SecurityFocus Newsletter #207
John Boletta <[email protected]> 28 Jul 2003 20:43:28 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #207
-----------------------------
This Issue is Sponsored by: SPI Dynamics
ALERT:
"How a Hacker Launches a LDAP Injection Attack Step-by-Step" - White Paper
It's as simple as placing additional LDAP query commands into a Web form
input box giving hackers complete access to all your backend systems!
Firewalls and IDS will not stop such attacks because LDAP Injections are
seen as valid data.
Download this *FREE* white paper from SPI Dynamics for a complete guide to
protection!
http://www.securityfocus.com/SPIDynamics-sf-news4
--------------------------------------------------------------------------
I. FRONT AND CENTER
1. "Copying is Theft ..."
2. Demonstrating ROI for Penetration Testing (Part One)
3. Detecting SQL Injection in Oracle
II. BUGTRAQ SUMMARY
1. Witango Server Remote Cookie Buffer Overflow Vulnerability
2. RAV AntiVirus Online Virus Scan RavonLine.DLL ActiveX Control...
3. Apache HTTP Server Multiple Vulnerabilities
4. SimpNews PATH_SIMPNEWS Remote File Include Vulnerability
5. GnuPG Group Root File Corruption Vulnerability
6. CGI.pm Start_Form Cross-Site Scripting Vulnerability
7. GNU GNATS Queue-PR Database Command Line Option Buffer Overflow...
8. Multiple Linux 2.4 Kernel Vulnerabilities
9. Microsoft Windows 2000 RPC DCOM Interface Denial of Service...
10. Drupal Cross-Site Scripting Vulnerability
11. AtomicBoard Directory Traversal Vulnerability
12. WebCalendar Local File Include Information Disclosure...
13. SCO OpenServer Display Local Privilege Escalation Vulnerability
14. SurfControl E-Mail Filter For SMTP Nested Zip File Filter...
15. Top Home Environment Variable Local Buffer Overflow Vulnerability
16. Ashnews Remote File Include Vulnerability
17. Savant Web Server CGITest.HTML Cross Site Scripting Vulnerability
18. Multiple Savant Web Server Denial Of Service Vulnerabilities
19. Microsoft Multiple IIS 6.0 Web Admin Vulnerabilities
20. MySQL AB ODBC Driver Plain Text Password Vulnerability
21. FDClone Local Insecure Temporary Directory Creation Vulnerability
22. Sun Solaris IPv6 Packet Denial of Service Vulnerability
23. 3Com DSL Router Administrative Interface Long Request Router...
24. Sun Solaris automountd Denial of Service Vulnerability
25. Novell Netware Enterprise Web Server CGI2Perl.NLM Buffer...
III. SECURITYFOCUS NEWS ARTICLES
1. The Hackers Who Broke Windows
2. Guilty Plea in Kinko's Keystroke Caper
3. Study finds computer voting system widely vulnerable to tampering
4. Online Identity-Theft Tactic Targeted
IV. SECURITYFOCUS TOP 6 TOOLS
1. Rate v0.81
2. Enigmail v0.81.0
3. Crash Core Analysis Suite v3.6-0.3
4. Ethereal v0.9.14
5. The SpamBouncer v1.5-Jul22
6. Gherkin v0.2.3
V. SECURITYJOBS LIST SUMMARY
1. Looking for a Security position (Thread)
2. Data Security/Audit Specialist- Chicago (Thread)
3. Looking for junior to mid level position - new and improved...
4. Penetration Testers Required; London UK. (Thread)
5. Common Criteria Evaluators - urgently required (Thread)
6. Looking for Security Work (Thread)
7. Risk / Security Management position sought (Thread)
8. Sr. Software/Embedded Systems Eng. (Thread)
9. Looking for a Job in Athens, Greece.??? (Thread)
10. VP of Marketing & Product Marketing Manager needed in Boston...
11. Security Research Support Engineer for TENABLE NETWORK...
12. Windows and Web interface GUI developer for TENABLE NETWORK...
13. Security Sales Account Executive position for TENABLE NETWORK...
14. Principal Intelligence Analyst vacancy (Thread)
15. CHIPSET SECURITY ARCHITECT - San Jose, CA (Thread)
16. Risk Management Analyst needed, Twin Cities (Thread)
17. seeking job in Sydney,Australia (Thread)
18. Seeking infosec opportunity (Thread)
19. Firewall support needed in Richmond, VA (Thread)
20. Secuity Software Sales Openings (Thread)
21. 2 Security Sales Opportunities in the Bay Area (Thread)
22. 7 Security Sales Opportunities in the Mid Atlantic (Thread)
23. 7 Security Sales Opportunities in the North East (Thread)
24. 6 Security Sales Opportunities in the Mid West (Thread)
25. JOB OPENING: Certification & Accreditation Security...
26. Promotionsstelle am Institut fuer Informatik und Gesellschaft...
27. Software Architect - Security (Thread)
28. Question about opportunities for Americans outside the US...
29. VOLUNTEER WORK (Thread)
30. JOB OPENING: Enterprise Security Architect (Thread)
31. Top Secret Cleared Security Professionals Wanted (Thread)
32. Security Software Engineer (Thread)
VI. INCIDENTS LIST SUMMARY
1. Port 0 packets (Thread)
2. New worm in Japan? (Thread)
3. Scan of TCP 552-554 (Thread)
4. [Full-Disclosure] Cisco IOS Denial of Service thataffects...
5. [Full-Disclosure] Cisco IOS Denial of Service that affects...
6. First time security issue. (Thread)
7. New SecurityFocus Articles (2) (Thread)
8. Cisco IOS Denial of Service that affects most Cisco IOS...
9. Importance of outbound traffic filtering (Thread)
10. Cisco IOS Denial of Service that affects most Cisco IOS...
11. Windows XP Guest Account. (Thread)
12. Cisco 0-day? [Was: strange protocol scans (and MOBP plug)]...
13. Cisco IOS vulnerability (Thread)
14. strange protocol scans (and MOBP plug) (Thread)
15. Strange DoS / new halflife server bug? (Update) (Thread)
16. Need some help and guidance, please.... TROJAN: Symantec: New...
17. Cisco ISO vul patch for packit 0.6.0c (Thread)
18. RES: Cisco IOS vulnerability (Thread)
19. Strange 4 MB Emails (Thread)
20. DOS / gameservers (Thread)
21. Cisco IOS Denial of Service that affects most Cisco IOS...
22. Strange domain-udp signature (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Shellcoding ... again. (Thread)
2. Does IE object type overflow work only on an Administrator...
3. Anyone looked at the canary stack protection in Win2k3? (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Tracking down a user in a large AD network (Thread)
2. SecurityFocus Microsoft Newsletter #146 (Thread)
3. plugging old IIS FTP holes (Thread)
4. Article Announcement: Waiting for the Worms (Thread)
5. Article Announcement: Forensic Log Parsing with Microsoft's...
6. Biometric fingerprint scanner (Thread)
IX. SUN FOCUS LIST SUMMARY
1.NO NEW POSTS FOR THE WEEK ENDING 07.25.03
X. LINUX FOCUS LIST SUMMARY
1.NO NEW POSTS FOR THE WEEK ENDING 07.25.03
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. "Copying is Theft ..."
By Mark Rasch
And other legal myths in the looming battle over peer-to-peer.
http://www.securityfocus.com/columnists/175
2. Demonstrating ROI for Penetration Testing (Part One)
By Marcia Wilson
This is the first in a series of articles demonstrating ROI (return on
investment) for a penetration test. You will have to step into the world
of budgeting, cost justification, resource allocation, and learn a few
unfamiliar terms.
http://www.securityfocus.com/infocus/1715
3. Detecting SQL Injection in Oracle
By Pete Finnigan
This paper takes the subject of SQL injection further and investigates the
possibilities for the Oracle Database Administrator to detect SQL
injection in the wild.
http://www.securityfocus.com/infocus/1714
II. BUGTRAQ SUMMARY
-------------------
1. Witango Server Remote Cookie Buffer Overflow Vulnerability
BugTraq ID: 8224
Remote: Yes
Date Published: Jul 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8224
Summary:
Witango Server is a rapid application development tool designed for Web
applications.
Because Witango does not properly perform bounds checking on variables
read from cookies, it may be possible to supply an excessively long value
to overrun an internal buffer stored on the stack. Specifically, if an
attacker sends an HTTP request to the Witango Server containing a cookie
with the Witango_UserReference variable set to a value exceeding
approximately 2864 bytes in length, the buffer overflow condition will be
triggered. Execution of arbitrary code may be possible, as attackers may
corrupt a saved instruction pointer residing in adjacent stack memory.
It should be noted that Witango Server must be installed with the
privileges of LocalSystem, and as a result, a complete compromise is
feasible by exploiting this vulnerability.
2. RAV AntiVirus Online Virus Scan RavonLine.DLL ActiveX Control Buffer
Overflow Vulnerability
BugTraq ID: 8225
Remote: Yes
Date Published: Jul 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8225
Summary:
ravonline.dll is a linked library distributed as part of the ActiveX
control for the RAV AntiVirus Online Virus Scan service.
ravonline.dll has been reported prone to a buffer overflow vulnerability.
The issue reportedly presents itself when excessive data is passed to the
browseForFolder() function.
It has been conjectured that this issue could potentially lead to the
execution of code with the privileges of the user executing the web
browser. This problem requires that a user with the vulnerable control
installed visit a web page that invokes the control in a manner sufficient
to trigger the issue. Upon doing so, it may be possible to create a
remotely exploitable stack overflow condition that results in the
overwriting of sensitive process memory. This, however, has not been
confirmed.
Although unconfirmed, because the function browseForFolder() is reportedly
imported from Shell32.dll, this issue may actually present itself in
Microsoft Windows native Shell32.dll library.
It should be noted, that ActiveX controls by nature might contain latent
vulnerabilities. Caution should be employed if installing ActiveX
controls.
3. Apache HTTP Server Multiple Vulnerabilities
BugTraq ID: 8226
Remote: Yes
Date Published: Jul 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8226
Summary:
Apache HTTP Server is a open-source web server designed to run on a number
of different platforms.
Apache HTTP Server version 1.3.28 has been released in response to
multiple vulnerabilities discovered. Apache is vulnerable to three
potential security issues. The impact of these vulnerabilities includes
denial of service, file descriptor leakage, and logging failures.
Under Windows and OS/2 systems, it may be possible to cause Apache to send
special control characters, namely a 0x1A character, over a pipe. This
could potentially cause Apache to cease logging and exit.
It has also been reported that attackers may be able to send specially
crafted requests that cause Apache to go into an internal loop and
eventually crash.
Additionally, Apache may under certain circumstances leak file descriptors
from a parent process to a child process. This could result in varying
degrees of unauthorized access.
Multiple BIDs are currently pending for these issues. When individual BIDs
are available, this BID will be retired.
4. SimpNews PATH_SIMPNEWS Remote File Include Vulnerability
BugTraq ID: 8227
Remote: Yes
Date Published: Jul 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8227
Summary:
SimpNews is a web news system implemented in PHP. It is available for
Unix/Linux variants and Microsoft Windows operating systems.
SimpNews is prone to a vulnerability that may permit remote attackers to
include and execute malicious PHP scripts. Remote users, under some PHP
configurations, may influence the $path_simpnews URI variable. This
variable is used in the include path for the 'config.php', 'functions.php'
and 'includes/has_entries.inc' scripts. By influencing the include path so
that it points to a malicious PHP script on a remote system, it is
possible to cause arbitrary PHP code to be executed. This would occur in
the context of the web server. This issue exists in both the
'eventcal2.php' and 'eventscroller.php' scripts.
This could be exploited to execute malicious PHP commands in the context
of the web server process.
It should be noted that although SimpNews versions 2.01 through 2.13 have
been reported vulnerable, other versions might also be affected.
5. GnuPG Group Root File Corruption Vulnerability
BugTraq ID: 8228
Remote: No
Date Published: Jul 19 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8228
Summary:
gnupg is an encryption utility that is available for a number of
platforms, including Unix/Linux variants.
gnupg is reported to be prone to an issue that could permit a malicious
local user to corrupt files owned by the root group. This issue is
reportedly the result of gnupg having setgid root privileges. The issue
was reported for Gentoo Linux, though other distributions may have a
similar default installation and be prone to this issue.
This vulnerability may potentially be exploited to corrupt critical or
sensitive files for a denial of service. The possibility of privilege
escalation also exists.
6. CGI.pm Start_Form Cross-Site Scripting Vulnerability
BugTraq ID: 8231
Remote: Yes
Date Published: Jul 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8231
Summary:
CGI.pm is a module for Perl that allows for dynamic creation of web forms
and parsing of CGI input.
CGI.pm is prone to cross-site scripting attacks under some circumstances.
This issue occurs because the start_form() function (or other functions
which use this function such as start_multipart_form()) does not
sufficiently sanitize HTML and script code when a form action is not
specified. This could expose scripts that use the function to cross-site
scripting attacks.
This issue could be exploited to cause hostile HTML and script code to be
rendered in the browser of a user who is enticed to visit a malicious link
to a vulnerable script. The code would be interpreted in the context of
the vulnerable site. Exploitation could allow theft of cookie-based
authentication credentials or other attacks.
7. GNU GNATS Queue-PR Database Command Line Option Buffer Overflow
Vulnerability
BugTraq ID: 8232
Remote: No
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8232
Summary:
GNU GNATS is a freely available bug tracking system. It is available for a
variety of Linux and Unix variant operating environments.
The queue-pr utility is shipped as part of GNATS and is intended as a
tool, used to manage the GNATS queue. The queue-pr utility is a setuid
utility typically with UID 'gnats' privileges.
A stack overflow vulnerability has been reported for the queue-pr utility.
The vulnerability occurs due to insufficient bounds checks performed on
the database name passed to the '-d' commandline option.
An attacker may invoke the queue-pr utility passing a malicious database
name (>=1148 bytes of data), in a manner sufficient to trigger the
vulnerability.
Successful exploitation may result in the execution of attacker-supplied
code with potentially elevated privileges.
It should be noted that on some systems, the queue-pr utility might be
installed with setuid 'root' privileges.
It should be noted that although this vulnerability has been reported to
affect GNATS version 3.113.1_6, other versions might be affected.
8. Multiple Linux 2.4 Kernel Vulnerabilities
BugTraq ID: 8233
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8233
Summary:
Red Hat has released an advisory reporting the existence of multiple
vulnerabilities in the Linux 2.4 kernel. The following issues were
reported:
/proc/tty/driver/serial may expose sensitive information to local
attackers by revealing the exact character count for serial links. This
information could permit a malicious local user to infer password lengths
and the timing between keystrokes when entering passwords. This might aid
in brute-force attacks that attempt to compromise another user's password.
A race condition in the implementation of the execve() system was
reported. This issue is described in BID 8042.
The kernel RPC code was reported to have recently changed, causing the
reuse flag on newly created sockets to be set. This introduced a
vulnerability that could permit unprivileged users to bind to UDP ports
used for related services, such as nfsd.
A vulnerability in the implementation of the execve() system could permit
malicious local users to gain read access to restricted file descriptors.
This occurs because the file descriptor of the executable process is
stored in the file table of the calling process. This could be exploited
to gain access to sensitive information. This is related to the race
condition in execve() and is also discussed in BID 8042.
A flaw in the /proc filesystem could be exploited to gain access to
sensitive information. If /proc/self entries are opened before executed a
setuid program, the program may fail to change the ownership and
permissions of entries that are already open.
The STP protocol on Red Hat was disabled due to lack of security. This
could be an issue on other distributions. An additional issue with STP
was reported in the kernel that may permit denial of service attacks, due
to insufficient length checking.
It was reported that the kernel Forwarding table may be spoofed if forged
packets are received that have the same source IP address as the host.
These issues will be divided into separate BIDs when further analysis is
complete.
9. Microsoft Windows 2000 RPC DCOM Interface Denial of Service
Vulnerability
BugTraq ID: 8234
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8234
Summary:
Microsoft Windows uses Remote Procedure Calls (RPC) for client-server
communications in a distributed computing environment (DCE). TCP Port 135
is typically used for DCE endpoint resolution.
A vulnerability in the Windows DCE-RPC stack could allow a remote user to
disable RPC services. If a specifically malformed packet is sent to the
DCOM __RemoteGetClassObject interface on a vulnerable system, the RPC
service may fail. This is due to a NULL pointer being passed from
__RemoteGetClassObject to the PerformScmStage function.
Because other services may depend on the RPC service, the loss of this
interface may impact other components on the system, possibly causing them
to fail as well.
It should be noted that once disabled, it might be possible for local
users to gain elevated privileges by hijacking orphaned pipes left by the
RPC process. This issue is described in BID 6769.
This issue may be related to BID 6005, however, this has not been
confirmed. Reportedly, this vulnerability affects systems that have
applied the patch for Microsoft Security Bulletin MS03-026.
10. Drupal Cross-Site Scripting Vulnerability
BugTraq ID: 8235
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8235
Summary:
Drupal is an open-source content management system. Drupal is available
for a number of platforms including Microsoft Windows operating systems
and Unix/Linux variants.
The Drupal content management system is prone to a cross-site scripting
vulnerability. This issue is exposed through the main page and through
other sub-pages. An attacker may exploit this issue by including hostile
HTML and script code in a malicious link to Drupal. This code may be
rendered in the web browser of a user who visits the link. This would
occur in the security context of the site hosting Drupal.
The attacker-supplied HTML and script code would be able to access
properties of the site, potentially allowing for theft of cookie-based
authentication credentials. An attacker could also exploit this issue to
control how the site is rendered to the user.
11. AtomicBoard Directory Traversal Vulnerability
BugTraq ID: 8236
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8236
Summary:
AtomicBoard is a weblog and message board system written in PHP.
It has been reported that attackers may be able to modify the 'location'
URI variable passed to the index.php file to cause the Web server to
return arbitrary files. This script is prone to a directory traversal
vulnerability, allowing attackers to retrieve any file residing on the
filesystem readable by the Web server user.
Specifically, by issuing a malicious request that contains directory
traversal sequences, '../..', an attacker may be able to break out of the
web root and disclose potentially sensitive web server readable files.
Additionally, by supplying an invalid filename, the web server may return
an error message disclosing the path to the AtomicBoard system.
The vendor claims this software is an alpha version and acknowledges the
insecurity present. The author advises that users do not deploy this
software in secure or sensitive environments.
It should be noted that although AtomicBoard version 0.6.2 has been
reported vulnerable, other versions might also be affected.
12. WebCalendar Local File Include Information Disclosure Vulnerability
BugTraq ID: 8237
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8237
Summary:
WebCalendar is a freely available, open source web calendar software
package. It is available for the Unix and Linux operating systems.
It has been reported that an information disclosure issue exists in
WebCalendar. This may allow an attacker to gain unauthorized read access
to potentially sensitive information with the privileges of the web server
process.
The problem is in the handling of directory traversal strings when passed
to a specific variable. When a request for any PHP script is made and
directory traversal strings are passed to the user_inc variable, it is
possible to view a file at the end of the directory traversal string.
13. SCO OpenServer Display Local Privilege Escalation Vulnerability
BugTraq ID: 8238
Remote: No
Date Published: Jul 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8238
Summary:
OpenServer is a commercially available UNIX operating system distributed
and maintained by SCO.
A vulnerability has been reported in the SCO display program. This
problem may make it possible for an attacker to gain unauthorized
privileges on a vulnerable system.
The specifics of this issue are not currently known. This BID will be
updated when further analysis has been completed.
It is speculated that this issue is a memory corruption error. However,
this information has not been confirmed. This vulnerability may be
related to the vulnerability described in BID 8177, titled "ImageMagick
Display Filename Format String Vulnerability."
14. SurfControl E-Mail Filter For SMTP Nested Zip File Filter Bypass
Vulnerability
BugTraq ID: 8240
Remote: Yes
Date Published: Jul 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8240
Summary:
SurfControl E-Mail Filter for SMTP is a gateway e-mail scanner that is
compatible with a number of SMTP server implementations. It is available
for Microsoft Windows operating systems.
It is reported that nested zip files may bypass the scanning mechanism in
Surf Control E-Mail Filter for SMTP. If a zipped message attachment
contains 16 other zip files, the filter will scan the first 15 files but
fail to scan the 16th. Scanning is reportedly done alphabetically so it
is possible to control the order in which files are scanned.
This could permit content that is malicious or restricted by security
policy to bypass the e-mail filter. An end-user would still be required
to execute any malicious content that is sent via this medium.
This issue may be exploitable with other archive formats. Other
SurfControl products may also use a similar scanning mechanism and may be
prone to this issue as well, though this has not been confirmed.
15. Top Home Environment Variable Local Buffer Overflow Vulnerability
BugTraq ID: 8239
Remote: No
Date Published: Jul 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8239
Summary:
top is a freely available, open source process monitoring utility. It is
available for various Unix and Linux platforms.
A buffer overflow condition has been reported in top when handling
environment variables of excessive length. This may result in an attacker
potentially executing arbitrary code.
The problem is in the checking of bounds on the HOME environment variable.
top does not properly handle input of excessive length in the HOME
environment variable. By placing a string of excessive length (1100
bytes) in this environment variable, an attacker may be able to corrupt
sensitive process memory, and potentially execute arbitrary code with the
privileges of the top program.
It should be noted that top is typically installed with the setuid root
bit set.
Additionally, although top versions less than or equal to version 2.0.11
have been reported vulnerable, it should be noted that other versions
might also be vulnerable.
16. Ashnews Remote File Include Vulnerability
BugTraq ID: 8241
Remote: Yes
Date Published: Jul 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8241
Summary:
Ashnews is a web based news board system written in PHP.
Ashnews is prone to a vulnerability that may permit remote attackers to
include and execute malicious PHP scripts. Remote users, under some PHP
configurations, may influence the $pathtoashnews variable. This variable
is used in the include path for the ashnews.php and ashheadlines.php
scripts. By influencing the include path so that it points to a malicious
PHP script on a remote system, it is possible to cause arbitrary PHP code
to be executed. This would occur in the context of the web server.
This could be exploited to execute malicious PHP commands in the context
of the web server process.
17. Savant Web Server CGITest.HTML Cross Site Scripting Vulnerability
BugTraq ID: 8242
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8242
Summary:
Savant web server is a free web server that runs on Windows platforms.
cgitest.html is a demonstration script that is installed by default on
Savant Web Server installs.
cgitest.html has been reported prone to cross-site scripting attacks. The
issue occurs due to a lack of sufficient sanitization performed on data
supplied to the cgitest.html script.
This issue could be exploited to cause hostile HTML and script code to be
rendered in the browser of a user who is enticed to visit a malicious link
to the vulnerable script. The code would be interpreted in the context of
the vulnerable site. Exploitation could allow theft of cookie-based
authentication credentials or other attacks.
It should be noted that while this vulnerability has been reported to
affect Savant web server version 3.1, other versions might also be
affected.
18. Multiple Savant Web Server Denial Of Service Vulnerabilities
BugTraq ID: 8243
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8243
Summary:
Savant web server is a free web server that runs on Windows platforms.
Savant web server has been reported prone to multiple denial of service
vulnerabilities.
Reportedly, a remote attacker may invoke many HTTP requests, against the
Savant web server, in rapid succession. It has been reported that this
activity will trigger an exception in the Savant web server and the
service will fail.
Additionally a remote attacker may make a HTTP request of excessive
length. This will also reportedly cause an exception in the Savant web
server causing the service to fail. This issue may be identical to the
issue described in BID 3788; this however has not been confirmed.
It should be noted that while this vulnerability has been reported to
affect Savant web server version 3.1, other versions might also be
affected.
19. Microsoft Multiple IIS 6.0 Web Admin Vulnerabilities
BugTraq ID: 8244
Remote: Yes
Date Published: Jul 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8244
Summary:
Multiple vulnerabilities have been reported in the web admin interface
that is included in Microsoft IIS 6.0.
Multiple instances of cross-site scripting vulnerabilities were discovered
in many of the ASPs that are included in the web admin interface. In
particular, input supplied to the ReturnURL parameter via many of these
scripts (such as Web_LogSettings.asp) may not be sanitized before being
echoed back to a user of the interface. An attacker could exploit these
issues via a malicious link to the interface that contains hostile HTML or
script code. This could cause attacker-supplied code to be rendered in
the web browser of a legitimate interface user who follows the link.
Additionally, it is reported that the web admin interface could expose
valid session IDs or permit unauthorized access to areas that do not
require session IDs. These issues may in part be due to insufficient
access validation for certain web admin interface components. Scripts
that may be affected include default.asp, tasks.asp and users.asp.
This BID will be separated into separate BIDs when further analysis of
these issues is complete.
20. MySQL AB ODBC Driver Plain Text Password Vulnerability
BugTraq ID: 8245
Remote: No
Date Published: Jul 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8245
Summary:
A vulnerability has been reported in the MySQL AB ODBC (Open Data Base
Connectivity) driver implementation. Reportedly, ODBC credentials are
stored in the system registry using plain text format.
When creating ODBC connections, the MySQL ODBC driver reportedly stores
plain text credentials used to connect to the specified database in the
system registry. ODBC SYSTEM-DSN entries are stored in the
HKEY_LOCAL_MACHINE branch of the system registry, unlike USER-DSN entries
which are stored in HKEY_LOCAL_USER registry branch. This may exaggerate
the impact of the vulnerability when relating to MySQL ODBC SYSTEM-DSN
entries, because the data may be accessible to a greater number of users.
If a local user has read access to the registry key that contains the
sensitive data, the credentials may be disclosed and used to connect to
the target database.
It should be noted that this issue might be configuration specific. Other
ODBC drivers may also be prone to the same issue, though this is not
confirmed.
21. FDClone Local Insecure Temporary Directory Creation Vulnerability
BugTraq ID: 8247
Remote: No
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8247
Summary:
fdclone is a freely available, open source file management tool. It is
available for the Linux platform.
A problem has been reported in the creation of temporary directories by
fdclone. Because of this, an attacker may be able to gain access to
potentially sensitive information.
The problem is in the creation of directories by the fdclone program in
the /tmp directory. fdclone does not properly check for the existence of
temporary directories prior to execution, and does not validate
permissions on already existing directories. Because of this, an attacker
may be able to gain access to the contents of temporary files created by
fdclone. It may also be possible to launch symbolic link attacks with
this vulnerability.
22. Sun Solaris IPv6 Packet Denial of Service Vulnerability
BugTraq ID: 8250
Remote: Yes
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8250
Summary:
Sun Solaris is a popular Unix-based operating system designed for x86 and
sparc platforms.
Sun has issued a security alert detailing a vulnerability present in the
Solaris 8 kernel. It is reported that the Solaris kernel may not properly
handle specific types of IP version 6 packets, potentially resulting in a
kernel panic. It may be possible for remote attackers to construct a
malicious packet that will trigger this condition to cause a denial of
service.
Specific details regarding the type of packet that may trigger this
vulnerability are currently not known. This alert will be updated as more
information becomes available.
23. 3Com DSL Router Administrative Interface Long Request Router Denial Of
Service Vulnerability
BugTraq ID: 8248
Remote: Yes
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8248
Summary:
The 812 OfficeConnect is one of a series of DSL routers distributed and
maintained by 3Com.
A vulnerability in the 3Com 812 OfficeConnect has been reported that may
result in the router becoming unstable. Because of this, an attacker may
be able to deny service to legitimate users of the vulnerable router.
The problem is in the handling of requests of excessive length by the
administrative interface. When an attacker sends a string of 512 or more
bytes to the administrative interface on port 80, the router reboots.
This could be exploited repeatedly, resulting in an prolonged denial of
service.
It should be noted that the administrative interface is reachable only via
the LAN interface of the DSL router, and cannot be accessed by the
untrusted network side by default.
It should also be noted that this issue is likely a memory corruption
vulnerability. Although unconfirmed, a possibility exists that this issue
may be exploitable to execute arbitrary code. This issue may also affect
other 3Com routers.
24. Sun Solaris automountd Denial of Service Vulnerability
BugTraq ID: 8253
Remote: No
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8253
Summary:
Sun Solaris is a popular Unix-based operating system designed for x86 and
sparc platforms.
Sun has released a security alert detailing a vulnerability present in
automountd(1M). This vulnerability may allow local users to cause the
automountd process to crash, resulting in a denial of service condition.
According to Sun, systems affected are Solaris 8 installations with the
following patches applied:
108993-14 through 108993-19 (SPARC) or, 108994-14 through 108994-19 (x86)
Specific details regarding exploitation of this vulnerability are
currently not known. This BID will be updated as more information becomes
available.
25. Novell Netware Enterprise Web Server CGI2Perl.NLM Buffer Overflow
Vulnerability
BugTraq ID: 8251
Remote: Yes
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8251
Summary:
Novell Netware Enterprise Web Server CGI2Perl.NLM has been reported prone
to a buffer overflow vulnerability.
The issue presents itself, likely due to insufficient bounds checking
performed on user-supplied requests that are passed to the perl
interpreter via the perl virtual directory. It has been reported that a
remote attacker may send data in a manner sufficient to trigger the
condition, and cause one or more server ABEND conditions. This may result
in server performance degradation or ultimately in the failure of the
server. Effectively denying service to legitimate users.
It should be noted, that the vendor has reported that no root shell
exploit from this kind of failure on Netware is currently known. However
due to the nature of this vulnerability, it has been conjectured that
arbitrary code execution may be possible; this however has not been
confirmed.
This vulnerability has been reported to affect the cgi2perl.nlm for
Netware Enterprise Web Server on Netware 5.0 and 6.0.
III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. The Hackers Who Broke Windows
By Deborah Radcliff
The Polish security researchers in the Last Stage of Delirium crack
unbreakable systems and find software security holes missed by
multi-million dollar corporations. They just don't sleep much. ... >>
http://www.securityfocus.com/news/6519
2. Guilty Plea in Kinko's Keystroke Caper
By Kevin Poulsen
A New York cyberthief bugged the public access machines at thirteen
Manhattan Kinko's shops for nearly two years. His take: hundreds of online
banking passwords.
http://www.securityfocus.com/news/6447
3. Study finds computer voting system widely vulnerable to tampering
By Brian Witte, The Associated Press
An electronic voting system used in some states as an alternative to the
troublesome punch-card ballots is highly vulnerable to fraud, computer
security experts warned in a study released Thursday.
http://www.securityfocus.com/news/6530
4. Online Identity-Theft Tactic Targeted
By Jonathan Krim, Washington Post
A Los Angeles 17-year-old has settled charges that he used fake Web pages
to lure consumers to provide credit card numbers and other personal data,
the Federal Trade Commission announced yesterday in a crackdown on a
growing form of Internet fraud.
http://www.securityfocus.com/news/6517
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Rate v0.81
by mteg
Relevant URL:
http://s-tech.elsat.net.pl/
Platforms: FreeBSD, Linux, OpenBSD, Solaris, SunOS
Summary:
Rate is a Swiss-Army-knife bandwidth measurement tool. Its primary
application is calculating the bandwidth used by packets matching a given
BPF packet filter expression, which can really help a network
administrator see what is happening at a software-based router at the
moment. Administrators can measure the traffic generated by a single host
or by a whole subnet, and measure HTTP traffic, broadcast traffic, quake
traffic, etc. It can also be used for generating per-IP statistics and for
determining nodes that generate highest traffic; it has a special
operation mode for it. Additionally, it is able to extract strings from
packets based on a POSIX regular expression.
2. Enigmail v0.81.0
by Patrick
Relevant URL:
http://enigmail.mozdev.org/thunderbird.html
Platforms: Linux, MacOS, POSIX, UNIX, Windows 2000, Windows 3.x, Windows
95/98, Windows CE, Windows NT, Windows XP
Summary:
Enigmail is a "plugin" for the mail client of Mozilla and Netscape 7.x
which allows users to access the authentication and encryption features
provided by the popular GnuPG software. Enigmail can encrypt/sign mail
when sending, and can decrypt/authenticate received mail. It can also
import/export public keys. Enigmail supports both the inline PGP format
and the PGP/MIME format, which can be used to encrypt attachments.
Enigmail is cross-platform, although binaries are supplied only for a
limited number of platforms. Enigmail uses inter-process communication to
execute GPG to carry out encryption/authentication.
3. Crash Core Analysis Suite v3.6-0.3
by Mission Critical Linux [email protected]
Relevant URL:
http://oss.missioncriticallinux.com/projects/crash/
Platforms: Linux, POSIX
Summary:
The Crash Core Analysis Suite utility is a self-contained tool, loosely
based on the SVR4 crash command but completely merged with gdb, thereby
combining the kernel-specific nature of crash with the source level
debugging capabilities of gdb. The utility can be used to investigate live
systems, kernel core dumps created from the Kernel Core Dump patch offered
by Mission Critical Linux, and kernel core dumps created from the Linux
Kernel Crash Dumps (LKCD) patch offered by SGI.
4. Ethereal v0.9.14
by Gerald Combs, [email protected]
Relevant URL:
http://www.ethereal.com/
Platforms: AIX, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD, SCO,
Solaris, True64 UNIX
Summary:
Ethereal is a network protocol analyzer, or "packet sniffer", that lets
you capture and interactively browse the contents of network frames. The
goal of the project is to create a commercial-quality packet analyzer for
Unix, and the most useful packet analyzer on any platform.
5. The SpamBouncer v1.5-Jul22
by BACbKA [email protected]
Relevant URL:
http://www.spambouncer.org/
Platforms: UNIX
Summary:
The SpamBouncer is a set of procmail instructions that search the headers
and text of your incoming email to see if it meets one or more of a list
of conditions for probable spam. It will then either tag the suspected
spam and return it to your main incoming mailbox, tag the suspected spam,
delete spam from known spam sources, and file suspected spam in a separate
folder, send a simulated MAILER-DAEMON daemon "bounce", complain to the
"upstream providers" of known spammers or spam sites/domains, etc.
6. Gherkin v0.2.3
by mschmuhl
Relevant URL:
http://www.altmode.com/gherkin
Platforms: Os Independent, POSIX
Summary:
Gherkin is a Web-enabled multi-threaded, centralized security scan manager
that incorporates Nessus vulnerability scanning, DNS and nmblookup name
resolution, nmap fingerprinting and scanning, and customized
traceroute-based network node detection.
V. SECURITY JOBS SUMMARY
------------------------
1. Looking for a Security position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330175
2. Data Security/Audit Specialist- Chicago (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330161
3. Looking for junior to mid level position - new and improved resume
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330145
4. Penetration Testers Required; London UK. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330123
5. Common Criteria Evaluators - urgently required (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330112
6. Looking for Security Work (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330114
7. Risk / Security Management position sought (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330110
8. Sr. Software/Embedded Systems Eng. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330118
9. Looking for a Job in Athens, Greece.??? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330036
10. VP of Marketing & Product Marketing Manager needed in Boston (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330035
11. Security Research Support Engineer for TENABLE NETWORK SECURITY
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330001
12. Windows and Web interface GUI developer for TENABLE NETWORK SECURITY
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329991
13. Security Sales Account Executive position for TENABLE NETWORK
SECURITY (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330005
14. Principal Intelligence Analyst vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329990
15. CHIPSET SECURITY ARCHITECT - San Jose, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/330006
16. Risk Management Analyst needed, Twin Cities (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329992
17. seeking job in Sydney,Australia (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329995
18. Seeking infosec opportunity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329989
19. Firewall support needed in Richmond, VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329831
20. Secuity Software Sales Openings (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329825
21. 2 Security Sales Opportunities in the Bay Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329817
22. 7 Security Sales Opportunities in the Mid Atlantic (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329816
23. 7 Security Sales Opportunities in the North East (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329815
24. 6 Security Sales Opportunities in the Mid West (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329814
25. JOB OPENING: Certification & Accreditation Security Consultants
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329789
26. Promotionsstelle am Institut fuer Informatik und Gesellschaft,
Freiburg (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329786
27. Software Architect - Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329785
28. Question about opportunities for Americans outside the US (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329788
29. VOLUNTEER WORK (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329784
30. JOB OPENING: Enterprise Security Architect (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329604
31. Top Secret Cleared Security Professionals Wanted (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329526
32. Security Software Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/329525
VI. INCIDENTS LIST SUMMARY
-------------------------
1. Port 0 packets (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/330389
2. New worm in Japan? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/330388
3. Scan of TCP 552-554 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/330354
4. [Full-Disclosure] Cisco IOS Denial of Service thataffects most Cisco
IOS routers- requires power cycle to recover (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/330334
5. [Full-Disclosure] Cisco IOS Denial of Service that affects most Cisco
IOS routers- requires power cycle to recover (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/330336
6. First time security issue. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/330132
7. New SecurityFocus Articles (2) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/330024
8. Cisco IOS Denial of Service that affects most Cisco IOS routers-
requires power cycle to recover (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/330023
9. Importance of outbound traffic filtering (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329996
10. Cisco IOS Denial of Service that affects most Cisco IOSrouters-
requires power cycle to recover (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/330000
11. Windows XP Guest Account. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329699
12. Cisco 0-day? [Was: strange protocol scans (and MOBP plug)] (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329698
13. Cisco IOS vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329685
14. strange protocol scans (and MOBP plug) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329675
15. Strange DoS / new halflife server bug? (Update) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329659
16. Need some help and guidance, please.... TROJAN: Symantec: New Serious
Virus found. (fwd) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329660
17. Cisco ISO vul patch for packit 0.6.0c (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329553
18. RES: Cisco IOS vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329567
19. Strange 4 MB Emails (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329566
20. DOS / gameservers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329548
21. Cisco IOS Denial of Service that affects most Cisco IOS routers-
requires power cycle to recover (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329556
22. Strange domain-udp signature (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/329478
VII. VULN-DEV RESEARCH LIST SUMMARY
----------------------------------
1. Shellcoding ... again. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/330392
2. Does IE object type overflow work only on an Administrator account?
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/330384
3. Anyone looked at the canary stack protection in Win2k3? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/329734
VIII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Tracking down a user in a large AD network (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/330458
2. SecurityFocus Microsoft Newsletter #146 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/329805
3. plugging old IIS FTP holes (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/329771
4. Article Announcement: Waiting for the Worms (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/329732
5. Article Announcement: Forensic Log Parsing with Microsoft's LogParser
(Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/329729
6. Biometric fingerprint scanner (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/329727
IX. SUN FOCUS LIST SUMMARY
----------------------------
1. NO NEW POSTS FOR THE WEEK ENDING 07.25.03
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. NO NEW POSTS FOR THE WEEK ENDING 07.25.03
XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: SPI Dynamics
ALERT:
"How a Hacker Launches a LDAP Injection Attack Step-by-Step" - White Paper
It's as simple as placing additional LDAP query commands into a Web form
input box giving hackers complete access to all your backend systems!
Firewalls and IDS will not stop such attacks because LDAP Injections are
seen as valid data.
Download this *FREE* white paper from SPI Dynamics for a complete guide to
protection!
http://www.securityfocus.com/SPIDynamics-sf-news4
--------------------------------------------------------------------------