SecurityFocus Newsletter #215

John Boletta <[email protected]> Mon, 22 Sep 2003 12:09:40 -0600 (MDT)

Newsgroups	gmane.comp.security.news.general
Message-ID	<[email protected]>

SecurityFocus Newsletter #215
------------------------------

This Issue is Sponsored By: AirDefense

*** Technical White Paper - Wireless LAN Layers of Security ***

Gartner & other industry experts suggest a layered approach for security &
management of wireless LANs:
* Secure WLAN Devices - Lock-down & secure access points & laptops
* Secure Communication - Encryption & Authentication for data integrity
* Network Monitoring - Detect rogues, block intruders & enforce policy

Click here to request this complimentary technical white paper.
http://www.securityfocus.com/sponsor/AirDefense_sf-news_030922
------------------------------------------------------------------------------------------------------------------------------------------------
I. FRONT AND CENTER
1. Wireless Policy Development (Part One)
2. Does Microsoft Give a Damn?
3. SPECIAL ANNOUNCEMENT
II. BUGTRAQ SUMMARY
1. 4D WebSTAR FTP Remote Long Password Buffer Overrun Vulnerabi...
2. Man Utility MANPL Environment Variable Buffer Overrun Vulner...
3. myServer cgi-lib.dll Remote Buffer Overflow Vulnerability
4. vbPortal Authentication SQL Injection Vulnerability
5. HP Tru64 NFS AdvFS File Denial Of Service Vulnerability
6. Sun Solaris SAdmin Client Credentials Remote Administrative ...
7. SCO OpenServer 'mana' REMOTE_ADDR Authentication Bypass Vuln...
8. WideChapter HTTP Request Buffer Overflow Vulnerability
9. SCO OpenServer 'mana' PATH_INFO Privilege Escalation Vulnera...
10. MiniHTTPServer WebForums/File-Sharing for NET Servers Direct...
11. MiniHTTPServer WebForums Server Default Password Vulnerabili...
12. DSPAM Insecure Default Permissions Privilege Escalation Vuln...
13. Nokia Electronic Documentation Directory Disclosure Vulnerab...
14. Nokia Electronic Documentation Connection Redirection Vulner...
15. Nokia Electronic Documentation Cross-Site Scripting Vulnerab...
16. ChatZilla Remote Denial of Service Attack
17. OpenSSH Buffer Mismanagement Vulnerabilities
18. Liquid War HOME Environment Variable Buffer Overflow Vulnera...
19. Spider HOME Environment Variable Heap Overflow Vulnerability...
20. Spider OPENWINHOME/XVIEWHOME Environment Variables Buffer Ov...
21. EFS Software Easy File Sharing Web Server Directory Traversa...
22. MiniHTTPServer WebForum Server Unauthorized Administrative A...
23. Yahoo! Webcam ActiveX Control Buffer Overrun Vulnerability
24. KDE KDM PAM Module PAM_SetCred Privilege Escalation Vulnerab...
25. KDE KDM Session Cookie Generation Weakness
26. NetWin DBabble Cross-Site Scripting Vulnerability
27. SGI IRIX NFS Export Unauthorized Read/Write Mount Vulnerabil...
28. Symantec AntiVirus For Handhelds Auto-Protect Scanning Weakn...
29. Symantec AntiVirus For Handhelds Scanning Bypass Vulnerabili...
30. Sendmail Prescan() Variant Remote Buffer Overrun Vulnerabili...
31. Lucent MAX TNT Universal Gateway Hang-Up Redial Administrati...
32. NetBSD Sysctl Argument Handling Vulnerabilities
33. Plug and Play Web Server Directory Traversal Vulnerability
34. IBM AIX lpd Local Format String Vulnerability
35. Multiple Mambo Open Source 4.0.14 Server Vulnerabilities
36. IBM AIX tsm Utility Local Format String Vulnerability
37. Sendmail Ruleset Parsing Buffer Overflow Vulnerability
38. Mondosoft MondoSearch Unspecified Access Validation Error
39. HLSW RCON Console Password Disclosure Weakness
40. Novell NetWare TCP Potential Vulnerabilities
III. SECURITYFOCUS NEWS ARTICLES
1. Accused AOL phisher spammed the FBI
2. Verisign's 'SiteFinder' finds privacy hullabaloo
3. Lamo denies $300,000 database hack
4. Baltimore sells 'crown jewels'
5. Oi! *Nix admin, get patching
6. Blaster trial set for November 17
IV. SECURITYFOCUS TOP 6 TOOLS
1. File::Scan v0.66
2. JSch v0.1.8
3. NuFW v0.4
4. Astaro Security Linux (Stable 4.x) v4.014
5. XML Security Library v1.1.2
6. Traffic tool Troll v1.2
V. SECURITYJOBS LIST SUMMARY
1. HIDS / IPS Business Development Manager - NYC, NJ (Thread)
2. Security/Network position in Fort Worth, Texas (Thread)
3. Position available immediately: DC-centered pre-sal... (Thread)
4. Sales Engineer - New York, NY (Thread)
5. Seattle, WA - Security Consultant (Thread)
6. SR. SYSTEMS SECURITY ARCHITECT - Santa Clara, CA (mu... (Thread)
7. Seeking Network Security Position in the New Jersey ... (Thread)
8. Security Administrator - Minneapolis (Thread)
9. Madison, WI - MSSP / Network Security Engineer (Thread)
10. SQA Test Team Lead - Web Security (Thread)
11. Seeking Secuity Position in Houston (Thread)
12. FW: Qwest Communications Seeks Director, IT Security (Thread)
13. Security SE for Sacarmento (Thread)
14. Seeking Secuirty Product Management Role (Thread)
15. Security Engineer - Knoxville, TN (Thread)
16. Job Search Resources (Thread)
17. US-CT-Stamford: Security Architect (Thread)
18. Ditscap or Niacap Expert Needed! (Thread)
19. Sr CISSP InfoSec Engineer looking for opening (Thread)
20. Wireless Security Engineer (TS/SCI required) (Thread)
21. Sr. IDS Manager/Engineer - Bethesda, MD (Thread)
22. ISSO/ISSM Security Opening - Reston, VA (Thread)
23. Microsoft Security Architect - Brooklyn, NY (Thread)
24. Perimeter Security Engineer/ Unix - Brooklyn, NY $1... (Thread)
25. Telecomms Security Audit Middle East ( Contract ) (Thread)
26. Technical Marketing Engineer - Silicon Valley - Neot... (Thread)
27. Sales Engineers CA and MA (Thread)
28. Senior Systems Security Engineer in New Orleans, LA (Thread)
29. Sr. Forensics Specialist with Verizon Wireless (Thread)
VI. INCIDENTS LIST SUMMARY
1. New virus disguised as Microsoft patch? (Thread)
2. NDRs from spamming (Thread)
3. RES: NDRs from spamming (Thread)
4. strange HTTP requests (Thread)
5. Strange Pix message (Thread)
6. [inbox] Strange Pix message (Thread)
7. Strange Pix message <-- Pix-Bug: CSCdz66410 (Thread)
8. compromised RealServer 8 *followup* (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. controlling ebp/eip of a frame, does it always lead ... (Thread)
2. OpenSSH Vulnerability (Thread)
3. [PAPER]: Integer array overflows. (Thread)
4. Ethernet ( MAC ) Address Reliability (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Disabling Internet Explorer "Save my password" check... (Thread)
2. Disabling sharing and group policies (Thread)
3. Blank passwords, TsInternetUser added to Administrat... (Thread)
4. Why Programs get written to need admin priveleges. (Thread)
5. SecurityFocus Announcement: New Mailing Lists (Thread)
6. SecurityFocus Microsoft Newsletter #154 (Thread)
IX. SUN FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2003-09-15 to 2003-09-22.
X. LINUX FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2003-09-15 to 2003-09-22.
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Wireless Policy Development (Part One)
By Jamil Farschi

This is the first of a two-part series that will help create a framework
for the most important aspect of any wireless security strategy -- policy
development.

http://www.securityfocus.com/infocus/1732

2. Does Microsoft Give a Damn?
By George Smith

The software-maker's dismal security record seems to have left it immune
to criticism and shame.

http://www.securityfocus.com/columnists/185

3. SPECIAL ANNOUNCEMENT

We are pleased to announce that The Basics infocus area has been renamed
to Foundations, in order to accommodate a wider range of security-related
articles that are not necessarily basic, but do not fit into one of the
seven other infocus areas either.

http://www.securityfocus.com/basics

II. BUGTRAQ SUMMARY
-------------------
1. 4D WebSTAR FTP Remote Long Password Buffer Overrun Vulnerabi...
BugTraq ID: 8601
Remote: Yes
Date Published: Sep 12 2003
Relevant URL: http://www.securityfocus.com/bid/8601
Summary:
4D WebSTAR FTP is an FTP server available for the MacOS X operating
system.

A buffer overrun has been reported for 4D WebSTAR FTP. The problem is said
to occur due to insufficient bounds checking when handling excessive data
as the user-supplied password. An attacker could trigger this condition by
supplying excessive data to the FTP PASS command.

As a result of this vulnerability, an attacker may be capable of
corrupting sensitive stack memory in such a way that the execution flow of
the WebSTAR process can be controlled. This could ultimately allow for the
execution of arbitrary code with the privileges of the FTP service,
typically the 'webstar' user.

2. Man Utility MANPL Environment Variable Buffer Overrun Vulner...
BugTraq ID: 8602
Remote: No
Date Published: Sep 12 2003
Relevant URL: http://www.securityfocus.com/bid/8602
Summary:
The man utility is used for formatting and displaying various system
manuals and documentation. It is possible to specify the length of lines
to display using the MANPL environment variables.

It has been reported that the man utility may be prone to a buffer overrun
conditon, when handling environment variable data. The problem is said to
specifically occur due to insufficient bounds checking when handling data
stored within the MANPL variable.

As a result of this issue, a local attacker may be capable of executing
arbitrary code with the privileges of man, typically setgid 'man'. This
could be accomplished by placing approximately 128 or more bytes of data,
within the affected environment variable, and invoking man.

It should be noted that some vendors are said to apply a patch to affected
man releases, however some systems may still deploy the vulnerable version
with setgid privileges.

3. myServer cgi-lib.dll Remote Buffer Overflow Vulnerability
BugTraq ID: 8612
Remote: Yes
Date Published: Sep 12 2003
Relevant URL: http://www.securityfocus.com/bid/8612
Summary:
myServer is an application and web server for Microsoft Windows and Linux
operating systems.

myServer has been reported prone to a remote buffer overflow
vulnerability. This issue is reported to exist in the cgi-lib.dll file.

The issue presents itself when the software attempts to process string
values of excessive length for URI variables. This will cause adjacent
regions of memory to be corrupted with data contained in the malicious
string. This will likely result in a crash due to the server attempting
to dereference an invalid memory address. However, it is possible that
this vulnerability may also allow the execution of arbitrary instructions
since the attacker may be able to leverage memory corruption to control
execution flow of the server process. Any instructions carried out
through this vulnerability would be with the privileges of the web server
process. However, the possibility of code execution has not been
confirmed.

This vulnerability was reported for myServer version 0.4.3 and earlier.

4. vbPortal Authentication SQL Injection Vulnerability
BugTraq ID: 8613
Remote: Yes
Date Published: Sep 12 2003
Relevant URL: http://www.securityfocus.com/bid/8613
Summary:
vbPortal is a portal application which can be used in conjunction with
vbBulletin forums.

It has been reported that vbPortal is prone to SQL injection attacks when
authentication users. The problem occurs due to insufficient sanitization
of the $aid variable, used to store the name of the authenticating user.
Specifically, slashes are not placed into the value of $aid to terminate
any control characters after the data has been base64 decoded. The
exploitable SQL query can be seen below:

$result=mysql_query("SELECT password as pwd FROM user WHERE username =
'$aid'");

As a result, an attacker may supply data within the username designed to
prematurely terminate the string, and influence the logic of this SQL
query. This may be exploited to expose sensitive information, or
potentially to launch attacks against the underlying database.

This issue can be exploited by making a malicious HTTP request to the
auth.inc.php script, including a base64 encoded payload embedded within
the 'admin' URI parameter.

5. HP Tru64 NFS AdvFS File Denial Of Service Vulnerability
BugTraq ID: 8614
Remote: Yes
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8614
Summary:
Tru64 is one of the Unix operating system variants maintained and
distributed by HP.

A problem in the handling of AdvFS file manipulation has been identified
in HP Tru64 versions. This issue may make it possible for an attacker to
deny service to legitimate users of the system.

The problem is in the handling of file size increases. Though specific
details are unavailable, it is known that a memory corruption error occurs
when a non-Tru64 NFS client attempts to increase the size of an AdvFS
file. This could cause a crash of the NFS service, and potentially the
system.

This is possibly a boundary condition error, and a chance of code
execution may exist. This theory has not been confirmed.

6. Sun Solaris SAdmin Client Credentials Remote Administrative ...
BugTraq ID: 8615
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8615
Summary:
Solaris is the Unix operating system variant maintained and distributed by
Sun Microsystems.

A problem has been discovered in the Sun Solaris sadmin service. Because
of this issue, it may be possible for a remote user to gain unauthorized
administrative access.

The problem is in the handling authentication credentials. sadmin does
not properly validate credentials supplied by the sadmin client. Because
of this, an attacker could supply a spoofed hostname and domain while
accessing the service, circumventing any access restrictions the service
may have in place.

It should be noted that the sadmin service is enabled by default.

7. SCO OpenServer 'mana' REMOTE_ADDR Authentication Bypass Vuln...
BugTraq ID: 8616
Remote: No
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8616
Summary:
OpenServer is a commercially available UNIX operating system distributed
and maintained by SCO. Internet Manager allows users to configure and
manage Internet and intranet servers.

A vulnerability has been reported in the SCO Internet Manager 'mana'
program for OpenServer. This problem may make it possible for an attacker
to gain unauthorized privileges on a vulnerable system.

It has been reported that mana as an administrative process is executed
via ncsa_httpd daemon on TCP port 615. Credentials are normally required
to run mana, however, it may be possible to execute mana locally without
requiring authentication credentials. The source of this issue is that a
local user is able to export the REMOTE_ADDR environment variable and set
it as localhost (127.0.0.1). This would allow an attacker to execute the
file 'menu.mana' via ncsa_httpd privileges without proper authentication.

Exploitation could lead to further attacks, including execution of
arbitrary code (as described in BID 8618).

8. WideChapter HTTP Request Buffer Overflow Vulnerability
BugTraq ID: 8617
Remote: Yes
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8617
Summary:
WideChapter is a multi Chapter multi tab web browser, available for
Microsoft Windows platforms.

WideChapter has been reported prone to a buffer overflow vulnerability
when handling HTTP requests of excessive length.

It has been reported that the condition may be triggered remotely when a
malicious website is rendered in the affected browser. An HTTP request of
>= 517 bytes, invoked by a window.open() script function, will overrun the
bounds of a reserved stack based buffer in WideChapter and corrupt
adjacent memory. Because memory adjacent to this buffer has been reported
to contain a saved instruction pointer, it is likely that a remote
attacker may influence execution flow, and although unconfirmed may likely
execute arbitrary instructions in the context of the user who is running
the affected browser.

This vulnerability has been reported to affect WideChapter version 3, and
prior versions.

9. SCO OpenServer 'mana' PATH_INFO Privilege Escalation Vulnera...
BugTraq ID: 8618
Remote: No
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8618
Summary:
OpenServer is a commercially available UNIX operating system distributed
and maintained by SCO. Internet Manager allows users to configure and
manage Internet and intranet servers.

A vulnerability has been reported in the SCO Internet Manager 'mana'
program for OpenServer. This problem may make it possible for an attacker
to gain unauthorized privileges on a vulnerable system.

It has been reported that mana as an administrative process is executed
via ncsa_httpd daemon on TCP port 615. mana normally requires
authentication to use but may be executed locally without needing to
supply credentials via exploitation of BID 8616.

The source of the issue is that a local user may specify the search path
for an executable that will be run by mana with elevated privileges. This
may be accomplished by changing the PATH_INFO environment variable to
/pass-err.mana and PATH environment variable to PATH to ./:$PATH. This
would allow an attacker to execute an attacker-specified file named
'hostname' with root privileges without requiring authentication.

Successful exploitation of this vulnerability may allow an attacker to
execute code with elevated privileges.

10. MiniHTTPServer WebForums/File-Sharing for NET Servers Direct...
BugTraq ID: 8619
Remote: Yes
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8619
Summary:
WebForums Server is a commercially-available HTTP server. It is available
for the Microsoft Windows platform. File-Sharing for NET is a
commercially-available web server mainly designed for file sharing.

A vulnerability is reported to exist in the software allowing a remote
attacker to access information outside the server root directory. The
problem occurs due to insufficient sanitization of user-supplied input.
This vulnerability may allow remote attackers to traverse outside the
server root directory by using '/../' character sequences.

This issue may allow an attacker to retrieve arbitrary server-readable
files. Successful exploitation of this issue may allow an attacker to gain
access to sensitive information, which may be used to launch further
attacks against a vulnerable system.

MiniHTTPServer WebForums Server 1.5 and prior and File-Sharing for NET 1.5
and prior have been reported to be prone to this issue.

11. MiniHTTPServer WebForums Server Default Password Vulnerabili...
BugTraq ID: 8620
Remote: Yes
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8620
Summary:
WebForums Server is a commercially available HTTP server. It is available
for the Microsoft Windows platform.

A vulnerability has been reported for WebForums server. Reportedly, the
database's administrative user, the 'admin' account, is created by default
during installation and is assigned a '"' password.

A remote attacker can exploit this vulnerability by connecting to a
vulnerable system's as an administrative user, and supplying a '"'
character as a password. The attacker may gain administrative access on a
default installation. It has been reported that attributes for this
account include the ability to access the local 'C:\' drive.

This vulnerability has been reported to exist in WebForums Server 1.5 and
prior.

12. DSPAM Insecure Default Permissions Privilege Escalation Vuln...
BugTraq ID: 8623
Remote: No
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8623
Summary:
DSPAM is an anti-spam application designed for use with most Unix mail
applications. Beginning with DSPAM 2.6.5, an option was included in the
program that allows a user to supply a delivery agent and quarantine agent
via the command-line.

A vulnerability has been reported for DSPAM that may allow an attacker to
execute arbitrary code with elevated privileges. The issue lies in the
fact that DSPAM is installed world-executable and setgid by default.

As a result, an unprivileged attacker may supply a malicious executable to
the application, as an argument when specifying a delivery or quarantine
agent. When invoked, the executable will be run with the group privileges
of DSPAM, typically mail.

This privilege escalation could assist in further attacks launched against
a target system.

13. Nokia Electronic Documentation Directory Disclosure Vulnerab...
BugTraq ID: 8624
Remote: Yes
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8624
Summary:
Nokia Electronic Documentation (NED) is a web-based documentation
interface for
Nokia products. NED is typically deployed on production networks for
telecom operators.

NED is prone to a vulnerability that may enable remote attackers to list
directory contents for the web root directory. This issue may be
exploited by appending a dot (.) to a request for a NED page.
Exploitation will also have the side-effect of disclosing the path to the
directory.

This issue could be exploited to gather information about the NED
installation and the underlying file system, which could be useful in
mounting further attacks against the system.

This issue was reported for NED installations hosted on WebLogic
application servers. It is not known if NED is prone to the same behavior
when hosted on other servers. It should be noted that although this
vulnerability has been reported to affect Nokia Electronic Documentation
version 5.0, previous versions might also be affected.

14. Nokia Electronic Documentation Connection Redirection Vulner...
BugTraq ID: 8625
Remote: Yes
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8625
Summary:
Nokia Electronic Documentation (NED) is a web-based documentation
interface for
Nokia products. NED is typically deployed on production networks for
telecom operators.

A vulnerability has been discovered in Nokia Electronic Documentation
(NED) that may allow an attacker to redirect connections to external
systems. The problem likely occurs due to the NED server failing to
sufficiently verify hosts provided within specific HTTP requests.
Specifically, by making an HTTP request to NED that includes the 'action'
and 'location' URI parameters, it is possible to carry out a specific
action on a defined location.

As a result, an attacker may be capable of making a request that would
cause data to be redirected to other systems. This may allow an attacker
to interact with an otherwise inaccessible system, or potentially hide the
origin of attacks launched against other targets.

15. Nokia Electronic Documentation Cross-Site Scripting Vulnerab...
BugTraq ID: 8626
Remote: Yes
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8626
Summary:
Nokia Electronic Documentation (NED) is a web-based documentation
interface for
Nokia products. NED is typically deployed on production networks for
telecom operators.

Nokia Electronic Documentation has been reported prone to a cross-site
scripting vulnerability. The issue has been conjectured to present itself
due to a lack of sufficient sanitization performed on user supplied data.

A remote attacker may exploit this issue by enticing a target user to
follow a malicious link to the affected Nokia Electronic Documentation
site, which contains embedded HTML and script code. The attacker-supplied
code would potentially be rendered in the user's browser when the link is
followed.

This issue could potentially be exploited to steal cookie-based
authentication credentials from a legitimate user. Other attacks may also
be possible.

It should be noted that although this vulnerability has been reported to
affect Nokia Electronic Documentation version 5.0, previous versions might
also be affected.

16. ChatZilla Remote Denial of Service Attack
BugTraq ID: 8627
Remote: Yes
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8627
Summary:
ChatZilla is an IRC-client for Linux operating systems. ChatZilla is
based on JavaScript and XUL and it is shipped with Mozilla web browser.

A vulnerability has been reported to exist in the software, that may allow
a remote attacker to cause a denial of service condition in ChatZilla.
The issue presents itself when a remote attacker posing as an IRC server
sends specially crafted requests containing long string values to a
vulnerable system. The attack may cause the software to behave in an
unstable manner leading to a crash.

Successful exploitation of this vulnerability may allow a remote attacker
to cause the vulnerable software to crash.

It is not known if this condition could also be exploited to execute
arbitrary code on the client.

ChatZilla versions 0.8.23 and prior are reported to be prone to this
issue.

17. OpenSSH Buffer Mismanagement Vulnerabilities
BugTraq ID: 8628
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8628
Summary:
A buffer mismanagement vulnerability has been reported in OpenSSH. This
issue exists in the 'buffer.c' source file.

The source of a problem is that a buffer structure size value may be
expanded before the program attempts to reallocate the buffer using this
size. If the expanded buffer size triggers a call to fatal(), a series of
cleanup functions registered by the daemon will be called prior to exiting
the program. As one of these functions may then reference the data within
the buffer, including the unused expanded value, a miscalculation could
potentially occur. Depending on how the cleanup functions reference this
data, it may be theoretically possible for heap-based memory to be
corrupted. This condition can reportedly be triggered by an overly large
packet.

External sources, including the vendor, do not believe that this issue
could be exploited to execute arbitrary code though it may potentially be
used to cause a denial of service.

There are also unconfirmed rumors of an exploit for this vulnerability
circulating in the wild. The impact may be reduced by the implementation
of privilege separation on affected versions of OpenSSH.

OpenSSH has revised their advisory, pointing out a similar issue in the
channels.c source file and an additional issue. Solar Designer has also
reportedly pointed out additional instances of the problem that may also
present vulnerabilities. Individual BIDs will be created for these
additional issues when further analysis is complete.

18. Liquid War HOME Environment Variable Buffer Overflow Vulnera...
BugTraq ID: 8629
Remote: No
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8629
Summary:
Liquid War is multiplayer computer game available for multiple platforms.

Liquid War has been reported prone to a buffer overflow condition when
handling HOME environment variables of excessive length.

The issue presents itself, due to a lack of sufficient boundary checks
performed on data contained in the HOME environment variable before it is
copied into a reserved buffer in stack based memory. Data that exceeds the
size of the affected buffer may overrun its bounds and corrupt adjacent
memory. It has been reported that a local attacker may exploit this
condition to execute arbitrary instructions with GID Games privileges.

It should be noted that although this vulnerability has been reported to
affect Liquid War version 5.4.5 other versions might also be affected.

19. Spider HOME Environment Variable Heap Overflow Vulnerability...
BugTraq ID: 8630
Remote: No
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8630
Summary:
Spider is a solitaire game for the X Window System. It is distributed as
part of the Debian Linux distribution.

Spider has been reported prone to a heap overflow condition when handling
HOME environment variables of excessive length.

The issue presents itself, because a call to calloc() allocates
'(strlen(str) + 256)' bytes as a buffer size, it is possible for an
attacker to trigger the allocation of an insufficient buffer, by crafting
a value for the 'str' variable that contains, '~/' sequences, these
sequences will later be expanded to equal the data contained in the 'HOME'
environment variable. An attacker may lever this condition to corrupt
adjacent malloc chunk headers with attacker-supplied data.

Although unconfirmed ultimately it may be possible that a local attacker
may exploit this condition to execute arbitrary instructions with GID
Games privileges.

It should be noted that although this vulnerability has been reported to
affect Spider version 1.1 other versions might also be affected.

20. Spider OPENWINHOME/XVIEWHOME Environment Variables Buffer Ov...
BugTraq ID: 8631
Remote: No
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8631
Summary:
Spider is a solitaire game for the X Window System. It is distributed as
part of the Debian Linux distribution.

Spider has been reported prone to a buffer overflow condition when
handling OPENWINHOME or XVIEWHOME environment variables of excessive
length.

The issue presents itself, due to a lack of sufficient boundary checks
performed on data contained in the OPENWINHOME or XVIEWHOME environment
variables before they are copied as part of an interpolated string into a
reserved 256 byte buffer in stack based memory.

Data that exceeds the size of the affected buffer may overrun its bounds
and corrupt adjacent memory. It has been reported that a local attacker
may exploit this condition to execute arbitrary instructions with GID
Games privileges.

It should be noted that although this vulnerability has been reported to
affect Spider version 1.1 other versions might also be affected.

21. EFS Software Easy File Sharing Web Server Directory Traversa...
BugTraq ID: 8632
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8632
Summary:
Easy File Sharing Web Server is a commercially-available web server
software package distributed by EFS Software. It is available for the
Microsoft Windows platform.

A problem has been reported in the handling of specific types of requests
in EFS Software Easy File Sharing Web Server. Because of this, an
attacker may be able to gain unauthorized access to system resources.

The problem is in the handling of directory traversal requests. Upon
placing a request to the server with dot-dot-slash notation, it is
possible to escape the web root directory and gain access to files on the
local system. Access to files is limited to those readable by the web
server process user. This may be SYSTEM level in some configurations.

22. MiniHTTPServer WebForum Server Unauthorized Administrative A...
BugTraq ID: 8633
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8633
Summary:
MiniHTTPServer WebForum Server is a web-based bulletin board system
available for the Microsoft Windows operating system.

A vulnerability has been reported for MiniHTTPServer WebForum Server that
may allow an attacker to log in as an administrator. The problem occurs
due to the software failing to sufficiently validate administrative
credentials. Specifically, if a quote character (") is supplied as the
administrator password, the user may be incorrectly authenticated.

This could ultimately allow for an unauthorized to carry out attacks
against the WebForum Server with administrator privileges, potentially
accessing sensitive information or destroying data. Other attacks would
also be possible.

23. Yahoo! Webcam ActiveX Control Buffer Overrun Vulnerability
BugTraq ID: 8634
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8634
Summary:
Yahoo! Messenger and Yahoo! Chat both implement the use of a Webcam
ActiveX control. The Webcam control can also be installed for stand-alone
use.

A buffer overrun has been discovered in the Yahoo! Webcam ActiveX control.
The problem occurs due to insufficient bounds checking when handling a
user-supplied 'TargetName' property. As a result, depending on the length
of the value a buffer overrun may be triggered within stack or heap
memory.

An attacker could potentially exploit this issue to execute arbitrary
code, with the context of a victim users web browser.

24. KDE KDM PAM Module PAM_SetCred Privilege Escalation Vulnerab...
BugTraq ID: 8635
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8635
Summary:
KDM is the KDE Display Manager, a component of the KDE Desktop
Environment. It is available for Linux/Unix operating systems. KDM
provides a graphical login interface for KDE.

A problem has been reported in the KDE Display Manager (KDM) when used in
combination with Pluggable Authentication Modules (PAM). Because of this,
an attacker may be able to gain unauthorized access to systems.

The problem is in the handling of specific authentication requests passed
through pam_setcred. Under some circumstances, the results of the
pam_setcred call is not checked. An attacker could create a malicious
request that circumvents authentication checking to gain unauthorized
access to a system.

It should be noted that this problem occurs when KDM is used in
combination with the pam_krb5 module.

25. KDE KDM Session Cookie Generation Weakness
BugTraq ID: 8636
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8636
Summary:
KDM is the KDE Display Manager, a component of the KDE Desktop
Environment. It is available for Linux/Unix operating systems. KDM
provides a graphical login interface for KDE.

KDM uses a weak algorithm to generate session cookies. In particular, the
session cookie generation algorithm is not sufficient for generating 128
bits of entropy. This may potentially make brute-forcing of session
cookies a practical endeavor, inevitably enabling an adversary to hijack a
KDM user session.

For exploitation to be successful, the adversary must also be able to
bypass any host-based restrictions. It is most likely that a malicious
local user could potentially exploit this to gain unauthorized access to
another user's existing session.

26. NetWin DBabble Cross-Site Scripting Vulnerability
BugTraq ID: 8637
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8637
Summary:
DBabble is a chat server implementation maintained and distributed by
NetWin. It is available for the Microsoft Windows platform.

A cross-site scripting problem has been reported in NetWin DBabble. This
could make it possible for an attacker to potentially execute HTML and
script code in the security context of a site using the vulnerable
software.

The problem is in the handling of input passed to the cmd URI parameter.
Input passed through this parameter is not properly sanitized, making it
possible to include HTML through this parameter via a malicious link. An
attacker could use this to render arbitrary HTML in the browser of a
victim, stealing cookie authentication credentials or performing other
nefarious acts.

27. SGI IRIX NFS Export Unauthorized Read/Write Mount Vulnerabil...
BugTraq ID: 8638
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8638
Summary:
SGI IRIX is a commercial Unix-derived operating system. It provides its
own NFS (Network File System) implementation.

SGI IRIX is prone to an issue in its NFS implementation that could allow
file systems to be mounted with incorrect permissions. Specifically, an
NFS client could potentially gain read/write access to a read-only file
system that has been exported from a system running the vulnerable NFS
implementation. This could permit unauthorized write access to said file
systems.

This vulnerability is reported to only affect SGI IRIX 6.5.21.

28. Symantec AntiVirus For Handhelds Auto-Protect Scanning Weakn...
BugTraq ID: 8639
Remote: No
Date Published: Sep 17 2003
Relevant URL: http://www.securityfocus.com/bid/8639
Summary:
Symantec AntiVirus for Handhelds is an anti-virus program for PocketPC and
Palm compatible PDAs.

The Auto-Protect feature of Symantec AntiVirus for Handhelds reportedly
fails to detect malicious code when it is loaded into memory, even if
there are existing anti-virus definitions or heuristic detections. The
discoverer of this weakness tested the issue with an 'eicar.exe' test
file. The Auto-Protect feature may fail to adequately protect handheld
systems as a result.

After further review, this BID will be retired. The Auto-Protect feature
of Symantec AntiVirus for Handhelds is meant to detect malicious code in
real time as it is being saved to the device. Since malicious code would
first have to be saved to the device before it could be loaded into
memory, this scenario could not occur.

29. Symantec AntiVirus For Handhelds Scanning Bypass Vulnerabili...
BugTraq ID: 8640
Remote: Yes
Date Published: Sep 17 2003
Relevant URL: http://www.securityfocus.com/bid/8640
Summary:
Symantec AntiVirus for Handhelds is an anti-virus program for PocketPC and
Palm compatible PDAs.

The Symantec AntiVirus For Handhelds scanning engine may fail to detect
variations of malicious code that definitions or heuristic detections
exist for.

The discoverer of this vulnerability tested the issue on the EICAR test
virus. Reportedly, it is possible to bypass the scanner by adding a few
random bytes of data before and after the test string.

After further review, this BID will be retired. When the EICAR test file
is modified, it is no longer considered to be the EICAR test file and
should not be detected by antivirus software.

From http://www.eicar.org/anti_virus_test_file.htm:

"The first 68 characters is the known string. It may be optionally
appended by any combination of whitespace characters with the total file
length not exceeding 128 characters. The only whitespace characters
allowed are the space character, tab, LF, CR, CTRL-Z. To keep things
simple the file uses only upper case letters, digits and punctuation
marks, and does not include spaces. The only thing to watch out for when
typing in the test file is that the third character is the capital letter
"O", not the digit zero."

For more information regarding the EICAR test file, see
http://www.eicar.org.

30. Sendmail Prescan() Variant Remote Buffer Overrun Vulnerabili...
BugTraq ID: 8641
Remote: Yes
Date Published: Sep 17 2003
Relevant URL: http://www.securityfocus.com/bid/8641
Summary:
Sendmail is prone to a buffer overrun vulnerability in the prescan()
function. This issue is different than the vulnerability described in BID
7230. The issue exists in the parseaddr.c source file and could allow for
corruption of stack or heap memory depending on where in the code the
function is called from. One possible attack vector is if the function is
indirectly invoked via parseaddr(), though others may also exist.

This vulnerability could permit remote attackers to execute arbitrary code
via vulnerable versions of Sendmail. This would occur with the privileges
of the server.

The vendor has reported that versions prior to version 8.12.10, are
vulnerable. Additionally it has been reported that commercial releases
including all versions of Sendmail Advanced Message Server, Sendmail Pro,
Sendmail Switch and Sendmail for NT are also vulnerable.

31. Lucent MAX TNT Universal Gateway Hang-Up Redial Administrati...
BugTraq ID: 8642
Remote: Yes
Date Published: Sep 17 2003
Relevant URL: http://www.securityfocus.com/bid/8642
Summary:
MAX TNT Universal Gateway is a router solution maintained and distributed
by Lucent. The device was previously manufactured by Ascend.

A problem in the handling of hang-up and redial calls to the Lucent MAX
TNT Universal Gateway has been reported. Allegedly, this may make it
possible for an attacker to gain unauthorized access to network resources.

It has been reported that callers connecting to the router, hanging up,
then immediately redialing gain an arbitrary administrative access.
Specific details of this issue are not currently available, and this BID
will be further updated when information becomes available.

It should be noted that it appears a valid user account is required to
launch an attack.

32. NetBSD Sysctl Argument Handling Vulnerabilities
BugTraq ID: 8643
Remote: No
Date Published: Sep 18 2003
Relevant URL: http://www.securityfocus.com/bid/8643
Summary:
Multiple vulnerabilities have been reported in the sysctl system call for
NetBSD systems.

A kernel panic could be the result of some sysctl nodes attempting to
dereference a NULL pointer. In particular, a pointer variable was
mistakenly used for pointing to a user-level and a kernel level address.
A NULL pointer could be set to the variable by a user, potentially causing
a kernel panic and denying service to legitimate users of the system.

If the process ID of a zombie process is passed to the system call, this
could cause a kernel panic. This could occur if the proc.* sysctl tree is
invoked on a zombie process, which would have invalid or non-existent
process information. This could potentially be exploited by a user to
cause a kernel panic, denying service to legitimate users of the system.

Some sysctl nodes do not implement sufficient range checking, potentially
allowing kernel memory to be read. The proc.curproc.rlimit subtree has a
number of nodes that contain information about process limits. sysctl
provides a helper that is used to manipulate these values, which does not
implement sufficient range checking, potentially allowing values outside
of the rlimit structure to be read. This could permit a local user to
browse kernel memory, potentially gaining access to sensitive information
such as credentials. This issue may be similar to the vulnerability
described in BID 2364, which affects the Linux kernel.

It is not known if other BSD derivatives are similarly affected by these
issues.

These issues will be separated into individual BIDs when further analysis
is complete.

33. Plug and Play Web Server Directory Traversal Vulnerability
BugTraq ID: 8645
Remote: Yes
Date Published: Sep 18 2003
Relevant URL: http://www.securityfocus.com/bid/8645
Summary:
Plug and Play Web Server is a Microsoft Windows based application package
that provides users with the ability to create and maintain dynamic
websites. The software also supports SSL.

A vulnerability has been reported in the software that may allow a remote
attacker to access information outside the server root directory. The
problem exists due to insufficient sanitization of user-supplied data.
The issue may allow a remote attacker to traverse outside the server root
directory by using '../' or '..\' character sequences.

Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive information that may be used to launch further
attacks against a vulnerable system.

Plug and Play Web Server version 1.0002c has been reported to be prone to
this issue, however other versions may be affected as well.

34. IBM AIX lpd Local Format String Vulnerability
BugTraq ID: 8646
Remote: No
Date Published: Sep 18 2003
Relevant URL: http://www.securityfocus.com/bid/8646
Summary:
lpd is a printing daemon designed to handle and queue print requests from
multiple users. It is a standard daemon found on most Unix and Linux
distributions.

IBM has released a security advisory stating that a local format string
vulnerability has been discovered in lpd on AIX systems. The problem
occurs due to incorrect usage of programming functions designed to take
formatted arguments. As a result, an attacker who is a member of the
'printq' group may be capable of feeding data to the vulnerable
application that may be interpreted as format specifiers. This may allow
for the attacker to overwrite arbitrary locations in memory, ultimately
resulting in the execution of attacker-supplied code.

35. Multiple Mambo Open Source 4.0.14 Server Vulnerabilities
BugTraq ID: 8647
Remote: Yes
Date Published: Sep 18 2003
Relevant URL: http://www.securityfocus.com/bid/8647
Summary:
Mambo Open Source is a web based content management system.

Several issues have been identified in Mambo Open Source Server. Because
of these issues, an attacker may be able to gain unauthorized access to
sensitive data and/or send e-mail/spam to arbitrary recipients. The
vulnerabilities are caused by insufficient sanitization of user-supplied
data.

The following problems have been reported to exist:

Multiple SQL injection vulnerabilities may exist in the banners.php and
emailfriend/emailarticle.php modules of the software allow a remote
attacker to inject malicious SQL syntax into database queries. A remote
attacker may exploit the issues to influence SQL query logic.

These issues may allow an attacker to gain access to sensitive data stored
in the database. Other attacks on the underlying database are possible as
well.

An input validation issue has been reported in the sendmail function of
contact.php module of the software. It is possible for a remote attacker
to exploit this lack of input validation to send anonymous e-mail to
arbitrary recipients, possibly in large volumes. The may be accomplished
by passing URL arguments to the following parameters in order to send
email to recipients: $text, $from, $name, $email_to, and $sitename.

This issue may allow an attacker to conceal their identity and send
e-mail/spam to arbitrary recipients.

Mambo Open Source Server 4.0.14 has been reported to be prone to this
problem, however other versions may be affected as well.

This BID will be divided into individual BIDs when further analysis of the
issues is complete.

36. IBM AIX tsm Utility Local Format String Vulnerability
BugTraq ID: 8648
Remote: No
Date Published: Sep 18 2003
Relevant URL: http://www.securityfocus.com/bid/8648
Summary:
The tsm command is used on IBM AIX systems to invoke the terminal state
manager. This is used for a variety of credential verification functions,
as well as other security-based checks. A variety of utilities implement
the use of this command on AIX systems, including su, login, and passwd.

A format string vulnerability has been discovered in the tsm command that
could be exploited locally.

An attacker could exploit the vulnerability by passing a targeted
application data which contains specifically calculated format specifiers.
Due to the incorrect usage of functions which take formatted arguments,
tsm will interpret this attacker-supplied data unexpectedly. As a result,
an attacker may be capable of influencing the flow of execution and
potentially execute arbitrary code.

Due to the use of the tsm command by various functions, including those
run as root, this issue may be exploitable locally to gain root
privileges.

*** It should be noted that IBM has updated their advisory stating that
this issue is in fact not exploitable remotely. This information has not
been confirmed by Symantec.

37. Sendmail Ruleset Parsing Buffer Overflow Vulnerability
BugTraq ID: 8649
Remote: Unknown
Date Published: Sep 17 2003
Relevant URL: http://www.securityfocus.com/bid/8649
Summary:
Sendmail is a widely used MTA for Unix and Microsoft Windows systems.

Sendmail has been reported prone to a buffer overflow condition when
parsing non-standard rulesets.

It has been reported that an attacker may trigger a buffer overflow
condition in Sendmail, when Sendmail parses specific rulesets.
Non-standard rulesets recipient(2), final(4) and mailer-specific envelope
recipient may be used as an attack vector to trigger this vulnerability.
It should be noted that Sendmail under a default configuration is not
vulnerable to this condition. It is not currently known, if this
vulnerability may potentially be exploited to execute arbitrary code.
However due to the nature of the condition, although unconfirmed, it has
been conjectured that ultimately an attacker may exploit this condition to
execute arbitrary code in the context of the affected Sendmail server.

It is not currently known if this vulnerability is restricted to local
exploitation or if the issue may also be exploited remotely.

Explicit technical details regarding this vulnerability are not currently
available; this BID will be updated as further details are disclosed.

38. Mondosoft MondoSearch Unspecified Access Validation Error
BugTraq ID: 8650
Remote: Yes
Date Published: Sep 18 2003
Relevant URL: http://www.securityfocus.com/bid/8650
Summary:
Mondosoft provides search, analytical, and optimization tools for various
Windows-based content-management systems. MondoSearch is a Microsoft .NET
based search engine utility that allows users to integrate search features
into their websites.

The vendor has reported an unspecified vulnerability in the MondoSearch
software system that may allow remote attackers to gain unauthorized
access to a server running the vulnerable versions of MondoSearch. The
vulnerability is considered critical, however, additional details have not
been specified. The vendor has requested users to download a patch that
addresses this issue from the vendor website.

This BID will be updated as more information about this issue becomes
available.

39. HLSW RCON Console Password Disclosure Weakness
BugTraq ID: 8651
Remote: Yes
Date Published: Sep 18 2003
Relevant URL: http://www.securityfocus.com/bid/8651
Summary:
HLSW RCON Console is used to remotely administer Half-Life and
Counter-Strike game servers.

It has been reported that RCON game server console is prone to a plaintext
password disclosure weakness because user passwords are not encrypted when
exchanged between a client and a server. This issue may allow an attacker
who is in a position to eavesdrop on client-server network traffic to
harvest user authentication information.

Successful exploitation of this weakness may allow a remote attacker to
steal authentication information. The attacker could use this information
to compromise the console. Latent vulnerabilities in the console which
require authentication may also be exploited if the console is
compromised.

Although unconfirmed HLSW versions 1.0.0.8 beta and prior could be prone
to this issue.

40. Novell NetWare TCP Potential Vulnerabilities
BugTraq ID: 8652
Remote: Yes
Date Published: Sep 17 2003
Relevant URL: http://www.securityfocus.com/bid/8652
Summary:
Novell NetWare has released a new version of their TCP implementation to
address bugs and potential security vulnerabilities. Of particular
importance is a flaw in the ISN (Initial Sequence Numbers) generation
algorithm that could make it plausible for remote attackers to anticipate
sequence numbers in packets if the ISN can be anticipated. This could
allow for injection of malicious packets or man-in-the-middle attacks.
The vendor has stated that ISN generation now uses MD5 so that sequence
numbers are less predictable.

Other bugs have also been addressed that could potentially have security
implications such as denial of service attacks or other issues. Exact
details have not been provided by the vendor regarding possible security
consequences of many of the bugs that have been fixed. Nonetheless,
administrators are advised to upgrade to mitigate any concerns about
potentially exploitable bugs.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Accused AOL phisher spammed the FBI
By: Kevin Poulsen

Fraudulent e-mail asked an FBI computer crime agent for his credit card
number. Charges have been filed.

http://www.securityfocus.com/news/7018

2. Verisign's 'SiteFinder' finds privacy hullabaloo
By: Deborah Radcliff

Already reviled by network operators, Verisign's ambitious typosquatting
project is raising hackles with privacy advocates too.

http://www.securityfocus.com/news/7009

3. Lamo denies $300,000 database hack
By: Kevin Poulsen

The helpful hacker faces three years in prison for allegedly helping
himself to the New York Times' LexisNexis account and racking up $300,000
in charges -- a figure he says "has no factual basis."

http://www.securityfocus.com/news/6934

4. Baltimore sells 'crown jewels'
By: John Leyden, The Register

http://www.securityfocus.com/news/7025

5. Oi! *Nix admin, get patching
By: John Leyden, The Register

http://www.securityfocus.com/news/6996

6. Blaster trial set for November 17
By: John Leyden, The Register

http://www.securityfocus.com/news/6995

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. File::Scan v0.66
By: Henrique Dias <[email protected]>
Relevant URL: http://www.cpan.org/authors/id/H/HD/HDIAS/
Platforms: N/A
Summary:

File::Scan allows users to make multiplataform virus scanners which can
detect Windows/DOS/Mac viruses. It include a virus scanner and signatures
database.

2. JSch v0.1.8
By: ymnk <[email protected]>
Relevant URL: http://www.jcraft.com/jsch/
Platforms: Os Independent
Summary:

JSch is a pure Java implementation of SSH2. It allows you to connect to an
sshd server and use port forwarding, X11 forwarding, file transfer, etc.
You can integrate its functionality into your own Java programs.

3. NuFW v0.4
By: regit
Relevant URL: http://www.nufw.org
Platforms: Linux, POSIX
Summary:

NuFW is a set of daemons providing filtering of packets at the user level.
On the client side, users have to run a client that sends authentication
packets to the gateway. On the server side, the gateway associates userids
to packets, thus enabling the possibility to filter packets on a user
basis. Furthermore, the server architecture is done to use external
authentication source such as an LDAP server.

4. Astaro Security Linux (Stable 4.x) v4.014
By: astaro
Relevant URL: http://www.astaro.com/
Platforms: Linux, POSIX
Summary:

Astaro Security Linux is a firewall solution. It does stateful packet
inspection filtering, content filtering, user authentication, virus
scanning, VPN with IPSec and PPTP, and much more. With its Web-based
management tool, WebAdmin, and the ability to pull updates via the
Internet, it is pretty easy to manage. It is based on a special hardened
Linux 2.4 distribution where most daemons are running in change-roots and
are protected by kernel capabilities.

5. XML Security Library v1.1.2
By: aleksey
Relevant URL: http://www.aleksey.com/xmlsec/
Platforms: N/A
Summary:

XML Security Library is a C library based on LibXML2 and OpenSSL. The
library was created with a goal to support major XML security standards:
XML Signature and XML Encryption.

6. Traffic tool Troll v1.2
By: Alexander Newald <[email protected]>
Relevant URL: http://linux.newald.de/
Platforms: N/A
Summary:

The Traffik Tool Troll is a traffic monitoring and managing skript.
Traffic statistics are generated by port, hour, day, month, and year. You
can define a special period for your needs. The script is written in Perl
and uses iptables and MySQL to get and store the traffic.

V. SECURITYJOBS LIST SUMMARY
----------------------------
1. HIDS / IPS Business Development Manager - NYC, NJ (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/338271

2. Security/Network position in Fort Worth, Texas (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/338267

3. Position available immediately: DC-centered pre-sal... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/338249

4. Sales Engineer - New York, NY (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/338144

5. Seattle, WA - Security Consultant (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/338143

6. SR. SYSTEMS SECURITY ARCHITECT - Santa Clara, CA (mu... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/338142

7. Seeking Network Security Position in the New Jersey ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/338141

8. Security Administrator - Minneapolis (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/338140

9. Madison, WI - MSSP / Network Security Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/338139

10. SQA Test Team Lead - Web Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337923

11. Seeking Secuity Position in Houston (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337917

12. FW: Qwest Communications Seeks Director, IT Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337916

13. Security SE for Sacarmento (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337915

14. Seeking Secuirty Product Management Role (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337845

15. Security Engineer - Knoxville, TN (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337842

16. Job Search Resources (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337747

17. US-CT-Stamford: Security Architect (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337705

18. Ditscap or Niacap Expert Needed! (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337673

19. Sr CISSP InfoSec Engineer looking for opening (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337672

20. Wireless Security Engineer (TS/SCI required) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337671

21. Sr. IDS Manager/Engineer - Bethesda, MD (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337670

22. ISSO/ISSM Security Opening - Reston, VA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337669

23. Microsoft Security Architect - Brooklyn, NY (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337668

24. Perimeter Security Engineer/ Unix - Brooklyn, NY $1... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337606

25. Telecomms Security Audit Middle East ( Contract ) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337586

26. Technical Marketing Engineer - Silicon Valley - Neot... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337569

27. Sales Engineers CA and MA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337568

28. Senior Systems Security Engineer in New Orleans, LA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337529

29. Sr. Forensics Specialist with Verizon Wireless (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/337484

VI. INCIDENTS LIST SUMMARY
--------------------------
1. New virus disguised as Microsoft patch? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/338383

2. NDRs from spamming (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/338379

3. RES: NDRs from spamming (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/338214

4. strange HTTP requests (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/337834

5. Strange Pix message (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/337785

6. [inbox] Strange Pix message (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/337742

7. Strange Pix message <-- Pix-Bug: CSCdz66410 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/337734

8. compromised RealServer 8 *followup* (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/337562

VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. controlling ebp/eip of a frame, does it always lead ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/338200

2. OpenSSH Vulnerability (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/338198

3. [PAPER]: Integer array overflows. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/337744

4. Ethernet ( MAC ) Address Reliability (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/337691

VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Disabling Internet Explorer "Save my password" check... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/338453

2. Disabling sharing and group policies (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/338452

3. Blank passwords, TsInternetUser added to Administrat... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/338451

4. Why Programs get written to need admin priveleges. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/338109

5. SecurityFocus Announcement: New Mailing Lists (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/337612

6. SecurityFocus Microsoft Newsletter #154 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/337610

IX. SUN FOCUS LIST SUMMARY
--------------------------
NO NEW POSTS FOR THE WEEK 2003-09-15 to 2003-09-22.

X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2003-09-15 to 2003-09-22.

XI. SPONSOR INFORMATION
-----------------------

This Issue is Sponsored By: AirDefense

*** Technical White Paper - Wireless LAN Layers of Security ***

Click here to request this complimentary technical white paper.
http://www.securityfocus.com/sponsor/AirDefense_sf-news_030922
------------------------------------------------------------------------