SecurityFocus Newsletter #197

Stephen Entwisle <[email protected]> Mon, 19 May 2003 13:49:36 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #197
-----------------------------

This Issue is Sponsored By: Spidynamics

ALERT! "Outsmart Web Application Hackers"-FREE Product Trial

Test your Web Applications for over 4000 vulnerabilities! FREE Security
Test via our 15 Day Product Trial that delivers a comprehensive
vulnerability report. Secure your critical assets today!

Visit us at: http://www.spidynamics.com/mktg/freewebinspect54
-------------------------------------------------------------------------------
I. FRONT AND CENTER
1. Security Tools: From Mermaids to Suckling Pigs
2. Malware Myths and Misinformation, Part One
3. Securing Apache: Step-by-Step
4. U.S. Information Security Law, Part 3
5. Relax, It Was a Honeypot
II. BUGTRAQ SUMMARY
1. Lgames LTris Local Memory Corruption Vulnerability
2. Internet Explorer file:// Request Zone Bypass Vulnerability
3. Netbus Authentication Bypass Vulnerability
4. Kerio Personal Firewall Fragmented Packet Filter Bypass...
5. Microsoft SQL Server Unspecified Vulnerability
6. ttCMS / ttForum Remote File Include Vulnerability
7. ttCMS / ttForum Profile.php SQL Injection Vulnerability
8. Boa Webserver File Disclosure Vulnerability
9. Phorum Message Form Field HTML Injection Variant Vulnerability
10. Firebird GDS_Inet_Server Interbase Environment Variable Buffer...
11. Youngzsoft CMailServer MAIL FROM Buffer Overflow Vulnerability
12. Youngzsoft CMailServer RCPT TO Buffer Overflow Vulnerability
13. Snitz Forums 2000 Register.ASP SQL Injection Vulnerability
14. Info-ZIP UnZip Encoded Character Hostile Destination Path...
15. BitchX Mode Change Denial Of Service Vulnerability
16. EType EServ Resource Exhaustion Denial Of Service Vulnerability
17. Apple AirPort Administrative Password Encryption Weakness
18. IU BLog Comment Form HTML Code Injection Vulnerability
19. Pi3Web Malformed GET Request Denial Of Service Vulnerability
20. Cerberus FTP Server Plaintext User Password Weakness
21. Happymall E-Commerce Software Normal_HTML.CGI Cross-Site...
22. PHPNuke Web_Links Module Remote SQL Injection Vulnerability
23. Happymall E-Commerce Software Normal_HTML.CGI File Disclosure...
24. Movable Type Comment Form HTML Code Injection Vulnerability
25. Yahoo! Voice Chat ActiveX Control Unspecified Vulnerability
26. Clearswift MailSweeper PowerPoint File Denial of Service...
27. BEA Systems WebLogic Multiple Password Storage Vulnerabilities
28. Netscape Navigator False URL Information Vulnerability
29. CDRTools CDRecord Devname Format String Vulnerability
30. IP Messenger For Win Filename Buffer Overflow Vulnerability
31. PHP-Nuke Modules.PHP Username URI Parameter Cross Site...
32. Clearswift MailSweeper Attachment Filename Validation...
33. AIX Sendmail Open Relay Default Configuration Weakness
34. Phorum Post.PHP Cross-Site Scripting Vulnerability
35. Phorum UserAdmin Arbitrary Command Execution Vulnerability
36. Phorum Multiple Path Disclosure Vulnerabilities
37. Phorum Common.PHP Cross-Site Scripting Vulnerability
38. Phorum Edit User Profile Arbitrary Command Execution...
39. Phorum Stats Program Arbitrary Command Execution Vulnerability
40. Phorum Download File Disclosure Vulnerability
41. Phorum Register.PHP Connection Proxying Vulnerability
42. Phorum login.PHP Cross Site Scripting Vulnerability
43. Phorum Register.PHP Cross-Site Scripting Vulnerability
44. Phorum Register.PHP Existing User HTML Injection Vulnerability
45. Poptop PPTP BCRELAY sprintf() Buffer Overflow Vulnerability
46. Phorum Login.PHP Connection Proxying Vulnerability
47. Intel Itanium 2 Processor Denial of Service Vulnerability
48. PHP-Nuke Web_Links Module Path Disclosure Vulnerability
49. PHP-Nuke Multiple Downloads Module SQL Injection Vulnerabilities
50. BEA Systems WebLogic Encryption Information Disclosure Weakness
51. BEA Systems WebLogic CredentialMapper Plaintext Password...
52. Poptop PPTP BCRELAY fscanf() Buffer Overflow Vulnerability
53. BEA WebLogic JDBCConnectionPoolRuntimeMBean On-Screen...
54. 3Com OfficeConnect ADSL Router DHCP Response Information...
III. SECURITYFOCUS NEWS ARTICLES
1. Matrix Sequel Has Hacker Cred
2. Security research exemption to DMCA considered
3. Feds To Refocus on Cybersecurity
4. MS 'slush' fund provides big discounts to stop Linux - email
IV. SECURITYFOCUS TOP 6 TOOLS
1. NoTrax v1.3
2. WifiScanner v0.9.0
3. Ginsu Chat Client v0.4.7
4. phpBandwidth Monitor v1.5
5. Very Simple Network Monitor v2.0.0
6. MyNetWeather v0.3
V. SECURITYJOBS LIST SUMMARY
1. Seasoned Security Expert Available (Thread)
2. Cheif Security Officer (Paris, France) (Thread)
3. Bay Area Sales Representive (Thread)
4. Malicious Code Security Analyst, Mechanicsburg, PA (Thread)
5. Application Penetration Tester Wanted (Thread)
6. Director of Quality Assurance (Thread)
7. Internet Security Architect contract position (Thread)
8. Unix Security Analyst - Bloomington, IL (Thread)
9. .Net Security Analyst - Bloomington, IL (Thread)
10. Network security Auditor - Israel (Thread)
11. Security Sales (Thread)
12. Looking for a White Hat Hacker to perform a vulnerability test...
13. Security Manager - Germany (Thread)
14. Cisco IDS Engineer- Guardent / Providence RI (Thread)
15. SAP Security Consultant, Midlands, UK (Thread)
16. Information Security Manager, Benelux (Thread)
17. Seeking Network Security position (will relocate) (Thread)
18. FL CISSP Seeking a Position (Thread)
19. Neoteris is hiring!!! - Regional Sales Managers - Japan/Korea...
20. Neoteris is hiring!!! - Sales Engineers - Japan/Korea (Thread)
21. Neoteris is hiring!!! - Sales Engineers - Germany/France...
22. Neoteris is hiring!!! - Sales Engineer - Ohio Valley (Thread)
23. Neoteris is hiring!!! - Regional Sales Managers - Germany...
24. Neoteris is hiring!!! - Federal Regional Sales Manager...
25. Technical Lead (Thread)
26. Deloitte & Touche Network Security Opportunities (Thread)
27. Deloitte & Touche: Application Security Engineer (Thread)
28. Deloitte and Touche: Identity Management Specialists Needed...
29. Network Security Analyst, Mechanicsburg, PA (Thread)
30. Security Engineer needed in Chicago, IL (Thread)
31. Global CERT Coordinator - NY - $150k-$200k - Job #781 (Thread)
32. Network Security Engineer needed in Jacksonville (Thread)
VI. INCIDENTS LIST SUMMARY
1. BIND Crash (Thread)
2. tcp/1274 scans (Thread)
3. New intrusion script? (Thread)
4. Trojan modifying ntdll.dll and cmd.exe (Thread)
5. UDP/137 scans -- new worm? (Thread)
6. re: DNS poisoning to Korean address (Thread)
7. tcp/554 scans (Thread)
8. Stopping information leakage (Thread)
9. More Info: DNS poisoning to Korean address (Thread)
10. Folllow-up to the Hotmail/MSN password reset problems (Thread)
11. Source 126.0.0.1 UDP/137 (Thread)
12. New SecurityFocus Article: U.S. Information Security Law...
13. IIS/WebDav Exploit List (Thread)
14. Attack attempts from 195.86.128.45 (Thread)
15. smsx.exe? (Thread)
16. A lot of whisker attempts? (Thread)
17. SecurityFocus Article Announcement: Starting from Scratch:...
VII. VULN-DEV RESEARCH LIST SUMMARY
1. MSIE integer overflows (Thread)
2. vulndev-1 and a suggestion about the ensuing discussion (Thread)
3. vulndev1.c solution (warning SPOILER) (Thread)
4. Administrivia: Challenge Guidelines (Thread)
5. Administrivia: List Announcement (Thread)
6. FW: partial analysis of vulndev-1.c (Thread)
7. partial analysis of vulndev-1.c (Thread)
8. vulndev-1 exploit. (Thread)
9. another vulndev-1.c solution (Thread)
10. Buffer overflow in Microsoft ftp.exe (Thread)
11. IIS/WebDav Exploit List (Thread)
12. vulndev-1.c challenge (was Administrivia: List Announcement)...
13. Buffer overflow in Explorer.exe (Thread)
14. TOP 75 Security Tools Translated (Thread)
15. Domain Name Forging On Authentication Prompt (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Article Announcement: Security Tools: From Mermaids to Suckling...
2. Article Announcement: U.S. Information Security Law, Part 3...
3. Harden ASP.NET Configuration (Thread)
4. Share Point? (Thread)
5. SecurityFocus Microsoft Newsletter #136 (Thread)
6. Timbuktu, etc. (Thread)
7. (prevent + detect Arp spoofing) + Securing Terminal Services...
8. IPSEC through Ms ISA Server (Thread)
IX. SUN FOCUS LIST SUMMARY
1. NO NEW POSTS FOR THE WEEK ENDING 05.16.03
X. LINUX FOCUS LIST SUMMARY
1. AW: IPChains Question (compatibility mode on kernel 2.4.x)...
2. IPChains Question (compatibility mode on kernel 2.4.x) (Thread)
3. how to check current backlog queue size(against synflood)...
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Security Tools: From Mermaids to Suckling Pigs
By Scott Granneman

The recent Nmap-hackers survey provides a glimpse of what security
professionals are packing in their tool-belts these days.

2. Malware Myths and Misinformation, Part One

By David Harley

This article is the first of a three-part series looking at some of the
myths and misconceptions that undermine anti-virus protection. The
fallacies we address here tend to begin with the words "I'm safe from
viruses because..."

http://www.securityfocus.com/infocus/1695

3. Securing Apache: Step-by-Step
By Artur Maj

This article shows in a step-by-step fashion, how to install and configure
the Apache 1.3.x Web server in order to mitigate or avoid successful
break-in when new vulnerabilities in this software are found.

4. U.S. Information Security Law, Part 3
By Steven Robinson
This is the third part of a four-part series looking at U.S. information
security laws and the way those laws affect security professionals. In
this installment, we will look at the basics of the criminal information
security law.

http://www.securityfocus.com/infocus/1693

5. Relax, It Was a Honeypot
By Tim Mullen

A security company cleverly tricks hackers into compromising one of its
distribution sites. Really.

http://www.securityfocus.com/columnists/162

II. BUGTRAQ SUMMARY
-------------------
1. Lgames LTris Local Memory Corruption Vulnerability
BugTraq ID: 7537
Remote: No
Date Published: May 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7537
Summary:

LTris is a Tetris clone written for Linux variant and BSD operating
systems. It is maintained by LGames.

A memory corruption vulnerability has been reported for LTris that may
result in a local attacker obtaining elevated privileges.

An attacker can exploit this vulnerability by creating an overly long
$HOME environment variable, consisting of at least 520 bytes. The attacker
then invokes /usr/local/share/ltris and the vulnerability is triggered
resulting in the corruption of sensitive memory and the execution of
attacker-supplied code. Any code to be executed will be executed with
group 'games' privileges.

This vulnerability was reported to affect LTris installed on FreeBSD
systems. It is likely that other systems are also affected.

2. Internet Explorer file:// Request Zone Bypass Vulnerability
BugTraq ID: 7539
Remote: Yes
Date Published: May 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7539
Summary:

Internet Explorer uses zones in order to limit the scope of execution of
code depending on the zone it originates from.

A vulnerability has been reported that could allegedly allow an executable
from the Internet to be run in the Local Computer zone.

It has been alleged that if Internet Explorer attempts to open a web page
containing more than 200 Iframes containing 'file://' requests for the
same executable file, the file will eventually be executed in the Local
Computer zone. This file would have to reside on the remote website
serving the HTML document.

A reliable source has reported that this vulnerability may be due to some
form of resource exhaustion. It is unclear how resource exhaustion would
allow the Iframe to violate the Internet Explorer security zone. This
record will be updated if more information becomes available.

3. Netbus Authentication Bypass Vulnerability
BugTraq ID: 7538
Remote: Yes
Date Published: May 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7538
Summary:

Netbus is a backdoor program that allows remote administration of a
compromised system. It is available for Microsoft Windows operating
systems.

Netbus can be configured to require a password for backdoor server access.

A vulnerability in Netbus may permit remote users to bypass
authentication. If a connection is made to a Netbus server from a host,
further connections from that IP address may not need to authenticate with
the server.

This could allow unauthorized access to the Netbus server.

4. Kerio Personal Firewall Fragmented Packet Filter Bypass Vulnerability
BugTraq ID: 7540
Remote: Yes
Date Published: May 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7540
Summary:

Kerio Personal Firewall (KPF) is a desktop firewall solution that performs
stateful packet inspection. It runs on Windows NT/2000/XP.

Reportedly, a vulnerability exists in KPF that may allow malicious packets
to bypass existing firewall rules.

Allegedly, KPF does not properly handle fragmented packets thus a
maliciously crafted packet may bypass firewall filters.

KPF implements stateful packet filtering for its firewall and as such,
unsolicited traffic, as described above, is unlikely to get through the
firewall.

This vulnerability has not been confirmed by the vendor.

5. Microsoft SQL Server Unspecified Vulnerability
BugTraq ID: 7541
Remote: Unknown
Date Published: May 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7541
Summary:

A reliable source has reported an unspecified vulnerability in Microsoft
SQL Server. SQL Server versions 7 and 2000, as well as the MSDE are said
to be affected by this vulnerability.

The report indicates that this vulnerability involves the Microsoft Jet
OLE DB provider. This component is not enabled by default and should be
disabled until a fix is available if it is not needed. Linked servers
using the OLE DB provider are also reported to be vulnerable.

Though unconfirmed, exploitation of this vulnerability by remote attackers
may result in the compromise of affected hosts.

This is a preliminary alert. This record will be updated when further
details become available.

** Reports suggest that this issue may be a variant of the vulnerability
described in BID 5057. This however, has not been confirmed.

6. ttCMS / ttForum Remote File Include Vulnerability
BugTraq ID: 7542
Remote: Yes
Date Published: May 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7542
Summary:

ttForum is web based forum implemented in PHP and derived from YABB SE.
ttCMS is another web based forum and is in turn derived from ttForum.

A remote file include vulnerability has been reported for both ttForum and
ttCMS. Due to insufficient sanitization of some user-supplied variables by
the 'News.php' and 'Install.php' scripts, it is possible for a remote
attacker to include a malicious PHP file in a URL.

An attacker may exploit this by supplying a path to a maliciously created
file, located on an attacker-controlled host as a value for the
'$template' or 'installdir' parameters.

If the remote file is a malicious PHP script, this may allow for execution
of attacker-supplied PHP code with the privileges of the web server.
Successful exploitation may provide local access to the attacker.

There are conflicting reports about whether or not this issue exists.
The vendor has stated that exploitation of this issue is not possible.

7. ttCMS / ttForum Profile.php SQL Injection Vulnerability
BugTraq ID: 7543
Remote: Yes
Date Published: May 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7543
Summary:

ttForum is web based forum implemented in PHP and derived from YABB SE.
ttCMS is another web based forum and is in turn derived from ttForum.

A problem with ttCMS/ttForum could make it possible for a remote user
launch SQL injection attacks.

It has been reported that a problem exists in the Profile.php script
distributed as part of the software. Due to insufficient sanitizing of
input, it is possible for a remote user to inject arbitrary SQL into the
database used by the web forums.

This problem may allow a remote user to change the password of the
administrative user of an instance of ttCMS or ttForum. It may also allow
a remote user to gain other information from SQL databases used by the
affected software.

There are conflicting reports about whether or not this issue exists.
The vendor has stated that exploitation of this issue is not possible.

8. Boa Webserver File Disclosure Vulnerability
BugTraq ID: 7544
Remote: Yes
Date Published: May 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7544
Summary:

Boa is a single-tasking a high performance web server for Unix based
systems.

Boa webserver has been reported prone to a file disclosure vulnerability.
The issue presents itself due to a lack of sufficient sanitization
performed on user supplied HTTP requests.

Reportedly an attacker may exploit this vulnerability by submitting a HTTP
request that contains dot-dot (../..) directory traversal sequences
designed to break out of the web root and access a webserver readable file
on the vulnerable system. Reportedly the file contents will be displayed
in the attacker's browser.

It should be noted that Boa webserver version '0.92r' on the 'PowerLinkT
WAN Aggregator' appliance has been reported vulnerable. It is not yet
confirmed if other platforms are vulnerable; this issue was not
reproducible on Boa webserver version '0.92r' compiled and installed on
Red Hat Linux 6.2.

This issue may be related to the vulnerability reported in BID 1770.

9. Phorum Message Form Field HTML Injection Variant Vulnerability
BugTraq ID: 7545
Remote: Yes
Date Published: May 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7545
Summary:

Phorum is a PHP based web forums package.

An HTML injection issue has been reported which may lead to unauthorized
code execution.

It has been reported that it is possible to inject HTML or script code
into the subject and other fields of a message in Phorum. This may be
done by including code in message fields before sending a message to the
target victim.

The injected HTML and script code may execute in the security context of
the Phorum site, potentially allowing an attacker to hijack web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user, including posting or deleting
content.

This issue is a variant of the vulnerability described in BID 7262 that
also affects Phorum 3.4.2.

10. Firebird GDS_Inet_Server Interbase Environment Variable Buffer Overflow Vulnerability
BugTraq ID: 7546
Remote: No
Date Published: May 10 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7546
Summary:

Interbase is a database distributed and maintained by Borland. It is
available for Unix and Linux operating systems. As Firebird is based on
Borland/Inprise Interbase source code, it is very likely that Interbase is
prone to this issue also.

A problem with Firebird could make it possible for a local user to gain
elevated privileges.

A buffer overflow has been discovered in the setuid root program
gds_inet_server, packaged with Firebird. This problem could allow a local
user to execute the program with strings of arbitrary length. By using a
custom crafted string, the attacker could overwrite stack memory,
including the return address of a function, and potentially execute
arbitrary code as root.

The vulnerability occurs in the INTERBASE environment variable. When the
gds_inet_server program is executed with a string of arbitrary length
(typically 500 or more bytes) in the INTERBASE environment variable, the
result in an exploitable buffer overflow.

This could make it possible for a local user to gain administrative
access.

11. Youngzsoft CMailServer MAIL FROM Buffer Overflow Vulnerability
BugTraq ID: 7547
Remote: Yes
Date Published: May 10 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7547
Summary:

CMailServer is a e-mail server designed for use with Microsoft Windows
operating environments.

A buffer overflow vulnerability has been reported for CMailServer. The
vulnerability exists due to insufficient bounds checking when parsing
e-mail headers. Specifically, an overly long MAIL FROM e-mail header will
cause CMailServer to crash and corrupt sensitive memory.

An attacker can exploit this vulnerability by crafting a malicious e-mail
with an overly long MAIL FROM header field, consisting of at least 2000
bytes, to a vulnerable system. This will trigger the buffer overflow
condition when CMailServer is used to process the e-mail and will result
in the corruption of sensitive memory. It may also be possible for an
attacker to cause CMailServer to execute malicious attacker-supplied
instructions.

12. Youngzsoft CMailServer RCPT TO Buffer Overflow Vulnerability
BugTraq ID: 7548
Remote: Yes
Date Published: May 10 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7548
Summary:

CMailServer is a e-mail server designed for use with Microsoft Windows
operating environments.

A buffer overflow vulnerability has been reported for CMailServer. The
vulnerability exists due to insufficient bounds checking when parsing
e-mail headers. Specifically, an overly long RCPT TO e-mail header will
cause CMailServer to crash and corrupt sensitive memory.

An attacker can exploit this vulnerability by crafting a malicious e-mail
with an overly long RCPT TO header field, consisting of at least 2000
bytes, to a vulnerable system. This will trigger the buffer overflow
condition when CMailServer is used to process the e-mail and will result
in the corruption of sensitive memory. It may also be possible for an
attacker to cause CMailServer to execute malicious attacker-supplied
instructions.

13. Snitz Forums 2000 Register.ASP SQL Injection Vulnerability
BugTraq ID: 7549
Remote: Yes
Date Published: May 10 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7549
Summary:

Snitz Forums 2000 is ASP-based web forum software. It runs on Microsoft
Windows operating systems. Snitz is back-ended by a database and supports
Microsoft Access 97/2000, SQL Server 6.5/7.0/2000 and MySQL.

It is possible for a remote attacker to inject SQL into queries made by
the register.asp script. Specifically, the 'email' variable is not
properly sanitized of malicious SQL instructions.

It is possible for a remote attacker to inject SQL into queries made by
the register.asp script. This may be exploited to manipulate the logic of
a query made by the script.

Depending on the database implementation used, this may possibly result in
sensitive information in the database being disclosed to the attacker or
may enable the attacker to modify data. There is also the possibility
that this issue may be leveraged to exploit vulnerabilities that may exist
in the underlying database.

The attacker would have to pass properly formatted SQL to the vulnerable
script to exploit this issue.

This vulnerability was reported for Snitz Forum 2000 3.3.03. It is likely
that earlier versions are affected.

14. Info-ZIP UnZip Encoded Character Hostile Destination Path Vulnerability
BugTraq ID: 7550
Remote: Yes
Date Published: May 10 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7550
Summary:

Info-ZIP UnZip contains a vulnerability during the handling of pathnames
for archived files. Specifically, when certain encoded characters are
inserted into '../' directory traversal sequences, the creator of the
archive can cause the file to be extracted to arbitrary locations on the
filesystem - including paths containing system binaries and other
sensitive or confidential information.

This will allow an attacker to create a file in a hostile archive to be
placed anywhere on the target system.

This can be used to create or overwrite binaries in any desired location.
Properly exploited, this may grant the archive creator an elevation of
privileges.

This vulnerability was reported to affect Info-ZIP UnZip 5.50 and it is
likely that earlier versions may be affected. This issue is similar to the
vulnerability described in BID 5835.

15. BitchX Mode Change Denial Of Service Vulnerability
BugTraq ID: 7551
Remote: Yes
Date Published: May 10 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7551
Summary:

BitchX is a freely available, open source IRC client. It is available for
Unix, Linux, and Microsoft operating systems.

A denial of service vulnerability has been reported for BitchX. It is
possible to cause BitchX to crash when certain mode changes are made.

The vulnerability exists in the names.c source file where a check is not
made for any arguments provided with a mode change.

The precise details of this vulnerability are currently unknown. This BID
will be updated as more information becomes available.

This vulnerability affects BitchX cvs versions prior to 05/09/2003.

16. EType EServ Resource Exhaustion Denial Of Service Vulnerability
BugTraq ID: 7552
Remote: Yes
Date Published: May 11 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7552
Summary:

EServ is a proxy software package distributed by EType. It is available
for Microsoft Windows operating systems.

A denial of service vulnerability has been reported for EServ. The
vulnerability exists due to the way the server handles connections.
Specifically, when EServ receives a connection, the server allocates a
specific block of heap memory. Reportedly, when a connection is
disconnected, the allocated memory is not adequately freed.

This vulnerability exists due to a delayed response time, upwards of up to
two minutes, when de-allocating memory from closed connections.

An attacker can exploit this vulnerability by making numerous connections
to the vulnerable server. For every connection, a small amount of memory
is not properly freed from heap memory. Many connections to the vulnerable
server will eventually result in a consumption of all available memory
resources which may cause the system to become unstable.

This vulnerability affects EServ 2.92 to 2.99.

17. Apple AirPort Administrative Password Encryption Weakness
BugTraq ID: 7554
Remote: Yes
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7554
Summary:

The Apple Airport device is a wireless access point which implements the
802.11b wireless protocol. It is possible to administer the Airport device
remotely by using a custom administration protocol. This protocol
functions using plaintext however, sensitive authentication credentials
are obfuscated before transmission.

A weakness has been discovered in the encoding mechanism used to obfuscate
administrative user credentials. Specifically, the administrator password
is XOR encoded against a 32-bit key.

An attacker capable of intercepting authentication-based network traffic
may trivially deduce the key. As a result, an unauthorized remote user may
gain administrative access to a target device.

18. IU BLog Comment Form HTML Code Injection Vulnerability
BugTraq ID: 7553
Remote: Yes
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7553
Summary:

A problem with IU BLog could allow remote users to execute arbitrary code
in the context of the web site hosting IU BLog. The problem occurs due to
the lack of sanitization performed on encoded character representations of
HTML tags.

Specifically, IU BLog fails to filter encoded HTML code, for example
'&lt;' and '&gt;'. As a result, a malicious user may have the ability to
submit arbitrary HTML code in the 'Name', 'Email Address', 'URL' or
'Comments' fields of the IU BLog comment form. This code would be executed
by a user's browser in the context of the vulnerable site.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. Other attacks are also possible.

19. Pi3Web Malformed GET Request Denial Of Service Vulnerability
BugTraq ID: 7555
Remote: Yes
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7555
Summary:

Pi3Web is a free, multi platform, configurable HTTP server and development
environment.

It has been reported that Pi3Web server is prone to a denial of service
vulnerability. Reportedly when a malicious GET request containing 354 '/'
characters is sent to the Pi3Web server the server will fail. It should be
noted that the Unix version has been reported vulnerable, it is not
currently known if other platforms are affected.

Although unconfirmed, due to the nature of this vulnerability, it may be
possible for an attacker to exploit this issue to corrupt sensitive Pi3Web
memory. If this is possible, an attacker may have the ability to supply
and execute arbitrary code.

Precise technical details regarding this vulnerability are not currently
known. This BID will be updated as further details are disclosed.

20. Cerberus FTP Server Plaintext User Password Weakness
BugTraq ID: 7556
Remote: No
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7556
Summary:

Cerberus is an FTP Server for Microsoft Windows operating systems.

Cerberus FTP Server stores authentication credentials for the FTP service
on the local system in plaintext. These credentials are stored in the
'users.pro' file in the program directory. Local users with access to
this file may gain unauthorized access to the server as a result.

Exposure of authentication credentials may also lead to compromise of
other services/resources if the same credentials are commonly used.

21. Happymall E-Commerce Software Normal_HTML.CGI Cross-Site Scripting Vulnerability
BugTraq ID: 7557
Remote: Yes
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7557
Summary:

HappyMall E-Commerce software is an E-Commerce software package available
from HappyCGI.com.

A vulnerability has been reported for Happymall E-Commerce. Due to
insufficient sanitization of user-supplied URI parameters, Happymall
E-Commerce may be prone to cross-site scripting attacks. Specifically, the
normal_html.cgi script fails to sanitize the 'file' variable of embedded
script code.

As a result, a remote attacker may be capable of constructing a malicious
link designed to execute arbitrary script code within the browser of a
legitimate user who follows it. This may allow for the theft of
cookie-based authentication credentials which could aid in session
hijacking. Other attacks may also be possible.

It should be noted that this issue has been reported to affect HappyMall
E-Commerce 4.3 and 4.4 however, earlier versions may also be affected.

22. PHPNuke Web_Links Module Remote SQL Injection Vulnerability
BugTraq ID: 7558
Remote: Yes
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7558
Summary:

PHPNuke is a freely available, open source content management system
written in PHP. It is available for Unix, Linux, and Microsoft Operating
Systems.

It has been reported that multiple input validation bugs exist in the
Web_Links module used by PHPNuke.

The problem is in the sanitizing of data passed to construct database
queries. Insufficient sanity checks are performed by the Web_Links
module, making it possible to inject SQL code into the database behind
PHPNuke. This issue could be exploited to gain access to potentially
sensitive information contained in the database with the privileges of the
web application. Compromise of the web forums may also be possible.
Consequences could vary depending on the the queries involved and the
capabilities of the underlying database implementation.

These issues could be especially dangerous for databases that support the
UNION function, allowing for execution of multiple queries. It should
also be noted that an additional 20 instances of SQL injection
vulnerabilities exist in this module.

23. Happymall E-Commerce Software Normal_HTML.CGI File Disclosure Vulnerability
BugTraq ID: 7559
Remote: Yes
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7559
Summary:

HappyMall E-Commerce software is an E-Commerce software package available
from HappyCGI.com.

A vulnerability has been reported for Happymall E-Commerce. Due to
insufficient sanitization of user-supplied URI parameters, Happymall
E-Commerce may be prone to a file disclosure vulnerability. Specifically,
the normal_html.cgi script fails to sanitize directory traversal (../)
sequences from the 'file' variable.

As a result, a remote attacker may be capable of viewing the contents of a
sensitive system file. This may allow the attacker to access information
that may aid in launching further attacks against the target system.

It should be noted that this issue has been reported to affect HappyMall
E-Commerce 4.3 and 4.4 however, earlier versions may also be affected.

24. Movable Type Comment Form HTML Code Injection Vulnerability
BugTraq ID: 7560
Remote: Yes
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7560
Summary:

Movable Type is a web-based publishing system designed to ease maintenance
of regularly updated web-sites for example news or weblogs.

A problem with the Movable Type Comment Form could allow remote users to
execute arbitrary code in the context of the web site hosting Movable
Type. The problem occurs due to the lack of sanitization performed on
encoded character representations of HTML tags.

Specifically, Movable Type fails to filter encoded HTML characters, for
example '&lt;' and '&gt;'. As a result, a malicious user may have the
ability to submit arbitrary HTML code in the 'Name', 'Email Address',
'URL' or 'Comments' fields of the Movable Type comment form. This code
would be executed by a user's browser in the context of the vulnerable
site.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. Other attacks are also possible.

It should be noted that all Movable Type versions prior to version 2.6
have been confirmed vulnerable. The vendor has reported that this
vulnerability has been addressed in versions higher than 2.6.

25. Yahoo! Voice Chat ActiveX Control Unspecified Vulnerability
BugTraq ID: 7561
Remote: Unknown
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7561
Summary:

Users of Yahoo! Groups may participate in voice chat sessions by
downloading the Yahoo! Audio Conferencing ActiveX control.

An unspecified vulnerability has been reported in the Yahoo! Audio
Conferencing ActiveX control. This control should be removed from systems
until a fix is available from Yahoo!.

Though unconfirmed, exploitation of this vulnerability by remote attackers
may result in the compromise of affected hosts.

This is a preliminary alert. This record will be updated when further
details become available.

26. Clearswift MailSweeper PowerPoint File Denial of Service Vulnerability
BugTraq ID: 7562
Remote: Yes
Date Published: May 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7562
Summary:

ClearSwift MAILsweeper is an SMTP gateway e-mail filtering product. It
allows filtering based on email content, source, destination and
attachments.

A vulnerability has been discovered in Clearswift MAILsweeper. By
including malformed or corrupt embedded objects within a PowerPoint file,
it is possible to trigger a denial of service in MAILsweeper. When
encountered, the file will trigger a condition which will cause the
process to enter an infinite loop. This will effectively result in the
consumption of available system resources and an inevitable denial of
service.

It should be noted that the precise details regarding the attributes of
the malicious embedded objects are currently unknown.

The affected system may need to be reboot to restore previous
functionality.

This vulnerability affects all MAILsweeper versions prior to 4.3.7.

27. BEA Systems WebLogic Multiple Password Storage Vulnerabilities
BugTraq ID: 7563
Remote: No
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7563
Summary:

WebLogic is an enterprise application server distributed by BEA Systems.

Problems with the software could make unauthorized access to user
credentials possible.

It has been reported that problems exist in the storage of passwords in
BEA Systems WebLogic. This could lead to users gaining unauthorized
access to passwords, and potentially unauthorized access to the WebLogic
server.

Three issues exist:

The JDBCConnectionPoolRuntimeMBean password is displayed in clear-text via
weblogic.Admin. This could allow a passerby to observe the password on
the screen of a user logged in with administrative privileges in a
"shoulder-surfing" attack scenario.

The default CredentialMapper stores passwords on the disk in clear-text.
A local user with access sufficient to read the binary files used by the
CredentialMapper could extract the passwords from the files.

Default implementations of WebLogic Server and WebLogic Express make
details about the encryption of passwords available to unprivileged users.
A user with access to the encrypted passwords, with knowledge of the
encryption algorithms used, and access to the config.xml,
filerealm.properties, and weblogic-rar.xml could gain access to the
plain-text passwords.

28. Netscape Navigator False URL Information Vulnerability
BugTraq ID: 7564
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7564
Summary:

Netscape is a web browser that is available for a number of platforms,
including Microsoft Windows and Unix and Linux variants.

An issue has been reported for Netscape Navigator that may result in a
false sense of security for a user.

Due to the way Netscape handles the history.back() function, the URL
displayed on the 'location bar' will not correspond to the actual URL of
the site displayed in the browser window. As a result, a malicious
attacker can exploit this issue to entice a user to visit a web site and
make them believe they are at known or trusted page.

This vulnerability was reported for Netscape Navigator 7.02 for Windows
operating systems.

29. CDRTools CDRecord Devname Format String Vulnerability
BugTraq ID: 7565
Remote: No
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7565
Summary:

CDRecord is a component of the CDRTools package. CDRecord is a CD-Burning
application developed for UNIX and Win32 platforms.

CDRecord has been reported prone to format string vulnerability. The issue
presents itself due to a programming error that occurs when calling a
printf-like function. Specifically, insufficient format specifiers are
supplied when calling the js_sprintf() function in the 'scsiopen.c' source
file.

It has been reported that by harnessing an unsupported feature of the
CDRecord utility, an attacker may supply format string specifiers as a
'dev' argument passed to the vulnerable utility.

When the device name is processed the malicious format string specifiers
may be interpreted. As a result, by supplying specifiers designed to write
to memory it may be possible for sensitive locations in memory to be
corrupted. This may ultimately result in the execution of
attacker-supplied code in the context of the CDRecord utility.

It should be noted that reports indicate CDRecord as being installed
setUID root on several distributions.

It should be noted that although this vulnerability has been reported to
affect CDRecord version 2.0 previous versions might also be affected.

30. IP Messenger For Win Filename Buffer Overflow Vulnerability
BugTraq ID: 7566
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7566
Summary:

IP Messenger is multi-platform pop up message communication software.

IP Messenger For Win has been reported prone to Buffer overflow
Vulnerability.

Reportedly the issue presents itself due to a lack of sufficient bounds
checking performed on the filename of a file supplied through IP
Messenger. As a result, it may be possible for a remote user to corrupt
sensitive memory within IP Messenger.

If data greater than the assigned size for the buffer is supplied as a
filename, excessive data will overrun the bounds of the internal buffer
and corrupt adjacent memory. Because adjacent memory may contain values
that are crucial to programs execution flow, an attacker may seize control
of the program. Ultimately the attacker may execute arbitrary operation
codes. Code execution would occur in the context of the user running the
vulnerable IP Messenger application.

31. PHP-Nuke Modules.PHP Username URI Parameter Cross Site Scripting Vulnerability
BugTraq ID: 7570
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7570
Summary:

PHP-Nuke is a freely available, open source content management system
written in PHP. It is available for Unix, Linux, and Microsoft Operating
Systems.

A cross site scripting vulnerability has been reported for PHP-Nuke.
Specifically, PHP-Nuke does not sufficiently sanitize user-supplied input
for the 'username' URI parameter to the modules.php script.

As a result of this deficiency, it is possible for a remote attacker to
create a malicious link containing script code that will be executed in
the browser of a legitimate user. Specifically the attacker can pass
malicious HTML code as a value for the 'username' URI parameter supplied
to the 'modules.php' page. All code will be executed within the context of
the website running PHP-Nuke.

This may allow for theft of cookie-based authentication credentials and
other attacks.

This vulnerability was reported to affect PHP-Nuke version 6.5.

32. Clearswift MailSweeper Attachment Filename Validation Vulnerability
BugTraq ID: 7568
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7568
Summary:

MailSweeper is an e-mail security product. It is designed to be deployed
on gateway systems and provides the ability to filter content based on
configured policy.

A vulnerability has been reported in how MailSweeper handles filenames for
attachments. MailSweeper does not sufficiently validate certain types of
malformed filenames.

It may be possible to bypass MailSweeper security with attachment
filenames that contain excessive trailing/leading whitespace, or uses
multiple extensions.

It is possible that some attachments with malicious filenames or content
may slip through MailSweeper. Knowledge of this problem could allow an
attacker to bypass filtering of the software to send unauthorized
attachment types into or out of the target network. This may also lead to
a violation of local security policy.

33. AIX Sendmail Open Relay Default Configuration Weakness
BugTraq ID: 7580
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7580
Summary:

Sendmail is a freely available, open source mail transport agent. It is
available for various UNIX and Linux operating systems.

A problem with the default sendmail implementation on AIX systems may lead
to violations in security policy.

It has been reported that the default sendmail configuration on AIX
systems enables promiscuous e-mail relaying options. Because of this, a
remote attacker may be able to use the e-mail server to obscure the
origins of e-mail.

The problem is in the default sendmail.cf deployed with AIX. The
sendmail.cf enables options that can allow anonymous remote users to relay
e-mail through AIX systems. This could be used for spam, e-mail attacks,
or other nefarious purposes.

34. Phorum Post.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 7573
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7573
Summary:

Phorum is a PHP based web forums package.

A cross-site scripting vulnerability has been reported for Phorum.
Specifically, Phorum does not sufficiently sanitize user-supplied input
for some URI parameters to the post.php script.

As a result of this deficiency, it is possible for a remote attacker to
create a malicious link containing script code that will be executed in
the browser of a legitimate user. Specifically the attacker can pass
malicious HTML code as a value for affected URI parameters supplied to the
'post.php' page. All code will be executed within the context of the
website running Phorum.

This may allow for theft of cookie-based authentication credentials and
other attacks.

This vulnerability was reported to affect Phorum prior to 3.4.3.

This vulnerability may be closely related to the issue described in BID
7545.

35. Phorum UserAdmin Arbitrary Command Execution Vulnerability
BugTraq ID: 7578
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7578
Summary:

Phorum is a PHP based web forums package.

Phorum 'UserAdmin' page has been reported prone to remote arbitrary
command execution vulnerability.

The issue presents itself due to a lack of sufficient sanitization
performed on user-supplied data submitted via the Phorum 'UserAdmin' page.

An attacker may submit arbitrary commands that will be executed in the
context of the web server hosting the vulnerable Phorum.

Exploitation of this vulnerability may be dependent on configuration and
may differ across systems.

The precise technical details regarding this vulnerability are not
currently known and this BID will be updated as further details become
apparent.

36. Phorum Multiple Path Disclosure Vulnerabilities
BugTraq ID: 7571
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7571
Summary:

Phorum is a PHP based web forums package.

Phorum is prone to multiple disclosure vulnerabilities.

When certain scripts are called incorrectly, Phorum will return the path to the webroot in the error message it generates. The affected scripts are:
smileys.php
quick_listrss.php
purge.php
news.php
memberlist.php
forum_listrss.php
forum_list_rdf.php
forum_list.php
move.php

This information could be useful to an attacker when mapping out the
filesystem for further attacks against the host.

37. Phorum Common.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 7576
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7576
Summary:

Phorum is a PHP based web forums package.

The 'common.php' script used by Phorum is prone to a cross-site scripting
issue.

Due to insufficient sanitization of user-supplied CGI parameters, embedded
script code may be included in one or more input parameters.

As a result, a remote attacker may be capable of constructing a malicious
link designed to execute arbitrary script code within the browser of a web
user who follows it. This may allow for the theft of cookie-based
authentication credentials which could aid in session hijacking. Other
attacks may also be possible.

38. Phorum Edit User Profile Arbitrary Command Execution Vulnerability
BugTraq ID: 7574
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7574
Summary:

Phorum is a PHP based web forums package.

Phorum 'Edit user profile' page has been reported prone to remote
arbitrary command execution vulnerability.

The issue presents itself due to a lack of sufficient sanitization
performed on user-supplied data submitted via the Phorum 'Edit user
profile' page.

An attacker may submit arbitrary commands that will be executed in the
context of the web server hosting the vulnerable Phorum.

Exploitation of this vulnerability may be dependent on configuration and
may differ across systems.

It should be noted that although unconfirmed exploitation of this issue
might be configuration dependant.

The precise technical details regarding this vulnerability are not
currently known and this BID will be updated as further details become
apparent.

39. Phorum Stats Program Arbitrary Command Execution Vulnerability
BugTraq ID: 7579
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7579
Summary:

Phorum is a PHP based web forums package.

Phorum Phorum Stats program has been reported prone to remote arbitrary
command execution vulnerability.

The issue presents itself due to a lack of sufficient sanitization
performed on user-supplied data submitted to the Phorum Stats program.

An attacker may submit arbitrary commands that will be executed in the
context of the web server hosting the vulnerable Phorum.

Exploitation of this vulnerability may be dependent on configuration and
may differ across systems.

It should be noted that although unconfirmed exploitation of this issue
might be configuration dependant.

The precise technical details regarding this vulnerability are not
currently known and this BID will be updated as further details become
apparent.

40. Phorum Download File Disclosure Vulnerability
BugTraq ID: 7569
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7569
Summary:

Phorum is a PHP based web forums package.

Phorum is prone to directory traversal attacks. The issue exists in the
'download.php' script, which allows users to download files.
Exploitation of this vulnerability could result in disclosure of sensitive
files which are readable by the web server. This problem is due to
insufficient sanitization of directory traversal sequences from
user-supplied input.

Files disclosed as a result of successful exploitation could potentially
contain sensitive information which would be useful in mounting further
attacks against the system hosting the web forum software.

41. Phorum Register.PHP Connection Proxying Vulnerability
BugTraq ID: 7581
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7581
Summary:

Phorum is a PHP based web forums package.

The Phorum 'register.php' script has been reported prone to a connection
proxying attack vulnerability.

It has been reported that an attacker may harness the vulnerable
'register.php' script to anonymously launch attacks on other sites in the
context of the website hosting the vulnerable Phorum. This may be used by
an attacker to make malicious activity appear to be coming from the target
site.

It should be noted that although unconfirmed exploitation of this issue
might be configuration dependant.

42. Phorum login.PHP Cross Site Scripting Vulnerability
BugTraq ID: 7577
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7577
Summary:

Phorum is a PHP based web forums package.

A cross site scripting vulnerability has been discovered in Phorum 3.4.3.
The problem occurs due to insufficient sanitization of user-supplied URI
parameters to the login.php script. This may allow for malicious HMTL or
script code to be embedded within variables used by the script.

As a result, it may be possible to execute arbitrary script code within
the browser of a target user who follows a maliciously constructed link.
This may allow for the theft of cookie-based authentication credentials or
other sensitive information. Other attacks against a user may also be
possible.

43. Phorum Register.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 7572
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7572
Summary:

Phorum is a PHP based web forums package.

Phorum is prone to cross-site scripting attacks. This issue exists in the
'register.php' script and is due to insufficient sanitization of HTML and
script code from user-supplied variables, such as CGI parameters. The
attacker may be required to create a malicious link to a Phorum site and
then entice web users to visit the link.

Successful exploitation could permit a malicious attacker to cause the
execution of hostile HTML and script code in the web client of a user who
visits a vulnerable site hosting Phorum. This would occur in the security
context of the site.

Exploitation could allow for attacks that steal cookie-based
authentication credentials. Other attacks will also be possible.

44. Phorum Register.PHP Existing User HTML Injection Vulnerability
BugTraq ID: 7584
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7584
Summary:

Phorum is a PHP based web forums package.

Phorum is prone to HTML injection attacks. This issue exists in the
'register.php' script and is due to insufficient sanitization of HTML and
script code from user-supplied variables. HTML and script code may be
echoed back when an existing user is specified from the registration page.
It is possible that code injected through this issue could be displayed
and rendered by other forum users.

Exploitation could allow for attacks that steal cookie-based
authentication credentials. Other attacks are also possible.

45. Poptop PPTP BCRELAY sprintf() Buffer Overflow Vulnerability
BugTraq ID: 7582
Remote: No
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7582
Summary:

PoPToP is a PPTP server available for a variety of operating systems.

A buffer overflow vulnerability has been discovered in PoPToP PPTP. The
problem occurs due to insufficient bounds checking before calling
sprintf() to copy the contents of 'dp->d_name' into an internal memory
buffer. The vulnerable call is made within the 'launch_bcrelay()' function
in the 'pptpctrl.c' source file.

By passing excessive data to Poptop it may be possible for a local
attacker to overwrite sensitive locations in memory. Successful
exploitation of this vulnerability may allow an attacker to execute
arbitrary code with the privileges of the affected server, potentially
root.

It should be noted that this issue may only present itself when the
BCRELAY option has been enabled. This option is not enabled by default.

46. Phorum Login.PHP Connection Proxying Vulnerability
BugTraq ID: 7583
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7583
Summary:

Phorum is a PHP based web forums package.

The Phorum 'login.php' script has been reported prone to a connecting
proxying vulnerability.

It has been reported that an attacker may harness the vulnerable
'login.php' script to anonymously launch attacks on other hosts in the
context of the website hosting the vulnerable Phorum. This may be used by
an attacker to make malicious activity appear to be coming from the target
site.

It should be noted that although unconfirmed exploitation of this issue
might be configuration dependant.

47. Intel Itanium 2 Processor Denial of Service Vulnerability
BugTraq ID: 7585
Remote: No
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7585
Summary:

A vulnerability has been discovered in the Intel Itanium 2 processor. The
problem occurs when a specially construct procedure is encountered. When
the operation is carried out, the processor may become unstable and cease
to function.

The details regarding the specific operations which will trigger this
condition are currently unknown. However, if an attacker were somehow
capable of executing these instructions on a target user's system, it may
be possible to trigger the condition.

A reboot may be required to return to typical functionality, although it
is not currently known whether this crash will permantely affect the
processor.

It should be noted that this BID will be updated as further information is
made available.

48. PHP-Nuke Web_Links Module Path Disclosure Vulnerability
BugTraq ID: 7589
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7589
Summary:

PHP-Nuke is a popular web based Portal system. It allows users to create
accounts and contribute content to the site.

The Web_Links module for PHP-Nuke has been reported prone to a
vulnerability which, when exploited, may disclose sensitive path
information to a remote attacker.

Reportedly an attacker may make a malicious request for the Web_Links
module passing specific URI parameters to trigger the condition. Although
unconfirmed, it is likely that the request will cause an error to occur,
causing PHP-Nuke to display an error message containing the path to the
module.

An attacker may use the information gathered in this manner to mount
further attacks against the host.

It should be noted that although PHP-Nuke version 6.x has been reported
vulnerable, other versions might also be affected.

49. PHP-Nuke Multiple Downloads Module SQL Injection Vulnerabilities
BugTraq ID: 7588
Remote: Yes
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7588
Summary:

PHP-Nuke is a web-based portal system. Implemented in PHP, it is available
for a range of systems, including Unix, Linux, and Microsoft Windows.

PHP-Nuke is reportedly prone to multiple SQL injection vulnerabilities in
the Downloads. User-supplied input is included in SQL queries made by the
module without being sanitized.

Exploitation could allow for injection of malicious SQL syntax, resulting
in modification of SQL query logic or other attacks. Consequences will
vary depending on the specific queries and the capabilities of the
underlying database implementation. At the very minimum it may be
possible to gain access to sensitive information that is stored in the
database.

50. BEA Systems WebLogic Encryption Information Disclosure Weakness
BugTraq ID: 7587
Remote: No
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7587
Summary:

WebLogic is an enterprise application server distributed by BEA Systems.

WebLogic Server and WebLogic Express are prone to a weakness that could
potentially disclose sensitive information to unauthorized parties.

Default implementations of WebLogic Server and WebLogic Express make
details about the encryption of passwords available to unprivileged users.
Though unconfirmed, this could include details about the encryption keys
used. A user with access to with knowledge of the encryption algorithms
used, and access to encrypted passwords in the 'config.xml',
'filerealm.properties', and 'weblogic-rar.xml' files could theoretically
gain access to the plain-text passwords.

This issue was originally described in BID 7563 and is now being assigned
its own BID.

51. BEA Systems WebLogic CredentialMapper Plaintext Password Vulnerability
BugTraq ID: 7586
Remote: No
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7586
Summary:

WebLogic is an enterprise application server distributed by BEA Systems. A
problem with the CredentialMapper software could make unauthorized access
to user credentials possible.

It has been reported that a problem exists in the method used in the
storage of passwords by BEA Systems WebLogic CredentialMapper. This could
lead to users gaining unauthorized access to passwords, and potentially
unauthorized access to the WebLogic server.

Specifically CredentialMapper stores passwords on the disk using
plain-text format by default. A local user with access sufficient to read
the binary files used by the CredentialMapper may extract the passwords
from the files.

Information gathered in this way may be used to aid in further attacks
launched against the vulnerable system.

This issue was originally described in BID 7563 and is now being assigned
its own BID.

52. Poptop PPTP BCRELAY fscanf() Buffer Overflow Vulnerability
BugTraq ID: 7590
Remote: Yes
Date Published: May 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7590
Summary:

PoPToP is a PPTP server available for a variety of operating systems.

A vulnerability has been discovered in PoPToP PPTP which may be exploited
by a local attacker to execute arbitrary code with elevated privileges.

The launch_bcrelay() function, located in the pptpctrl.c source file,
attempts to open a process file from within the /var/run directory. Data
is later copied from the file into a 64 byte memory buffer (pid_string).
It has been discovered that launch_bcrelay() fails to carry out sufficient
bounds checking before calling the fscanf() function to copy the file data
into pid_string. As a result, if excessive data were situated within the
file the pid_string buffer would be overrun.

An attacker could exploit this vulnerability by creating a malicious
poptop process file within the /var/run directory. The file must contain
65 or more bytes of data, including a payload containing embedded machine
instructions and replacement addresses.

Successful exploitation of this issue would result in the execution of
arbitrary instructions with the privileges of PoPToP, possibly root.

It should be noted that this issue may only present itself when the
BCRELAY option has been enabled. This option is not enabled by default.

53. BEA WebLogic JDBCConnectionPoolRuntimeMBean On-Screen Password Disclosure Vulnerability
BugTraq ID: 7591
Remote: No
Date Published: May 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7591
Summary:

WebLogic is an enterprise application server distributed by BEA Systems.

A problem with the software could make unauthorized access to sensitive
information possible.

It has been reported that under some circumstances, the password of
privileged users may be displayed in plain text on the screen of a user
logged in to the administrative interface. An unauthorized user may be
able to gain the opportunity to view this password.

The problem is in JDBCConnectionPoolRuntimeMBean. The
JDBCConnectionPoolRuntimeMBean password is displayed in clear-text via
weblogic.Admin. This could result in a "shoulder-surfing" attack.

54. 3Com OfficeConnect ADSL Router DHCP Response Information Disclosure Vulnerability
BugTraq ID: 7592
Remote: Yes
Date Published: May 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7592
Summary:

OfficeConnect ADSL routers are hardware and switch solutions distributed
by 3Com.

A problem with the OfficeConnect routers may make it possible for
attackers to view potentially sensitive information. The vulnerability
exists due to a flaw in the way memory is initialized when responding to
certain requests. Specifically, when DHCP requests are initiated by
clients, the router fails to properly initialize memory buffers which may
result in the leakage of potentially sensitive information.

An attacker can exploit this vulnerability by making a DHCP request to a
vulnerable router. This will result in the router answering the DHCP query
without first properly initializing memory buffers. Successful
exploitation may result in the attacker being able to view the contents of
previous HTTP requests to the device.

This vulnerability was reported to affect 3Com OfficeConnect DSL Router
812 with firmware 1.1.7. Additional reports indicate that the 1.1.9
firmware is also affected.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. Matrix Sequel Has Hacker Cred
By Kevin Poulsen

A port scanner and an SSH vulnerability turn up in the dystopian future of
the Matrix Reloaded. Now we know how Trinity hacked the IRS dbase.

http://www.securityfocus.com/news/4831

2. Security research exemption to DMCA considered
By Kevin Poulsen

Officials will hear a proposal from the scientific community Wednesday
that would exempt bug hunters from the federal anti-circumvention law.

http://www.securityfocus.com/news/4729

3. Feds To Refocus on Cybersecurity
By Brian Krebs, Washington Post

The Department of Homeland Security soon will establish an office to
execute the Bush administration's cybersecurity strategy, a move that may
serve to blunt criticism that the agency has not devoted enough resources
and attention to Internet security.

http://www.securityfocus.com/news/4809

4. MS 'slush' fund provides big discounts to stop Linux - email
By John Lettice, The Register

Microsoft's head of worldwide sales last summer circulated a 'stop Linux
at any price' email to sales execs and senior company executives,
including Steve Ballmer, Jim Allchin and Jeff Raikes. According to the
International Herald Tribune, which has seen the email, Orlando Ayala was
aiming to block Linux's progress in government. "Under NO circumstances
lose against Linux," he said, saying that in cases where the deal involved
governments or large institutions there was a special fund available which
could be used to offer large discounts, or even to give Microsoft software
away.

http://www.securityfocus.com/news/4807

IV. SECURITY FOCUS TOP 6 TOOLS
------------------------------
1. NoTrax v1.3
by Heidi Computers Ltd
Relevant URL:
http://www.heidi.ie/notrax/
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

Are You Concerned?

- that browsing the Internet has left traces of sites you've visited, all
over your hard drive i.e. in the Registry, Cache etc.
- that a website you are browsing may install Spyware or Viruses on your
PC?
- that your Credit Card details are being tracked by your browser while
purchasing online?
- that eliminator-type programs have not really cleaned your Registry
properly?
- that your laptop is lost or stolen with all the sensitive information
still stored in the history and cache of your browser?
- that unauthorised personnel may take a look at your PC, while you were
not around? Or that Hackers are probing your PC?
- that a company or individual is interested in tracking your online
habits for marketing or other more dangerous purposes?
- NoTrax PREVENTS this.

2. WifiScanner v0.9.0
by Jerome Poggi [email protected]
Relevant URL:
http://wifiscanner.sourceforge.net/
Platforms: Linux, POSIX
Summary:

WifiScanner is an analyzer and detector of 802.11b stations and access
points. It can listen alternatively on all the 14 channels, write packet
information in real time, can search access points and associated client
stations, and can generate a graphic of the architecture using GraphViz.
All network traffic can be saved in the libpcap format for post analysis.
It works under Linux with a PrismII card and with the linux-wlan driver.

3. Ginsu Chat Client v0.4.7
by John Meacham
Relevant URL:
http://repetae.net/john/computer/ginsu/
Platforms: POSIX
Summary:

Ginsu is a client for the Gale chat system. It is designed to be powerful
and above all stable, as well as having a quick learning curve.

4. phpBandwidth Monitor v1.5
by Eric Binger
Relevant URL:
http://www.phpBandwidth.com
Platforms: Linux
Summary:

phpBandwidth monitors a particular network interface (eth0, eth1, ppp0,
etc.) and provides a realtime graph showing bandwidth consumption on a
server.

5. Very Simple Network Monitor v2.0.0
by Jan Uyttersprot [email protected]
Relevant URL:
http://www.probam.be/nmonitor/
Platforms: Linux, POSIX
Summary:

Very Simple Network Monitor is a bash shell script CGI that monitors a
number of services on a network. It currently checks for node-up, TCP
service up, and UDP service up. A service or system can be put in
maintenance status to avoid repetitive alarms. It is easy to customize,
trigger alarms by email, or whatever you like (depends on nmap for TCP/UDP
service checks). Installation is also simple. It generates HTML with all
statuses, and for all services just in one view.

6. MyNetWeather v0.3
by Tim Geiges [email protected]
Relevant URL:
http://www.watchmefreak.com
Platforms: Os Independent
Summary:

MyNetWeather is a tool to plot ping and packet loss. It will also graph
signal to noise, and downstream and upstream levels of cable modems (For
MSOs). It uses GNUPlot for JPEG graphs.

V. SECURITY JOBS SUMMARY
------------------------
1. Seasoned Security Expert Available (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321646

2. Cheif Security Officer (Paris, France) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321622

3. Bay Area Sales Representive (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321618

4. Malicious Code Security Analyst, Mechanicsburg, PA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321601

5. Application Penetration Tester Wanted (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321600

6. Director of Quality Assurance (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321599

7. Internet Security Architect contract position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321490

8. Unix Security Analyst - Bloomington, IL (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321489

9. .Net Security Analyst - Bloomington, IL (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321488

10. Network security Auditor - Israel (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321331

11. Security Sales (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321314

12. Looking for a White Hat Hacker to perform a vulnerability test on an E-Commerce Website!!! (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321316

13. Security Manager - Germany (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321296

14. Cisco IDS Engineer- Guardent / Providence RI (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321215

15. SAP Security Consultant, Midlands, UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321214

16. Information Security Manager, Benelux (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321183

17. Seeking Network Security position (will relocate) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321190

18. FL CISSP Seeking a Position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321187

19. Neoteris is hiring!!! - Regional Sales Managers - Japan/Korea (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321119

20. Neoteris is hiring!!! - Sales Engineers - Japan/Korea (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321121

21. Neoteris is hiring!!! - Sales Engineers - Germany/France/Sweden/H olland (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321120

22. Neoteris is hiring!!! - Sales Engineer - Ohio Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321118

23. Neoteris is hiring!!! - Regional Sales Managers - Germany/France/ Holland/Sweden (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321116

24. Neoteris is hiring!!! - Federal Regional Sales Manager - VA/DC/MD (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321117

25. Technical Lead (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321115

26. Deloitte & Touche Network Security Opportunities (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321113

27. Deloitte & Touche: Application Security Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321114

28. Deloitte and Touche: Identity Management Specialists Needed (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321043

29. Network Security Analyst, Mechanicsburg, PA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321042

30. Security Engineer needed in Chicago, IL (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321010

31. Global CERT Coordinator - NY - $150k-$200k - Job #781 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321009

32. Network Security Engineer needed in Jacksonville (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/321008

VI. INCIDENTS LIST SUMMARY
--------------------------
1. BIND Crash (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321678

2. tcp/1274 scans (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321677

3. New intrusion script? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321676

4. Trojan modifying ntdll.dll and cmd.exe (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321666

5. UDP/137 scans -- new worm? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321660

6. re: DNS poisoning to Korean address (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321658

7. tcp/554 scans (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321661

8. Stopping information leakage (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321567

9. More Info: DNS poisoning to Korean address (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321564

10. Folllow-up to the Hotmail/MSN password reset problems (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321565

11. Source 126.0.0.1 UDP/137 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321560

12. New SecurityFocus Article: U.S. Information Security Law, Part 3 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321419

13. IIS/WebDav Exploit List (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321416

14. Attack attempts from 195.86.128.45 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321362

15. smsx.exe? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321225

16. A lot of whisker attempts? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/321055

17. SecurityFocus Article Announcement: Starting from Scratch: Formatting and Reinstalling after a Security Incident (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/320955

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. MSIE integer overflows (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321711

2. vulndev-1 and a suggestion about the ensuing discussion (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321665

3. vulndev1.c solution (warning SPOILER) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321656

4. Administrivia: Challenge Guidelines (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321615

5. Administrivia: List Announcement (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321607

6. FW: partial analysis of vulndev-1.c (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321484

7. partial analysis of vulndev-1.c (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321479

8. vulndev-1 exploit. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321469

9. another vulndev-1.c solution (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321460

10. Buffer overflow in Microsoft ftp.exe (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321454

11. IIS/WebDav Exploit List (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321397

12. vulndev-1.c challenge (was Administrivia: List Announcement) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321365

13. Buffer overflow in Explorer.exe (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/321210

14. TOP 75 Security Tools Translated (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320996

15. Domain Name Forging On Authentication Prompt (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/320992

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Article Announcement: Security Tools: From Mermaids to Suckling Pigs (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/321655

2. Article Announcement: U.S. Information Security Law, Part 3 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/321459

3. Harden ASP.NET Configuration (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/321353

4. Share Point? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/321276

5. SecurityFocus Microsoft Newsletter #136 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/321196

6. Timbuktu, etc. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/321050

7. (prevent + detect Arp spoofing) + Securing Terminal Services (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320976

8. IPSEC through Ms ISA Server (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/320975

IX. SUN FOCUS LIST SUMMARY
----------------------------
1. NO NEW POSTS FOR THE WEEK ENDING 05.16.03

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. AW: IPChains Question (compatibility mode on kernel 2.4.x) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/321455

2. IPChains Question (compatibility mode on kernel 2.4.x) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/321453

3. how to check current backlog queue size(against synflood) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/321212

XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored By: Spidynamics

ALERT! "Outsmart Web Application Hackers"-FREE Product Trial

Test your Web Applications for over 4000 vulnerabilities! FREE Security
Test via our 15 Day Product Trial that delivers a comprehensive
vulnerability report. Secure your critical assets today!

Visit us at: http://www.spidynamics.com/mktg/freewebinspect54
-------------------------------------------------------------------------------