SecurityFocus Newsletter #203
<[email protected]> 30 Jun 2003 16:15:08 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #203
-----------------------------
This Issue is Sponsored by: Tenable
Tenable Network Security offers a Vulnerability Management Product.
"Lightning 1.1 is a next-generation security software solution that
thoughtfully combines relevant security data from vulnerability scans and
intrusion detection devices to help enterprises reduce network exposure.
Its design is definitely unique and highly scalable when compared to
others in our industry," says Ron Gula, President and CTO of Tenable.
Please visit: http://www.securityfocus.com/TenableSecurity-sf-news
--------------------------------------------------------------------------
I. FRONT AND CENTER
1. IDS Correlation of VA Data and IDS Alerts
2. RFID Chips Are Here
3. The SecurityFocus 4th Anniversary Contest
II. BUGTRAQ SUMMARY
1. WebFS Request-URI Buffer Overflow Vulnerability
2. osh Environment Variable Buffer Overflow Vulnerability
3. osh File Redirection Buffer Overflow Vulnerability
4. WebJeff Filemanager File Disclosure Vulnerability
5. WebJeff Filemanager Plain Text Password Storage Vulnerability
6. Traceroute-Nanog Integer Overflow Memory Corruption Vulnerability
7. Progress 4GL Compiler Datatype Buffer Overflow Vulnerability
8. Zope Empty Upload Information DisclosureVulnerability
9. Zope addItems Script Information Disclosure Vulnerability
10. Zope Invalid Query Information Disclosure Vulnerability
11. Zope ExampledbBrowseReport Description Field HMTL Injection...
12. Linux /proc Filesystem Potential Information Disclosure...
13. GNU GNATS PR-Edit Command Line Option Heap Corruption...
14. GNU GNATS PR-Edit Lock File Buffer Overflow Vulnerability
15. GNU GNATS Environment Variable Buffer Overflow Vulnerability
16. IndigoSTAR Software PerlEdit Denial Of Service Vulnerability
17. QNX Demo Web Server Directory Traversal Vulnerability
18. Symantec Security Check RuFSI ActiveX Control Buffer Overflow...
19. MyServer Remote Denial Of Service Vulnerability
20. Compaq Web-Based Management Agent Multiple Remote Vulnerabilities
21. Tutos File_Select.PHP Cross-Site Scripting Vulnerability
22. XMB Forum Multiple Cross-Site Scripting And HTML Injection...
23. Tutos File_New Arbitrary File Upload Vulnerability
24. Compaq Web-Based Management Agent Remote Stack Overflow Denial...
25. Compaq Web-Based Management Agent Access Violation Denial of...
26. Microsoft Internet Explorer HR Align Buffer Overflow...
27. Armida Databased Web Server Remote GET Request Denial Of...
28. VisNetic WebMail Information Disclosure Vulnerability
29. Compaq Web-Based Management Agent Remote File Verification...
30. tcptraceroute Failure To Relinquish Root Privileges Weakness
31. LBreakOut2 Login Remote Format String Vulnerability
32. Gkrellmd Remote Buffer Overflow Vulnerability
33. Alt-N WebAdmin USER Parameter Buffer Overflow Vulnerability
34. Multiple GuestBookHost HTML Injection Vulnerabilities
35. Sharp Zaurus Samba Server Unauthorized Remote Filesystem...
36. SGI IRIX IPV6 InetD Port Scan Denial Of Service Vulnerability
37. SGI IRIX Snoop Unspecified Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. AT&T lets phone fraud victims off the hook
2. I am not the Spammer you think I am
3. Techno cops needed to catch cyber criminals - Blunkett
IV. SECURITYFOCUS TOP 6 TOOLS
1. SURVIVOR v0.9.2b
2. MIMEDefang v2.34
3. heartbeat v0.2
4. DSPAM v2.6.1
5. Python milter v0.5.5
6. Traffic tool Troll v1.0
V. SECURITYJOBS LIST SUMMARY
1. Expert in Security Event Management (as well as other things)...
2. Professional Services Opportunities in E-Commerce Security...
3. Incident Analyst Position, Dublin Ireland (Thread)
4. Expert in Firewall,VPN and IDS (Thread)
5. Security Architect - Technical Architect Security - London...
6. HELP! - IMMEDIATE OPENING - Vulnerability Assessment - Reston...
7. Business Development Manager Information Security / Saudi...
8. Senior Scientist, Risk Assessments - Chicago, IL - Greythorn...
9. Security Manager vacancy (Thread)
10. IT Internship (Thread)
11. Anti-SPAM/IDS Architect needed (Thread)
12. NT Security expert (Thread)
13. IMMEDIATE OPENING - Sr. IDS Manager - Bethesda, MD (Thread)
14. Certification & Accreditation Specialist (Thread)
15. Operations / Project Manager role in Amsterdam , Holland (Thread)
16. Secure VoIP, Wireless Engineer Needed in Baltimore Area (Thread)
17. Security LAN/WAN Opportunity (BS+8, US Citizen, DC area) (Thread)
18. Information Security Administrator opportunity -- Dallas, TX...
19. Location Update: Looking for security analyst (Thread)
20. Location Upate: Looking for security analyst (Thread)
21. Looking for security analyst (Thread)
22. Intrusion Detection & Incident Response - Chicago, IL (Thread)
23. HIPPA consultant in BOSTON (Thread)
VI. INCIDENTS LIST SUMMARY
1. Traffic with 55808 tcp windows size: news. (Thread)
2. strange logs -- tcp port 16166 (Thread)
3. War Dial on my PBX (Thread)
4. Questionable UDP traffic received by firewall (Thread)
5. Intrusec 55808 Trojan Analysis (Thread)
6. Scan from Philipine Center on Transnational Crime (Thread)
7. kuag2 again? (Thread)
8. chkrootkit and LKM? (Thread)
9. sdbot variant and WS 55808 activity (Thread)
10. ISS "Stumbler" advisory questions (Thread)
11. Unusual registry entries (Thread)
12. sdbot variant and port 55808 activity (Thread)
13. Spoofed TCP SYNs w/Winsize 55808 (was: Help with an odd lo...
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Starting on Assembly under win32 (Thread)
2. GetPC code (was: Shellcode from ASCII) (Thread)
3. Getting Base Address using the Structured Exception Handler...
4. Shellcode from ASCII (Thread)
5. Windows Shellcode Writing (Thread)
6. file hiding under Linux (Thread)
7. portmon <=1.8 buffer over flow ! (Thread)
8. remote command execution in multiple languages (Thread)
9. exploiting a binary if %edi can be overwritten? (Thread)
10. crashing explorer with file properties (Thread)
11. Java class obfuscation (Thread)
12. Myserver 0.4.1 DOS... (Thread)
13. Formatstrings on *BSD (Thread)
14. [Full-Disclosure] Java class obfuscation (Thread)
15. IE exposing URLs to msn.com and alexa.com? (Thread)
16. EXEC SHIELD - new Linux security feature (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. How to block users from installing other apps (Thread)
2. SP4 instalation failure (Thread)
3. Xp Home (Thread)
4. security auditing under windows 2000 server (Thread)
5. Windows NLB (Thread)
6. AW: Question about windows service (Thread)
7. Question about windows service (Thread)
8. Please read. Post containing BugBear.B (Thread)
9. Search for files and folders fails (Thread)
10. additional Windows 2000 password policy questions (Thread)
11. Windows 2000 password policy (Thread)
12. Managing Windows Event Logs (Thread)
13. Filtering DHCP Assignments by MAC Address (Thread)
14. Microsoft Baseline Security Analyzer (Thread)
15. SecurityFocus Microsoft Newsletter #142 (Thread)
16. adding new service to system services list (Thread)
17. Netreg for Windows (Thread)
18. Windows Event Logs (Thread)
IX. SUN FOCUS LIST SUMMARY
1. SPARC assembly - a beginner's question... (Thread)
2. Administrivia (X-Post) (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Administrivia (X-Post) (Thread)
2. Linux firewall/IDS/NAT ** IMPORTANT ** (Thread)
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. IDS Correlation of VA Data and IDS Alerts
By Neil Desai
This article discusses the correlation of VA data and IDS alerts to help
prioritize events and reduce the time it takes to sift through events.
http://wwwdev.securityfocus.com/infocus/1708
2. RFID Chips Are Here
By Scott Granneman
RFID chips are being embedded in everything from jeans to paper money, and
your privacy is at stake.
http://www.securityfocus.com/columnists/169
3. The SecurityFocus 4th Anniversary Contest
Enter to win two passes to the Black Hat Briefings.
Please visit the contest page here:
http://www.securityfocus.com/contest
II. BUGTRAQ SUMMARY
-------------------
1. WebFS Request-URI Buffer Overflow Vulnerability
BugTraq ID: 7990
Remote: Yes
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7990
Summary:
WebFS is a simple web server that serves static content. It is available
for Linux and Unix variant operating environments.
A buffer overflow vulnerability has been reported for WebFS that may
result in the execution of attacker-supplied code. The vulnerability
exists in the parse_request() function of the request.c source file and is
due to insufficient bounds checking on an overly long Request-URI HTTP
request.
Successful exploitation of this vulnerability will result in the
corruption of sensitive memory with attacker-supplied values and the
execution of code.
This vulnerability affects WebFS 1.1.8 and earlier.
2. osh Environment Variable Buffer Overflow Vulnerability
BugTraq ID: 7992
Remote: No
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7992
Summary:
osh Operator Shell is a security enhanced, restricted shell. It allows a
system administrator to restrict access to special commands and files to
certain users. The osh shell is a setuid root shell.
A buffer overflow vulnerability has been reported for osh when processing
environment variables. The problem likely occurs due to insufficient
bounds checking when copying environment data into an internal memory
buffer. As a result, it may be possible for a malicious local user to
corrupt osh process memory in such a way as to redirect execution flow.
Although unconfirmed, this buffer overflow may be exploited to execute
arbitrary code with superuser privileges.
The precise technical details of this vulnerability are currently unknown.
This BID will be updated as further information is available.
This vulnerability was reported to affect osh 1.7.
3. osh File Redirection Buffer Overflow Vulnerability
BugTraq ID: 7993
Remote: No
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7993
Summary:
osh Operator Shell is a security enhanced, restricted shell. It allows a
system administrator to restrict access to special commands and files to
certain users. The osh shell is a setuid root shell.
A buffer overflow vulnerability has been reported for osh when processing
file redirection commands. The problem likely occurs due to insufficient
bounds checking when copying environment data into an internal memory
buffer. As a result, it may be possible for a malicious local user to
corrupt osh process memory in such a way as to redirect execution flow.
Although unconfirmed, this buffer overflow may be exploited to execute
arbitrary code with superuser privileges.
The precise technical details of this vulnerability are currently unknown.
This BID will be updated as further information is available.
This vulnerability was reported to affect osh 1.7.
4. WebJeff Filemanager File Disclosure Vulnerability
BugTraq ID: 7995
Remote: Yes
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7995
Summary:
WebJeff Filemanager is a file management system implemented in PHP. It is
available for a variety of platforms including Microsoft Windows and Linux
and Unix variant operating environments.
A vulnerability has been reported for Filemanager that may result in the
disclosure of arbitrary files. The vulnerability exists due to
insufficient sanitization of user-supplied values for URI parameters.
Specifically, the 'ficher' URI parameter of the index.php3 script file is
not properly sanitized.
A malicious attacker can specify arbitrary absolute paths as the value of
the 'ficher' URI parameter. This will result in the requested file being
disclosed to the attacker.
This vulnerability affects Filemanager 1.6.
5. WebJeff Filemanager Plain Text Password Storage Vulnerability
BugTraq ID: 7996
Remote: Yes
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7996
Summary:
WebJeff Filemanager is a file management system implemented in PHP. It is
available for a variety of platforms including Microsoft Windows and Linux
and Unix variant operating environments.
A vulnerability has been reported for Filemanager that may result in an
attacker obtaining authentication credentials. The vulnerability exists
due to the way usernames and passwords are stored. Specifically,
authentication credentials are stored in plain text format in the
'prive/users.txt' file.
An attacker can exploit this vulnerability by making a request for the
desired resource.
Any information obtained in this manner may be used to launch further
attacks against a vulnerable system.
This vulnerability was reported for Filemanager 1.6.
6. Traceroute-Nanog Integer Overflow Memory Corruption Vulnerability
BugTraq ID: 7994
Remote: No
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7994
Summary:
Traceroute is a tool that is used to track packets in a TCP/IP network to
determine the path of network connections. Tracroute-Nanog is installed
setuid root on most systems, as it requires the use of raw sockets.
An integer overflow vulnerability has been reported for Traceroute-Nanog.
It has been reported that when processing certain user-supplied max_ttl
and nprobes values from a traceroute invocation, some functions or
utilities may fail to sufficiently handle integer wrapping.
Specifically, the issue presents itself when a large value is passed to
the affected application via the '-q' (nprobes) and '-m' (max_ttl) command
line arguments. If values of sufficient size are passed, when it is used
in subsequent boundary calculations (nprobes (-q) * max_ttl (-m)) the
integer value may wrap, causing it to be interpreted as a negative value
and thus bypassing boundary checks. This may result in excessive data
being copied into an insufficient memory space, effectively corrupting
adjacent heap based memory management structures.
Because the attacker can control arbitrary memory corruption, although
conjectured and unconfirmed, the attacker might exploit this condition to
execute arbitrary instructions with elevated privileges.
It should be noted that this vulnerability might only affect the Debian
implementation of Traceroute-Nanog.
7. Progress 4GL Compiler Datatype Buffer Overflow Vulnerability
BugTraq ID: 7997
Remote: No
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7997
Summary:
A vulnerability has been discovered in the Progress 4GL Compiler. The
problem lies in the processing of user-defined data types when compiling
.p Progress files. Specifically, due to insufficient bounds checking a
buffer overrun may occur when calling the memmove() function.
A user may define a data type using 'def var VarName as Value'. A defined
data type of excessive size, approximately 364 bytes, may trigger the
memory corruption within the compiler, effectively corrupting adjacent
process memory.
Due to this memory corruption, it has been reported that an attacker may
be capable of overwriting the saved frame pointer and return address of
the affected function. This would effectively allow the attacker to seize
control of the compiler's execution flow, possibly redirecting it to
attacker-supplied instructions.
This vulnerability may ultimately be exploited to execute arbitrary code
with the privileges of the user invoking the compiler.
It should be noted that although Progress 4GL Compiler is installed setuid
root, privileges are effectively dropped before the memory corruption
occurs.
8. Zope Empty Upload Information DisclosureVulnerability
BugTraq ID: 7998
Remote: Yes
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7998
Summary:
Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.
Reportedly, Zope will disclose path information if a user invokes an
upload operation via the 'addFile' script when a target file does not
exist as a URI parameter. An error will be triggered and traceback
information containing possible sensitive path information will be
returned to the browser of the attacker.
If an attacker can gain information about the details of the filesystem,
this information may be useful in further attacks against the host.
9. Zope addItems Script Information Disclosure Vulnerability
BugTraq ID: 7999
Remote: Yes
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7999
Summary:
Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.
A vulnerability has been discovered in Zope which may result in the
disclosure of sensitive information to a remote attacker. The problem
occurs when a value greater then 11 is passed as the records URI parameter
to the addItems script. When this occurs, an exception will be triggered
causing the server to return an error page containing sensitive system
information.
Information disclosed may include session identification, the script
installation paths, the application installation path, etc.
Access to this information could potentially aid an attacker in launching
further attacks against the system.
10. Zope Invalid Query Information Disclosure Vulnerability
BugTraq ID: 8000
Remote: Yes
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8000
Summary:
Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.
Reportedly, Zope will disclose path information if a user invokes an
invalid query operation using Shopping cart example scripts. An error will
be triggered and traceback information containing possible sensitive path
information will be returned to the browser of the attacker.
If an attacker can gain information about the details of the filesystem,
this information may be useful in further attacks against the host.
11. Zope ExampledbBrowseReport Description Field HMTL Injection
Vulnerability
BugTraq ID: 8001
Remote: Yes
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8001
Summary:
Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.
It has been reported that Zope ExampledbBrowseReport example script
suffers from an HTML injection vulnerability. The problem is said to occur
due to insufficient input validation of user-supplied form data.
Specifically, it is possible to embed HTML code within the 'Description'
field of the Zope ExampledbBrowseReport example script.
All script code will be interpreted by the browsers of other Zope users,
who view the affected page, within the context of the site hosting the
affected script.
The successful exploitation of this issue could ultimately result in the
attacker obtaining cookie-based authentication credentials or other
sensitive information, which, could be used to impersonate the other user.
12. Linux /proc Filesystem Potential Information Disclosure Vulnerability
BugTraq ID: 8002
Remote: No
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8002
Summary:
A potential information disclosure vulnerability has been reported for the
Linux /proc filesystem. The problem occurs specifically when invoking a
setuid application.
The problem lies in the permissions of the /proc/PID/environ file when the
file has been accessed prior to privilege elevation. It has been reported
that, if the environ file has been opened by a user application, forking
and invoking a setuid application will not in fact modify the ownership of
the open file. As a result, an attacker may be capable of reading the
environment data of a privileged process.
This may pose a security risk as the application may place sensitive or
privileged information within it's environment. Access to this information
could theoretically aid an attacker in launching further attacks against a
target system.
It has been conjectured that this issue affects the 2.2 and 2.4 Linux
kernel trees. This, however has not been confirmed by Symantec. This
information will be updated as further information becomes available.
13. GNU GNATS PR-Edit Command Line Option Heap Corruption Vulnerablity
BugTraq ID: 8003
Remote: No
Date Published: Jun 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8003
Summary:
GNU GNATS is a freely available bug tracking system. It is available for a
variety of Linux and Unix variant operating environments.
The pr-edit utility is shipped as part of GNATS and is intended as an
editor for problem reports. The pr-edit utility is a setuid utility
typically with UID 'gnats' privileges.
A heap overflow vulnerability has been reported for the pr-edit utility.
The vulnerability occurs due to insufficient checks performed on the
arguments to the '-d' commandline option.
The vulnerability exists due to the improper use of the sprintf()
function. Due to this a determined attacker can invoke pr-edit with a
malicious '-d' commandline argument to trigger the heap corruption
vulnerability.
Successful exploitation may result in the execution of attacker-supplied
code with potentially elevated privileges.
It should be noted that on some systems, the pr-edit utility may be
installed with setuid 'root' privileges.
This vulnerability was reported to affect GNATS 3.002.
14. GNU GNATS PR-Edit Lock File Buffer Overflow Vulnerability
BugTraq ID: 8004
Remote: No
Date Published: Jun 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8004
Summary:
GNU GNATS is a freely available bug tracking system. It is available for a
variety of Linux and Unix variant operating environments.
The pr-edit utility is shipped as part of GNATS and is intended as an
editor for problem reports. The pr-edit utility is a setuid utility
typically with UID 'gnats' privileges.
A stack overflow vulnerability has been reported for the pr-edit utility.
The vulnerability occurs when pr-edit locks a file for reading. If a file
is locked, pr-edit will read the file to output a message stating the user
that locked the file. Due to the improper use of fscanf(), there are no
bounds checks performed on the length of the user that locked the file.
An attacker can exploit this vulnerability by creating a lock file
containing over 2000 bytes. This will trigger the buffer overflow
condition when pr-edit attempts to read the file.
Successful exploitation may result in the execution of attacker-supplied
code with potentially elevated privileges.
It should be noted that on some systems, the pr-edit utility may be
installed with setuid 'root' privileges.
This vulnerability was reported to affect GNATS 3.002.
15. GNU GNATS Environment Variable Buffer Overflow Vulnerability
BugTraq ID: 8005
Remote: No
Date Published: Jun 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8005
Summary:
GNU GNATS is a freely available bug tracking system. It is available for a
variety of Linux and Unix variant operating environments.
It has been reported that GNATS is prone to a buffer overflow condition
when parsing certain environment variables. Specifically, the configure()
function of the config.c source file does not perform proper bounds checks
on the GNATS_ROOT function.
An attacker can exploit this vulnerability by setting an overly long
GNATS_ROOT environment variable, consisting of at least 5000 characters,
and invoking one of several GNATS utilities. This will trigger the
overflow condition and will result in the corruption of sensitive memory.
The following utilities have been reported to be affected: pr-edit,
queue-pr, gen-index
The affected utilities are typically installed with setuid 'gnats'
privileges however, on some systems, they may be installed with setuid
'root' privileges.
Successful exploitation may result in the execution of attacker-supplied
code with elevated privileges.
This vulnerability was reported to affect GNU GNATS 3.113.1 and 3.113.
16. IndigoSTAR Software PerlEdit Denial Of Service Vulnerability
BugTraq ID: 8006
Remote: Yes
Date Published: Jun 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8006
Summary:
PerlEdit is a IDE (Integrated Development Environment) for developing Perl
scripts. It is maintained and distributed by IndigoSTAR Software. It is
available for Linux variant and Microsoft Windows operating systems.
A denial of service vulnerability has been reported for PerlEdit. The
vulnerability exists when an connection is made to TCP port 1956.
When PerlEdit is executed, it will bind to TCP port 1956. If an attempt is
made to connect to that port while PerlEdit is running, it will cause
PerlEdit to crash.
An attacker can exploit this vulnerability to connect to a vulnerable host
on port 1956. This will cause the vulnerable PerlEdit application to
crash.
This vulnerability was reported to affect PerlEdit 1.07.
17. QNX Demo Web Server Directory Traversal Vulnerability
BugTraq ID: 8007
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8007
Summary:
The demo disk is a QNX marketing software package distributed by QNX.
A problem with the software may make it possible to violate security
policy.
The QNX demo disk comes with a web server that has been reported to be
vulnerable to a directory traversal attack. It may be possible to gain
unauthorized access to files on the demo system.
It should be noted that this software package is a demonstration disk
distributed as a marketing tool by QNX circa 1998. It was not meant as a
production deployment of the operating system.
By passing dot-dot-slash (../) directory traversal sequences to the web
server distributed on the disk, it is possible to gain access to any file
on the disk with the privileges of the web server process. The web server
process typically runs with administrative privileges.
18. Symantec Security Check RuFSI ActiveX Control Buffer Overflow
Vulnerability
BugTraq ID: 8008
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8008
Summary:
RuFSI is a utility class distributed as part of the ActiveX control for
the Symantec Security Check web service.
A vulnerability in the ActiveX control has been reported that may result
in unauthorized access.
It has been reported that the RuFSI Utility Class is vulnerable to a
boundary condition error when invoked with long strings. This could
potentially lead to the execution of code with the privileges of the user
executing the web browser.
This problem requires that a user with the vulnerable control installed
visit a web page that invokes the control with a string of excessive
length. Upon doing so, it may be possible to create an exploitable stack
overflow condition that results in the overwriting of sensitive process
memory.
19. MyServer Remote Denial Of Service Vulnerability
BugTraq ID: 8010
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8010
Summary:
MyServer is an application and web server for Microsoft Windows and Linux
operating systems.
MyServer HTTP server has been reported prone to a remote denial of service
attack.
The issue presents itself, likely due to a lack of sufficient bounds
checking, performed on arguments that are supplied via malicious HTTP GET
requests. It has been reported that a remote attacker may invoke a HTTP
GET request containing 100 '/' characters, this action will supposedly
trigger a segmentation fault in the server executable and the software
will fail. It has been reported that no details of this attack are logged.
Due to the nature of this vulnerability it has been conjectured that this
issue may be exploited to execute arbitrary code. This however has not
been confirmed.
It should be noted that although this issue has been reported to affect
MyServer version 0.4.1 other versions might also be affected.
20. Compaq Web-Based Management Agent Multiple Remote Vulnerabilities
BugTraq ID: 8009
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8009
Summary:
Web-Based Management Agent is the remote system management software
package distributed by Compaq. It is available for the Microsoft Windows
platform.
It may be possible for a remote attacker to gain unauthorized access to a
host using the vulnerable software.
The Compaq Web-Based Management Agent may permit an attacker to create one
of the following scenarios:
Numerous stack overflows are reported to exist in the management agent.
By passing one of several combinations of tags to the web server for
server-side command interpreting, it is possible for an attacker to crash
the agent, resulting in a denial of service. It is not clear whether or
not these issues may be exploited to execute code with the privileges of
the web server process.
Another reported issue appears to be a boundary condition error that may
be exploitable. By supplying a request with a length of at least 250
bytes to the FunctionContentType function, it is possible to cause an
"Access violation," which may be a memory corruption issue.
A final reported issue is the ability of a remote user to validate files
on a system. By passing a maliciously crafted request to the
DebugSearchPaths function, an attacker may be able to validate the
existence of certain files on the system, potentially resulting in
information disclosure.
This vulnerability alert is a preliminary analysis. These vulnerabilities
will be broken into specific entries as more detailed analysis is
performed.
21. Tutos File_Select.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 8011
Remote: Yes
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8011
Summary:
Tutos is a freely available, open source team organization software
package. It is available for the Unix, Linux, and Microsoft Windows
platforms.
A problem in the software may make the execution of arbitrary code
possible.
It has been reported that Tutos does not properly handle input to the
file_select script. Because of this, an attacker may be able to execute
code in the browser of another user with the privileges of the vulnerable
site.
The problem is in the rendering of arbitrary HTML and script code by
Tutos. An attacker may supply code as an argument to the file_select
script that, when loaded in the browser of another user, is executed in
the security context of the site hosting Tutos. This could permit the
theft of cookie authentication credentials, Other attacks may also be
possible.
22. XMB Forum Multiple Cross-Site Scripting And HTML Injection
Vulnerabilities
BugTraq ID: 8013
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8013
Summary:
XMB Forum is a web-based discussion forum.
XMB Forum has been reported prone to multiple cross-site scripting and
HTML injection vulnerabilities.
The issues present themselves due to insufficient sanitization of remote
user supplied data. An attacker may supply HTML or script code as the
member URI parameter passed to the member.php script or supply HTML and
script code as a value for the action URI parameter passed to the
buddy.php script. Additionally it has been reported that an authenticated
attacker may inject malicious HTML or script code into the 'Current Mood'
text box on the profiles page.
An attacker may exploit any one of these vulnerabilities to execute
arbitrary script code in the browser of an unsuspecting user.
It may be possible to steal the unsuspecting user's cookie-based
authentication credentials, as well as other sensitive information. Other
attacks may also be possible.
23. Tutos File_New Arbitrary File Upload Vulnerability
BugTraq ID: 8012
Remote: Yes
Date Published: Jun 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8012
Summary:
Tutos is a freely available, open source team organization software
package. It is available for the Unix, Linux, and Microsoft Windows
platforms.
A problem in the software may make the uploading of arbitrary files
possible.
It has been reported that Tutos does not properly handle input to the
file_new script. Because of this, an attacker may be able to upload
arbitrary files to a vulnerable site.
It is not clear where the specific vulnerable component of Tutos lies.
However, because of the problem, it may be possible for an attacker to
upload and overwrite files with the privileges of the web server process.
This could result in data corruption, or other potentially malicious
activities.
24. Compaq Web-Based Management Agent Remote Stack Overflow Denial of
Service Vulnerability
BugTraq ID: 8014
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8014
Summary:
Web-Based Management Agent is the remote system management software
package distributed by Compaq. It is available for the Microsoft Windows
platform.
Compaq Web-Based Management Agent has been reported prone to a remote
denial of service vulnerability. The problem occurs when making malformed
requests to the service. Specifically, requests which contain an
exclamation mark within angle brackets (<!>), optionally followed by an
argument.
The following requests are reported to trigger the exception:
http://www.example.com:2301/survey/<!>
http://www.example.com:2301/<!.StringRedirecturl>
http://www.example.com:2301/<!.StringHttpRequest=Url>
http://www.example.com:2301/survey/<!.StringHttpRequest=Url>
http://www.example.com:2301/<!.ObjectIsapiECB>
http://www.example.com:2301/<!.StringIsapiECB=lpszPathInfo>
The root of this problem may be due to the agent failing to handle
unexpected or unsupported protocol behavior, such as these requests. This
however has not been confirmed.
The returned error from such a request reports that a stack overflow
occurred, however it has not been confirmed whether this issue is
exploitable to corrupt memory. The problem may in fact be the result of a
NULL pointer dereference.
It should be noted that this BID was previously part of BID 8009, which
addressed multiple issues.
25. Compaq Web-Based Management Agent Access Violation Denial of Service
Vulnerability
BugTraq ID: 8015
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8015
Summary:
Web-Based Management Agent is the remote system management software
package distributed by Compaq. It is available for the Microsoft Windows
platform.
Compaq Web-Based Management Agent has been reported prone to a remote
denial of service vulnerability. The problem occurs when handling
malformed GET requests to the service. Specifically, requests which
contain "<!.FunctionContentType=" followed by approximately 250 bytes of
data and appended with a ">".
The returned error from such a request reports that an access violation.
The problem likely occurs due to the program attempting to write to an
invalid memory page, causing the service to crash.
It should be noted that this BID was previously part of BID 8009, which
addressed multiple issues.
26. Microsoft Internet Explorer HR Align Buffer Overflow Vulnerability
BugTraq ID: 8016
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8016
Summary:
Internet Explorer is reportedly prone to a boundary condition error.
This problem exists due to insufficient bounds checking on the 'Align'
attribute of the 'HR' (horizontal rule) HTML tag.
If the 'Align' attribute is given an unusually large value, a buffer
within the iexplore process will be overrun, causing Internet Explorer to
fail. It may also be possible to cause arbitrary code to be executed,
though this has not been confirmed. The overflow occurs in 'HTML32.cnv',
which is an HTML converter used by Internet Explorer.
This vulnerability was reported for Internet Explorer version 5 and above.
Earlier versions may also be vulnerable.
27. Armida Databased Web Server Remote GET Request Denial Of Service
Vulnerability
BugTraq ID: 8017
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8017
Summary:
Armida Databased Web Server is a web server available for the Microsoft
Windows operating systems.
Armida Databased Web Server is reportedly prone to a remote denial of
service when process malicious GET requests. The problem occurs when
processing requests containing approximately 5000 bytes of data.
Exploitation of this vulnerability would result in the remote service
crashing. Although unconfirmed, due to the nature of this vulnerability
it may be possible to supply and execute arbitrary code.
This vulnerability has been reported to affect Armida Web Server version
1.0.
28. VisNetic WebMail Information Disclosure Vulnerability
BugTraq ID: 8018
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8018
Summary:
VisNetic WebMail is a component of MailServer that allows users to
retrieve their email through a web browser.
WebMail is reportedly prone to an information disclosure vulnerability.
If a URI request is submitted to a PHP file on the WebMail server ending
with a dot '.' character, the source code behind the PHP file will be
revealed.
It is not known if a user must be authenticated to the WebMail server in
order to exploit this vulnerability.
This vulnerability was reported to affect WebMail 5.8.6.6, however,
earlier versions may also be affected.
29. Compaq Web-Based Management Agent Remote File Verification
Vulnerability
BugTraq ID: 8019
Remote: Yes
Date Published: Jun 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8019
Summary:
Web-Based Management Agent is the remote system management software
package distributed by Compaq. It is available for the Microsoft Windows
platform.
Compaq Web-Based Management Agent has been reported vulnerable to a remote
file verification vulnerability. This information leak could be exploited
by an attacker to verify the existence of sensitive files on a vulnerable
system.
The problem is in the handling of input when passed via the following
means:
http://www.example.com:2301/<!.DebugSearchPaths>?Url=%2F..%2F..%2F..%2F..%
2Fboot.ini
As can be ascertained from the above URL, passing directory traversal
strings in the dot-dot-slash form (../) with encoded slashes can permit
the attacker to access a file on the vulnerable system. If the file
exists, the Web-Based Management Agent returns a response that validates
the existence of the file.
It should be noted that this BID was previously part of BID 8009, which
addressed multiple issues.
30. tcptraceroute Failure To Relinquish Root Privileges Weakness
BugTraq ID: 8020
Remote: No
Date Published: Jun 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8020
Summary:
tcptraceroute is a traceroute implementation that uses TCP packets. It is
a setuid-root program.
It has been reported that tcptraceroute does not properly drop root
privileges after obtaining a file descriptor for raw packet capture.
There are not currently any known exploitable conditions that exist for
tcptraceroute. However, if an exploitable condition were discovered
within the program, this weakness could allow local privilege escalation.
31. LBreakOut2 Login Remote Format String Vulnerability
BugTraq ID: 8021
Remote: Yes
Date Published: Jun 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8021
Summary:
lbreakout2 is a freely available, open source clone of the game Arkanoid.
It is available for the Unix and Linux platforms.
A problem in the software may allow unauthorized access.
It has been reported that lbreakout2 is vulnerable to a format string
issue in the login component. This may result in an attacker executing
arbitrary code on a vulnerable host.
The problem is in the handling of input by the login component of
lbreakout2. By passing format specifiers through the initial login
request, an attacker could potentially corrupt process memory and
potentially execute arbitrary code.
32. Gkrellmd Remote Buffer Overflow Vulnerability
BugTraq ID: 8022
Remote: Yes
Date Published: Jun 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8022
Summary:
GKrellM is a suite of system monitors, designed to display a graphic
representation of system performance statistics. GKrellMd is a daemon that
is shipped as a part of the GKrellM software.
GKrellMd has been reported prone to a remote buffer overflow
vulnerability, arbitrary code execution is possible.
The issue presents itself due to a lack of sufficient bounds checking
performed on network-based data. If data exceeding the maximum reserved
memory buffer size (128 bytes) is received and processed by the affected
daemon, excessive data is copied beyond the boundary of the assigned
buffer and will corrupt adjacent memory. It has been confirmed that a
saved instruction pointer may be corrupted in this manner; a remote
attacker may ultimately exploit this issue remotely to seize control of
the affected daemon and execute arbitrary code in the context of the user
who is running the daemon.
This vulnerability has been reported to affect Gkrellm 2.1.13.
33. Alt-N WebAdmin USER Parameter Buffer Overflow Vulnerability
BugTraq ID: 8024
Remote: Yes
Date Published: Jun 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8024
Summary:
Alt-N WebAdmin is an optional component for MDaemon and RelayFax that
allows remote administration.
It has been reported that WebAdmin is prone to a buffer overflow due to
insufficient bounds checking on the USER parameter. Supplying an overly
long string for the USER parameter would result in a buffer overrun and
sensitive areas in memory being overwritten with arbitrary data. Code
execution is reportedly possible.
By default, WebAdmin runs with SYSTEM level privileges.
34. Multiple GuestBookHost HTML Injection Vulnerabilities
BugTraq ID: 8025
Remote: Yes
Date Published: Jun 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8025
Summary:
GuestBookHost is a guest book service written in PHP which implements a
MySQL database backend. It allows a central web-server to provide
distributed guest book service to other webmasters.
Multiple HTML injection vulnerabilities have been reported for
GuestBookHost guest books. The problem has been reported to due to a lack
of sufficient sanitization performed on user-supplied data. Specifically
an attacker may inject arbitrary HTML code via the 'Name', 'Email' or
'Message' fields once authenticated with the GuestBookHost guest book.
When the malicious entry is later viewed by a legitimate, the embedded
HTML code will be interpreted in their browser.
An attacker may exploit this vulnerability to steal cookie based
authentication credentials. Other attacks are also possible.
35. Sharp Zaurus Samba Server Unauthorized Remote Filesystem Access
Vulnerability
BugTraq ID: 8026
Remote: Yes
Date Published: Jun 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8026
Summary:
Zaurus is a handheld device distributed by Sharp Electronics. Zaurus runs
an embedded Linux-based operating system called Embedix.
When mounted on the docking station, the station's USB cable and
respective connection is perceived as the network interface to the
attached PC. As a result, a user from an attached PC may remotely connect
to the Zaurus. It is may also possible to connect to a Zaurus via an
802.11b connection.
A vulnerability has been reported for Samba server when run on the Sharp
Zaurus Embedix operating system. The problem occurs when mounting the
device to the docking station. When docked, a Samba server will
immediately be invoked, allowing access via any external interface.
It has been discovered that by default the Samba server is configured to
allow unauthorized users unrestricted read/write access to the local file
system.
This could potentially result in the disclosure of sensitive information
or the corruption of system resources. It may also allow an attacker to
potentially execute arbitrary code on the target device.
36. SGI IRIX IPV6 InetD Port Scan Denial Of Service Vulnerability
BugTraq ID: 8027
Remote: Yes
Date Published: Jun 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8027
Summary:
inetd is the network services superserver. It manages connections by
listening on ports, and starting a service when a connection request is
made.
A problem has been reported to affect inetd on SGI IRIX systems that are
part of an IPV6 network environment. The issue presents itself when inetd
handles network-based scans. It has been reported that when subjected to a
scan, inetd will crash.
Because inetd reacts unpredictably when scanned by a network scanning
utility, a consequence of a malicious scan could be, that all services
handled by the server become unavailable to legitimate users until inetd
is manually restarted.
This problem makes it possible to deny service to legitimate users of a
system.
37. SGI IRIX Snoop Unspecified Vulnerability
BugTraq ID: 8029
Remote: Unknown
Date Published: Jun 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8029
Summary:
SGI IRIX snoop network protocol analyzer has been reported prone to an
unspecified vulnerability, when operating in an IPV6 network environment.
Technical details regarding this vulnerability are not currently
available. The vendor has announced that various Snoop functionality has
been removed, allowing the utility to not require root privileges to run.
As a result, although unconfirmed, it has been conjectured that this
vulnerability may be exploited to locally gain root privileges or to gain
remote root access to a system.
It is not currently clear whether this vulnerability is a local or remote
issue.
38. Tripbit Secure Code Analizer Local fgets() Buffer Overrun
BugTraq ID: 8028
Remote: No
Date Published: Jun 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8028
Summary:
Tripbit Secure Code Analizer is a source code auditing utility design to
parse through source files and identify the use of potentially insecure
functions, such as strcpy(), gets(), fgets(), etc.
A buffer overrun vulnerability has been discovered in Secure Code Analizer
v1.0. The problem occurs when reading in data from a target source file.
The vulnerability occurs within the single_source() function during a call
to fgets().
The fgets() call is used to copy data from the target source file into an
internal memory buffer: puffer[256]. However, the 'size' argument of the
fgets() function is incorrectly set to 1024 bytes, potentially allowing
for 768 bytes of stack memory to be overwritten. An attacker could exploit
this vulnerability by creating a file containing approximately 257 or more
bytes of data.
It should be noted that 'puffer' is the first variable declared within the
single_source() function, typically placing it adjacent to the saved frame
pointer and return address. As a result, an attacker could potentially
exploit this vulnerability by writing only 8 bytes past the end of the
buffer. This would effectively overwrite the return address of the
function, allowing for the execution of attacker-supplied code. This
memory layout may differ between compilers.
III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. AT&T lets phone fraud victims off the hook
By Kevin Poulsen
The company will abandon its efforts to collect on four-figure phone bills
left by a voice-mail cracking scheme.
http://www.securityfocus.com/news/6158
2. I am not the Spammer you think I am
By John Leyden, The Register
A UK man named by Microsoft as a prolific spammer in a recent law suit is
protesting his innocence.
Simon Grainger, 43, a telecoms engineer from Merseyside, is one of 15
people targeted by Microsoft for their alleged spamming activities.
http://www.securityfocus.com/news/6181
3. Techno cops needed to catch cyber criminals - Blunkett
By John Leyden, The Register
Police must embrace cutting edge technology to stay ahead of criminals in
the fight against crime, the Home Secretary will tell an audience of
senior policemen tonight.
http://www.securityfocus.com/news/6148
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. SURVIVOR v0.9.2b
by Benn Oshrin
Relevant URL:
http://www.columbia.edu/acis/sy/unixdev/survivor/
Platforms: N/A
Summary:
SURVIVOR is yet another systems monitor. It consists of a POSIX-thread
based scheduler written in C++ running arbitrary checks in a flexible,
heterogeneous, bureaucratic, and convoluted environment. It maintains
proper state, history, sanity, and attitude, and allows interaction via
Web, command, and two-way messaging interfaces.
2. MIMEDefang v2.34
by David F. Skoll
Relevant URL:
http://www.mimedefang.org/
Platforms: Linux, Perl (any system supporting perl), UNIX
Summary:
MIMEDefang is a flexible MIME e-mail scanner designed to protect Windows
clients from viruses. It can alter or delete various parts of a MIME
message according to a very flexible configuration file. It can also
bounce messages with unnaceptable attachments. MIMEDefang works with
Sendmail 8.11's new "Milter" API, which gives it much more flexibility
than procmail-based approaches.
3. heartbeat v0.2
by Tyler Lane [email protected]
Relevant URL:
http://www.nolongervalid.com/heartbeat/
Platforms: Python
Summary:
Heartbeat is a server and service monitoring program written in PyGTK,
featuring XML configuration and support for unlimited servers and
services.
4. DSPAM v2.6.1
by Jonathan A. Zdziarski
Relevant URL:
http://www.networkdweebs.com/software/dspam/
Platforms: UNIX
Summary:
DSPAM is a server-side anti-spam agent for UNIX email servers. It
masquerades as the email server's local delivery agent and filters/learns
SPAM using a Bayesian statistical approach which provides an
administratively maintenance-free, self-learning Anti-Spam service. Each
email is broken down into its most interesting tokens, each assigned a
spam probability. All probabilities are then combined to produce a
statistical probability of spam. This approach, applied to a mature corpus
of email, has the potential to yield a 99.5% success rate with only 0.03%
chance of false positives.
5. Python milter v0.5.5
by Stuart D. Gathman
Relevant URL:
http://www.bmsi.com/python/milter.html
Platforms: POSIX
Summary:
The milter module for Python provides a python interface to Sendmail's
libmilter that exploits all its features. Milters can run on the same
machine as sendmail, or another machine. The milter can even run with a
different operating system or processor than sendmail. Sendmail talks to
the milter via a local or internet socket, and keeps the milter informed
of events as it processes a mail connection. At any point, the milter can
cut the conversation short by telling sendmail to ACCEPT, REJECT, or
DISCARD the message. After receiving a complete message from sendmail, the
milter can again REJECT or DISCARD it, but it can also ACCEPT it with
changes to the headers or body.
6. Traffic tool Troll v1.0
by Alexander Newald [email protected]
Relevant URL:
http://linux.newald.de/
Platforms: N/A
Summary:
The Traffik Tool Troll is a traffic monitoring and managing skript.
Traffic statistics are generated by port, hour, day, month, and year. You
can define a special period for your needs. The script is written in Perl
and uses iptables and MySQL to get and store the traffic.
V. SECURITY JOBS SUMMARY
------------------------
1. Expert in Security Event Management (as well as other things)-
Resume (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326930
2. Professional Services Opportunities in E-Commerce Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326929
3. Incident Analyst Position, Dublin Ireland (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326892
4. Expert in Firewall,VPN and IDS (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/327012
5. Security Architect - Technical Architect Security - London, Financial
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326886
6. HELP! - IMMEDIATE OPENING - Vulnerability Assessment - Reston, VA
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326864
7. Business Development Manager Information Security / Saudi Arabia
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326827
8. Senior Scientist, Risk Assessments - Chicago, IL - Greythorn (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326725
9. Security Manager vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326616
10. IT Internship (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326602
11. Anti-SPAM/IDS Architect needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326599
12. NT Security expert (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326492
13. IMMEDIATE OPENING - Sr. IDS Manager - Bethesda, MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326493
14. Certification & Accreditation Specialist (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326491
15. Operations / Project Manager role in Amsterdam , Holland (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326495
16. Secure VoIP, Wireless Engineer Needed in Baltimore Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326490
17. Security LAN/WAN Opportunity (BS+8, US Citizen, DC area) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326494
18. Information Security Administrator opportunity -- Dallas, TX (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326429
19. Location Update: Looking for security analyst (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326431
20. Location Upate: Looking for security analyst (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326430
21. Looking for security analyst (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326404
22. Intrusion Detection & Incident Response - Chicago, IL (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/326407
23. HIPPA consultant in BOSTON (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/325939
VI. INCIDENTS LIST SUMMARY
-------------------------
1. Traffic with 55808 tcp windows size: news. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326922
2. strange logs -- tcp port 16166 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326921
3. War Dial on my PBX (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326920
4. Questionable UDP traffic received by firewall (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326776
5. Intrusec 55808 Trojan Analysis (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326711
6. Scan from Philipine Center on Transnational Crime (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326621
7. kuag2 again? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326435
8. chkrootkit and LKM? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326433
9. sdbot variant and WS 55808 activity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326190
10. ISS "Stumbler" advisory questions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326187
11. Unusual registry entries (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326188
12. sdbot variant and port 55808 activity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326189
13. Spoofed TCP SYNs w/Winsize 55808 (was: Help with an odd log f ile...)
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/326185
VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Starting on Assembly under win32 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/327019
2. GetPC code (was: Shellcode from ASCII) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326924
3. Getting Base Address using the Structured Exception Handler (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326861
4. Shellcode from ASCII (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326850
5. Windows Shellcode Writing (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326717
6. file hiding under Linux (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326723
7. portmon <=1.8 buffer over flow ! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326718
8. remote command execution in multiple languages (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326720
9. exploiting a binary if %edi can be overwritten? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326721
10. crashing explorer with file properties (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326574
11. Java class obfuscation (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326303
12. Myserver 0.4.1 DOS... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326300
13. Formatstrings on *BSD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326211
14. [Full-Disclosure] Java class obfuscation (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326174
15. IE exposing URLs to msn.com and alexa.com? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326176
16. EXEC SHIELD - new Linux security feature (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/326165
VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. How to block users from installing other apps (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326971
2. SP4 instalation failure (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326977
3. Xp Home (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326976
4. security auditing under windows 2000 server (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326899
5. Windows NLB (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326900
6. AW: Question about windows service (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326898
7. Question about windows service (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326890
8. Please read. Post containing BugBear.B (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326715
9. Search for files and folders fails (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326671
10. additional Windows 2000 password policy questions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326673
11. Windows 2000 password policy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326524
12. Managing Windows Event Logs (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326522
13. Filtering DHCP Assignments by MAC Address (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326479
14. Microsoft Baseline Security Analyzer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326418
15. SecurityFocus Microsoft Newsletter #142 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326385
16. adding new service to system services list (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326386
17. Netreg for Windows (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326294
18. Windows Event Logs (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/326289
IX. SUN FOCUS LIST SUMMARY
----------------------------
1. SPARC assembly - a beginner's question... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/326928
2. Administrivia (X-Post) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/326748
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Administrivia (X-Post) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/326747
2. Linux firewall/IDS/NAT ** IMPORTANT ** (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/326304
XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Tenable
Tenable Network Security offers a Vulnerability Management Product.
"Lightning 1.1 is a next-generation security software solution that
thoughtfully combines relevant security data from vulnerability scans and
intrusion detection devices to help enterprises reduce network exposure.
Its design is definitely unique and highly scalable when compared to
others in our industry," says Ron Gula, President and CTO of Tenable.
Please visit: http://www.securityfocus.com/TenableSecurity-sf-news
--------------------------------------------------------------------------