SecurityFocus Newsletter #212

SecurityFocus Newsletter #212
------------------------------

This Issue is Sponsored by: SPI Dynamics

NEW ALERT:  "How a Hacker Launches a LDAP Injection Attack Step-by-Step".
It's as simple as placing additional LDAP query commands into a Web form
input box giving hackers complete access to all your backend systems!
Firewalls and IDS will not stop such attacks because LDAP Injections are
seen as valid data. Download this *FREE* white paper from SPI Dynamics for
a complete guide to protection!

http://www.securityfocus.com/sponsor/SPIDynamics_sf-news_030902
------------------------------------------------------------------------
I. FRONT AND CENTER
     1. Pocket-Sized Wireless Detection
     2. Securing MySQL: step-by-step
II. BUGTRAQ SUMMARY
     1. Real Networks Helix Universal Server Remote Buffer Overflow ...
     2. Glibc Getgrouplist Function Buffer Overrun Vulnerability
     3. Glibc Malloc Routine Race Condition Vulnerability
     4. WIDZ Remote Root Compromise Vulnerability
     5. IdealBB HTML Injection Vulnerability
     6. Red Hat Linux IPTables Firewall Failure Vulnerability
     7. OptiSoft Blubster Remote Denial of Service Attack
     8. Whois Client Command Line Buffer Overrun Vulnerability
     9. Castle Rock Computing SNMPc v5/v6 Unauthorized Remote Privil...
     10. Sendmail DNS Maps Remote Denial of Service Vulnerability
     11. GTKFTPD LIST Command Remote Buffer Overflow Vulnerability
     12. AnalogX Proxy DNS Lookup Error Page Cross-Site Scripting Vul...
     13. newsPHP Remote File Include Vulnerability
     14. newsPHP Authentication Bypass Vulnerability
     15. Netbula Anyboard Information Disclosure Vulnerability
     16. Pam_SMB Remote Buffer Overflow Vulnerability
     17. HP Tru64 SSH Undisclosed RSA Key Potential Authentication By...
     18. SLRN XRef Buffer Overflow Vulnerabilty
     19. PHPGACL Debugging Information Disclosure Vulnerability
     20. akpop3d User Name SQL Injection Vulnerability
     21. GBrowse Help Parameter File Disclosure Vulnerability
     22. KisMAC Multiple Local Privilege Escalation Vulnerabilities
     23. DocView File Disclosure Vulnerability
     24. Py-Membres Secure.PHP Unauthorized Access Vulnerability
     25. Py-Membres Pass_done.PHP Remote SQL Injection Vulnerability
     26. BSD-Games Monop Player Name Local Buffer Overrun Vulnerabili...
     27. Attila PHP SQL Injection Unauthorized Privileged Access Vuln...
     28. AldWeb MiniPortail LNG Parameter Cross-Site Scripting Vulner...
     29. Tellurian TftpdNT Long Filename Buffer Overrun Vulnerability
     30. eNdonesia Mod Parameter Cross-Site Scripting Vulnerability
     31. eNdonesia Mod Parameter Path Disclosure Vulnerability
     32. BEA WebLogic Integration Undisclosed File System Access Vuln...
     33. BProc Local Arbitrary File Deletion Vulnerability
     34. ISC INN Innfeed Config File Command Line Format String Vulne...
     35. WorldFlash News Ticker Remote Buffer Overrun Vulnerability
     36. LinuxNode Remote Buffer Overflow Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
     1. Hacking-by-subpoena ruled illegal
     2. U.S. Sponsors Anti-Censorship Web Service
     3. Slammer worm crashed Ohio nuke plant network
     4. FBI Says Teen Put Worm on Internet
     5. Digital Sandbox Recognizes Risks to Government Agencies
     6. Doh! Man steals GPS tracking device
IV. SECURITYFOCUS TOP 6 TOOLS
     1. cryptoswap v0.0.3
     2. Email v2.1
     3. floppyfw v2.0.7
     4. PAM SMB v1.1.7
     5. pam_dotfile v0.7
     6. Openwall Linux kernel patch v2.4.22-ow1
V. SECURITYJOBS LIST SUMMARY
     1. SQA Engineer (Contract) - Symantec - Redwood City, C... (Thread)
     2. Risk Assessment Professional - DOE - Chicago, IL (Thread)
     3. Urgent - CISSP, ISO 17799, Identity Access Mgmt Posi... (Thread)
     4. Seeking security job (Thread)
     5. D.C. Based Cybersecurity Solution Sales (Thread)
     6. Senior Security Software Developer (Thread)
     7. SQA Engineer - Symantec - Redwood City, CA (Thread)
     8. Lab Program Manager - Symantec - Redwood City, CA (Thread)
     9. Senior Product Manager, MetaFrame Password - Ft. Lau... (Thread)
     10. Repost:  Senior Security Software Engineer Position ... (Thread)
     11. Provisioning System Admin position in NY (Thread)
     12. Network Security System Admin position in NY (Thread)
     13. Provisioning Architect position in NY (Thread)
     14. MQSeries / Tivoli Architect position in New York! (Thread)
     15. DALLAS - Unix - Linux - Perl Scripting - Pre-Sales- ... (Thread)
     16. Director of Product Management (Thread)
     17. INFOSEC with Top Secret Clearance - DC Metro area (M... (Thread)
     18. Sr Security Professional looking for Northern VA 109... (Thread)
     19. Security Expert (Thread)
     20. Seeking Security Specialist Position (VA/DC) (Thread)
     21. Seeking Security Specialist Position (Thread)
     22. Incident Analyst - Calgary, AB Canada (Thread)
     23. C++ Windows Systems Security Software Engineer need ... (Thread)
     24. Asst Audit Director - Internal Audit & Risk Assessme... (Thread)
     25. Security Engineers (Thread)
     26. Security Engineer-IDS (Thread)
     27. Kansas City Kansas Tech Architect-Security PKI Speci... (Thread)
     28. Recently relocated to DE/PA/NJ area (Thread)
     29. Information Security Practice Manager - New York, NY... (Thread)
     30. TS-cleared Security Engineers needed -- Washington D... (Thread)
     31. Security Pre Sales Engineer need in Long Island, NY (Thread)
     32. Security Pre Sales Engineer need in Herndon (Thread)
     33. Security Professional looking for work in NYC (Thread)
     34. SOC Manager- Des Moines IA, $90-$110K (Thread)
VI. INCIDENTS LIST SUMMARY
     1. compromised Real Server 8 (Thread)
     2. Port 554 - Quicktime scans, what's up (Thread)
     3. Outgoing connections to ports 22226 and 22227 (Thread)
     4. Buffer Overflow in Windows Alpha systems (Thread)
     5. Can anyone identify this possible backdoor? (Thread)
     6. Increasing ICMP Echo Requests (Thread)
     7. towards a taxonomy of Information Assurance (IA) (Thread)
     8. lots of sobig virus emails. (Thread)
     9. Odd worm traffic? (Thread)
     10. strange HTTP requests (Thread)
     11. Outgoing connections to Port 22226 and 22227 (Thread)
     12. strange web traffic (Thread)
     13. ICMP port 2048 scans (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
     1. Oracle xdb ftp service? (Thread)
     2. Defeating non-executable stacks ... trying to, actua... (Thread)
     3. Off By One on Red Hat Linux again (Thread)
     4. Off by one on RedHat Linux (Thread)
     5. Mail relay issue (Thread)
     6. Oracle Patch Testing (Thread)
     7. gtkftpd[v1.0.4(and below)]: remote root buffer overf... (Thread)
     8. MS Exchange 'Recall' feature - Possible to delete ma... (Thread)
     9. Overwriting the .dtors section with gcc 3 (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
     1. [email protected] (Thread)
     2. Administrivia: lost messages sent since Wednesday (Thread)
     3. Patch testing (Thread)
     4. SecurityFocus Microsoft Newsletter # 151 (Thread)
IX. SUN FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2003-08-26 to 2003-09-02.
X. LINUX FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2003-08-26 to 2003-09-02.
XI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Pocket-Sized Wireless Detection
By Bob Rudis

This article provides a comparison of two tiny 802.11 detectors and
discusses how they would fit into your overall WiFi security framework.

http://www.securityfocus.com/infocus/1727

2. Securing MySQL: step-by-step
By Artur Maj

This article describes the basic steps which should be performed in order
to secure a MySQL database against both local and remote attacks.

http://www.securityfocus.com/infocus/1726


II. BUGTRAQ SUMMARY
-------------------
1. Real Networks Helix Universal Server Remote Buffer Overflow ...
BugTraq ID: 8476
Remote: Yes
Date Published: Aug 22 2003
Relevant URL: http://www.securityfocus.com/bid/8476
Summary:
Helix Universal Server is a multiple type media server distributed and
maintained by Real Networks. It is available for Unix, Linux, and
Microsoft Windows platforms.

Real Networks has announced that a vulnerability is present in Helix
Universal Server version 9 and prior that will allow for attackers to
remotely compromise servers.  The condition occurs when URLs containing an
excessive number of '../' sequences are sent to the Server's protocol
parsers.  A remote attacker may pass a malicious request that is
sufficient to overflow a 1024 byte buffer on the stack.  Ultimately the
attacker may influence execution flow into attacker controlled heap based
memory.  This will result in arbitrary attacker supplied instructions
being executed in the context of the affected Helix server.

The vulnerability is reportedly present in the "View Source" plug-in and
may be eliminated if the plug-in is disabled.  The plug-in is used for
reading and displaying file format header information of files accessible
on the server filesystem.  It also supports the "Content Browsing"
feature, which will not function if the plug-in is disabled.
Additionally, disabling the plug-in will not adversely affect on-demand or
live streaming delivery or the logging and authentication services of the
server.

It has been reported that exploitation of this issue is hindered somewhat
on SPARC systems or other systems that are word aligned.

Note:  The announcement by RealNetworks may be related to issues reported
earlier by Symantec (possibly BIDs 7020, 6454, 6458 or 6456).  This has
not been confirmed.  However, if this is indeed the case, this BID will be
retired.

2. Glibc Getgrouplist Function Buffer Overrun Vulnerability
BugTraq ID: 8477
Remote: Unknown
Date Published: Aug 23 2003
Relevant URL: http://www.securityfocus.com/bid/8477
Summary:
The GNU C library, glibc, contains standard C libraries called by various
applications.

The getgrouplist function in glibc does not perform adequate bounds
checking on data it retrieves, allowing a potential for the buffer to be
overrun.

When getgrouplist retrieves the group list for a user who is a member of
more groups than the group list can hold, the buffer is overrun.  This may
result in segmentation faults in user applications.

Consequences of this vulnerability are dependant on the application
calling the getgrouplist function.


3. Glibc Malloc Routine Race Condition Vulnerability
BugTraq ID: 8478
Remote: Unknown
Date Published: Aug 23 2003
Relevant URL: http://www.securityfocus.com/bid/8478
Summary:
The GNU C library, glibc, contains standard C libraries called by various
applications.

An unspecified race condition issue exists in the malloc function of
glibc.  This issue may result in memory corruption, possibly allowing
sensitive areas in memory to be overwritten.

Specific details of this issue are not currently known.  This record will
be updated when further information becomes available.

This issue was reported to only affect IA64 platforms.

4. WIDZ Remote Root Compromise Vulnerability
BugTraq ID: 8479
Remote: Yes
Date Published: Aug 23 2003
Relevant URL: http://www.securityfocus.com/bid/8479
Summary:
WIDZ is a wireless intrusion detection system that checks the identity of
wireless access points against a list of authorized access points in a
config file.  If an access point is not in the authorized list, an alert
message is generated.

The alert message generated by WIDZ passes untrusted data to system()
calls, possibly allowing for a compromise of the underlying operating
system.

If the essid of an access point is set to include commands, those commands
will be executed when they are passed to the system() call by WIDZ.
Commands would be executed with root privileges.

5. IdealBB HTML Injection Vulnerability
BugTraq ID: 8480
Remote: Yes
Date Published: Aug 23 2003
Relevant URL: http://www.securityfocus.com/bid/8480
Summary:
IdealBB is a web based bulletin board system implemented in ASP.  It runs
on Microsoft Windows platforms using SQL Server on the back end.

IdealBB is prone to a script injection issue.  The software allows raw
HTML to be inserted into messages.  The software then strips any script
code from the embedded HTML.

The problem occurs because IdealBB fails to strip script code containing
HTML entities in place of certain characters.  Any script code inserted
using this method would be executed in the web browser of the user viewing
the malicious message.

6. Red Hat Linux IPTables Firewall Failure Vulnerability
BugTraq ID: 8481
Remote: No
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8481
Summary:
iptables is a firewall infrastructure developed for the Linux kernel.

iptables on Red Hat Linux systems has been reported prone to a
vulnerability, which may prevent the iptables firewall from functioning
correctly.

The issue presents itself, due to recent Red Hat kernel updates. It has
been reported that a recent kernel update failed to update the iptables
utility thereby preventing iptables operations, for example owner match,
from functioning.

Ultimately this issue may prevent an iptables firewall from restarting
after a kernel-upgrade has been applied.

This issue may lead an administrator into a false sense of security, as
the administrator may believe that an effective firewall is running.

7. OptiSoft Blubster Remote Denial of Service Attack
BugTraq ID: 8482
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8482
Summary:
Blubster is a file-sharing network based on a basic peer-to-peer
structured software without a central server.  The software uses a private
UDP transport protocol called MP2P in order to allow users to share files
anonymously.

A vulnerability has been reported in Blubster that may allow a remote
attack to cause a denial of service on a vulnerable host.  The software
listens for incoming voice chat sessions on TCP port 701.  The issue is
reported to occur when a remote attacker floods port 701 with voice chat
session request packets.  The successful exploitation of this
vulnerability may cause the application to behave abnormally resulting in
a denial of service to other users.

It has been reported that this attack may not be logged, allowing an
attacker to persistently launch attacks against a vulnerable host.

This issue has been reported to exist in Blubster v2.5, however other
versions may be affected as well.

8. Whois Client Command Line Buffer Overrun Vulnerability
BugTraq ID: 8483
Remote: Yes
Date Published: Aug 22 2003
Relevant URL: http://www.securityfocus.com/bid/8483
Summary:
Whois is an enhanced whois client for Linux/Unix platforms.

Whois is prone to a buffer overrun vulnerability when handling command
line parameters of excessive length.  The cause of the issue is that
command line parameters are copied using an sprintf() operation without
sufficient bounds checking.  While the client is not setuid/setgid, it is
often invoked by external scripts.  This could present a security
vulnerability if the program is invoked with untrusted input.  In such a
case, successful exploitation would permit an attacker to execute
arbitrary code in the context of the program.

A typical scenario would be if a CGI script called the program with
parameters that could be controlled by a remote attacker.  This could
possibly the attacker to execute arbitrary code with the privileges of the
web server, which would be invoking the vulnerable program.

9. Castle Rock Computing SNMPc v5/v6 Unauthorized Remote Privil...
BugTraq ID: 8484
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8484
Summary:
SNMPc is a Distributed Network Manager developed and maintained by Castle
Rock Computing. SNMPc is available for the Microsoft Windows operating
system. For monitoring and administering the SNMPc server, the product
includes a remote console, which is accessible to authenticated remote
users.

It has been discovered that all authentication routines, when connecting
to the aforementioned console, are carried out within the client program.
Specifically, when an authentication request to the server is made, user
data will be transmitted from the server to the client, this date includes
an encrypted password. This password is compared client-side, to the
password that is supplied; if successful the client likely transmits a
packet to the server notifying it of a successful authentication.

An attacker could exploit this issue in one of two ways. First, it has
been reported that the encryption scheme used to obfuscate the password
transmitted by the server, is no more then a simple substitution cipher,
making it trivial for an attacker to deduce the plaintext. Second, it may
be possible for an attacker to reverse and modify specific components of a
client program, and thus influence it's behavior in such a way that
authentication may be granted when the routine actually failed.

Ultimately, this issue could allow an attacker to reveal users passwords,
such as the 'Administrator' user, who has 'Supervisor' privileges by
default. Or gain unauthorized console access, with 'Supervisor' privileges
on a target server, without supplying a password at all.

It should be noted that the 'Administrator' user cannot be deleted or
modified.

Privileged access to a remote console on a target server may allow an
attacker to gain sensitive information which could be used in later
attacks, or modify the behavior of an administered network, etc.

This vulnerability affects SNMPc v5 and version v6.

10. Sendmail DNS Maps Remote Denial of Service Vulnerability
BugTraq ID: 8485
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8485
Summary:
A potential vulnerability has been discovered in Sendmail when
implementing the use of DNS Maps. This behavior can be enabled through the
sendmail.cf configuration file.

The problem lies in the sm_resolve.c source file, and is exclusive to
Sendmail 8.12.x releases, prior to 8.12.9 only. Specifically, it has been
discovered that the dns_parse_reply() function fails to initialize
RESOURCE_RECORD_T structures after allocation. These structures are used
in a chain, designed to keep track of varoius DNS data. Each structure
includes a 'rr_next' variable, which is a pointer to the next structure in
the list.

When an invalid DNS reply is received by Sendmail, i.e. one with a reply
size differing from the announced reply size, the dns_free_data() function
is called. This function is designed to free allocated chains of
RESOURCE_RECORD_T structures, and traverses the chain until a 'rr_next'
variable points to NULL. Due to the failure to initialize these
structures, the last structure in the chain will not contain a NULL
'rr_next' variable. As such, the dns_free_data() function may traverse
into random memory by referencing this garbage 'rr_next' pointer, which
could potentially result in the free() function being called on random
memory.

This could potentially allow for a denial of service condition, as an
attacker may trigger a situation under which invalid memory will be
dereferenced. Theoretically, if this garbage data were to be controlled by
an attacker at some point during execution, it may be possible to exploit
this issue to execute arbitrary code. This however has not been confirmed.

It should be noted that the default configuration of Sendmail is not
affected by this issue.

11. GTKFTPD LIST Command Remote Buffer Overflow Vulnerability
BugTraq ID: 8486
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8486
Summary:
GtkFtpd is a personal FTP server that includes a GTK graphical interface.

The GtkFtpd LIST command routine has been reported prone to a remotely
exploitable buffer overflow vulnerability.

The issue presents itself in the sys_cmd.c source file, and is due to a
lack of sufficient bounds checking that is performed on user-supplied
data. Specifically when a LIST command is invoked, a sprintf() call fails
to perform sufficient checks when appending  date/user/stat data to a
file/foldername string. When the concatenated data is copied into a
256-byte buffer to be later displayed on screen, 40 bytes of
attacker-controlled data may be written past the boundary of a reserved
buffer in memory. Ultimately this issue may be leveraged by a remote
attacker to influence GtkFtpd program execution flow and have arbitrary
supplied instructions executed in the context of the vulnerable daemon,
typically root.

It should be noted that this issue has been reported to affect GtkFtpd
version 1.0.4 and previous.

12. AnalogX Proxy DNS Lookup Error Page Cross-Site Scripting Vul...
BugTraq ID: 8487
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8487
Summary:
AnalogX Proxy is proxy server software for Microsoft Windows operating
systems.  It supports various protocols including HTTP.

The AnalogX Proxy is prone to a cross-site scripting issue that can be
exploited through error pages.

When a DNS lookup for a domain fails, AnalogX Proxy returns an error page
including the failed URL.  If any script code is included in this failed
URL, it will be executed in the client web browser.

This issue allows a user to be prone to attacks such as cookie-based
credential theft.  Other attacks may also be possible.

13. newsPHP Remote File Include Vulnerability
BugTraq ID: 8488
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8488
Summary:
newsPHP is a web-based content management system. It is implemented in PHP
and is available for a variety of platforms including Microsoft Windows
and Linux variant operating systems.

newsPHP is reported to be prone to a vulnerability that may allow remoter
attackers to include files containing arbitrary code to be executed on a
host running the vulnerable software.  This issue is exploitable via the
LangFile variable of nphpd.php module.  It has been reported that the
LangFile variable is not set by default in newPHP and may be exploited by
influencing its path to point to a malicious file supplied by the
attacker.

This vulnerability may lead to execution of arbitrary code by an attacker
in the form of PHP commands in the context of the web server hosting the
vulnerable version of newsPHP.

newsPHP v216 is reported to be vulnerable to this issue, however other
versions may be affected as well.

14. newsPHP Authentication Bypass Vulnerability
BugTraq ID: 8489
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8489
Summary:
newsPHP is a web-based content management system. It is implemented in PHP
and is available for a variety of platforms including Microsoft Windows
and Linux variant operating systems.

It has been reported that newsPHP contains an authentication bypass
vulnerability allowing an unauthenticated attacker to gain access to
sensitive data or perform unauthorized actions.  The issue occurs due to
the failure of newPHP to check authentication credentials of a remote
user.  An attacker may send a request to perform an action via a specially
crafted URI containing illegitimate authentication credentials in order to
gain access to sensitive data.

The issue is reported to exist in newPHP v216, however other versions may
be affected as well.

15. Netbula Anyboard Information Disclosure Vulnerability
BugTraq ID: 8490
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8490
Summary:
Netbula Anyboard is a perl based content management system consisting of
message boards, chat and email.

It has been reported that Anyboard may be prone to an information
disclosure vulnerability, allowing a remote attacker to access sensitive
data via a specially crafted URI.  The issue occurs when an attacker sends
a specific HTTP request to a vulnerable host resulting in the disclosure
of information such as software versions, installation path, system
environment, UIDs etc.

This problem may result in an attacker gaining access to sensitive data
that may be used to launch further attacks against vulnerable hosts.

Netbula LLC Anyboard 9.9.5.6 is reported to be prone to this issue,
however other versions may be affected as well.

16. Pam_SMB Remote Buffer Overflow Vulnerability
BugTraq ID: 8491
Remote: Yes
Date Published: Aug 26 2003
Relevant URL: http://www.securityfocus.com/bid/8491
Summary:
pam_smb is a pluggable authentication module (PAM) that provides for
authentication of UNIX users to a Server Message Block (SMB) server.

pam_smb has been reported prone to a buffer overflow vulnerability. It has
been reported that systems using pam_smb to authenticate to a remotely
accessible service may be vulnerable to a condition that may allow a
remote attacker to supply and execute arbitrary code in the context of the
vulnerable module.

Specifically, insufficient bounds checking is carried out on user-supplied
passwords before being copied into internal memory space. As a result, an
attacker may be capable of overwriting sensitive locations in memory.

It has been reported that all versions of pam_smb prior to, and including
version 1.1.6 and 2.0.0-rc development versions are affected by this
vulnerability.

17. HP Tru64 SSH Undisclosed RSA Key Potential Authentication By...
BugTraq ID: 8492
Remote: Yes
Date Published: Aug 26 2003
Relevant URL: http://www.securityfocus.com/bid/8492
Summary:
The HP Tru64 implementation of SSH has been reported prone to an
undisclosed potential authentication bypass vulnerability. The issue has
been reported to present itself when RSA signatures are incorrectly
processed, if SSH is implementing RSA keys and digital certificates as
authentication methods.

This vulnerability has been reported to be potentially exploitable to
allow local or remote users to gain privileged interactive access via the
affected SSH service.

Explicit details relating to this vulnerability have not been made public.
This BID will be updated as further relevant details are released.

Although unconfirmed this issue may be related to the vulnerability
reported in BID 8094.

This issue has been reported to affect HP Tru64 UNIX 5.1B PK2(BL22) and HP
Tru64 UNIX 5.1A (all Base Levels).

18. SLRN XRef Buffer Overflow Vulnerabilty
BugTraq ID: 8493
Remote: Yes
Date Published: Aug 26 2003
Relevant URL: http://www.securityfocus.com/bid/8493
Summary:
slrn is an open source, freely available newsreader. It is actively
maintained by the SLRN Development Team, distributed through Sourceforge,
and included with many distributions of Linux.

slrn has been reported prone to a remote buffer overflow condition.

The issue has been reported to present itself when handling malicious Xref
headers. It has been reported that, when handled, an Xref header value
sufficient to trigger this issue may overrun the bounds of a reserved
memory buffer, and corrupt adjacent memory within the slrn process.
Although unconfirmed, due to the nature of this vulnerability it has been
conjectured that a remote attacker may exploit this issue to influence the
execution flow of the affected slrn application. This could result in
arbitrary code execution in the context of the user running slrn.

This vulnerability has been reported to affect all versions of slrn prior
to slrn version 0.9.8.0.

19. PHPGACL Debugging Information Disclosure Vulnerability
BugTraq ID: 8494
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8494
Summary:
phpGACL (PHP Generic Access Control List) is access control software for
web applications.

phpGACL does not sufficiently secure debugging information from access by
unauthorized parties.  This vulnerability has the potential to reveal
debugging information to remote users.  This could potentially expose
database authentication credentials and other sensitive information.  A
remote attacker may exploit this issue by adding a "?debug=1" URI
parameter in a HTTP GET request.

This issue could be related to configuration.

20. akpop3d User Name SQL Injection Vulnerability
BugTraq ID: 8495
Remote: Yes
Date Published: Aug 26 2003
Relevant URL: http://www.securityfocus.com/bid/8495
Summary:
akpop3d is a stand alone POP3 daemon.  The product allows secure POP3
sessions based on POP3-over-SSL.

akpop3d may be prone to a vulnerability that may allow an attacker to
inject malicious SQL syntax into database queries. The source of this
issue is insufficient sanitization of user-supplied input before including
this input in database queries.  A remote attacker may exploit this issue
to influence SQL query logic.

This issue may allow an attacker to gain access to sensitive data stored
in the database.  Other attacks on the underlying database are possible as
well.

It has been reported that a valid POP3 password is required in order to
exploit this issue.

21. GBrowse Help Parameter File Disclosure Vulnerability
BugTraq ID: 8496
Remote: Yes
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8496
Summary:
GBrowse (Generic Genome Browser) is web-based genetics software.

GBrowse is prone to a file disclosure vulnerability.  Remote users may
gain access to files outside of the web root directory by passing
directory traversal sequences (../) via the 'help' URI parameter.

This vulnerability could be exploited to gain unauthorized access to files
that are readable by the web server that is hosting the vulnerable
software.  If successfully exploited, an attacker may gain access to
sensitive information that could assist in mounting further attacks
against system resources.

22. KisMAC Multiple Local Privilege Escalation Vulnerabilities
BugTraq ID: 8497
Remote: No
Date Published: Aug 26 2003
Relevant URL: http://www.securityfocus.com/bid/8497
Summary:
KisMAC is a freely available net stumbling application for Apple's Mac OS
X.

KisMAC has been reported prone to multiple local privilege escalation
vulnerabilities.

The issues may only be exploited if the "SUID Shell Scripts are enabled"
feature is enabled on the affected system. The vulnerabilities present
themselves because the affected shell scripts may be influenced into using
an attacker controlled directory rather than a system directory, if an
attacker hardlinks to any of the affected shell scripts.

The following shell scripts are affected:

viha_driver.sh
macjack_load.sh
airojack_load.sh
exchangeKernel.sh
setuid_enable.sh
setuid_disable.sh
viha_prep.sh
viha_unprep.sh

It has been reported that these vulnerabilities maybe exploited by a local
user to: execute arbitrary binaries with elevated privileges, change
ownership of privileged files, load arbitrary kernel modules, change
ownership of attacker specified files and install an arbitrary kernel.

It should be noted that although this vulnerability has been reported to
affect KisMAC version 0.05d other versions might also be affected.

These issues will be split into individual BIDs at a later date.

23. DocView File Disclosure Vulnerability
BugTraq ID: 8498
Remote: Yes
Date Published: Aug 26 2003
Relevant URL: http://www.securityfocus.com/bid/8498
Summary:
docview is a proprietary package included with SCO OpenLinux and UnixWare,
and is licensed under the GPL. It is designed to allow viewing of man
pages via an HTTP interface.

docview has been reported prone to a remotely exploitable file disclosure
vulnerability. The issue has been reported to present itself due to an
Apache web server configuration issue. It has been reported that anonymous
remote attackers may exploit this condition, by invoking a malicious URL
request against the affected docview utility to disclose the contents of
publicly readable files. Due to the nature of this vulnerability it has
been conjectured that a remote attacker may also disclose contents of web
server readable files, this, however, has not been confirmed.

Information harvested in this manner may be used to aid in further attacks
that are launched against the target system.

24. Py-Membres Secure.PHP Unauthorized Access Vulnerability
BugTraq ID: 8499
Remote: Yes
Date Published: Aug 26 2003
Relevant URL: http://www.securityfocus.com/bid/8499
Summary:
Py-Membres is a php based content management system.

A vulnerability has been reported for Py-Membres that allows remote
attackers to obtain administrative privileges on vulnerable installations.

The error lies in the 'secure.php' script. Reportedly, the script does not
fully check some URI parameters. Thus it is possible for an attacker to
manipulate URI parameters and log into the system as an administrative
user without the need for passwords.

An attacker can exploit this vulnerability by setting the URI parameter
'adminpy' to 1.

This vulnerability was reported to affect Py-Membres 4.0, 4.1, and 4.2. It
is possible that other versions are affected as well.

25. Py-Membres Pass_done.PHP Remote SQL Injection Vulnerability
BugTraq ID: 8500
Remote: Yes
Date Published: Aug 26 2003
Relevant URL: http://www.securityfocus.com/bid/8500
Summary:
Py-Membres is a php based content management system.

A vulnerability has been reported for that allows remote attackers to
modify the logic of SQL queries.

It has been reported that an input validation error exists in the
pass_done.php file included with Py-Membres. Because of this issue, remote
attackers may launch SQL injection attacks through the software.

Exploitation of this issue will allow an attacker to inject SQL syntax
into database queries via the 'email' variable for the pass_done script.
This may allow for a variety of attacks.

This issue has been reported to be present in versions 4.0, 4.1, and 4.2,
however other versions may be affected as well.

26. BSD-Games Monop Player Name Local Buffer Overrun Vulnerabili...
BugTraq ID: 8501
Remote: No
Date Published: Aug 25 2003
Relevant URL: http://www.securityfocus.com/bid/8501
Summary:
Monop is a Monopoly game that is included in bsd-games.

Monop is prone to a locally exploitable buffer overrun vulnerability.
This is due to insufficient bounds checking of player names.  By
submitting a name for a second (or greater) player that is of excessive
length, it is possible to corrupt adjacent regions of heap memory with
attacker-supplied data.  This could be exploited to overwrite malloc
header data with specific values, which could be leveraged to corrupt a
return address or other sensitive value in memory with arbitrary data.

Monop is typically installed setgid games, so it is possible to exploit
this issue to execute arbitrary code with these privileges.

27. Attila PHP SQL Injection Unauthorized Privileged Access Vuln...
BugTraq ID: 8502
Remote: Yes
Date Published: Aug 26 2003
Relevant URL: http://www.securityfocus.com/bid/8502
Summary:
Attila PHP is a PHP content management system designed for portal sites.
It is available for Unix, Linux, and Microsoft Windows platforms.

An SQL injection vulnerability has been reported in Attila PHP that could
allow an attacker to gain unauthorized privileged access to a target site.
The problem occurs due to Attila PHP failing to sufficiently enapsulate
the 'cook_id' variable within quotes. As a result, an attacker may
injection SQL commands within the variable, and influence the result of an
SQL query carried out by the program. This could ultimately allow an
attacker to be granted access to the site as an arbitrary user, possibly
an administrator.

Privileged access to a site implementing Attila PHP could allow an
attacker to reveal or modify sensitive information or potentially launch
other attacks. It should be noted that, although unconfirmed it may be
possible for an attacker to injection SQL commands into the query that
could aid in launching attacks against the underlying database.

This vulnerability is said to affect Attila PHP 3.0.

28. AldWeb MiniPortail LNG Parameter Cross-Site Scripting Vulner...
BugTraq ID: 8504
Remote: Yes
Date Published: Aug 27 2003
Relevant URL: http://www.securityfocus.com/bid/8504
Summary:
aldweb miniPortail is a web-based portal system.

A cross-site scripting vulnerability has been reported for miniPortail.
The vulnerability exists due to insufficient sanitization of some
user-supplied values. Specifically, malicious HTML code is not sanitized
from the 'lng' URI parameter passed to miniPortail.

An attacker could exploit this issue to execute arbitrary HTML code in the
browser of a remote user who follows a malicious link. Code execution
would occur in the context of the vulnerable site. It has also been
reported that this issue may be exploited to disclose the installation
path of the affected software.

Exploitation could permit an attacker to steal cookie-based authentication
credentials or launch other attacks.

It should be noted that although this vulnerability has been reported to
affect aldweb miniPortail version 2.3 previous versions might also be
affected.

29. Tellurian TftpdNT Long Filename Buffer Overrun Vulnerability
BugTraq ID: 8505
Remote: Yes
Date Published: Aug 27 2003
Relevant URL: http://www.securityfocus.com/bid/8505
Summary:
Tellurian TftpdNT is a typical RFC compliant TftpdNT server for the
Microsoft Windows operating system.

It has been discovered that some versions of Tellurian TftpdNT may be
prone to a buffer overrun vulnerability. The problem is believed to occur
due to insufficient bounds checking when handling user-supplied filenames.
As a result, handling a filename of excessive length may result in
unexpected data being written to memory adjacent to the filename buffer.

This could potentially corrupt sensitive stack variables such as function
pointers, saved frame pointers, or return addresses. As a result, an
attacker may be capable of seizing control of a target TftpdNT server by
passing it a specially formatted filename. This could ultimately result in
the execution of arbitrary code, with the privileges of TftpdNT.

This vulnerability is said to affect Tullerian TftpdNT 2.0 and earlier.

30. eNdonesia Mod Parameter Cross-Site Scripting Vulnerability
BugTraq ID: 8506
Remote: Yes
Date Published: Aug 27 2003
Relevant URL: http://www.securityfocus.com/bid/8506
Summary:
eNdonesia is a PHP based web content management system.

eNdonesia has reported to be prone to a cross-site scripting
vulnerability.  The problem exists in the mod.php script, and may be
exploited via the 'mod' URI parameter.  HTML and script code supplied via
this parameter will not be filtered before being displayed, therefore an
attacker may be able to execute hostile HTML and script code in the
browsers of target users who follow a malicious link.  This would occur in
the security context of the site running eNdonesia.

The vulnerability allows a victim to be prone to theft of cookie-based
credentials. Other attacks can be possible as well.

This problem is reported to exist in eNdonesia version 8.2, however other
versions may be affected as well.

31. eNdonesia Mod Parameter Path Disclosure Vulnerability
BugTraq ID: 8507
Remote: Yes
Date Published: Aug 27 2003
Relevant URL: http://www.securityfocus.com/bid/8507
Summary:
eNdonesia is a PHP based web content management system.

It has been reported that a path disclosure issue exists in the software
leading to the disclosure of the installation path.  The software may
report the installation path in an error page in response to a invalid
user request.  The issue is reported to exist in the 'mod' parameter.  An
attacker may gain access to the installation path information by supplying
the "'" argument to the vulnerable mod parameter.

Successful exploitation of this attack may allow an attacker to gain
sensitive information about the file system that may aid in launching more
direct attacks against the system.

eNdonesia version 8.2 has been reported to be prone to this issue, however
it is possible that other versions are affected as well.

32. BEA WebLogic Integration Undisclosed File System Access Vuln...
BugTraq ID: 8508
Remote: Yes
Date Published: Aug 27 2003
Relevant URL: http://www.securityfocus.com/bid/8508
Summary:
BEA WebLogic Integration is a suite of software, including a J2EE
application server and an API, that provides functionality to integrate
systems within an enterprise.

BEA WebLogic Integration has been reported prone to an undisclosed file
system access vulnerability. The issue reportedly presents itself under
certain specific conditions and may provide for remote access to the
affected systems filesystem via a web browser.

Although unconfirmed it has been conjectured that this issue may be
exploited using a web browser to access the filesystem of a vulnerable
remote host, potentially disclosing sensitive data.

This BID will be updated as further details regarding this vulnerability
are disclosed.

This vulnerability has been reported to affect BEA WebLogic Integration -
Business Connect 8.1.

33. BProc Local Arbitrary File Deletion Vulnerability
BugTraq ID: 8509
Remote: No
Date Published: Aug 28 2003
Relevant URL: http://www.securityfocus.com/bid/8509
Summary:
BProc (Beowulf Distributed Process Space) is a set of kernel
modifications, utilities and library files that are designed to facilitate
the invocation and handling of processes on remote systems. BProc is
designed for use with the Linux kernel.

Bproc is prone to a vulnerability that could allow malicious local users
to delete arbitrary system files. The problem is said to be due to
incorrect permission checking when handling I/O redirection. As a result,
an attacker may be capable of gaining limited access to arbitrary system
files with elevated privileges. This issue could be exploited by an
attacker to delete arbitrary system files, potentially rendering the
system unusable.

The problem is believed to occur due to BProc failing to sufficiently
setup I/O prior to the execution of setuid programs from within another
program. This may make it possible for an attacker to access descriptors
used by the privileged program. This could possibly be accomplished by
creating a process under which file descriptors are shared with the
parent, and subsequently having the child invoke a setuid application.
This however, has not been confirmed.

It should be noted that the precise technical details regarding this issue
are currently unknown. As further information becomes available this BID
will be updated accordingly.

This vulnerability was reported for 3.2.5 however, earlier versions may
also be affected.

34. ISC INN Innfeed Config File Command Line Format String Vulne...
BugTraq ID: 8510
Remote: Yes
Date Published: Aug 28 2003
Relevant URL: http://www.securityfocus.com/bid/8510
Summary:
ISC INN (InterNetNews) is an NNTP implementation for Unix/Linux variants.

A format string vulnerability has been reported in ISC INN (InterNetNews).
The issue exists in the innfeed binary and may be triggered by including
format specifiers as an argument when specifying a config file via the -c
command line switch.  The innfeed program is a streaming NNTP feeder.

The source of the problem is that the program does not include format
specifiers when using logging functions, which will enable an attacker to
supply their own format specifiers.  This could be leveraged to overwrite
arbitrary locations in memory with attacker-supplied data, which will
allow for an attacker to control the execution flow of the program.

This vulnerability could be exploited by a user with a group ID of news to
execute arbitrary code in the context of the program, which may allow an
attacker to gain the user ID of news on some systems.  Further privilege
escalation may be possible if this issue is successfully exploited.

35. WorldFlash News Ticker Remote Buffer Overrun Vulnerability
BugTraq ID: 8511
Remote: Yes
Date Published: Aug 28 2003
Relevant URL: http://www.securityfocus.com/bid/8511
Summary:
World Flash News Ticker is a program designed to collect various news
events and display them to the user. It can be customized to access
specific links, etc. It is available for the Microsoft Windows operating
system.

A buffer overrun vulnerability has been alleged in WorldFlash News Ticker.
The problem is said to occur when receiving HTML data from remote sites.
This problem likely occurs due to insufficient bounds checking, and could
potentially be exploited by a remote host to trigger the execution of
arbitrary code. It should be noted that the remote host would likely have
to be on a list of links that the affected product references for news
items.

This vulnerability is said to affect WorldFlash News Ticker Gold M5.30i,
however, other versions may also be affected.

36. LinuxNode Remote Buffer Overflow Vulnerability
BugTraq ID: 8512
Remote: Yes
Date Published: Aug 29 2003
Relevant URL: http://www.securityfocus.com/bid/8512
Summary:
LinuxNode is an amateur packet radio node program.

It has been reported that LinuxNode is prone to a remote buffer overflow
condition.  The issue presents itself due to insufficient bounds checking.
A remote attacker may ultimately exploit this issue remotely and execute
arbitrary code in the context of the user who is running the vulnerable
software.  Successful exploitation may allow a attacker to gain
unauthorized access to the vulnerable host.

Explicit technical details regarding this vulnerability are not currently
available. This BID will be updated, as further details regarding this
issue are made public.

Although LinuxNode 0.3.0 has been reported to be vulnerable to this
problem, other versions may be affected as well.


III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Hacking-by-subpoena ruled illegal
By: Kevin Poulsen

A lawyer who subpoenaed every piece of e-mail a courtroom adversary sent
or received can be sued for unauthorized computer access under federal
anti-hacking laws.
http://www.securityfocus.com/news/6837

2. U.S. Sponsors Anti-Censorship Web Service
By: Kevin Poulsen

A federal agency contracts with Anonymizer to help Iranians bypass their
government's Internet blacklist.
http://www.securityfocus.com/news/6807

3. Slammer worm crashed Ohio nuke plant network
By: Kevin Poulsen

A computerized safety monitoring system at the Davis-Besse nuclear plant
was crippled after the worm entered through the business network of the
plant's operator,  FirstEnergy Corp.

http://www.securityfocus.com/news/6767

4. FBI Says Teen Put Worm on Internet
By: Ben White and Charles Duhigg, Washington Post

http://www.securityfocus.com/news/6851

5. Digital Sandbox Recognizes Risks to Government Agencies
By: Ellen McCarthy, Washington Post

http://www.securityfocus.com/news/6850

6. Doh! Man steals GPS tracking device
By: John Leyden, The Register

http://www.securityfocus.com/news/6849


IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. cryptoswap v0.0.3
By: W. Michael Petullo
Relevant URL: http://www.flyn.org/projects/cryptoswap/index.html
Platforms: Linux
Summary:

The cryptoswap package supports creating an encrypted swap partition when
a system boots. This may be necessary on systems that use encrypted
filesystems because plaintext secrets may be written to disk when memory
is swapped to disk. The project also includes the ability to build a Linux
initrd that supports booting with an encrypted root filesystem.

2. Email v2.1
By: Geekoid <[email protected]>
Relevant URL: http://email.cleancode.org
Platforms: FreeBSD, Linux, NetBSD, OpenBSD, POSIX, Solaris, SunOS
Summary:

Email sends email to remote SMTP servers via the command line, which makes
it useful in cron jobs. It will send to any RFC standard remote ESMTP
server, and will allow you to encrypt, sign, and design your message on
the fly. It has the capability to use signature files with dynamic
options, address book functionality, and users can also attach pictures,
binary files, documents, or whatever they want. It is completely
compatible with GNUPG for encryption and signing, and is easy to configure
and use.

3. floppyfw v2.0.7
By: Thomas Lundquist, [email protected]
Relevant URL: http://www.zelow.no/floppyfw/
Platforms: Linux
Summary:

floppyfw is a router and simple firewall on one single floppy. It uses
Linux basic firewall capabilities and have a very simple packaging system.
It is perfect for masquerading and securing networks on ADSL and cable
lines using both static IP and DHCP. It has a simple installation, mostly
only needed to edit one file on the floppy.

4. PAM SMB v1.1.7
By: Dave Airlie
Relevant URL: http://www.csn.ul.ie/~airlied/pam_smb/
Platforms: Linux
Summary:

pam_smb is a module which allows Linux users to be authenticated from
Samba, NT or Windows 95/8 machines.

5. pam_dotfile v0.7
By: Mezcalero
Relevant URL:
http://www.stud.uni-hamburg.de/users/lennart/projects/pam_dotfile/
Platforms: Linux, UNIX
Summary:

pam_dotfile is a PAM module which allows users to have more than one
password for a single account, each for a different service. This is
desirable because many users have objections to using the same password
for (as an example) an IMAP4 mailbox and SSH access.

6. Openwall Linux kernel patch v2.4.22-ow1
By: Solar Designer <[email protected]>
Relevant URL: http://www.openwall.com/linux/
Platforms: Linux
Summary:

The Openwall Linux kernel patch is a collection of security "hardening"
features for the Linux kernel. In addition to the new features, some
versions of the patch contain various security fixes. The "hardening"
features of the patch, while not a complete method of protection, provide
an extra layer of security against the easier ways to exploit certain
classes of vulnerabilities and/or reduce the impact of those
vulnerabilities. The patch can also add a little bit more privacy to the
system by restricting access to parts of /proc so that users may not see
what others are doing.


V. SECURITYJOBS LIST SUMMARY
----------------------------
1. SQA Engineer (Contract) - Symantec - Redwood City, C... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335694

2. Risk Assessment Professional - DOE - Chicago, IL (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335693

3. Urgent - CISSP, ISO 17799, Identity Access Mgmt Posi... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335692

4. Seeking security job (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335691

5. D.C. Based Cybersecurity Solution Sales (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335690

6. Senior Security Software Developer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335688

7. SQA Engineer - Symantec - Redwood City, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335686

8. Lab Program Manager - Symantec - Redwood City, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335681

9. Senior Product Manager, MetaFrame Password - Ft. Lau... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335680

10. Repost:  Senior Security Software Engineer Position ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335679

11. Provisioning System Admin position in NY (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335418

12. Network Security System Admin position in NY (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335417

13. Provisioning Architect position in NY (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335416

14. MQSeries / Tivoli Architect position in New York! (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335415

15. DALLAS - Unix - Linux - Perl Scripting - Pre-Sales- ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335414

16. Director of Product Management (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335413

17. INFOSEC with Top Secret Clearance - DC Metro area (M... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335412

18. Sr Security Professional looking for Northern VA 109... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335411

19. Security Expert (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335410

20. Seeking Security Specialist Position (VA/DC) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335296

21. Seeking Security Specialist Position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335295

22. Incident Analyst - Calgary, AB Canada (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335260

23. C++ Windows Systems Security Software Engineer need ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335255

24. Asst Audit Director - Internal Audit & Risk Assessme... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335254

25. Security Engineers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335228

26. Security Engineer-IDS (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335226

27. Kansas City Kansas Tech Architect-Security PKI Speci... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335224

28. Recently relocated to DE/PA/NJ area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335221

29. Information Security Practice Manager - New York, NY... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335134

30. TS-cleared Security Engineers needed -- Washington D... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335096

31. Security Pre Sales Engineer need in Long Island, NY (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335065

32. Security Pre Sales Engineer need in Herndon (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335064

33. Security Professional looking for work in NYC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335063

34. SOC Manager- Des Moines IA, $90-$110K (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/335062


VI. INCIDENTS LIST SUMMARY
--------------------------
1. compromised Real Server 8 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335654

2. Port 554 - Quicktime scans, what's up (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335545

3. Outgoing connections to ports 22226 and 22227 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335502

4. Buffer Overflow in Windows Alpha systems (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335498

5. Can anyone identify this possible backdoor? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335280

6. Increasing ICMP Echo Requests (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335237

7. towards a taxonomy of Information Assurance (IA) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335143

8. lots of sobig virus emails. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335142

9. Odd worm traffic? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335132

10. strange HTTP requests (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335130

11. Outgoing connections to Port 22226 and 22227 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335128

12. strange web traffic (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/335005

13. ICMP port 2048 scans (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/334970


VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Oracle xdb ftp service? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/335634

2. Defeating non-executable stacks ... trying to, actua... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/335633

3. Off By One on Red Hat Linux again (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/335588

4. Off by one on RedHat Linux (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/335587

5. Mail relay issue (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/335586

6. Oracle Patch Testing (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/335509

7. gtkftpd[v1.0.4(and below)]: remote root buffer overf... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/335217

8. MS Exchange 'Recall' feature - Possible to delete ma... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/335042

9. Overwriting the .dtors section with gcc 3 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/335040


VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. [email protected] (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/335653

2. Administrivia: lost messages sent since Wednesday (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/335344

3. Patch testing (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/335245

4. SecurityFocus Microsoft Newsletter # 151 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/334869


IX. SUN FOCUS LIST SUMMARY
--------------------------
NO NEW POSTS FOR THE WEEK 2003-08-26 to 2003-09-02.


X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2003-08-26 to 2003-09-02.


XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: SPI Dynamics

NEW ALERT:
"How a Hacker Launches a LDAP Injection Attack Step-by-Step". It's as
simple as placing additional LDAP query commands into a Web form input box
giving hackers complete access to all your backend systems! Firewalls and
IDS will not stop such attacks because LDAP Injections are seen as valid
data. Download this *FREE* white paper from SPI Dynamics for a complete
guide to protection!

http://www.securityfocus.com/sponsor/SPIDynamics_sf-news_030902
------------------------------------------------------------------------