SecurityFocus Newsletter #216
John Boletta <[email protected]> Mon, 29 Sep 2003 15:01:29 -0600 (MDT)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #216
------------------------------
This Issue is Sponsored by BlackHat
Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
technical IT security event. Modeled after the famous Black Hat event in
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
Symantec is the Diamond sponsor. Early-bird registration ends September
6.
http://www.securityfocus.com/sponsor/BlackHat_sf-news_030825
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Exploiting Cisco Routers (Part One)
2. Intrusion Detection Terminology (Part Two)
3. The Subpoenas are Coming!
4. Lost in Translation
5. SPECIAL ANNOUNCEMENT
II. BUGTRAQ SUMMARY
1. IBM DB2 Discovery Service UDP Denial Of Service Vulnerabilit...
2. LSH Remote Buffer Overflow Vulnerability
3. Debian hztty Multiple Buffer Overflow Vulnerabilities
4. Knox Arkeia Remote Stack Corruption Vulnerability
5. Midnight Commander Virtual File System Symlink Buffer Overfl...
6. Flying Dog Powerslave Portalmanager sql_id Information Discl...
7. ColdFusionMX Error Handler Pages Cross-Site Scripting Vulner...
8. Microsoft BizTalk Server Documentation/WebDAV Weak Permissio...
9. SepCity Community Wizard login.asp SQL Injection Vulnerabili...
10. myPHPNuke auth.inc.php SQL Injection Vulnerability
11. ipmasq Incorrect Packet Forwarding Default Ruleset Vulnerabi...
12. Imatix Xitami Long Header Denial Of Service Vulnerability
13. Sun Java XML Document Nested Entity Denial Of Service Vulner...
14. Multiple Plug And Play Web Server FTP Service Command Handle...
15. Wu-Ftpd SockPrintf() Remote Stack-based Buffer Overrun Vulne...
16. Speak Freely Show Your Face Malformed Gif Denial Of Service ...
17. Speak Freely Spoofed UDP Packet Flood Remote Denial Of Servi...
18. NetUP UTM Web Interface Session ID SQL Injection Vulnerabili...
19. NetUP UTM Web Interface utm_stat Script SQL Injection Vulner...
20. NetUp UTM Web Interface Local Privilege Escalation Vulnerabi...
21. Man Utility Local Compression Program Privilege Elevation Vu...
22. Multiple Vendor VPN Implementation Vulnerabilities
23. Multiple Portable OpenSSH PAM Vulnerabilities
24. wzdftpd Login Remote Denial of Service Vulnerability
25. ProFTPD ASCII File Transfer Buffer Overrun Vulnerability
26. MPG123 Remote File Play Heap Corruption Vulnerability
27. Ingate Firewall/SIParator Packet Filter Rule Bypass Vulnerab...
28. XFree86 XLOCALEDIR Buffer Overflow Variant Vulnerability
29. Gauntlet Firewall SQL-GW Connection Denial Of Service Vulner...
30. Mondosoft MondoSearch MsmSetup.exe ASP Code Injection Vulner...
31. Sun StorEdge T3 Security Scan Master Controller Failure Vuln...
32. TCLhttpd Directory Listing Disclosure Vulnerability
33. TCLHttpd Multiple Cross-Site Scripting Vulnerabilities
34. BSD Kernel ARP Cache Flooding Denial of Service Vulnerabilit...
35. BRS WebWeaver Long URL Request Logging Failure Weakness
36. Comment Board HTML Injection Vulnerabilities
37. yMonda Thread-IT Multiple Fields HTML Injection Vulnerabilit...
38. Re-Boot Design ASP Forum SQL Injection Vulnerability
39. NullLogic Null HTTPd Error Page Long HTTP Request Cross-Site...
40. NullLogic Null HTTPd Remote Denial Of Service Vulnerability
41. Thread-ITSQL HTML Injection Vulnerabilities
42. CFEngine CFServD Transaction Packet Buffer Overrun Vulnerabi...
43. Software602 602Pro LAN SUITE 2003 Sensitive User Information...
44. Software602 602Pro LAN SUITE 2003 Directory Traversal Vulner...
45. MPlayer Streaming ASX Header Parsing Buffer Overrun Vulnerab...
46. WodFTPServer FTP Command Buffer Overflow Vulnerability
47. ArGoSoft FTP Server XCWD Command Remote Buffer Overrun Vulne...
48. SBox Path Disclosure Vulnerability
49. Software602 602Pro LAN SUITE 2003 Multiple Remote Vulnerabil...
50. Apache htpasswd Password Entropy Weakness
51. myServer File Disclosure Variant Vulnerability
52. Athttpd Remote GET Request Buffer Overrun Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Car shoppers' credit details exposed in bulk
2. Accused AOL phisher spammed the FBI
3. Verisign's 'SiteFinder' finds privacy hullabaloo
4. Juvenile arrested in Blaster worm probe
5. AtStake fires executive over Microsoft criticism
6. Lloyds TSB phishing scam nipped in the bud
IV. SECURITYFOCUS TOP 6 TOOLS
1. MasarLabs NoArp v1.2.0
2. snortalog v2.0.0
3. sud v1.2c
4. OS-SIM v0.5.1
5. Dropbear SSH Server v0.37
6. Network Packet Capture Facility for Java v0.01.14
V. SECURITYJOBS LIST SUMMARY
1. Regional Sales Manager - North Carolina - Neoteris (Thread)
2. IT Security Personnel Needed (Thread)
3. VP of Sales - Bay Area or New York City (Thread)
4. Information Security Reporting / HIPAA Consultant (Thread)
5. Pre Sales Engineer- Chicago Area (Thread)
6. position available in Richmond, VA (Thread)
7. Seeking Developer Position (C/C++/Unix/crypto) (Thread)
8. Looking for former Sygate reps out of (GA,TX,MD,VA,D... (Thread)
9. Security Sales Engineer- DC area (Thread)
10. re the CISSP and CISSPs (Thread)
11. C++ Unix Security Programmer - San Diego. (Thread)
12. Pre Sales Engineer - Strategic Accounts - Herndon, V... (Thread)
13. Pre/Post Sales Security Architect - Herndon, VA (Thread)
14. CISSP was RE: Thank you very much (Thread)
15. Dead Thread - CISSP was RE: Thank you very much (Thread)
16. ***Requirement*** (Thread)
17. CISSP (Thread)
18. Information Analyst Computer Network Security (Thread)
19. Eastern Nassau County, Long Island, New York M/F Dat... (Thread)
20. Anti-virus Analyst: 2 Positions (Thread)
21. Thank you very much (Thread)
22. Mid-Level Firewall/Checkpoint Engineer position in P... (Thread)
23. Please give me some advice.. (Thread)
24. Exciting Opportunity for a Lead Firewall Engineer!!! (Thread)
25. Telecom Fraud Consultant (Thread)
26. Security Consulting Engineer Openings (Thread)
27. VP Position - Global Information Protection and Secu... (Thread)
28. Sr CISSP InfoSec Engineer looking for opening (Thread)
29. Lead Security Operations Engineer - Nebraska $90-$... (Thread)
30. Sr. IDS Manager/Engineer Opening - Bethesda, MD (Thread)
31. PKI Express Consultant - One Week project - CT (Thread)
32. Senior Pre-Post Sales Engineer (D0D, VA / DC area) (Thread)
33. Windows Security Design Architect - NYC (Thread)
34. Sales Manager - UK (Thread)
35. Lead Unix Security Engineer - NYC/ Brooklyn $100-$... (Thread)
36. Seeking Employment: Ethical Hacker / Penetration Tes... (Thread)
37. Searching for a Security or Admin Position in the ... (Thread)
38. Federal Security Sales Engineer needed... (Thread)
39. Solutions Architect opening - Northern CA (Thread)
40. IDS - Intrusion Prevention Sales - NYC, New Jersey $... (Thread)
41. Wanted-Director of Information Security in Dallas (Thread)
42. ISSO/ISSM Position - Reston, VA (Thread)
VI. INCIDENTS LIST SUMMARY
1. cron exploit? (Thread)
2. Probable new MS DCOM RPC worm for Windows (Thread)
3. Possible variant of Blaster/Nachi/Welchia? (more) (Thread)
4. Probable new MS DCOM RPC worm for Windows (fwd) (Thread)
5. Possible variant of Blaster/Nachi/Welchia? (Thread)
6. Possible variant of Blaster/Nachi/Welchia? (full sam... (Thread)
7. AW: [incidents] AIM Password theft (Thread)
8. AIM Password theft VU#865940 (Thread)
9. [Full-Disclosure] RE: Probable new MS DCOM RPC worm ... (Thread)
10. AIM Password theft (Thread)
11. AIM Password theft SUMMARY (Thread)
12. [incidents] RE: AIM Password theft (Thread)
13. Strange Windows logon attempts (Thread)
14. Port 9284 (Thread)
15. [Fwd: Re: AIM Password theft] (Thread)
16. NDRs from spamming (Thread)
17. New virus disguised as Microsoft patch? (Thread)
18. Snort not backdoored, Sourcefire not compromised (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. sample buffer overflow exploit problem (Thread)
2. Object Data IE Exploit (Thread)
3. Is this PHP code secure from CSS ? (Thread)
4. reverse shell shellcode for Windows (Thread)
5. Win32: Using SEH to search memory (Thread)
6. argosoft ftp server buffer overflow. (Thread)
7. Illegal Instruction and Frame pointer overwriting (Thread)
8. Moozatech: WZFTPD Denial Of Service (Thread)
9. Black Hat Windows Call for Papers (Thread)
10. xfree86 latest version BUG not vuln. (Thread)
11. mpg123[v0.59r,v0.59s]: remote client-side heap corru... (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Blocking and allowing ActiveX (Thread)
2. Vulnerability scanner for SQL injection, HTML injec... (Thread)
3. IPsec vs any personal software firewall (Thread)
4. Vulnerability scanner for SQL injection, HTML injec... (Thread)
5. Blank passwords, TsInternetUser added to Administrat... (Thread)
6. Disabling Internet Explorer "Save my password" check... (Thread)
7. SecurityFocus Microsoft Newsletter #155 (Thread)
8. Disabling Internet Explorer "Save my password" check... (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Password expiration in Solaris (Thread)
2. sun patches for sendmail and ssh on 2.9? (Thread)
3. sun patches for sendmail and ssh on 2.9? tests=DATE_... (Thread)
4. Solaris 8, X -nolisten tcp (Thread)
X. LINUX FOCUS LIST SUMMARY
1. FW: Linux and firewall load balancing (Thread)
2. Linux and firewall load balancing (Thread)
3. Kerberos + OpenLDAP help needed. (Thread)
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Exploiting Cisco Routers (Part One)
By Mark Wolfgang
This is the first of a three-part series that will focus on identifying
and then exploiting vulnerabilities and poor configurations in Cisco
routers.
http://www.securityfocus.com/infocus/1734
2. Intrusion Detection Terminology (Part Two)
By Andy Cuff
This is the second and final part of the series that discusses IDS
terminology, including terms where there may be disagreement from within
the security community.
http://www.securityfocus.com/infocus/1733
3. The Subpoenas are Coming!
By Mark Rasch
Citing a provision of the Patriot Act, the FBI is sending letters to
journalists telling them to secretly prepare to turn over their notes, e-
mails and sources to the bureau. Should we throw out the First Amendment
to nail a hacker?
http://www.securityfocus.com/columnists/187
4. Lost in Translation
By Tim Mullen
We spend money, increase administration, and take away functionality. Is
it any wonder that security people are so misunderstood?
http://www.securityfocus.com/columnists/186
5. SPECIAL ANNOUNCEMENT
We are pleased to announce that The Basics infocus area has been renamed
to Foundations, in order to accommodate a wider range of security-related
articles that are not necessarily basic, but do not fit into one of the
seven other infocus areas either.
http://www.securityfocus.com/foundations
II. BUGTRAQ SUMMARY
-------------------
1. IBM DB2 Discovery Service UDP Denial Of Service Vulnerabilit...
BugTraq ID: 8653
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8653
Summary:
IBM DB2 is a commercial relational database implementation that is
available for a number of operating systems including Microsoft Windows
and Unix/Linux variants.
IBM DB2 includes a Discovery Service that is used to locate other
databases on the network. By default, this service listens on UDP port
523.
The IBM DB2 Discovery Service is prone to denial of service attacks. The
service expects to receive messages of a certain size. If a UDP packet
larger than 20 bytes is received by the service, it will shut down. The
"DB2 - DB2DAS00" service must then be restarted to regain normal
functionality.
2. LSH Remote Buffer Overflow Vulnerability
BugTraq ID: 8655
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8655
Summary:
lsh is a free software implementation of the ssh version 2 protocol. It is
available for multiple platforms including Linux, Unix and Apple.
lsh has been reported prone to a remote buffer overflow vulnerability. The
condition is reported to present itself under fairly restrictive
circumstances; specifically the vulnerable server must receive malicious
exploit data before any other communications after it has been started.
The vulnerability has been reported to exist in read_line.c, inside an
error reporting function. It has been reported that the vulnerable
function does not return from a reporting procedure, and instead writes
arbitrary data past the end of a reserved buffer in heap-based memory.
This will eventually lead to the corruption of adjacent heap based
management structures.
This vulnerability has been reported to be exploitable pre-authentication,
resulting in the execution of arbitrary attacker supplied instructions in
the context of the affected daemon.
Although this issue has been reported to affect lsh versions 1.4.x, other
versions may also be affected.
3. Debian hztty Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 8656
Remote: No
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8656
Summary:
Debtian hztty is a program used to translate Chinese character encodings
in terminal sessions.
It has been reported that hztty is prone to multiple buffer overflow
issues that may allow an attacker to gain unauthroized access to a host
running the vulnerable software.
The conditions are present due to insufficient boundary checking. An
attacker may leverage the issues by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing the
affected procedures to return to an address of their choice. One of these
issues is due to insufficient bounds checking of data supplied via the
'-I' command line parameter.
It has also been reported that hztty is incorrectly installed as setuid
root by default instead of group utmp privileges.
Successful exploitation may allow an attacker to ultimately execute
arbitrary code in the context of the user who is running the vulnerable
software in order to gain unauthorized root access to a system.
hztty version 2.0-5.2 has been reported to be prone to these issue however
other versions may be affected as well.
4. Knox Arkeia Remote Stack Corruption Vulnerability
BugTraq ID: 8657
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8657
Summary:
Arkeia Server is an enterprise-based backup software solution distributed
and maintained by Knox Software.
A remote vulnerability has been reported for the Knox Arkeia server. The
issue is believed to occur due to insufficient bounds checking when
handling data contained within a type 74 packet. As a result of this
vulnerability, a remote attacker may be capable of triggering a buffer
overrun that could allow partial or complete corruption of sensitive stack
variables. This may allow for a saved frame pointer or saved return
address to be influenced in such a way that the execution flow of the
arkeiad process can be controlled.
Successful exploitation would ultimately allow for the execution of
arbitrary code with the privileges of arkeiad, typically root.
5. Midnight Commander Virtual File System Symlink Buffer Overfl...
BugTraq ID: 8658
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8658
Summary:
Midnight Commander is a popular file management tool for Unix systems.
Among other features, Midnight Commander is provided with a code layer to
access the file system; this code layer is known as the virtual file
system(VFS).
Midnight Commander has been reported prone to a buffer overflow
vulnerability, when handling symlinks in VFS.
The issue presents itself in the vfs_s_resolve_symlink() function,
reportedly due to an un-initialized buffer being used when Midnight
Commander is handling symlinks in the virtual file system code layer,
specifically in tar and cpio VFS procedures.
An attacker may reportedly trigger this issue, using malicious tar
archives as an attack vector; to overflow the bounds of an un-initialized
reserved buffer in stack based memory. Although unconfirmed, it has been
conjectured that this condition may be leveraged to execute arbitrary
code, however a denial of service condition that causes the affected
Midnight Commander application to crash has been demonstrated.
6. Flying Dog Powerslave Portalmanager sql_id Information Discl...
BugTraq ID: 8659
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8659
Summary:
Flying Dog Powerslave is a content management system that also provides a
development platform for other applications. Powerslave Portalmanager
allows external web applications to be integrated into Powerslave.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to gain access to sensitive information about the
underlying database structure of a vulnerable system. It has been
reported that Powerslave includes URL-rewriting functionality, using ';'
to separate variables in a URI request. The problem may exist in the
sql_id parameter; an attacker may insert malformed SQL queries in sql_id
resulting in the software disclosing information about the database in a
subsequent error message. Although unconfirmed attackers may also be able
to execute arbitrary SQL commands under certain circumstances.
Successful exploitation of this issue may allow an attacker to gain access
to sensitive information, which may be used to launch further attacks
against a vulnerable system.
Powerslave version 4.3 is reported to be prone to this vulnerability,
however other versions may be affected as well.
7. ColdFusionMX Error Handler Pages Cross-Site Scripting Vulner...
BugTraq ID: 8660
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8660
Summary:
ColdFusion MX is the application server for developing and hosting
infrastructure distributed by Macromedia. It is available as a standalone
product for Unix, Linux, and Microsoft Operating Systems.
ColdFusionMX has been reported prone to a cross-site scripting
vulnerability, under some circumstances.
The issue has been reported to present itself in web sites that harness
the default ColdFusionMX Site-Wide Error Handler page, the default
ColdFusionMX Missing Template Handler has additionally been reported
vulnerable.
The vendor has reported that a HTTP header, containing malicious content
in the 'referer' field, may be used as an attack vector to inject
malicious content into the aforementioned Error handler pages of
ColdFusionMX.
This vulnerability may be exploited by malicious attackers, to execute
arbitrary HTML or Script code in the context of the affected site, in the
browsers of unsuspecting users.
This vulnerability has been reported to affect ColdFusion MX 6.0, 6.1(All
editions), 6.0 J2EE (All editions), 6.1 J2EE (All editions),and ColdFusion
5.0 and prior versions.
8. Microsoft BizTalk Server Documentation/WebDAV Weak Permissio...
BugTraq ID: 8661
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8661
Summary:
Microsoft BizTalk Server 2002 allows application integration, process
automation, and is capable of receiving documents through HTTP, SMTP, and
SOAP.
A vulnerability has been reported to exist in the software that may allow
unauthorized modification and replacement of HTML and XML files on the
server.
The problem is reported to exist in two virtual directories installed by
default. Microsoft BizTalk Server installs and configures the following
virtual directories in IIS: BizTalkServerDocs and BizTalkServerRepository.
BizTalkServerDocs is used to store server documentation and
BizTalkServerRepository is a WebDAV repository for XML files.
It has been reported that the software grants full privileges to the users
group on the following folders: "...\Microsoft BizTalk
Server\Documentation\" and "...\Microsoft BizTalk
Server\BizTalkServerRepository\". Due to these weak permissions it may be
possible for an attacker to replace or modify HTML documents in
BizTalkServerDocs and XML files in BizTalkServerRepository with
attacker-supplied arbitrary files.
9. SepCity Community Wizard login.asp SQL Injection Vulnerabili...
BugTraq ID: 8662
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8662
Summary:
Community Wizard is a framework for building modular portal websites. It
is offered by SepCity, Inc.
A vulnerability has been reported in the login.asp page of the software
that may allow a remote attacker to login with administrative privileges
without supplying valid credentials.
The issue may allow an attacker to inject malicious SQL syntax into
database queries. The source of the issue is insufficient sanitization of
user-supplied input before including this input in database queries. It
has been reported that any user may login to the vulnerable website by
using any value for Username field and 'or''=' as a value for the password
field. As a result, the user would gain administrative privileges.
This issue may allow an attacker to gain access to sensitive data as an
administrator that could lead to other attacks against a system. Further
attacks against the underlying database are also possible.
Community Wizard version 5.1 has been reported to be prone to this
vulnerability, however prior version could be affected as well.
10. myPHPNuke auth.inc.php SQL Injection Vulnerability
BugTraq ID: 8663
Remote: Yes
Date Published: Sep 20 2003
Relevant URL: http://www.securityfocus.com/bid/8663
Summary:
myPHPNuke is a Web Portal System based on PHP-Nuke 4.4.1a. It is available
for the Linux and Microsoft Windows operating systems.
A vulnerability has been reported to exist in myPHPNuke that may allow a
remote attacker to inject malicious SQL syntax into database queries. The
source of this issue is insufficient sanitization of user-supplied input.
The problem is reported to exist in the $aid variable contained within the
auth.inc.php module. It has been reported that $aid is not sanitized for
user-supplied input before it is included in the database. A remote
attacker may exploit this issue to influence SQL query logic.
A malicious user may influence database queries in order to view or modify
sensitive information, potentially compromising the software or the
database.
myPHPNuke version 1.8.8 has been reported to be prone to this issue,
however other versions may be affected as well.
11. ipmasq Incorrect Packet Forwarding Default Ruleset Vulnerabi...
BugTraq ID: 8664
Remote: Yes
Date Published: Sep 20 2003
Relevant URL: http://www.securityfocus.com/bid/8664
Summary:
ipmasq is a package that is used to initialize and simplify the
configuration of Linux IP Masquerade. IP Masquerade is a feature of linux
that allows multiple hosts to share a single IP address.
Debian has reported that the firewall rules configured by ipmasq may
result in incorrect (and potentially insecure) forwarding of traffic on
the gateway host. According to the report, any traffic destined for
internal hosts arriving at the external interface of the gateway will be
forwarded to the destination host on the internal network regardless of
whether the packet can be associated with an established connection or
not. This behavior is incorrect and may result in attackers gaining
unauthorized access to internal and potentially more vulnerable hosts.
ipmasq 3.5.10 has been reported to be prone to this vulnerability.
12. Imatix Xitami Long Header Denial Of Service Vulnerability
BugTraq ID: 8665
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8665
Summary:
Xitami is a web server product that is available for Microsoft Windows and
other platforms.
Xitami is prone to a denial of service vulnerability. This condition is
known to occur when a .shtm file is requested with an overly long HTTP
header. In particular, a header that is greater than or equal to 5154
bytes followed by a colon (:) will trigger this condition. Exploitation
will cause a runtime error in XIWIN32.EXE, resulting in a server crash.
The server will need to be restarted to regain normal functionality.
The server crash may be the result of a boundary condition error, though
this has not been confirmed. If this is the case, it may also be possible
to exploit this issue to execute arbitrary code.
This vulnerability is reported to affect Xitami on Windows platforms. It
is not currently known if releases for other platforms are similarly
affected.
13. Sun Java XML Document Nested Entity Denial Of Service Vulner...
BugTraq ID: 8666
Remote: No
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8666
Summary:
A problem has been identified in Sun Java when handling XML documents with
specific constructs. Because of this, an attacker with the ability to
cause the software to parse malicious XML documents may have the ability
to crash a system hosting Sun Java.
The problem is in the handling of nested entities. By default Sun Java
does not permit recursive entity definitions. This default design
prevents resource consumption and denial of service through looping entity
definitions.
However, by using multiple deeply nested entity definitions, it is
possible to cause excessive consumption of system resources. By creating
maliciously nested entity definitions, it is possible to force the Java
engine to spend excessive amounts of processor and memory resources
attempting to reach the end of nested entities, making all system
resources unavailable for a period of time. This attack could be launched
continuously to launch a prolonged denial of service.
This problem is known to affect the Sun Java Runtime Environment. Other
versions may also be affected.
14. Multiple Plug And Play Web Server FTP Service Command Handle...
BugTraq ID: 8667
Remote: Yes
Date Published: Sep 21 2003
Relevant URL: http://www.securityfocus.com/bid/8667
Summary:
Plug and Play Web Server is a suite of server components, including an FTP
server, designed to run on Microsoft Windows platforms.
Plug and Play Web Server FTP service has been reported prone to multiple
buffer overflow issues, The issues present themselves when the affected
FTP service handles FTP command arguments of excessive size. This is
likely due to insufficient boundary checks performed on FTP commands and
associated arguments that are issued to the affected server.
It has been demonstrated that a remote attacker may exploit this condition
to trigger a denial of service in the affected FTP server. However, due to
the nature of this vulnerability, although unconfirmed, it has been
conjectured that a remote attacker may leverage this vulnerability to have
arbitrary code executed in the context of the vulnerable service.
Although Plug and Play Web Server version 1.0002c has been reported prone
to this vulnerability, other versions may also be affected.
15. Wu-Ftpd SockPrintf() Remote Stack-based Buffer Overrun Vulne...
BugTraq ID: 8668
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8668
Summary:
Wu-Ftpd is an ftp server based on the BSD ftpd that is maintained by
Washington University. Wu-Ftpd includes an option 'MAIL_ADMIN', which
allows the administrator to be e-mailed when a specific event occurs on
the server. One such event may be the uploading of a remote file.
A remote vulnerability has been discovered in Wu-Ftpd, when configured
using the 'MAIL_ADMIN' option to report file uploads, that could allow for
the execution of arbitrary code. It should be noted that Wu-Ftpd servers
running the default configuration are not affected by this vulnerability.
The problem is present within the SockPrintf() function, located within
the ftpd.c source file, and occurs due to insufficient bounds checking.
When SockPrintf() is called, a number of formatted arguments are passed to
the svprintf() function and are stored within the local stack buffer. Due
to insufficient bounds checking prior to calling svprintf(), an attacker
capable of influencing data passed to SockPrintf() may be capable of
overrunning the 32768 byte buffer with malicious data.
This issue may be exploitable through the store() function defined in
ftpd.c, which invokes the SockPrintf() function using an uploaded filename
as the 'name' argument. If an attacker was somehow capable of influencing
the size of the path used to store the uploaded file, possibly by creating
nested directories, it may be possible to construct a 'name' argument
greater then 32768 bytes. This would effectively result in the allocated
stack buffer being overrun, and could ultimately allow for the corruption
of sensitive stack variables such as a saved frame pointer or a return
address.
It should be noted that specific operating systems place a limit on the
available size of filenames. For instance, Linux limits the size to 4096
bytes. Due to this limit, this bug may not be exploitable on certain
systems. However, if the aforementioned nested directory creation is
possible, exploitation may still be possible on systems that set smaller
size limits.
Successful exploitation of this vulnerability could result in the
execution of arbitrary code with the privileges of the Wu-Ftpd server,
typically root.
16. Speak Freely Show Your Face Malformed Gif Denial Of Service ...
BugTraq ID: 8669
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8669
Summary:
Speak Freely is a freely available Internet voice communication
application. It is available for the Unix, Linux, and Microsoft Windows
platforms.
Speak Freely clients may crash when processing malformed GIF images. This
vulnerability is exposed via the "Show Your Face" feature, which allows
clients to send images to other clients. In particular, a GIF with "Image
width" and "Image height" header fields that are too large or equal to
zero will trigger this issue.
When such a malformed "Show Your Face" GIF is received and processed by a
client, the client will crash.
Though unconfirmed, this could permit an attacker to corrupt memory with
specific values, potentially leading to arbitrary code execution.
This issue is reported to affect Speak Freely on Windows platforms only.
17. Speak Freely Spoofed UDP Packet Flood Remote Denial Of Servi...
BugTraq ID: 8670
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8670
Summary:
Speak Freely is a freely available Internet voice communication
application. It is available for the Unix, Linux, and Microsoft Windows
platforms.
Speak Freely for Microsoft Windows has been reported prone to a remote
denial of service vulnerability. The issue presents itself when the Speak
Freely software handles multiple UDP connections in quick succession that
have spoofed IP addresses. It has been reported that the software will
exponentially consume resources until it fails shortly after displaying
the following error message: "Cannot create transmit socket for host
(x.x.x.x), error 10055. No buffer space is available".
It has been reported that this vulnerability may also be exploited on a
low speed network, due to the low UDP packet size required to trigger the
issue.
This vulnerability has been reported to affect Speak Freely versions up to
and including 7.6a, for Microsoft Windows platforms. The Unix version is
not reported prone to this issue.
18. NetUP UTM Web Interface Session ID SQL Injection Vulnerabili...
BugTraq ID: 8671
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8671
Summary:
NetUp UTM is a billing system for Internet Service Providers (ISP). It
includes a web interface, which allows users to log in and manage their
accounts. It is available for the Linux, FreeBSD, and Microsoft Windows
operating systems.
A vulnerability has been reported to exist in NetUp UTM that may allow a
remote attacker to inject malicious SQL syntax into specific database
queries. The source of this issue is insufficient sanitization of
user-supplied input.
The problem is reported to exist in the $sid variable, used to supply a
current session id. It has been reported that potential control characters
stored within the $sid variable are not escaped prior to being included
within a SELECT statement. As a result, an attacker may be capable of
hijacking a users session by supplying malicious SQL data within a request
to the NetUp UTM web interface. This could be accomplished by including
commands designed to escape the context of the expected data and influence
the logic of the query.
Successful exploitation of this issue could allow an attacker to gain
access to the account of another user whose has an active session. It
should be noted that a malicious user might also be capable of influencing
database queries in order to view or modify sensitive information,
potentially compromising the software or underlying database.
19. NetUP UTM Web Interface utm_stat Script SQL Injection Vulner...
BugTraq ID: 8672
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8672
Summary:
NetUp UTM is a billing system for Internet Service Providers (ISP). It
includes a web interface, which allows users to log in and manage their
accounts. It is available for the Linux, FreeBSD, and Microsoft Windows
operating systems.
A vulnerability has been reported to exist in NetUp UTM that may allow a
remote attacker to inject malicious SQL syntax into specific database
queries. The source of this issue is insufficient sanitization of
user-supplied input.
The problem is reported to exist when handling data passed to the
'utm_stat' script. It has been reported that potential control characters
stored within variables passed to this script are not escaped prior to
being included within various SQL queries. As a result, an attacker may
be capable of modifying sensitive attributes of their user account. This
may include current money balance and bill status. It may also be possible
to influence the configuration behavior of the server, potentially making
it possible to execute arbitrary shell commands with 'nobody' privileges.
This could be accomplished by including commands designed to escape the
context of the expected data and influence the logic of the query.
It should be noted that the implications of this vulnerability might be
exaggerated by the issue described in BID 8671. If used in conjunction,
these issues may allow an attacker to modify the account data of arbitrary
ISP users.
20. NetUp UTM Web Interface Local Privilege Escalation Vulnerabi...
BugTraq ID: 8673
Remote: No
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8673
Summary:
NetUp UTM is a billing system for Internet Service Providers (ISP). It
includes a web interface, which allows users to log in and manage their
accounts. It is available for the Linux, FreeBSD, and Microsoft Windows
operating systems.
A vulnerability has been discovered in NetUP UTM that may allow a user who
is capable of executing code locally, gain elevated privileges. The
problem occurs due to the 'nobody' users sudoers entry allowing the use of
the '/bin/mv' utility with root privileges. As a result, a malicious user
with 'nobody' privileges may be capable of gaining root privileges on a
target system.
The implications of this vulnerability may be exaggerated by the issues
described in BID 8671, and BID 8672. If used in conjunction with these
issues an unauthorized remote attacker may be capable of gaining root
privileges on a target system.
21. Man Utility Local Compression Program Privilege Elevation Vu...
BugTraq ID: 8675
Remote: No
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8675
Summary:
The man utility is used for formatting and displaying various system
manuals and documentation. The optional .manpath file is used by man to
locate various applications used by the user.
A vulnerability has been reported in man that may allow an attacker to
gain elevated privileges. The problem lies in man failing to carry out
sufficient sanity checks before executing a user-defined compression
program. As a result, it may be possible for an attacker to execute
arbitrary code with user 'man' privileges.
An attacker could exploit this issue by creating a malicious executable,
designed to spawn a shell, and specify it as the compression program.
22. Multiple Vendor VPN Implementation Vulnerabilities
BugTraq ID: 8676
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8676
Summary:
Multiple VPN implementations, including CIPE, vtun, and tinc are prone to
security vulnerabilities.
The CIPE implementation is prone to a number of cryptographic flaws. The
flaws include lack of data integrity assurance due to the use of CRC-32
checksums, no inherent measures to protect against message
insertion/deletion attacks and incompatibilities with recent 128-bit block
cipher implementations due to use of 3-bit padding lengths.
Follow-up information has been provided regarding these reported
implementation flaws in CIPE. It appears that the use of CRC-32 checksums
is a legitimate concern, which may be configurable in future versions of
CIPE. Incompatibilities with recent 128-bit block cipher implementations
such as AES do present a possibility for cryptographic attacks on inherent
weaknesses that may exist in algorithms that are supported by CIPE. Other
reported issues such as no inherent protection against message
insertion/deletion attacks are perceived as the result of limitations in
underlying network protocols and it is reported that some of these attacks
may be impractical.
vtun is prone to flaws including weak key generation and lack of inherent
message insertion/deletion protection mechanisms.
tinc is prone to minor cryptographic weaknesses that could expose the
first encrypted block of packets to attacks, potentially exposing
encrypted data. Additional flaws have been reported in the handshake
protocol that could expose VPN communications to man-in-the-middle attacks
and threaten the integrity of the VPN.
Exploitation of these issues could compromise the security of the VPN.
Replay and man-in-the-middle attacks may be possible, in addition to
attacks which allow adversaries to partially decrypt VPN communications or
abuse trust relationships. Many of these issues may be exploited in
combination.
These issues are pending further analysis. This BID will be divided into
individual BIDs when further analysis of the issues is complete.
23. Multiple Portable OpenSSH PAM Vulnerabilities
BugTraq ID: 8677
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8677
Summary:
Multiple vulnerabilities have been reported to affect Portable OpenSSH
with PAM support enabled. It has been reported that at least one of these
vulnerabilities may be exploitable, under a non-standard configuration
with privsep disabled, by a remote attacker.
Explicit technical details regarding this vulnerability is not currently
available, this BID will be updated, as further analysis of these
conditions is complete.
This vulnerability has been reported to affect Portable OpenSSH versions
3.7p1 and 3.7.1p1. OpenBSD releases of OpenSSH do not contain the
vulnerable code and so are not reported to be affected.
24. wzdftpd Login Remote Denial of Service Vulnerability
BugTraq ID: 8678
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8678
Summary:
wzdftpd is an FTP server implementation that is available for the Unix,
Linux, and Microsoft Windows platforms.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to cause a denial of service condition. The issue
presents itself when a remote attacker sends a single CRLF character to
the program during the login process. The attack may cause the software
to act in an unstable manner.
This issue occurs due to improper sanitizing of user-supplied input and a
successful attack may allow a remote attacker to cause the vulnerable
process to crash.
wzdftpd version 0.1rc5 has been reported to be prone to this
vulnerability, however other versions across various platforms may be
affected as well.
25. ProFTPD ASCII File Transfer Buffer Overrun Vulnerability
BugTraq ID: 8679
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8679
Summary:
ProFTPD is an FTP server implementation that is available for Unix and
Linux platforms.
A remotely exploitable buffer overrun vulnerability has been reported in
ProFTPD.
This issue could be triggered if a malicious file is transferred in ASCII
mode. Specifically, ASCII transfers are read in 1024 byte chunks and
checked for newlines (\n). Improper handling of newline characters in
ASCII files may potentially be abused to corrupt memory with
attacker-supplied values. If sensitive values in memory such as
instruction pointers can be overwritten with attacker-supplied data, it
will be possible to control execution flow of the process and execute
arbitrary code.
Successful exploitation will permit a malicious FTP user with upload
access to execute arbitrary code in the context of the FTP server. To
exploit the issue, the attacker must upload the malicious file and then
attempt to download it.
It is also reported that ProFTPD does not adequately drop privileges in
some circumstances, which may compound the risks associated with
exploitation.
This issue could also affect versions prior to 1.2.7, though this has not
been confirmed.
26. MPG123 Remote File Play Heap Corruption Vulnerability
BugTraq ID: 8680
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8680
Summary:
mpg123 is a freely available, open source audio file player. mpg123 is
available for the Linux and Unix platforms.
A problem in the handling of some types of remote files has been reported
in mpg123. Because of this, it may be possible for a remote attacker to
execute arbitrary code with the privileges of the mpg123 user.
The problem occurs in the readstring function implemented in the httpget.c
source file. When the program is used to connect to a remote streaming
server, it receives strings which is places onto the heap. However, the
readstring function does not sufficiently limit the data in some
instances, making it possible for an attacker to send an arbitrary amount
of data. An attacker can use this problem to overwrite sensitive process
memory, potentially executing arbitrary instructions.
27. Ingate Firewall/SIParator Packet Filter Rule Bypass Vulnerab...
BugTraq ID: 8681
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8681
Summary:
Ingate Firewall is a firewall appliance; SIParator is an appliance that
provides for the transmission of SIP-based communications and is designed
to operate with Ingate Firewall.
Ingate Firewall/SIParator products have been reported prone to a TCP
packet filter bypass vulnerability under some circumstances.
The issue presents itself if TCP packet filtering is being used in the
affected software. A malicious packet containing SYN and RST flags set
that passes through the firewall in the reply direction, may bypass
packet-filtering rules if the destination TCP stack implementation ignores
the RST flag and establishes a TCP connection based off the SYN flag.
Ultimately this issue may result in an established TCP connection, that
the affected TCP packet filtering rules were supposed to block.
It is likely that this vulnerability affects Ingate Firewall/SIParator
version 3.2 and prior.
28. XFree86 XLOCALEDIR Buffer Overflow Variant Vulnerability
BugTraq ID: 8682
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8682
Summary:
XFree86 utilities may be prone to a locally exploitable vulnerability due
to insufficient bounds checking of data supplied via the XLOCALEDIR
environment variable. This is a variant of the issue described in BID
7002, but is reported to affect XFree86 4.3.0 and the buffer required to
trigger the condition may also vary. This poses a security risk with
utilities that are setuid/setgid.
The researcher who reported this vulnerability tested the issue with
xscreensaver and it was reportedly possible to overwrite EIP with
attacker-supplied values, however, privilege escalation was not possible
due to the application dropping privileges. It is possible that some
other utilities may drop privileges before exploitation can occur. It has
not been established that this issue may be exploited to gain elevated
privileges.
29. Gauntlet Firewall SQL-GW Connection Denial Of Service Vulner...
BugTraq ID: 8683
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8683
Summary:
Gauntlet Firewall includes an Oracle proxy entitled SQL gateway (sql-gw)
that provides application level database security. SQL gateways may be
added to the rule base of the firewall.
sql-gw is prone to denial of service attacks. It is possible to trigger
this condition by making multiple connections to port 1521, which the
service listens on by default. In particular, 17 concurrent connections
to the port reportedly will cause this condition to occur. The service
will need to be restarted to regain normal functionality.
This issue was reported for Gauntlet Firewall version 6, running on
Solaris. Other versions may also be affected.
30. Mondosoft MondoSearch MsmSetup.exe ASP Code Injection Vulner...
BugTraq ID: 8684
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8684
Summary:
MondoSearch is a Microsoft .NET based search engine utility that allows
users to integrate search features into their websites.
A vulnerability is reported to exist in MondoSearch that may allow a
remote attacker to inject arbitrary ASP code to be executed on a host
running a vulnerable version of the software. The issue is reported to
present itself when a malicious string value is sent to the MsmSetup.exe
module of the software. Although complete details are unavailable at the
moment, this issue may potentially be exploited by passing malicious input
via a vulnerable URI parameter.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the server hosting the software.
Mondosoft MondoSearch versions 4.4, 5.0, and 5.1 are reported to be prone
to this issue, however other versions may be affected as well.
31. Sun StorEdge T3 Security Scan Master Controller Failure Vuln...
BugTraq ID: 8685
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8685
Summary:
StorEdge T3 systems are enterprise disk arrays manufactured and
distributed by Sun Microsystems. StorEdge systems are available for the
Unix platform.
A vulnerability has been reported in the handling of specific types of
network traffic by Sun StorEdge T3 systems. Because of this, an attacker
may be able to deny service to legitimate users of a vulnerable array.
The problem is in the handling of scans by third-party security software.
When the ethernet interface of T3 arrays are scanned by such software, the
array firmware becomes unstable. As a result of such scans, the master
controller usually fails, impacting performance. In some circumstances,
the failover controller fails also, constituting a denial of service to
the array.
32. TCLhttpd Directory Listing Disclosure Vulnerability
BugTraq ID: 8687
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8687
Summary:
TCLHttpd is a basic HTTP server implemented completely in the TCL
scripting language.
It has been reported that a vulnerability present in TCLHttpd allows for
attackers to view the contents of arbitrary directories on affected web
servers. According to the report, the input validation implemented to
protect against this is inadequate and can be evaded easily by specifying
the absolute path of the requested directory.
Issuing a request for the following URI to a server running a vulnerable
version of TCLHttpd will result in the contents of directory "/" being
output:
http://example/images/?pattern=/*&sort=name
The discoverer of this vulnerability has stated that version 3.4.2 is
affected. It is likely that prior versions are also vulnerable.
33. TCLHttpd Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 8688
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8688
Summary:
TCLHttpd is a basic HTTP server implemented completely in the TCL
scripting language.
It has been reported that several of the modules included with TCLHTtpd
are vulnerable to cross-site scripting attacks. According to the report,
the Status, Debug, Mail and Admin modules are affected by these
vulnerabilities. Four instances of this vulnerability have been pointed
out, all appearing to be in the Debug module:
http://example/debug/echo?name=<script>alert('hello');</script>
http://example/debug/dbg?host=<script>alert('hello');</script>
http://example/debug/showproc?proc=<script>alert('hello');</script>
http://example/debug/errorInfo?title=<script>alert('hello');</script>
It is likely that there are many similar instances of this type of
vulnerability in the other modules. These flaws may allow an attacker to
execute script code in the context of another client session. Cookie
theft and content modification attacks are possible.
The discoverer of this vulnerability has stated that version 3.4.2 is
affected. It is likely that prior versions are also vulnerable.
34. BSD Kernel ARP Cache Flooding Denial of Service Vulnerabilit...
BugTraq ID: 8689
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8689
Summary:
The Address Resolution Protocol (ARP) is used to map Internet Protocol
(IP) addresses to MAC addresses. When an IP address is resolved to a MAC
address, it is stored in the ARP cache within the BSD kernel.
A vulnerability has been discovered in the BSD kernel. The problem lies in
the method in which BSD handles and caches information stored in ARP
requests. Specifically, if an ARP request is received and the IP cannot be
resolved, if a default route exists the MAC address will be given an entry
within the ARP cache regardless. As a result, especially on systems with a
default ipv4 route, an attacker may be capable of filling up the available
ARP cache space and triggering a system panic.
A successful attack can be accomplished by sending a high volume of ARP
requests, each with a unique spoofed IP address, to a target system.
The issue is reported to exist in FreeBSD and MacOS X. Other systems
which use a BSD-derived kernel may also be prone to the issue.
35. BRS WebWeaver Long URL Request Logging Failure Weakness
BugTraq ID: 8690
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8690
Summary:
BRS WebWeaver is a small personal web server available for the Microsoft
Windows operating systems.
A problem has been reported in the logging of some types of requests to
BRS WebWeaver. Because of this, an attacker may be able to launch an
unrecorded denial of service against vulnerable hosts.
The problem is in the handling of requests of excessive length. When an
attacker places a request for a URI that exceeds the length limitations
imposed by WebWeaver, the program correctly returns a 414 error, as
defined in RFC specifications. However, the program does not log the
request.
36. Comment Board HTML Injection Vulnerabilities
BugTraq ID: 8691
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8691
Summary:
Comment Board is a web-based application that is implemented in ASP and
available for Microsoft Windows operating systems.
Comment Board is prone to a number of HTML injection issues. In
particular, when users submit comments, input supplied via the Topic
Title, Name and Message form fields will not be adequately sanitized of
HTML and script code. Remote attackers could exploit this issue to inject
hostile HTML and script into the site hosting the software, which could be
rendered in the browsers of users visiting the site.
These issues will permit the attacker to execute hostile code in the
context of the site hosting the software. This will allow for theft of
cookie-based authentication credentials, which could lead to hijacking of
user and administrative sessions. This issue will also allow an attacker
to influence how a vulnerable site is rendered to the issue, allowing for
content manipulation or other attacks.
37. yMonda Thread-IT Multiple Fields HTML Injection Vulnerabilit...
BugTraq ID: 8692
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8692
Summary:
yMonda Thread-IT is an ASP based message board system. The system also
employs Microsoft Access database.
A vulnerability has been reported in the software that may allow a remote
attacker to execute HTML code in a user's browser. The issue is reported
to be present in the 'Topic Title', 'Name', and 'Message' fields. The
problem exists due to insufficient sanitization of user-supplied input.
It may be possible for an attacker to include malicious HTML code in one
of the vulnerable fields. The injected code could then be interpreted by
the browser of a user visiting the vulnerable site. This attack would
occur in the security context of the affected site.
Successful exploitation of this issue may allow a remote attacker to steal
cookie-based authentication credentials. Other attacks are possible as
well.
Thread-IT version 1.6 and prior may be vulnerable to this issue.
38. Re-Boot Design ASP Forum SQL Injection Vulnerability
BugTraq ID: 8694
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8694
Summary:
It has been reported that Re-Boot Design ASP Forum is prone to SQL
injection attacks. The problem likely occurs due to insufficient
sanitization of user-supplied input during authentication. The precise
details of this vulnerability are currently unknown, however it is likely
that an attacker may prematurely escape the authentication data used
within an SQL query, effectively allowing for the logic of the query to be
corrupted.
As a result, an attacker may be capable of accessing an arbitrary users
account without supplying legitimate authentication credentials.
This issue is said to affect Re-Boot Design ASP Forum 1.01, however
earlier versions may also be vulnerable.
39. NullLogic Null HTTPd Error Page Long HTTP Request Cross-Site...
BugTraq ID: 8695
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8695
Summary:
NullLogic Null HTTPd is a small multithreaded web server for Linux and
Windows.
A vulnerability has been reported in the software that may allow an
attacker to execute HTML or script in the browser of a user running the
vulnerable version of the software.
The issue has been reported previously (BID 5603) and fixed, however an
attacker is reported to bypass the fix leading to a cross-site scripting
error. The problem is reported to present itself when displaying error
pages. An attacker may be able to pass long HTTP requests to the software
that overwrite memory and therefore bypass the check for cross-site
scripting issues. As a result, an attacker may construct a link
containing malicious HTML and script code that will be rendered in a
user's browser upon visiting that link. This would occur in the context
of the affected site.
Successful exploitation of this issue may allow a remote attacker to steal
cookie-based authentication credentials. Other attacks are possible as
well.
Null HTTPd version 0.5.1 and prior are reported to be prone to this issue.
40. NullLogic Null HTTPd Remote Denial Of Service Vulnerability
BugTraq ID: 8697
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8697
Summary:
NullLogic Null HTTPd is a small-multithreaded web server for Linux and
Windows.
Null HTTPd has been reported prone to a remotely triggered denial of
service vulnerability.
The issue has been reported to present itself in the HTTP POST handling
routines within the Null HTTPd server. It has been reported that a remote
attacker may make a malicious HTTP POST request, specifying a
'Content-Length' value in the HTTP header and then sending data that
amounts to 1 byte less that the specified Content-Length.
It has been reported that after several consecutive connections employing
the method described above, the affected service will consume system
resources exponentially, effectively denying service to legitimate users.
Although unconfirmed, this behavior has been reported to be due to the
closure of an active connection by the client before the expected data
transfer is completed. Resulting in multiple threads continuing to be
active in an open state, waiting for the expected data.
This vulnerability has been reported to affect Null HTTPd versions up to
and including 0.5.1.
41. Thread-ITSQL HTML Injection Vulnerabilities
BugTraq ID: 8698
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8698
Summary:
Thread-ITSQL is a web-based discussion board implemented in ASP and
available for Microsoft Windows operating systems.
Thread-ITSQL is prone to a number of HTML injection issues. In
particular, when users submit messages, input supplied via the Topic
Title, Name and Message form fields will not be adequately sanitized of
HTML and script code. Remote attackers could exploit this issue to inject
hostile HTML and script into the site hosting the software, which could be
rendered in the browsers of users visiting the site.
These issues will permit the attacker to execute hostile code in the
context of the site hosting the software. This will allow for theft of
cookie-based authentication credentials, which could lead to hijacking of
user and administrative sessions. This issue will also allow an attacker
to influence how a vulnerable site is rendered to the issue, allowing for
content manipulation or other attacks.
42. CFEngine CFServD Transaction Packet Buffer Overrun Vulnerabi...
BugTraq ID: 8699
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8699
Summary:
GNU cfengine is software for automating administration and maintenance of
large networks. It is available for Unix and Linux variants.
cfengine is prone to a stack-based buffer overrun vulnerability. This
issue may be exploited by remote attackers who are able to send malicious
transaction packets to cfservd. cfservd is typically configured to run on
a central master server, which may have some degree of authority over
other systems in the network.
This issue is due to insufficient bounds checking of data that is read in
during a transaction with a remote user. In particular, the
BusyWithConnection() function in the cfservd.c source file passes
externally supplied data in a 4096 byte stack-based buffer to the
ReceiveTransaction() function in net.c. A value for the message length is
then read from the socket by ReceiveTransaction(). The message length and
buffer are then passed to the RecvSocketStream() function. If the message
length is more than 4096 bytes, then adjacent regions of memory will be
corrupted with the superfluous data. In this manner it is possible to
corrupt stack variables such as an instruction pointer with
attacker-supplied values, allowing for control of execution flow and
execution of malicious instructions embedded in memory by the attacker.
The vulnerability may be exploited to execute arbitrary code with the
privileges of cfservd. A denial of service may also be the result of
exploitation attempts as cfservd is multi-threaded and may not be
configured to restart itself via a super-server such as inetd.
43. Software602 602Pro LAN SUITE 2003 Sensitive User Information...
BugTraq ID: 8700
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8700
Summary:
602Pro LAN SUITE 2003 is a all-in-one server application maintained by
Software602 for Microsoft Windows platforms.
A problem with the storage of user credentials has been identified in
Software602 602Pro LAN SUITE 2003. Because of this, an attacker may be
able to gain access to potentially sensitive information.
The problem is in the storage of information in plain text files that may
be reached through the server. Users that log into the webmail interface
have their information such as user id, IP address, and login time
recorded in a file in web-reachable file /mail/S<date>L.LOG, where date is
a six number representation of the day (for example, S030904L.LOG).
Additionally, LAN SUITE 2003 stores sensitive information in plain text in
other files. The file Tempdirs.lst maintains a list of the temporary
directories in use by current webmail users. The MSGlist.mid is created
in user temporary directories to hold message ids, and the MSGlist.mil
file is created to store the username and mailbox number. These issues
are further aggravated by the issue described in Bugtraq ID 8701.
44. Software602 602Pro LAN SUITE 2003 Directory Traversal Vulner...
BugTraq ID: 8701
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8701
Summary:
602Pro LAN SUITE 2003 is a all-in-one server application maintained by
Software602 for Microsoft Windows platforms.
A problem with the handling of directory traversal requests has been
identified in Software602 602Pro LAN SUITE 2003. Because of this, an
attacker may be able to gain access to potentially sensitive information.
The problem is in the handling of dot-dot-slash (../) notation by the
software. When a user places a request to the m602cl3w.exe using the
GetFile function with a request for a file outside of the web root
directory using dot-dot-slash notation, it is possible for an attacker to
access that file with the privileges of the 602Pro LAN SUITE 2003 user.
An attacker can use this issue to take advantage of the problems described
in the latter part of Bugtraq ID 8700.
This problem may also allow an attacker to gain access other sensitive
information on the local host, depending upon configuration.
45. MPlayer Streaming ASX Header Parsing Buffer Overrun Vulnerab...
BugTraq ID: 8702
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8702
Summary:
MPlayer is a multimedia program designed for the Linux and BSD operating
systems. It supports are wide variety of video files, including the ASX
format.
A vulnerability has been discovered in MPlayer when handling malformed
streaming ASX file headers. The issue has been reported to present itself
within the ASX stream handler of MPlayer, and has been reported to be due
to a lack of sufficient boundary checks performed within the
asf_http_request() function.
An attacker may create a malicious ASX file and host it on a server that
responds to a connecting client with new line data that is sufficient to
subvert boundary checks. When the malicious ASX file stream is
interpreted, excessive data contained as an http_proxy value in the ASX
file header may overrun the bounds of a reserved stack-based buffer in
memory and corrupt adjacent memory.
A remote attacker may leverage this condition to corrupt a saved
instruction pointer and thereby influence execution flow of the vulnerable
application into attacker controlled memory. Ultimately an attacker may
execute embedded instructions in the context of the user running MPlayer.
46. WodFTPServer FTP Command Buffer Overflow Vulnerability
BugTraq ID: 8703
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8703
Summary:
wodFTPServer is a commercially available FTP server software package
implemented as ActiveX controls and COM objects and distributed by
WeOnlyDo! Software. It is available for the Microsoft Windows platform.
A problem in the FTP Server command handling has been identified in
wodFTPServer. Because of this, an attacker may be able to execute
arbitrary code, potentially gaining unauthorized access to affected
systems.
The problem is in bounds checking on commands issued to the FTP server.
wodFTPServer does not properly handle long requests, making it possible to
overwrite sensitive regions of memory within the executing process. This
could be exploited to gain access to the system using the affected
software with the privileges of the FTP server process.
47. ArGoSoft FTP Server XCWD Command Remote Buffer Overrun Vulne...
BugTraq ID: 8704
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8704
Summary:
ArGoSoft FTP server is an FTP server for the Windows platform.
A remote buffer overrun vulnerability has been discovered in ArGoSoft FTP
Server. The vulnerability occurs due to insufficient bounds checking when
handling data passed to the XCWD command. Specifically, passing data in
excess of 4096 bytes may overrun the internal memory buffer used to store
the XCWD argument. This would effectively result in memory adjacent to the
buffer being overwritten with user-supplied data.
As a result, an attacker may be capable of corrupting sensitive process
memory; potentially allowing for the execution of arbitrary code.
All code executed in this manner would be run with the privileges of the
FTP server, possibly SYSTEM.
48. SBox Path Disclosure Vulnerability
BugTraq ID: 8705
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8705
Summary:
sbox is a CGI wrapper providing additional security to Web site enabling
CGI authoring privileges to untrusted clients.
sbox has been reported prone to a path disclosure vulnerability.
The issue has been reported to present itself when a HTTP request is made
for a CGI resource that does not exist. sbox will reportedly return an
error message that contains path information.
Information contained in this error message may aid an attacker in further
attacks mounted against a vulnerable system. For example a home directory
contained in the disclosed path may be useful in providing a username when
mounting brute force login attempts against a target server.
This vulnerability has been reported to affect sbox version 1.04 and later
versions.
49. Software602 602Pro LAN SUITE 2003 Multiple Remote Vulnerabil...
BugTraq ID: 8706
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8706
Summary:
602Pro LAN SUITE 2003 is a all-in-one server application maintained by
Software602 for Microsoft Windows platforms.
Several vulnerabilities have been identified in Software602 602Pro LAN
SUITE. These problems may allow a remote user to gain unauthorized
privileges, and potentially unauthorized access to a system hosting the
vulnerable software.
Several problems have been identified to exist:
1. The message window source discloses information about the design of
the system. Specifically, one can gather information about the
installation by viewing the message window source code.
2. It is possible to delete e-mail belonging to other users. Due to
insufficient checking of privileges, an attacker can supply the user id of
a specific user to the "A=DELETEFOLDER" function to destroy files
belonging to a target user.
3. It is possible to create arbitrary folders. By supplying an arbitrary
path and location to the FolderDir parameter, it is possible to create a
folder in any location on the system.
4. It is possible to rename folders belonging to other users. By
supplying the name of an arbitrary folder to rename to in the FolderDir
parameter, it is possible to rename a specified folder.
5. A buffer overflow in the CGI handling code exists. By supplying a
value of 5000 or more characters as a subdirectory to the /mail/
directory, it is possible to overwrite process memory.
6. HTTP authorization is vulnerable to a buffer overflow. By supplying a
username of excessive length to the service, it is possible to overwrite
sensitive process memory.
These issues are pending further analysis. When analysis is complete, the
issues will be divided into separate BIDs.
50. Apache htpasswd Password Entropy Weakness
BugTraq ID: 8707
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8707
Summary:
A weakness has been discovered in the way that the Apache htpasswd
generates salts. Specifically, the salt is generated based of the current
system time using the following procedure:
(void) srand((int) time((time_t *) NULL));
ap_to64(&salt[0], rand(), 8);
If this procedure were used twice or more within the same second, the
generated salts would be identical. As a result, if the affected system
were implementing the use of default auto-generated passwords, multiple
passwords may have the same salt. Having a static value across multiple
passwords will make it easier for an attacker to compromise credentials
and gain access to resources protected via htpasswd that they wouldn't
normally have access to.
This may pose a security weakness if an attacker were capable of gain
access to the contents of htpasswd.
This weakness is said to affect Apache 1.3.27 and 1.3.28, however, other
versions may also be affected.
51. myServer File Disclosure Variant Vulnerability
BugTraq ID: 8708
Remote: Yes
Date Published: Sep 24 2003
Relevant URL: http://www.securityfocus.com/bid/8708
Summary:
A file disclosure vulnerability has been reported in myServer that could
permit remote attackers to gain access to sensitive files outside of the
web root directory of the server. This is a variant of previously
reported vulnerabilities (in particular BID 7944) that is known to affect
myServer 0.4.3. The main difference is that it is possible to escape web
root using a combination of './' and '../' sequences.
To exploit the issue, the request must contain an equal number of './' and
'../' in the relative path to a sensitive resource, plus one of either
string, for example:
/././..
/./././../..
/././././../../..
/./././././../../../..
This could be exploited to gain access to sensitive information on the
system hosting the server. Such information may be useful in mounting
attacks which could further compromise system resources.
52. Athttpd Remote GET Request Buffer Overrun Vulnerability
BugTraq ID: 8709
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8709
Summary:
Athttpd is a web server available for the Linux operating system.
A vulnerability has been reported for Athttpd. The problem occurs due to
insufficient bounds checking when handling GET requests. Specifically,
making a GET request including approximately 820 bytes of data will
effectively overrun the bounds of the internal memory buffer used for its
storage.
As a result, an attacker may be capable of corrupting sensitive data such
as a return address, and effectively control the execution flow of the
program. This would ultimately allow for the execution of arbitrary code.
This vulnerability is said to affect atphttpd 0.4b, however, earlier
versions may also be affected.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Car shoppers' credit details exposed in bulk
By: Kevin Poulsen
Consumers who submitted online credit applications to any of 150 different
automotive dealerships around the U.S. had their personal financial
information exposed on a publicly-accessible website.
http://www.securityfocus.com/news/7067
2. Accused AOL phisher spammed the FBI
By: Kevin Poulsen
Fraudulent e-mail asked an FBI computer crime agent for his credit card
number. Charges have been filed.
http://www.securityfocus.com/news/7018
3. Verisign's 'SiteFinder' finds privacy hullabaloo
By: Deborah Radcliff
Already reviled by network operators, Verisign's ambitious typosquatting
project is raising hackles with privacy advocates too.
http://www.securityfocus.com/news/7009
4. Juvenile arrested in Blaster worm probe
By: John Leyden, The Register
http://www.securityfocus.com/news/7087
5. AtStake fires executive over Microsoft criticism
By: Ted Bridis, The Associated Press
http://www.securityfocus.com/news/7069
6. Lloyds TSB phishing scam nipped in the bud
By: John Leyden, The Register
http://www.securityfocus.com/news/7065
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. MasarLabs NoArp v1.2.0
By: Masar
Relevant URL: http://www.masarlabs.com/noarp/
Platforms: Linux, POSIX
Summary:
MasarLabs NoArp is a Linux kernel module that filters and drops unwanted
ARP requests. It is useful when you need to add an alias to the loopback
interface to use a load balancer.
2. snortalog v2.0.0
By: jeremy chartier
Relevant URL: http://jeremy.chartier.free.fr/snortalog/
Platforms: UNIX
Summary:
Snortalog (formerly known as Snort-ng) is a powerful Perl script that
summarizes Snort logs, making it easy to view any network attacks detected
by Snort. It can generate charts in HTML. It works with all versions of
Snort, and can analyze logs in two formats: syslog alerts and text alerts.
It does not include a database for maximum performance.
3. sud v1.2c
By: mm
Relevant URL: http://tuna.cuore.org/sud/
Platforms: FreeBSD, OpenBSD, POSIX
Summary:
sud (superuser daemon) permits a user to switch to root privileges and to
use a suid program in a nosuid environment. It is based on a client/server
model and on the ability to pass file descriptors between processes. sud
permits you to choose your authentication method, and your effective
credentials will be checked by using a Unix domain socket.
4. OS-SIM v0.5.1
By: Dominique Karg
Relevant URL: http://os-sim.sourceforge.net/
Platforms: Linux, MacOS, POSIX
Summary:
OSSIM pretends to unify network monitoring, security, correlation, and
qualification in one single tool. It combines Snort, Acid, HotSaNIC, NTOP,
OpenNMS, nmap, nessus, and rrdtool to provide the user with full control
over every aspect of networking or security.
5. Dropbear SSH Server v0.37
By: Matt Johnston
Relevant URL: http://matt.ucc.asn.au/dropbear/dropbear.html
Platforms: POSIX
Summary:
Dropbear is an SSH2 server, designe-d to be usable in small memory
environments.
6. Network Packet Capture Facility for Java v0.01.14
By: patrick charles
Relevant URL: http://jpcap.sourceforge.net
Platforms: Linux, Solaris, SunOS
Summary:
Network Packet Capture Facility for Java is a set of Java classes that
provide an interface and system for network packet capture. A protocol
library and tool for visualizing network traffic is included. It utilizes
libpcap, a widely used system library for packet capture.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Regional Sales Manager - North Carolina - Neoteris (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339507
2. IT Security Personnel Needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339501
3. VP of Sales - Bay Area or New York City (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339319
4. Information Security Reporting / HIPAA Consultant (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339291
5. Pre Sales Engineer- Chicago Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339288
6. position available in Richmond, VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339286
7. Seeking Developer Position (C/C++/Unix/crypto) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339284
8. Looking for former Sygate reps out of (GA,TX,MD,VA,D... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339283
9. Security Sales Engineer- DC area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339197
10. re the CISSP and CISSPs (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339187
11. C++ Unix Security Programmer - San Diego. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339176
12. Pre Sales Engineer - Strategic Accounts - Herndon, V... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339175
13. Pre/Post Sales Security Architect - Herndon, VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339174
14. CISSP was RE: Thank you very much (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339116
15. Dead Thread - CISSP was RE: Thank you very much (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339103
16. ***Requirement*** (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339102
17. CISSP (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339099
18. Information Analyst Computer Network Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339079
19. Eastern Nassau County, Long Island, New York M/F Dat... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338882
20. Anti-virus Analyst: 2 Positions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338876
21. Thank you very much (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338875
22. Mid-Level Firewall/Checkpoint Engineer position in P... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338732
23. Please give me some advice.. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338706
24. Exciting Opportunity for a Lead Firewall Engineer!!! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338630
25. Telecom Fraud Consultant (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338627
26. Security Consulting Engineer Openings (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338626
27. VP Position - Global Information Protection and Secu... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338625
28. Sr CISSP InfoSec Engineer looking for opening (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338624
29. Lead Security Operations Engineer - Nebraska $90-$... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338535
30. Sr. IDS Manager/Engineer Opening - Bethesda, MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338532
31. PKI Express Consultant - One Week project - CT (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338529
32. Senior Pre-Post Sales Engineer (D0D, VA / DC area) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338527
33. Windows Security Design Architect - NYC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338526
34. Sales Manager - UK (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338525
35. Lead Unix Security Engineer - NYC/ Brooklyn $100-$... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338524
36. Seeking Employment: Ethical Hacker / Penetration Tes... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338523
37. Searching for a Security or Admin Position in the ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338522
38. Federal Security Sales Engineer needed... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338520
39. Solutions Architect opening - Northern CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338519
40. IDS - Intrusion Prevention Sales - NYC, New Jersey $... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338517
41. Wanted-Director of Information Security in Dallas (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338515
42. ISSO/ISSM Position - Reston, VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/338514
VI. INCIDENTS LIST SUMMARY
--------------------------
1. cron exploit? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339511
2. Probable new MS DCOM RPC worm for Windows (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339416
3. Possible variant of Blaster/Nachi/Welchia? (more) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339415
4. Probable new MS DCOM RPC worm for Windows (fwd) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339342
5. Possible variant of Blaster/Nachi/Welchia? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339305
6. Possible variant of Blaster/Nachi/Welchia? (full sam... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339302
7. AW: [incidents] AIM Password theft (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339295
8. AIM Password theft VU#865940 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339132
9. [Full-Disclosure] RE: Probable new MS DCOM RPC worm ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339127
10. AIM Password theft (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339113
11. AIM Password theft SUMMARY (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339106
12. [incidents] RE: AIM Password theft (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339105
13. Strange Windows logon attempts (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/338978
14. Port 9284 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/338958
15. [Fwd: Re: AIM Password theft] (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/338754
16. NDRs from spamming (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/338753
17. New virus disguised as Microsoft patch? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/338572
18. Snort not backdoored, Sourcefire not compromised (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/338571
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. sample buffer overflow exploit problem (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339504
2. Object Data IE Exploit (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339490
3. Is this PHP code secure from CSS ? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339351
4. reverse shell shellcode for Windows (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339226
5. Win32: Using SEH to search memory (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339121
6. argosoft ftp server buffer overflow. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339081
7. Illegal Instruction and Frame pointer overwriting (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/338821
8. Moozatech: WZFTPD Denial Of Service (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/338820
9. Black Hat Windows Call for Papers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/338819
10. xfree86 latest version BUG not vuln. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/338818
11. mpg123[v0.59r,v0.59s]: remote client-side heap corru... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/338817
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Blocking and allowing ActiveX (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339516
2. Vulnerability scanner for SQL injection, HTML injec... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339515
3. IPsec vs any personal software firewall (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339487
4. Vulnerability scanner for SQL injection, HTML injec... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339149
5. Blank passwords, TsInternetUser added to Administrat... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/338688
6. Disabling Internet Explorer "Save my password" check... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/338686
7. SecurityFocus Microsoft Newsletter #155 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/338502
8. Disabling Internet Explorer "Save my password" check... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/338500
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Password expiration in Solaris (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/339325
2. sun patches for sendmail and ssh on 2.9? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/338728
3. sun patches for sendmail and ssh on 2.9? tests=DATE_... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/338600
4. Solaris 8, X -nolisten tcp (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/338588
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. FW: Linux and firewall load balancing (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/338852
2. Linux and firewall load balancing (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/338792
3. Kerberos + OpenLDAP help needed. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/338715
XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by BlackHat
Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
technical IT security event. Modeled after the famous Black Hat event in
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
Symantec is the Diamond sponsor. Early-bird registration ends September
6.
http://www.securityfocus.com/sponsor/BlackHat_sf-news_030825
------------------------------------------------------------------------