SecurityFocus Newsletter #214
Kelly Martin <[email protected]> Tue, 16 Sep 2003 12:24:58 -0600 (MDT)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #214
------------------------------
This Issue is Sponsored by: Solsoft
How fast can you respond to security alerts from anti-virus or SIM
engines?
**Attend a FREE webinar and learn how Solsoft can help you:
- Black list suspicious IP addresses in seconds
- Shut down access across multiple devices at once in case of a worm
attack
- Escalate from one security policy to another based on threat levels
- Instantly deploy error-proof ACLs, NAT, and IPSec VPN rules
**More information and registration at:
http://www.securityfocus.com/sponsor/Solsoft_sf-news_000101
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Dynamic Honeypots
2. Demonstrating ROI for Penetration Testing (Part Three)
3. Hardening the TCP/IP stack to SYN attacks
4. SecurityFocus New Mailing List Announcement
II. BUGTRAQ SUMMARY
1. FoxWeb PATH_INFO Remote Buffer Overrun Vulnerability
2. HP Tru64 UNIX Unspecified DTTerm Denial Of Service Vulnerabi...
3. Python Publishing Accessories Error Messages Cross-Site Scri...
4. ISS RealSecure Server Sensor SSL Denial Of Service Vulnerabi...
5. Digital Scribe Error Function Cross-Site Scripting Vulnerabi...
6. Microsoft Internet Explorer Browser Popup Window Object Type...
7. Mah-Jong Server Undisclosed Remote Buffer Overflow Vulnerabi...
8. Mah-Jong Server Undisclosed Remote Denial Of Service Vulnera...
9. FTP Desktop Banner Parsing Buffer Overflow Vulnerability
10. FTP Desktop FTP 331 Server Response Buffer Overflow Vulnerab...
11. Apache::Gallery Insecure Local File Storage Privilege Escala...
12. Microsoft ASP.NET Request Validation Null Byte Filter Bypass...
13. ICQ Webfront guestbook Cross-Site Scripting Vulnerability
14. Kukol E.V. HTTP & FTP Server Suite File Disclosure Vulnerabi...
15. Microsoft Internet Explorer XML Page Object Type Validation ...
16. Roger Wilco Remote Server Side Buffer Overrun Vulnerability
17. NullSoft Winamp MIDI Plugin IN_MIDI.DLL Track Data Size Buff...
18. Roger Wilco Remote Username Denial of Service Vulnerability
19. PHPBB URL BBCode HTML Injection Vulnerability
20. RealOne Player Insecure Configuration File Permission Local ...
21. WinRAR Compressed File Size Misrepresentation Weakness
22. Escapade Scripting Engine PAGE Parameter Cross-Site Scriptin...
23. Invision Power Board Index.php Showtopic Cross-Site Scriptin...
24. Gordano Messaging Suite WWW.exe Denial of Service Vulnerabil...
25. Multiple Microsoft Internet Explorer Script Execution Vulner...
26. FloosieTek FTGatePro WebAdmin Interface Information Disclosu...
27. Gordano Messaging Suite Alertlist.mml Information Disclosure...
28. IkonBoard Cookie Default Parameter Arbitrary Command Executi...
29. Yak! Chat Client FTP Server Default Credentials Vulnerabilit...
30. Net-SNMP Unauthorized MIB Object Access Vulnerability
31. FutureWave WebX Server Directory Traversal Vulnerability
32. CacheFlow CacheOS HTTP HOST Proxy Vulnerability
33. KokeshCMS Unauthorized Content Editing Vulnerability
34. b2evolution Multiple Cross-Site Scripting Vulnerabilities
35. CmdFTP Store_Line() Heap Overflow Vulnerability
36. Pine Message/External-Body Type Attribute Buffer Overflow Vu...
37. Pine rfc2231_get_param() Remote Integer Overflow Vulnerabili...
38. MySQL Password Handler Buffer Overflow Vulnerability
39. b2evolution Multiple SQL Injection Vulnerabilities
40. Multiple Unspecified OSSIM SQL Injection Vulnerabilities
41. Asterisk CallerID Call Detail Records SQL Injection Vulnerab...
III. SECURITYFOCUS NEWS ARTICLES
1. Lamo denies $300,000 database hack
2. Lamo surrenders, is released
3. Adrian Lamo charged with computer crimes
4. White House selects Symantec executive as new cybersecurity ...
5. E-mail fraudsters target Barclays
6. Wi-Fi whistle blower faces criminal charges
IV. SECURITYFOCUS TOP 6 TOOLS
1. Private v0.5b
2. Novosec Bouncy Castle Extensions v1.0
3. LinuxMagic magic-smtpd v0.7.2rc3
4. GKrellM v2.1.18 (GTK 2.0)
5. Tiny SHell v0.6
6. iptables-control v1.0.6
V. SECURITYJOBS LIST SUMMARY
1. Job Search Resources (Thread)
2. Sr SW Eng - Windows Domain Expert Silicon Valley CA (Thread)
3. SW Vulnerability Detection Engineer Silicon Valley ... (Thread)
4. QA Web Application Test Eng Silicon Valley CA (Thread)
5. Results of the vote query (Thread)
6. Sr. CISSP InfoSec engineer looking for opening (Thread)
7. DBA/Sys admin wanted (Thread)
8. Symantec Looking for Internal Enterprise Security Ad... (Thread)
9. Senior Security Engineer Silicon Valley CA (Thread)
10. IT Audit (Mid-West) (Thread)
11. Software Security Architect (Thread)
12. Sr. Security Software Developer (Thread)
13. Sales Engineer - San Francisco WLAN Security Company (Thread)
14. CISO - East Wenatchee, Washington - EOE - Greythorn (Thread)
15. Sr. IDS Engineer/Manager - Bethesda, MD (Thread)
16. ISSO Opening - Reston, VA (Thread)
17. Seattle, WA - 63-65K - Local Candidates Preferred - ... (Thread)
18. Searching for Midwest US position (Thread)
19. Security Professional - over 20 years' experience no... (Thread)
20. London, UK - Security Laboratory Manager (Thread)
21. Seattle, WA - (1) Security Engineering Project Manag... (Thread)
22. Neoteris - Systems Engineer - Japan (Thread)
23. IT Security Senior Manager, Systems Integrity - UK (Thread)
24. Neoteris - Regional Sales Manager - NC/SC/TN (Thread)
25. Position wanted - Security Engineer (CISSP) with 4+ ... (Thread)
26. Security Pre Sales Engineer - Alameda, CA (Thread)
27. Implementation Project Manager - Security Software (Thread)
28. Senior Security Consultant (Unix) - Austin, TX (Thread)
29. Penetration Tester vacancy (Thread)
30. Several opp's for Security Engineers with Product De... (Thread)
31. HELP!, Desperately looking for DISTCAP Expert! (Thread)
32. Looking for a job position (Thread)
33. Voting on issues for this list and SecurityFocus (Se... (Thread)
34. Top Gun Intrusion Detection Tools Developer (High Ba... (Thread)
35. Vulnerability Assessment, Incident Respondents, Netw... (Thread)
36. Sr Network Security Engineers (Thread)
37. Director of Product Marketing/Management - Austin, T... (Thread)
38. Entry Level Security Analyst Positions (West VA & Ch... (Thread)
39. Seeking Security or Admin Position in the Washingto... (Thread)
40. Jobs in Forensics - UK but do not mind rellocating (Thread)
41. Channel Manager- with direct exp. -Atlanta, GA (Thread)
42. Federal Sales position- DC area (Thread)
43. security professional needed in DC (Thread)
44. Maryland contract NT/2000 Security-recruiter (Thread)
45. Seeking a Security Position (Mumbai India and ready ... (Thread)
46. Maryland contract Database security-recruiter (Thread)
47. New articles on SecurityFocus (Thread)
48. Cisco/Pki/smartcard/checkpoint guru available in Tor... (Thread)
VI. INCIDENTS LIST SUMMARY
1. Results of the vote query (Thread)
2. Cacheflow proxy abuse (revisited) (Thread)
3. Strange Windows logon attempts (Thread)
4. New Article Announcement: Hardening the TCP/IP stack... (Thread)
5. Canada Wardialer (Thread)
6. Voting on issues for this list and SecurityFocus (In... (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Results of the vote query (Thread)
2. Cannot access memory at address 0x90909090 (Thread)
3. Moozatech: MyServer Buffer Overflow vulnerability (Thread)
4. A strike against OISAFTEY is a strike for mankind...... (Thread)
5. 4D WebSTAR FTP Buffer Overflow. (Thread)
6. Windows 2003 Server - Defeating the stack protection... (Thread)
7. Half-Life client buffer overflow (Thread)
8. Ethernet ( MAC ) Address Reliability (Thread)
9. EEYE: Microsoft RPC Heap Corruption Vulnerability - ... (Thread)
10. win32 call dword ptr [eax] help needed (Thread)
11. Voting on issues for this list and SecurityFocus (Vu... (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. windows 2000 security logs (Thread)
2. Disabling sharing and group policies (Thread)
3. Security for Win XP Home (Thread)
4. GPO for one machine (Thread)
5. RE: Disabling sharing and group policies (Thread)
6. Domain vs. Local security policy (Thread)
7. Disable USB on a per user basis? (Thread)
8. Limiting users on secific machines that are part of ... (Thread)
9. Voting on issues for this list and SecurityFocus (Fo... (Thread)
10. SecurityFocus Microsoft Newsletter #153 (Thread)
11. Possible information leakage from DNS quirks (Thread)
12. SecurityFocus Microsoft Newsletter #152 (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Building Sentry Systems (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Accessing file server (Thread)
2. Voting on issues for this list and SecurityFocus (Fo... (Thread)
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Dynamic Honeypots
By Lance Spitzner
The search for the dream honeypot: dynamic honeypots, an appliance-like
plug-and-play solution.
http://www.securityfocus.com/infocus/1731
2. Demonstrating ROI for Penetration Testing (Part Three)
By Marcia Wilson
The third article in this series focuses on defining terms related to the
Risk Analysis process and touches on Information Asset valuation methods
that are critical when justifying the necessity and expense of a Pen
Test.
http://www.securityfocus.com/infocus/1730
3. Hardening the TCP/IP stack to SYN attacks
By Mariusz Burdach
This article discusses methods of hardening the TCP/IP stack of various
operating systems to make servers more resistant to SYN flooding and SYN
spoofing Denial of Service (DOS) attacks.
4. SecurityFocus New Mailing List Announcement
We are pleased to announce the launch of two new mailing lists for the
Security community:
1. Security Management ([email protected])
2. Bugtraq-French ([email protected])
To subscribe to either of these lists, send mail to the listserv at the
respective address indicated above; the subject and body of your message
do not matter. Or, you can visit our signup page at
http://www.securityfocus.com/archive
http://www.securityfocus.com/infocus/1729
II. BUGTRAQ SUMMARY
-------------------
1. FoxWeb PATH_INFO Remote Buffer Overrun Vulnerability
BugTraq ID: 8547
Remote: Yes
Date Published: Sep 05 2003
Relevant URL: http://www.securityfocus.com/bid/8547
Summary:
FoxWeb is a Foxpro-based web application development framework. It is
available for Microsoft Windows operating systems.
FoxWeb is prone to a remotely exploitable buffer overrun vulnerability.
This is due to insufficient bounds checking of user-supplied PATH_INFO
data to the FoxWeb CGI and ISAPI extension (foxweb.exe and foxweb.dll).
If more than 3000 bytes are supplied as input to PATH_INFO, adjacent
regions of stack memory may be overrun with the excessive data. This
could potentially allow a remote attacker to corrupt stack variables, such
as a return address, with specific data. This may be leveraged by the
attacker to control the execution flow of the program.
Successful exploitation would permit a remote attacker to execute
arbitrary code in the context of the software.
2. HP Tru64 UNIX Unspecified DTTerm Denial Of Service Vulnerabi...
BugTraq ID: 8548
Remote: Yes
Date Published: Sep 05 2003
Relevant URL: http://www.securityfocus.com/bid/8548
Summary:
HP has released a security bulletin to address an unspecified denial of
service vulnerability in the dtterm terminal emulator for Tru64 UNIX.
This issue is reported to present a threat locally and remotely.
The vendor has not released specific technical details at this time. This
BID will be updated if further details are made available.
3. Python Publishing Accessories Error Messages Cross-Site Scri...
BugTraq ID: 8549
Remote: Yes
Date Published: Sep 05 2003
Relevant URL: http://www.securityfocus.com/bid/8549
Summary:
Python Publishing Accessories is a library consisting of python modules
that are used to create web publication systems.
A vulnerability has been reported to exist because of the error messages
returned to a user in Python Publishing Accessories. This issue may allow
a remote attacker to execute HTML or script code in a user's browser due
to insufficient sanitization of user input.
The problem is reported to exist due to a lack of sanitization of error
messages by the software. The vulnerable software is reported to include
requests for invalid URLs in error messages returned to a user without
proper sanitization. HTML and script code will be rendered in a user's
browser, therefore making it possible for an attacker to a construct a
malicious link containing HTML or script code that may be rendered in a
user's browser upon visiting that link. This attack would occur in the
security context of the affected site.
Successful exploitation of this vulnerability may allow an attacker to
steal cookie-based authentication credentials. Other attacks may well be
possible.
This issue is reported to be present in Python Publishing Accessories
version 0.2.1, however prior versions may be affected as well.
4. ISS RealSecure Server Sensor SSL Denial Of Service Vulnerabi...
BugTraq ID: 8550
Remote: Yes
Date Published: Sep 05 2003
Relevant URL: http://www.securityfocus.com/bid/8550
Summary:
ISS RealSecure Server Sensor is an intrusion detection technology that can
integrate with an underlying web server such as Microsoft IIS or Apache.
It supports a number of platforms including Microsoft Windows and
Unix/Linux variants.
ISS RealSecure Server Sensor is prone to a denial of service when handling
a malicious request over SSL. It is reportedly possible to reproduce this
condition by passing invalid unicode characters in a request over SSL.
This vulnerability could be exploited to crash the underlying Microsoft
IIS web server. It should be noted that the service may be automatically
restarted.
It is not known if this issue affects other platforms or can be exploited
to crash other underlying web server implementations.
The researchers who discovered this vulnerability are currently
investigating the possibility of exploiting this issue to execute
arbitrary code, though sufficient details are not available regarding this
at the time of writing. This BID will be updated and impacts adjusted
accordingly if more details become available.
5. Digital Scribe Error Function Cross-Site Scripting Vulnerabi...
BugTraq ID: 8551
Remote: Yes
Date Published: Sep 05 2003
Relevant URL: http://www.securityfocus.com/bid/8551
Summary:
Digital Scribe is a freely available, open source PHP publishing
application. It is available for the Linux platform.
A problem has been reported in the checking of input by Digital Scribe.
Because of this, it may be possible for an attacker to steal cookie
authentication credentials or launch other attacks.
The problem is in the handling of input by the register.php and login.php
scripts. In both scripts, the error URI parameter does not sufficiently
filter input before displaying it in web pages, making it possible for an
attacker to include HTML and script code in a malicious link to a site
running the software. If such a link is visited, then hostile code
included in the link may be rendered by the victim user's browser in the
context of the site.
6. Microsoft Internet Explorer Browser Popup Window Object Type...
BugTraq ID: 8556
Remote: Yes
Date Published: Sep 07 2003
Relevant URL: http://www.securityfocus.com/bid/8556
Summary:
Internet Explorer does not properly handle object types, when rendering
web browser popup windows. This may result in the possibility of the
execution of malicious software.
The problem occurs when Internet Explorer receives a response from the
server when a malicious popup window containing an object tag is parsed.
Proper parameter checks of the type of file being loaded are not performed
on the object type contained within HTTP response received from the web
server.
Successful exploitation of this vulnerability could allow a malicious
object to be trusted and as such be installed and executed on the local
system. All code execution would occur in the security context of the user
running the affected browser. It should be noted that an attacker might be
capable of also executing locally installed executables with command-line
parameters.
This issue is related to Microsoft Bulletin MS03-032 and BID 8456, it has
also been reported to be related to BID 3867.
7. Mah-Jong Server Undisclosed Remote Buffer Overflow Vulnerabi...
BugTraq ID: 8557
Remote: Yes
Date Published: Sep 07 2003
Relevant URL: http://www.securityfocus.com/bid/8557
Summary:
mah-jong is a network enabled computer game available for multiple Unix
platforms.
An undisclosed remote buffer overflow vulnerability has been reported to
affect the mah-jong game server. The issue has been reported to be
exploitable so that arbitrary code may be supplied and executed in the
context of the remote mah-jong server.
This may provide a conduit for a remote attacker to gain remote
unauthorized interactive access to an affected system.
It is not currently known whether this issue is restricted to Debian
maintained versions of mah-jong or not. Although unconfirmed, other
versions may also be affected.
This BID will be updated as further details regarding this vulnerability
are disclosed.
8. Mah-Jong Server Undisclosed Remote Denial Of Service Vulnera...
BugTraq ID: 8558
Remote: Yes
Date Published: Sep 07 2003
Relevant URL: http://www.securityfocus.com/bid/8558
Summary:
mah-jong is a network enabled computer game available for multiple Unix
platforms.
An undisclosed remote denial of service vulnerability has been reported to
affect the mah-jong game server. The issue has been reported to be
exploitable so that a remote attacker may trigger a tight loop in the
affected mah-jong server. This will cause the game server to be
unresponsive to further commands, effectively denying service to
legitimate users.
It is not currently known whether this issue is restricted to Debian
maintained versions of mah-jong or not. Although unconfirmed, other
versions may also be affected.
This BID will be updated as further details regarding this vulnerability
are disclosed.
9. FTP Desktop Banner Parsing Buffer Overflow Vulnerability
BugTraq ID: 8559
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8559
Summary:
FTP Desktop is an application that allows a user to access FTP sites as if
they were folders on the local system.
A buffer overflow vulnerability has been reported in FTP Desktop. The
vulnerability occurs when FTP Desktop is parsing 'Welcome' banner 220
messages from remote FTP servers. When FTP Desktop receives an FTP banner
exceeding a certain length, it will trigger the overflow condition.
In the event that a malicious FTP server sends a banner consisting of
greater than approximately 237 bytes, an internal buffer in the client
will be overrun, causing adjacent regions of memory to be corrupted with
data supplied by the malicious server. This could allow for execution of
malicious code in the context of the affected FTP client.
It should be noted that although this vulnerability has been reported to
affect FTP Desktop version 3.5, other versions might also be affected.
10. FTP Desktop FTP 331 Server Response Buffer Overflow Vulnerab...
BugTraq ID: 8560
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8560
Summary:
FTP Desktop is an application that allows a user to access FTP sites as if
they were folders on the local system.
A buffer overflow vulnerability has been reported in FTP Desktop. The
vulnerability occurs when FTP Desktop is parsing 331 server responses from
remote FTP servers. When FTP Desktop receives an FTP 331 response
exceeding a certain length, it will trigger the overflow condition.
In the event that a malicious FTP server sends a 331 response consisting
of greater than approximately 237 bytes, an internal buffer in the client
will be overrun, causing adjacent regions of memory to be corrupted with
data supplied by the malicious server. This could allow for execution of
malicious code in the context of the affected FTP client.
It should be noted that although this vulnerability has been reported to
affect FTP Desktop version 3.5, other versions might also be affected.
11. Apache::Gallery Insecure Local File Storage Privilege Escala...
BugTraq ID: 8561
Remote: No
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8561
Summary:
Apache::Gallery is a perl module designed to be used with Apache and
mod_perl. It's purpose is to create an index of picture thumbnails for
each directory hosted by the server.
When initializing Inline C from within the Gallery.pm file,
Apache::Gallery fails to sufficiently store the files within a secure
location. Specifically, it calls File::Spec->tmpdir() which will typically
return a world writable temporary directory. This directory is then used
for the storage of shared objects later linked to by Apache. These .so
files also use predictable file names, making it possible for an attacker
to potentially supply malicious shared object files that will be linked
into Apache.
An attacker could exploit this issue by constructing a malicious shared
object file. The file may need to contain specific functions expected by
Apache::Gallery to avoid errors. The attacker must simply place these
files within the /tmp/lib/auto/Apache/Gallery_4033 directory, or which
ever temporary directory is typically used, prior to Apache creating the
shared object there. It should be noted that these shared object files
must be replaced prior to the Apache process linking to them.
This will result in malicious code being linked to and executed within the
Apache process, effectively allowing for the execution of arbitrary code
with elevated privileges.
12. Microsoft ASP.NET Request Validation Null Byte Filter Bypass...
BugTraq ID: 8562
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8562
Summary:
ASP.NET 1.1 ships with a Request Validation feature that is designed to
sanitize malicious user-supplied HTML before it is rendered to clients.
It has been reported that Request Validation does not perform as expected,
and under some circumstances may be bypassed. As a result, ASP scripts
that depend on Request Validation to sanitize user-supplied input may
still be prone to cross-site scripting or HTML injection attacks as a
result. Request Validation may be bypassed by including a null byte (%00)
in malicious user-supplied input. It has been demonstrated that this
issue may be exploited if a null byte is placed after the '<' character in
a HTML tag, for example:
<%00script>
This will effectively bypass the feature, but many clients will ignore the
null byte and render the HTML tag normally.
It should be noted that this can also create a false sense of security,
since the expectation is that Request Validation should sufficiently
sanitize hostile input. Developers may design scripts with this
expectation and not implement native validation of user-supplied input.
13. ICQ Webfront guestbook Cross-Site Scripting Vulnerability
BugTraq ID: 8563
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8563
Summary:
ICQ is an instant messenger client for Microsoft Windows systems and other
platforms. ICQ Webfront is used to create personal web sites that are
integrated with a user's ICQ client. ICQ Webfront allows users to share
personal information, contacts, and files with other users.
A vulnerability has been reported to exist in the message field of the
guestbook module of ICQ Webfront. This issue may allow a remote attacker
to execute HTML or script code in a user's browser due to insufficient
sanitization of user input.
The problem is reported to exist due to a lack of sanitization of
user-supplied input by the software. HTML and script code will be
rendered in a user's browser, therefore making it possible for an attacker
to a construct a malicious link containing HTML or script code that may be
rendered in a user's browser upon visiting that link. This attack would
occur in the security context of the affected site.
Successful exploitation of this vulnerability may allow an attacker to
steal cookie-based authentication credentials. Other attacks may well be
possible.
ICQ 2003 has been listed as a vulnerable package, however other versions
may be affected as well.
14. Kukol E.V. HTTP & FTP Server Suite File Disclosure Vulnerabi...
BugTraq ID: 8564
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8564
Summary:
Kukol E.V. HTTP & FTP Server Suite is a web/file server that is available
for Microsoft Windows operating systems.
The web server component of Kukol E.V. HTTP & FTP Server Suite is prone to
a file disclosure vulnerability. Remote web users may use directory
traversal sequences in requests to gain access to files outside of the
server's web root directory. In this manner, contents of files that are
readable by the web server may be disclosed to remote attackers.
This vulnerability has the potential to disclose sensitive information
that may be useful in mounting further attacks against the system hosting
the software.
15. Microsoft Internet Explorer XML Page Object Type Validation ...
BugTraq ID: 8565
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8565
Summary:
Internet Explorer does not properly handle object types, when rendering
XML based web sites. This may result in the possibility of the execution
of malicious software.
The problem occurs when Internet Explorer receives a response from the
server when a malicious XML web page containing an embedded object tag is
parsed. Proper parameter checks of the type of file being loaded are not
performed on the object type contained within HTTP response received from
the web server.
Successful exploitation of this vulnerability could allow a malicious
object to be trusted and as such be installed and executed on the local
system. All code execution would occur in the security context of the user
running the affected browser. It should be noted that an attacker might be
capable of also executing locally installed executables with command-line
parameters.
This issue is related to Microsoft Bulletin MS03-032, BID 8456 and BID
8556 it has also been reported to be related to BID 3867.
16. Roger Wilco Remote Server Side Buffer Overrun Vulnerability
BugTraq ID: 8566
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8566
Summary:
Roger Wilco is a net-based communication client designed to allow users to
speak in real-time. Multiple clients may connect to a single server
allowing remote users to interact. It is available for the Microsoft
Windows operating servers.
A remote buffer overrun has been reported for various Roger Wilco server
releases. The problem lies in the fact that the vulnerable servers rely on
client-side size values when copying data into internal memory buffers.
When a client attempts to connect to a server, it first transmits a packet
containing a variety of data, including the password and channel. The 3rd
and 4th bytes of this packet denote the size of this data. Upon receiving
this transmission, the server uses the client-supplied size value when
copying the data into an internal memory buffer. As the size value is two
bytes, an attacker could theoretically supply up to 65535 bytes of data to
be copied into the server. As the server has previously allocated a buffer
believed to be of sufficient size, this could result in a buffer overrun.
An attacker may be capable of exploiting this issue to overwrite sensitive
memory variables within the server process space. This could ultimately
allow for the execution flow of the server to be controlled, and may
result in the execution of attacker-supplied instructions.
17. NullSoft Winamp MIDI Plugin IN_MIDI.DLL Track Data Size Buff...
BugTraq ID: 8567
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8567
Summary:
NullSoft Winamp is a freely available media player from Nullsoft. It is
available for the Microsoft Windows platform. IN_MIDI.DLL is the default
MIDI plugin used by Winamp when processing MIDI files.
Winamp MIDI plugin, IN_MIDI.DLL has been reported prone to a buffer
overflow issue when handling malicious MIDI files. The issue presents
itself when a value of 'ffffffff', is passed as a value for the Track Data
Size of a MIDI file header. Although unconfirmed the vulnerability may be
due to an unsigned signed mismatch when performing bounds checking on data
that is being copied into an internal buffer in stack based memory. The
signed value of 0xffffffff (-1), instead of the unsigned value may be used
erroneously in boundary conditions arithmetic.
Although unconfirmed it has been conjectured that an attacker may exploit
this condition to execute arbitrary code in the context of the user who is
running the affected Winamp player.
It has been reported that user interaction may hinder exploitation of this
vulnerability, for example how the file is opened, or the default MIDI
device that is used.
It should be noted that due to default MIDI file player registry settings
made when Winamp is installed, this issue may also be automatically
exploitable when malicious web pages or HTML email are viewed.
Winamp version >=3.01 IN_MIDI.DLL has been reported prone to this issue.
18. Roger Wilco Remote Username Denial of Service Vulnerability
BugTraq ID: 8568
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8568
Summary:
Roger Wilco is a net-based communication client designed to allow users to
speak in real-time. Multiple clients may connect to a single Roger Wilco
server, allowing remote users to interact. It is available for the
Microsoft Windows operating servers.
It has been reported that connecting to a Roger Wilco server with a
username of excessive length may cause the server to crash. The problem is
said to occur within the NETWORK.DLL library, specifically when someone
with a 33 byte or larger username connects to the server. This may
effectively deny service to other legitimate users.
Although it has not been confirmed, this issue may be due to insufficient
bounds checking before copying username data into an internal memory
buffer.
This vulnerability is said to affect Roger Wilco 1.4.1.6.
19. PHPBB URL BBCode HTML Injection Vulnerability
BugTraq ID: 8570
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8570
Summary:
phpBB is an open-source web forum application that is written in PHP and
supported by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.
BBCode is a basic restricted implementation of HTML that is used to
control the appearance of text in user-supplied phpBB entries.
phpBB BBCode has been reported prone to an HTML injection vulnerability.
It has been reported that an attacker may inject malicious script into
areas of phpBB where BBCode is rendered, for example bulletin board posts
or private messages. This issue is due to a lack of sufficient
sanitization performed on user supplied URL BBCode tags. The [url] BBCode
tag is reported vulnerable.
As a result of the lack of sanitization, injected code may be rendered in
the web browser of a user who views vulnerable areas of the site. This
would occur in the security context of the site hosting phpBB and its
related modules.
An attacker may exploit this issue to steal cookie-based authentication
credentials, other attacks may also be possible.
Although this vulnerability has been reported to affect phpBB version
2.0.6, other versions may also be vulnerable.
20. RealOne Player Insecure Configuration File Permission Local ...
BugTraq ID: 8571
Remote: No
Date Published: Sep 09 2003
Relevant URL: http://www.securityfocus.com/bid/8571
Summary:
RealOne Player is a media player that is available for a number of
platforms including Microsoft Windows and MacOS systems.
RealOne Player reported prone to a local privilege escalation
vulnerability.
The configuration files for the RealOne Player are installed in the
'.realnetworks' hidden folder in a users home directory. The issue
presents itself, because configuration files stored in this directory are
installed with 0660 permissions. This means that an attacker, who is in
the same group as a target user, may modify RealOne Player configuration
files and may thereby escalate privileges to that of the target user.
A local attacker may exploit this condition; by creating a Trojan shared
library and modifying the 'dt_codecs' variable in the 'RealShared_0_0'
configuration file, so that it points to the malicious shared library.
This may result in arbitrary code execution in the context of the target
user, when RealOne Player is executed. Other methods of exploitation are
also possible.
It should be noted, that this vulnerability has been reported to affect
X86 Linux variants of RealOne Player.
21. WinRAR Compressed File Size Misrepresentation Weakness
BugTraq ID: 8572
Remote: Yes
Date Published: Sep 09 2003
Relevant URL: http://www.securityfocus.com/bid/8572
Summary:
WinRAR is a compression utility capable of reading and writing files using
several different archival formats. It is available for the Microsoft
Windows Operating system.
WinRAR is prone to a weakness that may allow malicious parties to
misrepresent the size of compressed files. This issue occurs because
WinRAR trusts values in the .rar header without adequately verifying the
actual file size.
If the .rar header is otherwise correct and contains a valid CRC checksum,
then WinRAR will pre-allocate space to decompress the file based on file
size information provided in the header. During pre-allocation, WinRAR
will not verify that there is enough disk space to decompress files
included in the archive based on their actual size (since pre-allocation
is based on the size specified in the header). This presents a security
threat because a user may expect that a compressed file is a certain size
and decompress it based on this assumption. A deceptively large file
could be included in an archive that consumes all available disk space
when it is decompressed. Furthermore, under some circumstances, WinRAR
may attempt to extract a file based on the size specified in the header,
even if the actual file size is relatively small, filling any disk space
beyond the end of the decompressed file with zeroes.
UnRar, a Rar add-on distributed by RARLAB, is also prone to this issue.
The UnRar add-on is available for a number of operating systems, including
Unix/Linux derivatives and may be invoked automatically by various virus
scanners. This could pose an additional attack vector which does not
require user interaction to exploit.
There have been conflicting reports as to whether WinRar 3.20 is
vulnerable to this issue or not.
22. Escapade Scripting Engine PAGE Parameter Cross-Site Scriptin...
BugTraq ID: 8573
Remote: Yes
Date Published: Sep 09 2003
Relevant URL: http://www.securityfocus.com/bid/8573
Summary:
Escapade (ESP) is a server-side scripting language.
A cross-site scripting vulnerability has been reported for Escapade. The
vulnerability exists due to insufficient sanitization of some
user-supplied values. Specifically, malicious HTML code is not sanitized
from the 'PAGE' URI parameter passed to ESP.
An attacker could exploit this issue to execute arbitrary HTML code in the
browser of a remote user who follows a malicious link. Code execution
would occur in the context of the vulnerable site. It has also been
reported that this issue may be exploited to disclose the installation
path of the affected software.
Other attacks may also be possible.
Exploitation could permit an attacker to steal cookie-based authentication
credentials or launch other attacks.
23. Invision Power Board Index.php Showtopic Cross-Site Scriptin...
BugTraq ID: 8575
Remote: Yes
Date Published: Sep 09 2003
Relevant URL: http://www.securityfocus.com/bid/8575
Summary:
Invision Board is web forum software. It is implemented in PHP and is
available for Unix and Linux variants and Microsoft Windows operating
systems.
Invision Power Board index.php script reported prone to a cross-site
scripting vulnerability.
The issue presents itself due to a lack of sufficient sanitization
performed by functions in the index.php script on user-influenced
'showtopic' URI parameter. It has been reported that a remote attacker may
construct a malicious link to the script and supply arbitrary HTML code as
a value for the 'showtopic' URI parameter. If this link is followed, the
content of the 'showtopic' parameter will be rendered in the browser of
the user who followed the link.
This could permit the theft of cookie authentication credentials; other
attacks may also be possible.
24. Gordano Messaging Suite WWW.exe Denial of Service Vulnerabil...
BugTraq ID: 8576
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8576
Summary:
Gordano Messaging Suite is a messaging server that is compatible with
Windows, Linux, Sun Solaris and IBM AIX platforms. The suite provides
e-mail, instant messaging, SMS and antivirus services for its clients.
A vulnerability has been reported to be present in the WWW.exe process of
the software that may allow a remote attacker to cause the process to
crash on Windows systems.
WWW.exe process listens on TCP ports 80, 8000, 8025, 8081, 8888, and 9000
in order to provide services such as Administration, WebMail Professional,
WebMail Express, WebMail Mobile, Instant Messaging, and Web Server
services. The problem occurs when a remote attacker sends a malicious
HTTP GET request with the characters '/../..' to the web server. The
attack may cause WWW.exe process to crash resulting in the termination of
all services provided by the process. Restarting the process may resume
normal functionality.
It has been reported that the WWW.exe process does not crash when running
on Linux platforms however an attacker may send multiple HTTP GET requests
with the characters '/../..' to the server resulting the process to hang.
This would cause a denial of service to legitimate users.
Successful exploitation of this condition would effectively deny service
to legitimate users.
Gordano Messaging Suite version 9.0 has been reported to be prone to this
vulnerability, however other version may be affected as well.
25. Multiple Microsoft Internet Explorer Script Execution Vulner...
BugTraq ID: 8577
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8577
Summary:
Multiple issues have been reported in Microsoft Internet Explorer. Though
these issues have been reported by a reliable source, communication issues
have presented difficulty in obtaining details surrounding the reported
issues. This vulnerability entry will be updated when additional
information becomes available.
The following issues may exist, based on the limited information currently
available:
1. A javascript-protocol URL left in browser history will result in the
execution of javascript if the browser back button is pressed.
2. Under some circumstances, it may be possible to break functionality in
Internet Explorer to map the find function to the execution of arbitrary
functions. This appears to be done by hijacking the Control-F function
within IE.
3. It may be possible to hijack the click function within Internet
Explorer to instead perform a dragNdrop function. By doing so, an
attacker could drag an arbitrary homepage into a targeted list.
4. Similar to the issue described under point three, it may be possible to
hijack a different method to perform specific actions within the browser,
this removing the need for user action to perform potentially malicious
functions.
5. Due to insecure handling of script code by the search function, it is
possible to execute script code in the search window. This may result in
a violation of browser security policy.
6. It may be possible to bypass the URL check performed by the search
method, making it possible to pass a HREF property into a BASE tag.
7. It is possible to abuse the file: protocol to potentially execute code
in the local security zone. The window.external.NavigateAndFind is a
method that may be abused in such an instance. This issue, combined with
a previously disclosed problem, can permit an attacker to inject malicious
code into the media sidebar error page, resulting in the execution of code
in the security context of the "My Computer" zone.
Other issues exist, however preliminary details are either unclear or not
available at this time. Further, the available information may change as
available details are further clarified. This vulnerability will be
further updated as more information becomes available.
26. FloosieTek FTGatePro WebAdmin Interface Information Disclosu...
BugTraq ID: 8578
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8578
Summary:
FloosieTek FTGatePro is said to be prone to an information disclosure
weakness. The problem occurs in the WebAdmin Interface and may allow an
attacker to view sensitive server configuration information. The problem
is believed to occur due to insufficient access controls put in place by
FTGatePro.
As a result, an unprivileged attacker could exploit this weakness by
making a request to the '/tools/ftgatedump.fts' or 'Exportmbx.fts' file. A
request to the first script will cause the "ftgate_dump.txt" to be created
on the server which will contain a variety of configuration data. The
second script allows a user to export the mailbox of an arbitrary local
domain to a specified file which will be stored in CSV format. For an
attacker to view the contents of the mailbox, it must be exported as
"ftgate_dump.txt"
The attacker can then view the contents of the "ftgate_dump.txt" file by
making a request to 'ftgatedump.fts?command=1'. As described above, this
file may contain various FTGatePro configuration details that could be
used by an attacker to launch further attacks against a target system. If
viewing an exported mailbox, username and password data may also be
disclosed to an attacker.
It should be noted that the FTGate Pro WebAdmin Interface is not
accessible to the internet by default. However, this issue could still be
exploited by a user on an internal network.
27. Gordano Messaging Suite Alertlist.mml Information Disclosure...
BugTraq ID: 8579
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8579
Summary:
Gordano Messaging Suite is a messaging server that is compatible with
Windows, Linux, Sun Solaris and IBM AIX platforms. The suite provides
e-mail, instant messaging, SMS and antivirus services for its clients.
A vulnerability has been reported to be present in the Alertlist.mml
module of the software that may allow a user to access sensitive data
reserved for administration.
Alertlist.mml provides an administrator with information about users that
have logged in to the server. This data includes information such as
usernames,
domains, and logged in time. It has been reported that a user without
administrative privileges may access Alertlist.mml as the software fails
to carry out proper authentication when accessing Alertlist.mml.
This problem may result in an attacker gaining access to sensitive data
that may be used to launch further attacks against vulnerable hosts.
Gordano Messaging Suite version 9.0 has been reported to be prone to this
vulnerability, however other version may be affected as well.
28. IkonBoard Cookie Default Parameter Arbitrary Command Executi...
BugTraq ID: 8580
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8580
Summary:
IkonBoard is a Web Bulletin Board Service (BBS) software package written
in Perl that runs on several web server platforms.
It has been reported that IkonBoard may be prone to an arbitrary command
execution vulnerability. The vulnerability is reportedly due to
insufficient sanitization performed on user supplied 'default' cookie
data.
Specifically, a flaw has been reported in the pattern matching code
implemented to sanitize user-supplied cookie data before it is
interpolated into a string. An attacker may exploit this issue to execute
arbitrary commands. If the attacker supplies a malicious cookie that
contains illegal characters designed to break the sanitization
functionality of IkonBoard, the data will get passed as a value for
'$default', as part of an interpolated string to a Perl eval() function.
This circumstance could allow the attacker to have arbitrary Perl code
evaluated. Therefore arbitrary command execution may be possible in the
security context of the web server hosting the vulnerable IkonBoard.
This issue may be related to the issue described in BID 7361.
This vulnerability has been reported to affect IkonBoard version 3.1.2a;
previous versions are also reported to be affected.
29. Yak! Chat Client FTP Server Default Credentials Vulnerabilit...
BugTraq ID: 8581
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8581
Summary:
Yak! is a commercially-available chat client distributed by Digicraft
Software. It is available for the Microsoft Windows platform.
It has been reported that a vulnerability exists in the Yak! client client
FTP server. This problem may allow an attacker unauthorized access to
resources.
The problem is in the default credentials created with the Yak! FTP
server. When the FTP server is installed, it installs a user 'Yak' with
the password 'asd123' by default. This user is granted full access to the
file system on which the FTP server resides. The FTP server listens on
port 3535.
30. Net-SNMP Unauthorized MIB Object Access Vulnerability
BugTraq ID: 8582
Remote: Yes
Date Published: Sep 06 2003
Relevant URL: http://www.securityfocus.com/bid/8582
Summary:
Net-SNMP is a freely available, open source implementation of the SNMP
protocol. It was previously known as UCD-SNMP, and is available for the
Unix and Linux operating systems.
Net-SNMP is prone to a vulnerability that may permit an existing user or
community to gain unauthorized access to MIB objects. MIB objects that
are explicitly excluded from a user's or community's view may still be
accessed due to this vulnerability. This could potentially allow
malicious parties to gain read/write access to information contained in a
restricted MIB.
31. FutureWave WebX Server Directory Traversal Vulnerability
BugTraq ID: 8583
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8583
Summary:
FutureWave WebX Server is a web server application with ActiveX, SSI, and
CGI support.
A vulnerability is reported to exist in the software allowing a remote
attacker to access information outside the server root directory. The
problem occurs due to insufficient sanitization of user-supplied input.
This vulnerability may allow remote attackers to traverse outside the
server root directory by using '/../' character sequences.
This issue may allow an attacker to retrieve arbitrary server readable
file. Successful exploitation of this issue may allow an attacker to gain
access to sensitive information, which may be used to launch further
attacks against a vulnerable system.
FutureWave WebX Server 1.1 and WebX Lite have been reported to be prone to
this vulnerability, however other versions may be affected as well.
32. CacheFlow CacheOS HTTP HOST Proxy Vulnerability
BugTraq ID: 8584
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8584
Summary:
CacheOS is the firmware designed and distributed with CacheFlow web cache
systems. It is maintained and distributed by CacheFlow.
Malicious HTTP HOST header fields can be used on CacheOS to tunnel
arbitrary TCP connections through a HTTP request.
It has been reported that CacheFlow CacheOS may allow the misuse of the
HOST HTTP header value. The issue presents itself, likely due to design
error. A malicious request may target an arbitrary machine inside the
firewall, on an arbitrary port.
It has been demonstrated that a remote attacker may exploit this
vulnerability by making a malicious HTTP GET request to the affected
server; the request may contain an internal server as the HOST value of
the HTTP header, and valid SMTP data contained in the body of the request.
When submitted, the malicious request is proxied, including carriage
returns, to the internal mail server. This may provide for the use of an
internal mail server as an open relay for the purposes of sending
unsolicited mass email.
This BID may be related to the issue described in BID 4143.
It should be noted that while this vulnerability has been reported to
affect CacheOS Version SA 4.1.10016, on CacheFlow 7XX series server, other
versions may also be affected.
33. KokeshCMS Unauthorized Content Editing Vulnerability
BugTraq ID: 8585
Remote: Yes
Date Published: Sep 09 2003
Relevant URL: http://www.securityfocus.com/bid/8585
Summary:
KokeshCMS is a content management system that is implemented in PHP. It
is available for Microsoft Windows operating systems and Unix/Linux
variants.
KokeshCMS does not adequately secure access to the content editing script
(edit.php). The source of the problem is that KokeshCMS does not force
users to authenticate before granting access to the script. As a result,
remote users can access this script without needing to authenticate. A
remote attacker could exploit this issue to manipulate content on sites
managed by the software, for example, placing malicious or abusive content
on a site. This could pose an additional risk if users trust the site's
content.
34. b2evolution Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 8586
Remote: Yes
Date Published: Sep 09 2003
Relevant URL: http://www.securityfocus.com/bid/8586
Summary:
b2evolution is a PHP based software that allows users to create and manage
weblogs and newsfeeds.
Multiple cross-site scripting vulnerabilities have been reported in
b2evolution.
The vulnerabilities are caused by insufficient sanitization of
user-supplied data. HTML and script code will not be filtered from
externally supplied input before being displayed in web pages, therefore
allowing an attacker to construct a link containing malicious HTML or
script code to be executed in a user's browser upon visiting that link.
This attack would occur in the security context of the site running the
vulnerable version of b2evolution.
Successful exploitation of these issues may allow an attack to steal
cookie-based authentication credentials. Other attacks are possible as
well.
35. CmdFTP Store_Line() Heap Overflow Vulnerability
BugTraq ID: 8587
Remote: Yes
Date Published: Sep 08 2003
Relevant URL: http://www.securityfocus.com/bid/8587
Summary:
cmdftp is a command line FTP client for Linux.
cmdftp has been reported prone to a remote heap overflow vulnerability.
The issue presents itself likely due to insufficient boundary checks
performed by store_line() when handling ftp server directory listings.
Excessive data returned by a malicious FTP server, when an 'ls' command is
invoked, may overflow the bounds of a buffer in heap memory and result in
the corruption of adjacent heap memory management structures. Ultimately a
remote attacker may leverage this corruption to have supplied arbitrary
instructions executed in the context of the user who is running the
vulnerable FTP client.
This vulnerability has been reported to affect all versions of cmdftp
prior to version 0.641.
36. Pine Message/External-Body Type Attribute Buffer Overflow Vu...
BugTraq ID: 8588
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8588
Summary:
Pine is a freely available, open source Mail User Agent. It is
distributed by the University of Washington, and available for the Unix,
Linux, and Microsoft platforms.
A problem in Pine has been reported when handling "message/external body
type" attributes. Because of this, an attacker may be able to gain
unauthorized access to a host using the vulnerable software.
The problem is in the parsing of the name/value pairs. Due to improper
bounds checking, it is possible to supply a value in this field that
results in the overwriting of sensitive process memory. An attacker can
exploit this with a custom string to execute arbitrary code with the
privileges of the Pine user.
37. Pine rfc2231_get_param() Remote Integer Overflow Vulnerabili...
BugTraq ID: 8589
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8589
Summary:
Pine is an e-mail client program used with Linux and Unix distributions.
It has been reported that Pine is prone to an integer overflow condition
resulting in possible memory corruption and leading to arbitrary code
execution.
The vulnerability exists in the rfc2231_get_param() function present in
the strings.c file. The condition is triggered when a vulnerable user
opens a maliciously crafted e-mail message sent by a remote attacker. The
vulnerability exists due to insufficient bounds checking by the software
when parsing e-mail message headers. Due to the possibility of memory
corruption, an attacker may be able to execute arbitrary code in the
security context of the vulnerable version of Pine.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in order to gain unauthorized access to a vulnerable host.
38. MySQL Password Handler Buffer Overflow Vulnerability
BugTraq ID: 8590
Remote: Yes
Date Published: Sep 10 2003
Relevant URL: http://www.securityfocus.com/bid/8590
Summary:
MySQL is an open source relational database project. It is available for
the Microsoft Windows, Linux, and Unix operating systems.
MySQL server has been reported prone to a buffer overflow vulnerability
when handling user passwords of excessive size.
The issue presents itself, due to a lack of sufficient bounds checking
performed on MySQL user passwords that are stored in the 'Password' field
of the 'User' table in a MySQL database. It has been reported that MySQL
fails to properly perform bounds checking when processing passwords. A
password greater that 16 characters may overrun the bounds of a reserved
buffer in memory and corrupt adjacent memory. The buffer overflow occurs
in an ACL_USER instance of acl_init(), and may ultimately result in the
corruption of a saved instruction pointer.
An attacker with global administrative privileges on an affected MySQL
server may potentially exploit this condition to have arbitrary supplied
instructions executed in the context of the MySQL server.
This vulnerability has been reported to affect all versions of MySQL up to
and including 4.0.14 and 3.0.57.
39. b2evolution Multiple SQL Injection Vulnerabilities
BugTraq ID: 8591
Remote: Yes
Date Published: Sep 09 2003
Relevant URL: http://www.securityfocus.com/bid/8591
Summary:
b2evolution is a PHP based software that allows users to create and manage
weblogs and newsfeeds.
Multiple SQL injection vulnerabilities have been reported in b2evolution.
The vulnerabilities are caused by insufficient sanitization of
user-supplied data. The issues may allow an attacker to inject malicious
SQL syntax into database queries. The source of these issues is
insufficient sanitization of user-supplied input before including this
input in database queries. A remote attacker may exploit the issues to
influence SQL query logic.
These issues may allow an attacker to gain access to sensitive data stored
in the database. Other attacks on the underlying database are possible as
well.
40. Multiple Unspecified OSSIM SQL Injection Vulnerabilities
BugTraq ID: 8592
Remote: Yes
Date Published: Sep 09 2003
Relevant URL: http://www.securityfocus.com/bid/8592
Summary:
OSSIM is an open source program that is used to unify network monitoring
and management into one single tool.
Multiple unspecified SQL injection vulnerabilities have reported in
various regions of the OSSIM software. These issues may allow an attacker
to inject malicious SQL syntax into database queries. The issues likely
present themselves due to insufficient sanitization performed on
user-supplied input before including this input in database queries. A
remote attacker may exploit this issue to influence SQL query logic.
Exploitation of these issues may allow an attacker to gain access to
sensitive data stored in the database, bypass security restrictions, or
data manipulation. Other attacks on the underlying database may also be
possible.
41. Asterisk CallerID Call Detail Records SQL Injection Vulnerab...
BugTraq ID: 8599
Remote: Yes
Date Published: Sep 11 2003
Relevant URL: http://www.securityfocus.com/bid/8599
Summary:
Asterisk is a software-based PBX system, which is available for Linux
operating systems. Asterisk includes support for various protocols
including SIP, IAX v1 and v2, and H323. It is back-ended by a relational
database.
Call Detail Records (CDR) are used by telephone systems to record various
user data. This includes a variety of information, such as the CallerID
data.
Asterisk is prone to SQL injection attacks via malformed CDR data. The
vulnerability occurs due to insufficient sanitization of user-supplied
CallerID data and could allow for the execution of SQL commands on the
system hosting Asterisk. This could potentially be exploited by an
attacker to influence the logic of SQL queries or to exploit
vulnerabilities in the underlying database. Other attacks may also be
possible.
For an attacker to exploit this issue, it would have to be possible for
them to modify the CallerID data sent out by their phone system.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Lamo denies $300,000 database hack
By: Kevin Poulsen
The helpful hacker faces three years in prison for allegedly helping
himself to the New York Times' LexisNexis account and racking up $300,000
in charges -- a figure he says "has no factual basis."
http://www.securityfocus.com/news/6934
2. Lamo surrenders, is released
By: Kevin Poulsen
A federal judge frees the wandering hacker, but bars him from computers,
most travel and unemployment.
http://www.securityfocus.com/news/6907
3. Adrian Lamo charged with computer crimes
By: Kevin Poulsen
FBI agents armed with a federal arrest warrant were searching for the
helpful hacker Thursday, according to his family and a lawyer. Last year's
New York Times hack is the likely charge.
http://www.securityfocus.com/news/6888
4. White House selects Symantec executive as new cybersecurity ...
By: Ted Bridis, The Associated Press
http://www.securityfocus.com/news/6961
5. E-mail fraudsters target Barclays
By: John Leyden, The Register
http://www.securityfocus.com/news/6947
6. Wi-Fi whistle blower faces criminal charges
By: John Leyden, The Register
http://www.securityfocus.com/news/6946
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Private v0.5b
By: drugphish
Relevant URL: http://www.drugphish.ch/~jonny/private.html
Platforms: Linux, POSIX
Summary:
Private is a kernel module which uses the LSM hooks to implement
configurable, 4.4BSD-like securelevels for Linux. It gives users control
over ptrace, module loading/ unloading, mounting filesystems, file
permissions, and changing system time much like the securelevels known on
BSD systems.
2. Novosec Bouncy Castle Extensions v1.0
By: Johannes Nicolai
Relevant URL: http://www.sourceforge.net/projects/novosec-bc-ext/
Platforms: Os Independent
Summary:
Novosec Bouncy Castle Extensions provides some extensions to the Bouncy
Castle Cryptography framework. It features an OCSP (RFC 2560) server and
client that work with the Bouncy Castle OCSP generators and parsers, and a
full tested implementation of CMP (RFC 2510, RFC 2511) generator and
parser classes, that also rely on Bouncy Castle classes.
3. LinuxMagic magic-smtpd v0.7.2rc3
By: LinuxMagic Inc. <[email protected]>
Relevant URL: http://www.linuxmagic.com/opensource/magicmail/magic-smtpd/
Platforms: Linux, POSIX
Summary:
MAGIC-SMTPD is a drop-in replacement for Dan Bernstein's qmail-smtpd, and
was originally designed to be part of the LinuxMagic Magic Mail Server.
This opensource version has been released to allow others to benefit from
its anti-spam components, and valid user checking to reduce server loads
and spam volumes. It is designed to support stock qmail installations,
qmail/vpopmail installations, and database connectivity. Designed for ISP
service, this will work for all mail servers large and small.
4. GKrellM v2.1.18 (GTK 2.0)
By: Bill Wilson
Relevant URL: http://www.gkrellm.net/
Platforms: FreeBSD, Linux, NetBSD, OpenBSD, Solaris, SunOS
Summary:
GKrellM is a GTK-based stacked monitor program that charts SMP CPUs,
disks, load, active net interfaces, and internet connections. There are
also builtin monitors for memory and swap, file systems with mount/umount
feature, mailbox checking including POP3 and IMAP, clock/calendar, laptop
battery, sensors (temperatures, voltages, and fans), and uptime. It has
LEDs for the net monitors and an on/off button and online timer for PPP.
There is a GUI popup for configuration, plugin extensions can be
installed, and many themes are available. It also features a client/server
monitoring capability.
5. Tiny SHell v0.6
By: Christophe Devine
Relevant URL: http://www.cr0.net:8040/code/network/
Platforms: FreeBSD, IRIX, Linux, OpenBSD, Solaris, SunOS, UNIX
Summary:
Tiny SHell is a lightweight client/server clone of the standard remote
shell tools (rlogin, telnet, ssh, etc.). It provides remote shell
execution and file transfers. It is 8-bit clean, has full support for
pseudo-terminal pairs (pty/tty), and uses simple xor encryption. Most Unix
platforms are currently supported (Linux, BSD, OSF, SunOS, and IRIX).
6. iptables-control v1.0.6
By: Francesco 'StealthP' <[email protected]>
Relevant URL: http://devzone.stealthp.org/iptables-control
Platforms: Linux, POSIX
Summary:
Iptables-Control is a fast and easy iptables filter configurator It
features a step-by-step interactive configurator script, a TCP/UDP ports
configurator, LAN settings for routing and masquerading, and ICMP
filtering.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Job Search Resources (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337454
2. Sr SW Eng - Windows Domain Expert Silicon Valley CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337448
3. SW Vulnerability Detection Engineer Silicon Valley ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337445
4. QA Web Application Test Eng Silicon Valley CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337438
5. Results of the vote query (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337366
6. Sr. CISSP InfoSec engineer looking for opening (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337352
7. DBA/Sys admin wanted (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337347
8. Symantec Looking for Internal Enterprise Security Ad... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337345
9. Senior Security Engineer Silicon Valley CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337344
10. IT Audit (Mid-West) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337293
11. Software Security Architect (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337226
12. Sr. Security Software Developer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337225
13. Sales Engineer - San Francisco WLAN Security Company (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337224
14. CISO - East Wenatchee, Washington - EOE - Greythorn (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337223
15. Sr. IDS Engineer/Manager - Bethesda, MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337222
16. ISSO Opening - Reston, VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337221
17. Seattle, WA - 63-65K - Local Candidates Preferred - ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337220
18. Searching for Midwest US position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337219
19. Security Professional - over 20 years' experience no... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337218
20. London, UK - Security Laboratory Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337217
21. Seattle, WA - (1) Security Engineering Project Manag... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337128
22. Neoteris - Systems Engineer - Japan (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337124
23. IT Security Senior Manager, Systems Integrity - UK (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337117
24. Neoteris - Regional Sales Manager - NC/SC/TN (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337116
25. Position wanted - Security Engineer (CISSP) with 4+ ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337079
26. Security Pre Sales Engineer - Alameda, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337078
27. Implementation Project Manager - Security Software (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/337077
28. Senior Security Consultant (Unix) - Austin, TX (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336941
29. Penetration Tester vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336940
30. Several opp's for Security Engineers with Product De... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336881
31. HELP!, Desperately looking for DISTCAP Expert! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336880
32. Looking for a job position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336842
33. Voting on issues for this list and SecurityFocus (Se... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336826
34. Top Gun Intrusion Detection Tools Developer (High Ba... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336820
35. Vulnerability Assessment, Incident Respondents, Netw... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336796
36. Sr Network Security Engineers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336795
37. Director of Product Marketing/Management - Austin, T... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336786
38. Entry Level Security Analyst Positions (West VA & Ch... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336743
39. Seeking Security or Admin Position in the Washingto... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336741
40. Jobs in Forensics - UK but do not mind rellocating (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336739
41. Channel Manager- with direct exp. -Atlanta, GA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336738
42. Federal Sales position- DC area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336737
43. security professional needed in DC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336656
44. Maryland contract NT/2000 Security-recruiter (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336654
45. Seeking a Security Position (Mumbai India and ready ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336653
46. Maryland contract Database security-recruiter (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336601
47. New articles on SecurityFocus (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336593
48. Cisco/Pki/smartcard/checkpoint guru available in Tor... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/336480
VI. INCIDENTS LIST SUMMARY
--------------------------
1. Results of the vote query (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/337394
2. Cacheflow proxy abuse (revisited) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/337362
3. Strange Windows logon attempts (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/337131
4. New Article Announcement: Hardening the TCP/IP stack... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/337130
5. Canada Wardialer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/337081
6. Voting on issues for this list and SecurityFocus (In... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/336821
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Results of the vote query (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337376
2. Cannot access memory at address 0x90909090 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337375
3. Moozatech: MyServer Buffer Overflow vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337356
4. A strike against OISAFTEY is a strike for mankind...... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337329
5. 4D WebSTAR FTP Buffer Overflow. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337296
6. Windows 2003 Server - Defeating the stack protection... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337209
7. Half-Life client buffer overflow (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337207
8. Ethernet ( MAC ) Address Reliability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337206
9. EEYE: Microsoft RPC Heap Corruption Vulnerability - ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337204
10. win32 call dword ptr [eax] help needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/337203
11. Voting on issues for this list and SecurityFocus (Vu... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/336814
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. windows 2000 security logs (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/337444
2. Disabling sharing and group policies (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/337441
3. Security for Win XP Home (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/337312
4. GPO for one machine (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/337289
5. RE: Disabling sharing and group policies (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/337182
6. Domain vs. Local security policy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336996
7. Disable USB on a per user basis? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336930
8. Limiting users on secific machines that are part of ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336813
9. Voting on issues for this list and SecurityFocus (Fo... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336810
10. SecurityFocus Microsoft Newsletter #153 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336759
11. Possible information leakage from DNS quirks (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336536
12. SecurityFocus Microsoft Newsletter #152 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/336508
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Building Sentry Systems (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/336911
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Accessing file server (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/336910
2. Voting on issues for this list and SecurityFocus (Fo... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/336843
XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Solsoft
How fast can you respond to security alerts from anti-virus or SIM
engines?
**Attend a FREE webinar and learn how Solsoft can help you:
- Black list suspicious IP addresses in seconds
- Shut down access across multiple devices at once in case of a worm
attack
- Escalate from one security policy to another based on threat levels
- Instantly deploy error-proof ACLs, NAT, and IPSec VPN rules
**More information and registration at:
http://www.securityfocus.com/sponsor/Solsoft_sf-news_000101
------------------------------------------------------------------------