SecurityFocus Newsletter #196

John Boletta <[email protected]> Tue, 13 May 2003 09:07:12 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #196
-----------------------------

This is issue is sponsored by: AirDefense

*** Wireless LAN Policies for Security & Management - NEW White Paper ***

Just like wired networks, wireless LANs require network security policies
that are enforced to protect WLANs from known vulnerabilities and threats.
Learn to design, implement and enforce WLAN security policies to lockdown
enterprise WLANs.

Click here to request your FREE white paper:
www.airdefense.net/securityfocus/policies.shtm
-------------------------------------------------------------------------------
I. FRONT AND CENTER
1. Starting from Scratch: Formatting and Reinstalling after...
2. U.S. Information Security Law, Part 3
3. The Nowhere Men
4. Security's Failed Past and Risky Future
II. BUGTRAQ SUMMARY
1. KDE Konqueror Malformed HTML Page Denial of Service Vulnerability
2. HP-UX RWrite Buffer Overflow Vulnerability
3. WebcamXP Message Field HTML Code Injection Vulnerability
4. Ethereal Multiple Dissector One Byte Buffer Overflow...
5. Ethereal Mount Dissector Integer Overflow Vulnerability
6. Ethereal PPP Dissector Integer Overflow Vulnerability
7. Microsoft MN-500 Plaintext Password Disclosure Weakness
8. FlashFXP User Password Encryption Weakness
9. Mod_Survey SYSBASE Disk Resource Consumption DOS...
10. GNU Privacy Guard Insecure Trust Path To User ID Weakness
11. MySQL Weak Password Encryption Vulnerability
12. CommuniGate Pro Webmail Session Hijacking Vulnerability
13. Mirabilis ICQ POP3 Client UIDL Command Format String...
14. Mirabilis ICQ POP3 Client Subject Field Signed Integer...
15. Mirabilis ICQ Features On Demand Remote Command Execution...
16. Mirabilis ICQ GIF Parsing Denial Of Service Vulnerability
17. Mirabilis ICQ Message Session Window Denial Of Service...
18. Mirabilis ICQ POP3 Client Date Field Signed Integer Overflow...
19. Microsoft Internet Explorer DHTML AnchorClick Partial Denial...
20. Youbin HOME Buffer Overflow Vulnerability
21. Leksbot Multiple Unspecified Vulnerabilities
22. Siemens Mobile Phones %IMG_NAME Denial Of Service Vulnerability
23. Floosietek FTGate PRO SMTP MAIL FROM Buffer Overflow...
24. Floosietek FTGate PRO SMTP RCPT TO Buffer Overflow Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. 'Banned' Xbox Hacking Book Selling Fast
2. Report: Too Many Watch Lists
3. Senate broadens powerful U.S. terror surveillance law
4. Microsoft admits Passport identity service was vulnerable
IV. SECURITYFOCUS TOP 6 TOOLS
1. Data Thief v1.0
2. DISCO v1.0
3. linux-identd v1.3
4. mod_protection v0.0.2
5. pcInternet Patrol
6. Active Spam Killer v2.3 beta2
V. SECURITYJOBS LIST SUMMARY
1. Sr. Software Security Engineer, Washington DC area (Thread)
2. Information Security Officer required - Charlotte, NC (Thread)
3. Security Engineer/Policy Developer/ needed in MD (columbia...
4. Web Security Research Engineer (Thread)
5. Information Security Programme Manager (UK) (Thread)
6. Seeking information security position (Thread)
7. Security Job w/Fortune 500 Company (Thread)
8. AVAYA Consultative Services Sales Associates (Thread)
9. Looking for Network and System Security administrators in India...
10. Enterprise Mobility Security Architect (Thread)
11. Security Architect Manager - Cleveland, Ohio (Thread)
12. IT Security Engineer required - Hampshire, South Coast, UK...
13. Looking for a job in Networking/ Security (Thread)
14. Senior Network Security Engineer - San Diego Contract - 6...
15. Security Engineer - DITSCAP - San Diego Contract - 6 Months+...
16. Network Security Engineer - San Diego Contract - 6 Months+...
17. Infosec Engineer - CISSP for San Diego 6-month Contract (Job...
18. CISSP Security consultant seeking position in NYC (Thread)
19. Experienced Consultant Desires Information Security Project...
20. Director of Marketing for Latin American Security Company - Fl...
21. IT Security Manager Essex UK (Thread)
22. INFOSEC Engineer in NYC seeks opportunities (Thread)
23. AVAIL: 20-yr International Security Consultant Expert (Thread)
24. Neoteris is hiring!!! - Sales Engineer - Ohio Valley (Thread)
25. Neoteris is hiring!!! - Technical Support Engineer - Mt. View...
26. Security Engineering position in NYC/Norther NJ wanted (Thread)
27. Security consultants needed in Asia (Thread)
28. Neoteris is hiring!!! - Senior Technical Trainer - Mt. View...
29. Seeking RACF Consulting Project (Thread)
30. Information Security Engineer, looking for a position... (Thread)
31. CyberCorp Student Looking for Federal Employment in...
32. Wanted - Telephony Engineer (Thread)
33. Wanted - Internet Investigations Analyst (Thread)
34. Junior - Computer Forensic Analyst (Thread)
35. Wanted - Mid Level Computer Forensic Analyst (Thread)
36. Wanted - Computer Forensic Analyst Senior (Thread)
37. Sr. Security Sales Engineer-DC (Thread)
38. Director of SQA/Release-CA, Bay Area (Thread)
39. SWE-CA, bay area (Thread)
40. Sales Engineer for New York Metro Area (Thread)
41. IT security consultant position in NYC needed (Thread)
VI. INCIDENTS LIST SUMMARY
1. Folllow-up to the Hotmail/MSN password reset problems (Thread)
2. more iis-kabom New attack or old Vulnerability Scanner?...
3. Attack attempts from 195.86.128.45 (Thread)
4. Attack attempts from 195.86.128.45 (Thread)
5. [[email protected]: Attack attempts from 195.86.128.45] (Thread)
6. followup to the MSN hotmail and .Net passport change post (Thread)
7. [Full-Disclosure] Hotmail & Passport (.NET Accounts)...
8. Healthcare incidents? (Thread)
9. Healthcare Incidents: SUMMARY (Thread)
10. DNS Injection Problem (Thread)
11. OT:Healthcare incidents? (Thread)
12. smsx.exe? (Thread)
13. Administrivia: Logs showing GET /.hash=... (Thread)
14. Logs showing GET /.hash=... (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. s0h: Kerio Personal Firewall and Tiny Personal Firewall remote...
2. Buffer overflow in Explorer.exe (Thread)
3. nokia calendar memory errors (Thread)
4. NetBIOS could be used as network flood amplier (Thread)
5. Microsoft Biztalk Server DTA vulnerable to SQL injection (Thread)
6. Microsoft Biztalk Server ISAPI HTTP Receive function buffer...
7. Domino security contact (Thread)
8. TOORCON 2003 CALL FOR PAPERS (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. (prevent + detect Arp spoofing) + Securing Terminal Services...
2. (prevent + detect Arp spoofing) + Securing Terminal Services...
3. Article Announcement: Starting from Scratch: Formatting and...
4. IPSEC through Ms ISA Server (Thread)
5. p2p and ISA (Thread)
6. Timbuktu, etc. (Thread)
7. SuS update's (Thread)
8. Article Announcement: Madonna's Borderline MP3 Tactics (Thread)
9. Article Announcement: Auditing Web Site Authentication, Part...
10. SecurityFocus Microsoft Newsletter #135 (Thread)
11. Microsoft and Bluetooth (Thread)
12. Outlook Security Settings removed (Thread)
13. AD Question (Thread)
IX. SUN FOCUS LIST SUMMARY
1. .exrc file security risks (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Martian Source (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Starting from Scratch: Formatting and Reinstalling after a Security
Incident
By Matthew Tanase

This article will examine the process of starting over, and more
specifically, reinstalling after a security incident.

http://www.securityfocus.com/infocus/1692

2. U.S. Information Security Law, Part 3
By Steven Robinson

This is the third part of a four-part series looking at U.S. information
security laws and the way those laws affect security professionals. In
this installment, we will look at the basics of the criminal information
security law.

http://www.securityfocus.com/infocus/1693

3. The Nowhere Men
By George Smith

Unemployed virus writers take heart: the recording industry is hiring
cyber miscreants to attack its own customers. And we thought you'd never
amount to anything.

http://www.securityfocus.com/columnists/160

4. Security's Failed Past and Risky Future
By Jon Lasser

Final grumblings from SecurityFocus columnist Jon Lasser, as he bids
farewell to the computer security world and moves to Colorado.

http://www.securityfocus.com/columnists/159

II. BUGTRAQ SUMMARY
-------------------
1. KDE Konqueror Malformed HTML Page Denial of Service Vulnerability
BugTraq ID: 7486
Remote: Yes
Date Published: May 02 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7486
Summary:

Konqueror is an Open Source web browser, shipped with the KDE desktop. It
is available on Linux platforms.

KDE Konqueror has been reported prone to a denial of service vulnerability
when rendering a HTML page that contains malformed data. Specifically when
the Konqueror browser attempts to render a page containing 30000 bytes of
repeating '\xFF\xFE\r\r\n' sequences, it will fail dumping a core file in
the process.

An attacker may exploit this vulnerability to trigger a denial of service
condition in a remote user's Konqueror web session.

Although unconfirmed, this vulnerability may be exploited to execute
attacker-supplied code.

The precise technical details of this vulnerability are currently unknown.
This BID will be updated, as further information is available.

2. HP-UX RWrite Buffer Overflow Vulnerability
BugTraq ID: 7489
Remote: No
Date Published: May 02 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7489
Summary:

HP-UX /usr/lbin/rwrite utility has been reported prone to a buffer
overflow vulnerability. Although unconfirmed code execution with elevated
privileges may be possible.

The condition presents itself when excessive data, consisting of more than
14628 bytes, is supplied as part of an argument passed to the vulnerable
utility. When the rwrite application parses the argument it will segfault.
The segfault is likely due to lack of sufficient bounds checking performed
on the data before it is copied into an internal memory buffer. Excessive
data may overrun the boundary of the buffer and adjacent memory containing
values crucial to program flow or execution management may be corrupted.
Although unconfirmed, because of the nature of this vulnerability,
arbitrary code execution may be possible. Code execution, in a default
install, would take place in the context of the root user.

The precise technical details of this vulnerability are currently unknown.
This BID will be updated, as further information is available.

It should be noted that although this vulnerability has been reported to
affect HP-UX version 11.00 other versions might also be affected.

3. WebcamXP Message Field HTML Code Injection Vulnerability
BugTraq ID: 7490
Remote: Yes
Date Published: May 02 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7490
Summary:

WebcamXP is a webcam utility with an integrated http server designed to
operate on windows platforms.

A problem with WebcamXP Chat page could allow remote users to execute
arbitrary script code in the context of the web site running WebcamXP
Chat. The problem occurs due to the lack of sanitization performed on
user-supplied input submitted via the site 'message' field.

As a result, a malicious user may have the ability to submit a post to the
site containing embedded HTML code. This code would be executed by a
user's browser in the context of the vulnerable site.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. Other attacks are also possible, including a prolonged denial
of service attack. The consequences of the attack may vary depending on
the users browser.

It should be noted that although this vulnerability has been reported to
affect WebcamXP version 1.02.432 and 1.02.535.4.0, previous versions might
also be affected.

4. Ethereal Multiple Dissector One Byte Buffer Overflow Vulnerabilities
BugTraq ID: 7493
Remote: Yes
Date Published: May 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7493
Summary:

Ethereal is a freely available, open source network traffic analysis tool.
It is maintained by the Ethereal Project and is available for most Unix
and Linux variants as well as Microsoft Windows operating systems.

Several dissectors included with Ethereal are vulnerable to buffer
overflow conditions. Specifically, the dissectors were using the
tvb_get_nstringz() and tvb_get_nstringz0() functions in an unsafe manner.
Exploitation of this issue will allow an attacker to overflow memory
buffers by one byte. The AIM, GIOP Gryphon, OSPF, PPTP, Quake, Quake2,
Quake3, Rsync, SMB, SMPP, and TSP dissectors are vulnerable to this issue.

The precise technical details of this vulnerability are currently unknown.
This BID will be updated as further information is available.

An attacker may be able to exploit this vulnerability by crafting a
specially formed packet and sending it to a system using the vulnerable
dissectors or by convincing a victim user to use Ethereal to read a
malformed packet trace file.

Due to the nature of this vulnerability, it may be possible for an
attacker to create a situation in which sensitive memory could be
overwritten. If successful this may allow for the execution of arbitrary
code with the privileges of the Ethereal process.

This vulnerability affects Ethereal 0.9.11 and earlier.

5. Ethereal Mount Dissector Integer Overflow Vulnerability
BugTraq ID: 7494
Remote: Yes
Date Published: May 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7494
Summary:

The Mount dissector of Ethereal is prone to an integer overflow
vulnerability.

The precise technical details of this vulnerability are currently unknown.
This BID will be updated as further information is available.

An attacker may be able to exploit this vulnerability by crafting a
specially formed packet and sending it to a system using the Mount
dissector or by convincing a victim user to use Ethereal to read a
malformed packet trace file.

Due to the nature of this vulnerability it may be possible for an attacker
to create a situation in which sensitive memory could be corrupted. If
successful, this may cause Ethereal to behave in an unpredictable manner.

This vulnerability affects Ethereal 0.9.11 and earlier.

6. Ethereal PPP Dissector Integer Overflow Vulnerability
BugTraq ID: 7495
Remote: Yes
Date Published: May 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7495
Summary:

The PPP dissector of Ethereal is prone to an integer overflow
vulnerability.

The precise technical details of this vulnerability are currently unknown.
This BID will be updated as further information is available.

An attacker may be able to exploit this vulnerability by crafting a
specially formed packet and sending it to a system using the PPP dissector
or by convincing a victim user to use Ethereal to read a malformed packet
trace file.

This vulnerability affects Ethereal 0.9.11 and earlier.

7. Microsoft MN-500 Plaintext Password Disclosure Weakness
BugTraq ID: 7496
Remote: Yes
Date Published: May 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7496
Summary:

The MN-500 Wireless Base Station provides a wireless networking solution
to home and business networks.

A weakness has been reported for the MN-500 device that may result in the
disclosure of administrative credentials to remote attackers. Reportedly,
the issue exists due to backup configuration files storing administrative
passwords in a plaintext format.

An attacker who is able to obtain the backup configuration file is able to
obtain the administrative password.

8. FlashFXP User Password Encryption Weakness
BugTraq ID: 7499
Remote: No
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7499
Summary:

FlashFXP is a FTP implementation that allows client-server file transfers
in addition to site-to-site file transfers. It is available for Microsoft
Windows.

FlashFXP uses a trivially reversible algorithm to encode FTP user
credentials. FTP user passwords are encrypted using XOR with a weak key.
Local attackers with access to the sites.data may exploit this weakness to
gain unauthorized access to FTP user credentials for remote sites.

If credentials are used for multiple services or sites, it may permit
attackers to gain unauthorized access to those services as well.

9. Mod_Survey SYSBASE Disk Resource Consumption Denial of Service Vulnerability
BugTraq ID: 7498
Remote: Yes
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7498
Summary:

Mod_Survey is an Apache module designed to process and display XML-based
questionnaires and surveys. It is available for the Linux, Unix, and
Microsoft Windows operating systems.

The SYSBASE variable is used by Mod_Survey when accessing requests survey
files. The value of SYSBASE is initialized to the location of the survey
file and is used to create a subdirectory for the storage of various
survey related files including cache files and questionnaire response
data. The subdirectory is placed within the central data repository,
typically /usr/local/mod_survey/data.

A vulnerability has been discovered in Mod_Survey when handling requests
for nonexistent surveys. Before verifying the existence of a requested
survey file the SYSBASE variable is initialized, triggering the creation
of an unneeded directory. The validity of the requested survey file is
subsequently verified.

Exploitation of this vulnerability may allow an attacker to carry out a
denial of service attack, designed to consume available hard disk space or
inodes. The consumption of resources may cause a target server to crash.

This vulnerability affects Mod_Survey versions prior to 3.0.15.

10. GNU Privacy Guard Insecure Trust Path To User ID Weakness
BugTraq ID: 7497
Remote: No
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7497
Summary:

GNU Privacy Guard is a free opensource multi-platform replacement for PGP.

GNU Privacy Guard has been reported prone to a weakness involving the
validity of multiple user IDs. It has been reported that GNUPG does not
sufficiently differentiate between the validity given to individual IDs on
a public key that has multiple user IDs linked to it. The amount of
validity given is reportedly the same for all IDs as given to the most
valid ID on the key.

This may result in an untrusted user ID, linked to a key that contains a
trusted ID as the most valid ID, being accepted as valid. Data will be
encrypted to the untrusted ID without any warning. This may result in the
leakage of data presumed destined to a trusted user; other attacks may
also be possible.

11. MySQL Weak Password Encryption Vulnerability
BugTraq ID: 7500
Remote: No
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7500
Summary:

MySQL is an open source relational database project. It is available for
the Microsoft Windows, Linux, and Unix operating systems.

MySQL has been reported prone to a weak password encryption algorithm. It
has been reported that the MySQL function used to encrypt MySQL passwords
makes just one pass over the password and employs a weak left shift based
cipher. The output of this function results in a password hash of low
entropy. Due to the base complexity of the algorithm used to create the
MySQL password hash, the hash may be cracked in little time using a
bruteforce method to create an identical hash and thereby guess the clear
text password.

An attacker may use information recovered in this way to aid in further
attacks launched against the underlying system.

12. CommuniGate Pro Webmail Session Hijacking Vulnerability
BugTraq ID: 7501
Remote: Yes
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7501
Summary:

CommuniGate Pro is an internet messaging server. CommuniGate Pro includes
a webmail service to allow access to mailboxes via HTTP. It is available
for a number of platforms including Unix and Linux variants and Microsoft
Windows operating systems.

CommuniGate Pro Webmail has been reported prone to a session hijacking
vulnerability. The vulnerability presents itself when the victim views an
image or similar resource embedded in a HTML web-mail. Specifically the
current session ID used in CommuniGate Pro Webmail is sent, as the
'referrer' field, in the HTTP header of a request made for an image
embedded in a malicious e-mail.

The attacker may intercept the HTTP header and extract the URL data
contained in the 'referrer' field. The attacker may then follow the URL to
hijack the current user session.

13. Mirabilis ICQ POP3 Client UIDL Command Format String Vulnerability
BugTraq ID: 7461
Remote: Yes
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7461
Summary:

Mirabilis ICQ is an instant messenger client for a number of platforms
including Microsoft Windows, MacOS and Palm systems. ICQ provides an
integrated POP3 client that is used to communicate via e-mail. The POP3
client is a COM object embedded in the POP3.dll library.

Each message generated by the POP3 client is given a unique identification
number (UIDL), which is determined by the server. This id consists of up
to 70 bytes of data from a limited character set.

A format string vulnerability has been discovered in the ICQ POP3 client
when handling the identification string. It is likely that the problem
presents itself due to a programming error in a function used to handle
UIDL command server response strings.

By impersonating a valid POP3 server, an attacker may send malicious
format string specifiers, embedded in the unique id of an e-mail message
destined for the ICQ POP3 Client. When the message header is processed the
malicious format string specifiers may be interpreted. As a result, it may
be possible for sensitive locations in memory to be corrupted. This may
ultimately result in the execution of attacker-supplied code.

14. Mirabilis ICQ POP3 Client Subject Field Signed Integer Overflow Vulnerability
BugTraq ID: 7462
Remote: Yes
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7462
Summary:

A vulnerability has been reported for the POP3 client of ICQ that may
result in the execution of arbitrary attacker-supplied commands.

The vulnerability exists due to insufficient boundary checks performed by
the integrated POP3 mail client when verifying the length of certain
e-mail header fields. Specifically, the length of the 'Subject' header is
stored within a 16 bit signed integer. As a result, by supplying excessive
data within the 'Subject' field it may be possible to wrap the signed
integer, resulting in a negative value.

An attacker can exploit this vulnerability by crafting an e-mail with an
overly long Subject field, consisting of at least 33000 characters, and
sending it to a victim user. This will effectively result in an unexpected
miscalculation by the application.

Successful exploitation of this issue may allow an attacker to overwrite
sensitive memory with malicious values which will result in the client
throwing an unhandled exception and crashing.

Exploitation of this issue may also result in the execution of
attacker-supplied code.

This vulnerability was reported for Mirabilis ICQ 2003a and earlier.

15. Mirabilis ICQ Features On Demand Remote Command Execution Vulnerability
BugTraq ID: 7464
Remote: Yes
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7464
Summary:

ICQ is an instant messenger client for a number of platforms including
Microsoft Windows.

The ICQ Features on Demand allows users to download and install ICQ add-on
client software such as ICQ Phone and ICQ Web Search.

Features on Demand uses a hardcoded URL from which it retrieves add-on
installation packages. The DataURL value is found in the 'Packages.ini'
file under the heading '[General]'.

When Features on Demand is invoked, it connects to this URL in order to
download the appropriate packages, but it does not verify the authenticity
of the package in any way. This could allow a malicious user to
impersonate the package repository service through some other attack, such
as DNS poisoning. Any malicious package supplied to ICQ will be executed
with the permissions of the user running ICQ.

Features on Demand was introduced in ICQ 2002a and is available in
subsequent versions.

16. Mirabilis ICQ GIF Parsing Denial Of Service Vulnerability
BugTraq ID: 7466
Remote: Yes
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7466
Summary:

ICQ is an instant messenger client for a number of platforms including
Microsoft Windows systems.

ICQ is prone to a denial of service condition when parsing GIF89a headers.
This condition exists in 'icqateimg32.dll', which is the native ICQ GIF
parsing/rendering library.

This issue is due to a flaw in how 'icqateimg32.dll' decodes GIF files.
The library expects either an existing GCT (Global Color Table) or an LCT
(Local Color Table) in the header when attempting to decode a GIF file.
If none of these tables exist in the header, the library will fail when
attempting to render the GIF file. This will cause ICQ to crash, leading
to a denial of service.

An attacker will be able to exploit this issue by passing a GIF with a
specially crafted header for processing by the GIF parsing/rendering
library.

17. Mirabilis ICQ Message Session Window Denial Of Service Vulnerability
BugTraq ID: 7465
Remote: Yes
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7465
Summary:

Mirabilis ICQ is an instant messenger client for a number of platforms
including Microsoft Windows, MacOS and Palm systems.

Each ICQ message window (message session) contains an advertisement that
the client requests from an ADS server. This advertisement is obtained by
making a specially crafted HTTP request to the ADS server for a randomized
HTML file. Aside from the randomized file name, the request is made to a
static location.

No authentication is performed between the ICQ client and the ADS server
during this transaction.

A denial of service vulnerability has been discovered in HTML rendering
library used by Mirabilis ICQ to process advertisement code. The problem
occurs due to the library failing to handle specific malformed HTML table
tag attributes. Specifically, a table tag containing a 'width' attribute
with a value of '-1' will trigger a denial of service. The affected client
program will freeze the systems CPU utilization will rise to 100%.

An attacker may be capable of exploiting this vulnerability due to the
lack of authentication while obtaining the advertisement. By impersonating
the ADS server it may be possible for ICQ client requests to be made to an
attacker-controlled server. This may result in malicious HTML
advertisements being rendered within a message session.

18. Mirabilis ICQ POP3 Client Date Field Signed Integer Overflow Vulnerability
BugTraq ID: 7463
Remote: Yes
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7463
Summary:

A vulnerability has been reported for the POP3 client of ICQ that may
result in the execution of arbitrary attacker-supplied commands.

The vulnerability exists due to insufficient boundary checks performed by
the integrated POP3 mail client when verifying the length of certain
e-mail header fields. Specifically, the length of the 'Date' header is
stored within a 16 bit signed integer. As a result, by supplying excessive
data within the 'Date' field it may be possible to wrap the signed
integer, resulting in a negative value.

An attacker can exploit this vulnerability by crafting an e-mail with an
overly long 'Date' field, consisting of at least 32000 bytes of data, and
sending it to a victim user. This will effectively overflow the sign of an
internally stored variable and result in an unexpected miscalculation by
the application.

Successful exploitation of this issue may allow an attacker to overwrite
sensitive memory with malicious values, which will result in the client
throwing an unhandled exception and crashing.

Exploitation of this issue may also result in the execution of
attacker-supplied code.

This vulnerability was reported for Mirabilis ICQ 2003a and earlier.

19. Microsoft Internet Explorer DHTML AnchorClick Partial Denial Of Service Vulnerability
BugTraq ID: 7502
Remote: Yes
Date Published: May 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7502
Summary:

Microsoft Internet Explorer has been reported prone to a denial of service
condition when handling certain DHTML objects.

It has been reported that, while using the DHTML 'A' 'AnchorClick' object,
an attacker may specify a folder instead of a HREF style URL link. While
the latter is within normal specifications of the DHTML language, if the
attacker leaves this field blank and supplies the link to an unsuspecting
user, upon following the malicious link, Internet Explorer will fail. This
issue is believed to be as a result of an illegal exception thrown while
attempting to access a null pointer.

This issue will only affect the active Internet Explorer window, inactive
Internet Explorer windows are not affected.

It should be noted that, although this vulnerability has been reported to
affect Internet Explorer version 6.0 SP1, previous versions might also be
affected.

20. Youbin HOME Buffer Overflow Vulnerability
BugTraq ID: 7503
Remote: No
Date Published: May 06 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7503
Summary:

youbin is a network based mail arrival notification service designed to
replace biff.

It has been reported that youbin is vulnerable to a locally exploitable
buffer overflow vulnerability. The vulnerability is related to the
handling of the HOME environment variable.

Specifically, an internal memory buffer may be overrun while handling a
HOME environment variable containing excessive data. This condition may be
exploited by attackers to corrupt memory adjacent to the affected buffer.

Because adjacent memory may contain values, which are crucial to the
control of program execution flow, an attacker may be capable of executing
arbitrary instructions with the privileges of the youbin process,
typically root.

It should be noted that although this vulnerability has been reported to
affect youbin version 3.4, previous versions might also be affected.

21. Leksbot Multiple Unspecified Vulnerabilities
BugTraq ID: 7505
Remote: No
Date Published: May 06 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7505
Summary:

Leksbot is a freely available dictionary of botanical terms. It is
available for a variety of platforms including Microsoft Windows and Linux
systems.

Multiple vulnerabilities have been reported for Leksbot. The precise
nature of these vulnerabilities are currently unknown however,
exploitation of this issue may result in an attacker obtaining elevated
privileges.

Reportedly, in some installations of Leksbot, the /usr/bin/KATAXWR is
unnecessarily configured to be a setuid root binary. Systems configured in
this manner may be prone to a security risk, as an attacker may be capable
of gaining root privileges.

These vulnerabilities have been confirmed to affect Debian installations
of Leksbot. Although unconfirmed, Leksbot installations on other systems
may also be prone to this issue.

This BID will be updated as further information is available.

22. Siemens Mobile Phones %IMG_NAME Denial Of Service Vulnerability
BugTraq ID: 7507
Remote: Yes
Date Published: May 06 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7507
Summary:

Siemens Mobile Phones are prone to a denial of service when handling
malformed image attachments in SMS messages. This is reportedly due to a
boundary condition error.

The correct syntax for image attachments is "%IMG_NAME", where IMG_NAME is
the name of the image to be attached. This condition will occur if the
value for the IMG_NAME is 157 characters in length. A denial of service
may occur when such the malformed SMS is received, causing the phone to
disconnect. It has also been reported that the user will not be able to
access their INBOX. It should be noted that this condition could also
occur if a user sends the malformed message from a vulnerable Siemens
mobile phone.

This vulnerability was reported in Siemens *45 Series phones, but other
phones may also be affected.

23. Floosietek FTGate PRO SMTP MAIL FROM Buffer Overflow Vulnerability
BugTraq ID: 7506
Remote: Yes
Date Published: May 06 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7506
Summary:

Floosietek FTGate PRO is a mail server for the Microsoft Windows operating
system.

A buffer overflow vulnerability has been reported for FTGate PRO mail
server. The vulnerability exists when the mail server attempts to process
overly long SMTP 'Mail From' arguments. Specifically, when the mail server
processes a malicious 'Mail From' e-mail address consisting of more than
2017 characters, the mail server will crash. This is reportedly due to the
exception handler being corrupted. Although unconfirmed, due to the nature
of this vulnerability the condition may be exploited to execute
attacker-supplied arbitrary code with the privileges of the SYSTEM user.

This vulnerability was reported for FTGate PRO 1.22 Hotfix(1328). It is
likely that previous versions are also affected.

24. Floosietek FTGate PRO SMTP RCPT TO Buffer Overflow Vulnerability
BugTraq ID: 7508
Remote: Yes
Date Published: May 06 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7508
Summary:

Floosietek FTGate PRO is a mail server for the Microsoft Windows operating
system.

A buffer overflow vulnerability has been reported for FTGate PRO mail
server. The vulnerability exists when the mail server attempts to process
overly long SMTP 'Rcpt To' arguments. Specifically, when the mail server
processes a malicious 'Rcpt To' e-mail address consisting of more than
2017 characters, the mail server will crash. This is reportedly due to the
exception handler being corrupted. Although unconfirmed, due to the nature
of this vulnerability the condition may be exploited to execute
attacker-supplied arbitrary code with the privileges of the SYSTEM user.

This vulnerability was reported for FTGate PRO 1.22 Hotfix(1328). It is
likely that previous versions are also affected.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. 'Banned' Xbox Hacking Book Selling Fast
By Kevin Poulsen

Too hot for tech publishers, Andrew Huang self-published his comprehensive
guide to hacking Microsoft's game console. Weeks before publication, he's
already pre-sold half of his initial print run.

http://www.securityfocus.com/news/4580

2. Report: Too Many Watch Lists
By Kevin Poulsen

Congressional investigators urge the government to combine twelve
different surveillance databases into one.

http://www.securityfocus.com/news/4419

3. Senate broadens powerful U.S. terror surveillance law
By Ted Bridis, The Associated Press

The Senate easily passed a measure Thursday expanding a powerful
surveillance law, used in spy and terrorism investigations, to allow U.S.
agents to wiretap lone foreigners who can't be linked to a terror
organization or government.

http://www.securityfocus.com/news/4590

4. Microsoft admits Passport identity service was vulnerable
By Ted Bridis, The Associated Press

A computer researcher in Pakistan discovered how to breach Microsoft
Corp.'s security procedures for its popular Internet Passport service,
designed to protect customers visiting some retail Web sites, sending
e-mails and in some cases making credit-card purchases.

http://www.securityfocus.com/news/4575

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Data Thief v1.0
by Application Security, Inc
Relevant URL:
http://www.appsecinc.com/resources/freetools/
Platforms: Linux, UNIX
Summary:

Data Thief is a "proof-on-concept" tool used to demonstrate to web
administrators and developers how easy it is to steal data from a web
application that is vulnerable to SQL Injection. Data Thief is designed to
retrieve the data from a Microsoft SQL Server back-end behind a web
application with a SQL Injection vulnerability. Once a SQL Injection
vulnerability is identified, Data Thief does all the work of listing the
linked severs, laying out the database schema, and actually selecting the
data from a table in the application.

2. DISCO v1.0
by P
Relevant URL:
http://www.altmode.com/disco/
Platforms: FreeBSD, Linux, NetBSD, OpenBSD
Summary:

DISCO is a passive IP discovery utility designed to sit on segments
throughout a network to discover unique IPs and passively fingerprint TCP
SYN packets.

3. linux-identd v1.3
by Per Liden [email protected]
Relevant URL:
http://www.fukt.bth.se/~per/identd/
Platforms: Linux
Summary:

linux-identd is a user identification daemon for Linux, which implements
the Identification Protocol (RFC1413). This protocol is used to identify
active TCP connections. The daemon listens to TCP port 113 (auth), and can
be run either as a stand-alone daemon, or through inetd.

4. mod_protection v0.0.2
by Pierpaolo Giacomin
Relevant URL:
http://www.twlc.net/download.php?op=viewsdownload&sid=20
Platforms: UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

mod_protection is an Apache module that integrates the basic function of
an IDS (Intrusion Detection System) and a firewall. When a malicious
client sends a request that matches a rule, the administrator will be
warned and the client gets an error message.

5. pcInternet Patrol
by Internet Security Alliance
Relevant URL:
http://www.isa-llc.com/downloads/pcip.php
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

pcInternet Patrol maximizes protection with minimum user involvement This
product finds 6 times more potentially dangerous programs/modules than
other leading personal firewalls. Other features are:
- Stops all intruder programs both known and unknown;
- Users always have the latest programs definition without the need for an
update;
- Keeps you and your computer out of harms way, without getting in your
way;
- Cannot be disabled by an intruder without alerting user or
administrator;
- Activates Intruder tracking to trace IP address of intruder for possible
apprehension;
- Continuously monitors the state of the NETBIOS ports, the first entry
target for intruders;
- Help with security issues in real time!

6. Active Spam Killer v2.3 beta2
by Marco Paganini [email protected]
Relevant URL:
http://www.paganini.net/ask/
Platforms: Python
Summary:

Active Spam Killer (ASK) protects your email account against spam by
confirming the sender's email address before actual delivery takes place.
The confirmation happens by means of a "confirmation message" that is
automatically sent to all "unknown" users. Once the sender replies to that
message (a simple reply will do), future emails from that person will be
delivered immediately. You can also specify (regexp) addresses to be
immediately accepted, rejected (with a nastygram) or ignored. The package
also includes a utility to scan your old mailboxes and generate a list of
emails to be accepted automatically.

V. SECURITY JOBS SUMMARY
------------------------
1. Sr. Software Security Engineer, Washington DC area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320906

2. Information Security Officer required - Charlotte, NC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320888

3. Security Engineer/Policy Developer/ needed in MD (columbia- baltimore area) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320887

4. Web Security Research Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320873

5. Information Security Programme Manager (UK) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320876

6. Seeking information security position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320868

7. Security Job w/Fortune 500 Company (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320869

8. AVAYA Consultative Services Sales Associates (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320877

9. Looking for Network and System Security administrators in India (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320867

10. Enterprise Mobility Security Architect (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320866

11. Security Architect Manager - Cleveland, Ohio (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320865

12. IT Security Engineer required - Hampshire, South Coast, UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320864

13. Looking for a job in Networking/ Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320863

14. Senior Network Security Engineer - San Diego Contract - 6 Months+ (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320862

15. Security Engineer - DITSCAP - San Diego Contract - 6 Months+ (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320861

16. Network Security Engineer - San Diego Contract - 6 Months+ (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320860

17. Infosec Engineer - CISSP for San Diego 6-month Contract (Job #944) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320859

18. CISSP Security consultant seeking position in NYC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320858

19. Experienced Consultant Desires Information Security Project (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320857

20. Director of Marketing for Latin American Security Company - Fl - #762JA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320856

21. IT Security Manager Essex UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320567

22. INFOSEC Engineer in NYC seeks opportunities (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320518

23. AVAIL: 20-yr International Security Consultant Expert (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320517

24. Neoteris is hiring!!! - Sales Engineer - Ohio Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320516

25. Neoteris is hiring!!! - Technical Support Engineer - Mt. View, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320515

26. Security Engineering position in NYC/Norther NJ wanted (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320458

27. Security consultants needed in Asia (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320468

28. Neoteris is hiring!!! - Senior Technical Trainer - Mt. View, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320456

29. Seeking RACF Consulting Project (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320457

30. Information Security Engineer, looking for a position... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320415

31. CyberCorp Student Looking for Federal Employment in Information Security - Charlotte, NC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320413

32. Wanted - Telephony Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320414

33. Wanted - Internet Investigations Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320412

34. Junior - Computer Forensic Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320411

35. Wanted - Mid Level Computer Forensic Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320410

36. Wanted - Computer Forensic Analyst Senior (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320409

37. Sr. Security Sales Engineer-DC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320416

38. Director of SQA/Release-CA, Bay Area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320408

39. SWE-CA, bay area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320407

40. Sales Engineer for New York Metro Area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320406

41. IT security consultant position in NYC needed (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/320284

VI. INCIDENTS LIST SUMMARY
-------------------------
1. Folllow-up to the Hotmail/MSN password reset problems (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320944

2. more iis-kabom New attack or old Vulnerability Scanner? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320943

3. Attack attempts from 195.86.128.45 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320939

4. Attack attempts from 195.86.128.45 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320938

5. [[email protected]: Attack attempts from 195.86.128.45] (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320946

6. followup to the MSN hotmail and .Net passport change post (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320778

7. [Full-Disclosure] Hotmail & Passport (.NET Accounts) Vulnerability (fwd) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320779

8. Healthcare incidents? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320774

9. Healthcare Incidents: SUMMARY (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320781

10. DNS Injection Problem (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320780

11. OT:Healthcare incidents? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320563

12. smsx.exe? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320566

13. Administrivia: Logs showing GET /.hash=... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320346

14. Logs showing GET /.hash=... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320261

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. s0h: Kerio Personal Firewall and Tiny Personal Firewall remote exploit/patch. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320914

2. Buffer overflow in Explorer.exe (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320824

3. nokia calendar memory errors (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320620

4. NetBIOS could be used as network flood amplier (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320579

5. Microsoft Biztalk Server DTA vulnerable to SQL injection (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320502

6. Microsoft Biztalk Server ISAPI HTTP Receive function buffer overflow (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320501

7. Domino security contact (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320385

8. TOORCON 2003 CALL FOR PAPERS (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320264

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. (prevent + detect Arp spoofing) + Securing Terminal Services (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320932

2. (prevent + detect Arp spoofing) + Securing Terminal Services (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320915

3. Article Announcement: Starting from Scratch: Formatting and Reinstalling after a Security Incident (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320904

4. IPSEC through Ms ISA Server (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320903

5. p2p and ISA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320902

6. Timbuktu, etc. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320901

7. SuS update's (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320810

8. Article Announcement: Madonna's Borderline MP3 Tactics (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320540

9. Article Announcement: Auditing Web Site Authentication, Part Two (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320541

10. SecurityFocus Microsoft Newsletter #135 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320491

11. Microsoft and Bluetooth (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320483

12. Outlook Security Settings removed (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320481

13. AD Question (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320327

IX. SUN FOCUS LIST SUMMARY
----------------------------
1. .exrc file security risks (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/320891

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Martian Source (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/320726

XI. SPONSOR INFORMATION
-----------------------
This is issue is sponsored by: AirDefense

*** Wireless LAN Policies for Security & Management - NEW White Paper ***

Click here to request your FREE white paper:
www.airdefense.net/securityfocus/policies.shtm
-------------------------------------------------------------------------------