SecurityFocus Newsletter #199

John Boletta <[email protected]> Mon, 2 Jun 2003 12:59:10 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #199
-----------------------------

This Issue is Sponsored by: Interland

"For a limited time get 15% OFF Netscreen Firewalls and an additional 15%
OFF any Managed Dedicated Hosting Solution from Interland. Knowledgeable
24/7/365 Technical Support. Call 1-877-504-0091 for more details on how to
protect your dedicated server."

Visit us at: http://www.securityfocus.com/Interland-sf-news
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. **Announcing the new SecurityFocus Pen-Test and Firewalls Focus Areas**
2. Malware Myths and Misinformation Part 2
3. A Special Needs Class
4. Untrustworthy Passport
II. BUGTRAQ SUMMARY
1. TextPortal Undocumented Username / Password Weakness
2. IISProtect Web Administration Interface SQL Injection...
3. UML_NET Integer Mismanagement Code Execution Vulnerability
4. BLNews Remote File Include Vulnerability
5. Ultimate PHP Board admin_iplog.PHP Arbitrary PHP Execution...
6. Encrypted Virtual Filesystem Local Heap Overrun Vulnerability
7. AnalogX Proxy URI Buffer Overflow Vulnerability
8. FastTrack P2P Supernode Packet Handler Buffer Overflow...
9. D-Link DI-704P Syslog.HTM Denial Of Service Vulnerability
10. Ifenslave Argument Local Buffer Overflow Vulnerability
11. Multiple Vignette Cross-Site Scripting Vulnerabilities
12. Vignette Unauthorized Legacy Tool Access Vulnerability
13. Vignette Memory Disclosure Vulnerability
14. Vignette SSI Injection Vulnerability
15. Vignette Style Template Information Leakage Vulnerability
16. Vignette Login Template User Information Leakage Vulnerability
17. Vignette License Template Denial Of Service Vulnerability
18. BRS WebWeaver POST and HEAD Denial Of Service Vulnerability
19. PalmVNC Insecure Password Storage Vulnerability
20. P-News Administrative Account Creation Vulnerability
21. Vignette VALID_PATHS Command TCL Code Injection Vulnerability
22. Vignette NEEDS Command TCL Code Injection Vulnerability
23. Batalla Naval Remote Buffer Overflow Vulnerability
24. Remote PC Access Denial Of Service Vulnerability
25. Privatefirewall FIN/XMas Scan Traffic Handling Vulnerability
26. BNC IRC Proxy Multiple Session Denial of Service Vulnerability
27. PostNuke Phoenix Glossary Module SQL Injection Vulnerability
28. PostNuke Phoenix Main Modules Multiple Path Disclosure...
29. PostNuke Phoenix Rating System Denial Of Service Vulnerability
30. iPlanet Messaging Server HTML Attachment Cross Site Scripting...
31. Newsscript Administrative Privilege Elevation Vulnerability
32. Upclient Command Line Argument Buffer Overflow Vulnerability
33. ST FTP Service Information Disclosure Vulnerability
34. Microsoft Internet Explorer Malformed JavaScript Denial of...
35. Meteor FTP Server Username Information Disclosure Vulnerability
36. Eterm PATH_ENV Buffer Overflow Vulnerability
37. Sun One Application Server Request Logging Circumvention Weakness
38. Sun ONE Application Server Source Disclosure Vulnerability
39. Sun ONE Application Server Error Message Cross-Site Scripting...
40. Sun ONE Application Server Plaintext Password Vulnerability
41. Multiple HP Tru64 Unspecified CDE Privilege Escalation...
42. Red Hat Linux up2date Unspecified Vulnerability
43. Softrex Tornado WWW-Server File Disclosure Vulnerability
44. Softrex Tornado WWW-Server Buffer Overflow Vulnerability
45. Super-M Son hServer File Disclosure Vulnerability
46. Multiple Vendor FTP Server File Disclosure Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. California Supremes Hear DeCSS Case
2. Report: Too Much Cyber Security at CIA
3. Palm signs Wi-Fi security, access, VoIP deals
4. US cyber crime losses tumble
IV. SECURITYFOCUS TOP 6 TOOLS
1. Access Control Designer vbeta1
2. IPA v1.3.4
3. BCWipe v1.2-3
4. Log Tool v1.3.0
5. SSHTerm v0.1.4 beta
6. SSHVnc v0.1.0
V. SECURITYJOBS LIST SUMMARY
1. Kansas City - Application Security Engineer (Thread)
2. Research and Development Engineer location (Thread)
3. Senior Business Development Manager, UK (Thread)
4. Research and Development Team Lead - (Thread)
5. CISSP Information Security Engineer seeking position in...
6. Need security consultants in Boston (Thread)
7. Security Project Manager (Thread)
8. Security Engineer position in Knoxville, TN (Thread)
9. Looking for information security position (Thread)
10. SAP Security Consultant, Midlands, UK (Thread)
11. Information Security Manager, Benelux (Thread)
12. Research and Development Engineer (Thread)
13. Information Security Architect - Fairfield County, CT (Thread)
14. Need Security Evangelist in Chicago (Thread)
15. Seeking Tivoli Access Manager Consultant (NJ) (Thread)
16. Senior Security Manager -Cleveland, Ohio (Thread)
17. Neoteris is hiring!!! - Sales Engineer - Southern California...
18. Information Security Dr available (Thread)
19. Neoteris is hiring!!! - Technical Support Engineers...
20. CISSP Security consultant seeking position in NYC (Thread)
21. Etiquette for recruiters (Thread)
22. Good article on job hunting in this environ. (Thread)
23. Seeking security consulting position in NYC (Thread)
24. Immediate opening for a Tivoli Access Manager Securit...
25. Sales Engineer / San Francisco (Thread)
26. Cleared, Navy looking for work in San Diego, CA (Thread)
27. North East Coast Sr. Security Engineering Position Available...
28. Administrivia (Thread)
29. Business Development Director EMEA - based in UK (Thread)
30. Field Engineer (DC and SF) (Thread)
31. Senior Security Manager - Cleveland, Ohio (Thread)
32. Neoteris is hiring!!! - Senior Technical Trainer - Silico...
33. Neoteris is hiring!!! - Product Marketing Manager - Silicon...
34. Neoteris is hiring!!! - Technical Marketing Engineer - Silicon...
35. Neoteris is hiring!!! - Manager, Business Development...
36. Neoteris is hiring!!! - Inside Sales Rep - East Region (Thread)
37. Neoteris is hiring!!! - Federal Sales Rep - VA/MD/DC (Thread)
VI. INCIDENTS LIST SUMMARY
1. Weird Traffic from www.eyeblaster-bs.com (Thread)
2. Whois updates, Was: [ Possible Intrusion Attempt?] (Thread)
3. strange cmd.exe access (Thread)
4. A question for the list... (Thread)
5. DDoS Attack (Thread)
6. Possible Intrusion Attempt? (Thread)
7. Are they back? (was Scans from proxyprotector.com) (Thread)
8. New Paper on Passive OS Fingerprinting (Thread)
9. Scans from proxyprotector.com (Thread)
10. [ANNOUNCE] protocol watcher (Thread)
11. is this new ... (Thread)
12. Stukach Trojaned SysReg.exe (Thread)
13. cisco 7200 performance issue (Thread)
14. ICMP/SYN Flood (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Re[2]: mirc32 6.0x crash when resolving dns. (Thread)
2. mirc32 6.0x crash when resolving dns. (Thread)
3. Abo3 (can someone help me?) (Thread)
4. [Vuln-dev Challenge] Challenge #2 (Thread)
5. N00b questions :\ (Thread)
6. [Vuln-dev Challenge] Challenge #2 (return-to-libc) (Thread)
7. Mac OS X shellcode and SIGTRAP (Thread)
8. [Vuln-dev Challenge] example exploit for 2 (Thread)
9. [Vuln-dev Challenge]: Symlink Attack (Thread)
10. Frame Pointer Overwriting (Thread)
11. [Vuln-dev Challenge] Challenge #2 (SPOILER) (Thread)
12. [Vuln-dev Challenge] nonexec stack&heap solution (encrypted)...
13. Is this exploitable? (Thread)
14. CORRECTION: vulndev1.c solution (WARNING! QUESTIONS!) (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Article Announcement: Malware Myths and Misinformation Part 2...
2. Article Announcement: Conducting a Security Audit: An...
3. SecurityFocus Microsoft Newsletter #138 (Thread)
4. Re[2]: Windows 2003 Server - MS Rulez? (Thread)
5. Windows 2003 Server - MS Rulez? (Thread)
IX. SUN FOCUS LIST SUMMARY
1. NO NEW POSTS FOR THE WEEK ENDING 05.30.03
X. LINUX FOCUS LIST SUMMARY
1. process accounting (Thread)
2. more on linux hardening (fwd) (Thread)
3. more on linux hardening (Thread)
4. hardening scripts (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. ** Announcing the new SecurityFocus Pen-Test and Firewalls Focus Areas **

In response to the ever evolving needs of the security community,
SecurityFocus is very pleased to announce the release of two new focus
areas effective June 2, 2003: Pen-Test
<http://www.securityfocus.com/pen-test> and Firewalls
<http://www.securityfocus.com/firewalls>

2. Malware Myths and Misinformation Part 2
By David Harley May 28, 2003

This article is the second of a three-part series looking at some of the
myths and misconceptions that undermine anti-virus protection.

http://www.securityfocus.com/infocus/1698

3. A Special Needs Class
By George Smith

The University of Calgary's new course in virus-writing begs the question:
is it a cheap publicity stunt or just boneheaded educating?

http://www.securityfocus.com/columnists/164

4. Untrustworthy Passport
by Yen-Ming Chen ([email protected])

On May 7, 2003, yet another vulnerability[1,2,3] was found on Microsoft's
Passport service, a single sign-on service for multiple Web sites
including Microsoft's own Hotmail and Expedia.com. The vulnerability
allows an attacker to gain control of any passport user's account by
resetting her password simply by accessing a server response file (SRF)
interface. Microsoft disabled the vulnerable feature in a few hours after
the information went public. Some sources [4] claim federal regulators can
fine Microsoft up to 22 trillion dollars, although that will be unlikely.
Either way, the damage to Passport and Microsoft's perception of
trustworthy computing has been done. In this article, we take a deeper
look at the vulnerability from the perspective of a software development
life cycle, its impact and how to monitor and fix such problem. We will
also examine how the bug could have slipped through the cracks standard
penetration testing methodologies and provide recommendations to harden
the methodology.

http://www.securityfocus.com/guest/20225

II. BUGTRAQ SUMMARY
-------------------
1. TextPortal Undocumented Username / Password Weakness
BugTraq ID: 7673
Remote: Yes
Date Published: May 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7673
Summary:

TextPortal is a web-based content management system implemented in PHP. It
is available for a variety of platforms including Microsoft Windows and
Linux and Unix variant operating environments.

A weakness has been reported for TextPortal that may allow an attacker to
obtain unauthorized access. The issue exists due to a weak, undocumented
password used for the default administrative user 'god2'.

TextPortal encrypts passwords using crypt and stores them in the
'db_ures\admin_pass.php' file. Specifically, the user 'god2' has a default
undocumented password of '12345'.

Access to the 'god2' account could grant unauthorized administrative
access to remote attackers.

Administrative privileges gained on target systems may allow attackers to
corrupt configuration settings. Other attacks are also possible.

2. IISProtect Web Administration Interface SQL Injection Vulnerability
BugTraq ID: 7675
Remote: Yes
Date Published: May 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7675
Summary:

iisProtect is a security product for Microsoft Windows that provides
authentication based access control to protect web resources.

The IISProtect web administration interface is prone to an SQL injection
vulnerability.

The interface fails to properly sanitize user-supplied input before
including it in SQL queries. This could allow remote users to pass
malicious SQL input to database queries, resulting in modification of
query logic and other attacks.

Successful exploitation could result in a compromise of site integrity,
disclosure or modification of data, or potential exploitation of
vulnerabilities in the underlying database implementation. This could
also be exploited to call stored procedures such as 'xp_cmdshell', to
execute operating system commands.

It is not clear if the IISProtect web administration interface is enabled
by default.

3. UML_NET Integer Mismanagement Code Execution Vulnerability
BugTraq ID: 7676
Remote: No
Date Published: May 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7676
Summary:

uml_utilities is a collection of packages designed to be used in
conjunction with the User Mode Linux (UML) kernel patch. The uml_net
program can be used by an administrator to configure various network
devices and system networking parameters.

A vulnerability has been discovered in uml_net. The problem lies in the
uml_net.c source file and occurs while handling user-supplied version
information.

The 'v' variable is declared as a signed integer, however it is used to
store an unsigned integer value returned by a call to the 'strtoul()'
function. This will result in 'v' being interpreted as a negative value.
As 'v' is later used in various bounds checking calculations, specifically
'if (v > CURRENT_VERSION)', it is possible to trigger an unexpected
calculation and bypass the check.

If all necessary calculation checks are passed, an attacker may be capable
of indexing into a malformed location within an array of function
pointers. Specifically, the 'v' variable is used as an index into the
(*handlers[])() array. When this occurs the negative value stored in 'v'
will allow the attacker to reference a supplied address lower in process
memory.

Successful exploitation of this vulnerability would allow an attacker to
execute arbitrary commands with the privileges of uml_net, possibly root.
It has been confirmed that uml_net is installed suid root on at least one
Linux distribution.

4. BLNews Remote File Include Vulnerability
BugTraq ID: 7677
Remote: Yes
Date Published: May 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7677
Summary:

BLNews is a web-based news application written in PHP. BLNews supports the
use of themes.

A vulnerability has been reported for BLNews 2.1.3-beta. The problem
occurs due to the 'objects.inc.php4' script failing to include the
'server.inc.php4' file. As a result, it is possible for a remote attacker
making a request to BLNews to control the 'Server' variable. This may
allow for the inclusion of attacker-supplied PHP header files,
specifically 'tools.inc.php4' and 'cmd.php4'.

Successful exploitation of this vulnerability would allow an attacker to
upload a malicious PHP file to BLNews. This could result in the execution
of arbitrary PHP code with the privileges of the web server.

It should be noted that, although this vulnerability is said to affect
BLNews 2.1.3-beta, previous versions may also affected.

5. Ultimate PHP Board admin_iplog.PHP Arbitrary PHP Execution Vulnerability
BugTraq ID: 7678
Remote: Yes
Date Published: May 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7678
Summary:

Ultimate PHP Board (UPB) is a freely available, open source PHP Bulletin
Board. It is available for the Unix and Linux operating systems.

UPB stores information about each connected user in the 'db' file, stored
in the 'iplog' directory. Information logged includes the users IP address
as well as the HTTP user agent information. An administrator is capable of
viewing this information by calling the 'admin_iplog.php' script.

A vulnerability has been reported for UPB 1.9. The problem is said to
occur due to insufficient sanitization of the HTTP 'User-Agent'
information before including it within the 'admin_iplog.php' script. As a
result, an attacker may be capable of embedding malicious PHP commands
within this field, which would in turn be interpreted by the web server.

The execution of these commands would only occur when an administrator
chooses to view the log of forum activity via the 'admin_iplog.php'
script. All commands executed would be run with the privileges of the web
server, typically httpd.

It should be noted that although unconfirmed this may also affect UPB
versions prior to 1.9.

6. Encrypted Virtual Filesystem Local Heap Overrun Vulnerability
BugTraq ID: 7679
Remote: No
Date Published: May 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7679
Summary:

Encrypted Virtual Filesystem (EVFS) is a virtual filesystem that runs on
top of the Linux VFS. It allows multiple users to each mount their own
encrypted filesystems using individual keys. It is available for the Linux
operating system.

A vulnerability has been discovered in the 'efs' utility used by EVFS. The
problem occurs during the 'do_mount()' function within the efs.c source
file. During a call to salloc(), the size calculation fails to take the
size of the 'to' argument into account. Data greater then that allocated
may subsequently be written into the buffer. As a result, it may be
possible for an attacker to corrupt sensitive memory management
information.

Successful exploitation of this vulnerability could allow a legitimate
EVFS user to execute arbitrary commands with root privileges.

This vulnerability affects EVFS v0.2, however earlier versions may also be
affected.

7. AnalogX Proxy URI Buffer Overflow Vulnerability
BugTraq ID: 7681
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7681
Summary:

AnalogX Proxy is proxy server software for Microsoft Windows operating
systems.

AnalogX Proxy is prone to a buffer overflow due to insufficient bounds
checking of client-supplied URIs. It is possible to trigger this
condition by submitting a URI that is greater than 340 characters.
Exploitation could allow an attacker to corrupt sensitive regions of
memory with attacker-supplied values, which could result in execution of
arbitrary code in the context of the AnalogX server.

This is similar to this issue described in BID 5139.

8. FastTrack P2P Supernode Packet Handler Buffer Overflow Vulnerability
BugTraq ID: 7680
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7680
Summary:

KaZaA, Grokster and Morpheus are file-sharing clients based on FastTrack
P2P technologies. They will run on Microsoft Windows 9x/ME/NT/2000/XP
systems. Ports also exist for variants of the Linux operating system.

FastTrack P2P Supernode Packet Handler has been reported prone to a buffer
overflow vulnerability. The issue presents itself in the FastTrack
Supernode packet handler. The handler does not perform sufficient bounds
checking on Supernode entries received before they are copied into a
reserved buffer in internal memory.

Specifically, when Supernode data extracted from certain FastTrack P2P
network packets is passed to the affected FastTrack class and later copied
into internal memory, excessive Supernode data (>200 entries) may overrun
the boundary of the assigned buffer and corrupt adjacent memory. Memory
adjacent to this buffer has been reported to contain values that are
crucial to controlling memory management or program execution flow.
Therefore it may be possible for a remote attacker to trigger a denial of
service condition or ultimately seize control of the vulnerable
application and have arbitrary attacker supplied code executed. Code
execution would occur in the context of the user running an application
that incorporates the vulnerable FastTrack P2P Packet Handler.

It should be noted that this vulnerability has been tested on KaZaA
version 2.0.2. Other versions of KaZaA and similar file-sharing clients
based on FastTrack P2P technology may also be affected.

9. D-Link DI-704P Syslog.HTM Denial Of Service Vulnerability
BugTraq ID: 7686
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7686
Summary:

The D-Link DI-704P is an Internet Broadband Gateway device. The DI-704P
provides a method to share a single broadband Internet connection and
share a single printer among systems connected to the local network.

D-Link DI-704P has been reported prone to a remote denial of service
vulnerability.

The issue presents itself in the 'Syslog.htm' page, a part of the router's
web management interface. It has been reported that when excessive is data
passed URI parameter in a request for the vulnerable page, the router
firmware the device behaves in an unstable manner. Although unconfirmed
this may be due to an attempted name resolution of the malicious data.
Subsequent malicious requests may result in corruption of device logs or
in a complete denial of service condition requiring a device reboot.

Although unconfirmed, it should be noted that other D-Link devices that
use related firmware might also be affected.

10. Ifenslave Argument Local Buffer Overflow Vulnerability
BugTraq ID: 7682
Remote: No
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7682
Summary:

ifenslave is a tool designed to attach and detach slave network interfaces
to a bonding device. The bonding device will act like an Ethernet network
device to the Linux kernel, but will send out packets using the bound
slave devices using a scheduler.

ifenslave for Linux has been reported prone to a buffer overflow
vulnerability.

The issue is reportedly due to a lack of sufficient bounds checking
performed on user-supplied data before it is copied into an internal
memory space.

Specifically, excessive data passed as the first command line argument to
the vulnerable ifenslave executable, when copied into internal memory, may
overrun the boundary of the assigned buffer and corrupt adjacent memory.
Memory adjacent to this buffer has been confirmed to contain values that
are crucial to controlling program execution flow. It is therefore
possible for a local attacker to seize control of the vulnerable
application and have malicious arbitrary code executed in the context of
ifenslave. ifenslave is not installed setUID or setGID by default.

It should be noted that although this vulnerability has been reported to
affect ifenslave version 0.07 previous versions might also be affected.

11. Multiple Vignette Cross-Site Scripting Vulnerabilities
BugTraq ID: 7687
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7687
Summary:

Vignette distributes several products that include content management and
application portal software.

Vignette software has been reported prone to multiple cross-site scripting
vulnerabilities.

Reportedly the issue presents itself, because the Vignette software does
not sufficiently sanitize HTML characters (",&,<,>) from user-supplied
data. As a direct result of this, all vignette applications that do not
implement an explicit filters to sanitize user-supplied variables and
later generates dynamic content based on the supplied data, are
potentially affected.

An attacker may exploit these vulnerabilities by enticing a victim user to
follow a malicious link that contains malicious HTML code.
Attacker-supplied HTML and script code may be executed on a web client in
the context of the site hosting the affected Vignette software.

This may allow for theft of cookie-based authentication credentials and
other attacks.

This issue was reported for Vignette StoryServer version 4 to version 6;
it has been speculated that all current versions are vulnerable.

12. Vignette Unauthorized Legacy Tool Access Vulnerability
BugTraq ID: 7683
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7683
Summary:

Vignette distributes several products that include content management and
application portal software.

Vignette does not sufficiently restrict access to the Legacy Tool
application. This tool is accessible via the /vgn/legacy/edit template,
which requires authentication. However, it is also possible to access the
functions of the tool via the /vgn/legacy/save template, which does not
have the same level of access control. Cookie values are not sufficiently
checked when a remote user attempts to access the /vgn/legacy/save
template. A remote attacker may gain access to this template by
submitting a falsified cookie.

Unauthorized remote users may use the /vgn/legacy/save template to execute
database queries. This includes the ability to execute a SELECT query on
any tables which are accessible by the Vignette database user. This could
expose sensitive information to remote attackers.

13. Vignette Memory Disclosure Vulnerability
BugTraq ID: 7684
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7684
Summary:

Vignette distributes several products that include content management and
application portal software.

Vignette is prone to an issue which may expose the contents of memory to
remote attackers. This condition is due to a flaw in how Vignette
calculates the size of certain characters in URI variables. This
condition may occur when a request contains "-->". This will cause the
software to miscalculate the size of the request and random parts of
adjacent memory will be included in the response. This could result in
disclosure of sensitive information contained in memory and may also aid
in exploitation of other vulnerabilities.

This issue was reported for Vignette on IBM AIX. Other platforms may also
be affected, though this has not been confirmed. The issue affects some
of the default templates provided with Vignette.

This issue is similar to the vulnerability described in BID 7296.

14. Vignette SSI Injection Vulnerability
BugTraq ID: 7685
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7685
Summary:

Vignette distributes several products that include content management and
application portal software.

Under some circumstances, Vignette applications may be prone to injection
of Server-Side Includes (SSI). It may be possible to inject SSI through
URI variables and other input fields. This could allow remote attackers
to execute arbitrary commands with the privileges of Vignette. It is
believed that some of the default Vignette applications are prone to this
issue.

Exploitation is possible only if the SSI EXEC feature is enabled. This
issue could also affected third-party applications that are developed for
use with Vignette.

15. Vignette Style Template Information Leakage Vulnerability
BugTraq ID: 7688
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7688
Summary:

Vignette distributes several products that include content management and
application portal software.

A problem with Vignette software may make it possible to gain potentially
sensitive information.

It has been reported that some Vignette products install several
templates, including the style template, in the /vgn directory. Because
of this, it may be possible for a remote attacker to gain access to
potentially sensitive information.

The problem is in the style template. This template is by default
installed as /vgn/style on an affected system. When this template is
accessed by a remote user, the server leaks information that may include
variable names, paths, and other installation information. This could be
exploited to provide an attacker with information necessary in launching a
more organized attack against systems.

This problem has been reported to affect Vignette StoryServer and Vignette
V/5, though other products may also be affected.

16. Vignette Login Template User Information Leakage Vulnerability
BugTraq ID: 7691
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7691
Summary:

Vignette distributes several products that include content management and
application portal software.

A problem with Vignette software may make it possible to gain potentially
sensitive information.

It has been reported that some Vignette products install several
templates, including the login template, in the /vgn directory. Because
of this, it may be possible for a remote attacker to gain access to
potentially sensitive information.

The problem is in the login template. This template is by default
installed as /vgn/login on an affected system. When this template is
accessed by a remote user, the server leaks information when user names
are entered. Differing responses are given for existing users,
non-existing users, and disabled users. This could be exploited to
provide an attacker information necessary in launching a more organized
attack against systems.

This problem has been reported to affect Vignette StoryServer and Vignette
V/5, though other products may also be affected.

17. Vignette License Template Denial Of Service Vulnerability
BugTraq ID: 7694
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7694
Summary:

Vignette distributes several products that include content management and
application portal software.

A problem with Vignette software may make it possible to deny service to
web content.

It has been reported that some Vignette products install several
templates, including the license template, in the /vgn directory.
Because of this, it may be possible for a remote attacker to deny service
to a system using the software to manage web content.

The problem is in the license template. This template is by default
installed as /vgn/license on an affected system. When this template is
accessed by a remote user, the template allows the remote user to view and
alter license information. By altering the license data to invalid
values, the software could be made to not function. This could be
exploited by an attacker to prevent legitimate users from access content
on a site.

18. BRS WebWeaver POST and HEAD Denial Of Service Vulnerability
BugTraq ID: 7695
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7695
Summary:

BRS WebWeaver is an FTP and web server from Blaine Southam.

A vulnerability has been reported for WebWeaver that may result in a
denial of service condition.

When a POST or HEAD request is received containing 32700 characters or
more, WebWeaver will return an "Unable to insert string" error message and
fail. This issue is likely due to a boundary condition error, but this
has not been confirmed. It is not known if the condition is exploitable
to execute arbitrary code.

This vulnerability was reported for WebWeaver 1.04. Earlier versions may
also be vulnerable.

19. PalmVNC Insecure Password Storage Vulnerability
BugTraq ID: 7696
Remote: No
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7696
Summary:

PalmVNC is a VNC implementation for PalmOS. It can be used to establish
VNC sessions with Windows or Unix/Linux systems.

PalmVNC stores password credentials in plaintext. By default, the
database file (PalmVNCDB) that contains VNC passwords has the backup bit
set. As a result, these credentials may be stored on a desktop system
when the Palm is "Hotsynced". This could expose credentials to other
users of the system that the backup is stored on.

This issue was reported in PalmVNC 1.40. Other versions are also likely
affected.

20. P-News Administrative Account Creation Vulnerability
BugTraq ID: 7689
Remote: Yes
Date Published: May 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7689
Summary:

P-News is a web-based news management system. It is implemented in PHP
and available for Unix/Linux variants and Microsoft Windows operating
systems.

A vulnerability has been reported that could enable a P-News member to
create and access an administrative account. The flaw exists in the
'p-news.php' script. It is possible to inject malicious data into the
'Name' account editing input field. Exploitation could allow a member to
compromise P-News.

This issue was reported in P-News 1.16. Other versions may also be
affected.

21. Vignette VALID_PATHS Command TCL Code Injection Vulnerability
BugTraq ID: 7692
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7692
Summary:

Vignette distributes several products that include content management and
application portal software.

Under some circumstances Vignette applications that harness the Vignette
API, specifically the 'VALID_PATHS' command, may be prone to injection of
arbitrary TCL code. The issue presents itself due to a lack of sufficient
sanitization performed on a user-supplied variable parsed by the
'VALID_PATHS' command. This variable, HTTP_REFERER may be influenced by an
attacker to ultimately inject arbitrary TCL code.

This could allow remote attackers to execute arbitrary commands with the
privileges of the affected server. It has been reported that several of
the default Vignette applications are prone to this issue.

This issue could also affect third-party applications that are developed
for use with Vignette.

This issue was reported for Vignette StoryServer version 5 and version 6.
However it has been speculated that all current versions may be
vulnerable.

22. Vignette NEEDS Command TCL Code Injection Vulnerability
BugTraq ID: 7690
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7690
Summary:

Vignette distributes several products that include content management and
application portal software.

Under some circumstances Vignette applications that harness the Vignette
API, specifically a 'NEEDS' command that follows a certain code path, may
be prone to injection of arbitrary TCL code. The issue presents itself due
to a lack of sufficient sanitization performed on user-supplied variables
parsed by the 'NEEDS' command. These variables, HTTP_QUERY_STRING and
HTTP_COOKIE, may be influenced by an attacker to ultimately inject
arbitrary TCL code.

This issue could also affect third-party applications that are developed
for use with Vignette.

This issue was reported for Vignette StoryServer version 5 and version 6.
However it has been speculated that all current versions may be
vulnerable.

Conflicting reports suggest that while SHOW HTTP_COOKIE and
HTTP_QUERY_STRING may be vulnerable to cross-site scripting attacks, only
the SET HTTP_COOKIE and HTTP_QUERY_STRING are vulnerable to TCL code
injection attacks.

23. Batalla Naval Remote Buffer Overflow Vulnerability
BugTraq ID: 7699
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7699
Summary:

Batalla Naval is graphical naval battle game that can be played over a
network. It is available for Unix/Linux variants and Microsoft Windows
operating systems.

Batalla Naval is prone to a remotely exploitable buffer overflow when
handling requests of excessive length. In particular, sending a string to
the game server (gbnserver) that is 500 or more bytes in length may cause
stack memory to be corrupted. This could allow for execution of malicious
instructions in the context of the game server.

The game server listens on port 1995 by default.

24. Remote PC Access Denial Of Service Vulnerability
BugTraq ID: 7698
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7698
Summary:

Remote PC Access is a remote administration tool designed for Microsoft
Windows platforms.

Remote PC Access has been reported to be prone to a denial of service
vulnerability.

The issue, although unconfirmed is likely due to a lack of bounds checking
performed by the Remote PC Access server on network communications
received from the client. Specifically an attacker may craft an
authorization packet and transmit it to the vulnerable server, after the
initial authorization process has been completed the server will send data
to the client. The attacker may copy the information received and
re-transmit it back to the server. This has the invariable effect of
causing the vulnerable PC Access server to behave in an unstable manner
eventually leading to a fatal exception.

Although unconfirmed, due to the nature of this vulnerability, it may be
possible for a remote attacker to supply and execute arbitrary code.

It should be noted that although this vulnerability has been reported to
affect Remote PC Access version 2.2, previous versions might also be
affected.

25. Privatefirewall FIN/XMas Scan Traffic Handling Vulnerability
BugTraq ID: 7700
Remote: Yes
Date Published: May 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7700
Summary:

Privatefirewall is a security software package distributed and maintained
by Privacyware. It is available for the Microsoft Windows platform.

A problem with Privatefirewall may make it possible to bypass firewall
policies.

It has been reported that Privatefirewall does not properly handle TCP
traffic with certain flag settings. This may allow an attacker to
circumvent firewall filtering.

The problem is in the parsing of traffic with FIN and Xmas tree flag
settings. Privatefirewall does not correctly handle traffic with these
specific flags set. These types of flags may be set during either port
scanning, or other potentially malicious network activity such as back
door communication.

It has been reported that Privatefirewall does not properly filter these
types of traffic when the "Filter Internet Traffic" and "Deny Internet
Traffic" configuration variables in Privatefirewall are selected. An
attacker could circumvent both traffic policies.

26. BNC IRC Proxy Multiple Session Denial of Service Vulnerability
BugTraq ID: 7701
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7701
Summary:

BNC IRC Proxy is an open source IRC proxying server that allows a system
without direct Internet access to relay through the BNC server.

It has been reported that the BNC IRC Proxy is prone to a denial of
service vulnerability.

This vulnerability appears to occur when two legitimate users of the
service connect from the same IP address. If the second connected user
disconnects before the first connected user, the service reportedly fails
when the first user disconnects.

Precise technical details of this vulnerability are not currently known.
This record will be updated when further details become available.

This vulnerability was reported to affect BNC IRC Proxy version 2.6.2 and
prior.

27. PostNuke Phoenix Glossary Module SQL Injection Vulnerability
BugTraq ID: 7697
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7697
Summary:

A vulnerability has been discovered in PostNuke Phoenix v0723 and earlier.
Specifically, the Glossary module fails to sufficiently sanitize
user-supplied input, making it prone to SQL injection attacks.

Exploitation may allow for modification of SQL queries, resulting in
information disclosure, or database corruption. The consequences depend on
the nature of specific queries. This issue may allow the attacker to
exploit latent vulnerabilities in the underlying database.

28. PostNuke Phoenix Main Modules Multiple Path Disclosure Vulnerabilities
BugTraq ID: 7693
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7693
Summary:

PostNuke is a web-based content management system. It is implemented in
PHP and available for Unix/Linux variants and Microsoft Windows platforms.

Path disclosure vulnerabilities have been reported in modules which are
included with PostNuke Phoenix. Affected modules include Downloads,
Web_Links, Sections, FAQ, Search, Reviews and Glossary. The nature of
these issues is poor handling of data supplied via URI parameters, causing
error pages to be generated that contain the path to the installation root
directory and other resources.

Exploitation of these issues may allow an attacker to gather sensitive
information.

Some of these issues may be previously reported or exist in other content
management systems such as PHP-Nuke or PHPBB, due to shared code.

29. PostNuke Phoenix Rating System Denial Of Service Vulnerability
BugTraq ID: 7702
Remote: Yes
Date Published: May 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7702
Summary:

PostNuke is a web-based content management system. It is implemented in
PHP and available for Unix/Linux variants and Microsoft Windows platforms.

A problem in the software may make it possible to prevent access to sites
by legitimate users.

It has been reported that the PostNuke rating system does not properly
handle some submissions to the rating system. Because of this, a remote
attacker may be able to submit a string that causes a denial of service to
legitimate users.

The problem is in the handling of rating strings of excessive length. By
submitting a maliciously crafted string, it is possible to cause the
software to become unstable and potentially crash. It has been reported
this can affect both the web server and database server under the PostNuke
installation, though it's not entirely clear how.

30. iPlanet Messaging Server HTML Attachment Cross Site Scripting Vulnerability
BugTraq ID: 7704
Remote: Yes
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7704
Summary:

iPlanet Messaging Server is a webmail product maintained by Sun
Microsystems. It supports a variety of protocols including SMTP, IMAP, and
POP3. Various security mechanisms are also supported, such as access
control lists.

It has been reported that iPlanet Messaging Server may be prone to
cross-site scripting attacks.

The problem is said to occur while processing HTML attachments received
via e-mail. An option exists within iPlanet Messaging Server which allows
a user to open an attachment 'online'. If used, this option will interpret
the attachment within the context of the webmail domain.

Successful exploitation of this vulnerability could allow an attacker to
steal a legitimate users iPlanet Messaging Server session ID information.
Access to this information may aid in launching further attacks, such as
session hijacking. Other attacks may also be possible.

31. Newsscript Administrative Privilege Elevation Vulnerability
BugTraq ID: 7705
Remote: Yes
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7705
Summary:

Newsscript is a web-based news management system. It is written in PHP
and available for Unix/Linux variants and Microsoft Windows operating
systems.

A vulnerability was reported in Newsscript that may permit an unauthorized
member to increase their privilege level. The issue exists in the profile
editing function of the 'write.php' script. This is due to insufficient
validation of data supplied to account editing input fields of Newsscript.
In particular, it is possible to include user database delimiters (<~>)
when editing user profile properties. This could be used to add arbitrary
data to a user record, including modification of the user's privilege
level.

32. Upclient Command Line Argument Buffer Overflow Vulnerability
BugTraq ID: 7703
Remote: No
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7703
Summary:

upclient is a multi-platform utility that is designed to extract and
publish system uptime statistics.

upclient has been reported prone to a buffer overflow vulnerability when
handling command line arguments of excessive length. Specifically when the
vulnerable upclient handles a '-p' command line argument of greater than
1022 bytes, the bounds of an internal buffer in memory is overrun and
memory adjacent to the buffer is corrupted with attacker-supplied data.

Memory adjacent to this buffer has been reported to contain values that
are crucial to controlling program execution flow. It is therefore
possible for a local attacker to seize control of the vulnerable
application and have malicious arbitrary code executed in the context of
upclient. It has been reported that upclient is installed on FreeBSD
systems as setuid kmem.

An attacker may harness elevated privileges obtained in this way to
manipulate arbitrary areas in system memory through /dev/mem or /dev/kmem
devices.

33. ST FTP Service Information Disclosure Vulnerability
BugTraq ID: 7674
Remote: Yes
Date Published: May 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7674
Summary:

A vulnerability has been reported in ST FTP Service. Allegedly, ST FTP
Service fails to enforce a document root before sharing files. As a
result, a remote attacker may be capable of accessing arbitrary system
files with the privileges of the ST FTP process.

Access to arbitrary system files may aid an attacker in launching further
attacks against the target server and its users.

It should be noted that this vulnerability may be due to a configuration
error within the server. However this possibility has not been confirmed.

34. Microsoft Internet Explorer Malformed JavaScript Denial of Service Vulnerability
BugTraq ID: 7706
Remote: Yes
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7706
Summary:

An issue has been reported in Microsoft Internet Explorer. It is possible
for a malicious web page using JavaScript to crash the browser process.

When certain malformed or incomplete JavaScript statements are handled by
the JavaScript interpreter, Internet Explorer will fail. This may be due
to use of irregular statements with the quoteText() function, though this
is unconfirmed.

With Internet Explorer 6, this condition will result in only the browser
used to parse the JavaScript failing.

Precise technical details of this vulnerability are not currently known.
This record will be updated when new information becomes available.

35. Meteor FTP Server Username Information Disclosure Vulnerability
BugTraq ID: 7707
Remote: Yes
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7707
Summary:

Meteor FTP Server is an FTP Server for Microsoft Windows operating
systems.

It has been reported that Meteor FTP Server is prone to an information
disclosure weakness.

The problem exists in the way the FTP server handles the authentication
procedure. Specifically the FTP server returns a '530 Not logged on' error
message to the console, if the username supplied is invalid, before
disconnecting the user. An attacker may exploit this weakness to enumerate
valid usernames.

It should be noted that although this weakness was reported to affect
Meteor FTP server version 1.5, previous versions might also be affected.

36. Eterm PATH_ENV Buffer Overflow Vulnerability
BugTraq ID: 7708
Remote: No
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7708
Summary:

Eterm is terminal emulation software which is available for Unix and Linux
variants.

Eterm has been reported prone to a local buffer overflow vulnerability.
Code execution with elevated privileges has been confirmed possible.

The issue presents itself in the conf_parse_theme() function, and is due
to a lack of sufficient bounds checking performed on an environment
variable that is copied into an internal memory buffer. The buffer is
located in static memory space. This issue is further exaggerated because
adjacent memory contains 'rs-pixmap' char pointer data, this may be
manipulated by the attacker to point anywhere in system memory.

The function post_parse(), is later invoked. This function calls free() on
the location pointed to by rs_pixmaps. Since the attacker may have
corrupted 'rs-pixmap' data to point to a malicious crafted fake malloc
chunk on the heap, when malloc() is called arbitrary memory of the
attackers choice may be corrupted.

It has been reported that Eterm fails after it frees the malicious chunk,
an internal Eterm function dump_stack_trace(), intercepts SIGSEGV in the
process and performs a small memory dump before launching gdb,
dump_stack_trace() later generates a SIGALRM. It has been demonstrated,
however, that the delivery of this signal may be prevented and arbitrary
shell code executed with elevated privileges. Code execution will occur in
the context of the vulnerable Eterm, which may have setuid/setgid utmp or
possibly root on some Unix/Linux distributions.

37. Sun One Application Server Request Logging Circumvention Weakness
BugTraq ID: 7711
Remote: Yes
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7711
Summary:

Sun ONE Application Server is the application server solution distributed
and maintained by Sun Microsystems. It is available for the Unix, Linux,
and Microsoft platforms.

A problem with the software may make it possible to circumvent logging.

It has been reported that Sun ONE Application Server may not properly log
requests under some circumstances. Because of this, an attacker may be
able to obscure attacks from the view of administrators.

The problem is in the handling of extremely long requests. Sun ONE
Application Server is capable of serving requests with lengths of up to
4096 bytes. However, the logging facility truncates requests at the
length of 4042 bytes. An attacker could potentially embed a malicious
request in the 54 unlogged bytes, obscuring the specifics of the attack
from administrator view.

It has been reported that this problem affects Sun ONE Application Server
on Microsoft Windows platforms. Versions prior to 7.0 may also be
affected, but this has not been confirmed.

38. Sun ONE Application Server Source Disclosure Vulnerability
BugTraq ID: 7709
Remote: Yes
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7709
Summary:

Sun ONE Application Server is the application server solution distributed
and maintained by Sun Microsystems. It is available for the Unix, Linux,
and Microsoft platforms.

Sun ONE Application Server is prone to a source code disclosure
vulnerability. This issue is due to handling of case in requests for
resources. By changing the case of a file extension, the server may fail
to interpret the script and instead serve it as a normal web resource.
For example, if a JSP page is requested with the '.jsp' extension, it will
be interpreted. However, if the same resource is requested using with an
extension of '.JSP', it will not be interpreted by the server.

Script source code may contain sensitive information, such as database
authentication credentials, which will be disclosed to a remote attacker
if this issue is exploited.

This issue exists for Sun ONE Application Server on Microsoft Windows
platforms. Previous versions may also be affected.

39. Sun ONE Application Server Error Message Cross-Site Scripting Vulnerability
BugTraq ID: 7710
Remote: Yes
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7710
Summary:

Sun ONE Application Server is the application server solution distributed
and maintained by Sun Microsystems. It is available for the Unix, Linux,
and Microsoft platforms.

Sun ONE Application Server has been reported prone to a cross-site
scripting vulnerability.

Sun ONE Application Server does not adequately filter script code from URL
parameters, making it prone to cross-site scripting attacks.
Attacker-supplied script code may be included in a malicious link to a JSP
application hosted on the vulnerable server. If the request triggers an
error, the error message may contain the attacker-supplied script code,
which in turn may be executed in the browser of the web user who visits
the link. The code will be executed in the security context of the system
running Sun ONE Application Server. Such a link might be included in a
HTML e-mail or on a malicious web page.

This may enable a remote attacker to steal cookie-based authentication
credentials from legitimate users.

It should be noted that although this vulnerability has been reported to
affect Sun ONE Application Server 7.0 on Windows platforms, previous
versions might also be affected.

40. Sun ONE Application Server Plaintext Password Vulnerability
BugTraq ID: 7712
Remote: No
Date Published: May 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7712
Summary:

Sun ONE Application Server is the application server solution distributed
and maintained by Sun Microsystems. It is available for the Unix, Linux,
and Microsoft platforms.

A problem with the Sun ONE Application Server could make unauthorized
access to credentials possible.

It has been reported that a problem exists in the method used for the
storage of passwords by Sun ONE Application Server. This could lead to
local users gaining unauthorized access to passwords, and potentially
unauthorized access to the Sun ONE administrative server.

Specifically, Sun ONE Application Server stores administrative server
credentials in the "statefile" file, using plaintext format by default. To
further exaggerate this problem, the Sun ONE application is installed by
default into a folder that is world readable. A local user with access
sufficient to read this file may disclose the usernames and passwords
contained within.

Information gathered in this way may be used to aid in further attacks
launched against the vulnerable system.

It should be noted that although this vulnerability has been reported to
affect Sun ONE Application Server version 7.0 on Windows platforms,
previous versions might also be affected.

41. Multiple HP Tru64 Unspecified CDE Privilege Escalation Vulnerabilities
BugTraq ID: 7713
Remote: Yes
Date Published: May 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7713
Summary:

Tru64 is a UNIX Operating System variant distributed and maintained by HP.

Several problems have been identified that may allow attackers to gain
unauthorized access to systems.

It has been reported by HP that several issues in the Common Desktop
Environment suite distributed with Tru64 contain vulnerabilities that
could be exploited by a local attacker for privilege gain. Specific
information about these vulnerabilities is not currently available.

It is known that the affected programs are dtprintinfo, dtsession, and
dtappgather. These problems are likely known boundary condition errors
that permit the execution of code with escalated privileges.

Also affected are the libDtHelp.so, libDtHelp.a, libDtSvc.so, and
LibDtSvc.a libraries. Programs linked against these libraries are
vulnerable exploitation that could lead to an attacker gaining
unauthorized access to system resources.

This record is being retired as it has been separated into BIDs 7719,
7720, 7721, 7730 and 7732.

42. Red Hat Linux up2date Unspecified Vulnerability
BugTraq ID: 7714
Remote: No
Date Published: May 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7714
Summary:

Red Hat Linux is a popular distribution of the Linux operating
environment.

A vulnerability has been reported for Red Hat Linux's up2date mechanism.
up2date is used by Red Hat Linux distributions to provide a way for users
to obtain system updates through the Red Hat Network.

up2date is prone to an issue that may result in a segmentation fault
during Migration. Although unconfirmed, due to the nature of this report,
it has been speculated that memory corruption may trigger this
vulnerability. It may be possible that, under the correct circumstances,
this situation may ultimately be exploitable.

The precise technical details of this vulnerability are currently unknown.
This BID will be updated as further information becomes available.

43. Softrex Tornado WWW-Server File Disclosure Vulnerability
BugTraq ID: 7715
Remote: Yes
Date Published: May 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7715
Summary:

Softrex Tornado www-Server is a freely available web server designed for
use with the Microsoft Windows operating system.

It has been announced that Tornado www-Server is vulnerable to a condition
that may result in the disclosure of potentially sensitive information.

According to the report, Tornado www-Server does not perform sufficient
sanitization on client requested paths which include "../" character
sequences. It is possible for attackers to obtain files and directories
outside of the established web root folder by exploiting this
vulnerability.

Files disclosed as a result of successful exploitation could potentially
contain sensitive information that would be useful in mounting further
attacks against the system hosting the web forum software.

44. Softrex Tornado WWW-Server Buffer Overflow Vulnerability
BugTraq ID: 7716
Remote: Yes
Date Published: May 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7716
Summary:

Softrex Tornado www-Server is a freely available web server designed for
use with the Microsoft Windows operating system.

A buffer overflow vulnerability has been reported for Tornado www-Server.
The vulnerability exists when Tornado processes overly long HTTP GET
requests.

An attacker can exploit this vulnerability by issuing a malicious GET
request to the vulnerable server consisting of at least 471 characters.
When this request is processed, the server will crash thereby resulting in
a denial of service.

Although unconfirmed, it may be possible to exploit this vulnerability to
execute malicious attacker-supplied code.

This vulnerability was reported for Tornado www-Server 1.2.

45. Super-M Son hServer File Disclosure Vulnerability
BugTraq ID: 7717
Remote: Yes
Date Published: May 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7717
Summary:

Super-M Son hServer is a freely available web server designed for use with
the Microsoft Windows operating system.

It has been announced that Super-M Son hServer is vulnerable to a
condition that may result in the disclosure of potentially sensitive
information.

According to the report, hServer does not perform sufficient sanitization
on client requested paths which include ".|./" character sequences. It is
possible for attackers to obtain files and directories outside of the
established web root folder by exploiting this vulnerability.

46. Multiple Vendor FTP Server File Disclosure Vulnerability
BugTraq ID: 7718
Remote: Yes
Date Published: May 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7718
Summary:

VisNetic FTPServer is a secure FTP server distributed by Deerfield. Titan
FTP Server is a FTP server distributed by South River Technologies. Both
servers are available for Microsoft Windows operating systems.

It has been announced that VisNetic FTPServer and Titan FTP Server are
vulnerable to a condition that may result in the disclosure of potentially
sensitive information.

According to the report, the affected servers do not perform sufficient
sanitization on client requested paths, which include "../" character
sequences passed to 'quote stat' commands. It is possible for attackers to
obtain information relating to files and directories outside of the
established FTP root folder by exploiting this vulnerability.

Attackers may disclose information about the structure and layout of the
target filesystem. This could potentially lead to the disclosure of
sensitive information that would be useful in mounting further attacks
against the system running the vulnerable software.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. California Supremes Hear DeCSS Case
By Kevin Poulsen

The Golden State's high court ponders computer code as speech, against warnings that
California's economic security is at risk from evil programmers. ... >>

http://www.securityfocus.com/news/5239

2. Report: Too Much Cyber Security at CIA
By Kevin Poulsen

A study finds that an uncompromising security model shackles spooks to primitive
technology.

http://www.securityfocus.com/news/5201

3. Palm signs Wi-Fi security, access, VoIP deals
By Tony Smith, The Register

Palm yesterday signed a handful of alliances it hopes will make its Wi-Fi equipped
Tungsten C handheld more attractive to corporate IT departments.

http://www.securityfocus.com/news/5255

4. US cyber crime losses tumble
By John Leyden, The Register

US financial losses from cyber crime in 2002 were down 56 per cent on 2001, according
to the Computer Security Institute's (CSI) eighth annual Computer Crime and Security
Survey.

http://www.securityfocus.com/news/5254

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Access Control Designer vbeta1
by Robert Trebula R0B0
Relevant URL:
http://acd.zero.sk.eu.org/
Platforms: Os Independent
Summary:

Access Control Designer is a universal modular tool for visually designing
access control policies. The user of this system depicts requirements for
the designed security policy in a graphical notation based on a generally
accepted security model. The tool will then generate a configuration of
security mechanisms, which will be used for the implementation of the
security policy. Modularity of the tool will allow users to design
security policies for a lot of various environments - systems needed to
have access controlled. A pluggable module API allows third-party
programmers to provide ACD modules for systems and so allow users to use
ACD for designing access control policies for the systems.

2. IPA v1.3.4
by Andrey Simonenko
Relevant URL:
http://ipa-system.sourceforge.net/
Platforms: FreeBSD, NetBSD, OpenBSD
Summary:

IPA allows one to perform IP accounting based on FreeBSD IPv4/v6 Firewall,
OpenBSD Packet Filter, and IP Filter accounting rules on Free/Net/OpenBSD.
It supports limits for accounting rules, and limits events such as "limit
is reached" and "reached limit is expired." It also has a flexible
configuration file with many sections and options.

3. BCWipe v1.2-3
by Jetico, Inc. [email protected]
Relevant URL:
http://www.jetico.com/
Platforms: Windows 2000, Windows 95/98, Windows NT
Summary:

The BCWipe utility is designed to securely delete files from the disk.
Standard file deletion leaves the contents of the "deleted" file on your
disk. Unless it has been overwritten by files subsequently saved, it can
be recovered using standard disk utilities. Working quickly and integrated
with Windows Shell, BCWipe shreds data in files so that they can not be
recovered by any means. BCWipe software is a freeware for non-commercial
and non-governmental use. Please, refer to BCWipe End-User license
agreement for more information on licensing terms.

4. Log Tool v1.3.0
by A.L.Lambert [email protected]
Relevant URL:
http://xjack.org/logtool/
Platforms: UNIX
Summary:

Logtool is a syslog file parser, report generator, and monitoring utility.
It takes syslog (and syslog compatible) logfiles as input from stdin, and
depending on command line switches and/or config file settings, will parse
and filter out unwanted messages from the logfile accordingly, and
generate output in ANSI color, formatted ASCII, CSV (for spreadsheets), or
HTML format. It is very handy for use in automated nightly reports, and
online monitoring of logfile activity. It comes with some simple example
scripts and documentation.

5. SSHTerm v0.1.4 beta
by Richard Pernavas
Relevant URL:
http://www.sshtools.com/
Platforms: Os Independent
Summary:

SSHTerm is a Java SSH client that provides a whole range of features,
including port forwarding, password authentication, public-key
authentication, ANSI/VT100/VT220/VT320 terminal, full clipboard support,
record and playback input/output, and the ability to load/save connection
settings to a file.

6. SSHVnc v0.1.0
by Lee David Painter
Relevant URL:
http://www.sshtools.com
Platforms: Os Independent
Summary:

SSHVnc is a standalone Java VNC viewer that secures VNC a ccess by
integrating the popular TightVNC viewer with the SSH Tools Java SSH API.
It features a clean and easy to use interf ace.

V. SECURITY JOBS SUMMARY
------------------------
1. Kansas City - Application Security Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323193

2. Research and Development Engineer location (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323191

3. Senior Business Development Manager, UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323192

4. Research and Development Team Lead - (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323184

5. CISSP Information Security Engineer seeking position in PA,NJ,NY,FL and CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323171

6. Need security consultants in Boston (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323170

7. Security Project Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323169

8. Security Engineer position in Knoxville, TN (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323167

9. Looking for information security position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323166

10. SAP Security Consultant, Midlands, UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323163

11. Information Security Manager, Benelux (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323165

12. Research and Development Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323161

13. Information Security Architect - Fairfield County, CT (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323160

14. Need Security Evangelist in Chicago (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323034

15. Seeking Tivoli Access Manager Consultant (NJ) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/323033

16. Senior Security Manager -Cleveland, Ohio (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322899

17. Neoteris is hiring!!! - Sales Engineer - Southern California (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322793

18. Information Security Dr available (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322777

19. Neoteris is hiring!!! - Technical Support Engineers - Silicon Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322772

20. CISSP Security consultant seeking position in NYC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322707

21. Etiquette for recruiters (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322686

22. Good article on job hunting in this environ. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322644

23. Seeking security consulting position in NYC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322639

24. Immediate opening for a Tivoli Access Manager Security Pofessional (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322638

25. Sales Engineer / San Francisco (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322637

26. Cleared, Navy looking for work in San Diego, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322491

27. North East Coast Sr. Security Engineering Position Available Now!! (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322490

28. Administrivia (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322394

29. Business Development Director EMEA - based in UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322377

30. Field Engineer (DC and SF) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322376

31. Senior Security Manager - Cleveland, Ohio (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322375

32. Neoteris is hiring!!! - Senior Technical Trainer - Silicon Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322373

33. Neoteris is hiring!!! - Product Marketing Manager - Silicon Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322372

34. Neoteris is hiring!!! - Technical Marketing Engineer - Silicon Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322371

35. Neoteris is hiring!!! - Manager, Business Development - Silicon Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322370

36. Neoteris is hiring!!! - Inside Sales Rep - East Region (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322369

37. Neoteris is hiring!!! - Federal Sales Rep - VA/MD/DC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/322368

VI. INCIDENTS LIST SUMMARY
-------------------------
1. Weird Traffic from www.eyeblaster-bs.com (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/323252

2. Whois updates, Was: [ Possible Intrusion Attempt?] (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/323251

3. strange cmd.exe access (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/323250

4. A question for the list... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/323248

5. DDoS Attack (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/323111

6. Possible Intrusion Attempt? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/323107

7. Are they back? (was Scans from proxyprotector.com) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/322983

8. New Paper on Passive OS Fingerprinting (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/322982

9. Scans from proxyprotector.com (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/322909

10. [ANNOUNCE] protocol watcher (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/322788

11. is this new ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/322778

12. Stukach Trojaned SysReg.exe (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/322655

13. cisco 7200 performance issue (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/322649

14. ICMP/SYN Flood (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/322478

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Re[2]: mirc32 6.0x crash when resolving dns. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322988

2. mirc32 6.0x crash when resolving dns. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322987

3. Abo3 (can someone help me?) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322874

4. [Vuln-dev Challenge] Challenge #2 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322687

5. N00b questions :\ (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322614

6. [Vuln-dev Challenge] Challenge #2 (return-to-libc) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322612

7. Mac OS X shellcode and SIGTRAP (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322549

8. [Vuln-dev Challenge] example exploit for 2 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322546

9. [Vuln-dev Challenge]: Symlink Attack (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322528

10. Frame Pointer Overwriting (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322521

11. [Vuln-dev Challenge] Challenge #2 (SPOILER) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322542

12. [Vuln-dev Challenge] nonexec stack&heap solution (encrypted) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322540

13. Is this exploitable? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322395

14. CORRECTION: vulndev1.c solution (WARNING! QUESTIONS!) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/322397

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------

1. Article Announcement: Malware Myths and Misinformation Part 2 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/323119

2. Article Announcement: Conducting a Security Audit: An Introductory Overview (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/322796

3. SecurityFocus Microsoft Newsletter #138 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/322798

4. Re[2]: Windows 2003 Server - MS Rulez? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/322721

5. Windows 2003 Server - MS Rulez? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/322720

IX. SUN FOCUS LIST SUMMARY
--------------------------
1. NO NEW POSTS FOR THE WEEK ENDING 05.30.03

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. process accounting (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/322998

2. more on linux hardening (fwd) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/322997

3. more on linux hardening (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/322980

4. hardening scripts (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/322927

XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Interland

Visit us at: http://www.securityfocus.com/Interland-sf-news
-------------------------------------------------------------------------------