key
Distribution Center (KDC). It has been reported that KDC fails to supply
sufficient format specifiers when handling user-supplied data.
Specifically, principal names supplied by a remote user are handled by
functions of the printf family without supplying format specifiers. It has
been determined that under some cirumstances an unauthenticated remote
user may be able to pass principal names to an affected server.

An attacker could exploit this vulnerability by supplying a maliciously
crafted principal name containing format specifiers. By writing
attacker-controlled values to memory using the %n format specifier, it may
be possible for a remote attacker to execute arbitrary commands.

30. MIT Kerberos / Key Distribution Center Shared Key User Spoofing Vulnerability
BugTraq ID: 6714
Remote: Yes
Date Published: Jan 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6714
Summary:

A vulnerability has been discovered MIT Kerberos and Key Distribution
Center (KDC). It has been reported that a user within a realm implementing
shared keys may be able to spoof another legitimate non-local user.

This issue is exploitable due to insufficent realm transit path
verification by the affected software.

This vulnerable exists only if non-local principal names are located in
the KDC's access control list. The ability to impersonate another
legitimate user may be leveraged by an attacker to obtain sensitive
information. Under some cirumstances a malicious attacker may be able to
impersonate a user with additional privileges to their own.

This issue affects MIT Kerberos 5 release 1.2.2 and earlier. As this issue
affects older releases of Kerberos, a BID may already exist. If this is
issue proves to be covered in a previous database entry, this BID will be
retired and the correct BID will be updated accordingly.

31. DotProject Remote File Include Vulnerability
BugTraq ID: 6710
Remote: Yes
Date Published: Jan 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6710
Summary:

dotproject is web-based project management software, written in PHP. It is
designed to run on Unix and Linux variants.

dotproject is prone to an issue which may allow remote attackers to
include arbitrary files located on remote servers. This issue is present
in several PHP script files provided with dotproject in the 'modules'
directory which try to include the file 'classdefs/date.php'.

The following are a list of scripts that are affected:
modules/projects/addedit.php
modules/projects/view.php
modules/projects/vw_files.php
modules/tasks/addedit.php
modules/tasks/viewgantt.php

Under some circumstances, it is possible for remote attackers to influence
the include path for 'date.php' to point to an external file on a remote
server by manipulating the $root_dir URI parameter.

If the remote file is a malicious PHP script, this may be exploited to
execute arbitrary commands in the context of the webserver.

32. PLP Tools plpnfsd Syslog Format String Vulnerability
BugTraq ID: 6715
Remote: No
Date Published: Jan 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6715
Summary:

PLP Tools is a collection of libraries and utilities for enabling Unix and
Linux variant systems to communicate with a Psion palmtop over a serial
line. plpnfsd is the server application that allows users to mount Psion
filesystems on workstations.

A vulnerability has been reported for plpnfsd that may result in an
attacker obtaining elevated privileges on the vulnerable system.

Due to a programming error, it may be possible to exploit a format string
vulnerability in plpnfsd. A logging function in plpnfsd contains insecure
syslog() calls. This could result in the execution of attacker-supplied
code.

The vulnerability occurs when plpnfsd receives a carefully constructed
directory name that include malicious format string specifiers. In the
event that this vulnerability is exploited, an attacker could cause
arbitrary locations in memory to be corrupted with attacker-specified data
and execute code with elevated privileges.

This vulnerability is also exacerbated by the fact that the plpnfsd daemon
is installed with setuid root privileges.

This vulnerability was reported for plptools 0.6.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. E-Voting security debate comes home
By Kevin Poulsen

Why are some high-power technologists trying to keep fully-electronic
ballots out of Silicon Valley voting booths? They're worried that hackers
might decide the next election.

http://online.securityfocus.com/news/2197

2. 'Secure by design', claims MS op-ed ad
By Andrew Orlowski, The Register

Quite by mistake, I bought the New York Times yesterday. I thought it was
Paul Krugman day, but he wasn't there - his column doesn't appear on a
Thursday.

http://online.securityfocus.com/news/2202

3. Canada's biggest Identity theft?
By Drew Cullen, The Register

IBM has lost a hard drive containing the records of 180,000 clients of an
insurance company. Details include "names, addresses, beneficiaries,
social insurance numbers, pension values, pre-authorized checking
information and mothers' maiden names", according to wire reports.

http://online.securityfocus.com/news/2190

4. $1m hacking challenge' product is flawed
By John Leyden, The Register

AlphaShield's "unhackable" consumer security device isn't unhackable,
Spanish white hat hackers claim.

http://online.securityfocus.com/news/2189

IV. SECURITY FOCUS TOP 6 TOOLS
------------------------------
1. coridoras v0.0.17
by Christian Leber
Relevant URL:
http://ijuz.uugrn.org/dev/coridoras.html
Platforms: N/A
Summary:

Coridoras provides a relative simple way to encrypt IRC queries without
changing the client and/or the server.

2. fwtrends v0.1
by George Hedfors
Relevant URL:
http://www.sr-71.nu/fwtrends/
Platforms: Os Independent
Summary:

fwtrends is a project to ease firewall log monitoring via a Web GUI. It
imports log files from various firewall software and can easily generate
graph statistics from alert events. It allows you to investigate single
remote source addresses and what alerts they generated.

3. TinyMonitor v0.9b
by Brian Shellabarger
Relevant URL:
http://www.glug.com/projects/
Platforms: FreeBSD, Linux, POSIX, Solaris, SunOS, UNIX
Summary:

TinyMonitor is written in Perl and was created out of pure necessity for a
simple monitoring program that watched the actual content of returned
pages rather than simply checking to see if the httpd service was running.
It can be used for simple Web server monitoring (i.e., is it actually
delivering content?) or to verify that a page is returning what you expect
(i.e., a 200 rather than a 404). It is very small and designed to work
through cron. Alerts are sent via email to a pager or SMS phone.

4. GNU SASL v0.0.5
by Simon Josefsson
Relevant URL:
http://www.gnu.org/software/gsasl/
Platforms: POSIX
Summary:

GNU SASL is a library that implements the IETF Simple Authentication and
Security Layer (SASL) framework and some SASL mechanisms. SASL is used in
servers (e.g. IMAP, SMTP, etc.) to request authentication from clients,
and in clients to authenticate against servers.

5. J2SSH v0.0.4
by Richard Pernavas
Relevant URL:
http://www.sshtools.com
Platforms: Os Independent
Summary:

J2SSH is an object-orientated Java implementation of the SSH2 protocol. It
provides a rich, powerful, and extensible SSH API that enables developers
to gain access to SSH servers and to develop entire SSH client/server
frameworks. The API library provides a fully-featured SSH2 implementation
specifically designed for cross-platform development. Higher level
components, representing both the standard SSH client and SSH servers, are
provided which implement the protocol specification for user sessions and
port forwarding. The specification currently supports public-key and
password authentication, with X11 forwarding and SFTP to follow.

6. Darik's Boot and Nuke v2003013000
by Darik Horn
Relevant URL:
http://dban.sourceforge.net/download/changelog.txt
Platforms: Os Independent
Summary:

Darik's Boot and Nuke (DBAN) is a self-contained boot floppy that securely
wipes the hard disks of most computers. DBAN will automatically and
completely delete the contents of any hard disk that it can detect, which
makes it an appropriate utility for bulk or emergency data destruction.

V. SECURITY JOBS SUMMARY
------------------------
1. LOOKING FOR INFOSEC POSITION WASH DC AREA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/309424

2. Network Security Analyst opportunity for CLEARED individual at Bolling AFB, MD (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/309416

3. Sr. InfoSec Opportunity for Cleared individual in Reston, Virginia (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/309401

4. NY/NJ - Security professional looking for a new opportunity (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/309390

5. Seeking Employment (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/309402

6. What is a good way to find CSO jobs? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/309386

7. WILL WORK FOR FOOD (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/309128

8. SEEKING: Network Security position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308892

9. IL Security Analyst (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308893

10. Looking for Work... (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308856

11. Senior Network Security Analysts Needed (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308857

12. Senior IDS Engineers (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308855

13. Network Security Engineer (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308854

14. Seeking employment - 20 years information security exp. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308853

15. IL Unix Security Specialist (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308866

16. IT Director needed in San Francisco Bay Area (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308868

17. SEEKING: InfoSec or Network Security Position in CA. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308852

18. SEEKING: InfoSec or Network Security Position (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308565

19. Security Sales Position in Maryland (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308586

20. Internship (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308286

21. Seeking: Network Security Engineer - Herndon, VA - USA (Northern VA / MD / DC area) - ePlus Technology Inc. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308301

22. Common Criteria Security Engineer position in VA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308287

23. POSITION: Security Specialist - CA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308253

24. POSITION: Information Security Consultant - CA (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308294

25. Sales Support / Tactical Marketing Position (Boston, MA) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308288

26. Inside Sales Position (Boston, MA) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308272

27. Seeking Entry Level Security Position (fwd) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/308219

VI. INCIDENTS LIST SUMMARY
-------------------------
1. Packet from port 80 with spoofed microsoft.com ip (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/309397

2. Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/309419

3. Firewall logging port 6346 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/309408

4. HTML email bug [was: (Fwd) hi] (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/309364

5. MSDE contained in... (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/309359

6. MSDE contained in... (MS Office ? really ?) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/309146

7. Variant or original posting to packetstormsecurity - long (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/309041

8. Scan UDP port 135 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/309051

9. Incidents Mailing List Administrivia (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308928

10. Take note of products that don't "advertise" they have MSDE/SQL integration. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/309100

11. SQL Sapphire Worm Analysis (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308669

12. SNMP Weirdness (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308555

13. wierd: udp port 0 traffic (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308559

14. MS SQL server worm logs question (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308561

15. graphical stats of new SQL worm (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308553

16. internet status (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308469

17. strange attacks - flood udp packets from 1030 to msql (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308462

18. Paypal.com hosting IRC server, possible hack? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308471

19. New spam-probing wave? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308466

20. Increased activity on UDP/1434 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308459

21. Microsoft SQL Server 2000 worm - port 1434 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308463

22. strange traffic (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308474

23. udp/1434 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308379

24. MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434! (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308346

25. New MS SQL Server Worm (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308349

26. Is anyone else seeing a real heavy incrase in TCP/1434? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308354

27. New Web Hack? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308341

28. Hacked web server (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308384

29. SGI.com hosts HACKED and being abused by scriptkiddies on IRC. (Thread)
Relevant URL:

http://online.securityfocus.com/archive/75/308331

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. re: slocate vulnerability (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/309432

2. Black Hat Announcements (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/308763

3. format strings vulns in /bin/login and /usr/bin/passwd (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/308621

4. SQL Sapphire Worm Analysis (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/308389

5. Administrivia: New Moderators (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/308278

6. What to do with a vulerability? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/82/308284

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. uh, oh (was:Re: w2k server compromised) (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/309420

2. Problems with Pwdump3e (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/309120

3. Win2k log management (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/309121

4. Bypass Traverse Checking? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/309119

5. IIS 5.0 and Digest Authentication (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308989

6. Securing IIS/5 with ASP (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308979

7. At.exe Service Account - scripted or registry? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308906

8. Administrivia (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308765

9. SecurityFocus Microsoft Newsletter #122 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308764

10. SQL Sapphire Worm Analysis (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308838

11. w2k server compromised (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308782

12. Attacking EFS through cached domain logon credentials (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308274

13. AD replication over WAN (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308262

14. Stopping Admin Alert SPAM (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308139

15. Fw: Bypass Traverse Checking? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/308127

IX. SUN FOCUS LIST SUMMARY
----------------------------
1. LDAP replacing NIS...? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/309476

2. Setting TOS bit in related packets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/309166

3. Administrivia: Please trim replies (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/309117

4. [focus-sun] LDAP replacing NIS...? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/92/309110

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. NIS with local root (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/309475

2. Secure Web-Based Administration (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/309114

3. Administrivia: Trimming replies (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/309085

XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: GuardedNet - Transforming Security Data into
Knowledge

Event Correlation - Is it Security's Holy Grail?