SecurityFocus Newsletter #213
John Boletta <[email protected]> Mon, 8 Sep 2003 12:18:02 -0600 (MDT)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #213
------------------------------
This Issue is Sponsored by: Captus Networks
Precisely Define and Implement Network Security and Performance Policies
Integrated Intrusion Prevention and Traffic Shaping to:
- Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
- Automatically Control P2P, IM and Spam Traffic
- Ensure Reliable Performance of Mission Critical Applications
**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo
http://www.securityfocus.com/sponsor/CaptusNetworks_sf-news_030811
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Intrusion Detection Terminology (Part One)
II. BUGTRAQ SUMMARY
1. LinuxNode Remote Buffer Overflow Vulnerability
2. File Sharing for Net Directory Traversal File Disclosure Vul...
3. XFree86 Multiple Unspecified Integer Overflow Vulnerabilitie...
4. SAP Internet Transaction Server Information Disclosure Vulne...
5. SAP Internet Transaction Server Directory Traversal File Dis...
6. SAP Internet Transaction Server Cross Site Scripting Vulnera...
7. Exim EHLO/HELO Remote Heap Corruption Vulnerability
8. Ezboard 'invitefriends.php3' Cross Site Scripting Vulnerabil...
9. TSguestbook Message Field HTML Injection Vulnerability
10. Sitebuilder 'sitebuilder.cgi' Directory Traversal File Discl...
11. Multiple Vendor PC2Phone Software Remote Denial of Service V...
12. ZoneAlarm Random UDP Flood Denial Of Service Vulnerability
13. Wrapsody View Copy And Paste Restriction Bypassing Vulnerabi...
14. FloosieTek FTGatePro Mail Server Path Disclosure Vulnerabili...
15. FloosieTek FTGatePro Mail Server Cross-Site Scripting Vulner...
16. FloosieTek FTGatePro Mail Server User Enumeration Weakness
17. Microsoft mshtml.dll Library GIF Image Handling Denial of Se...
18. Microsoft Windows XP TCP Packet Information Leakage Weakness
19. Microsoft Windows NetBIOS Name Service Reply Information Lea...
20. Microsoft Word Macro Execution Security Model Bypass Vulnera...
21. Microsoft Visual Basic For Applications Document Handling Bu...
22. PADL Software PAM_LDAP PAM Filter Access Restriction Failure...
23. Microsoft Access Snapshot Viewer ActiveX Control Parameter B...
24. Stunnel Leaked File Descriptor Vulnerability
25. Microsoft WordPerfect Converter Buffer Overrun Vulnerability
26. WebCalendar Multiple Cross-Site Scripting Vulnerabilities
27. WebCalendar Multiple Module SQL Injection Vulnerabilities
28. Leafnode fetchnews Remote Denial of Service Vulnerability
29. Ipswitch WS_FTP Server FTP Command Buffer Overrun Vulnerabil...
30. Microsoft Windows 98 Fragmented UDP Flood Denial Of Service ...
31. Multiple Blackberry Enterprise Server Vulnerabilities
32. EZ-WEB Site Builder Advanced Editor Selectedpage Parameter D...
33. Asterisk SIP Request Buffer Overrun Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Adrian Lamo charged with computer crimes
2. U.S. warns nuke plants of worm threat
3. Racketeering suit filed against DirecTV
4. Recording industry sues hundreds of individual music swapper...
5. Universities Rush to Protect Networks
6. Blaster-F suspect arrested in Romania
IV. SECURITYFOCUS TOP 6 TOOLS
1. Sussen v0.6
2. The OpenAntivirus Project: Summary Various
3. Devil-Linux v0.5
4. BO2K v1.1.1
5. Clam Antivirus v0.60
6. slidentd v1.0.0
V. SECURITYJOBS LIST SUMMARY
1. Slightly Off- Topic: Cyber Security Insurance (Thread)
2. Looking for INFOSEC position in Denver Area (Thread)
3. List lag, subject lines etc. (Thread)
4. Seeking a Security Position in MD. (Thread)
5. Security Software Engineer - Kansas City, MO (Thread)
6. Sr. Network Security Engineer (Thread)
7. Infosec Job Opportunities in Saudi Arabia (Thread)
8. Security Data Architect (Thread)
9. Security Administrator - Boston, MA $70K-$85K (Thread)
10. InfoSec. Representative - Boston, MA $70K-$85K (Thread)
11. Software Tools Diva - Network Penetration / Intrusio... (Thread)
12. Wireless Security S/W Engineer (Thread)
13. Information Security Analyst - Washington DC (Thread)
14. Top Gun Intrusion Detection Tools Developer (High Ba... (Thread)
15. Information Security Engineer needs in Barcelona - S... (Thread)
16. Kansas City - Application Security Developer (Thread)
17. Sr. Software Engineer - Symantec - Redwood City, CA (Thread)
18. SQA Manager - Symantec - Redwood City, CA (Thread)
19. Forensic Security Guru in Liberty Corner, NJ (Thread)
20. Sr. Program Manager - Symantec - Santa Monica, CA (Thread)
21. Ethical Hacker with Top Secret Clearance (Thread)
22. offering penetration testing service/outsourcing (Thread)
23. JOB-US-NY-NYC: Policy Manager (Thread)
24. Immediate Postions Available: Malcode Analysts at I... (Thread)
25. Sales Engineer (New York City) (Thread)
26. UNIX Systems-level Develop (Maryland suburbs) ACTIVE... (Thread)
27. Top Gun Systems Hacker - DC area Location (ACTIVE To... (Thread)
28. Security Project Manager - Cleveland, Ohio (Contract... (Thread)
29. Sr. Security Professional Avail in Europe/Middle Eas... (Thread)
30. Security Business Development Opportunity (Thread)
31. List international focus? (Thread)
32. Seeking security job (Thread)
VI. INCIDENTS LIST SUMMARY
1. Spam-Object Exploit (Thread)
2. Backdoor.coreflood infection (Thread)
3. increase in 19725 probes (Thread)
4. Infected Subscriber (Thread)
5. New DDOS? (Thread)
6. compromised Real Server 8 (Thread)
7. [tool] the new p0f 2.0.1 is now out (Thread)
8. A Canada based wardialer/hacker: +16045507000 (Thread)
9. freebsd 0-day exploit Real-/Helixserver 9.0.2.794 (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. InlineEgg library release (Thread)
2. Mail relay issue (Thread)
3. exim remote heap overflow, probably not exploitable (Thread)
4. Defeating non-executable stacks ... trying to, actua... (Thread)
5. certain versions of Windows XP leaking memory in TCP... (Thread)
6. Oracle xdb ftp service? (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Domain vs. Local security policy (Thread)
2. windows 2000 security logs (Thread)
3. Local Admins (Thread)
4. MS03-008 and SP4 (Thread)
5. [email protected] (Thread)
6. windows update (Thread)
7. Security Configuration guides provided by the Navy. (Thread)
8. cached passwords (was [email protected]) (Thread)
IX. SUN FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2003-09-01 to 2003-09-08.
X. LINUX FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2003-09-01 to 2003-09-08.
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Intrusion Detection Terminology (Part One)
By Andy Cuff
This is the first of a two-part series that discusses IDS terminology,
including terms where there may be disagreement from within the security
community.
http://www.securityfocus.com/infocus/1728
II. BUGTRAQ SUMMARY
-------------------
1. LinuxNode Remote Buffer Overflow Vulnerability
BugTraq ID: 8512
Remote: Yes
Date Published: Aug 29 2003
Relevant URL: http://www.securityfocus.com/bid/8512
Summary:
LinuxNode is an amateur packet radio node program.
It has been reported that LinuxNode is prone to a remote buffer overflow
condition. The issue presents itself due to insufficient bounds checking.
A remote attacker may ultimately exploit this issue remotely and execute
arbitrary code in the context of the user who is running the vulnerable
software. Successful exploitation may allow a attacker to gain
unauthorized access to the vulnerable host.
Explicit technical details regarding this vulnerability are not currently
available. This BID will be updated, as further details regarding this
issue are made public.
Although LinuxNode 0.3.0 has been reported to be vulnerable to this
problem, other versions may be affected as well.
2. File Sharing for Net Directory Traversal File Disclosure Vul...
BugTraq ID: 8513
Remote: Yes
Date Published: Aug 30 2003
Relevant URL: http://www.securityfocus.com/bid/8513
Summary:
File Sharing for Net is a web server program designed to share documents
and files over the Web. It is available for the Microsoft Windows
operating system.
File Sharing for Net is said to be prone to a directory traversal
vulnerability, potentially allowing users to disclose the contents of
system files. The problem occurs due to the application failing to parse
user-supplied input for directory traversal sequences (../), thus making
it possible to access files outside of the established web root.
This could potentially allow an attacker to obtain information that could
be used in launching further attacks, such as passwords or sensitive user
information.
This vulnerability is said to affect File Sharing for Net 1.5.
3. XFree86 Multiple Unspecified Integer Overflow Vulnerabilitie...
BugTraq ID: 8514
Remote: Yes
Date Published: Aug 30 2003
Relevant URL: http://www.securityfocus.com/bid/8514
Summary:
Multiple integer overflow vulnerabilities have been discovered in XFree86
4.3.0. The problem specifically occurs due to insufficient sanity checks
within font libraries. As a result, a malicious font server that transmits
font data to a target client may include a malformed integer value
designed to unexpectedly pass a bounds checking calculation and trigger a
buffer overrun. This could cause memory corruption within stack or heap
process space, ultimately allowing for the execution of arbitrary code
with the privileges of the client program.
It should be noted that under some non-default XFree86 configurations, it
has been reported that the Xserver and XFS daemons may act as a client to
the font server, making it possible for these services to be exploited
remotely.
Although unconfirmed, these integer overflow vulnerabilities may be
present in earlier versions of XFree86.
Precise technical details regarding these vulnerabilities are currently
unavailable, however as further information is released this BID will be
updated accordingly.
4. SAP Internet Transaction Server Information Disclosure Vulne...
BugTraq ID: 8515
Remote: Yes
Date Published: Aug 30 2003
Relevant URL: http://www.securityfocus.com/bid/8515
Summary:
A vulnerability has been discovered in the 'wgate.dll' component of SAP
Internet Transaction Server. Specifically, the server may disclose
sensitive information when sending an error page in response to a
malformed request. This issue can be triggered by sending invalid values
to one of the following request parameters:
~service
~templatelanguage
~language
~theme
~template
Processing the request will effectively trigger an error, causing the
service to respond with an error. This response may contain sensitive
local filesystem information, or other system details, that could be used
by an attacker when launching future attacks.
5. SAP Internet Transaction Server Directory Traversal File Dis...
BugTraq ID: 8516
Remote: Yes
Date Published: Aug 30 2003
Relevant URL: http://www.securityfocus.com/bid/8516
Summary:
SAP is said to be prone to a directory traversal vulnerability,
potentially allowing users to disclose the contents of sensitive files.
The problem occurs due to the application failing to parse user-supplied
input for directory traversal sequences (../) and can be exploited due to
correct bounds checking verification. As a result of these two issues used
in conjunction it is possible to bypass the appending of the '.html'
extension to requested files.
Specifically, by making a directory traversal request and including the
filename of the target document, it is possible to prevent the .html
extension from being appended to the name. This can be accomplished by
supplying excessive space characters after the document name, sufficient
enough to fill the buffer close to it's max. This will prevent the program
from being able to append the extension due to bounds checking
verification.
As a result, it may be possible to access sensitive files residing outside
of the requested location, such as the Internet Transaction Server
configuration file.
6. SAP Internet Transaction Server Cross Site Scripting Vulnera...
BugTraq ID: 8517
Remote: Yes
Date Published: Aug 30 2003
Relevant URL: http://www.securityfocus.com/bid/8517
Summary:
The 'wgate.dll' component of SAP Internet Transaction Server has been
reported prone to cross-site scripting attacks. The issue occurs due to a
lack of sufficient sanitization performed on data supplied to the
'wgate.dll' library. Specifically, the '~service' parameter is not
sufficiently parsed for embedded script code.
This issue could be exploited to cause hostile HTML and script code to be
rendered in the browser of a user who is enticed to visit a malicious link
to the vulnerable script. The code would be interpreted in the context of
the vulnerable site. Exploitation could allow theft of cookie-based
authentication credentials or other attacks.
7. Exim EHLO/HELO Remote Heap Corruption Vulnerability
BugTraq ID: 8518
Remote: Yes
Date Published: Sep 01 2003
Relevant URL: http://www.securityfocus.com/bid/8518
Summary:
Exim is a message transfer agent (MTA) developed at the University of
Cambridge and available under the GNU Public License. It is available for
the Linux operating system.
A heap buffer overflow vulnerability has been discovered in Exim. The
problem is said to affect all Exim3 and Exim4 versions prior to Exim 4.21.
I
This issue occurs due to insufficient bounds checking performed when
handling user-supplied SMTP EHLO/HELO command data. The vulnerability
specifically occurs within the 'smtp_in.c' source file when handling
invalid EHLO/HELO arguments. If EHLO/HELO arguments contain 506 leading
spaces followed by a NUL byte and a CRLF, a static string intended for a
syntax error message will be appended to the command argument data. The
interpolated string will now exceed the size of the reserved buffer in
heap-based memory. The entire string will be copied, without the spaces
being stripped, into the affected command buffer, this will result in heap
memory management structures adjacent to the affected buffer being
corrupted with superfluous data.
It has been reported that this vulnerability is unlikely to be exploitable
to execute arbitrary code. This is because a free() call is never made on
the attacker-controlled malloc chunk. Exploitation attempts will also be
hindered because the uncontrollable static string 'o argument given)\0' is
appended to attacker-supplied data, and will complicate the valid
corruption of the adjacent malloc header.
8. Ezboard 'invitefriends.php3' Cross Site Scripting Vulnerabil...
BugTraq ID: 8519
Remote: Yes
Date Published: Sep 01 2003
Relevant URL: http://www.securityfocus.com/bid/8519
Summary:
The 'invitefriends.php3' script of Ezboard has been reported prone to
cross-site scripting attacks. The issue occurs due to a lack of sufficient
sanitization performed on user-supplied URI parameters. Specifically, the
'action' parameter is not sufficiently parsed for embedded script code.
This issue could be exploited to cause hostile HTML and script code to be
rendered in the browser of a user who is enticed to visit a malicious link
to the vulnerable script. The code would be interpreted in the context of
the vulnerable site. Exploitation could allow theft of cookie-based
authentication credentials or other attacks.
It should be noted that it is currently unknown which versions of Ezboard
are affected by this vulnerability. This bid will be updated as further
information is made available.
9. TSguestbook Message Field HTML Injection Vulnerability
BugTraq ID: 8520
Remote: Yes
Date Published: Sep 01 2003
Relevant URL: http://www.securityfocus.com/bid/8520
Summary:
TSguestbook is an object-oriented guestbook program implemented in the PHP
programming language.
It has been reported that TSguestbook may be prone to HTML injection
attacks. The problem is said to occur due to insufficient sanization of
user-supplied input within the 'message' field. As a result, an attacker
may post a guestbook entry including malicious HTML or script code within
the said field. When the entry is later viewed by unsuspecting users, the
injected code will be interpreted within the browser of the user.
This could ultimately result in the theft of sensitive information, such
as cookie-based authentication credentials, or other attacks.
This vulnerability is said to affect TSguestbook 2.1 and possibly earlier.
10. Sitebuilder 'sitebuilder.cgi' Directory Traversal File Discl...
BugTraq ID: 8521
Remote: Yes
Date Published: Sep 01 2003
Relevant URL: http://www.securityfocus.com/bid/8521
Summary:
Sitebuilder is said to be prone to a directory traversal vulnerability,
potentially allowing users to disclose the contents of system files. The
problem occurs due to the application failing to parse user-supplied input
for directory traversal sequences (../) supplied to the 'sitebuilder.cgi'
script, thus making it possible to access files outside of the established
web root.
This could potentially allow an attacker to obtain information that could
be used in launching further attacks, such as passwords or sensitive user
information.
This vulnerability is said to affect Sitebuilder 1.4.
11. Multiple Vendor PC2Phone Software Remote Denial of Service V...
BugTraq ID: 8523
Remote: Yes
Date Published: Sep 01 2003
Relevant URL: http://www.securityfocus.com/bid/8523
Summary:
It has been reported that multiple PC2Phone products are prone to a remote
denial of service condition. The problem is said to occur when processing
excessive data passed to the programs via a UDP packet and could result in
the product crashing. This could result in an established conversation
prematurely ending, or potentially other attacks.
This vulnerability has been triggered by transmitting the UDP packet to
port 5000 on Go2Call Cash Calling, as well as Net2Phone Dialer. However,
to trigger the issue Yahoo! Messenger the packet must be sent via UDP port
6801.
It should be noted that reports indicate that the problem may in fact lie
within the Go2Call Cash Calling program, and other products derived from
its source code are also affected. However, this information has not yet
been confirmed.
The precise technical details regarding this issue are currently unknown,
however as further information is made available this bid will be updated
accordingly.
12. ZoneAlarm Random UDP Flood Denial Of Service Vulnerability
BugTraq ID: 8525
Remote: Yes
Date Published: Sep 02 2003
Relevant URL: http://www.securityfocus.com/bid/8525
Summary:
ZoneAlarm is a firewall software package available for the Microsoft
Windows operating system. It is distributed and maintained by Zone Labs.
A denial of service vulnerability has been alleged in ZoneAlarm. It is
reportedly possible to reproduce this condition by sending a flood of UDP
packets to random ports (0-65000) on a system hosting the vulnerable
software. This issue reportedly presents itself because ZoneAlarm takes
longer to handle some packets than others.
It has been reported that this type of attack has the potential to cause
vsmon to consume system resources, causing the remote affected system to
behave in an unstable manner and suffer from performance degradation
issues. Additionally it has been reported that outgoing UDP based
services, for example ICQ client, may be denied. It has been reported that
the UDP flood may have to be in the region of 900Kb of UDP based data a
second to trigger this issue.
13. Wrapsody View Copy And Paste Restriction Bypassing Vulnerabi...
BugTraq ID: 8526
Remote: No
Date Published: Sep 02 2003
Relevant URL: http://www.securityfocus.com/bid/8526
Summary:
Wrapsody is a file and e-mail content security application distributed and
maintained by Fasoo.com. It is available for the Microsoft Windows
platform.
A problem has been discovered in the default workflow deployed with the
Wrapsody viewer. Because of this, an attacker may be able to perform
unauthorized actions on a vulnerable system.
The problem is in the implementation the workflow used by Wrapsody. By
loading a specific workflow, an attacker may be able to circumvent
restrictions placed on content, performing copy and paste actions.
14. FloosieTek FTGatePro Mail Server Path Disclosure Vulnerabili...
BugTraq ID: 8527
Remote: Yes
Date Published: Sep 02 2003
Relevant URL: http://www.securityfocus.com/bid/8527
Summary:
FloosieTek FTGatePro Mail Server is a mail server implementation for
Microsoft Windows operating systems.
FloosieTek FTGatePro Mail Server may disclose its installation path to
remote attackers. The issue reportedly occurs when
'/utility/wmsecurity.fts' is requested by a remote user. This information
could be useful in aiding the attacker to enumerate the layout of the file
system on the host, which could result in further attacks against the
host.
This issue exists in the web administrative interface, which listens on
port 8089 by default.
15. FloosieTek FTGatePro Mail Server Cross-Site Scripting Vulner...
BugTraq ID: 8528
Remote: Yes
Date Published: Sep 02 2003
Relevant URL: http://www.securityfocus.com/bid/8528
Summary:
FloosieTek FTGatePro Mail Server is a mail server implementation for
Microsoft Windows operating systems.
FloosieTek FTGatePro Mail Server is prone to a cross-site scripting
vulnerability. The source of this vulnerability is that HTML and script
code supplied via URI parameters is not sufficiently filtered before being
echoed back in web pages. In particular, it is possible to inject HTML
and script code into the 'href' parameter of '/help/index.fts'.
A remote attacker could exploit this issue by enticing a legitimate user
of the mail server to follow a malicious link with embedded HTML and
script code. The attacker-supplied code would potentially be rendered in
the user's browser when the link is followed.
This issue could potentially be exploited to steal cookie-based
authentication credentials from a legitimate user. Other attacks are also
possible.
This issue exists in the web administrative interface, which listens on
port 8089 by default.
16. FloosieTek FTGatePro Mail Server User Enumeration Weakness
BugTraq ID: 8529
Remote: Yes
Date Published: Sep 02 2003
Relevant URL: http://www.securityfocus.com/bid/8529
Summary:
FloosieTek FTGatePro Mail Server leaks information that may allow remote
attackers to enumerate mail server users. The software is reported to
return different responses based on whether or not a username is valid
during authentication.
For example, the following response occurs when a username is not valid:
user InValid
-ERR InValid doesn't get mail here <==
On the other hand, the server returns the following when a username is
valid:
user user1
+OK user1 gets mail here <==
This information is useful if an attacker is attempting to brute-force
mail server user accounts, as it is possible to determine which users are
valid.
17. Microsoft mshtml.dll Library GIF Image Handling Denial of Se...
BugTraq ID: 8530
Remote: Yes
Date Published: Sep 02 2003
Relevant URL: http://www.securityfocus.com/bid/8530
Summary:
An unidentified denial of service vulnerability has been discovered in the
Microsoft mshtml.dll library. The problem is believed to occur when
handling malformed GIF images, possibly with invalid header information.
Although unconfirmed, the image may be required to be 1x1 pixels to
trigger this condition. Furthermore, for the denial of service to be
triggered it is believed that the image must not be located in temporary
internet files.
The denial of service may be triggered when an application linked to the
library attempts to interpret an HTML document containing the malformed
image, such as Internet Explorer or Microsoft Outlook.
It has been conjectured that the crash occurs due to the library
attempting to dereference invalid memory, due to malformed data within the
image file. However, this information has not been confirmed.
The precise technical details of this issue are currently unknown, however
this BID will be updated as further information is made available.
18. Microsoft Windows XP TCP Packet Information Leakage Weakness
BugTraq ID: 8531
Remote: Yes
Date Published: Sep 02 2003
Relevant URL: http://www.securityfocus.com/bid/8531
Summary:
A weakness has been discovered in Microsoft Windows XP. The problem occurs
due to Windows XP failing to sufficiently initialize specific locations in
memory, prior to using their values within TCP packets.
As a result of this issue, an attacker may be capable of viewing the
contents of previously used system memory. This can be accomplished by
intercepting SYN packets transmitted by an affected Microsoft Windows XP
host, and observing the contents of the unused URG flag. This flag value
may contain 16 bits of previously used system memory. By intercepting a
sequence of these packets, it is theoretically possible for an attacker to
obtain sensitive information previously contained with in memory, such as
a password. It should be noted that memory disclosed via this weakness
will be random and will not be sensitive under most circumstances.
The precise technical details regarding this weakness are currently
unknown. However, this BID will be updated as more information is made
available.
19. Microsoft Windows NetBIOS Name Service Reply Information Lea...
BugTraq ID: 8532
Remote: Yes
Date Published: Sep 03 2003
Relevant URL: http://www.securityfocus.com/bid/8532
Summary:
A weakness has been reported in NetBIOS on Microsoft Windows operating
systems that may enable remote attackers to gain access to potentially
sensitive information. In particular, the NetBIOS Name Service may leak
random memory contents when replying to NetBT Name Service requests.
The source of this issue is a flaw in how NetBT pads datagrams. A larger
buffer is allocated than is needed when NetBIOS is generating a Name
Service reply and this buffer is not adequately initialized before the
reply is generated. As a result, the reply may contain random fragments
of system memory, some of which could potentially contain sensitive
information. It is reported that the amount of padding that is required
will normally be 15 bytes or less, which will cause minute amounts of
memory to be disclosed, which will be derived from a previous memory
operation. The expected behavior is for the datagram padding to be blank.
20. Microsoft Word Macro Execution Security Model Bypass Vulnera...
BugTraq ID: 8533
Remote: Yes
Date Published: Sep 03 2003
Relevant URL: http://www.securityfocus.com/bid/8533
Summary:
Microsoft Word is a word processing software that is part of the Microsoft
Office suite. Microsoft Word allows a user to create various types of
documents. The software also supports the use of macros in order to
automate commonly performed tasks.
Microsoft Word has been reported to be prone to a vulnerability that
allows an attacker to bypass the macro security model of the software.
The issue exists due to a failure in the software to ensure properties of
a modified document with macros. This flaw allows the macro to be
executed without prior notification to the user.
It has been reported that an attacker may exploit this issue by embedding
malicious macro instructions within a document, which is crafted in a
manner sufficient to trigger the vulnerability. When opened, the
malicious macro contained within this document would be executed despite
the macro security settings of Microsoft Word.
If successful, this attack would allow an attacker to execute arbitrary
code within the context of the user who is running the affected software.
The vulnerable system could be exploited in terms of data modifications,
backdoor programs, and reformatting of the hard drives etc. An attack may
also change the macro security setting of Microsoft Word, that could lead
to execution of macros previously blocked by the user. If the user has
administrative privileges, an attacker may completely compromise the
system.
21. Microsoft Visual Basic For Applications Document Handling Bu...
BugTraq ID: 8534
Remote: Yes
Date Published: Sep 03 2003
Relevant URL: http://www.securityfocus.com/bid/8534
Summary:
Microsoft Visual Basic for Applications (VBA) is a development platform
implemented by various applications. A buffer overrun vulnerability has
been discovered in VBA when handling malformed documents. The issue exists
in all applications that implement the use of VBA, such as Microsoft
Office products.
The vulnerability occurs due to insufficient bounds checking when the
application parses the contents of a document that supports VBA, such as a
Word, Excel, or PowerPoint file. The issue exists in the Visual Basic
Design Time Environment library and may be triggered by a malformed
document property. As a result, if the malicious document is passed to the
application, it may be possible to trigger the buffer overrun, triggering
the corruption of memory adjacent to the originally assigned memory
buffer.
Potentially, an attacker could exploit this issue to corrupt sensitive
memory variables crucial to the execution flow of the affected
application. Successful exploitation would effectively result in the
execution of arbitrary code with the privileges of the affected
application.
Internet Explorer is also reportedly an attack vector, since it may
automatically call helper applications when handling certain document
types.
This vulnerability affects Microsoft VBA 5.0 through 6.3, which ship with
a number of other Microsoft products.
22. PADL Software PAM_LDAP PAM Filter Access Restriction Failure...
BugTraq ID: 8535
Remote: Yes
Date Published: Sep 03 2003
Relevant URL: http://www.securityfocus.com/bid/8535
Summary:
PAM_LDAP is the PAM module package designed to allow authentication with
LDAP servers via PAM-compliant authentication mechanisms. It is available
for the Unix and Linux platforms.
A problem in the PAM filter portion of PAM_LDAP has been identified that
may fail to restrict access to certain systems. This may allow
unauthorized access to network resources.
The problem is in the handling of values supplied to PAM filter. When PAM
filter is used to restrict the ability of users logging in from
unauthorized hosts, PAM filter may fail to restrict access by the user.
This could result in a user gaining access to a system from an
unauthorized host. This will also create a false sense of security, as
the PAM filter has been configured to restrict access and is not
performing as expected.
23. Microsoft Access Snapshot Viewer ActiveX Control Parameter B...
BugTraq ID: 8536
Remote: Yes
Date Published: Sep 03 2003
Relevant URL: http://www.securityfocus.com/bid/8536
Summary:
Microsoft Access Snapshot Viewer, is a utility used to view a snapshot of
a Microsoft Access database on systems that do not have Microsoft Access
installed. The snapshot view is installed by default on all systems that
have Microsoft Access installed; additionally the Microsoft Access
Snapshot Viewer may be downloaded as an ActiveX control (Snapview.ocx).
Microsoft Access Snapshot Viewer has been reported prone to a remote
buffer overflow condition. The vendor has reported that the issue presents
itself, due to a lack of sufficient boundary checks performed on
user-supplied parameters.
Although unconfirmed, it has been conjectured that by passing excessive
data to the affected ActiveX control, the bounds of an insufficient
reserved buffer in memory may be overrun and adjacent memory corrupted
with attacker-supplied values. To exploit this issue, the vulnerable
control may be called with malformed parameters by a malicious web page.
It has been conjectured that an attacker may leverage this issue, to
ultimately execute arbitrary instructions in the context of the user
running the affected Internet Explorer.
It should be noted that although Microsoft Access 2002, 2000 and 97 are
reported prone to this vulnerability. Previous versions may also be
affected.
24. Stunnel Leaked File Descriptor Vulnerability
BugTraq ID: 8537
Remote: No
Date Published: Sep 03 2003
Relevant URL: http://www.securityfocus.com/bid/8537
Summary:
Stunnel is a freely available, open source cryptography wrapper. It is
designed to wrap arbitrary protocols that may or may not support
cryptography. It is maintained by the Stunnel project.
Stunnel has been reported prone to a file descriptor leakage
vulnerability. The issue reportedly presents itself due to an fcntl() call
made without a CLOEXEC flag in the source of Stunnel. It has been reported
that because of this, file descriptors returned by a listen() call are
made available to unprivileged processes.
If Stunnel is used to tunnel an application or service that provides shell
access, such as telnet, the shell will have the affected file descriptor
leaked to it. As a result, an unprivileged attacker may exploit this issue
to hijack the Stunnel Server.
Other file descriptors are also reportedly leaked, which may also be
potentially exploited in a similar manner.
It should be noted that this issue has been reported to affect Stunnel
versions 3.24, 4.00 and previous.
25. Microsoft WordPerfect Converter Buffer Overrun Vulnerability
BugTraq ID: 8538
Remote: No
Date Published: Sep 03 2003
Relevant URL: http://www.securityfocus.com/bid/8538
Summary:
Microsoft WordPerfect Converter is a component shipped with Office and a
number of other Microsoft products for handling documents in WordPerfect
formats. The WordPerfect Converter is also available separately from
Microsoft as part of the Office Converter Pack.
A buffer overrun vulnerability has been reported in the converter. The
issue is due to insufficient bounds checking of parameters in WordPerfect
documents. A particularly malformed WordPerfect document could
potentially corrupt adjacent regions of process memory with
attacker-supplied data. An attacker could leverage this condition to
control execution flow and cause the execution of malicious instructions.
This would occur in the context of the user opening the malformed
document.
26. WebCalendar Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 8539
Remote: Yes
Date Published: Sep 03 2003
Relevant URL: http://www.securityfocus.com/bid/8539
Summary:
WebCalendar is a PHP based application, used as a calendar for one or more
clients. WebCalendar can be used with MySQL, Oracle, PostgreSQL or ODBC.
Multiple cross-site scripting vulnerabilities have been reported in
various modules of WebCalendar. The vulnerabilities may allow an attacker
to execute malicious script code on a legitimate user's browser due to
unsanitized user input.
The issues have been reported to exist in the $color parameter of
includes/js/colors.php module, $user parameter of week.php module, and
$eventinfo paremeter of week.php, day.php, month.php, week_details.php,
view_l.php, view_m.php, view_t.php, view_v.php, view_w.php, and
week_details.php modules of the software.
HTML and script code may not be filtered from user supplied input before
being displayed. Therefore it may be possible to construct a malicious
link containing script code that may be executed in the browser of a user
who visits the link. This would occur in the context of the vulnerable
site.
Successful exploitation could allow for theft of cookie-based
authentication credentials from users. Other attacks are also possible.
27. WebCalendar Multiple Module SQL Injection Vulnerabilities
BugTraq ID: 8540
Remote: Yes
Date Published: Sep 03 2003
Relevant URL: http://www.securityfocus.com/bid/8540
Summary:
WebCalendar is a PHP based application, used as a calendar for one or more
clients. WebCalendar can be used with MySQL, Oracle, PostgreSQL or ODBC.
Multiple SQL injection vulnerabilities have reported in various modules of
the software. The issues may allow an attacker to inject malicious SQL
syntax into database queries. The source of these issues is insufficient
sanitization of user-supplied input before including this input in
database queries. A remote attacker may exploit this issue to influence
SQL query logic.
The vulnerabilies have been reported to exist in the view_t.php,
view_w.php, view_v.php, and login.php modules of the software.
This issue may allow an attacker to gain access to sensitive data stored
in the database. Other attacks on the underlying database are possible as
well.
28. Leafnode fetchnews Remote Denial of Service Vulnerability
BugTraq ID: 8541
Remote: Yes
Date Published: Sep 04 2003
Relevant URL: http://www.securityfocus.com/bid/8541
Summary:
Leafnode is a Usenet news proxy. It allows online news readers to read
news offline. Fetchnews is a NNTP client software used with Leafnode.
Fetchnews is reported to be prone to a remote denial of service
vulnerability that may allow a remote attacker to cause the software to
hang.
The vulnerability may occur if an attacker sends certain non-RFC-1036
compliant Usenet news articles to the server. As fetchnews attempts to
retrieve the articles it may cause the software to wait for input that
never arrives. It has been reported that only one fetchnews process is
allowed to run at a time, therefore any fetchnews processes started
afterwards would fail immediately. This issue does not exhaust CPU
resources but limits the availability of the client while the condition is
occurring.
Successful exploitation of this issue may allow an attacker to cause a
denial of service attack on a vulnerable version of the software by
posting malformed news articles. This problem would result in news bases
not being updated.
This vulnerability affects Leafnode 1.9.3 to 1.9.41. The default
installation of Leafnode is also affected by this vulnerability. The
vendor has advised that versions 1.9.42 and newer are not vulnerable to
this issue.
29. Ipswitch WS_FTP Server FTP Command Buffer Overrun Vulnerabil...
BugTraq ID: 8542
Remote: Yes
Date Published: Sep 04 2003
Relevant URL: http://www.securityfocus.com/bid/8542
Summary:
Ipswitch WS_FTP Server is an FTP implementation that is available for
Microsoft Windows operating systems.
Ipswitch WS_FTP Server is reported to be prone to buffer overruns when
handling data supplied to the APPE and STAT FTP commands. An FTP user who
supplies excessive input to these commands could potentially execute
arbitrary code in the context of the server or cause a denial of service.
The issues may be reproduced by supplying arguments to these commands that
are in excess of 255 characters. This will cause adjacent regions of
memory to be corrupted with the excessive data. By overwriting sensitive
regions of memory, such as instruction pointers, it may be possible to
exploit this issue to control execution flow of the server process. In
this manner, it will be possible to execute arbitrary code in the context
of the server, which may be run as SYSTEM.
A similar issue with the STAT command is described in BID 3507, but was
addressed by the vendor in a previous release.
30. Microsoft Windows 98 Fragmented UDP Flood Denial Of Service ...
BugTraq ID: 8543
Remote: Yes
Date Published: Sep 04 2003
Relevant URL: http://www.securityfocus.com/bid/8543
Summary:
A remote denial of service vulnerability has been reported to affect
Microsoft Windows 98. It is reportedly possible to reproduce this
condition by sending a fragmented flood of spoofed UDP packets to a
vulnerable system. This will reportedly consume system resources and may
ultimately result in the system locking up until the attack desists.
Ultimately exploitation of this issue will reportedly exhaust system
resources, potentially denying availability of the operating system.
This vulnerability has been reported to affect Microsoft Windows 98, but
not Windows 98SE. It should be noted that this issue might also affect
prior Windows versions.
This is likely a known issue.
31. Multiple Blackberry Enterprise Server Vulnerabilities
BugTraq ID: 8544
Remote: Yes
Date Published: Sep 04 2003
Relevant URL: http://www.securityfocus.com/bid/8544
Summary:
Blackberry Enterprise Server is communications middleware for Research In
Motion Blackberry devices. It is distributed and maintained by
Blackberry, and available for the Microsoft Windows platform.
Several issues have been identified in Blackberry Enterprise Server.
Because of these issues, an attacker may be able to deny service to
legitimate users of a host using the software, or gain unauthorized
privileges.
The following problems are known:
Under some circumstances, a resource exhaustion vulnerability occurs when
handling large or complex documents. This has been noted with PDF
documents, and results in 100% CPU utilitization for several minutes.
Exploitation of this issue may be repeated to result in prolonged denial
of service. This issue is resolved in release 3.6 Service Pack 1a.
A problem with password management occurs when the same document is sent
to a user twice. A password-protected attachment sent to a user a second
time may be viewed without entering a password if the document has been
sent to the recipient and password entered previously. This issue likely
occurs due to storage of password credentials in system memory. This
issue is resolved in release 3.6 Service Pack 1a.
A problem with password management occurs when the same password-protected
document is sent to multiple users. Upon one user entering the password
for the document, all recipients of the document may view the contents of
the protected document. This issue is resolved in release 3.6 Service
Pack 1a.
Some configurations with the Cache Size value set to 32 could experience
resource consumption, resulting in a temporary denial of service. This
occurs when the table of contents of a large file is retrieved. An
attacker could continuously perform this action to cause an extended
denial of service. This issue is resolved in release 3.6 Service Pack 1a.
The extended logging level of the Blackberry Enterprise Server software
does not correctly display extended data. This configuration could result
in the unintended loss of sensitive information. This issue is resolved
in release 3.6 Service Pack 1a.
Blackberry Enterprise Server does not adequately protect the SQL user
credentials when storing them. The software stores SQL user passwords in
the registry in plain text. An attacker with read access to the system
registry may gain access to the database. This issue exists in 3.6
Service Pack 1a.
In some configurations, sending the Set Password and Lock IT command sent
via the administrative console does not lock the device as intended. Due
to handling of passwords by the software, the device may lock without
adequate security measures, allowing the user of the target device to
unlock the device by double-clicking. This issue exists in 3.6 Service
Pack 1a.
This BID will be divided into individual BIDs when further analysis of the
issues is complete.
32. EZ-WEB Site Builder Advanced Editor Selectedpage Parameter D...
BugTraq ID: 8545
Remote: Yes
Date Published: Sep 04 2003
Relevant URL: http://www.securityfocus.com/bid/8545
Summary:
EZ-WEB Site Builder is a software that allows users to create personal and
business web pages. Advanced editor is a text editor included with the
software package.
A vulnerability has been reported in EZ-WEB that may allow remote users to
access restricted data from the server outside the server root directory.
The issue is reported to exist in the 'selectedpage' parameter. It has
been reported that the 'selectedpage' parameter is not sanitized when used
to open a file using the advanced editor.
The vulnerability is due to an access validation error that allows clients
to traverse outside of the root directory using '../' directory traversal
character sequences as a value for the 'selectedpage' parameter.
This may allow the attacker to disclose arbitrary web server readable
files. Successful exploitation of this vulnerability may disclose
sensitive information to an attacker that may be used to launch further
attacks against a vulnerable host.
It has been reported that EZ-WEB Site Builder v1.5 is vulnerable to this
issue, however other versions may be affected as well.
33. Asterisk SIP Request Buffer Overrun Vulnerability
BugTraq ID: 8546
Remote: Yes
Date Published: Sep 04 2003
Relevant URL: http://www.securityfocus.com/bid/8546
Summary:
Asterisk is a software-based PBX system, which is available for Linux
operating systems. Asterisk includes support for the SIP (Session
Initiation Protocol).
Asterisk is prone to a remote exploitable buffer overrun. This is due to
insufficient bounds checking of SIP MESSAGE and INFO requests.
In particular, due to a programming error in the chan_sip.c source file,
data supplied via either of these requests is used as a size argument for
a strncat() operation. By passing 1024 bytes in the request body,
strncat() will be invoked with a negative number for the size argument,
causing memory to be corrupted. A null is included in the affected page
of memory, limiting the amount of memory that is corrupted in the
operation and preventing a page fault, which will permit the saved return
address to be overwritten with attacker-supplied data. As a result, it
will be possible to control execution flow of the program and execute
arbitrary code.
This issue may be exploited by an unauthenticated remote attacker to
execute arbitrary code in the context of the software.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Adrian Lamo charged with computer crimes
By: Kevin Poulsen
FBI agents armed with a federal arrest warrant were searching for the
helpful hacker Thursday, according to his family and a lawyer. Last year's
New York Times hack is the likely charge.
http://www.securityfocus.com/news/6888
2. U.S. warns nuke plants of worm threat
By: Kevin Poulsen
The Nuclear Regulatory Commission issues an advisory about the January
Slammer attack on FirstEnergy's Davis-Besse nuclear plant.
http://www.securityfocus.com/news/6868
3. Racketeering suit filed against DirecTV
By: Kevin Poulsen
Former targets of DirecTV's anti-hacking campaign strike back in federal
court, accusing the company of organized extortion and fraud.
http://www.securityfocus.com/news/6865
4. Recording industry sues hundreds of individual music swapper...
By: Alex Veiga, The Associated Press
http://www.securityfocus.com/news/6904
5. Universities Rush to Protect Networks
By: Brian Krebs, Washington Post
http://www.securityfocus.com/news/6877
6. Blaster-F suspect arrested in Romania
By: John Leyden, The Register
http://www.securityfocus.com/news/6875
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Sussen v0.6
By: lorenb420
Relevant URL: http://sussen.sourceforge.net/
Platforms: Linux, POSIX
Summary:
Sussen is a GNOME client for the Nessus Security Scanner. Sussen is
incredibly easy to use, allowing you to perform a vulnerabiltiy assessment
with just a few mouse clicks.
2. The OpenAntivirus Project: Summary Various
By: cbricart, fz-net, hfuhs, kurti and reniar
Relevant URL: http://www.openantivirus.org/
Platforms: Os Independent, POSIX, Windows 2000, Windows 95/98, Windows NT,
Windows XP
Summary:
Developing Open Source AntiVirus Solutions
3. Devil-Linux v0.5
By: Heiko Zuerker <[email protected]>
Relevant URL: http://www.devil-linux.org/download.htm
Platforms: Linux
Summary:
Devil-Linux is a special Linux distribution which is used for
firewalls/routers. The goal of Devil-Linux is to have a small,
customizable, and secure Linux system. Configuration is saved on a floppy
disk, and it has several optional packages.
4. BO2K v1.1.1
By: andrereis and j_aroche
Relevant URL: http://www.bo2k.com/
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Summary:
BO2K is a remote administration tool for Windows systems. It comes with a
client and a server. The server is lightweight and inobtrusive. A dynamic
plugin architechture allows for easy system extension.
5. Clam Antivirus v0.60
By: Tomasz Kojm
Relevant URL: http://clamav.elektrapro.com/
Platforms: UNIX
Summary:
Clam AntiVirus is an anti-virus toolkit for Unix. The main purpose of this
software is the integration with mail servers (attachment scanning). The
package provides a flexible and scalable multi-threaded daemon, a
commandline scanner, and a tool for automatic updating via Internet. The
programs are based on a shared library distributed with the Clam AntiVirus
package, which you can use in your own software.
6. slidentd v1.0.0
By: Sean Hunter
Relevant URL: http://www.uncarved.com/slidentd/
Platforms: Linux, POSIX
Summary:
slidentd is a minimal ident (RFC1413) daemon which runs from inetd,
xinetd, or tcpserver. It is similar in purpose to pidentd, which is
installed with most Linux systems. However its design goals are somewhat
different. It was written because the author wanted a very small, simple
daemon that would not give out any sensitive information (such as
usernames). In this regard it is not RFC compliant (RFC 1413 requires the
daemon to be insecure by default with secure settings as an option).
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Slightly Off- Topic: Cyber Security Insurance (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336464
2. Looking for INFOSEC position in Denver Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336454
3. List lag, subject lines etc. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336438
4. Seeking a Security Position in MD. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336425
5. Security Software Engineer - Kansas City, MO (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336424
6. Sr. Network Security Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336423
7. Infosec Job Opportunities in Saudi Arabia (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336422
8. Security Data Architect (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336421
9. Security Administrator - Boston, MA $70K-$85K (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336420
10. InfoSec. Representative - Boston, MA $70K-$85K (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336418
11. Software Tools Diva - Network Penetration / Intrusio... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336416
12. Wireless Security S/W Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336415
13. Information Security Analyst - Washington DC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336414
14. Top Gun Intrusion Detection Tools Developer (High Ba... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336413
15. Information Security Engineer needs in Barcelona - S... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336412
16. Kansas City - Application Security Developer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336410
17. Sr. Software Engineer - Symantec - Redwood City, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336409
18. SQA Manager - Symantec - Redwood City, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336183
19. Forensic Security Guru in Liberty Corner, NJ (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336181
20. Sr. Program Manager - Symantec - Santa Monica, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336180
21. Ethical Hacker with Top Secret Clearance (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336178
22. offering penetration testing service/outsourcing (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336176
23. JOB-US-NY-NYC: Policy Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336013
24. Immediate Postions Available: Malcode Analysts at I... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336010
25. Sales Engineer (New York City) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/335871
26. UNIX Systems-level Develop (Maryland suburbs) ACTIVE... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/335869
27. Top Gun Systems Hacker - DC area Location (ACTIVE To... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/335867
28. Security Project Manager - Cleveland, Ohio (Contract... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/335739
29. Sr. Security Professional Avail in Europe/Middle Eas... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/335738
30. Security Business Development Opportunity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/335737
31. List international focus? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/335734
32. Seeking security job (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/335691
VI. INCIDENTS LIST SUMMARY
--------------------------
1. Spam-Object Exploit (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/336270
2. Backdoor.coreflood infection (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/336269
3. increase in 19725 probes (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/336267
4. Infected Subscriber (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/336253
5. New DDOS? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/336251
6. compromised Real Server 8 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/336250
7. [tool] the new p0f 2.0.1 is now out (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/336067
8. A Canada based wardialer/hacker: +16045507000 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/336065
9. freebsd 0-day exploit Real-/Helixserver 9.0.2.794 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/335990
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. InlineEgg library release (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/336243
2. Mail relay issue (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/336242
3. exim remote heap overflow, probably not exploitable (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/336060
4. Defeating non-executable stacks ... trying to, actua... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/336059
5. certain versions of Windows XP leaking memory in TCP... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/335845
6. Oracle xdb ftp service? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/335634
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Domain vs. Local security policy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336532
2. windows 2000 security logs (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336531
3. Local Admins (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336479
4. MS03-008 and SP4 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336477
5. [email protected] (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336476
6. windows update (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336311
7. Security Configuration guides provided by the Navy. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336246
8. cached passwords (was [email protected]) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/335812
IX. SUN FOCUS LIST SUMMARY
--------------------------
NO NEW POSTS FOR THE WEEK 2003-09-01 to 2003-09-08.
X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2003-09-01 to 2003-09-08.
XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Captus Networks
Precisely Define and Implement Network Security and Performance Policies
Integrated Intrusion Prevention and Traffic Shaping to:
- Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
- Automatically Control P2P, IM and Spam Traffic
- Ensure Reliable Performance of Mission Critical Applications
**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo
http://www.securityfocus.com/sponsor/CaptusNetworks_sf-news_030811
------------------------------------------------------------------------