SecurityFocus Newsletter # 209
John Boletta <[email protected]> 11 Aug 2003 19:44:05 -0000
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter # 209
------------------------------
Precisely Define and Implement Network Security and Performance Policies
Integrated Intrusion Prevention and Traffic Shaping to:
- Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
- Automatically Control P2P, IM and Spam Traffic
- Ensure Reliable Performance of Mission Critical Applications
**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo
http://www.securityfocus.com/sponsor/CaptusNetworks_sf-news_030811
------------------------------------------------------------------------
I. FRONT AND CENTER
1. The Lingering Ghost of Slammer
2. Blogs: Another Tool in the Security Pro's Toolkit (Part Two)
3. Demonstrating ROI for Penetration Testing (Part Two)
II. BUGTRAQ SUMMARY
1. Multiple Atari800 Emulator Local Buffer Overflow Vulnerabili...
2. Cisco IOS UDP Echo Service Memory Disclosure Vulnerability
3. RAV AntiVirus Online Virus Scan Ravupdt.DLL ActiveX Control ...
4. Novell GroupWise Wireless Webaccess Insecure Logged Password...
5. IISShield Unspecified Scan Bypass Vulnerability
6. Hassan Consulting Shopping Cart Multiple Vulnerabilities
7. CDRTools RSCSI Debug File Arbitrary Local File Manipulation ...
8. Symantec Norton AntiVirus Device Driver Memory Overwrite Vul...
9. Linux Netfilter NAT Remote Denial of Service Vulnerability
10. Netfilter Connection Tracking Denial of Service Vulnerabilit...
11. mindi Temporary File Creation Vulnerabilities
12. Multiple Postfix Denial of Service Vulnerabilities
13. Counterpane Password Safe Clipboard Data Recovery Vulnerabil...
14. Invision Board Overlapping IBF Formatting Tag HTML Injection...
15. HP Compaq Insight Management Agent Format String Vulnerabili...
16. Xtokkaetama Nickname Local Buffer Overflow Vulnerability
17. Macromedia Dreamweaver MX PHP User Authentication Suite Cros...
18. NetBSD Kernel OSI Packet Handler Remote Denial Of Service Vu...
19. Man-db DEFINE Arbitrary Command Execution Vulnerability
20. ZoneAlarm Local Device Driver IO Control Code Execution Vuln...
21. EveryBuddy Long Message Denial Of Service Vulnerability
22. IBM DB2 db2job File Overwrite Vulnerability
23. FreezingCold Software aspBoard URL HTML Injection Vulnerabil...
24. IBM DB2 Shared Library Injection Vulnerability
25. TightVNC Win32 Server QueryAllowNoPass Access Control Bypass...
26. gURLChecker HTML Parser Denial Of Service Vulnerability
27. Webware WebKit Cookie String Command Execution Vulnerability
28. ERoaster Local Insecure Temporary File Creation Vulnerabilit...
29. Sun Microsystems ONE Application Server Java Server Page Sou...
30. ManDB Compressor Binary Substitution Vulnerability
31. JSCI SSO URI Pattern Matching Access Validation Vulnerabilit...
32. vBulletin Register.PHP HTML Injection Vulnerability
33. D-Link DI-704P Long URL Denial Of Service Vulnerability
34. 121 Software 121 WAM! FTP Server Directory Traversal Vulnera...
35. Bea WebLogic/Liquid Data Multiple Cross-Site Scripting Vulne...
36. Cisco Content Service Switch ONDM Ping Failure Denial Of Ser...
37. Lotus Sametime Multiple Encryption Implementation Flaw Vulne...
38. IdealBB Error.ASP Cross-Site Scripting Vulnerability
39. Postfix Connection Proxying Vulnerability
40. Postfix SMTP Malformed E-mail Envelope Address Denial of Ser...
41. MiniHTTPServer WebForums Server Null Default Password Vulner...
42. VMware Workstation For Linux File Deletion Vulnerability
43. IPNetSentryX / IPNetMonitorX Unauthorized Network Reconnaiss...
44. TCPflow Format String Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. NSA Proposes Backdoor Detection Center
2. Appeal in bug disclosure case
3. Official: Cyberterror fears missed real threat
4. Habeas cans spammer
5. Security spending to hit $13.5bn by 2006
6. Security spending to hit $13.5bn by 2006
IV. SECURITYFOCUS TOP 6 TOOLS
1. AIM Sniff v0.1.2
2. FIAIF is an Intelligent Firewall v1.16.0
3. FirePay v0.9.2
4. Antinat v0.61
5. Webanalyse v1.13
6. ngrep v1.41
V. SECURITYJOBS LIST SUMMARY
1. Security analyst and experienced network engineer se... (Thread)
2. Senior Security Engineer wanted Miami/Fort Lauderdal... (Thread)
3. InfoSec Ninj4 Wanted (Thread)
4. Security Professional with Auditing or Certification... (Thread)
5. Checkpoint Network Security Consultant needed (Thread)
6. LURHQ is hiring! (Thread)
7. Firewall Security Expert (Thread)
8. Channel Sales Manager, Germany (Thread)
9. Security Professional openings (2) in Jax, Fl (Thread)
10. Security Professional Needed (Thread)
11. Security Systems Administrator/Architect - Redwood C... (Thread)
12. Senior Product Manager, SF Bay Area (Thread)
13. Strategic Business Development Manager - #798JA - S... (Thread)
14. Request for Job Postings...Job descriptions included... (Thread)
15. Security Researcher/Signature Developer needed (Thread)
16. IDS / IPS and Network Security Professional looking ... (Thread)
17. Multiple Positions - St. Louis - Software Security D... (Thread)
18. Audit (Thread)
19. Web-based Application Security Engineer (Thread)
20. Security Product Line Manager - New Jersey (Thread)
21. Director of Sales & Marketing - Zurich (Thread)
22. VP Microsoft Security Architecture - NYC Financial ... (Thread)
23. Spam slipped through - DMR (Thread)
24. URGENT REQUIREMENT - Sr. IDS Manager, Bethesda, MD (Thread)
25. Kidnap & Ransom, Security Consulting (Thread)
26. Senior Product Manager- Sunnyvale, CA (Thread)
27. Question about opportunities for Americans outside t... (Thread)
28. ERP Senior Consultant (Thread)
29. job opening (Thread)
30. IMMEDIATE Opportunity (Thread)
31. The potential Expat ....... (Thread)
32. Internship in Australia (Thread)
33. Senior Forensics & Incident Handler GURU needed ASAP... (Thread)
34. Mail Filter by Location within Subject Field (Thread)
35. Looking for UNIX Security / Penetration Tester - UK (Thread)
VI. INCIDENTS LIST SUMMARY
1. Dig in: autorooter, maybe that IRC one but SAV doesn... (Thread)
2. Heads up! distributed scans and attacks targeting ns... (Thread)
3. port 445 probes continued (Thread)
4. [normal] RE: [Full-Disclosure] Re: Secure.dcom.exe (Thread)
5. New mail scanner? (Thread)
6. Heads up! distributed scans and attacks targeting n... (Thread)
7. Secure.dcom.exe (Thread)
8. [unisog] Heads up! distributed scans and attacks tar... (Thread)
9. DCOM95 for Windows 95 (Thread)
10. [unisog] Heads up! distributed scans and attacks ta... (Thread)
11. Stumbler: Reserved IP 73.247.223.148 scan source (Thread)
12. 445 probes (Thread)
13. Musical irc bot backdoor? (Thread)
14. FW: Secure.dcom.exe (Thread)
15. Backdoor.Trojan and payload.dat (Thread)
16. WORM_MIMAIL.A Anyone have any info on what this does... (Thread)
17. WORM_MIMAIL.A cleaner ? (Thread)
18. Question for all (Thread)
19. Pdmin / Trojaned csrss.exe (Thread)
20. Command Line RPC vulnerability scanner? (Thread)
21. /tmp/pdk ? (Thread)
22. RPC DCOM exploit (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Bug in Norton FireWall 2003 (Thread)
2. quick question (Thread)
3. middleware corba vulnerabilities:do they exist? (Thread)
4. TOORCON 2003 CALL FOR PAPERS CLOSING (Thread)
5. Some help With BOF Exploits Writing. (Thread)
6. Anyone looked at the canary stack protection in Win2... (Thread)
7. Oracle xdb ftp service? (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Administrivia: Spam threads (Thread)
2. MS broadening its efforts to warn customers (Thread)
3. Exchange 2000 out of office (Thread)
4. TSGrinder 2.03 Released (Thread)
5. HTASploit (Thread)
6. How to silently deploy DirectX9b? (Thread)
7. SecurityFocus Microsoft Newsletter #148 (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Solaris Vulnerability Calculator (Thread)
X. LINUX FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2003-08-04 to 2003-08-11.
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. The Lingering Ghost of Slammer
By Tim Mullen
The last big Windows worm showed that network security can literally be a
matter of life and death. http://www.securityfocus.com/columnists/178
2. Blogs: Another Tool in the Security Pro's Toolkit (Part Two)
By Scott Granneman
Part Two on blogs covers RSS feeds that are highly relevant to the security
community. http://www.securityfocus.com/columnists/177
3. Demonstrating ROI for Penetration Testing (Part Two)
By Marcia Wilson
The second article in this series will introduce Risk Management concepts
as they relate to Information Asset valuation.
http://www.securityfocus.com/infocus/1718
II. BUGTRAQ SUMMARY
-------------------
1. Multiple Atari800 Emulator Local Buffer Overflow Vulnerabili...
BugTraq ID: 8322
Remote: No
Date Published: Jul 31 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8322
Summary:
atari800 is multi platform Atari 800, 800XL, 5200 and 130XE emulator
software developed for Unix, WinCE, MS-DOS, Atari TT/Falcon, SDL and Amiga
platforms.
atari800 emulator has been reported prone to multiple local buffer overflow
vulnerabilities.
The issues are likely due to insufficient bounds checking performed on
user-supplied data before it is copied into reserved buffers in memory. A
local attacker may supply excessive data in a manner sufficient to trigger
these issues and in doing so corrupt arbitrary memory. Because atari800
requires direct access to graphic devices, it has been reported that one of
the affected applications is setuid root. Therefore, it has been reported
that a local attacker may exploit this condition to gain local root access.
It should be noted that although version 1.2.2 and prior have been reported
vulnerable, other versions are also likely to be prone to this issue.
2. Cisco IOS UDP Echo Service Memory Disclosure Vulnerability
BugTraq ID: 8323
Remote: No
Date Published: Aug 01 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8323
Summary:
IOS is the router operating system maintained and distributed by Cisco Systems.
Under some circumstances Cisco IOS UDP Echo Service may leak sensitive
memory contents to remote attackers.
It has been reported that, if the upd-small-servers command is enabled, a
Cisco appliance running IOS may answer malicious malformed UDP echo packets
with replies that contain partial contents from the affected router's memory.
It has been reported that a remote attacker may repeat this process to
disclose portions of data stored in the router's memory. This could expose
sensitive information that may be useful in mounting other attacks.
**Update: This issue may be exploited in conjunction with other
vulnerabilities, as is demonstrated in BID 8373. In BID 8373, memory
disclosed through the exploitation of the UDP Echo Service, is used to
assist in the successful exploitation of the IOS HTTP 2GB Buffer Overflow
vulnerability.
The vendor has reported that the udp-small-servers command is disabled by
default since IOS 11.2(1). Additionally, IOS 12.1, 12.2, and 12.3 based
images are not reported to be affected by this issue.
3. RAV AntiVirus Online Virus Scan Ravupdt.DLL ActiveX Control ...
BugTraq ID: 8324
Remote: Yes
Date Published: Aug 01 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8324
Summary:
Ravupdt.dll is a linked library distributed as part of the ActiveX control
for the RAV AntiVirus Online Virus Scan service.
ravupdt.dll has been reported prone to a buffer overflow vulnerability. The
issue reportedly presents itself when excessive data is passed to the
update() function.
It has been conjectured that this issue could potentially lead to the
execution of code with the privileges of the user executing the web
browser. This problem requires that a user with the vulnerable control
installed visit a web page that invokes the control in a manner sufficient
to trigger the issue. Upon doing so, it may be possible to create a
remotely exploitable stack overflow condition that results in the
overwriting of sensitive process memory. This, however, has not been confirmed.
It should be noted, that ActiveX controls by nature might contain latent
vulnerabilities. Caution should be employed if installing ActiveX controls.
4. Novell GroupWise Wireless Webaccess Insecure Logged Password...
BugTraq ID: 8325
Remote: No
Date Published: Aug 01 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8325
Summary:
GroupWise is the commercial groupware package distributed and maintained by
Novell.
A problem in the handling of user passwords by Novell GroupWise Wireless
Webaccess has been reported. This may make it possible for an unauthorized
user to gain access to sensitive information.
The problem is in the storage of passwords. When a user accesses network
and authenticates through GroupWise Wireless Webaccess, user credentials
are logged in plain text in the GroupWise Apache logs. A user that has the
ability to read these log files could gain access to another user's
credentials, and potentially impersonate another user on the network.
The vendor has reported that this onlys occur when WML and HDML pages are
accessed by a wireless phone.
5. IISShield Unspecified Scan Bypass Vulnerability
BugTraq ID: 8326
Remote: Yes
Date Published: Aug 01 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8326
Summary:
IISShield is an IIS ISAPI filter that is designed to prevent anomalous
activity and attacks from disrupting IIS servers.
IISShield has been reported prone to an unspecified scan bypass vulnerability.
It has been reported that in some circumstances, although IISShield detects
a specific malformed HTTP request, it will fail to drop the malicious request.
Although unconfirmed, this issue may allow an attacker to bypass IISShield
scans in attacks launched against a protected IIS server.
This BID will be updated as further technical details are disclosed.
6. Hassan Consulting Shopping Cart Multiple Vulnerabilities
BugTraq ID: 8327
Remote: Yes
Date Published: Aug 01 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8327
Summary:
Hassan Consulting Shopping Cart is prone to a path disclosure issue. It is
reported that the software will display path information when the shop.cfg
file is requested. This could permit remote attackers to gain access to
information about the layout of the file system, which could be useful in
further attacks against system resources.
It is possible that this issue may be related to configuration, for
example, debugging directives may be enabled in the software. This has not
been confirmed.
It is also reported that the software could also expose the system to other
attacks, including allowing files and directory contents to be read. Few
details about these other issues are available at this time. If more
details about the specific nature of these other issues are disclosed,
separate BIDs will be created appropriately. It is possible that these
additional issues have been previously reported and are already covered in
BID 1777.
7. CDRTools RSCSI Debug File Arbitrary Local File Manipulation ...
BugTraq ID: 8328
Remote: No
Date Published: Aug 01 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8328
Summary:
rscsi is a helper component of the cdrtools package.
It has been reported that a local attacker may invoke the rscsi utility
against an attacker specified file. The attacker may accomplish this by
supplying a rscsi 'debug file' argument that points to a file that already
exists, to the affected utility. This action will have the affect of
causing the group ownership of the target file to be modified. The changes
will reflect the group of which the individual invoking the rscsi utility
is a member. Additionally the target file contents will be corrupted with
data that may be influenced by the attacker.
Because the rscsi utility is installed with setuid 'root' permissions by
default, a local attacker may harness this vulnerability to achieve
elevated privileges.
This vulnerability has been reported to affect the version 2.x branch of
cdrtools, and all previous versions.
8. Symantec Norton AntiVirus Device Driver Memory Overwrite Vul...
BugTraq ID: 8329
Remote: No
Date Published: Aug 02 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8329
Summary:
It has been reported that a memory corruption vulnerability affects the
Symantec Norton AntiVirus Device Driver, "NAVAP.SYS". According to the
report, one of the device control operation handlers attempts to write data
to an address offset from a pointer parameter passed to DeviceIoControl().
There is no validation on the parameter supplied or the address written to.
The vulnerability is reportedly present in the driver subroutine for
handling control code "0x222a87". This control operation can be invoked by
unprivileged userland processes through DeviceIoControl(). One of the
arguments passed to this control operation is later used as the target of a
memory write without any validation. As the device driver code runs in
kernel mode, a write to an invalid address (not page-mapped) will result in
a complete system crash. It may also be possible, though likely difficult,
for a malicious userland program to hijack control of the kernel to
escalate privileges.
In the report, NAV 2002 was listed as vulnerable. It is not currently
known if NAV 2003 is affected.
Proof-of-concept code has been developed.
9. Linux Netfilter NAT Remote Denial of Service Vulnerability
BugTraq ID: 8330
Remote: Yes
Date Published: Aug 02 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8330
Summary:
The Netfilter project maintains the packet filter component of the Linux
kernel. A fix for a denial of service vulnerability has been reported by
the Netfilter project.
The vulnerability is present on systems with the ip_nat_ftp or ip_nat_irc
modules loaded or with a kernel built supporting options
CONFIG_IP_NF_NAT_FTP or CONFIG_IP_NF_NAT_IRC. These optional subcomponents
implement limited stateful inspection of the FTP and IRC application
protocols, allowing for features such as active mode FTP and DCC through NAT.
A remotely exploitable denial of service vulnerability exists when at least
one of these features are enabled and communication to FTP/IRC servers is
permitted.
Version 2.4.20 of the Linux kernel is confirmed vulnerable. A patch is
available. According to the Netfilter team, the 2.4.20 kernels shipped
with Red Hat Linux include the patch.
10. Netfilter Connection Tracking Denial of Service Vulnerabilit...
BugTraq ID: 8331
Remote: Yes
Date Published: Aug 02 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8331
Summary:
The Netfilter project maintains the packet filter component of the Linux
kernel. A fix for a denial of service vulnerability has been reported by
the Netfilter project.
The vulnerability is present on systems with support for connection
tracking enabled. Connection tracking allows for the firewall to identify
which packets belong to established connections. Linux 2.4.20 systems with
kernels built supporting the CONFIG_IP_NF_CONNTRACK option or with the
ip_conntrack module loaded are vulnerable. Other kernel versions are not
affected.
The vulnerability is due to the introduction into the Linux 2.4.20 kernel
of a new generic linked list implementation. The reliance on the previous
linked list implementation resulted in a condition which could result in a
denial of service.
A patch has been released that removes dependence on a specific kernel
linked list API.
11. mindi Temporary File Creation Vulnerabilities
BugTraq ID: 8332
Remote: No
Date Published: Aug 02 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8332
Summary:
Mindi is a program for creating boot/root disks that is maintained by Hugo
Robson.
Debian has reported that Mindi is affected by several temporary file
creation vulnerabilities that could allow for corruption of local files
and, possibly, elevation of privileges. Throughout it's operation, mindi
creates numerous files in /tmp with predictable filenames. Because /tmp is
world-writeable, symbolic link attacks are possible. Some of the temporary
file filenames are static and can be predicted with certainty and others
are based on process IDs.
If malicious local attackers know that another user on the system is going
to run mindi, symbolic links with anticipated filenames can be created in
/tmp. If the file pointed to by the symbolic link is writeable by the user
running mindi, the file will be overwritten or deleted if the attacker
chose the correct filenames. If the contents can be controlled by the
attacker, privilege escalation may be possible. As there are numerous
temporary files, different attack channels may yield different consequences.
Debian has issued fixes.
12. Multiple Postfix Denial of Service Vulnerabilities
BugTraq ID: 8333
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8333
Summary:
Postfix is a free, open-source mailer that was designed to be an
alternative to Sendmail. It is written and maintained by Wietse Venema.
Debian has reported two vulnerabilities in the Postfix mail transfer agent.
The first vulnerability, CAN-2003-0468, can allow for an adversary to
"bounce-scan" a private network. It has also been reported that this
vulnerability can be exploited to use the server as a distributed denial of
service tool. This is reportedly possible through forcing the server to
connect to an arbitrary port on an arbitrary host.
The second vulnerability, CAN-2003-0540, is another denial of service. It
can be triggered by a malformed envelope address and can cause the queue
manager to lock up until the message is removed manually from the queue.
It is also reportedly possible to lock the SMTP listener, also resulting in
a denial of service.
This BID has been divided into BIDs 8361 and 8362 and is being retired.
13. Counterpane Password Safe Clipboard Data Recovery Vulnerabil...
BugTraq ID: 8334
Remote: No
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8334
Summary:
Counterpane Password Safe is a password storage application for Microsoft
Windows operating systems.
Password Safe has security options that clear data from the clipboard and
lock the password database when the Password Safe window is minimized by
the user.
It has been reported the Password Safe will not clear passwords or other
sensitive information from the clipboard when the program is minimized,
even in circumstances where it is configured to do so. This could create a
false sense of security as the user expects that credentials have been
cleared from the clipboard when the program window is minimized. This
could also permit password credentials to be retrieved by malicious users
under some circumstances.
It should be noted that a user must first copy a password or other
sensitive information to the clipboard for this issue to be exploited.
14. Invision Board Overlapping IBF Formatting Tag HTML Injection...
BugTraq ID: 8335
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8335
Summary:
Invision Board is web forum software. It is implemented in PHP and is
available for Unix and Linux variants and Microsoft Windows operating systems.
Invision Board supports the use of formatting tags that allow users to
insert images and links into content as well as control certain aspects of
how content is rendered. These tags are referred to as IBF codes.
It may be possible to inject hostile HTML into Invision Board by using
overlapping IBF tags. This could cause the hostile code to be interpreted
in the context of the site hosting the software. Any input fields which
support inclusion of IBF code may be prone to this issue.
It should be noted that it may not be possible to inject arbitrary HTML
into Invision Board but it is more likely that this could be exploited to
spoof or manipulate links or include other abusive content.
15. HP Compaq Insight Management Agent Format String Vulnerabili...
BugTraq ID: 8336
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8336
Summary:
Compaq Web Agent is a component of Compaq Insight Manager which facilitates
remote management of Proliant servers via a web-based interface.
It has been reported that the webserver component of the Insight Management
Agent contains a format string vulnerability.
Remote attackers may pass format specifiers to Insight Management Agent
HTTP server via ".DebugSearchPaths>?Url=" requests. Incorrect usage of a
formatting function when these requests are handled exposes the software to
a format string vulnerability. This allows arbitrary locations and
sensitive data in memory to be overwritten. This could permit arbitrary
code to be executed. The Insight Management Agent HTTP server runs as
Local System.
Compaq Insight Management Agent 5.00 H was reported to be prone to this
issue, however, other versions may also be affected.
16. Xtokkaetama Nickname Local Buffer Overflow Vulnerability
BugTraq ID: 8337
Remote: No
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8337
Summary:
xtokkaetama, also known as xkaetama, is a puzzle game similar to Tetris
available for Linux.
xtokkaetama is prone to a locally exploitable buffer overflow
vulnerability. This is due to insufficient bounds checking of the
'-nickname' command line option. By supplying an excessive long parameter
for this command line option, it is possible to corrupt adjacent regions of
stack memory with attacker-supplied values. This could result in execution
of arbitrary code in the context of the software.
The software is typically installed setgid 'games'.
It should be noted that this issue was not patched in the updates provided
in BID 8312.
17. Macromedia Dreamweaver MX PHP User Authentication Suite Cros...
BugTraq ID: 8339
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8339
Summary:
Macromedia's Dreamweaver MX is a product designed to allow visual creation
of websites and web applications.
It is possible to create an authentication or access control page, using
Dreamweaver MX PHP Authentication Suite. This script will generate an error
page that contains dynamic content when a user fails to authenticate
correctly to the site.
A cross-site-scripting vulnerability has been reported to affect PHP
authentication functions used in PHP access control pages created with the
Macromedia Dreamweaver MX PHP Authentication Suite.
The issue presents itself, due to a lack of sufficient sanitization
performed on URI parameters that may be influenced by an attacker. An
attacker may supply encoded HTML as a value for the access denied variable
that is used by the affected sites' authentication page. The attacker may
present this code contained in a link to an affected site, to an
unsuspecting user. The malicious HTML code will be incorporated into an
error page and rendered in the browser of the user if the link is followed.
The attacker-supplied HTML and script code would be able to access
properties of the site, potentially allowing for theft of cookie-based
authentication credentials. An attacker could also exploit this issue to
control how the site is rendered to the user.
It should be noted that while this vulnerability has been reported to
affect Macromedia Dreamweaver MX version 6, other versions might also be
affected.
18. NetBSD Kernel OSI Packet Handler Remote Denial Of Service Vu...
BugTraq ID: 8340
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8340
Summary:
It has been reported that NetBSD systems that have OSI networking support
compiled into their kernel are prone to a remote denial of service
vulnerability.
The issue exists because error-reporting functions invoked by the netiso
enabled kernel, under some circumstances, are not implemented correctly to
abide by requisites of the BSD networking stack.
When the kernel processes an OSI packet that is sufficient to trigger the
generation of an error indication response packet one of two outcomes may
occur. If the kernel has been compiled with "options DEBUG" a kernel panic
may result and the kernel will report this condition. Otherwise the system
may crash unpredictably.
This is because the function that is responsible for crafting error
indication response packets was not converted to use a "PKTHDR" mbuf, which
is the standard for the BSD networking stack.
It has been reported that this issue does not affect systems that do not
have OSI networking support installed and an OSI network address assigned.
19. Man-db DEFINE Arbitrary Command Execution Vulnerability
BugTraq ID: 8341
Remote: No
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8341
Summary:
man-db is a utility that is used to initialize or manually update the index
database caches that are usually maintained by the man utility.
man-db could allow a local user to execute commands with elevated privileges.
This occurs because man-db allows commands to be executed through the
DEFINE directive even if it is running setuid "man". This would allow a
local user to execute any command with "man" privileges.
It is important to note that man-db is not installed setuid by default.
This vulnerability is only present if man-db was installed setuid "man".
20. ZoneAlarm Local Device Driver IO Control Code Execution Vuln...
BugTraq ID: 8342
Remote: No
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8342
Summary:
ZoneAlarm is a firewall software package available for the Microsoft
Windows operating system. It is distributed and maintained by Zone Labs.
A problem in the handling of input may, under some circumstances, allow an
attacker to cause the execution of code at arbitrary locations of memory
through the ZoneAlarm application. This may lead to unauthorized access to
system resources.
The problem is in the handling of input by the ZoneAlarm Device Driver
"VSDATANT". It is possible to overwrite specific locations in memory by
supplying a signal and location to which the data will be written. By
using a dwIoControl code, it is possible to cause the ZoneAlarm application
to jump to this location of memory and execute the code contained at the
address. The code executed by ZoneAlarm would be with the privileges of ring0.
This vulnerability was reported to affect ZoneAlarm 3.1, however, other
versions may also be affected.
21. EveryBuddy Long Message Denial Of Service Vulnerability
BugTraq ID: 8343
Remote: Yes
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8343
Summary:
EveryBuddy is an instant messaging client that supports numerous instant
messaging services, including AIM, ICQ and MSN. It is available for
Microsoft Windows operating systems.
EveryBuddy is prone to a denial of service vulnerability when handling
instant messages of excessive length. The condition is reportedly
reproducible by sending 55 lines with 27 characters per line in an instant
message to a user of a vulnerable client. Most legitimate clients will
limit the length of outgoing instant messages, however this could be
exploited with a malicious instant messaging client designed to send
messages of excessive length.
This condition may be due to a buffer overflow, though this has not been
confirmed.
22. IBM DB2 db2job File Overwrite Vulnerability
BugTraq ID: 8344
Remote: No
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8344
Summary:
IBM's DB2 database ships with a utility, db2job, installed with permissions
4550 and owned by root.db2asgrp. It has been reported that db2job writes
to a number of files with root privileges.
When db2job runs, it does not drop privileges before writing data to the
following files:
db2jobht.prf
db2jobht.bak
db2jobsm.bak
0_1.out
The files written to are created with 0770 permissions (owner, group
writeable) and are owned by root.db2asgrp. If a symbolic link is written
to, the file pointed to will be overwritten and given these permissions.
This would be exploitable, however, db2job is allegedly not
world-executable by default (permissions are 4550). The two members of
group db2asgrp, db2as and db2inst1, are the only users besides root that
would normally have execute access.
This can be exploited by local attackers with effective groupid db2asgrp
privileges to gain write access to sensitive root-owned files (such as
/etc/passwd, /etc/shadow) that have been overwritten. If the attacker can
run commands or gain the access level of that group (perhaps through one of
those two accounts), they may further elevate their access level through
exploitation of this vulnerability.
23. FreezingCold Software aspBoard URL HTML Injection Vulnerabil...
BugTraq ID: 8345
Remote: Yes
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8345
Summary:
aspBoard is a bulletin board system implemented in ASP.
aspBoard is prone to an HTML injection vulnerability. This issue is exposed
through inadequate sanitization of user input for the 'URL' variable. The
script that processes user supplied URLs used in posts to the message board
may allow attackers to embed HTML and script commands within the post. An
attacker may exploit this issue by including hostile HTML and script code
in posts to the bulletin board. This code may be rendered in the web
browser of a user who views these areas of the site. This would occur in
the security context of the site hosting aspBoard.
The attacker-supplied HTML and script code would be able to access
properties of the site, potentially allowing for theft of cookie-based
authentication credentials. An attacker could also exploit this issue to
control how the site is rendered to the user.
24. IBM DB2 Shared Library Injection Vulnerability
BugTraq ID: 8346
Remote: No
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8346
Summary:
IBM DB2 ships with a number of shared libraries, stored in a directory
owned by the user and group 'bin'.
*In version 7.1, the directory /usr/IBMdb2/V7.1 contains the following
subdirectories:
drwxr-xr-x 2 bin bin 4096 Jun 21 2002 java12
drwxr-xr-x 2 bin bin 4096 Jul 30 19:54 lib
drwxr-xr-x 2 bin bin 4096 Jun 21 2002 map
*In version 8.1, /opt/IBM/db2/V8.1/ contains:
drwxr-xr-x 2 bin bin 4096 Dec 11 2002 java
drwxr-xr-x 2 bin bin 4096 Dec 11 2002 lib
drwxr-xr-x 30 bin bin 4096 Dec 11 2002 license
drwxr-xr-x 2 bin bin 4096 Dec 11 2002 map
As setuid root utilities are linked to the libraries stored in these
directories, their ownership by a user and group of a lower privilege level
constitutes a vulnerability. If an attacker can obtain user bin
privileges, the shared libraries can be overwritten with malicious
replacements designed to obtain root privileges from the setuid root
utilities that use them.
It is likely that root privileges can be obtained through all or most of
the setuid utilities shipped with DB2.
* - Local directory structure may vary.
25. TightVNC Win32 Server QueryAllowNoPass Access Control Bypass...
BugTraq ID: 8347
Remote: Yes
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8347
Summary:
TightVNC is a VNC implementation that is freely available for a number of
platforms including Linux variants and Microsoft Windows operating systems.
TightVNC for Win32 platforms is reported to be prone to an unspecified
vulnerability that could permit access controls to be bypassed. This issue
is reportedly due to a failure of the software while acting on the
QueryAllowNoPass configuration directive. This issue is known to affect
the TightVNC server.
It has been reported that this issue exists in versions prior to 1.2.9.
Precise technical details are not available at this time. This BID will be
updated when further details become available.
26. gURLChecker HTML Parser Denial Of Service Vulnerability
BugTraq ID: 8348
Remote: Yes
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8348
Summary:
gURLChecker is software that can validate web links. It is available for
Unix and Linux variants.
gURLChecker is reported to be prone to a denial of service vulnerability.
This issue is exposed when the HTML parser (html_parser.c) included with
the software encounters specifically malformed HTML tags of excessive
length. The issue appears to be present in the
uc_html_parser_get_attributes() function. This could be exploited to cause
gURLChecker to crash if the software is used to access an untrusted web
page that contains code designed to trigger the condition.
Though unconfirmed, this condition could result in memory corruption. Due
to the nature of memory corruption issues, it may be possible to exploit
this issue to execute arbitrary code in the context of the software.
27. Webware WebKit Cookie String Command Execution Vulnerability
BugTraq ID: 8349
Remote: Yes
Date Published: Aug 01 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8349
Summary:
Webware is an application suite which provides tools for development of
web-based applications. It is implemented in Python.
Webware ships with a component entitled WebKit that provides Python classes
for dynamically generating web server content.
The Webware WebKit component is prone to a vulnerability that may allow for
execution of malicious commands. This issue is due to usage of
SmartCookie, which is provided in the CookieEngine module. SmartCookie
will attempt to unpickle malicious client-supplied cookie strings. This
could result in the Python pickle module executing malicious code contained
in cookie-strings.
A remote attacker could potentially exploit this issue to execute malicious
commands with the privileges of the software.
28. ERoaster Local Insecure Temporary File Creation Vulnerabilit...
BugTraq ID: 8350
Remote: No
Date Published: Aug 06 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8350
Summary:
eroaster is a freely available graphical frontend to cdrecord. It is
available for the Linux operating system.
A problem has been reported in the secure creation of temporary files by
the eroaster application. This may allow an attacker to overwrite files
belonging to the eroaster user.
Few details are available about this vulnerability. However, it is
theorized that this issue results from inadequate checks on the existence
of a predictable temporary file prior to an attempt to create the file
during program execution. By creating a symbolic link, an attacker could
potentially destroy data at the end of the symbolic link, or perform other
nefarious deeds.
29. Sun Microsystems ONE Application Server Java Server Page Sou...
BugTraq ID: 8351
Remote: Yes
Date Published: Aug 06 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8351
Summary:
ONE Application Server is the web application server distributed and
maintained by Sun Microsystems.
A problem with Sun ONE Application Server may result in the disclosure of
the source code of Java Server Pages (JSP). This may allow an attacker to
gain unauthorized access to sensitive information.
The precise details of this vulnerability have not been disclosed, and this
BID will be updated to contain additional information when it becomes
available. What is known is that JSPs often contain sensitive credentials
used in database and system communication. By disclosing the source code
of a JSP, an attacker could potentially gain access to these credentials,
and potentially the systems that the web application communicates with.
30. ManDB Compressor Binary Substitution Vulnerability
BugTraq ID: 8352
Remote: No
Date Published: Aug 06 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8352
Summary:
mandb is a utility that is used to initialize or manually update the index
database caches that are usually maintained by the man utility.
mandb is prone to a vulnerability that may permit local attackers to gain
elevated privileges. The source of this issue is that local users are able
to specify an arbitrary program as the location for a compressor utility
for cat files. In particular, the open_cat_stream() function call will be
made while the program still has privileges. By specifying a malicious
program, the attacker can cause arbitrary code execution with the
privileges of mandb. mandb typically executes with the privileges of user
'man'.
31. JSCI SSO URI Pattern Matching Access Validation Vulnerabilit...
BugTraq ID: 8353
Remote: Yes
Date Published: Aug 06 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8353
Summary:
JCSI is a suite of Java components that offer solutions for data security
requirements. JCSI SSO (Single Sign-On) suite provides for authorization
and access control for Java applications using Microsoft Active Directory.
JSCI SSO has been reported prone to an access validation vulnerability
under certain circumstances.
The issue presents itself in pattern-matching tags contained in JSCI SSO
XML configuration files; these tags are used when controlling access to
Java applications. It has been reported that these pattern-matching tags
match an entire URI rather than the relative path to the secured Java
application. This may mean that if the protected Java application is moved
and has a different context root, JSCI SSO will no longer be protecting it.
This may lead a system administrator into a false sense of security and may
allow remote attackers to access restricted Java applications that were
presumed secured.
32. vBulletin Register.PHP HTML Injection Vulnerability
BugTraq ID: 8354
Remote: Yes
Date Published: Aug 06 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8354
Summary:
vBulletin is a message board system implemented in PHP.
vBulletin may be prone to an HTML injection vulnerability. This issue is
exposed through inadequate sanitization of user input for fields marked
"optional" within the register.php script. This may allow attackers to
embed HTML and script commands within their user profile. An attacker may
exploit this issue by including hostile HTML and script code in fields that
may be viewable by other users. This code may be rendered in the web
browser of a user who views posts to the message board which will have this
user information automatically appended. This would occur in the security
context of the site hosting vBulletin.
The attacker-supplied HTML and script code would be able to access
properties of the site, potentially allowing for theft of cookie-based
authentication credentials. An attacker could also exploit this issue to
control how the site is rendered to the user.
33. D-Link DI-704P Long URL Denial Of Service Vulnerability
BugTraq ID: 8355
Remote: Yes
Date Published: Aug 06 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8355
Summary:
The D-Link DI-704P is an Internet Broadband Gateway device. The DI-704P
provides a method to share a single broadband Internet connection and share
a single printer among systems connected to the local network.
D-Link DI-704P has been reported prone to a remote denial of service
vulnerability.
The issue presents itself when a request of excessive length is sent to the
router. It has been reported that when a URL of excessive length is
requested, the device behaves in an unstable manner. This may result in a
complete denial of service condition requiring a device reboot, or the loss
of the ability to log in to the administration interface.
Although unconfirmed, it should be noted that other D-Link devices that use
related firmware might also be affected.
34. 121 Software 121 WAM! FTP Server Directory Traversal Vulnera...
BugTraq ID: 8356
Remote: Yes
Date Published: Aug 06 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8356
Summary:
121 WAM! Server is a FTP Server for Microsoft Windows Platform allowing
users to manage online databases including Microsoft Access, SQL Server and
MySQL.
A vulnerability has been reported in 121 WAM! Server that may allow remote
users to access restricted data from the server and other user accounts
outside the user root directory. The vulnerability is due to an access
validation error that allows clients to traverse outside of the root FTP
directory using '/../' character sequences.
This may allow the attacker to access system resources on the server.
Information that could be useful in further attacks could be disclosed to
an attacker through successful exploitation of this issue.
35. Bea WebLogic/Liquid Data Multiple Cross-Site Scripting Vulne...
BugTraq ID: 8357
Remote: Yes
Date Published: Aug 07 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8357
Summary:
BEA Systems has reported multiple cross-site scripting vulnerabilities in
BEA WebLogic Express/Server and the WebLogic Integration and Liquid Data
components.
The following issues were reported:
A cross-site scripting vulnerability that could be exposed when web
applications use a forward statement with a dynamically calculated URL.
This is reportedly not exploitable when a web application hosted by the
vulnerable software includes a forward statement that points to a static URL.
Multiple cross-site scripting vulnerabilities issues in the WebLogic Server
console application which could permit hostile HTML or script code to be
rendered in the web browser of a user with special privileges that follows
a malicious link.
Execution of hostile HTML or script code via these issues will occur in the
context of the site hosting the vulnerable software. Exploitation could
allow for theft of cookie-based authentication credentials from
administrative or other users. Other attacks are also plausible since it
is possible for an attacker to control how an affected site is rendered to
a web user who follows the attacker's malicious link.
36. Cisco Content Service Switch ONDM Ping Failure Denial Of Ser...
BugTraq ID: 8358
Remote: Yes
Date Published: Aug 07 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8358
Summary:
Cisco Content Service Switch is an appliance designed to provide a
front-end for server farms and cache clusters.
It has been reported that under certain circumstances, it may be possible
for remote attackers to force the System Controller Module (SCM) on Cisco
Content Service Switches to reboot. A component on the device known as the
Online Diagnostics Monitor (ONDM) periodically sends out ping packets to
all SFP cards present on the device to ensure functionality. In the event
that a reply is not received, the SCM will reboot the device.
Remote attackers may be able to perform a SYN flood attack against the
device by directing a large amount of data to the circuit IP address of the
Content Service Switch. This may prevent delivery of these diagnostic ping
packets, causing the router to believe the component is not functional and
cause the SCM to reboot.
37. Lotus Sametime Multiple Encryption Implementation Flaw Vulne...
BugTraq ID: 8359
Remote: Yes
Date Published: Aug 07 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8359
Summary:
Sametime is the Instant Message client distributed and maintained by Lotus.
It is available for the Microsoft Windows operating system.
Several problems have been identified in Lotus Sametime that may make
information encrypted through Sametime more prone to retrieval by a
malicious party. This may result in an adversary gaining access to
sensitive information.
One issue is the RC2/40 key being sent in the login message. Upon
intercepting the login message, an adversary has a significantly greater
chance of decrypting the user's password.
Next, the key is also transmitted with Instant Messages. This may also
increase the liklihood of decrypting sensitive information.
Also, Encrypted Instant Messages contain six bytes of known characters at
the beginning of each IM. It is theorized that by gathering Instant
Messages over a period of time and cracking the six bytes of known text, it
may be possible to reveal the encryption key used. This has not been
confirmed.
Finally, the implementation of RC2/40 in Sametime uses a limited range of
characters when generating encryption keys that significantly weakens
generated keys. The implementation uses only ASCII representations of
decimal numbers that weaken keyspace from 256^10 possibilities to 10^10
possibilities.
38. IdealBB Error.ASP Cross-Site Scripting Vulnerability
BugTraq ID: 8360
Remote: Yes
Date Published: Aug 07 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8360
Summary:
IdealBB is a web based bulletin board system implemented in ASP.
IdealBB error.asp page has been reported prone to a cross-site scripting
vulnerability.
The issue presents itself due to a lack of sufficient sanitization
performed by functions in the error.asp script on user-influenced 'msg' URI
parameters. It has been reported that a remote attacker may construct a
malicious link to the error.asp script hosted on a remote site, and supply
arbitrary HTML code as a value for the 'msg' URI parameter. If this link is
followed, the content of the 'msg' parameter is incorporated into a dynamic
error message, and will be executed in the browser of the user who followed
the link.
This could permit the theft of cookie authentication credentials; other
attacks may also be possible.
This vulnerability has been reported to affect IdealBB version 1.4.9 beta,
other versions might also be vulnerable.
39. Postfix Connection Proxying Vulnerability
BugTraq ID: 8361
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8361
Summary:
Postfix is a free, open-source mailer that was designed to be an
alternative to Sendmail. It is written and maintained by Wietse Venema.
A vulnerability has been reported in Postfix that may allow an adversary to
"bounce-scan" a private network.
The problem is in handling an attempt to deliver a message to an address
with the following format:
<[server_ip]:service!@local-host-name>
This will cause the server to make a connection to the port and IP address
that is specified. Such an address can be included in the "RCPT TO" or
"MAIL FROM" / Errors-To SMTP header fields. By designing requests that
create bounces, an adversary can abuse this issue to proxy scans to
networks that the adversary would not normally have direct access to.
It has been reported that this vulnerability can be exploited to use the
server as a distributed denial of service tool. This is reportedly
possible through forcing the server to connect repeatedly to an arbitrary
port on an arbitrary host.
This issue was described in BID 8333 and is now being assigned an
individual BID.
40. Postfix SMTP Malformed E-mail Envelope Address Denial of Ser...
BugTraq ID: 8362
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8362
Summary:
Postfix is a free, open-source mailer that was designed to be an
alternative to Sendmail. It is written and maintained by Wietse Venema.
Postfix is reported to be prone to a denial of service attack. It can be
triggered by a malformed envelope address and can cause the queue manager
to lock up until the message is removed manually from the queue. It is also
reportedly possible to lock the SMTP listener, also resulting in a denial
of service. The vulnerability is present in the address parser code.
Evidence of exploitation of this vulnerability can be detected in the mail
server logs. Deleting the malicious message in the queue that is
associated to the "resolve_clnt_query: null recipient" error message
contained in Postfix logs and restarting the service can restore normal
functionality.
This issue was described in BID 8333 and is now being assigned an
individual BID.
41. MiniHTTPServer WebForums Server Null Default Password Vulner...
BugTraq ID: 8363
Remote: Yes
Date Published: Aug 07 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8363
Summary:
WebForums Server is a commercially available HTTP server. It is available
for the Microsoft Windows platform.
A vulnerability has been reported for WebForums server. Reportedly, the
database's administrative user, the 'admin' account, is created by default
during installation and is assigned a blank password.
A remote attacker can exploit this vulnerability by connecting to a
vulnerable system's as an administrative user, and supplying a null
password. The attacker may gain administrative access on a default
installation. It has been reported that attributes for this account include
the ability to access the local 'C:\' drive.
Although this vulnerability has been reported to affect MiniHTTPServer
WebForums Server version 1.5, other versions might also be affected.
42. VMware Workstation For Linux File Deletion Vulnerability
BugTraq ID: 8364
Remote: No
Date Published: Aug 07 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8364
Summary:
VMWare Workstation is virtualization software that allows for multiple
virtual servers to run on a single host.
VMWare Workstation for Linux platforms is reported to be prone to an issue
that may allow unprivileged users on the host operating systems to delete
privileged files via manipulation of symbolic links. This could result in
a denial of service if critical system files are deleted. An attacker may
also exploit this issue to destroy data contained in sensitive files. This
issue is likely due an insecure temporary file handling problem.
This issue is reported to affected VMWare Workstation for Linux 4.0.1 build
5289 and earlier releases. Windows versions are not affected.
43. IPNetSentryX / IPNetMonitorX Unauthorized Network Reconnaiss...
BugTraq ID: 8365
Remote: No
Date Published: Aug 07 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8365
Summary:
IPNetSentryX and IPNetMonitorX are a network security application and a
network diagnostic utility, respectively. They are designed for use on
MacOS X systems.
It has been reported that the helper applications 'RunTCPFlow' and
'RunTCPDump' that are shipped with IPNetSentryX and IPNetMonitorX may be
harnessed by a local attacker to provide for unauthorized network
reconnaissance.
'RunTCPFlow' and 'RunTCPDump' are setUID root helper utilities that are
designed to execute the normally restricted applications, tcpdump and
tcpflow. It has been demonstrated that a local user on a system with
IPNetSentryX or IPNetMonitorX installed, may invoke tcpdump and tcpflow
indirectly using the affected helper applications.
This may provide a local attacker an opportunity to perform unauthorized
network traffic analysis.
44. TCPflow Format String Vulnerability
BugTraq ID: 8366
Remote: No
Date Published: Aug 07 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8366
Summary:
tcpflow is an application that is designed to capture and store network
traffic in a way that is convenient for analysis.
tcpflow has been reported prone to a local format string vulnerability. It
has been reported that this vulnerability is not exploitable under normal
conditions but could be exploitable under certain restrictive
circumstances. If the tcpflow application is installed on a MacOS X system
that also has IPNetMonitorX or IPNetSentryX utilities installed, a local
attacker may harness helper applications to exploit the condition. The
IPNetMonitorX and IPNetSentryX helper vulnerability is described in detail
in BID 8365.
Under the circumstances explained above, it is possible for unprivileged
users to execute the tcpflow application by utilizing a IPNetMonitorX or
IPNetSentryX script that is shipped with the software called "RunTCPFlow".
Because of this, privilege escalation may be possible. A local attacker may
supply a malicious format string as an argument to the -i parameter of
RunTCPFlow. This argument is ultimately passed to a debugging function,
which uses a vulnerable vfprintf() call to record the error. The format
specifiers may be interpreted literally by the formatting function and
arbitrary memory corrupted with attacker supplied values.
An attacker may leverage this condition to execute arbitrary instructions
with the privileges of the tcpflow application.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. NSA Proposes Backdoor Detection Center
By: Kevin Poulsen
National think tank would develop automated tools and techniques for
detecting malicious tampering in source code and executables.
http://www.securityfocus.com/news/6671
2. Appeal in bug disclosure case
By: Deborah Radcliff
Bret "Secret Squirrel" McDanel got 16 months in federal prison for blowing
the whistle on a security hole in his ex-employer's product. His lawyer
says he was robbed.
http://www.securityfocus.com/news/6643
3. Official: Cyberterror fears missed real threat
By: Kevin Poulsen
A top U.S. cyber security official says the government was looking for
imagined terrorist hackers, while real terrorists were plotting 9-11.
http://www.securityfocus.com/news/6589
4. Habeas cans spammer
By: Jan Libbenga, The Register
http://www.securityfocus.com/news/6683
5. Security spending to hit $13.5bn by 2006
By: John Leyden, The Register
http://www.securityfocus.com/news/6681
6. Security spending to hit $13.5bn by 2006
By: John Leyden, The Register
http://www.securityfocus.com/news/6682
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. AIM Sniff v0.1.2
By: Shawn Grimes
Relevant URL: http://www.aimsniff.com/
Platforms: UNIX
Summary:
AIM Sniff is a utility for monitoring and archiving AOL Instant Messenger
messages across a network. It can be used to monitor for cases of
harassment or warez trading. It has the ability to do a live dump (actively
sniff the network) or read a PCAP file and parse the file for IM messages.
You also have the option of dumping the information to a MySQL database or
STDOUT. AIM Sniff will also monitor for an AIM login and then perform an
SMB lookup on the originating computer in order to match NT Domain names
with AIM login names (handles). A very basic Web frontend is included.
2. FIAIF is an Intelligent Firewall v1.16.0
By: Anders Fugmann
Relevant URL: http://www.fiaif.net/
Platforms: Linux, POSIX
Summary:
FIAIF is an Intelligent Firewall. It provides a highly customizable script
for setting up an iptables-based firewall. Configuration is done through
one configuration file for each network interface, to ease configuration.
FIAIF supports masquerading, port forwarding, traffic shaping, and more.
3. FirePay v0.9.2
By: flamingcow
Relevant URL: http://firestuff.org/
Platforms: N/A
Summary:
FirePay is an implementation of the HashCash/MIME
(application/postage-hashcash) specification. HashCash is an anti-spam,
anti-DoS system for email. The concept centers around the sender of the
mail completing a computationally expensive task (in this case, generating
hash collisions) that the recipient can verify very quickly. This allows
the sender to "pay" for transport in CPU cycles, creating artificial
scarcity. Programs are included to add payment to messages (for the sender)
and to verify message payment (for the recipient).
4. Antinat v0.61
By: malx
Relevant URL: http://yallara.cs.rmit.edu.au/~malsmith/products/antinat/
Platforms: POSIX
Summary:
Antinat is a modular, multithreaded, scaleable SOCKS server for Linux
supporting SOCKS 4, SOCKS 5, authentication, firewalling, and name
resolution. Modules can be added without modifying the core server, and
modules can be removed to remove support for some functionality.
5. Webanalyse v1.13
By: Ranx <[email protected]>
Relevant URL: http://www.nanobody.net/
Platforms: Linux, POSIX
Summary:
Webanalyse is a Web site traffic statistics tool written in PHP 4. It
doesn't use any databases or Apache logs. Its reports include Web site
statistics by day, week, month, and year, referer, host, IP, browser. The
big advantage lies primarily in detail of each visit--you can follow the
pages or articles which are visited on your site. WebAnalyse can be added
very easily on all the pages where you wish to follow the activity.
6. ngrep v1.41
By: Jordan Ritter <[email protected]>
Relevant URL: http://ngrep.sourceforge.net/
Platforms: AIX, Digital UNIX/Alpha, FreeBSD, IRIX, Linux, OpenBSD, Solaris,
Windows 2000, Windows 95/98, Windows NT
Summary:
ngrep strives to provide most of GNU grep's common features, applying them
to the network layer. ngrep a pcap-aware tool that will allow you to
specify extended regular expressions to match against data payloads of
packets. It currently recognizes TCP and UDP across ethernet, ppp and slip
interfaces, and understands bpf filter logic in the same fashion as more
common packet sniffing tools like tcpdump and snoop.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Security analyst and experienced network engineer se... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332485
2. Senior Security Engineer wanted Miami/Fort Lauderdal... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332476
3. InfoSec Ninj4 Wanted (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332475
4. Security Professional with Auditing or Certification... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332474
5. Checkpoint Network Security Consultant needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332473
6. LURHQ is hiring! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332472
7. Firewall Security Expert (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332406
8. Channel Sales Manager, Germany (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332394
9. Security Professional openings (2) in Jax, Fl (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332393
10. Security Professional Needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332389
11. Security Systems Administrator/Architect - Redwood C... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332329
12. Senior Product Manager, SF Bay Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332264
13. Strategic Business Development Manager - #798JA - S... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332263
14. Request for Job Postings...Job descriptions included... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332259
15. Security Researcher/Signature Developer needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332258
16. IDS / IPS and Network Security Professional looking ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332257
17. Multiple Positions - St. Louis - Software Security D... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332256
18. Audit (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332255
19. Web-based Application Security Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/332064
20. Security Product Line Manager - New Jersey (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331962
21. Director of Sales & Marketing - Zurich (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331961
22. VP Microsoft Security Architecture - NYC Financial ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331960
23. Spam slipped through - DMR (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331910
24. URGENT REQUIREMENT - Sr. IDS Manager, Bethesda, MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331909
25. Kidnap & Ransom, Security Consulting (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331887
26. Senior Product Manager- Sunnyvale, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331885
27. Question about opportunities for Americans outside t... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331884
28. ERP Senior Consultant (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331882
29. job opening (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331881
30. IMMEDIATE Opportunity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331880
31. The potential Expat ....... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331878
32. Internship in Australia (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331876
33. Senior Forensics & Incident Handler GURU needed ASAP... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331873
34. Mail Filter by Location within Subject Field (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331871
35. Looking for UNIX Security / Penetration Tester - UK (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/331869
VI. INCIDENTS LIST SUMMARY
--------------------------
1. Dig in: autorooter, maybe that IRC one but SAV doesn... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332516
2. Heads up! distributed scans and attacks targeting ns... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332515
3. port 445 probes continued (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332514
4. [normal] RE: [Full-Disclosure] Re: Secure.dcom.exe (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332491
5. New mail scanner? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332489
6. Heads up! distributed scans and attacks targeting n... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332486
7. Secure.dcom.exe (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332435
8. [unisog] Heads up! distributed scans and attacks tar... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332420
9. DCOM95 for Windows 95 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332418
10. [unisog] Heads up! distributed scans and attacks ta... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332417
11. Stumbler: Reserved IP 73.247.223.148 scan source (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332315
12. 445 probes (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332312
13. Musical irc bot backdoor? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332158
14. FW: Secure.dcom.exe (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332154
15. Backdoor.Trojan and payload.dat (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332143
16. WORM_MIMAIL.A Anyone have any info on what this does... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/332142
17. WORM_MIMAIL.A cleaner ? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/331959
18. Question for all (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/331954
19. Pdmin / Trojaned csrss.exe (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/331774
20. Command Line RPC vulnerability scanner? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/331751
21. /tmp/pdk ? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/331691
22. RPC DCOM exploit (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/331689
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Bug in Norton FireWall 2003 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/332573
2. quick question (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/332492
3. middleware corba vulnerabilities:do they exist? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/332425
4. TOORCON 2003 CALL FOR PAPERS CLOSING (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/332423
5. Some help With BOF Exploits Writing. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/332422
6. Anyone looked at the canary stack protection in Win2... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/332421
7. Oracle xdb ftp service? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/332326
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Administrivia: Spam threads (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/332111
2. MS broadening its efforts to warn customers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/332110
3. Exchange 2000 out of office (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/332109
4. TSGrinder 2.03 Released (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/331998
5. HTASploit (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/331996
6. How to silently deploy DirectX9b? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/331906
7. SecurityFocus Microsoft Newsletter #148 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/331762
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Solaris Vulnerability Calculator (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/331838
X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2003-08-04 to 2003-08-11.
XI. SPONSOR INFORMATION
-----------------------
Precisely Define and Implement Network Security and Performance Policies
Integrated Intrusion Prevention and Traffic Shaping to:
- Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
- Automatically Control P2P, IM and Spam Traffic
- Ensure Reliable Performance of Mission Critical Applications
**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo
http://www.securityfocus.com/sponsor/CaptusNetworks_sf-news_030811
------------------------------------------------------------------------