SecurityFocus Newsletter #204

John Boletta <[email protected]> Mon, 7 Jul 2003 10:08:58 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #204
-----------------------------

This Issue is Sponsored by: SpiDynamics

FREE White Paper: "Top Web Application Hacker Techniques!" Learn why 70%
of today's successful hacks involve Web Application attacks such as: SQL
Injection, XSS, Cookie Manipulation, and Parameter Manipulation.

All undetectable by Firewalls and IDS! Download *FREE* white paper from
SPI Dynamics for a complete guide to protection!

Visit us at:
http://www.securityfocus.com/SPIDynamics-sf-news2
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Penetration Testing for Web Applications (Part Two)
2. IDS Correlation of VA Data and IDS Alerts
3. Antivirus Concerns in XP and .NET Environments
4. Promises, Promises
5. The SecurityFocus 4th Anniversary Contest
II. BUGTRAQ SUMMARY
1. HP Tru64 KSH Resource Consumption Denial Of Service Vulnerability
2. WebBBS Guestbook HTML Injection Vulnerability
3. Sun Solaris Veritas File System Unauthorized Information Access...
4. WZDFTPD Incomplete Port Command Denial Of Service Vulnerability
5. ImageMagick Temporary File Creation Vulnerability
6. XGalaga Environment Variable Multiple Buffer Overflow...
7. Mantis Weak Configuration File Permission Vulnerability
8. CutePHP CuteNews HTML Injection Vulnerability
9. GTKSee PNG Image Loading Heap Corruption Vulnerability
10. Microsoft Commerce Server 2002 Weak Registry Key Permissions...
11. Abyss Web Server HTTP GET Heap Overrun Vulnerability
12. Abyss Web Server HTTP Header Injection Vulnerability
13. MegaBook Multiple HTML Injection Vulnerabilities
14. Multiple Opera Denial Of Service Vulnerabilities
15. PABox Password Reset Vulnerability
16. PABox Admin Control Panel PHP Code Injection Vulnerability
17. Adobe Unix Acrobat Reader WWWLaunchNetscape Buffer Overflow...
18. InterSystems Cache Insecure Default Permissions Vulnerability
19. ezbounce Format String Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Study: Wi-Fi users still don't encrypt
2. PetCo Plugs Credit Card Leak
3. Illinois supercomputer center to head military cybersecurity...
4. Web Firms Choose Profit Over Privacy
IV. SECURITYFOCUS TOP 6 TOOLS
1. IDABench v1.0
2. Secure FTP Bean v2.0.8
3. python-crack v0.4
4. Amrita VPN v0.97-2
5. DSPAM v2.6.2
6. John the Ripper v1.6.34(dev)
V. SECURITYJOBS LIST SUMMARY
1. Senior Cyber Security Consultant ? DC Area (Thread)
2. CISSP seeking Security Architect position in London, UK (Thread)
3. Uncle Sam wants you ... (Thread)
4. List is now open (Thread)
5. Entry Level Security SA Position Announcement for DC Area (Thread)
6. TORONTO - Checkpoint Firewall SME - 1 Year renewable Contract...
7. Information Assurance Manager w/ TS Clearance in Kyrgyzstan...
8. Information Security Practice Manager - New York, NY $135K -...
9. Business Development Manager (Thread)
10. Senior Email Consultant for Computer Forensics Practice - New...
11. Internet Security Architect contract position in Pittsbur...
12. Contract position in Atlanta, GA & Knoxville, TN...Intereste...
13. Looking for positions in the field of security (Thread)
14. Southern California, Chicago, Atlanta Info Security Postions...
15. Washington DC Info Security Positions (Thread)
16. List Closure till the 3rd of July (Thread)
17. Salary for DITSCAP or INFOSEC work in the Mid West (Thread)
18. Senior Security Consultant - London Financial (Thread)
VI. INCIDENTS LIST SUMMARY
1. Another overflow exploit for Apache? *RESOLVED* (Thread)
2. frontpage extensions; backdoor or initial compromise? (Thread)
3. Another overflow exploit for Apache? (Thread)
4. UDP to port 500 (Thread)
5. msmsgs.exe /passportlogon /delaysync /shortpackets (Thread)
6. AW: DoS "Probing" on one of our hosts (Thread)
7. DoS "Probing" on one of our hosts (Thread)
8. New MySQL worm? increased probes/traffic detected... (Thread)
9. re: DoS "Probing" on one of our hosts (Thread)
10. Anyone else seeing a spike in SSHd scans? (Thread)
11. possible new irc worm (Thread)
12. speaking of rootkits (Thread)
13. rooted by blowkit (Thread)
14. Intrusec 55808 Trojan Analysis (Thread)
15. port 5248 (Thread)
16. strange logs -- tcp port 16166 (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Minor security problem in Axis 560x web interface (Thread)
2. Red Hat 9: free tickets (Thread)
3. GetPC code (was: Shellcode from ASCII) (Thread)
4. Corrupting memory control structures under XP (Thread)
5. Starting on Assembly under win32 (Thread)
6. Windows Shellcode Writing (Thread)
7. cross-site to root scripting papers (Thread)
8. gera's encoder (Thread)
9. Radware Linkproof: SSH port DoS (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. SP4 installation failure (Thread)
2. Q811114 and Q815021 (Thread)
3. How to block users from installing other apps (Thread)
4. Managing Windows Event Logs (Thread)
5. Limiting the creation of new files to specific types. (Thread)
6. SP4 instalation failure (Thread)
7. SecurityFocus Microsoft Newsletter #143 (Thread)
8. SP4 installation (Thread)
9. Windows NLB (Thread)
10. Xp Home (Thread)
11. Question about windows service (Thread)
12. security auditing under windows 2000 server (Thread)
IX. SUN FOCUS LIST SUMMARY
1. TCP checksum and device driver eri0 (Thread)
X. LINUX FOCUS LIST SUMMARY
1. NO NEW POSTS FOR THE WEEK ENDING 07.04.03
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Penetration Testing for Web Applications (Part Two)
By Jody Melbourne and David Jorm

The second installment in this series expands upon issues of input
validation - how developers routinely, through a lack of proper input
sanity and validity checking, expose their back-end systems to server-side
code-injection and SQL-injection attacks. It also explores the manner in
which these issues may manifest the client-side as cross-site scripting
and other content-manipulation vulnerabilities.

http://www.securityfocus.com/infocus/1709

2. IDS Correlation of VA Data and IDS Alerts
By Neil Desai

This article discusses the correlation of VA data and IDS alerts to
helpprioritize events and reduce the time it takes to sift through events.

http://www.securityfocus.com/infocus/1708

3. Antivirus Concerns in XP and .NET Environments
by Roger A. Grimes

After Windows NT was released, it took virus writers 5 years to learn how
to infect it. Windows NT 3.1 and the Win32 API were released in late 1993,
but it wasn't until August 1998 that W32.Cabanas became the first NT virus
by capturing coveted kernel mode access. .NET and some of Microsoft's
other initiatives have not been as lucky. The purpose of this article is
to discuss antivirus (AV) concerns with .NET and Microsoft Windows XP.

http://www.securityfocus.com/infocus/1707

4. Promises, Promises
By Mark Rasch

Most online businesses promise they'll protect customer data as if it were
their own. Now the government is holding them to it.

http://www.securityfocus.com/columnists/171

5. The SecurityFocus 4th Anniversary Contest

Enter before July 16th, 2003 to win two passes to the Black Hat Briefings.
Please visit the contest page here:

http://www.securityfocus.com/contest

II. BUGTRAQ SUMMARY
-------------------
1. HP Tru64 KSH Resource Consumption Denial Of Service Vulnerability
BugTraq ID: 8051
Remote: Yes
Date Published: Jun 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8051
Summary:

ksh, Korn shell is an interactive command interpreter and a command
programming language implemented on some unix based systems.

ksh on Tru64 systems has been reported prone to a denial of service
vulnerability under some circumstances. It has been reported that ksh does
not sufficiently terminate if a remote telnet session is aborted abruptly,
under some circumstances. Specifically, if a trap() call is defined in a
startup script or a script that is executed within the affected shell
process, the ksh process may continue to execute after the telnet session
has terminated consuming CPU resources in an exponential manner until the
CPU becomes resource-bound.

Although unconfirmed, a malicious unprivileged system user may exploit
this issue to consume system resources in a bid to deny service to
legitimate users of the affected system.

2. WebBBS Guestbook HTML Injection Vulnerability
BugTraq ID: 8052
Remote: Yes
Date Published: Jun 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8052
Summary:

WebBBS Pro is a web-based BBS system designed to run in Microsoft Windows
environments. WebBBS Pro is shipped with a web server component.

A HTML injection vulnerability has been reported for WebBBS. The
vulnerability exists as a result of insufficient sanitization of
user-supplied data.

An attacker may exploit this issue to inject malicious HTML code into
WebBBS guestbook entries. The hostile code may be rendered in the user's
browser when the user views the entry.

Exploitation could permit an attacker to steal cookie-based authentication
credentials or launch other attacks.

3. Sun Solaris Veritas File System Unauthorized Information Access Vulnerability
BugTraq ID: 8053
Remote: No
Date Published: Jun 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8053
Summary:

Sun Solaris systems that implement the Veritas File System (VxFS) may
allow unprivileged local users to obtain access to potentially sensitive
data.

The vulnerability exists due to improper ACL permissions when a new VxFS
filesystem is created. Due to this, there may be less restrictive access
permissions on some files that reside within the vulnerable filesystem.

This vulnerability may be exploited by a local user to access potentially
sensitive data.

Information obtained in this manner may be used by an attacker to launch
further attacks against a vulnerable system.

4. WZDFTPD Incomplete Port Command Denial Of Service Vulnerability
BugTraq ID: 8055
Remote: Yes
Date Published: Jun 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8055
Summary:

wzdftpd is an FTP server implementation that is available for a number of
operating systems, including Unix/BSD/Linux variants.

wzdftpd is reported to be prone to a denial of service when receiving an
incomplete or malformed FTP PORT command. Sending such a command to the
FTP server will allegedly cause the server to crash. This could be
exploited by authenticated FTP users to deny availability of FTP services
to legitimate users.

5. ImageMagick Temporary File Creation Vulnerability
BugTraq ID: 8057
Remote: No
Date Published: Jun 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8057
Summary:

ImageMagick is an image manipulation program. It is available for a
variety of platforms including Microsoft Windows and Unix and Linux
variant operating systems.

ImageMagick has been reported prone to an insecure temporary file creation
vulnerability. As a result, it may be possible for local attackers to
corrupt files owned by the user who is invoking the ImageMagick
application.

An attacker could potentially exploit this issue by creating a symbolic
link in place of the temporary file, which is created. Any actions
performed by ImageMagick when it is executed will be performed on the
linked file.

6. XGalaga Environment Variable Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 8058
Remote: No
Date Published: Jun 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8058
Summary:

XGalaga is a graphical game designed for use with Linux and Unix variant
operating systems.

Several buffer overflow vulnerabilities have been reported for xgalaga
when parsing certain environment variables. Specifically, bounds checks
are not performed on the HOME environment variable.

An attacker can exploit this vulnerability by setting an overly long HOME
environment variable and invoking xgalaga. This will result in the
corruption of sensitive memory with attacker-supplied values to obtain
elevated privileges.

xgalaga is typically installed setuid 'games'.

7. Mantis Weak Configuration File Permission Vulnerability
BugTraq ID: 8059
Remote: No
Date Published: Jun 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8059
Summary:

Mantis is a web-based bug tracking system. It is written in PHP and
supported by a MySQL database.

A vulnerability has been reported for Mantis that may allow an attacker to
obtain access to the Mantis database.

The vulnerability exists due to weak permissions on the Mantis
configuration file. Specifically, the configuration file, which contains
the password for the Mantis database, has world-readable permissions.

An attacker can exploit this to obtain unprivileged access to the Mantis
database.

8. CutePHP CuteNews HTML Injection Vulnerability
BugTraq ID: 8060
Remote: Yes
Date Published: Jun 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8060
Summary:

CutePHP is a web-based bulletin board system. It is implemented in PHP and
is available for a variety of platforms including Microsoft Windows and
Unix and Linux variant operating environments.

CutePHP is prone to HTML injection attacks. The vulnerability exists due
to insufficient sanitization of user-supplied input. Specifically,
user-supplied input to news posts are not sufficiently sanitized of
malicious HTML code.

An attacker can exploit this vulnerability by adding HTML code within
IFRAME tags. The hostile code may be rendered in the user's browser when
the user views the entry.

Exploitation could permit an attacker to steal cookie-based authentication
credentials or launch other attacks.

9. GTKSee PNG Image Loading Heap Corruption Vulnerability
BugTraq ID: 8061
Remote: No
Date Published: Jun 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8061
Summary:

GTKSee is an image viewer developed for Linux and Unix variant operating
systems.

A vulnerability has been reported for GTKSee that may result in the
corruption of heap memory. The vulnerability occurs when GTKSee attempts
to load PNG files with a certain colour depth.

An attacker may be able to exploit this vulnerability by creating a PNG
image file with a certain colour depth. When GTKSee is used to view the
image, the overflow issue will be triggered and will result in the
corruption of heap memory with attacker-supplied values.

Successful exploitation will result in the execution of attacker-supplied
code.

The precise technical details of this vulnerability are unknown. This BID
will be updated as further information becomes available.

10. Microsoft Commerce Server 2002 Weak Registry Key Permissions Weakness
BugTraq ID: 8063
Remote: No
Date Published: Jun 30 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8063
Summary:

Microsoft Commerce Server 2002 is a web server product geared towards
building e-commerce websites.

Microsoft Commerce Server 2002 installs a registry key with weak default
permissions when configured to authenticate via SQL Server. The following
registry key is installed with read privileges for the users group:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Commerce Server

Encoded database authentication credentials are stored under "ADMINDBPS".

Attackers with interactive access to a system hosting the vulnerable
software could gain access to encoded database credentials by perusing the
registry. Credentials could also be retrieved via Open Commerce Server
Manager. This information could be exploited to compromise the database.

This issue is reported to affect Microsoft Commerce Server 2002. It is
not known if Microsoft Commerce Server 2000 is similarly affected.

11. Abyss Web Server HTTP GET Heap Overrun Vulnerability
BugTraq ID: 8062
Remote: Yes
Date Published: Jun 30 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8062
Summary:

Abyss Web Server is a freely available personal web server. It is
maintained by Aprelium Technologies and runs on Microsoft Windows
operating systems, as well as Linux.

Abyss Web Server is prone to a remotely exploitable heap overrun. This is
due to insufficient bounds checking of data supplied via client HTTP GET
requests which is used in a strcpy() operation. By submitting an HTTP GET
request in excess of 2048 bytes, it will be possible to trigger this
condition. It should be noted that the ':\' characters must be appended
to the end of the request. This will permit remote attackers to corrupt
adjacent regions of heap memory with attacker-supplied values.

This condition could be exploited to execute arbitrary code with the
privileges of the web server.

This issue is reported to affect Abyss Web Server 1.1.2. Later versions,
such as 1.1.4 and 1.1.5 may be similarly affected, though this has not
been confirmed.

12. Abyss Web Server HTTP Header Injection Vulnerability
BugTraq ID: 8064
Remote: Yes
Date Published: Jun 30 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8064
Summary:

Abyss Web Server is a freely available personal web server. It is
maintained by Aprelium Technologies and runs on Microsoft Windows
operating systems, as well as Linux.

Abyss Web Server is prone to a vulnerability that could permit attackers
to inject malicious data into server response headers. HTTP GET requests
ending with ':\' characters will cause the server to return a HTTP 302
response to the client, which includes the requested URI in the Location:
header field of the server response. User input is not sufficiently
sanitized from this header field in the response. An attacker could cause
malicious data such as HTML and script code to be included in the server
response. It will also be possible be append additional HTTP header
fields to the server response.

This could be exploited to launch cross-site scripting attacks. The
attacker can also append arbitrary HTTP header information to the server
response, which could permit cookie values to be set or spoofed header
field data.

This issue is reported to affect Abyss Web Server 1.1.2. Later versions,
such as 1.1.4 and 1.1.5 may be similarly affected, though this has not
been confirmed.

13. MegaBook Multiple HTML Injection Vulnerabilities
BugTraq ID: 8065
Remote: Yes
Date Published: Jun 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8065
Summary:

MegaBook is a web-based guestbook that is intended to run on Unix and
Linux variants.

MegaBook is prone to multiple HTML injection vulnerabilities. This is due
to insufficient sanitization of HTML and script code from user-supplied
input, including input supplied to the administrative login page
(admin.cgi). It is not known if this malicious input supplied to the
admin login page will be stored within the guestbook system, so the admin
script may not provide an attack vector for HTML injection. However, it
is possible to inject HTML and script code into 'gbook.db' file via the
client HTTP User-Agent: header field.

Exploitation of these issues could permit hostile HTML or script code to
be injected into the guestbook system and rendered in the browser of a
legitimate guestbook user. Code would be interpreted in the context of
the site hosting the software.

Exploitation could allow for theft of cookie-based authentication
credentials or permit an attacker to control how the guestbook site is
rendered to legitimate users. Other attacks are also possible.

14. Multiple Opera Denial Of Service Vulnerabilities
BugTraq ID: 8066
Remote: Yes
Date Published: Jun 30 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8066
Summary:

Opera has been reported to be prone to five denial of service
vulnerabilities. These issues can be triggered when the browser attempts
to interpret a document with malformed code. If a user of the web browser
visits a web page that contains malformed code designed to trigger one of
these conditions, their browser could freeze up or crash outright. It
should be noted that exploitation of these issues will generally not cause
a prolonged or persistent denial of service as the browser includes
features that allow users to gracefully recover from a crash. If the
browser freezes, this could cause CPU usage to spike to 100% for that
process, which could result in a more serious denial of service condition.

This issue was reported for Opera on Microsoft Windows platforms. It is
not known if other releases are affected.

These issues are pending further analysis and will be assigned separate
BIDs with more specific details when analysis is completed.

15. PABox Password Reset Vulnerability
BugTraq ID: 8067
Remote: Yes
Date Published: Jun 30 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8067
Summary:

paBox is a web-application that is written in PHP. It will run on Unix
and Linux variants, as well as Microsoft Windows operating systems.

paBox is prone to an issue that may allow unauthenticated remote users to
reset administrative passwords. This issue is due to insufficient access
validation prior to allow users to perform certain actions. This could
permit unauthorized access to the administrative Control Panel, which may
aid the attacker in further attacks against the underlying system.

16. PABox Admin Control Panel PHP Code Injection Vulnerability
BugTraq ID: 8068
Remote: Yes
Date Published: Jun 30 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8068
Summary:

paBox is a web-application that is written in PHP. It will run on Unix
and Linux variants, as well as Microsoft Windows operating systems.

Remote users with access to the administrative Control Panel may be able
to inject malicious PHP code when adding banned users. Banned user
information is stored in the 'bannedusers.php' script. This code could
then be executed, allowing for execution of arbitrary commands in the
context of the web server hosting the software.

Unauthorized remote users may exploit other latent vulnerabilities in the
software to gain access to the administrative console.

17. Adobe Unix Acrobat Reader WWWLaunchNetscape Buffer Overflow Vulnerability
BugTraq ID: 8069
Remote: No
Date Published: Jul 01 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8069
Summary:

Acrobat Reader is an application for reading, navigating, and printing PDF
(Portable Document Format) files.

An individual has reported that Adobe Acrobat Reader for Unix systems is
vulnerable to a buffer overflow condition. The error is allegedly related
to the processing of hyperlinks, in the function "WWWLaunchNetscape".
The flaw is triggered only when Netscape is set as the browser to be used
in the preferences (this is the default configuration).

According to the report, the overflow occurs when a user viewing a
malicious document accesses an embedded link that is greater than 256
bytes in length. It appears that this overflow is in stack memory as the
discoverer has stated that the return address is overwritten. If this is
accurate, the vulnerability will allow for the execution of custom
instructions on affected systems.

It should be noted that it is not confirmed that Acrobat Reader for
Windows is not affected. Users of both versions should exhibit caution
until there is a response from the vendor.

18. InterSystems Cache Insecure Default Permissions Vulnerability
BugTraq ID: 8070
Remote: No
Date Published: Jul 01 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8070
Summary:

Cache is a post-relational database developed by InterSystems Corporation.

It has been reported that the permissions set by default on the files and
directories comprising Cache are insecure. The permissions on directories
allegedly allow for any user to overwrite any file. This creates many
opportunities for local attackers to obtain root privileges.

The setuid root "wrapper" program "/cachesys/bin/cuxs" can be used to run
a malicious replacement executable with root privileges. It is also
possible for local attackers to overwrite server-side scripts which are
run as root through the web interface.

19. ezbounce Format String Vulnerability
BugTraq ID: 8071
Remote: Yes
Date Published: Jul 01 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8071
Summary:

ezbounce is a highly configurable IRC proxy.

It has been reported that ezbounce is affected by a format string
vulnerability. The condition is present in the file
"ezbounce/commands.cpp" and can be triggered when session support is
enabled.

When processing client input, untrusted data is passed as the format
string argument to a wrapper for a printf function. Attackers can use
format specifiers such as "%n" to overwrite critical regions of memory.

To exploit this vulnerability, the attacker must have a username and
password for the ezbounce service. This flaw may be of use to attackers
who have proxy access but none or limited on the underlying host.

20. Pam_Timestamp_Check Privilege Escalation Weakness
BugTraq ID: 8072
Remote: No
Date Published: Jul 02 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8072
Summary:

A weakness has been reported in the pam_timestamp_check implementation for
Red Hat 9.0 and other distributions that may be derived from this version
or include this functionality.

pam_timestamp_check is a tty ticketing implementation that is designed to
cache credentials so that users are not constantly required to use a
facility such as sudo or su to perform actions as another user.
pam_timestamp_check is implemented through the pam_timestamp_check.so
module and with the pam_timestamp_check setuid helper. The implementation
works by fetching the pseudo-terminal name (A), current user name (B), and
the user whose credentials are cached (C). The implementation then checks
to see if the timestamp of /var/run/sudo/B/A:C is recent to determine
whether access should be granted. The ticket contents are not
sufficiently verified, allowing for ticket spoofing.

If the attacker can cause the timestamp of the file to change, it will be
possible to gain elevated privileges through exploitation of this
weakness. This scenario will be possible in combination with file
corruption issues such as those that are the result of insecure temporary
file handling and allow files in privileged directories to be corrupted.

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. Study: Wi-Fi users still don't encrypt
By Kevin Poulsen

Sniffing the airwaves at the 802.11 Planet Expo in Boston turns up loads
of passwords, and very little encryption.

http://www.securityfocus.com/news/6290

2. PetCo Plugs Credit Card Leak
By Kevin Poulsen

Pet supply site offered more than kitty litter and flea collars.

http://www.securityfocus.com/news/6194

3. Illinois supercomputer center to head military cybersecurity effort
By Jim Paul, The Associated Press

Hoping to thwart hackers, the military is launching a new research effort
at the University of Illinois to improve the security of battlefield
computers and communications systems.

http://www.securityfocus.com/news/6288

4. Web Firms Choose Profit Over Privacy
By Jonathan Krim, Washington Post

To parents interested in buying the popular Hooked on Phonics
learn-to-read programs, the company made a firm promise on its Web site:
It would never sell or rent their personal information to other marketers.

http://www.securityfocus.com/news/6281

IV. SECURITYFOCUS TOP 6 TOOLS
----------------------------
1. IDABench v1.0
by George Bakos
Relevant URL:
http://idabench.ists.dartmouth.edu
Platforms: UNIX
Summary:

IDABench is a Web interface to many intrusion analysis tools. By the use
of simple plug-ins, it allows an analyst to twist and turn hourly packet
logs through such utilities as tcpdump, ngrep, tethereal, etc. Output is
textual web pages, gnuplot graphs, and downloadable composite binary
dumpfiles. Based on the US Navy's SHADOW intrusion detection system,
IDABench simplifies the writing of tcpdump filters, allows regular-
expression context matching, and through a simple plugin API, can be
extended to include other libpcap- based analysis tools, such as Snort,
p0f, etc.

2. Secure FTP Bean v2.0.8
by glub
Relevant URL:
http://www.glub.com/products/bean/
Platforms: Os Independent
Summary:

The Secure FTP Bean allows FTP connections to be made over SSL, including
both implicit and explicit SSL connections, and passive and active data
transfers with or without encryption.

3. python-crack v0.4
by Domenico Andreoli
Relevant URL:
http://www.nongnu.org/python-crack/
Platforms: Python
Summary:

python-crack is a module that provides Python programs with the ability to
evaluate password strength. It uses the well known cracklib toolkit, hence
the name.

4. Amrita VPN v0.97-2
by Jayaraj
Relevant URL:
http://amvpn.sourceforge.net
Platforms: Linux, POSIX
Summary:

Amrita VPN is an easy-to-use open source VPN solution that runs on the
GNU/Linux platform. The implementation is fully in userspace and requires
no kernel patches or enhancements. It uses SSL for strong encryption and
authentication.

5. DSPAM v2.6.2
by Jonathan A. Zdziarski
Relevant URL:
http://www.networkdweebs.com/software/dspam/
Platforms: UNIX
Summary:

DSPAM is a server-side anti-spam agent for UNIX email servers. It
masquerades as the email server's local delivery agent and filters/learns
SPAM using a Bayesian statistical approach which provides an
administratively maintenance-free, self-learning Anti-Spam service. Each
email is broken down into its most interesting tokens, each assigned a
spam probability. All probabilities are then combined to produce a
statistical probability of spam. This approach, applied to a mature corpus
of email, has the potential to yield a 99.5% success rate with only 0.03%
chance of false positives.

6. John the Ripper v1.6.34(dev)
by Solar Designer
Relevant URL:
http://www.openwall.com/john/
Platforms: BeOS, DOS, MacOS, Windows 2000, Windows 95/98, Windows NT
Summary:

John the Ripper is a fast password cracker, currently available for many
flavors of Unix (11 are officially supported, not counting different
architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to
detect weak Unix passwords. It supports several crypt(3) password hash
types which are most commonly found on various Unix flavors, as well as
Kerberos AFS and Windows NT/2000/XP LM hashes. Several other hash types
are added with contributed patches.

V. SECURITY JOBS SUMMARY
------------------------
1. Senior Cyber Security Consultant ? DC Area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327753

2. CISSP seeking Security Architect position in London, UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327798

3. Uncle Sam wants you ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327820

4. List is now open (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327819

5. Entry Level Security SA Position Announcement for DC Area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327771

6. TORONTO - Checkpoint Firewall SME - 1 Year renewable Contract (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327782

7. Information Assurance Manager w/ TS Clearance in Kyrgyzstan (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327745

8. Information Security Practice Manager - New York, NY $135K - $150K+ (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327737

9. Business Development Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327738

10. Senior Email Consultant for Computer Forensics Practice - New York , NY - $80- $100K (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327705

11. Internet Security Architect contract position in Pittsburgh PA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327531

12. Contract position in Atlanta, GA & Knoxville, TN...Interested? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327530

13. Looking for positions in the field of security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327529

14. Southern California, Chicago, Atlanta Info Security Postions (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327528

15. Washington DC Info Security Positions (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327527

16. List Closure till the 3rd of July (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327120

17. Salary for DITSCAP or INFOSEC work in the Mid West (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327097

18. Senior Security Consultant - London Financial (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/327073

VI. INCIDENTS LIST SUMMARY
-------------------------
1. Another overflow exploit for Apache? *RESOLVED* (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327660

2. frontpage extensions; backdoor or initial compromise? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327661

3. Another overflow exploit for Apache? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327593

4. UDP to port 500 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327563

5. msmsgs.exe /passportlogon /delaysync /shortpackets (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327548

6. AW: DoS "Probing" on one of our hosts (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327549

7. DoS "Probing" on one of our hosts (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327412

8. New MySQL worm? increased probes/traffic detected... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327378

9. re: DoS "Probing" on one of our hosts (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327183

10. Anyone else seeing a spike in SSHd scans? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327161

11. possible new irc worm (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327153

12. speaking of rootkits (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327141

13. rooted by blowkit (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327139

14. Intrusec 55808 Trojan Analysis (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327129

15. port 5248 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327128

16. strange logs -- tcp port 16166 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/327126

VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Minor security problem in Axis 560x web interface (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/327558

2. Red Hat 9: free tickets (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/327361

3. GetPC code (was: Shellcode from ASCII) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/327348

4. Corrupting memory control structures under XP (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/327272

5. Starting on Assembly under win32 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/327268

6. Windows Shellcode Writing (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/327157

7. cross-site to root scripting papers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/327026

8. gera's encoder (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/327028

9. Radware Linkproof: SSH port DoS (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/327024

VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SP4 installation failure (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327789

2. Q811114 and Q815021 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327788

3. How to block users from installing other apps (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327673

4. Managing Windows Event Logs (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327532

5. Limiting the creation of new files to specific types. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327363

6. SP4 instalation failure (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327307

7. SecurityFocus Microsoft Newsletter #143 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327282

8. SP4 installation (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327203

9. Windows NLB (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327075

10. Xp Home (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327081

11. Question about windows service (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327054

12. security auditing under windows 2000 server (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/327104

IX. SUN FOCUS LIST SUMMARY
----------------------------
1. TCP checksum and device driver eri0 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/327502

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. NO NEW POSTS FOR THE WEEK ENDING 07.04.03

XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: SpiDynamics

All undetectable by Firewalls and IDS! Download *FREE* white paper from
SPI Dynamics for a complete guide to protection!

Visit us at:
http://www.securityfocus.com/SPIDynamics-sf-news2
-------------------------------------------------------------------------------