SecurityFocus Newsletter #194

John Boletta <[email protected]> Mon, 28 Apr 2003 14:18:48 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #194
-----------------------------

This issue is sponsored by: FastTrain

FastTrain has your solution for a great CISSP Boot Camp. The industry's
most recognized corporate security certification track, provides a
comprehensive prospectus based upon the core principle concepts of
security. This ALL INCLUSIVE curriculum utilizes lectures, case studies
and true hands-on utilization of pertinent security tools. For a limited
time you can enter for a chance to win one of the latest technological
innovations, the SEGWAY HT.

Log onto http://www.fasttraincamp.com.
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Auditing Web Site Authentication
2. Anti-Virus Defence In Depth
3. Al-Jazeera, the First Amendment, and Security Professionals
4. Secure by Default
5. SecurityFocus DPP Program
II. BUGTRAQ SUMMARY
1. Xinetd Rejected Connection Memory Leakage Denial Of Service...
2. Central Command Vexira Antivirus Buffer Overflow Vulnerability
3. Microsoft Internet Explorer CLASSID Variant Denial Of Service...
4. Microsoft Windows SMB NTLM Authentication Interception...
5. Microsoft Windows Service Control Manager Race Condition...
6. Working Resources BadBlue Ext.DLL Command Execution Vulnerability
7. MPCSoftWeb Guest Book HTML Injection Vulnerability
8. MPCSoftWeb Database Disclosure Vulnerability
9. 360 Degree Web PlatinumKey Access Control Bypass Information...
10. 360 Degree Web PlatinumKey Access Control Bypass Application...
11. Mod_NTLM Authorization Heap Overflow Vulnerability
12. Mod_NTLM Authorization Format String Vulnerability
13. PT News Unauthorized Administrative Access Vulnerability
14. AN HTTPD Count.pl Directory Traversal Vulnerability
15. Xeneo Web Server Denial Of Service Vulnerability
16. HP TruCluster Server Cluster Alias/NFS Denial of Service...
17. YaBB SE Language Remote File Include Vulnerability
18. Microsoft Shlwapi.dll Malformed HTML Form Tag DOS...
19. OpenBB Index.PHP Remote SQL Injection Vulnerability
20. OpenBB Board.PHP Remote SQL Injection Vulnerability
21. OpenBB Member.PHP Remote SQL Injection Vulnerability
22. MIME-Support Package Insecure Temporary File Creation...
23. XMB Forum Members.PHP SQL Injection Vulnerability
24. SAP Database Development Tools INSTDBMSRV INSTROOT Environment...
25. SAP Database Development Tools INSTLSERVER INSTROOT...
III. SECURITYFOCUS NEWS ARTICLES
1. DirecTV Mole to Plead Guilty
2. Verizon loses RIAA piracy case
3. Judge rejects constitutional challenge over Internet...
4. Trojan defence clears man on child porn charges
IV. SECURITYFOCUS TOP 6 TOOLS
1. Crash Core Analysis Suite v3.3
2. In Memory Core Dump v3.1.4
3. cosign v1.0.0
4. FloodGuard Alert v2_2p3
5. heartbeat v0.1
6. fwsnort v0.1
V. SECURITYJOBS LIST SUMMARY
1. Development Manager Needed - Symantec in Redwood City CA (Thread)
2. Application Security Consultant - VA/DC $75K - $100K base...
3. Information Security Manager - Seattle, WA - up to 90K base...
4. Fw: Intrusion / security engineer needed in DC (Thread)
5. Security Engineer/Data Mining Specialist (Thread)
6. Senior Network Security Engineer needed for Ft. Monmouth...
7. Junior Security Administrator (Thread)
8. Looking for entry level INFOSEC position in New York Metro...
9. Opportunity for cleared Network Security Analyst/Engineer...
10. Consulting Manager, Cyber Operations Center - Albany, NY, USA...
11. Application Security Consultant VA/DC $75K-$100K base (Thread)
12. Sr Security Architect Needed--Ohio (Thread)
13. Security Engineer available for Hire (Thread)
14. 2003 Summer Internship (Thread)
15. Position Sought -- Computer Forensic Analyst (Thread)
16. Sr. Product Manager - Redwood City CA (Thread)
17. Sr Security Architect Needed - Ohio (Thread)
18. Program Manager Needed at Symantec, Redwood City, CA (Thread)
19. Chief Security Officer (Chicago based fortune 100 company)...
20. Chicago Information Security Manager (Thread)
21. Sr. Manager Development / Lead Security Analyst Team, Tokyo...
22. Sr. Security Researcher / Principal Software Engineer, Tokyo...
23. NetScreen Certified Professional Required **ASAP** (Thread)
24. wanted: Jr. Security Consultant/ Security Engineer position...
VI. INCIDENTS LIST SUMMARY
1. Trojan found... (Thread)
2. IP Spoofs in the log - not sure what to do next (Thread)
3. SMTP Scans (Thread)
4. protocol watcher (Thread)
5. POP3 logon attempts (Thread)
6. Company being War Dialed (Thread)
7. msamba (Thread)
8. FW: IP Spoofs in the log - not sure what to do next (Thread)
9. Tracking proxies on port 1180/1182 (Thread)
10. port 139 syn-fin scans (Thread)
11. Strange, scary, subtle trojan (Thread)
12. Intresting problem concerning libresolv.so.2 (Thread)
13. Mo'Logs (Thread)
14. re: port 5168 (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Article Announcement: Auditing Web Site Authentication (Thread)
2. Jump back to shellcode Windows overflow (Thread)
3. MSIE crash-"feature" (Thread)
4. cipher.exe overflow (Thread)
5. defacement stats (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Article Announcement: Auditing Web Site Authentication (Thread)
2. Files in system 32 directory (Thread)
3. interoperability of VPN checkpoint FW1 to ISA (Thread)
4. Article Announcement: Anti-Virus Defence In Depth (Thread)
5. Auditing a reboot (Thread)
6. SecurityFocus Microsoft Newsletter #134 (Thread)
7. Does In-Place Upgrade of Microsoft Exchange Create Open...
8. Article Announcement: Statistical-Based Intrusion Detection...
9. checking server status (Thread)
10. Does In-Place Upgrade of Microsoft Exchange Create Open...
IX. SUN FOCUS LIST SUMMARY
1. New release of Solaris secuirity module Papillo (Thread)
2. New release of Solaris secuirity module Papillon (Thread)
3. Unable to su on firewall (Thread)
4. distributed ssh key management (Thread)
5. Expanded Solaris Security (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Linux Security Courses (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Auditing Web Site Authentication
By Mark Burnett

This is the first part of a two-part article discussing a standard audit
procedure consisting of a list of questions to test Web site
authentication schemes.

http://www.securityfocus.com/infocus/1688

2. Anti-Virus Defence In Depth
by Ken Bechtel

Lately it seems I can't open my inbox with out seeing a new article on
defence in depth. This is fine: defence in depth is crucial to anti-virus
protection. Unfortunately, most of the articles are missing two crucial
components. To understand what is being missed, we need to look at what is
meant by defence in depth as it applies in the malicious software world.
For the purpose of this paper, when referring to defence in depth, we will
be specifically talking about the utilization of anti-virus software, and
other methods to provide a multi-layered anti-malware defence in a
corporate environment.

http://www.securityfocus.com/infocus/1687

3. Al-Jazeera, the First Amendment, and Security Professionals
By Scott Granneman

While attempts to disrupt Web broadcasts of Al-Jazeera may seem like a
distant concern, they reflect the problems that should concern security
professionals everywhere.

http://www.securityfocus.com/columnists/156

4. Secure by Default
By Tim Mullen

With Windows Server 2003, Microsoft has finally produced an operating
system that isn't begging to be hacked on the first boot.

http://www.securityfocus.com/columnists/157

5. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only
global early-warning system for cyber attacks - SecurityFocus DeepSight
Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

II. BUGTRAQ SUMMARY
-------------------
1. Xinetd Rejected Connection Memory Leakage Denial Of Service Vulnerability
BugTraq ID: 7382
Remote: Yes
Date Published: Apr 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7382
Summary:

Xinetd is intended as a secure replacement for inetd. It is designed for
use with Linux and Unix variant operating environments.

A denial of service vulnerability has been reported for Xinetd. The
vulnerability exists due to memory leaks occuring when connections are
rejected. This issue was reported to occur in the svc_request() function
of the service.c source file where some allocated memory is not properly
freed when a connection is rejected.

An attacker can exploit this vulnerability by repeatedly connecting to a
Xinetd server and having the connection rejected. This will result in a
memory exhaustion issue that will result in a denial of service condition.

This vulnerability was reported for Xinted prior to 2.3.11.

2. Central Command Vexira Antivirus Buffer Overflow Vulnerability
BugTraq ID: 7383
Remote: No
Date Published: Apr 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7383
Summary:

Vexira Antivirus is an antivirus solution for Linux variant systems
distributed by Central Command.

A buffer overflow vulnerability has been reported for Vexira Antivirus
which may result in privilege escalation.

A local attacker can exploit this vulnerability by supplying an overly
long commandline argument to the /usr/lib/Vexira/vexira binary, consisting
of at least 280 characters. When the binary attempts to process this
input, it will trigger the buffer overflow condition and cause the
application to crash.

Although unconfirmed, it may be possible to exploit this vulnerability to
execute malicious attacker-supplied code.

This vulnerability was reported for Vexira Antivirus 2.1.7 for Linux.

3. Microsoft Internet Explorer CLASSID Variant Denial Of Service Vulnerability
BugTraq ID: 7384
Remote: Yes
Date Published: Apr 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7384
Summary:

Microsoft Internet Explorer contains a vulnerability that may allow for
malicious webmasters to cause a victim user's web browser to stop
responding.

A CLASSID is a unique identifier that provides information to the default
COM handler. It is possible to include a CLASSID value as part of an
OBJECT tag under some versions of Internet Explorer.

If a web page contains a specific CLASSID value and an IE user attempts to
view the page, IE has been reported to crash. The reported offending
CLASSID is CLSID:0CF32AA1-7571-11D0-93C4-00AA00A3DDEA, however there may
be other CLASSID values which could exploit this issue.

This issue has been reported to occur when vulnerable versions of Internet
Explorer are running under Windows 2000 or XP. It is not currently known
if this issue is related to properties of the underlying operating system.

This vulnerability has been reported to affect Internet Explorer 6.0 SP1.

4. Microsoft Windows SMB NTLM Authentication Interception Weakness
BugTraq ID: 7385
Remote: Yes
Date Published: Apr 19 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7385
Summary:

Microsoft Windows uses the SMB protocol to authenticate against other
Microsoft systems on a network.

A weakness has been reported whereby an attacker may be able to intercept
SMB communications to access a vulnerable SMB client.

This weakness exists due to the way SMB connections are initiated. An
attack would proceed by tricking a victim user to connect to an
attacker-controlled server. The attacker's server would then send a
request to an attacker-controlled client which initiates a request to a
legitimate SMB server. The responses generated by the legitimate server
would be relayed through the attacker-controlled systems to eventually
gain control of the victim client.

Exploitation of this issue involves many specific scenarios and would be
difficult. It has been reported that this issue is very similar to an
attack described by DilDog presented at DefCon 2000.

5. Microsoft Windows Service Control Manager Race Condition Vulnerability
BugTraq ID: 7386
Remote: No
Date Published: Apr 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7386
Summary:

A race condition error has been reported in the Microsoft Service Control
Manager (SCM). The SCM manages and keeps track of installed services.

When the system is shutdown, the SCM may send a SERVICE_CONTROL_SHUTDOWN
control code to service applications that are required to clean up before
the system shutdown. The SCM will wait for service applications to
shutdown for a specified time limit before continuing with the system
shutdown. This condition could occur during system shutdown if services
do not successfully shutdown within the specified time limit.

The race condition could cause random cached data to be included in files
that are still open when the time limit expires for the service shutdown.
In the worst case scenario, random sensitive data from administrative
services could be included in output files for lower privileged services.
This could expose sensitive data to local users with access to these
output files. To exploit this condition, a malicious local user would
need to monitor the output files after a reboot.

6. Working Resources BadBlue Ext.DLL Command Execution Vulnerability
BugTraq ID: 7387
Remote: Yes
Date Published: Apr 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7387
Summary:

BadBlue is a P2P file sharing application distributed by Working
Resources. It is available for Microsoft Windows operating systems.

BadBlue is prone to a vulnerability that could allow remote attackers to
gain unauthorized access. BadBlue includes a server-side scripting
language which uses '.htx' and '.hts' files. The '.hts' extension
represents files that are only intended to be requested and executed by
the local host.

It has been reported that by inserting certain characters into a request
for an '.hts' file, it is possible for a remote user to cause the '.hts'
file to be interpreted by the server. This is due to an input validation
error in the 'ext.dll' component, which is responsible for verifying the
source of requests for '.hts' files. Exploitation could lead to
unauthorized execution of administrative or restricted commands.

7. MPCSoftWeb Guest Book HTML Injection Vulnerability
BugTraq ID: 7389
Remote: Yes
Date Published: Apr 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7389
Summary:

MPCSoftWeb Guest Book is a web application for Microsoft Windows operating
systems.

MPCSoftWeb Guest Book is prone to a vulnerability that could allow remote
attackers to inject hostile HTML and script code into the guestbook
system. The issue exists in the 'insertguest.asp' script. This is due to
insufficient sanitization of guestbook form fields such as "Name",
"location" and "comment". HTML and script code that is injected in this
manner may be interpreted in the web browser of users who visit the
guestbook site. This will occur in the security context of the site
hosting the guestbook software.

Successful exploitation may allow for theft of cookie-based authentication
credentials or other attacks.

8. MPCSoftWeb Database Disclosure Vulnerability
BugTraq ID: 7390
Remote: Yes
Date Published: Apr 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7390
Summary:

MPCSoftWeb Guest Book is a web application for Microsoft Windows operating
systems. It is backended by a Microsoft Access database.

MPCSoftWeb does not sufficiently secure the database file. This issue is
due to lack of access controls to prevent remote users from requesting the
database file. It is possible for remote attackers to request the database
file and gain access to sensitive information such as administrative
credentials for the guestbook.

9. 360 Degree Web PlatinumKey Access Control Bypass Information Disclosure Vulnerability
BugTraq ID: 7391
Remote: No
Date Published: Apr 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7391
Summary:

PlatinumKey is a smart card security application distributed by 360 Degree
Web. It is available for some laptops that use Microsoft Windows
operating systems.

It has been reported that PlatinumKey does not properly restrict access to
the desktop when smart card access control is enabled. Because of this,
an attacker may be able to gain access to potentially sensitive
information.

The problem is in the handling of certain key sequences. When the key
sequence Control-Escape is pressed, the Windows task bar is displayed.
An attacker could abuse this to gain information about recently run
applications and recently accessed documents.

This problem has been reported to occur on the Acer Travelmate 600 and 800
series laptops. It may additionally affect other laptops using the same
software with similar configurations.

10. 360 Degree Web PlatinumKey Access Control Bypass Application Execution Vulnerability
BugTraq ID: 7392
Remote: No
Date Published: Apr 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7392
Summary:

PlatinumKey is a smart card security application distributed by 360 Degree
Web. It is available for some laptops that use Microsoft Windows operating
systems.

It has been reported that PlatinumKey does not properly restrict access to
the desktop when smart card access control is enabled. Because of this, an
attacker may be able to gain access to the task bar and potentially
execute applications.

The problem is in the handling of certain key sequences. When the key
sequence Control-Escape is pressed, the Windows task bar is displayed. An
attacker could abuse this to gain access to the icons of recently run
applications. By clicking on one of the applications stored in the
frequently access applications menu, an attacker could execute the
application.

It is unclear what privileges the application will be executed with during
exploitation of this vulnerability. It is likely that the application
will be executed with the privileges of the user whose session is locked.

This problem has been reported to occur on the Acer Travelmate 600 and 800
series laptops. It may additionally affect other laptops using the same
software with similar configurations.

11. Mod_NTLM Authorization Heap Overflow Vulnerability
BugTraq ID: 7388
Remote: Yes
Date Published: Apr 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7388
Summary:

mod_ntlm is an Apache module, which implements NLTM authentication. It is
available for Apache 2.0.x and 1.3.x on the Linux operating system.

The mod_ntlm Apache module has been reported prone to a heap overflow
vulnerability.

The vulnerability is due to a lack of sufficient bounds checking performed
on user-supplied data, stored in a 2048 byte buffer within heap memory.

Specifically, an insecure 'vsprintf()' function call is made within the
mod_ntlm 'log()' function. The call to 'vsprintf()' copies user-supplied
authorization data without carrying out sufficient bounds checking. As a
result, excessive data may be copied into the 2048 byte buffer, resulting
in the corruption of sensitive memory management information.

By modifying an adjacent malloc header to contain malicious values, it may
be possible for an attacker to overwrite sensitive locations in memory
when a subsequent call to free() is made. As a result, it may be possible
for an attacker to execute arbitrary instructions, with the privileges of
the Apache server.

This vulnerability is reported to affect mod_ntlm v0.4 for Apache 1.3 and
mod_ntlmv2 version 0.1 for Apache 2.0. Although unconfirmed, previous
versions may also be affected.

12. Mod_NTLM Authorization Format String Vulnerability
BugTraq ID: 7393
Remote: Yes
Date Published: Apr 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7393
Summary:

mod_ntlm is an Apache module which implements NLTM authentication. It is
available for Apache 2.0.x and 1.3.x on the Linux operating system.

A format string vulnerability has been discovered in the mod_ntlm Apache
module. The issue occurs when processing authorization information located
in HTTP headers.

The problem occurs in a call to ap_log_rerror(), by the log() function,
without including format specifier arguments. As a result, it may be
possible for a remote attacker to embed their own specifiers within
authorization data. This may allow for an attacker to write to sensitive
locations in memory.

It should be noted that the exploitability of this issue to execute
arbitrary code may be hindered by various system specific limitations. As
a result, exploitation may only result in a denial of service.

This vulnerability was reported in mod_ntlm <= 0.4 and mod_ntlm2 0.1.

13. PT News Unauthorized Administrative Access Vulnerability
BugTraq ID: 7394
Remote: Yes
Date Published: Apr 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7394
Summary:

PT News is a web based news system. It is implemented in PHP and
available for Microsoft Windows operating systems and Linux/Unix variants.

PT News does not adequately prevent remote users from gaining unauthorized
access to administrative functions. The source of this issue is that the
'index.php' script includes the 'news.inc' file, which contains various
administrative functions for PT News. Remote users may access the
administrative functions of 'news.inc' through the 'index.php' script.

Exploitation could allow remote attackers to manipulate content.

14. AN HTTPD Count.pl Directory Traversal Vulnerability
BugTraq ID: 7397
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7397
Summary:

AN HTTPD is a Web server designed for use on Microsoft Windows operating
systems.

AN HTTPd contains a sample script named count.pl that may be used as a web
counter. The script may accept a path and file name as arguments to store
the numerical value of the counter.

This script does not perform adequate input validation on user-supplied
paths containing directory traversal (../) character seqences. The
vulnerable script may be used to overwrite any file on the system to which
the 'CGI' user has write privileges, by supplying the file name and path
in an HTTP request.

The 'CGI' user typically has System level privileges by default. As a
result, an attacker may be capable of corrupting arbitrary system files.

15. Xeneo Web Server Denial Of Service Vulnerability
BugTraq ID: 7398
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7398
Summary:

Xeneo Web Server is a web server for Microsoft Windows platforms that
supports ASP, PHP, ColdFusion, Perl, CGI and ISAPI.

Xeneo web server has been reported prone to Denial of Service
vulnerability.

It has been reported that a malicious HTTP GET request containing over
4096 bytes of data will trigger this vulnerability. Specifically, an
attacker may initiate a HTTP GET request including a "?" character
followed by approximately 4096 bytes of data. This action will result in a
denial of service condition triggered in the Xeneo web server.

Although absolutely unconfirmed, due to the nature of this vulnerability,
memory corruption or arbitrary code execution may be possible.

It should also be noted, that although this vulnerability has been
reported to affect Xeneo web server version 2.2.9.0 previous versions may
also be vulnerable.

16. HP TruCluster Server Cluster Alias/NFS Denial of Service Vulnerability
BugTraq ID: 7400
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7400
Summary:

HP has reported a denial of service vulnerability in Tru64 Unix/TruCluster
Cluster Alias/NFS services. The problem appears to lie in the way Cluster
Alias/NFS services included with TruCluster systems handle malicious
network traffic.

Successful exploitation of this issue may allow a remote attacker to crash
a vulnerable server. It may also result in malicious network traffic being
transmitted undetected.

The precise details regarding the exploitation of this issue are not
currently known. This BID will be updated as further information is made
available.

17. YaBB SE Language Remote File Include Vulnerability
BugTraq ID: 7399
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7399
Summary:

YaBB SE is a freely available, open source port of Yet Another Bulletin
Board (YaBB). It is available for a number of platforms include Unix,
Linux, and Microsoft Windows operating systems.

YaBB may allow malicious bulletin board users to influence the include
path for language files. Registered users may influence the include path
of language files through the "Change Profile" option. A malicious user
could set an include path that points to a malicious PHP script on an
external host. This could result in execution of commands in the context
of the web server.

18. Microsoft Shlwapi.dll Malformed HTML Form Tag Denial of Service Vulnerability
BugTraq ID: 7402
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7402
Summary:

The 'shlwapi.dll' is a dynamic link library that exports several shell
functions. Several applications, such as Internet Explorer and Front Page
use functions from this library when rendering HTML content.

When an HTML page containing a specifically malformed tag is rendered by
an application that exports functions from 'shlwapi.dll', the host
application will fail. It has been reported that this vulnerability could
not be exploited to cause code execution.

The problem appears to be caused by an attempt to perform a
case-insensitive comparison of two strings. Due to the malformed tag, one
of these strings will be a null pointer. The result of this is that the
comparison attempt causes an exception.

It has also been reported that an HTML page containing the malformed tag
located on the local file system may cause explorer.exe to fail if the
"Enable Web content in folders" option is selected.

19. OpenBB Index.PHP Remote SQL Injection Vulnerability
BugTraq ID: 7401
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7401
Summary:

OpenBB is a freely available, open source bulletin board software package.
It is available for Unix, Linux, and Microsoft Windows operating systems.

A problem with the software may make it possible for remote users to
modify database query logic.

It has been reported that OpenBB does not properly check input passed via
the 'index.php' script. Because of this, it may be possible for a remote
user to inject malicious arbitrary SQL queries in the context of the
database user for the bulletin board software. The consequences of
successful exploitation will vary depending on the underyling database
implementation, but may allow for disclosure of sensitive information or
remote compromise of the bulletin board or database itself.

This vulnerability has been reported in OpenBB version 1.1.0. The
currently available version reported by the vendor is 1.0.5. This
vulnerability may affect the reported version, and previous versions of
the affected software.

20. OpenBB Board.PHP Remote SQL Injection Vulnerability
BugTraq ID: 7404
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7404
Summary:

OpenBB is a freely available, open source bulletin board software package.
It is available for Unix, Linux, and Microsoft Windows operating systems.

A problem with the software may make it possible for remote users to
modify database query logic.

It has been reported that OpenBB does not properly check input passed via
the 'board.php' script. Because of this, it may be possible for a remote
user to inject malicious arbitrary SQL queries in the context of the
database user for the bulletin board software. The consequences of
successful exploitation will vary depending on the underyling database
implementation, but may allow for disclosure of sensitive information or
remote compromise of the bulletin board or database itself.

21. OpenBB Member.PHP Remote SQL Injection Vulnerability
BugTraq ID: 7405
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7405
Summary:

OpenBB is a freely available, open source bulletin board software package.
It is available for Unix, Linux, and Microsoft Windows operating systems.

A problem with the software may make it possible for remote users to
modify database query logic.

It has been reported that OpenBB does not properly check input passed via
the 'member.php' script. Because of this, it may be possible for a remote
user to inject malicious arbitrary SQL queries in the context of the
database user for the bulletin board software. The consequences of
successful exploitation will vary depending on the underyling database
implementation, but may allow for disclosure of sensitive information or
remote compromise of the bulletin board or database itself.

22. MIME-Support Package Insecure Temporary File Creation Vulnerability
BugTraq ID: 7403
Remote: No
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7403
Summary:

The mime-support package contains a variety of MIME applications and
tools. It is available for the Linux operating system.

A vulnerability has been discovered in the run-mailcap application
included with mime-support. The problem occurs due to invalid sanity
checks when creating temporary files.

By populating the /tmp directory with symbolic links which point to
sensitive system files, it may be possible for an unprivileged user to
corrupt arbitrary files. As a result, an unprivileged user may be capable
of rendering a target system unusable or possibly gain elevated
privileges.

This vulnerability affects run-mailcap included in mime-support verison
3.21 and earlier.

23. XMB Forum Members.PHP SQL Injection Vulnerability
BugTraq ID: 7406
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7406
Summary:

XMB Forum is a web based discussion forum implemented in PHP.

An SQL injection vulnerability has been reported to affect the
'members.php' page of XMB Forum. The vulnerability may be exploited if the
web server hosting XMB has activated 'register_globals' in the php.ini
configuration file.

The condition is reportedly due to insufficient sanitization of externally
supplied data that is used to construct SQL queries. This data may be
supplied via the '$email1' and '$email2' URI parameters during the
registration process. A remote attacker may take advantage of this issue
to inject malicious data into SQL queries, possibly resulting in
modification of query logic.

The consequences may vary depending on the particular database
implementation and the nature of the specific queries. One scenario
reported was revealing registered users password hashes. SQL injection
also makes it possible, under some circumstances, to exploit latent
vulnerabilities that may exist in the underlying database.

It should be noted that although this vulnerability has been reported to
affect XMB Forum version 1.8 previous versions might also be affected.

24. SAP Database Development Tools INSTDBMSRV INSTROOT Environment Variable Vulnerability
BugTraq ID: 7407
Remote: No
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7407
Summary:

SAP DB is a free database software package for Unix, Linux, and Microsoft
Operating Systems.

It has been reported that a vulnerability exists in the SAP Database
program instdbmsrv. Because of this, a local attacker may be able to gain
elevated privileges.

The problem is in the handling of input from untrusted sources. When
executed, the instdbmsrv program checks the INSTROOT environment variable
for the location of the pgm/dbmsrv program. The permissions of the dbmsrv
program are changed to give the program setuid root privileges when the
instdbmsrv is executed. An attacker could modify the INSTROOT environment
variable locally to point to an arbitrary directory. When the instdbmsrv
program is executed, an attacker-supplied version of the dbmsrv program
would be changed to setuid root.

This could result in an attacker gaining local administrative privileges.

25. SAP Database Development Tools INSTLSERVER INSTROOT Environment Variable Vulnerability
BugTraq ID: 7408
Remote: No
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7408
Summary:

SAP DB is a free database software package for Unix, Linux, and Microsoft
Operating Systems.

It has been reported that a vulnerability exists in the SAP Database
program instlserver. Because of this, a local attacker may be able to gain
elevated privileges.

The problem is in the handling of input from untrusted sources. When
executed, the instlserver program checks the INSTROOT environment variable
for the location of the pgm/lserver program. The permissions of the
lserver program are changed to give the program setuid root privileges
when the instlserver is executed. An attacker could modify the INSTROOT
environment variable locally to point to an arbitrary directory. When the
instlserver program is executed, an attacker-supplied version of the
lserver program would be changed to setuid root.

This could result in an attacker gaining local administrative privileges.

26. Web Protector Trivial Encryption Weakness
BugTraq ID: 7409
Remote: Yes
Date Published: Apr 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7409
Summary:

Web Protector is software that is designed to protect Web pages from
unauthorized cloning or Internet theft. Protection includes HTML code,
JavaScript, VBscript, text, links, and graphics.

Web protector has been reported prone to a trivial encryption weakness.

It has been reported that the method used to obfuscate and protect the
HTML source of web pages implementing Web Protector is flawed and may be
easily reversed. Reportedly the Java script decode method used to decode
and render the original plaintext HTML source is embedded in the
obfuscated document as escaped characters. The decode method may easily be
extracted and used to decode the rest of the page contents.

This weakness may be exploited to disclose sensitive information contained
in HMTL source or to reveal the HTML source itself. Due to the nature of
web-based obfuscation, sensitive information should never be included in
the source of an obfuscated document.

Administrators may be relying on a false sense of security by implementing
the protection supplied by Web protector.

It should be noted that although this weakness has been reported to affect
Web Protector version 2.0, previous versions are most likely also
affected.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. DirecTV Mole to Plead Guilty
By Kevin Poulsen

A plea agreement is reached in the case of the college student who knew
too much, while elsewhere DirecTV lawyers move against a message board
poster for giving hacking advice to satellite pirates.

http://www.securityfocus.com/news/4173

2. Verizon loses RIAA piracy case
By Tim Richardson, The Register

Verizon has vowed to continue its fight to refuse to reveal the identity
of one of its punters accused of pirating music, claming the matter could
have a "chilling effect" on Internet users.

http://www.securityfocus.com/news/4210

3. Judge rejects constitutional challenge over Internet music downloading
By Ted Bridis, The Associated Press

A 19-year-old University of Chicago student accused of leaking the secrets
of DirectTV's most advanced anti-piracy technology to hacker websites has
agreed to plead guilty to violating the rarely used 1996 Economic
Espionage Act.

http://www.securityfocus.com/news/4188

4. Trojan defence clears man on child porn charges
By John Leyden, The Register

A man was cleared of possession of child porn this week after experts
testified that a Trojan horse infection on his PC could have downloaded 14
depraved images without his knowledge.

http://www.securityfocus.com/news/4179

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Crash Core Analysis Suite v3.3
by Mission Critical Linux [email protected]
Relevant URL:
http://oss.missioncriticallinux.com/projects/crash/
Platforms: Linux, POSIX
Summary:

The Crash Core Analysis Suite utility is a self-contained tool, loosely
based on the SVR4 crash command but completely merged with gdb, thereby
combining the kernel-specific nature of crash with the source level
debugging capabilities of gdb. The utility can be used to investigate live
systems, kernel core dumps created from the Kernel Core Dump patch offered
by Mission Critical Linux, and kernel core dumps created from the Linux
Kernel Crash Dumps (LKCD) patch offered by SGI.

2. In Memory Core Dump v3.1.4
by Mission Critical Linux [email protected]
Relevant URL:
http://oss.missioncriticallinux.com/projects/mcore/
Platforms: Linux, POSIX
Summary:

In Memory Core Dump uses system memory to save crash information. On a
subsequent reboot of the system, the crash information can be recovered.

3. cosign v1.0.0
by UMich Web Team
Relevant URL:
http://weblogin.org/
Platforms: UNIX, Windows 2000, Windows NT
Summary:

cosign is a Web single sign on system that allows users to authenticate
once per session and access any protected Web resources at the
institution. If used, passwords are sent only to a single, central URL.
Sessions have both idle and hard timeouts, and users can logout of all
protected services by visiting a single URL. The use of public key
cryptography ensures that a compromise of a protected Web server has no
impact on the security of other participating servers.

4. FloodGuard Alert v2_2p3
by Reactive Network Solutions, Inc. [email protected]
Relevant uRL:
http://www.reactivenetwork.com/downloads/
Platforms: Linux, POSIX
Summary:

FloodGuard Alert is designed to detect all forms of flooding and bandwidth
attacks, including DDoSes and worms. The software initially trains on
ingress traffic directed at your protection domain that it uses to
statistically identify anomalous traffic. It also suggests initial
mitigation steps (ACLs/filters) that can be taken to stop the attack while
letting legitimate traffic through. It comes with a comprehensive
Java-based GUI that facilitates traffic visualization, configuration,
control, analysis, report generation, and SYSLOG- and email-based
communications.

5. heartbeat v0.1
by Tyler Lane [email protected]
Relevant URL:
http://www.nolongervalid.com/heartbeat/
Platforms: Python
Summary:

Heartbeat is a server and service monitoring program written in PyGTK,
featuring XML configuration and support for unlimited servers and
services.

6. fwsnort v0.1
by Michael Rash
Relevant URL:
http://www.cipherdyne.com/fwsnort/
Platforms: Linux
Summary:

fwsnort translates snort rules into an equivalent iptables ruleset. By
making use of the iptables string match module, fwsnort can detect
application layer signatures which exist in many snort rules. fwsnort adds
a --hex-string option to iptables, which allows snort rules that contain
hex characters to be input directly into iptables rulesets without
modification. In addition, fwsnort makes use of the IPTables::Parse Perl
module in order to (optionally) restrict the snort rule translation to
only those rules that specify traffic that could potentially be allowed
through an existing iptables policy.

V. SECURITY JOBS SUMMARY
------------------------
1. Development Manager Needed - Symantec in Redwood City CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319686

2. Application Security Consultant - VA/DC $75K - $100K base (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319685

3. Information Security Manager - Seattle, WA - up to 90K base (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319646

4. Fw: Intrusion / security engineer needed in DC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319647

5. Security Engineer/Data Mining Specialist (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319648

6. Senior Network Security Engineer needed for Ft. Monmouth, New Jersey (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319649

7. Junior Security Administrator (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319650

8. Looking for entry level INFOSEC position in New York Metro area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319651

9. Opportunity for cleared Network Security Analyst/Engineer for DC area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319652

10. Consulting Manager, Cyber Operations Center - Albany, NY, USA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319660

11. Application Security Consultant VA/DC $75K-$100K base (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319653

12. Sr Security Architect Needed--Ohio (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319657

13. Security Engineer available for Hire (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319658

14. 2003 Summer Internship (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319654

15. Position Sought -- Computer Forensic Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319655

16. Sr. Product Manager - Redwood City CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319656

17. Sr Security Architect Needed - Ohio (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319678

18. Program Manager Needed at Symantec, Redwood City, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319661

19. Chief Security Officer (Chicago based fortune 100 company) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319670

20. Chicago Information Security Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319665

21. Sr. Manager Development / Lead Security Analyst Team, Tokyo, Japan (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319668

22. Sr. Security Researcher / Principal Software Engineer, Tokyo Japan (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319659

23. NetScreen Certified Professional Required **ASAP** (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319671

24. wanted: Jr. Security Consultant/ Security Engineer position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/319663

VI. INCIDENTS LIST SUMMARY
-------------------------
1. Trojan found... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319617

2. IP Spoofs in the log - not sure what to do next (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319620

3. SMTP Scans (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319616

4. protocol watcher (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319520

5. POP3 logon attempts (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319461

6. Company being War Dialed (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319459

7. msamba (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319455

8. FW: IP Spoofs in the log - not sure what to do next (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319347

9. Tracking proxies on port 1180/1182 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319286

10. port 139 syn-fin scans (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319249

11. Strange, scary, subtle trojan (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319255

12. Intresting problem concerning libresolv.so.2 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319243

13. Mo'Logs (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319156

14. re: port 5168 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/319154

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Article Announcement: Auditing Web Site Authentication (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/319643

2. Jump back to shellcode Windows overflow (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/319642

3. MSIE crash-"feature" (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/319640

4. cipher.exe overflow (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/319641

5. defacement stats (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/319422

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Article Announcement: Auditing Web Site Authentication (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319605

2. Files in system 32 directory (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319564

3. interoperability of VPN checkpoint FW1 to ISA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319537

4. Article Announcement: Anti-Virus Defence In Depth (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319467

5. Auditing a reboot (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319397

6. SecurityFocus Microsoft Newsletter #134 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319271

7. Does In-Place Upgrade of Microsoft Exchange Create Open Relays? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319274

8. Article Announcement: Statistical-Based Intrusion Detection (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319221

9. checking server status (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319199

10. Does In-Place Upgrade of Microsoft Exchange Create Open Relays? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/319195

IX. SUN FOCUS LIST SUMMARY
----------------------------
1. New release of Solaris secuirity module Papillo (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/319442

2. New release of Solaris secuirity module Papillon (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/319429

3. Unable to su on firewall (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/319340

4. distributed ssh key management (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/319341

5. Expanded Solaris Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/319214

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Linux Security Courses (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/319322

XI. SPONSOR INFORMATION
-----------------------
This issue is sponsored by: FastTrain

Log onto http://www.fasttraincamp.com.