SecurityFocus Newsletter #202

John Boletta <[email protected]> Mon, 23 Jun 2003 12:08:08 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #202
-----------------------------

This Issue is Sponsored by: IBM

SecureWorld: IBM's End-To-End Security Conference, August 25-29, 2003,
Miami Beach, Florida

As Information Technology increases in importance, so do the number of
threats directed against this critical infrastructure. A comprehensive
security strategy is essential to protecting your vital data and ensuring
continuity of operations. The SecureWorld Conference provides over 100
sessions to help you assess, protect, detect, correct, and recover from
security concerns with end-to-end security solutions.

For more information or to enroll, visit:
http://www.securityfocus.com/IBM-sf-news
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Securing PHP: Step-by-step
2. Tracking Down the Phantom Host
3. From the Booby Hatch
II. BUGTRAQ SUMMARY
1. IKE-Scan Local Logging Format String Vulnerability
2. PostNuke Modules.PHP Multiple Cross-Site Scripting Vulnerabilities
3. PostNuke User.PHP UNAME Cross-Site Scripting Vulnerability
4. Sphera HostingDirector VDS Control Panel Multiple Cross-Site...
5. ATFTP Timeout Command Line Argument Local Buffer Overflow...
6. Sphera HostingDirector Session ID Random Generator Weakness
7. ATFTP Blocksize Command Line Argument Local Buffer Overflow...
8. ATFTP TFTP-Timeout Command Line Argument Local Buffer Overflow...
9. Methodus 3 FTP Server File Disclosure Vulnerability
10. Methodus 3 Web Server File Disclosure Vulnerability
11. Mollensoft Hyperion FTP/Enceladus Server Suite Multiple Remote...
12. Multiple Vendor PDF Hyperlinks Arbitrary Command Execution...
13. MikMod Long File Name Local Buffer Overflow Vulnerability
14. Progress Database DBAgent InstallDir Local Privilege Elevation...
15. Progress Database Environment Variable Local Privilege...
16. myServer Signal Handling Denial Of Service Vulnerability
17. FreeWnn JServer Logging Option Data Corruption Vulnerability
18. PMachine Lib.Inc.PHP Remote Include Command Execution...
19. LedNews Post Script Code Injection Vulnerability
20. Mailtraq Remote Directory Traversal Vulnerability
21. Snitz Forums Search.ASP Cross-Site Scripting Vulnerability
22. Snitz Forum Cookie Authentication Bypass Vulnerability
24. Snitz Forums Password.ASP Password-Reset Vulnerability
25. Mailtraq Remote Format String SMTP Resource Consumption...
26. Xoops/E-Xoops Tutorials Module Remote Command Execution...
27. Linux-PAM Pam_Wheel Module getlogin() Username Spoofing...
28. Mailtraq Webmail Remote HTML Injection Vulnerability
29. Dantz Retrospect Client StartupItems Insecure Default...
30. Pod.Board Forum_Details.PHP Multiple HTML Injection...
31. Pod.Board New_Topic.PHP Multiple HTML Injection Vulnerabilities
33. PHPBB Admin_Styles.PHP Theme_Info.CFG File Include Vulnerability
34. Noweb/Noroff Insecure Temporary File Creation Vulnerability
35. Microsoft Internet Explorer MSXML XML File Parsing Cross-Site...
36. Microsoft Internet Explorer Custom HTTP Error HTML Injection...
37. Portmon Host File Option Sensitive File Arbitrary Content...
38. Internet Security Systems BlackICE Defender Cross-site...
39. Armida Databased Web Server Long Request Denial Of Service...
40. Portmon Log File Option File Overwrite Vulnerability
41. MyServer HTTP Server Directory Traversal Vulnerability
42. Dune HTTP Get Remote Buffer Overrun Vulnerability
43. Squirrelmail Multiple Remote Vulnerabilities
44. Proxomitron Proxy Server Long Get Request Remote Denial Of...
45. MiniHTTPServer WebForums Server Remote Directory Traversal...
46. MidHosting FTP Daemon Shared Memory Local Denial Of Service...
47. CesarFTP Remote CWD Denial of Service Vulnerability
48. Unspecified IBM OS/390 Vulnerability
49. Alguest Admin Panel Cookie Authentication Bypass Vulnerability
50. IBM RACF Profile Updating Privilege Elevation Vulnerability
51. Sun Management Center Insecure File Permissions Vulnerability
52. Avaya Cajun Network Switch Connection Stalling Denial Of...
III. SECURITYFOCUS NEWS ARTICLES
1. Guess settles with FTC over cybersecurity snafu
2. Security Researchers Nibble at Bluetooth
3. Spam Bill Gains In Senate
4. Meet Stumbler: Next Gen port scanning malware
IV. SECURITYFOCUS TOP 6 TOOLS
1. socklog v1.1.0
2. GkrellMMS v2.1.12
3. TinyCA v0.4.5
4. softflowd v0.8.1
5. Coyote Linux 2.0.0-pre5
6. ADMLogger - Default branch v1.0
V. SECURITYJOBS LIST SUMMARY
1. Senior Consultant #793 - Seattle,WA - Salary $90k-$110k (Thread)
2. Security Consultant #787 - Chicago, IL - $90k - $105k (Thread)
3. Security Intern, Dublin, OH (Thread)
4. Director of Engineer-Product Development-Application Security...
5. Training Manager (Thread)
6. IT Auditor CISA - required in Hong Kong (Thread)
7. Disaster Recovery Specialist position in PA (Thread)
8. Disaster Recovery Admin w/ Strohl product knowledge (Thread)
9. Senior Security Consultant - Seattle / Tacoma / Puget Sound Are...
10. Immediate Openings Support Engineers (Sunnyvale CA) (Thread)
11. Security Engineer, Manager, CISSP seeking leads in SF Bay area...
12. Messaging Security Specialist needed in Washington, DC / Nort...
13. Washington, DC area Project / Systems Engineers needed (Thread)
14. Firewall Expert Needed for Washington, DC job (Thread)
15. Senior Security Architect - Seattle, WA - Contract to Hire...
16. Sr Security Sales / Business Dev Manager - Auckland New...
17. Security specialist contract - canada (Thread)
18. IT Security Consultant (CHECK Team Leader), London, UK (Thread)
19. Internet Security Architect contract position (Thread)
20. New articles available on SecurityFocus (Thread)
21. Intrusion Detection & Incident Response - Chicago, IL (Thread)
22. Principal Security Consultant (CLAS), UK (Thread)
23. Security Engineer Contract Position in TX or Bay Area (Thread)
24. NJ Systems Architect (Thread)
25. Security expert for $25/hr (Thread)
26. Neoteris is hiring!!! - PR/Media Relations Manager - Silicon...
27. Neoteris is hiring!!! - SR Tech Support Engineer - Silicon...
28. Neoteris is hiring!!! - Regional Sales Manager - Scandic (Thread)
29. Neoteris is hiring!!! - Regional Sales Manager - Federal (Thread)
30. Pre-Sales Engineers (Thread)
31. Security Engineers needed in Denver! (Thread)
32. Enterprise Security Architect--NJ/Full-time (Thread)
33. Posting for another party - Director, Information Security NYC...
VI. INCIDENTS LIST SUMMARY
1. FW: IANA Reserved IP Source scans 55808 (Thread)
2. odd RST packets with 55808 (Thread)
3. sdbot variant and WS 55808 activity (Thread)
4. Unusual registry entries (Thread)
5. sdbot variant and WS 55808 activity (Thread)
6. SNMP search for printers? (Thread)
7. One observed pattern of Win 55808 packets (Thread)
8. chkrootkit and LKM? (Thread)
9. sdbot variant and port 55808 activity (Thread)
10. Spoofed TCP SYNs w/Winsize 55808 (was: Help with an odd log...
11. UDP/41170 (Thread)
12. Wierd Profile in Document Settings (Thread)
13. Help with identifying scan/attack (Thread)
14. File on desktop called "~" (Thread)
15. Odd windows ICMP... any ideas what this is? (Thread)
16. Windows 2k rootkit incident, files zipped for your pleasure...
17. Windows 2k rootkit incident, files zipped for your pleasure...
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Java class obfuscation (Thread)
2. Question (Thread)
3. Formatstrings on *BSD (Thread)
4. Black Hat Briefings 2003 - Announcement (Thread)
5. Microsoft Access 97 MDW files (Thread)
6. IE exposing URLs to msn.com and alexa.com? (Thread)
7. Directory traversal vulnerability on Xoops/E-xoops CMS module...
8. Research on Source Code Review -C (Thread)
9. Sphera Hosting Director Control Panel Multiple Vulnerabilities...
10. shellcode with standard characters (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Filtering DHCP Assignments by MAC Address (Thread)
2. Windows Event Logs (Thread)
3. NTRootkit (Thread)
4. Article Announcement: Tracking Down the Phantom Host (Thread)
5. Question regarding su.exe (Thread)
6. Administrivia: OOO Messages (Thread)
7. SecurityFocus Microsoft Newsletter #141 (Thread)
8. Local User Permissions in a Public, Domain Environment? (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Package Log for Solaris (Thread)
2. Solaris Patch Manager (Thread)
3. New SecurityFocus Article (Thread)
X. LINUX FOCUS LIST SUMMARY
1. deny deleting a file for users.. trying a solution (Thread)
2. New SecurityFocus Article (Thread)
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Securing PHP: Step-by-step
By Artur Maj

This article shows the basic steps in securing PHP, one of the most
popular scripting languages used to create dynamic web pages on the
Internet.

http://www.securityfocus.com/infocus/1706

2. Tracking Down the Phantom Host
By John Payton

This article explains techniques on how to locate a problem host when you
are not sure where it is physically located.

http://www.securityfocus.com/infocus/1705

3. From the Booby Hatch
By George Smith

Senator Orrin Hatch says he wants to destroy music swappers' computers,
but what he really means is that kids today have no respect for their
elders.

http://www.securityfocus.com/columnists/168

II. BUGTRAQ SUMMARY
-------------------
1. IKE-Scan Local Logging Format String Vulnerability
BugTraq ID: 7897
Remote: No
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7897
Summary:

ike-scan is a utility designed to discover IPsec VPN hosts running IKE
(Internet Key Exchange). It is maintained by NTA and is available for Unix
variant operating systems.

A vulnerability has been discovered in ike-scan. The problem is said to
occur due to insufficient format specifiers being supplied to the syslog()
function. As a result, by passing a command-line argument to ike-scan it
may be possible for a malicious local user to corrupt process memory.

Successful exploitation of this vulnerability would allow an attacker to
execute arbitrary code with the privileges of ike-scan. It should be noted
that ike-scan is not installed suid by default.

2. PostNuke Modules.PHP Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 7898
Remote: Yes
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7898
Summary:

PostNuke is a web-based portal system. Implemented in PHP, it is available
for a range of systems, including Unix, Linux, and Microsoft Windows.

The PostNuke 'modules.php' script does not sufficiently sanitize data
supplied via URI parameters, making it prone to cross-site scripting
attacks. In particular, the 'categories' and 'letter' URI parameters are
not properly sanitized of HTML tags. This could allow for execution of
hostile HTML and script code in the web client of a user who visits a web
page that contains the malicious code. This would occur in the security
context of the site hosting the software.

Exploitation could allow for theft of cookie-based authentication
credentials. Other attacks are also possible.

It should be noted, that although this vulnerability has been reported to
affect PostNuke version 0.7.2.3, other versions might also be affected.

3. PostNuke User.PHP UNAME Cross-Site Scripting Vulnerability
BugTraq ID: 7901
Remote: Yes
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7901
Summary:

PostNuke is a web-based portal system. Implemented in PHP, it is available
for a range of systems, including Unix, Linux, and Microsoft Windows.

The PostNuke 'user.php' script does not sufficiently sanitize data
supplied via URI parameters, making it prone to cross-site scripting
attacks. In particular, the 'uname' URI parameter is not properly
sanitized of HTML tags. This could allow for execution of hostile HTML and
script code in the web client of a user who visits a web page that
contains the malicious code. This would occur in the security context of
the site hosting the software.

Exploitation could allow for theft of cookie-based authentication
credentials. Other attacks are also possible.

It should be noted, that although this vulnerability has been reported to
affect PostNuke version 0.7.2.3, other versions might also be affected.

4. Sphera HostingDirector VDS Control Panel Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 7899
Remote: Yes
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7899
Summary:

Sphera HostingDirector is software designed to provide centralized
administration of a dedicated environment. ServerDirector/Virtual
Dedicated Server(VDS) technology is a component that is shipped with
HostingDirector; it is designed to simulate multiple virtual dedicated
servers on a single system.

Sphera HostingDirector VDS Control Panel has been reported prone to
several cross-site scripting attacks. The vulnerabilities exist due to
insufficient sanitization of user-supplied input for certain URI
parameters.

Specifically, the 'uid', 'error' and 'vds_ip' URI parameters, of the
login_screen.php and sm_login_screen.php scripts, are not sanitized of
malicious HTML code.

An attacker can exploit this by crafting a link that includes malicious
HTML code. If a web user follows a malicious link to a site hosting the
vulnerable software that includes hostile HTML or script code. This code
would be executed in the context of the site hosting the software.

Successful exploitation could permit theft of cookie-based authentication
credentials from legitimate users of the HostingDirector Control Panel,
which may in turn permit unauthorized access to resources that are managed
by the software. Other attacks may also be possible.

5. ATFTP Timeout Command Line Argument Local Buffer Overflow Vulnerability
BugTraq ID: 7902
Remote: No
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7902
Summary:

atftp is a TFTP client/server implementation for Linux and Unix variants.

atftp is prone to a locally exploitable buffer overflow condition. This
issue is due to insufficient bounds checking performed on input supplied
to the command line parameter (-t) for "timeout". By providing a string of
excessive length (9000 bytes) as a value for the command line parameter,
it is possible to trigger this condition to corrupt stack variables. Local
attackers may leverage the resulting memory corruption to execute
arbitrary instructions.

If atftp is installed setuid/setgid, an attacker may potentially exploit
this condition to execute arbitrary instructions with elevated privileges.

It should be noted that although this vulnerability has been reported to
affect atftp version 0.7cvs, other versions might also be vulnerable.

6. Sphera HostingDirector Session ID Random Generator Weakness
BugTraq ID: 7904
Remote: Yes
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7904
Summary:

HostingDirector is a commercially available system administration package
distributed by Sphera. It is available for the Linux and Microsoft
Windows platforms.

A problem with the software may increase the possibility of a user gaining
unauthorized access to the system.

It has been reported that Sphera HostingDirector uses a weak method of
generating session IDs. This problem may increase the possibility of an
attacker brute-force guessing a valid session ID.

The problem is in the method used to generate session IDs. Upon session
ID generation, each new session ID may be a total of 11 bytes in length,
of which five bytes vary from a previously generated session ID. Of these
five bytes, one is incremented sequentially in a predictable location.
This value is stored in a cookie on the system of the authenticated user.
It, and the session ID, is persistent until the user logs out.

To gain access to a vulnerable implementation, an attacker still must know
a valid user name to place in the authentication cookie.

7. ATFTP Blocksize Command Line Argument Local Buffer Overflow Vulnerability
BugTraq ID: 7907
Remote: No
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7907
Summary:

atftp is a TFTP client/server implementation for Linux and Unix variants.

atftp is prone to a locally exploitable buffer overflow condition. This
issue is due to insufficient bounds checking performed on input supplied
to the command line parameter (-b) for "blocksize". By providing a string
of excessive length as a value for the command line parameter, it is
possible to trigger this condition to corrupt stack variables. Local
attackers may leverage the resulting memory corruption to execute
arbitrary instructions.

If atftp is installed setuid/setgid, an attacker may potentially exploit
this condition to execute arbitrary instructions with elevated privileges.

It should be noted that although this vulnerability has been reported to
affect atftp version 0.7cvs, other versions might also be vulnerable.

It should also be noted that atftp is not installed setuid/setgid by
default.

8. ATFTP TFTP-Timeout Command Line Argument Local Buffer Overflow Vulnerability
BugTraq ID: 7906
Remote: No
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7906
Summary:

atftp is a TFTP client/server implementation for Linux and Unix variants.

atftp is prone to a locally exploitable buffer overflow condition. This
issue is due to insufficient bounds checking performed on input supplied
to the command line parameter (-T) for "tftp-timeout". By providing a
string of excessive length as a value for the command line parameter, it
is possible to trigger this condition to corrupt stack variables. Local
attackers may leverage the resulting memory corruption to execute
arbitrary instructions.

If atftp is installed setuid/setgid, an attacker may potentially exploit
this condition to execute arbitrary instructions with elevated privileges.

It should be noted that although this vulnerability has been reported to
affect atftp version 0.7cvs, other versions might also be vulnerable.

It should also be noted that atftp is not installed setuid/setgid by
default.

9. Methodus 3 FTP Server File Disclosure Vulnerability
BugTraq ID: 7905
Remote: Yes
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7905
Summary:

Methodus 3 is utility that provides a number of features such as file
sharing through an HTTP server and FTP client/server implementation. It
is a available for Microsoft Windows operating systems.

The Methodus 3 FTP server component is prone to a file disclosure
vulnerability.

This vulnerability is due to insufficient sanitization of various
directory traversal sequences from FTP commands. It is possible to break
out of the FTP root directory by submitting directory sequences such as
'../' and '//..' via the change directory (CD) FTP command. Other
commands may be similarly affected. As a result, files that are readable
by the server could be disclosed to remote attackers. The attacker would
need to authenticate with the FTP server to exploit this issue, though
this could occur through anonymous access if it is enabled.

10. Methodus 3 Web Server File Disclosure Vulnerability
BugTraq ID: 7908
Remote: Yes
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7908
Summary:

Methodus 3 is utility that provides a number of features such as file
sharing through an HTTP server and FTP client/server implementation. It
is a available for Microsoft Windows operating systems.

It is possible for remote attackers to retrieve resources outside of the
web root directory. The vulnerability is due to insufficient sanitization
of directory traversal sequences such as '../' from web requests. This
could potentially be exploited to gain access to sensitive files on a
system hosting the vulnerable software. Files that are readable by the
web server could be disclosed if this issue is exploited.

11. Mollensoft Hyperion FTP/Enceladus Server Suite Multiple Remote Heap
Corruption Vulnerabilities
BugTraq ID: 7909
Remote: Yes
Date Published:
Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7909
Summary:

MollenSoft Hyperion FTP Server is a server that supports basic FTP
functionality and more. It is available for the Microsoft Windows
operating systems.

MollenSoft Enceladus Server Suite, is a combined FTP and HTTP server
product. It is available for the Microsoft Windows operating systems.

Multiple vulnerabilities have been reported for Mollensoft Hyperion FTP
and Enceladus Server Suite. The problem likely occurs due to insufficient
bounds checking of user-supplied command parameters. As a result, by
supplying excessive data to one of multiple FTP commands it is possible to
corrupt heap-based memory.

The affected commands include cwd, stat, mkd, xmkd, rmd, and nlst. It is
possible to trigger this condition by supplying approximately 270 to 344
bytes as a parameter to one of the commands.

This vulnerability could potentially be exploited by an attacker to
execute arbitrary code with the privileges of the server process, possibly
SYSTEM. A denial of service attack is also possible.

12. Multiple Vendor PDF Hyperlinks Arbitrary Command Execution Vulnerability
BugTraq ID: 7912
Remote: Yes
Date Published: Jun 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7912
Summary:

A vulnerability has been reported for multiple viewers for Unix variant
operating systems. Both Adobe Acrobat Reader and Xpdf are said to be
affected.

The vulnerability allegedly occurs when following a malicious hyperlink.
When the hyperlink is followed the PDF viewer externally calls the 'sh -c'
command to invoke a utility to handle the request. Supposedly, when the
link is followed it is possible to execute arbitrary code by placing shell
metacharacters designed to escape the command. This can be accomplished by
placing (`) characters within the hyperlink.

Successful exploitation of this vulnerability could potentially allow an
attacker to execute arbitrary commands on a target system with the
privileges of the user invoking the PDF document. This would occur
externally to the program and the utility invoked to handle the link would
still be called.

The exploitability of this issue is said to vary between PDF viewers, as
some do not support the use of external hyperlinks. If a viewer is
currently invoked within a browser, the call to 'sh -c' may not be made.

This vulnerability is said to affect Adobe Acrobat Reader 5.06 and Xpdf
1.01, however, other versions may also be affected.

It should be noted that this vulnerability may be similar to that
described in BID 1624. If it is concluded that this is in fact the case,
the older BID will be updated and this BID will be retired.

13. MikMod Long File Name Local Buffer Overflow Vulnerability
BugTraq ID: 7914
Remote: No
Date Published: Jun 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7914
Summary:

mikmod is a freely available, open source sound library and module player.
It is available for Unix, Linux, and Microsoft platforms.

A problem with the program may make it possible for users to gain
unauthorized privileges.

It has been reported that mikmod does not properly handle some types of
input. Because of this, an attacker may be able to gain unauthorized
privileges on a system using the program.

mikmod does not properly handle file names of arbitrary length. Long file
names inside archive files can cause the corruption of sensitive process
memory that may potentially be exploited to execute code with the
privileges of the process.

14. Progress Database DBAgent InstallDir Local Privilege Elevation Vulnerability
BugTraq ID: 7915
Remote: No
Date Published: Jun 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7915
Summary:
Progress Database is a commercial database for Microsoft Windows, Linux, and Unix systems.

A problem with the software may grant unauthorized privileges.

It has been reported that dbagent packaged with Progress does not properly
handle untrusted input in some command line arguments. Because of this,
an attacker may be able to gain unauthorized privileges.

The problem is in the installdir option. The dbagent program does not
perform sufficient checks or sanitizing of values passed with this
argument when executed. This could lead to an attacker supplying a
directory in an arbitrary location on the system, and potentially loading
a malicious library into the program.

Any library code loaded and executed through the installdir argument would
be with the privileges of the dbagent program. dbagent is typically
installed with privileges.

15. Progress Database Environment Variable Local Privilege Escalation Vulnerability
BugTraq ID: 7916
Remote: No
Date Published: Jun 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7916
Summary:
Progress Database is a commercial database for Microsoft Windows, Linux, and Unix systems.

A problem with the software may grant unauthorized privileges.

It has been reported that Progress database does not properly handle
untrusted input when opening shared libraries. Specifically, the dlopen()
function, used by several Progress utilities in /usr/dlc/bin/, checks the
user's PATH environment variable when including shared object libraries.
If any shared objects are found, Progress will load and execute them. Due
to this, an attacker may be able to gain unauthorized privileges.

An attacker can exploit this vulnerability by creating a malicious shared
object and setting the PATH environment variable to include the directory
containing the shared object. When certain utilities in the /usr/dlc/bin/
directory are executed, the malicious shared library will be loaded.

Any library code loaded will execute with elevated privileges.

16. myServer Signal Handling Denial Of Service Vulnerability
BugTraq ID: 7917
Remote: Yes
Date Published: Jun 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7917
Summary:
myServer is an application and web server for Microsoft Windows and Linux operating systems.

A vulnerability has been reported for myServer that may result in a denial
of service condition. The vulnerability exists when myServer receives
certain signals. Specifically, when myServer receives the SIGINT signal,
it will crash.

This vulnerability was reported to affect myServer 0.4.1.

17. FreeWnn JServer Logging Option Data Corruption Vulnerability
BugTraq ID: 7918
Remote: No
Date Published: Jun 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7918
Summary:

FreeWnn 1.1.0 is a kana-kanji (japanese) translation system. This software
is a client-server type application, with the jserver portion acting as a
server and performing translations for clients.

A vulnerability has been reported for FreeWnn that may result in an
attacker obtaining elevated privileges. Specifically, when
/usr/bin/Wnn4/jserver is invoked with the '-s' commandline option to
indicate a log file, it does not perform proper file existence checks. Due
to this, an attacker may be able to overwrite system files, and
potentially gain elevated privileges.

If the jserver process is executed as a user with elevated privileges,
this could allow an attacker to gain privileges equal to the jserver user.

It should be noted that this program might also be installed with setuid
or setgid privileges on some systems. This would allow an attacker to
execute and exploit the program at will.

18. PMachine Lib.Inc.PHP Remote Include Command Execution Vulnerability
BugTraq ID: 7919
Remote: Yes
Date Published: Jun 15 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7919
Summary:

PMachine is a web content management system. It is available for the Unix
and Linux platforms.

A problem with the software may make unauthorized access possible.

It has been reported that PMachine does not properly handle include files
under some circumstances. Because of this, an attacker may be able to
remotely execute commands.

The problem is in the lib.inc.php file. This file does not adequately
check the input of an include() function. Because of this, an attacker
can supply a value to a remote include file containing malicious commands
to be executed in a shell on the local host. This could allow an attacker
to gain access to the host with the privileges of the web server process.

19. LedNews Post Script Code Injection Vulnerability
BugTraq ID: 7920
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7920
Summary:

LedNews is a freely available, open source news posting script. It is
available for the Unix and Linux platforms.

A problem with the software may make script injection attacks possible.

It has been reported that LedNews does not properly filter input from news
posts. Because of this, it may be possible for an attacker to steal
authentication cookies or perform other nefarious activities.

The problem is in filtering of input. The program does not properly
sanitize input, allowing HTML and script code to be posted as news. This
could be abused to execute code in the browser of site users.

It should be noted that it may also be possible to execute arbitrary
commands through server-side includes on a host using the vulnerable
software.

20. Mailtraq Remote Directory Traversal Vulnerability
BugTraq ID: 7921
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7921
Summary:

Mailtraq is a commercially available e-mail server and client software
package. It is available for the Microsoft Windows platform.

A problem with the software may make it possible for an attacker to gain
unauthorized access to sensitive information.

It has been reported that Mailtraq is vulnerable to a remote directory
traversal issue. Because of this, an attacker may be able to gain access
to files on the local system with the privileges of the Mailtraq server
process.

The problem is in the handling of input by the Mailtraq server process.
By issuing a request to the Mailtraq web interface for a specific
directory, a remote user can view all the files contained in the requested
directory. As the Mailtraq program typically executes with elevated
privileges, this may permit the disclosure of privileged information.

21. Snitz Forums Search.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 7922
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7922
Summary:

Snitz Forums is ASP-based web forum software. It runs on Microsoft Windows
operating systems.

Snitz Forums is prone to cross-site scripting attacks. This is due to
insufficient sanitization of data passed to the search facility via URI
parameters. As a result, it is possible for a remote user to create a
malicious link to a site hosting the vulnerable software, which contains
hostile HTML and script code. If this link is visited, the
attacker-supplied HTML and script code will be interpreted by their
browser. This will occur in the context of the site hosting the vulnerable
software.

Exploitation may allow theft of cookie-based authentication credentials or
other attacks.

This issue was reported in Snitz Forums 3.4.0.3, other versions might also
be affected.

22. Snitz Forum Cookie Authentication Bypass Vulnerability
BugTraq ID: 7924
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7924
Summary:

Snitz Forums is ASP-based web forum software. It runs on Microsoft Windows
operating systems.

Snitz Forum has been reported prone to a cookie authentication bypass
vulnerability.

It has been reported that, if a remote attacker can retrieve the
authentication cookie of another user, they can extract the password hash
and use it to construct a malicious cookie that can be harnessed to hijack
the victim's account.

An attacker may exploit this issue to hijack another Snitz forum users
account.

This issue was reported in Snitz Forums 3.4.0.3, other versions might also
be affected.

23. Mailtraq User Password Encoding Weakness
BugTraq ID: 7923
Remote: No
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7923
Summary:

Mailtraq is a commercially available e-mail server and client software
package. It is available for the Microsoft Windows platform.

A problem with the software may make increase the possibility of an
attacker discovery passwords.

It has been reported that Mailtraq does not securely store passwords.
Because of this, an attacker may have an increased chance at gaining
access to clear text passwords.

The problem is in the algorithm used to store passwords. Mailtraq uses a
weak encoding scheme that can be easily reversed by a user with read
access to the password file. This can result in an attacker revealing the
clear text password strings and gaining access to the accounts of Mailtraq
users.

24. Snitz Forums Password.ASP Password-Reset Vulnerability
BugTraq ID: 7925
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7925
Summary:

Snitz Forums is ASP-based web forum software. It runs on Microsoft Windows
operating systems.

Snitz Forums 'password.asp' has been reported prone to a password-reset
vulnerability. It has been reported that by requesting a forgotten
password, an attacker may save the 'password reset' page offline. By
modifying the member id in the saved script the attacker may reset
arbitrary account passwords, if the corresponding member id is known.

This issue was reported in Snitz Forums 3.4.0.3, other versions might also
be affected.

25. Mailtraq Remote Format String SMTP Resource Consumption Vulnerability
BugTraq ID: 7926
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7926
Summary:

Mailtraq is a commercially available e-mail server and client software
package. It is available for the Microsoft Windows platform.

A problem with the software may make a remote denial of service possible.

It has been reported that Mailtraq does not reliably handle format strings
in some SMTP protocol fields. This may cause a system to become unstable
and crash, allowing a remote attacker to deny service to the system.

The problem is in the handling of certain format string sequences. It has
been reported that sending an e-mail with strings such as @@%s%p%n and
%s%p%n to the server in the following fields may consume excessive
resources:

MAIL FROM
RCPT TO
HELO
FROM

Each string must contain 65535 repetitions of the string to successfully
cause the system to become momentarily resource-bound. This can be
automated to result in a prolonged denial of service.

26. Xoops/E-Xoops Tutorials Module Remote Command Execution Vulnerability
BugTraq ID: 7927
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7927
Summary:

Xoops is open-source, freely available web portal software written in
object-oriented PHP. It is back-ended by a MySQL database and will run on
most Unix and Linux distributions.

The Tutorials module allows remote users to upload various content to a
site, including image MIME type. All images are uploaded to the images
directory. This module is also available for E-Xoops.

A vulnerability has been discovered in the function used by Tutorials to
upload images to a site. The problem occurs due to the module failing to
verify that the file being uploaded is indeed an image MIME type.

Due to this lack of input validation, a remote attacker may be capable of
uploading malicious script files to the images directory or possibly other
locations on the system. If a script file were successfully uploaded, an
attacker could subsequently trigger its execution by issuing an HTTP
request for the file.

This would effectively result in the execution of arbitrary system
commands with the privileges of the httpd server, possibly root.

27. Linux-PAM Pam_Wheel Module getlogin() Username Spoofing Privileged Escalation Vulnerability
BugTraq ID: 7929
Remote: No
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7929
Summary:

Linux-PAM (Pluggable Authentication Modules for Linux) is an
authentication system used to enforce various access restrictions and
security mechanisms. The pam_wheel module can be used to enforce access
restrictions to various utilities, such as 'su', using the 'wheel' group.

When the "trust" configuration option is implemented, users of the trusted
group are not required to supply a password when running the 'su' utility.
A configuration option "use_uid" is also available which specifies whether
a user of the trusted group should be verified using the login name or
user id.

A vulnerability has been discovered in the pam_wheel module when running a
configuration with the "trust" option enabled and the "use_uid" option
disabled. The vulnerability occurs due to the insecure use of the
getlogin() function when verifying user login names against a list of
trusted users. It should be noted that the said configuration is not used
by default.

Due to the insecure use of getlogin() a local attacker may be capable of
gaining unauthorized 'root' privileges without supplying a password. This
can be accomplished by spoofing the 'logname' return value, effectively
making the getlogin() function to return a value of another logged in
user. The spoofed user would have to be logged in to the system and also
be part of the trusted group for this to attack take place.

Successful exploitation of this issue would allow an attacker to invoke
the 'su' utility and gain unauthorized superuser privileges.

28. Mailtraq Webmail Remote HTML Injection Vulnerability
BugTraq ID: 7928
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7928
Summary:

Mailtraq is a commercially available e-mail server and client software
package. It is available for the Microsoft Windows platform.

It has been reported that Mailtraq does not sufficiently sanitize
potentially malicious content from e-mails.

The problem is in the filtering of HTML and script code from e-mail header
fields. When this type of content is sent to a user of the vulnerable
webmail service, it is not filtered of HTML tags. This may allow an
attacker to send HTML or script code to users that could result in a
denial of service, theft of authentication cookie credentials or other
attacks.

29. Dantz Retrospect Client StartupItems Insecure Default Permissions Vulnerability
BugTraq ID: 7934
Remote: No
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7934
Summary:

Retrospect is a backup software package distributed by Dantz.

A problem with the software may make local data destruction or privilege
elevation possible.

It has been reported that Retrospect does not create some directories and
files with secure permissions. Because of this, an attacker may be able
to launch symbolic link or other types of attacks.

The problem is in the creation of the directories and files below the
/Library/StartupItems/ directory. These files are created by Retrospect
with world-read and world-write permissions. These files could be changed
to symbolic links, replaced with files of malicious content, or other
scenarios.

30. Pod.Board Forum_Details.PHP Multiple HTML Injection Vulnerabilities
BugTraq ID: 7933
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7933
Summary:

pod.board is a web-based portal/forum system. Implemented in PHP, it is
available for a range of systems, including Unix, Linux, and Microsoft
Windows.

The pod.board 'forum_details.php' script does not sufficiently sanitize
data supplied via URI parameters or web-based input fields, making it
prone to HTML injection attacks. In particular, the 'user_homepage',
'user_location', 'user_nick' and 'user_signature' URI parameters and
corresponding input fields are not properly sanitized of HTML tags. This
could allow for execution of hostile HTML and script code in the web
client of a user who visits a web page that contains the malicious
injected code. This would occur in the security context of the site
hosting the software.

Exploitation could allow for theft of cookie-based authentication
credentials. Other attacks are also possible.

It should be noted, that although this vulnerability has been reported to
affect pod.board version 1.1, other versions might also be affected.

31. Pod.Board New_Topic.PHP Multiple HTML Injection Vulnerabilities
BugTraq ID: 7936
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7936
Summary:

pod.board is a web-based portal/forum system. Implemented in PHP, it is
available for a range of systems, including Unix, Linux, and Microsoft
Windows.

The pod.board 'new_topic.php' script does not sufficiently sanitize data
supplied via URI parameters or web-based input fields, making it prone to
HTML injection attacks. In particular, the 'topic_title' or 'post_text'
URI parameters and corresponding input fields are not properly sanitized
of HTML tags. This could allow for execution of hostile HTML and script
code in the web client of a user who visits a web page that contains the
malicious injected code. This would occur in the security context of the
site hosting the software.

Exploitation could allow for theft of cookie-based authentication
credentials. Other attacks are also possible.

It should be noted, that although this vulnerability has been reported to
affect pod.board version 1.1, other versions might also be affected.

32. Tarantella Enterprise Redirected Keypress Applicaton Control Weakness
BugTraq ID: 7935
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7935
Summary:

A vulnerability has been discovered Tarantella Enterprise versions 3.0
through 3.3. The problem occurs when the "Maximum Users Per Engine"
configuration option has been modified to contain a value greater than 1.
When this occurs, Tarantella may fail to correctly transmit keypresses to
the correct user session, and instead transmit them to another user's
session. These keypresses would then be interpreted by the second user's
application.

This would result in the actions being interpreted by their application,
potentially resulting in unexpected behaviour or data loss.

It is currently unknown whether a remote user could potentially transmit
keypresses to a target user. However, if the transmission is sent to a
random user, an attacker could repeatedly hit a sequence of keypresses
designed to corrupt data. When the unpredictable transmission occurs, the
keypresses would cause a random Tarantella Enterprise user to be
'attacked'.

Other potential scenarios may include a user unexpectedly viewing a second
user's password. Also, if a malicious user were to attempt to trigger a
specific sequence of keypresses, if sent to a user using a specific
application, it may be possible to execute commands or carry out other
forms of attacks.

The precise details regarding this vulnerability are currently unknown.
This BID will be updated when further information is made available.

33. PHPBB Admin_Styles.PHP Theme_Info.CFG File Include Vulnerability
BugTraq ID: 7932
Remote: Yes
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7932
Summary:

phpBB is an open-source web forum application that is written in PHP and
supported by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

It has been reported that phpBB may permit an attacker to influence the
include path of 'theme_info.cfg'. The path to this file can be influenced
by supplying a malicious value for the '$install_to' CGI variable.

While it does not seem possible to supply a path to a remote server, it
may be possible to supply a relative path to a malicious local
'theme_info.cfg' file. This could lead to execution of arbitrary PHP code
with the privileges of the web server. Older versions of PHP may also
permit an attacker to specify a path to an arbitrary system file by
including a NULL byte (%00) in the request, which could reportedly cause
files to be disclosed to the attacker.

34. Noweb/Noroff Insecure Temporary File Creation Vulnerability
BugTraq ID: 7937
Remote: No
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7937
Summary:

noweb is an application designed to automate the process of preparing the
source of a program for human readers.

noroff is a tool that is shipped as part of noweb, noroff is designed to
format documents in a specific manner that have been partially processed
by noweb.

noroff has been reported prone to an insecure temporary file creation
vulnerability. As a result, it may be possible for local attackers to
corrupt files owned by the user who is invoking the noroff application.

An attacker could potentially exploit this issue by creating a symbolic
link in place of the temporary file which is created. Any actions
performed by noroff when it is executed will be performed on the linked
file.

It should be noted that although this vulnerability has been reported to
affect noweb version 2.9a, other versions might also be affected.

35. Microsoft Internet Explorer MSXML XML File Parsing Cross-Site Scripting Vulnerability
BugTraq ID: 7938
Remote: Yes
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7938
Summary:

A vulnerability has been reported for Internet Explorer, using the MSXML
parser, that may result in cross-site scripting attacks. The vulnerability
exists due to the way that the MSXML parser handles certain types of XML
data.

When IE views a XML file, it will automatically attempt to parse it using
the MSXML parser. If IE is unable to parse the XML file, it will display a
parse error that also includes the URL of the requested XML file.

In some instances, the displayed URL is not sufficiently sanitized of
query strings that may have been passed in as URI parameters.

As a result, it is possible for a remote user to create a malicious link
to a site hosting the vulnerable software, which contains hostile HTML and
script code. If this link is visited, the attacker-supplied HTML and
script code will be interpreted by their browser. This will occur in the
context of the site hosting the vulnerable software.

Exploitation may allow theft of cookie-based authentication credentials or
other attacks.

This vulnerability was reported to affect Microsoft Internet Explorer 5.5
and 6.0. It is likely that other applications that use the IE engine are
also vulnerable to this issue.

36. Microsoft Internet Explorer Custom HTTP Error HTML Injection Vulnerability
BugTraq ID: 7939
Remote: Yes
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7939
Summary:

An issue has been reported for Microsoft Internet Explorer that may result
in HTML injection attacks. The vulnerability exists when IE is used to
display custom HTTP error messages also known as "Friendly HTTP error
messages".

IE 5 and later include HTML resource files that are able to display the
custom HTTP errors. A function in the HTML resource files is to extract
the real URL from the document.

When an error occurs, IE will request the following resource:
res://shdoclc.dll/<HTTP STATUS CODE>_HTTP.htm#http://<URL>

Due to some errors when extracting the URL from the above requested
resource, it is possible to cause IE to execute malicious HTML code.

Exploitation may allow theft of cookie-based authentication credentials or
other attacks.

This vulnerability was reported to affect Microsoft Internet Explorer 6.0
SP1 and earlier. It is likely that other applications that use the IE
engine are also vulnerable to this issue.

37. Portmon Host File Option Sensitive File Arbitrary Content Display Vulnerability
BugTraq ID: 7941
Remote: No
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7941
Summary:

Portmon is a freely available, open source network service monitoring
utility. It is available for Unix and Linux operating systems.

A vulnerability in the software may give local users unauthorized access
to sensitive information.

Portmon is typically installed with elevated privileges, as it requires
these privileges to use raw sockets. When the program is executed, and a
file with restricted privileges is supplied as an argument to the hosts
command line argument (-c), the contents of the file are displayed to the
user executing portmon. This could reveal sensitive information to a
malicious local user.

38. Internet Security Systems BlackICE Defender Cross-site Scripting Detection Evasion Weakness
BugTraq ID: 7942
Remote: Yes
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7942
Summary:

BlackICE Defender is a home/small office firewall and intrusion detection
system. It is maintained by Internet Security Systems and is designed for
use on the Microsoft Windows operating system.

A weakness has been reported for BlackICE Defender, which could allow an
attacker to evade the detection of specific forms of attacks.
Specifically, the intrusion detection system fails to match cross-site
scripting attacks embedded within various HTTP requests.

An attacker could potentially exploit this weakness by embedding
cross-site scripting payloads within PUT or DELETE HTTP requests for a
target system. This would effectively evade detection by BlackICE.

A user of BlackICE may be relying on a false sense of security as a result
of this weakness.

This weakness has been reported to affect BlackICE 3.6cbd, however it has
been speculated that earlier versions and possibly other software suites
may also be affected.

39. Armida Databased Web Server Long Request Denial Of Service Vulnerability
BugTraq ID: 7940
Remote: Yes
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7940
Summary:

Armida is a databased web server implementation for Microsoft Windows
operating systems.

Armida Databased Web Server is prone to a denial of service condition when
handling overly long HTTP GET requests. It is possible to reproduce this
condition by making an HTTP GET request that specifies a path to a
resource that is 500,000+ characters in length. This will cause CPU usage
for the server to spike. Multiple requests of this nature could cause a
prolonged denial of service to the system hosting the software.

40. Portmon Log File Option File Overwrite Vulnerability
BugTraq ID: 7943
Remote: No
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7943
Summary:

Portmon is a freely available, open source network service monitoring
utility. It is available for Unix and Linux operating systems.

A problem with the software may give local users the ability to overwrite
information.

Portmon is typically installed with elevated privileges, as it requires
these privileges to use raw sockets. When the program is executed, and a
file with restricted privileges is supplied as an argument to the log file
command line argument, the contents of the file will be corrupted by
portmon. This could result in a denial of service if critical files are
corrupted.

It is not known if files can be corrupted with custom data, though if this
is possible, an attacker may potentially exploit this issue to elevate
privileges.

41. MyServer HTTP Server Directory Traversal Vulnerability
BugTraq ID: 7944
Remote: Yes
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7944
Summary:

MyServer is an application and web server for Microsoft Windows and Linux
operating systems.

The MyServer HTTP server is prone to a file disclosure vulnerability.
Encoded directory traversal sequences may be used to break out of the web
root directory. Attackers may gain access to files that are readable by
the web server as a result.

Successful exploitation may expose sensitive information to remote
attackers. This information could be used to aid in further attacks that
attempt to compromise the host.

It should be noted that although this vulnerability has been reported to
affect MyServer version 0.4.1 other versions might also be affected.

42. Dune HTTP Get Remote Buffer Overrun Vulnerability
BugTraq ID: 7945
Remote: Yes
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7945
Summary:

Dune is a freely available, open source HTTP server for the Unix and Linux
platforms.

A problem with the program may make it possible for an attacker to gain
unauthorized access.

It has been reported that Dune is vulnerable to a remote boundary
condition error when handling long requests. This could allow a remote
attacker to execute arbitrary code on a vulnerable system.

The problem is insufficient bounds checking of HTTP GET requests. By
placing an HTTP GET request of 48 or more bytes, an attacker can cause the
overwriting of sensitive process memory. This could be exploited to
execute code with the privileges of the web server process.

It should be noted that the Dune project is no longer maintained.

43. Squirrelmail Multiple Remote Vulnerabilities
BugTraq ID: 7952
Remote: Yes
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7952
Summary:

SquirrelMail is a webmail program implemented in the PHP4 language. It is
available for Linux and Unix based operating systems.

Multiple vulnerabilities have been reported for SquirrelMail PHP scripts
which could be exploited to carry out a variety of attacks. Successful
exploitation could result in a wide variety of circumstances including
data corruption, information disclosure, and privilege escalation.

These vulnerabilities were reported for SquirellMail 1.2.11, however,
earlier versions may also be affected.

It should be noted that as further analysis is carried out on these
vulnerabilities, each issue will be given their own individual Bugtraq ID.
At that time, this BID will be retired.

44. Proxomitron Proxy Server Long Get Request Remote Denial Of Service Vulnerability
BugTraq ID: 7954
Remote: Yes
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7954
Summary:

Proxomitron is a freely available proxy server. It is available for the
Microsoft Windows platform.

A problem in the software may result in denial of service to legitimate
users.

It has been reported that Proxomitron does not properly handle some string
types. Because of this, an attacker can cause the server to become
unstable and crash.

The problem is in the handling of long strings with mixed characters. It
has been reported that this issue can be reproduced by submitting a string
of at least 4504 characters with dots, slashes, and zero-percent-percent
(0%%) characters in the string.

It should be noted that all references on the web to Proxomitron proxy
software lead to a page with Japanese text that, when translated to
English, means "this page has gone."

45. MiniHTTPServer WebForums Server Remote Directory Traversal Vulnerability
BugTraq ID: 7955
Remote: Yes
Date Published: Jun 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7955
Summary:

WebForums Server is a commercially-available HTTP server. It is available
for the Microsoft Windows platform.

A problem with the server may give remote users unauthorized access to
potentially sensitive information.

It has been reported that WebForums Server does not properly handle some
types of requests. Because of this, attackers may be able to gain access
to files on the host server with the privileges of the web server process.

The problem is in the handling of directory traversal strings. WebForums
Server does not properly sanitize requests. Remote users may request
files using dot-dot-slash (../) requests to gain access to any file on the
system.

46. MidHosting FTP Daemon Shared Memory Local Denial Of Service Vulnerability
BugTraq ID: 7956
Remote: No
Date Published: Jun 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7956
Summary:

MidHosting FTP Daemon is a freely available, open source FTP daemon. It
is available for the Unix and Linux platforms.

A problem with the software may make it possible for an attacker to deny
service to legitimate users.

It has been reported that MidHosting FTP Daemon does not properly
implement shared memory when the m flag (-m) is enabled. Because of this,
an attacker could corrupt process memory, causing the service to crash.

MidHosting FTPd does not sufficiently protect the shared memory from
arbitrary read/write access. An attacker with shell access to a system
using the vulnerable server software could overwrite sections of the
shared memory used by the process.

47. CesarFTP Remote CWD Denial of Service Vulnerability
BugTraq ID: 7949
Remote: Unknown
Date Published: Jun 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7949
Summary:

CesarFTP is a freely available FTP Server for Microsoft Windows operating
systems.

A vulnerability has been reported for CesarFTP. Reportedly, an attacker
may crash a target server by supplying excessive data as the argument to
the 'CWD' command. Specifically, by passing approximately 6500 bytes of
data as an argument to the vulnerable command, it is possible to trigger
the vulnerability.

This may result in the server hanging, effectively denying service to
other legitimate FTP users.

48. Unspecified IBM OS/390 Vulnerability
BugTraq ID: 7958
Remote: Unknown
Date Published: Jun 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7958
Summary:

IBM z/OS, OS/390 and MVS are operating systems for mainframes.

An issue has been reported for the IBM OS/390 systems where integrity is
at a risk.

The precise technical details of this vulnerability are currently uknown.
This BID will be updated if more information becomes available.

49. Alguest Admin Panel Cookie Authentication Bypass Vulnerability
BugTraq ID: 7957
Remote: Yes
Date Published: Jun 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7957
Summary:

Alguest is web-based guestbook based on a mysql database, written in PHP.
It is designed to run on Windows, Linux and Unix variants.

Alguest is prone to an issue, which may allow remote attackers to bypass
authentication procedures and gain administrative access to the software.
The issue presents itself, because the affected software checks only for
the existence of an authentication cookie before granting administrative
access to the software.

The attacker may manually craft a cookie sufficient to bypass the
authentication check and proceed to make an HTTP request for the Alguest
admin panel. Ultimately the fake cookie may bypass the Alguest
authentication procedure and the attacker will gain administrative access
to the guestbook.

50. IBM RACF Profile Updating Privilege Elevation Vulnerability
BugTraq ID: 7959
Remote: No
Date Published: Jun 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7959
Summary:

The IBM Resource Access Control Facility (RACF) is a security application
designed to log activity and enforce various access controls on system
resources and users. It is available for the IBM OS/390 and IBM z/OS
operating systems.

RACF stores user information within profiles, each containing various
segments. Data contained within these segments is used to store
permissions and UserID information to control access to various services
and resources.

A vulnerability has been discovered in the ALTUSER command that can be
used on systems implementing UNIXMAP. The command can be used to modify a
user's profile, specifically to define the UserID and access controls.

It has been discovered if the ALTUSER command is invoked, but the call
fails, various sections of user profile may be incorrectly updated.
Specifically, the UserID of the user is not modified, however the user may
be removed from one access control list and added to another. This is said
to be due to ALTUSER calling the IRRPRE02 module to update this
information before verifying the sanity of the invocation.

This issue may pose as a security risk if the user later attempts to
access privileged applications that authorize access using UserID to
username translation. The result of this translation may indicate the user
has access to the restrict resource when in fact the access control was
updated in error.

It is not currently known whether an unprivileged user, who may invoke the
ALTUSER command, is capable of triggering this vulnerability. The issue
may only occur when an administrator issues an incorrect call to the
program.

51. Sun Management Center Insecure File Permissions Vulnerability
BugTraq ID: 7960
Remote: No
Date Published: Jun 16 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7960
Summary:

Sun Management Center has been reported prone to insecure permissions on
the directories and files it creates.

The issue presents itself, because Sun Management Center does not enforce
sufficient restrictive permissions when creating files and folders. As a
result of this a local attacker may modify Sun Management Center files. A
local attacker may also use symbolic link attacks to make modifications of
arbitrary files with the permissions of the user who is running Sun
Management Center.

The issue is further exacerbated if Sun Management Center is run by the
root user.

52. Avaya Cajun Network Switch Connection Stalling Denial Of Service Vulnerability
BugTraq ID: 7961
Remote: Yes
Date Published: Jun 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7961
Summary:

Cajun Network Switch is the range of network switches distributed by
Avaya.

A problem with the switches may make it possible to deny service to
network users.

It has been reported that Cajun switches do not properly handle traffic to
port 4000. Because of this, an attacker may be able to cause the switch
to stall for period of time.

The problem is in the handling of strings at least five bytes. When a
string, such as \x80dupa, is sent to the switch on this port, the device
stalls then reboots. This can be continued when the switch reboots to
result in a prolonged denial of service.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. Guess settles with FTC over cybersecurity snafu
By Kevin Poulsen

How a whistle-blowing hacker's revelations gave the fashion retailer a
federal case.

http://www.securityfocus.com/news/5968

2. Security Researchers Nibble at Bluetooth
By Kevin Poulsen

The wireless standard gets its first hackers.

http://www.securityfocus.com/news/5896

3. Spam Bill Gains In Senate
By Jonathan Krim, Washington Post

The Senate Commerce Committee unanimously approved legislation yesterday
to combat unwanted commercial e-mail, as the first of several anti-spam
bills in both houses of Congress advanced.

http://www.securityfocus.com/news/5988

4. Meet Stumbler: Next Gen port scanning malware
By John Leyden, The Register

Security experts are tracking the spread of a mysterious piece of malware
which has been linked to an upsurge in distributed port scanning on the
Internet.

http://www.securityfocus.com/news/5987

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. socklog v1.1.0
by Gerrit Pape [email protected]
Relevant URL:
http://smarden.org/socklog/
Platforms: BSDI, FreeBSD, OpenBSD
Summary:

socklog cooperates with the daemontools package to create a small and
secure replacement for syslogd. socklog supports system logging through
Unix domain sockets (/dev/log) and UDP sockets (0.0.0.0:514) with the help
of daemontools svscan, supervise, and multilog. socklog provides a
different network logging concept, and also does log event notification.
multilog has built in log file rotation based on file size, so there is no
need for any cron jobs to rotate the logs. socklog is small, secure, and
reliable.

2. GkrellMMS v2.1.12
by Sjoerd Simons [email protected]
Relevant URL:
http://gkrellm.luon.net/gkrellmms.phtml
Platforms: Linux, POSIX
Summary:

GkrellMMS is a plugin for controlling XMMS from within GKrellM.

3. TinyCA v0.4.5
by Stephan Martin
Relevant URL:
http://tinyca.sm-zone.net/
Platforms: Linux, OpenNMS, POSIX
Summary:

TinyCA is a simple GUI written in Perl/Tk to manage a small certification
authority. It is based on OpenSSL and Perl modules from the OpenCA
project. TinyCA lets you manage x509 certificates. It is possible to
export data in PEM or DER format for use with servers, as PKCS#12 for use
with clients, or as S/MIME certificates for use with email programs. It is
also possible to import your own PKCS#10 requests and generate
certificates from them.

4. softflowd v0.8.1
by Damien Miller
Relevant URL:
http://www.mindrot.org/softflowd.html
Platforms: OpenBSD
Summary:

softflowd is a software flow-based network monitor. It tracks network
traffic flows and report aggregate statistics as well as (optionally)
export Cisco Netflow v1 compatible datagrams. It can listen on a
promiscuous network interface or read store pcap capture files, and
includes a sophisticated control interface.

5. Coyote Linux 2.0.0-pre5
by Joshua Jackson
Relevant URL:
http://www.coyotelinux.com/
Platforms: Linux
Summary:

Coyote Linux is a single floppy distribution for people who have an
Internet connection that they wish to share with other computers on a LAN.
In addition to connection sharing, it also provides firewall services to
help protect the internal network. The goal of the Coyote project is to
make it as quick and easy as possible to share an Internet connection.

6. ADMLogger - Default branch v1.0
by Aaron D. Marasco
Relevant URL:
http://www.fireparse.com/
Platforms: Linux
Summary:

ADMLogger is a log analyzing engine. Using this core, users could easily
build upon it with plugins. With very little Perl programming knowledge,
it may become a powerful tool in a System Administrator's toolbox.
ADMLogger creates email reports that can be formatted plain text or full
HTML, which is up to the plugin designers to support. The main system has
an HTML preference, so if your plugin ignores it, so be it. ADMLogger will
also remove all filtered entries from the main syslog file into a second
file so your other entries are more noticable.

V. SECURITY JOBS SUMMARY
------------------------
1. Senior Consultant #793 - Seattle,WA - Salary $90k-$110k (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325933

2. Security Consultant #787 - Chicago, IL - $90k - $105k (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325935

3. Security Intern, Dublin, OH (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325938

4. Director of Engineer-Product Development-Application Security #777 - Dulles, VA - $120k - $150k base (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325932

5. Training Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325928

6. IT Auditor CISA - required in Hong Kong (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325911

7. Disaster Recovery Specialist position in PA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325913

8. Disaster Recovery Admin w/ Strohl product knowledge (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325655

9. Senior Security Consultant - Seattle / Tacoma / Puget Sound Area, WA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325623

10. Immediate Openings Support Engineers (Sunnyvale CA) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325488

11. Security Engineer, Manager, CISSP seeking leads in SF Bay area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325491

12. Messaging Security Specialist needed in Washington, DC / Northern VA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325494

13. Washington, DC area Project / Systems Engineers needed (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325490

14. Firewall Expert Needed for Washington, DC job (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325487

15. Senior Security Architect - Seattle, WA - Contract to Hire - Local Candidates Preferred. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325486

16. Sr Security Sales / Business Dev Manager - Auckland New Zealand (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325492

17. Security specialist contract - canada (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325298

18. IT Security Consultant (CHECK Team Leader), London, UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325275

19. Internet Security Architect contract position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325274

20. New articles available on SecurityFocus (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325252

21. Intrusion Detection & Incident Response - Chicago, IL (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325247

22. Principal Security Consultant (CLAS), UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325246

23. Security Engineer Contract Position in TX or Bay Area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325245

24. NJ Systems Architect (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325244

25. Security expert for $25/hr (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325243

26. Neoteris is hiring!!! - PR/Media Relations Manager - Silicon Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325249

27. Neoteris is hiring!!! - SR Tech Support Engineer - Silicon Valley (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325248

28. Neoteris is hiring!!! - Regional Sales Manager - Scandic (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325253

29. Neoteris is hiring!!! - Regional Sales Manager - Federal (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325241

30. Pre-Sales Engineers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325238

31. Security Engineers needed in Denver! (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325239

32. Enterprise Security Architect--NJ/Full-time (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325063

33. Posting for another party - Director, Information Security NYC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/325064

VI. INCIDENTS LIST SUMMARY
-------------------------
1. FW: IANA Reserved IP Source scans 55808 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325936

2. odd RST packets with 55808 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325929

3. sdbot variant and WS 55808 activity (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325930

4. Unusual registry entries (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325937

5. sdbot variant and WS 55808 activity (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325934

6. SNMP search for printers? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325931

7. One observed pattern of Win 55808 packets (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325748

8. chkrootkit and LKM? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325717

9. sdbot variant and port 55808 activity (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325712

10. Spoofed TCP SYNs w/Winsize 55808 (was: Help with an odd log file...) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325713

11. UDP/41170 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325537

12. Wierd Profile in Document Settings (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325530

13. Help with identifying scan/attack (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325324

14. File on desktop called "~" (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325303

15. Odd windows ICMP... any ideas what this is? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325302

16. Windows 2k rootkit incident, files zipped for your pleasure. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325097

17. Windows 2k rootkit incident, files zipped for your pleasure. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/325092

VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Java class obfuscation (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/325874

2. Question (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/325718

3. Formatstrings on *BSD (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/325719

4. Black Hat Briefings 2003 - Announcement (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/325720

5. Microsoft Access 97 MDW files (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/325630

6. IE exposing URLs to msn.com and alexa.com? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/325851

7. Directory traversal vulnerability on Xoops/E-xoops CMS module "tutorials" (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/325221

8. Research on Source Code Review -C (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/325220

9. Sphera Hosting Director Control Panel Multiple Vulnerabilities: XSS-Session Hijacking-DoS/Buffer Overflow-Another User Accounts access (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/325222

10. shellcode with standard characters (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/324981

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Filtering DHCP Assignments by MAC Address (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/325993

2. Windows Event Logs (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/325991

3. NTRootkit (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/325992

4. Article Announcement: Tracking Down the Phantom Host (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/325871

5. Question regarding su.exe (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/325467

6. Administrivia: OOO Messages (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/325273

7. SecurityFocus Microsoft Newsletter #141 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/325268

8. Local User Permissions in a Public, Domain Environment? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/325263

IX. SUN FOCUS LIST SUMMARY
----------------------------

1. Package Log for Solaris (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/325670

2. Solaris Patch Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/325540

3. New SecurityFocus Article (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/325416

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. deny deleting a file for users.. trying a solution (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/325669

2. New SecurityFocus Article (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/325414

XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: IBM

SecureWorld: IBM's End-To-End Security Conference, August 25-29, 2003,
Miami Beach, Florida

For more information or to enroll, visit:
http://www.securityfocus.com/IBM-sf-news
-------------------------------------------------------------------------------