SecurityFocus Newsletter # 211
John Boletta <[email protected]> Mon, 25 Aug 2003 15:53:14 -0600 (MDT)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter # 211
--------------------------------------
This Issue is Sponsored by BlackHat
Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
technical IT security event. Modeled after the famous Black Hat event in
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
Symantec is the Diamond sponsor. Early-bird registration ends September
6.
http://www.securityfocus.com/sponsor/BlackHat_linux-secnews_030825
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Slow Down Internet Worms With Tarpits
2. Penetration Testing for Web Applications (Part Three)
II. BUGTRAQ SUMMARY
1. Cisco 7900 Series VoIP Phone ARP Spoofing Denial Of Service ...
2. Horde Application Framework Account Hijacking Vulnerability
3. Netris Client-Side Buffer Overrun Vulnerability
4. HostAdmin Path Disclosure Vulnerability
5. DistCC Insecure Temporary File Vulnerability
6. Eudora WorldMail Search Cross-Site Scripting Vulnerability
7. HP Tru64 Unspecified EE Device Driver Local Denial of Servic...
8. PHP DLOpen Memory Disclosure Vulnerability
9. SurgeLDAP Path Disclosure Vulnerability
10. SurgeLDAP User.CGI Cross-Site Scripting Vulnerability
11. SurgeLDAP HTTP GET Denial Of Service Vulnerability
12. SurgeLDAP Insecure Password Storage Vulnerability
13. CiscoWorks Common Management Foundation Administrative Authe...
14. CiscoWorks Common Management User Field Privileged Informati...
15. CiscoWorks Common Management Foundation Guest Account Passwo...
16. Microsoft MCIWNDX.OCX ActiveX Control Buffer Overflow Vulner...
17. Xoops BBCode HTML Injection Vulnerability
18. SGI IRIX NFSD XDR Decoding Remote Denial of Service Vulnerab...
19. HolaCMS HTMLtags.PHP Local File Include Vulnerability
20. Clickcess ChitChat.NET Message HTML Injection Vulnerability
21. HP Fixes Unspecified Local Denial Of Service Vulnerability
22. Microsoft URLScan / RSA Security SecurID Configuration Enume...
23. ECartis LIScript Arbitrary Variable Viewing Vulnerability
24. Ecartis Multiple Buffer Overrun Vulnerabilities
25. Skunkweb Error Page Cross-Site Scripting Vulnerability
26. Sun One/IPlanet Web Server Windows Denial Of Service Vulnera...
27. Skunkweb Cache Module File Disclosure Vulnerability
28. Unix/Linux Keystroke Information Disclosure Weakness
29. Poster.version:two Unauthorized Privileged User Access Vulne...
30. PHPSecureSite SQL Injection Vulnerabilities
31. MatrikzGB Guestbook Administrative Privilege Escalation Vuln...
32. SGI IRIX Checkpoint/Restart libcpr File Corruption Vulnerabi...
33. Novell NetWare XNFS Portscan Denial Of Service Vulnerability
34. Novell NetWare NWFTPD.NLM Unspecified Security Vulnerabiliti...
35. Autorespond Buffer Overrun Vulnerability
36. Atilla PHP Content Management System Multiple Web Vulnerabil...
37. Dropbear SSH Server Username Format String Vulnerability
38. eMule Client OP_SERVERIDENT Heap Overflow Vulnerability
39. Fusion News Unauthorized Account Addition Vulnerability
40. ManDB Utility Hard Link Buffer Overrun Vulnerability
41. eMule Client OP_SERVERMESSAGE Format String Vulnerability
42. eMule AttachToAlreadyKnown Double Free Vulnerability
43. eMule Client Servername Format String Vulnerability
44. OpenSLP Initialization Script Insecure Temporary File Vulner...
III. SECURITYFOCUS NEWS ARTICLES
1. Slammer worm crashed Ohio nuke plant network
2. The Bright Side of Blaster
3. Hackers Claim New Fingerprint Biometric Attack
4. Net anonymity service back-doored
5. MS releases unholy trinity of security fixes
6. Check Point targets MEs with firewall/ VPN combo
IV. SECURITYFOCUS TOP 6 TOOLS
1. p0f2 v2.0b
2. p0f2 v2.0b
3. Remote Nmap v0.10
4. Password Manager XP v1.5
5. packETH v1.0
6. Lutel Firewall v0.70
V. SECURITYJOBS LIST SUMMARY
1. ISS Malware/Malcode Research Analyst Position Availa... (Thread)
2. Certifications on resume (Thread)
3. Smart Card (N. VA/DC area) (Thread)
4. Symantec Looking for Sr. Java/C++ Dev/Security Consu... (Thread)
5. Risk Assessment (Thread)
6. Sr. Consultant / CA product specialist - MN (Thread)
7. Information Assurance (IA) Team - Top Secret Clearan... (Thread)
8. PKI /Security Analyst - Twin Cities, MN (Thread)
9. Sr Security Analyst & Systems Recovery-WSI (Thread)
10. Computer Systems Security Engineers/Administrator C&... (Thread)
11. Network Intrusion Specialist - Washington DC Metro A... (Thread)
12. Product Manager-San Francisco, CA (Thread)
13. Senior Information Assurance Systems Engineer (TS Cl... (Thread)
14. Perimeter Security Engineer - NYC/Brooklyn $100-$11... (Thread)
15. SRP Integration Consultant MD-VA-DC $75-$85, equi... (Thread)
16. Another List (Thread)
17. Looking for a hads-on hot dog in the DC area... (Thread)
18. Sales/Client Engineer (Thread)
19. InfoSec Mktg-BusDev in DC or Denver Area (Thread)
20. Territory Manager - New York, New Jersey & Conn. (Thread)
21. Seeking Security Position in the SF Bay Area (Thread)
22. Job Opportunity: US-NY-NYC: Senior Windows Security ... (Thread)
23. Is there life after infosec? (Thread)
24. Unix Security Engineer contract - Winston-Salem, NC (Thread)
25. Life after security? (Thread)
26. AW: Is there life after infosec? (Thread)
27. Seeking Information Technology Position in the Washi... (Thread)
28. The "Is there life after infosec?" Thread is Dead (Thread)
29. Yahoo! Software Engineer - Security (Thread)
30. Perl Developer - Ft. Meade, MD (Thread)
31. Launching A Security Practice: Is there life after ... (Thread)
32. Security Architecture Manager - Seattle, WA (Thread)
33. NIDS Senior Secruity Engineer Columbia, MD (Thread)
34. Security and Privacy Tools Development Manager - Mi... (Thread)
35. Security Engineers needed - Fairfax, VA (Thread)
36. Request for Job Posting... (Thread)
VI. INCIDENTS LIST SUMMARY
1. DCOM worm with get.bat bot.rar (Thread)
2. Anyone else seeing a radical increase in Sobig? (Thread)
3. possible 0-day exploit for latest Real-/Helixserver ... (Thread)
4. DCOM bot.rar (Thread)
5. Increasing ICMP Echo Requests (Thread)
6. lots of sobig virus emails. (Thread)
7. Sobig.F (Was: document _ a l l . p i f) (Thread)
8. Software vendor clueless (Thread)
9. Unusual DNS and port 37 requests (Thread)
10. Administrivia: Virus. (Thread)
11. wicked_scr.scr (Thread)
12. mod to "killblast.vbs" script (Thread)
13. ICMP port 2048 scans (Thread)
14. SoBig.F (Was: document_all.pif) (Thread)
15. document_all.pif (Thread)
16. what is this? (Thread)
17. newbie wanting some info !! (Thread)
18. Strange blaster behavior (Thread)
19. Strange UDP packets to non-existent network. (Thread)
20. Re(2): Increasing ICMP Echo Requests (Thread)
21. DCOM95 for Windows 95 (Thread)
22. is this the start of something naughty? (Thread)
23. Microsoft 'extinguishes' windowsupdate.com (Thread)
24. msblast.d and a review of defensive worms (Thread)
25. Article Announcement (3): (Thread)
26. msblast and RFC 1918 addresses (Thread)
27. Re-Infection with Blaster Worm (Thread)
28. FTimes 3.3.0 Release (Thread)
29. WebJob 1.3.0 Release (Thread)
30. rpc dcom worm and windowsupdate (Thread)
31. MSBlast and other known exploits.. (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Sobig / Blaster on steroids (Thread)
2. TOORCON 2003 LINEUP FINALIZED (Thread)
3. Bug in Norton FireWall 2003 (Thread)
4. HOON & shellcode (again) (Thread)
5. Rolf Rolles analysis (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Patch testing (Thread)
2. Patch Management Best Practices E-Seminar (Thread)
3. Article Announcement: Slow Down Internet Worms With ... (Thread)
4. MS03-033 not signed by Microsoft? (Thread)
5. DCOM patch + Exchange (Thread)
6. Mail from MSN Messenger (Thread)
7. scan of domain logon reveals unknown port (Thread)
8. SecurityFocus Microsoft Newsletter # 150 (Thread)
9. Article Announcement: MRTG for Intrusion Detection w... (Thread)
10. Why the shutdown if infected with blaster? (Thread)
11. DNS (Thread)
12. Account Lockout -- ARGH (Thread)
13. Account Lockuout --ARGH (Thread)
14. Detecting Blaster (Thread)
15. New variant. Blast.b (Thread)
16. FW: Actions for the Blaster Worm - Special Edition, ... (Thread)
17. MS03-029 ?-Download link (Thread)
18. FW: Blaster vs. Kaht2, detecting Windows root kits (Thread)
19. Administrivia: Blaster (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Administrivia: Out on vacation X-POST (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Administrivia: Out on vacation X-POST (Thread)
2. Disassemblers??? (Thread)
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Slow Down Internet Worms With Tarpits
By Tony Bautts
This timely article discusses how to slow the spread of Internet worms
using a tarpit and IPtables on Linux. A similar approach could potenially
be used with tarpits on Windows platforms, Solaris, OpenBSD, and others.
http://www.securityfocus.com/infocus/1723
2. Penetration Testing for Web Applications (Part Three)
By Jody Melbourne and David Jorm
The third and final article in this series investigates session security
issues and cookies, buffer overflows and logic flaws, and provides links
to further resources for the web application penetration tester. ... >>
http://www.securityfocus.com/infocus/1722
II. BUGTRAQ SUMMARY
----------------------------------
1. Cisco 7900 Series VoIP Phone ARP Spoofing Denial Of Service ...
BugTraq ID: 8398
Remote: Yes
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8398
Summary:
The 7900 series VoIP Phones are a Voice-Over-IP solution distributed by
Cisco Systems.
The Cisco 7900 Series of Voice-Over-IP phones have been reported prone to
a vulnerability where a spoofed ARP message may crash the phone.
It has been reported that an attacker that is connected to the same
segment as the affected phones may send spoofed ARP messages to a phone,
causing the target phone to be disconnected from the switch. This will
result in the phone becoming unstable and crashing. Power cycling the
phone to regain normal functionality is required. It has also been
reported that such an attack performed on a switchboard phone may deny all
incoming calls.
Other attacks including man in the middle style attacks, for example
packet injection and data interception, have also been reported possible.
2. Horde Application Framework Account Hijacking Vulnerability
BugTraq ID: 8399
Remote: Yes
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8399
Summary:
The Horde Application Framework is a series of web applications,
implemented in PHP. Included in the framework is a mail transfer agent.
The Horde Application Framework is prone to a vulnerability that may allow
remote attackers to hijack mail accounts. This can reportedly be
exploited via a malicious link in an e-mail. When the link is visited,
the software appears to leak a session ID to the site that is visited. An
attacker could then use these credentials to access a user's Horde mail
account.
This appears to be a problem with session fixation.
3. Netris Client-Side Buffer Overrun Vulnerability
BugTraq ID: 8400
Remote: Yes
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8400
Summary:
Netris is a freely available network "Tetris" clone. It is available for
Unix and Linux variants.
A client-side buffer overrun vulnerability has been reported for Netris.
The issue is said to occur due to insufficient bounds checking when
copying a server greeting into an internal memory buffer. As a result, an
attacker could theoretically pose as a Netris server, and upon connection
pass excessive data to the client program. When this occurs, internal
program memory will be corrupted, potentially allowing for the execution
of arbitrary code with the privileges of the user invoking Netris.
This vulnerability affects Netris 0.5 and earlier.
4. HostAdmin Path Disclosure Vulnerability
BugTraq ID: 8401
Remote: Yes
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8401
Summary:
HostAdmin is a web-based tool designed to automate web-hosting operations.
HostAdmin is prone to a path disclosure vulnerability. Passing invalid
data to the HostAdmin site will cause an error message to be displayed,
which contains installation path information.
Exploitation may be dependant on web server and PHP configuration.
This type of information may aid an attacker in mapping out the file
system for further attacks against the host.
5. DistCC Insecure Temporary File Vulnerability
BugTraq ID: 8402
Remote: No
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8402
Summary:
distcc is a distributed compiler application for Linux/Unix variants.
distcc acts as a compiler front-end that can distribute software builds
across multiple hosts.
distcc is reported to handle temporary files insecurely. This could
permit attacks which cause sensitive files to be corrupted. A local user
may be able to exploit this issue by creating malicious symbolic links.
Exploitation could result in destruction of critical files, causing a
denial of service. Though unconfirmed, if a local attacker can corrupt
files with custom data, they may be able to gain elevated privileges.
6. Eudora WorldMail Search Cross-Site Scripting Vulnerability
BugTraq ID: 8403
Remote: Yes
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8403
Summary:
Eudora WorldMail is a Java-based mail server.
A vulnerability has been reported in the software that may allow
unsanitized user input to be displayed to the user. This problem is
related to the search utility for countries, which does not properly
filter HTML and script code. It may be possible for an attacker to
construct a link containing malicious script code that could be executed
in a user's browser upon following that link. This would occur in the
security context of the host running Eudora WorldMail.
This vulnerability exposes web users to cookie-based credential theft as
well as other attacks.
It should also be noted that this issue is also exposed via the search
form. If search input is logged, this issue could be more persistent and
potentially expose users with the ability to view search logs to HTML
injection attacks.
7. HP Tru64 Unspecified EE Device Driver Local Denial of Servic...
BugTraq ID: 8404
Remote: No
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8404
Summary:
Systems running the Tru64 operating system, in conjunction with DE60x
series adapters and/or DS15 onboard 10/100 ports, implement the use of the
ee device driver.
HP has announced that an unspecified local denial of service vulnerability
has been discovered in the ee device driver. Although it has been reported
that what causes this condition is currently unknown, and the likelihood
of triggering the issue is believed to be low, successful exploitation of
this issue can potentially cause system instability, possibly causing it
to crash. It is believed that the root of this problem lies in a rarely
used error control path within the driver.
This vulnerability affects the ee device driver included in HP Tru64 4.0f
through 5.1.
8. PHP DLOpen Memory Disclosure Vulnerability
BugTraq ID: 8405
Remote: No
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8405
Summary:
PHP is the Personal Home Page web application development suite. It is
available for the
Unix, Linux, and Microsoft platforms.
A vulnerability has been reported to present itself in the dlopen()
function contained in the PHP source. The issue occurs when PHP is used in
conjunction with the Apache web server. It has been reported possible to
dump the contents of the Apache process memory into a text file. This
issue could be harnessed by a local attacker to gain access to potentially
sensitive information which could include authentication credentials.
Other exploits such as allowing an attacker to deliver different content
other than what the server is configured to serve, may also be possible.
It should be noted that dlopen() is a function contained in the PHP
source. It is not a PHP language function.
9. SurgeLDAP Path Disclosure Vulnerability
BugTraq ID: 8406
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8406
Summary:
SurgeLDAP is an LDAP server implementation. It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.
SurgeLDAP is prone to a path disclosure vulnerability. It is possible to
gain access to sensitive path information by issuing an HTTP GET request
for an invalid resource. This could help a remote attacker enumerate the
layout of the file system of the host running the vulnerable software,
which may be useful in further attacks against the host.
This issue exists in the web server component of SurgeLDAP.
10. SurgeLDAP User.CGI Cross-Site Scripting Vulnerability
BugTraq ID: 8407
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8407
Summary:
SurgeLDAP is an LDAP server implementation. It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.
SurgeLDAP is prone to cross-site scripting attacks. The issue exists in
the user.cgi script and is due to insufficient sanitization of data
supplied via URI parameters, which will be echoed back to users. Remote
attackers may exploit this issue by enticing a user to visit a malicious
link that specifies hostile HTML and script code as a value for the 'cmd'
parameter of the vulnerable script. This code may be rendered in the
user's browser when the link is visited. This would occur in the context
of the server.
Successful exploitation may allow theft of cookie-based authentication
credentials or other attacks.
This issue exists in the web server component of SurgeLDAP.
11. SurgeLDAP HTTP GET Denial Of Service Vulnerability
BugTraq ID: 8408
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8408
Summary:
SurgeLDAP is an LDAP server implementation. It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.
SurgeLDAP is prone to a denial of service vulnerability that may occur
when an overly long HTTP GET request is sent to the server. Though
unconfirmed, this may result in memory corruption, which may be further
exploitable to execute arbitrary code. It is reported that an HTTP GET
request of 501 or more characters will trigger this condition.
This issue exists in the web server component of SurgeLDAP.
12. SurgeLDAP Insecure Password Storage Vulnerability
BugTraq ID: 8409
Remote: No
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8409
Summary:
SurgeLDAP is an LDAP server implementation. It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.
SurgeLDAP does not adequately secure password credentials. These
credentials will be stored on the system hosting the server in plaintext
and could be exposed to users with local access to the system. On
Microsoft Windows, these credentials are reported to be stored in the
'user.dat' file in the program directory.
13. CiscoWorks Common Management Foundation Administrative Authe...
BugTraq ID: 8410
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8410
Summary:
CiscoWorks Common Management Foundation is the suite of network management
tools distributed and maintained by Cisco.
A problem has been reported in the CiscoWorks Common Management Foundation
that may allow an attacker to circumvent authentication to gain
administrative access. This may give a remote attacker unauthorized
access to resources.
The problem is in the handling of certain URLs. By passing a maliciously
crafted URL to the CiscoWorks Common Management Foundation application, it
is possible to bypass the requirement for authentication. The attacker
must have access as a minimum of guest user.
14. CiscoWorks Common Management User Field Privileged Informati...
BugTraq ID: 8411
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8411
Summary:
CiscoWorks Common Management Foundation is the suite of network management
tools distributed and maintained by Cisco.
A problem has been reported in the CiscoWorks Common Management Foundation
that may allow an attacker to gain access to sensitive information. This
may give a remote attacker information necessary in launching a more
directed attack against resources.
The problem is an error in the handling of user names. The device accepts
user names from web forms, but does not perform adequate checking on the
submitted names. A user logged in as an application user of lower
privilege could change the user name contained within the web form and
resubmit it as the user 'admin' to read privileged information on the
device.
15. CiscoWorks Common Management Foundation Guest Account Passwo...
BugTraq ID: 8412
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8412
Summary:
CiscoWorks Common Management Foundation is the suite of network management
tools distributed and maintained by Cisco.
A problem has been reported in default accounts of the CiscoWorks Common
Management Foundation. This may result in an attacker gaining unintended
access to the application.
The problem is the Guest account. By default, the application does not
require setting a password for this account. Because of this, it is
possible that the application may be deployed with an account that is not
password protected.
16. Microsoft MCIWNDX.OCX ActiveX Control Buffer Overflow Vulner...
BugTraq ID: 8413
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8413
Summary:
The 'mciwndx.ocx' ActiveX control is included in Microsoft Visual Studio 6
and supports multimedia programming.
'mciwndx.ocx' has been reported prone to a buffer overflow vulnerability.
The issue reportedly presents itself when excessive data (more than 640
kB) is passed to the "filename" property.
It has been conjectured that this issue could potentially lead to the
execution of code with the privileges of the user executing the web
browser. This problem requires that a user with the vulnerable control
installed visit a web page that invokes the control in a manner sufficient
to trigger the issue. Upon doing so, it may be possible to create a
remotely exploitable stack overflow condition that results in the
overwriting of sensitive process memory. This, however, has not been
confirmed.
It should be noted, that ActiveX controls by nature might contain latent
vulnerabilities. Caution should be employed if installing ActiveX
controls.
17. Xoops BBCode HTML Injection Vulnerability
BugTraq ID: 8414
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8414
Summary:
Xoops is open-source, freely available web portal software written in
object-oriented PHP. It is back-ended by a MySQL database and will run on
most Unix and Linux distributions.
BBCode is a basic restricted implementation of HTML that is used to
control the appearance of text in user-supplied Xoops entries.
Xoops BBCode has been reported prone to an HTML injection vulnerability.
It has been reported that an attacker may inject malicious script into
areas of Xoops where BBCode is rendered, for example News entries,
bulletin board posts or private messages. This issue is due to a lack of
sufficient sanitization performed on user supplied BBCode tags. The
[color], [size] and [font] BBCode tags are reported vulnerable. Injected
code may be rendered in the web browser of a user who views vulnerable
areas of the site. This would occur in the security context of the site
hosting Xoops and its related modules.
Redirection attacks using CSS and vbscript, exploiting this vulnerability
have been demonstrated. Although unconfirmed, theft of cookie-based
authentication credentials and other attacks may also be possible.
Although this vulnerability has been reported to affect Xoops version <=
1.3.x. The issue has been reported exploitable via the News, Private
Messages and NewBB Xoops modules.
18. SGI IRIX NFSD XDR Decoding Remote Denial of Service Vulnerab...
BugTraq ID: 8415
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8415
Summary:
XDR (External Data Representation) is a protocol governing the platform
independent description and encoding of data, in this particular case it
is used in conjunction with the SGI IRIX nfsd daemon, used to share system
based resources across a network. NFS uses XDR to describe the format of
its data.
SGI has announced a vulnerability in the IRIX nfsd daemon which may make
it prone to remote denial of service attacks. The issue is said to occur
when nfsd attempts to handle malformed packets which cause XDR decoding
errors.
Although it has not been confirmed, there is a possibility that this
vulnerability is in someway related to the
Linux Kernel 2.4 XDR Packet Handler For NFSv3 Remote Denial Of Service
Vulnerability described in BID 8298.
Successful exploitation of this vulnerability would allow a remote
attacker to trigger a system panic on an affected host.
19. HolaCMS HTMLtags.PHP Local File Include Vulnerability
BugTraq ID: 8416
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8416
Summary:
holaCMS is a content management system that is implemented in PHP.
It has been reported that an information disclosure issue exists in the
htmltags.php module of the software. The issue could be exploited by a
remote attacker to gain unauthorized access to potentially sensitive
information. It has also been reported that some files included via
exploitation may allow for information to be edited.
This issue may allow an attacker to access confidential data such as the
password file. It is not known if this may also be exploited to include
remote files. If this is the case, this issue could also lead to remote
command execution.
20. Clickcess ChitChat.NET Message HTML Injection Vulnerability
BugTraq ID: 8417
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8417
Summary:
Clickcess ChitChat.NET is a discussion forum designed specifically for use
with SQL Server and implemented in ASP.NET. It is available for Microsoft
Windows.
A vulnerability has been reported in the software that may allow
unsanitized user input to be injected into the website. This problem is
related to the Name and Topic Title input fields, which fail to properly
filter HTML and script code. Injected HTML code may be rendered in the
web browser of a victim who views vulnerable areas of the site. This would
occur in the security context of the site hosting ChitChat.NET.
This vulnerability could be exploited to steal cookie-based credential
from a host. Other attacks may well be possible.
21. HP Fixes Unspecified Local Denial Of Service Vulnerability
BugTraq ID: 8418
Remote: No
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8418
Summary:
The problem is in two patches released by HP. Patches PHNE_26413 and
PHNE_27128 have a denial of service vulnerability that, when applied, can
allow a local attacker to crash a host with the patches applied. The
exact details of this vulnerability is not presently known, and this
Bugtraq ID will be updated when additional details become available.
22. Microsoft URLScan / RSA Security SecurID Configuration Enume...
BugTraq ID: 8419
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8419
Summary:
Microsoft URLScan is an Internet Server API (ISAPI) filter that can be
configured to block a variety of HTTP methods, file extension access, and
other queries.
SecurID, a two-factor authentication mechanism developed by RSA Security,
can also be used to prevent unauthorized access to a website.
A weakness has been discovered in Microsoft URLScan and RSA Security
SecurID when used in conjunction on a web server. The problem is said to
occur due to the order in which the products are placed within the global
ISAPI filter list.
When the vulnerable configuration is in place, an attacker may be capable
of enumerating the Microsoft URLScan extension filtering list, by making
repeated requests to files with differing extensions. This is due to the
web server incorrectly returning a page, containing a hidden form field
that includes a 'referrer' NAME, and VALUE containing
'Rejected-By-UrlScan'. It should be noted that if the default
configuration has been changed, the rejection string may differ.
The enumeration of this type of information could potentially aid an
attacker when launching further attacks against the target web server.
23. ECartis LIScript Arbitrary Variable Viewing Vulnerability
BugTraq ID: 8420
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8420
Summary:
ECartis is a freely available, open source mailing list manager. It is
available for the Unix and Linux platforms.
A problem in the handling of user-supplied input has been reported in
ECartis. Because of this, an attacker may be able to gain access to
unauthorized and potentially sensitive information.
The problem is in the handling of requests sent via e-mail for specific
functions and variables. By supplying specially malformed requests, it is
possible to make ECartis disclose data or perform actions that may be
restricted and sensitive in nature. Multiple instances of this type of
issue were reported to exist in the software.
24. Ecartis Multiple Buffer Overrun Vulnerabilities
BugTraq ID: 8421
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8421
Summary:
ECartis is a freely available, open source mailing list manager. It is
available for the Unix and Linux platforms.
Multiple buffer overrun vulnerabilities have been reported for Ecartis
1.0. The problems occur due to a variety of problems within the code, and
each appears to be a result of insufficient bounds checking when copying
the contents of e-mail into internal memory buffers.
One such problem occurs within the smtp_body_822bis() function, located in
the stmp.c source file, which is designed to copy data from a src buffer
into a destination buffer. However, the function does not include a size
parameter, which may allow for the destination to be overrun. As a result
of this issue, any later implementation of this function may result in a,
potentially exploitable, buffer overrun.
Other issues have been reported within the unhtml.c and unmime.c source
files. All issues located in these files appear to occur due insufficient
bounds checking before transferring data between pointers.
Successful exploitation of this vulnerabilities may result in a remote
denial of service. Also, although it has not yet been confirmed, due to
the nature of these vulnerabilities, it is theoretically possible that an
attacker may be capable of exploiting the overruns to execute arbitrary
instructions. It should be noted that due to the nature of e-mail
protocols, successfully exploiting this issue may be difficult due to a
restricted character set.
25. Skunkweb Error Page Cross-Site Scripting Vulnerability
BugTraq ID: 8422
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8422
Summary:
Skunkweb is a web application server written in python.
Skunkweb has been reported to be prone a cross-site script vulnerability.
The problem exists in the Handler module of the software. This module
handles error output for the server. HTML and script code will not
filtered before being displayed to the user in 404 error pages. Therefore
an attacker may create a malicious link containing HTML and script code,
which could be rendered in a legitimate user's browser when the link is
visited. This would occur in the context of the vulnerable server and
could permit the attacker-supplied code to access properties of pages
hosted by the server.
This issue allows a user to be prone to attacks such as cookie-based
credential theft. Other attacks may be possible as well.
26. Sun One/IPlanet Web Server Windows Denial Of Service Vulnera...
BugTraq ID: 8423
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8423
Summary:
Sun ONE Web Server is a web server implementation that is maintained by
Sun Microsystems. It has been rebranded from iPlanet.
Sun has reported the Sun ONE and iPlanet Web Servers on Windows platforms
are prone to a remotely exploitable denial of service vulnerability.
Exploitation of this issue will cause the server to exit unexpectedly.
This could be exploited to deny the availability of services to legitimate
users of an affected server.
Sun has not released further technical details about this issue. If
additional details are made available, this BID will be updated
accordingly.
27. Skunkweb Cache Module File Disclosure Vulnerability
BugTraq ID: 8424
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8424
Summary:
Skunkweb is a web application server written in Python.
Skunkweb has been reported by the vendor to be prone to a vulnerability
that may allow remote users to access restricted data from the server.
The problem exists in the Cache module of the server that is responsible
for caching spread mailboxes. The vulnerability allows clients to
traverse outside of the document root for the web server using various
character sequences.
This may allow the attacker to access system resources on the server.
Through successful exploitation of this issue sensitive information could
be disclosed to an attacker leading to further attacks.
28. Unix/Linux Keystroke Information Disclosure Weakness
BugTraq ID: 8425
Remote: Yes
Date Published: Aug 15 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8425
Summary:
Various Unix-derived operating systems implement the /dev/random device
which acts as a source of entropy when generating pseudo-random numbers.
This device contains an entropy pool, containing pseudo-random data from a
variety of sources. One such source is keyscan codes, triggered by a user
using the keyboard.
A weakness has been discovered in the /dev/random mechanism that could
theoretically allow an attacker to deduce keystrokes made by a user who is
physically at the system's console keyboard.
The problem appears to lie in the differing times between entropy pool
seeding times. Specifically, when a typical keystroke is made a keypress
in and keypress out scancodes are generated. These keystrokes typically
have different timing delays, due to the way a keyboard is used. For
instance, as Michal Zalewski described, a keypress scancode in will
generate 1-2 byte(s) of data with a 50-150 millisecond delay, whereas a
key release scancode in, which also generates 1-2 byte(s), will have a 50
millisecond or more delay. Other forms of seeding the entropy pool have
other patterns, making them easy to distinguish from keystrokes.
As a result of these timing differences, it may be possible for an
attacker to reliably time keystrokes made at the systems physical console.
This timing data may then be compared to statistics regarding keypress
times versus words typed, potentially allowing the attacker to deduce a
users keystrokes.
A conclusive list of affected systems is not available at this time. It
is also not known at this point if any specific implementation is not
affected. This BID will be updated and the affected systems modified as
more information becomes available.
29. Poster.version:two Unauthorized Privileged User Access Vulne...
BugTraq ID: 8426
Remote: Yes
Date Published: Aug 15 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8426
Summary:
Poster Version.Two is a web-based forum implemented in PHP.
A vulnerability has been reported for Poster.version:two. The problem
occurs due to the application failing to lock the 'setup' variable after
initialization. As a result, an attacker may access this variable to add
additional administrator users to the forum. This can be specifically
accomplished by access the 'setup_submit' variable, as well as influencing
the 'un' and 'pw' parameters to contain the username and password
respectively.
This may effectively allow for the theft or modification of sensitive
information. This could include news posting and users' passwords.
30. PHPSecureSite SQL Injection Vulnerabilities
BugTraq ID: 8427
Remote: Yes
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8427
Summary:
phpSecureSite is a session handling and authentication module for
web-based applications.
A new version of phpSecureSite has been released to address multiple
instances of unsanitized user-supplied input being used in database
queries. These issues could expose the software to SQL injection attacks
that could potentially compromise sites which use the software or database
resources. The consequences may vary depending on the nature of the
specific queries that permit the inclusion of unsanitized input, as well
as other factors such as the capabilities of the underlying database
implementation.
31. MatrikzGB Guestbook Administrative Privilege Escalation Vuln...
BugTraq ID: 8430
Remote: Yes
Date Published: Aug 16 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8430
Summary:
MatrikzGB Guestbook is a web application that is implemented in PHP.
MatrikzGB Guestbook is prone to a vulnerability that may permit registered
guestbook users to administrative privileges. This issue exists in the
index.php script and may permit guestbook users to add full administrative
rights to an existing account. It is possible to exploit this issue by
manipulating URI parameters. In particular, a user can gain admin rights
by setting the 'new_rights' parameter to a value of 'admin'.
This could allow a user to compromise the guestbook.
32. SGI IRIX Checkpoint/Restart libcpr File Corruption Vulnerabi...
BugTraq ID: 8433
Remote: No
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8433
Summary:
Checkpoint/Restart is a facility for SGI IRIX that allows processes to be
stopped and restored at a later time.
SGI has reported a vulnerability in the Checkpoint/Restart libcpr library.
This vulnerability could potentially be exploited to overwrite or truncate
files which are owned by another user. This could result in destruction
of sensitive data, potentially causing a denial of service.
This issue is reported to exist in both 32-bit and 64-bit versions of the
library. Binaries that load the affected library may expose the
vulnerability.
33. Novell NetWare XNFS Portscan Denial Of Service Vulnerability
BugTraq ID: 8434
Remote: Yes
Date Published: Aug 15 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8434
Summary:
XNFS is an NFS server that is included in Novell NetWare operating
systems.
The Novell NetWare XNFS Server (XNFS.NLM) is prone to a denial of service
when being portscanned. The vendor has stated that this issue was
reproduced using Nessus, but other scanners may also cause the same
effect. Such a scan will cause XNFS to ABEND, causing the availability of
the service to be denied to legitimate users.
34. Novell NetWare NWFTPD.NLM Unspecified Security Vulnerabiliti...
BugTraq ID: 8435
Remote: Yes
Date Published: Aug 16 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8435
Summary:
NWFTPD.NLM is an FTP server implementation including with Novell NetWare
operating systems.
Novell has released a new version of NWFTPD.NLM for NetWare that provides
security enhancements, bugfixes and addresses a number of unspecified
security issues, including two weaknesses involving anonymous FTP access.
A loophole in intruder detection methods was also reported.
The exact technical details of these issues are not known at this time but
it is probable that exploitation could lead to unauthorized access to FTP
resources. This BID will be updated if further technical information is
made available.
35. Autorespond Buffer Overrun Vulnerability
BugTraq ID: 8436
Remote: Yes
Date Published: Aug 16 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8436
Summary:
autorespond is a program that is used with qmail to generate automated
responses to e-mail. It is available for Unix and Linux variants.
autorespond is prone to a buffer overrun. This issue may potentially be
exploited by remote attackers to execute arbitrary code in the context of
the software. Debian has reported that this issue may not be exploitable
due to "incidental" limits on the length of user-supplied input that could
potentially trigger this issue. Exploitation should not be ruled out
though, since it is possible that there may be situations where these
limits do not apply.
If this issue were successfully exploited, it would be possible to execute
malicious instructions in the context of the user who has configured qmail
to forward messages to autorespond.
36. Atilla PHP Content Management System Multiple Web Vulnerabil...
BugTraq ID: 8437
Remote: Yes
Date Published: Aug 18 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8437
Summary:
Atilla PHP is a PHP content management system designed for portal sites.
It is available for Unix, Linux, and Microsoft Windows platforms.
Several problems have been identified in Atilla PHP. Because of these
issues, and attacker may be able to gain access to sensitive information,
or execute code in the browsers of victims in the security context of the
vulnerable site.
Three problems have been identified in Atilla PHP.
Atilla PHP is vulnerable to a cross-site scripting issue. The index.php3
script does not properly filter input supplied to the Rubrique and article
URI variables.
Atilla PHP is also vulnerable to a script injection issue. The
user_action.php3 script does not properly filter user input, making it
possible to insert HTML and script that will be stored in a place where it
can be executed in the browsers of victims.
Finally, Atilla PHP is vulnerable to path disclosure issues in the
index.php3 script. By supplying a single quotation to the id, nrub, or
article variables of the index.php3 script, it is possible to gain
information about the installation path of the software.
37. Dropbear SSH Server Username Format String Vulnerability
BugTraq ID: 8439
Remote: Yes
Date Published: Aug 18 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8439
Summary:
Dropbear SSH Server is a secure shell server designed to be usable with
low-end systems. Dropbear implements the use of various SSH 2 protocol
features as well as X and authentication-agent forwarding, and is
available for the Linux, Tru64, Solaris, and FreeBSD operating systems.
A remotely exploitable format string vulnerability has been discovered in
Dropbear SSH Server. The problem occurs due to an incorrectly formatted
call to the syslog() system call, occurring within the 'util.c' source
file. This syslog() call can be triggered by invoking the dropbear_log()
function, which amongst other locations is called during the
authentication stage.
The specific code which makes this vulnerability remotely exploitable
occurs within the 'auth.c' source file, and is invoked after the server
places the user-supplied 'username' variable within an internal memory
buffer. This buffer is then passed to the syslog() system call as a format
string, called via the dropbear_log() function, and is subsequently
interpreted as such.
As a result of this format string, an attacker may be capable of
influencing the flow of program execution by placing specially calculated
format specifiers within the 'username'. When this data is logged, it may
be possible for the attacker to execute arbitrary code with the privileges
of Dropbear, typically root.
This vulnerability affects Dropbear SSH Server v0.34 and earlier.
38. eMule Client OP_SERVERIDENT Heap Overflow Vulnerability
BugTraq ID: 8440
Remote: Yes
Date Published: Aug 17 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8440
Summary:
eMule is a freely available open source peer-to-peer file sharing
application. eMule uses the eDonkey file sharing protocol. EMule+, xMule
and lmule are similar peer-to-peer file sharing applications that are
derived from the eMule code base and so are affected by this
vulnerability.
eMule client has been reported prone to a heap overflow vulnerability. The
issue presents itself when the client parses OP_SERVERIDENT data received
from a server. An attacker may exploit this issue by transmitting
malicious data to an affected client using a malicious server. Excessive
data greater than the size of an allocated buffer in heap memory, will
corrupt data adjacent to that buffer. In this case corrupting heap memory
management structures. Ultimately an attacker may exploit this condition
to execute arbitrary supplied instructions in the context of the
vulnerable eMule application. Failed exploitation attempts will result in
a denial of service of the affected client.
It should be noted that this vulnerability has been reported to affect
eMule <= 0.29a, lmule <= 1.3.1, xMule <= 1.4.3, <= 1.5.4 and EMule+ 1.0.
39. Fusion News Unauthorized Account Addition Vulnerability
BugTraq ID: 8441
Remote: Yes
Date Published: Aug 18 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8441
Summary:
Fusion News is a multi-user news management system implemented in PHP.
An access validation vulnerability has been reported in the software that
allows an attacker to add arbitrary accounts with administrator or user
privileges by manipulating URI parameters. Fusion News fails to check a
user's authentication credentials when adding a new account, therefore
allowing any user to add an account directly through a URI.
This vulnerability may allow an attacker to gain administrative privileges
resulting in a full compromise of the system.
The problem is reported to be present in Fusion News 3.3, however older
versions may be vulnerable as well.
40. ManDB Utility Hard Link Buffer Overrun Vulnerability
BugTraq ID: 8442
Remote: No
Date Published: Aug 18 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8442
Summary:
mandb is a utility that is used to initialize or manually update the index
database caches that are usually maintained by the man utility.
Debian released updates for previous mandb vulnerabilities (described in
BID 8303) that introduced a buffer overrun. This vulnerability exists in
a routine that is responsible for resolving hard links. The issue could
potentially be triggered by a malformed filename for a hard linked man
page. This could permit local attackers to execute arbitrary code in the
context of the mandb utility, which is typically user 'man'. Debian
addressed this by releasing revised updates that also fix this issue.
It is not known if the utility is prone to this issue on other
distributions.
41. eMule Client OP_SERVERMESSAGE Format String Vulnerability
BugTraq ID: 8443
Remote: Yes
Date Published: Aug 17 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8443
Summary:
eMule is a freely available, open source peer-to-peer file sharing
application. eMule uses the eDonkey file sharing protocol. EMule+, xMule
and lmule are similar peer-to-peer file sharing applications that are
derived from the eMule code base and so are affected by this
vulnerability.
eMule client has been reported prone to a format string vulnerability. The
issue presents itself when the client processes OP_SERVERMESSAGE data
received from a server. An attacker may exploit this issue by transmitting
malicious data, containing embedded format string specifiers to an
affected client using a malicious server. The format specifiers will be
interpreted literally and may result in attacker controlled arbitrary
memory being corrupted. Ultimately a remote attacker may exploit this
condition to execute supplied instructions in the context of the
vulnerable eMule application. Failed exploitation attempts will result in
a denial of service of the affected client.
It should be noted that this vulnerability has been reported to affect
eMule 0.29a and earlier, lmule 1.3.1 and earlier, xMule 1.4.3 and earlier
as well as 1.5.4 and earlier, and EMule+ 1.0.
42. eMule AttachToAlreadyKnown Double Free Vulnerability
BugTraq ID: 8444
Remote: Yes
Date Published: Aug 17 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8444
Summary:
eMule is a freely available open source peer-to-peer file sharing
application. eMule uses the eDonkey file sharing protocol. xMule and lmule
are similar peer-to-peer file sharing applications that are derived from
the eMule code base and so are affected by this vulnerability.
eMule client has been reported prone to a double free vulnerability. It
has been reported that when the eMule client receives a specific sequence
of packets from a malicious server, the AttachToAlreadyKnown client object
that is currently used is freed from reserved memory. The program may fail
to sufficiently format the pointer to the object after it has been freed.
As a result an attacker may be capable of freeing the object a second
time, potentially resulting in attacker-controlled data being referenced.
Ultimately an attacker may exploit this condition to execute arbitrary
supplied instructions in the context of the vulnerable eMule application.
Failed exploitation attempts will result in a denial of service of the
affected client.
It has been reported that this issue may be exploited with packets that
conform to the eDonkey protocol. This may make exploitation attempts
difficult to detect.
It should be noted that this vulnerability has been reported to affect
eMule <= 0.29c, lmule <= 1.3.1 and xMule <= 1.4.2, <= 1.5.6a.
43. eMule Client Servername Format String Vulnerability
BugTraq ID: 8445
Remote: Yes
Date Published: Aug 17 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8445
Summary:
eMule is a freely available, open source peer-to-peer file sharing
application. eMule uses the eDonkey file sharing protocol. EMule+, xMule
and lmule are similar peer-to-peer file sharing applications that are
derived from the eMule code base and so are affected by this
vulnerability.
eMule client has been reported prone to a format string vulnerability. The
issue presents itself when the client processes a malicious server name.
An attacker may exploit this issue by passing a server name containing
embedded format string specifiers to an affected client in a sufficient
manner. The format specifiers will be interpreted literally and may result
in attacker controlled arbitrary memory being corrupted or revealed.
Ultimately, a remote attacker may exploit this condition to trigger a
denial of service condition in the affected client. Although unconfirmed
it has been conjectured that this issue may also be exploited to reveal
contents in arbitrary locations of memory. Remote code execution is not
believed to be possible.
It should be noted that this vulnerability has been reported to affect
eMule 0.29c and earlier, lmule 1.3.1 and earlier, xMule 1.4.2 and earlier
as well as 1.5.5 and earlier and EMule+ 1.0.
44. OpenSLP Initialization Script Insecure Temporary File Vulner...
BugTraq ID: 8446
Remote: No
Date Published: Aug 18 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8446
Summary:
OpenSLP is a freely available, open source implementation of the Service
Location Protocol. It is available for the Unix and Linux platforms.
A problem exists in the creation of temporary files by OpenSLP. Because
of this, an attacker may be able to destroy data, resulting in a denial of
service.
The problem is in the initialization script used by OpenSLP. The default
script, slpd.all_init, does not properly check for the existence of the
/tmp/route.check file prior to attempting to create it. Because of this,
a symbolic link to a file can result in the destruction of the file at the
end of the symbolic link, depending upon the privileges of the user
executing the initialization script.
It should be noted that the initialization script is typically executed by
a privileged user.
III. SECURITYFOCUS NEWS ARTICLES
-----------------------------------------------------
1. Slammer worm crashed Ohio nuke plant network
By: Kevin Poulsen
A computerized safety monitoring system at the Davis-Besse nuclear plant
was crippled after the worm entered through the business network of the
plant's operator, FirstEnergy Corp.
http://www.securityfocus.com/news/6767
2. The Bright Side of Blaster
By: Kevin Poulsen
Experts predict the worm will leave a more secure Internet in its wake
http://www.securityfocus.com/news/6728
3. Hackers Claim New Fingerprint Biometric Attack
By: Ann Harrison
Presenters at the Chaos Computer Camp say thin invisible latex can fool
advanced fingerprint scanners.
http://www.securityfocus.com/news/6717
4. Net anonymity service back-doored
By: Thomas C. Greene, The Register
http://www.securityfocus.com/news/6779
5. MS releases unholy trinity of security fixes
By: John Leyden, The Register
http://www.securityfocus.com/news/6778
6. Check Point targets MEs with firewall/ VPN combo
By: John Leyden, The Register
http://www.securityfocus.com/news/6773
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. p0f2 v2.0b
By: The Evil Twin
Relevant URL: http://lcamtuf.coredump.cx/p0f-help/
Platforms:
Summary:
p0f2 is a versatile passive OS fingerprinting utility, to be used for
evidence or information gathering on servers, firewalls, IDSes, and
honeypots, for pen-testing, or just for the fun of it. It is a complete
rewrite of p0f version 1 by William Stearns, and until (if) both projects
are merged, will be listed separately.
2. p0f2 v2.0b
By: The Evil Twin
Relevant URL: http://lcamtuf.coredump.cx/p0f-help/
Platforms:
Summary:
p0f2 is a versatile passive OS fingerprinting utility, to be used for
evidence or information gathering on servers, firewalls, IDSes, and
honeypots, for pen-testing, or just for the fun of it. It is a complete
rewrite of p0f version 1 by William Stearns, and until (if) both projects
are merged, will be listed separately.
3. Remote Nmap v0.10
By: Tuomo Makinen, [email protected]
Relevant URL: http://rnmap.sourceforge.net
Platforms: UNIX
Summary:
Remote nmap (Rnmap) is a pair of client and server programs which allow
for various authorised clients to run their port scans from a centralised
server.
4. Password Manager XP v1.5
By: CP-Lab
Relevant URL: http://www.cp-lab.com
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:
Password Manager XP is a program that helps you to systematize any secret
information stored on your PC. It will be your passwords and secrets
keeper. Protect your private data with this password management utility.
Password Manager XP allows you to create several databases for storing
your secret information. Each database has an access password and is
encrypted with various algorithms at the same time (Blowfish, 3DES,
Rijndael, Tea, Cast128, RC4, Serpent, Twofish). You can store data in
different databases under your own passwords. You can create passwords
databases at shared resource and access them from multiple computers
across the network. Install to removable device Wizard will help you to
install the Password Manager XP to the removable devices such a USB flash
drives. It is easily integrated into Microsoft Internet Explorer. It helps
you to surf the Web more safely. Password Manager XP has a built-in
password generator with many adjustable functions.
5. packETH v1.0
By: Miha Jemec
Relevant URL: http://packeth.sourceforge.net
Platforms: Linux
Summary:
packETH is a Linux GUI packet generator tool for ethernet. It allows you
to create and send any possible packet or sequence of packets on the
ethernet.
6. Lutel Firewall v0.70
By: Tomek Lutelmowski
Relevant URL: http://energoprojekt.pl/~lutel/firewall/
Platforms: N/A
Summary:
Lutel Firewall Script is a Linux iptables shell script written in bash for
use as a firewall and NAT/masquerade router for home networks or multiple
subnet applications. It shares access to an Internet connection from
multiple workstations. Its main features are support for interface
aliases, per subnet traffic definitions, UID and GID of packet owner
restrictions, length of packet restrictions, SYN / flood protection,
disabling routing between subnets, masquerading setups per subnet,
transparent proxy support, port redirection, anti-spoof protection, TOS
optimization, predefinied netfilter marking for 3rd party traffic shapers
(such as tc), DHCP support, FTP active and passive mode support, and
ZorbipTraffic.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. ISS Malware/Malcode Research Analyst Position Availa... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334566
2. Certifications on resume (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334419
3. Smart Card (N. VA/DC area) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334417
4. Symantec Looking for Sr. Java/C++ Dev/Security Consu... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334397
5. Risk Assessment (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334395
6. Sr. Consultant / CA product specialist - MN (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334394
7. Information Assurance (IA) Team - Top Secret Clearan... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334390
8. PKI /Security Analyst - Twin Cities, MN (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334389
9. Sr Security Analyst & Systems Recovery-WSI (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334264
10. Computer Systems Security Engineers/Administrator C&... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334263
11. Network Intrusion Specialist - Washington DC Metro A... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334262
12. Product Manager-San Francisco, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334261
13. Senior Information Assurance Systems Engineer (TS Cl... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334230
14. Perimeter Security Engineer - NYC/Brooklyn $100-$11... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334229
15. SRP Integration Consultant MD-VA-DC $75-$85, equi... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334228
16. Another List (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334099
17. Looking for a hads-on hot dog in the DC area... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334090
18. Sales/Client Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334089
19. InfoSec Mktg-BusDev in DC or Denver Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334063
20. Territory Manager - New York, New Jersey & Conn. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334061
21. Seeking Security Position in the SF Bay Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334054
22. Job Opportunity: US-NY-NYC: Senior Windows Security ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334053
23. Is there life after infosec? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334047
24. Unix Security Engineer contract - Winston-Salem, NC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334045
25. Life after security? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334044
26. AW: Is there life after infosec? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334043
27. Seeking Information Technology Position in the Washi... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334040
28. The "Is there life after infosec?" Thread is Dead (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/334039
29. Yahoo! Software Engineer - Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/333932
30. Perl Developer - Ft. Meade, MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/333915
31. Launching A Security Practice: Is there life after ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/333860
32. Security Architecture Manager - Seattle, WA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/333549
33. NIDS Senior Secruity Engineer Columbia, MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/333544
34. Security and Privacy Tools Development Manager - Mi... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/333536
35. Security Engineers needed - Fairfax, VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/333531
36. Request for Job Posting... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/333522
VI. INCIDENTS LIST SUMMARY
--------------------------
1. DCOM worm with get.bat bot.rar (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334282
2. Anyone else seeing a radical increase in Sobig? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334281
3. possible 0-day exploit for latest Real-/Helixserver ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334280
4. DCOM bot.rar (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334277
5. Increasing ICMP Echo Requests (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334275
6. lots of sobig virus emails. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334274
7. Sobig.F (Was: document _ a l l . p i f) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334273
8. Software vendor clueless (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334272
9. Unusual DNS and port 37 requests (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334268
10. Administrivia: Virus. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334239
11. wicked_scr.scr (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334238
12. mod to "killblast.vbs" script (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334152
13. ICMP port 2048 scans (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334147
14. SoBig.F (Was: document_all.pif) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334144
15. document_all.pif (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334139
16. what is this? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334137
17. newbie wanting some info !! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334135
18. Strange blaster behavior (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334005
19. Strange UDP packets to non-existent network. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/334001
20. Re(2): Increasing ICMP Echo Requests (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333939
21. DCOM95 for Windows 95 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333938
22. is this the start of something naughty? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333864
23. Microsoft 'extinguishes' windowsupdate.com (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333863
24. msblast.d and a review of defensive worms (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333827
25. Article Announcement (3): (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333824
26. msblast and RFC 1918 addresses (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333814
27. Re-Infection with Blaster Worm (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333812
28. FTimes 3.3.0 Release (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333585
29. WebJob 1.3.0 Release (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333584
30. rpc dcom worm and windowsupdate (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333582
31. MSBlast and other known exploits.. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/333566
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Sobig / Blaster on steroids (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/334483
2. TOORCON 2003 LINEUP FINALIZED (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/334035
3. Bug in Norton FireWall 2003 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/334021
4. HOON & shellcode (again) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/333571
5. Rolf Rolles analysis (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/333490
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Patch testing (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/334432
2. Patch Management Best Practices E-Seminar (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/334430
3. Article Announcement: Slow Down Internet Worms With ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/334407
4. MS03-033 not signed by Microsoft? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/334403
5. DCOM patch + Exchange (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/334251
6. Mail from MSN Messenger (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/334249
7. scan of domain logon reveals unknown port (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333826
8. SecurityFocus Microsoft Newsletter # 150 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333809
9. Article Announcement: MRTG for Intrusion Detection w... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333803
10. Why the shutdown if infected with blaster? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333799
11. DNS (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333797
12. Account Lockout -- ARGH (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333763
13. Account Lockuout --ARGH (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333753
14. Detecting Blaster (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333545
15. New variant. Blast.b (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333539
16. FW: Actions for the Blaster Worm - Special Edition, ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333529
17. MS03-029 ?-Download link (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333516
18. FW: Blaster vs. Kaht2, detecting Windows root kits (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333498
19. Administrivia: Blaster (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/333482
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Administrivia: Out on vacation X-POST (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/333972
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Administrivia: Out on vacation X-POST (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/333973
2. Disassemblers??? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/333967
XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by BlackHat
Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
technical IT security event. Modeled after the famous Black Hat event in
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
Symantec is the Diamond sponsor. Early-bird registration ends September
6.
http://www.securityfocus.com/sponsor/BlackHat_linux-secnews_030825
------------------------------------------------------------------------------