SecurityFocus Newsletter #217
Kelly Martin <[email protected]> Mon, 6 Oct 2003 13:32:48 -0600 (MDT)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #217
------------------------------
This Issue is Sponsored By: ClearSight Networks
Do you want see what your networked applications look like without having
to decode packets? Tired of the three window text decodes?
ClearSight Networks has introduced a visual network analyzer that shows
you your network problems from an application perspective. It is easy-to-
use, visual, and quickly pinpoints problems. Download a full working
Trial Demo for free and see the difference.
Click here to get more information and a free product download.
http://www.securityfocus.com/sponsor/ClearSightNetworks_sf-news_031006
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Wireless Policy Development (Part Two)
2. Exploiting Cisco Routers (Part One)
3. Fame, Infame, All the Same
4. Linux vs. Windows Viruses
5. SPECIAL ANNOUNCEMENT - RSS feeds
II. BUGTRAQ SUMMARY
1. marbles Local Home Environment Variable Buffer Overflow Vuln...
2. SMC Router Random UDP Packet Denial Of Service Vulnerability
3. Savant Web Server Page Redirect Denial Of Service Vulnerabil...
4. Sun One Application Server LDAP Incorrect Authentication Vul...
5. Line9 Tek9 Shopping Cart SQL Injection Vulnerability
6. Novell NetWare Broker Information Disclosure Vulnerability
7. freesweep Environment Variable Handling Buffer Overflow Vuln...
8. GuppY HTML Injection Vulnerability
9. Multiple Geeklog Vulnerabilities
10. OmniCom winShadow Server Login Denial of Service Vulnerabili...
11. OmniCom winShadow hostname Buffer Overflow Vulnerability
12. Megacomputing Personal-WebServer Professional Remote Directo...
13. A-Cart MSG Cross-Site Scripting Vulnerability
14. Megacomputing Personal-WebServer Professional Denial Of Serv...
15. Webfs HTTP Server Information Disclosure Vulnerability
16. Apache2 MOD_CGI STDERR Denial Of Service Vulnerability
17. WebFS Long Pathname Buffer Overrun Vulnerability
18. Sun Solaris Serial Console Excessive Output Data Denial of S...
19. mIRC USERHOST Buffer Overflow Vulnerability
20. Mah-Jong MJ-Player Server Flag Local Buffer Overflow Vulnera...
21. Half-Life Invalid Command Error Response Format String Vulne...
22. Sun SAM-FS File System Deadlock Denial of Service Vulnerabil...
23. OpenSSL ASN.1 Parsing Vulnerabilities
24. Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
25. HP Unspecified Local Socket Implementation Denial of Service...
26. Silly Poker Local HOME Environment Variable Buffer Overrun V...
27. Invision Power Board Insecure Permissions Vulnerability
28. IBM AIX GetIPNodeByName API Socket Management Vulnerability
29. Multiple DCP-Portal SQL Injection Vulnerabilities
30. Atrise Everyfind search Cross-Site Scripting Vulnerability
31. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
32. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
33. MPNews PRO Directory Traversal Information Disclosure Vulner...
34. Mutant Penguin MPWeb PRO Directory Traversal Vulnerability
35. OpenSSL SSLv2 Client_Master_Key Remote Denial Of Service Vul...
36. Microsoft Windows PostThreadMessage() Arbitrary Process Kill...
37. FreeBSD Kernel ProcFS Handler UIO_Offset Integer Overflow Vu...
38. FreeBSD Kernel Readv() Integer Overflow Vulnerability
39. FortiGate Firewall Web Filter Logs HTML Injection Vulnerabil...
40. Inter7 VPopMail Configuration File Insecure Default Permissi...
III. SECURITYFOCUS NEWS ARTICLES
1. Brits pound OpenSSL bugs
2. Car shoppers' credit details exposed in bulk
3. Accused AOL phisher spammed the FBI
4. US cableco seeks to quash RIAA subpoenas
5. Following legal threat, VeriSign agrees to suspend Site Find...
6. Trojan hijacks web browsers
IV. SECURITYFOCUS TOP 6 TOOLS
1. pmacct v0.5.1
2. screen-scraper v1.1.5
3. Scapy v0.9.15
4. phpOpenTracker v1.3.0
5. NSA Security-enhanced Linux v2003100110
6. NuFW v0.5.1
V. SECURITYJOBS LIST SUMMARY
1. Senior IT Auditor - Atlanta, Georgia (Thread)
2. Sr CISSP InfoSec Engineer looking for opening (Thread)
3. Security Consulting Sales/Business Development - San... (Thread)
4. Information Security Specialist - Livingston, NJ (Thread)
5. Security Engineer w/ACTIVE Secret Clearance (Thread)
6. Ernst and Young's Advanced Security Centers (Thread)
7. Security Engineer with ACTIVE Secret Clearance (Thread)
8. PKI Windows Security Specialist - Bloomington, IL (Thread)
9. Security Analyst (Thread)
10. System Security Engineer III vacancy (Thread)
11. UK Sales Manger vacancy (Thread)
12. Principle Research Scientist - Trusted Computing (d... (Thread)
13. *** Product Marketing Manager, Bay Area, CA *** (Thread)
14. Remediation - QA Position Open (Thread)
15. Information Security Analyst Nashville TN $55K - $... (Thread)
16. *** Technical Marketing Engineer, Bay Area, CA *** (Thread)
17. Junior security position sought - two years' NOC exp... (Thread)
18. Repost: Resume for Unix/Network Security Guru (Thread)
19. Resume for Unix/Network Security Guru (Thread)
20. Needed Network Security Professionals (Thread)
21. Position Available: Director of Business Continuity ... (Thread)
22. Regional Sales Manager(s) - Security Software - IL, ... (Thread)
23. Security Consulting Sales/Business Development - Ral... (Thread)
24. Infosec Strategy/Arch/Policy (BC, Canada) (Thread)
25. Technical Marketing Engineer - Neoteris - Sunnyvale,... (Thread)
26. Product Manager - Neoteris - Sunnyvale, CA (Thread)
27. Hello, could you post thes positions. thanks Herb (... (Thread)
28. ISSM/ISSO Position - Reston, VA (Thread)
29. Sr. IDS Manager/Engineer - Bethesda, MD (Thread)
30. Security Analyst position open at Apple (Thread)
31. Recent Graduate looking for a security position (Thread)
32. System Security Engineer (Thread)
33. Mgr. Network Security Operations - NYC $120-$130K b... (Thread)
34. Looking for a position as a security researcher (Thread)
35. New Articles @ SecurityFocus (Thread)
36. Security Pre Sales Engineer New York (Thread)
37. Hiring Security Consultant - So. Cal or Chicago Pref... (Thread)
38. Full time positions in Miami and Chicago (Thread)
39. Security Consultant - Orange County or Chicago Prefe... (Thread)
40. TS/SCi Sr. Level Network Security Architect/Implemen... (Thread)
41. Sr. Forensics Specialist with Verizon Wireless (Thread)
42. Manager of Info Security with Verizon Wireless (Thread)
43. Who is hiring top security researchers? (Thread)
44. Engineer Available, Dallas/Fort Worth Texas (Thread)
VI. INCIDENTS LIST SUMMARY
1. BIND 9.2.1 crashes (Thread)
2. Strange packets from Verisign Sitefinder (Thread)
3. cron exploit? (Thread)
4. Repository of virus/worm propagation methods? (Thread)
5. Help in flood (Thread)
6. Possible variant of Blaster/Nachi/Welchia? (more) (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Bug in Microsoft Word (Thread)
2. Problem with sample buffer overflow exploit solved (Thread)
3. Fake frame overwriting (Thread)
4. sample buffer overflow exploit problem (Thread)
5. NISSC SSL/TLS Test suite? (Thread)
6. Is this PHP code secure from CSS ? (Thread)
7. Format string bug in Half-Life client, but is it rea... (Thread)
8. Format string bug in Half-Life client, but is it rea... (Thread)
9. MPlayer buffer overflow (Thread)
10. Possible Apache directory rules bypass / override (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Wasn't someone looking for a Group Policy collection... (Thread)
2. R: Registry Settings for Group Policy Security Optio... (Thread)
3. Article Announcement: Linux vs. Windows Viruses (Thread)
4. windows ce exploits (Thread)
5. New exploit circulating for IE vulnerability (Thread)
6. Registry Settings for Group Policy Security Options (Thread)
7. IPsec vs any personal software firewall (Thread)
8. SecurityFocus Microsoft Newsletter #156 (Thread)
9. IPsec vs any personal software firewall (Thread)
10. Article Announcement: Lost in Translation (Thread)
11. Blocking and allowing ActiveX (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Password expiration in Solaris (Thread)
X. LINUX FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2003-09-29 to 2003-10-06.
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Wireless Policy Development (Part Two)
By Jamil Farshchi
This is the second of a two-part series that will help create a framework
for the most important aspect of any wireless security strategy -- policy
development.
http://www.securityfocus.com/infocus/1735
2. Exploiting Cisco Routers (Part One)
By Mark Wolfgang
This is the first of a three-part series that will focus on identifying
and then exploiting vulnerabilities and poor configurations in Cisco
routers.
http://www.securityfocus.com/infocus/1734
3. Fame, Infame, All the Same
By George Smith
Blowing the lid off the altruistic computer security town-crier angle.
http://www.securityfocus.com/columnists/189
4. Linux vs. Windows Viruses
By Scott Granneman
To mess up a Linux box, you need to work at it; to mess up your Windows
box, you just need to work on it.
http://www.securityfocus.com/columnists/188
5. SPECIAL ANNOUNCEMENT
SecurityFocus is pleased to announce the relaunch of our RSS feeds.
http://www.securityfocus.com/rss/index.shtml
II. BUGTRAQ SUMMARY
-------------------
1. marbles Local Home Environment Variable Buffer Overflow Vuln...
BugTraq ID: 8710
Remote: No
Date Published: Sep 26 2003
Relevant URL: http://www.securityfocus.com/bid/8710
Summary:
marbles is a freely available, open source game for the Linux platform.
A problem in the handling of data in the Home environment variable has
been reported in the marbles program. This may make it possible for a
local attacker to gain elevated privileges.
The problem is in the checking of bounds on data stored in the Home
environment variable. By placing a string of excessive length in the
environment variable, it is possible to overwrite sensitive process
memory. This could lead to the execution of arbitrary code, and
potentially privilege escalation to groupid games.
2. SMC Router Random UDP Packet Denial Of Service Vulnerability
BugTraq ID: 8711
Remote: Yes
Date Published: Sep 26 2003
Relevant URL: http://www.securityfocus.com/bid/8711
Summary:
The SMC SMC2404WBR BarricadeT Turbo 11/22 Mbps Wireless Cable/DSL
Broadband Router is routing hardware that is intended to be deployed in
home or small office networks.
A denial of service has been reported in the SMC SMC2404WBR BarricadeT
Turbo 11/22 Mbps Wireless Cable/DSL Broadband Router. It is possible to
trigger this condition by sending UDP packets randomly to ports 0-65000.
The impact of the issues seems to vary, sometimes the router will need a
"soft reset" to regain normal functionality and sometimes a "hard reset"
will be required. The time it takes for the router to recover after being
reset may also vary. In any of these cases, the availability of a network
which depends on the router will be denied to legitimate users.
This condition was reportedly reproduced using one of the exploits for BID
8525.
The SMC7004VWBR router is also affected by this vulnerability.
SMC7004VWBR firmwares are reportedly affected even when security features
such as Stateful Packet Inspection, Anti-DoS and UDP sessions are enabled.
This may also be the case with other routers.
3. Savant Web Server Page Redirect Denial Of Service Vulnerabil...
BugTraq ID: 8712
Remote: Yes
Date Published: Sep 26 2003
Relevant URL: http://www.securityfocus.com/bid/8712
Summary:
Savant Web Server is a free HTTP server that runs on Windows platforms.
Savant Web Server is prone to a denial of service vulnerability. The
server reportedly goes into an infinite loop upon receipt of a specially
crafted HTTP GET request that causes the server to repeatedly redirect to
the default page. The server will eventually crash. A remote attacker
may exploit this condition to deny availability of web services rendered
by the software to legitimate users.
This issue may be similar in nature to the vulnerability described in BID
2468.
4. Sun One Application Server LDAP Incorrect Authentication Vul...
BugTraq ID: 8713
Remote: Yes
Date Published: Sep 26 2003
Relevant URL: http://www.securityfocus.com/bid/8713
Summary:
Sun One Application Server is a commercially-available application server
distributed and maintained by Sun Microsystems.
A problem has been identified in the Sun One Application Server when
authenticating against LDAP. Because of this, an attacker may be able to
gain unauthorized access to the Application Server.
The problem is in the handling of responses from the LDAP server.
Specifics are not currently known. However, it is conjectured that the
application server does not correctly interpret some responses from LDAP
servers when failed authentication results.
This BID will be further updated when more detailed information becomes
available.
5. Line9 Tek9 Shopping Cart SQL Injection Vulnerability
BugTraq ID: 8714
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8714
Summary:
Tek9 is a full-featured Shopping Cart software suite, developed by Line9.
It has been reported that Tek9 Shopping Cart is prone to SQL injection
attacks. The problem occurs when handling user-supplied password data
supplied to the program. Specifically, Tek9 fails to escape specific SQL
control characters contained within a users password before including it
within an SQL statement.
To exploit this vulnerability, an attacker may inject the password with
specially formatted SQL characters such as (') or ('=), and effectively
manipulate the logic of the statement. When the statement execution is
completed, the attacker will be successfully logged in as an
administrator.
The exploitation of this issue could ultimately allow an attacker to log
in as an administrator. This could potentially expose sensitive
information to the attacker, possibly including user credentials and
financial information.
6. Novell NetWare Broker Information Disclosure Vulnerability
BugTraq ID: 8715
Remote: Yes
Date Published: Sep 27 2003
Relevant URL: http://www.securityfocus.com/bid/8715
Summary:
Novell has reported that it is possible for unauthenticated clients to
view information related to the NDPS Broker on a webserver that may be
installed by default. Novell has stated that this is a low risk security
issue. The information disclosed includes:
1) The presence of a Broker on the server
2) The name and context of the Broker
3) Which, if any, Broker services are running
According to Novell, the information may be viewed, without any
authentication required, at the following URL:
http://:8008/Broker
It is assumed that this URL is to be directed at a specific NetWare
server. Symantec has not confirmed this.
The information disclosed due to this vulnerability may be of use to
attackers to launch more sophisticated attacks. The vendor has stated
that NetWare NetWare 6 and NetWare 5.1 are affected. NetWare 6.5 is not
vulnerable. Additional technical details are not known at this time.
7. freesweep Environment Variable Handling Buffer Overflow Vuln...
BugTraq ID: 8716
Remote: No
Date Published: Sep 28 2003
Relevant URL: http://www.securityfocus.com/bid/8716
Summary:
freesweep is a curses-based clone of the game "Minesweeper". It is
installed setgid "games" on some systems.
It has been reported that freesweep is vulnerable by a buffer overflow
condition related to the processing of several environment variables.
This vulnerability may be exploited by local attackers to gain group
"games" privileges.
It is likely that freesweep copies the value of certain environment
variables into local buffers of a predefined size without bounds checking.
As a result, it may be possible for attackers to execute code of their
choice by overwriting the saved return address on the stack. Any code
executed would run as effective groupid "games".
8. GuppY HTML Injection Vulnerability
BugTraq ID: 8717
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8717
Summary:
GuppY is a free suite of PHP scripts for creating an online portal.
It has been reported that one of the scripts included with GuppY is
vulnerable to an HTML injection attack. The script, "postguest.php", does
not perform input validation to prevent the inclusion of HTML/script
content in messages posted to the portal by remote clients. The flaw is
present in the implementation of the "[c]" tag, which can be used by users
posting messages in the forum or in the guestbook components of GuppY
portals.
According to the report, the value of the tag's "c" parameter is not
validated before being output again by the server. As a result, any
embedded HTML or script code may become part of the affected HTML
document. Consequently, malicious users may create and then inject into
the context of the portal arbitrary content that may either
inappropriately alter the presentation of the portal or manipulate the
client-server session (e.g. transmit cookies to a remote server).
The vendor is aware of the vulnerability and has released an updated
version, 2,4p1, that eliminates the issue.
9. Multiple Geeklog Vulnerabilities
BugTraq ID: 8718
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8718
Summary:
Multiple vulnerabilities have been reported in Geeklog. The following
issues were reported:
An HTML injection vulnerability that may allow unauthenticated remote
attackers to send hostile HTML and script code to Geeklog users via
Shoutbox.
Multiple cross-site script issues in the index.php, brokenfile.php and
read-story.php scripts that may permit remote attackers to construct
malicious links to a Geeklog site that include hostile HTML.
The HTML injection and cross-site scripting issues could potentially be
exploited to steal cookie-based authentication credentials from legitimate
users. Other attacks are also possible.
Several SQL injection issues have been reported in the index.php,
viewtopic.php, visit.php, viewcat.php, comment.php, read-story.php and
singlefile.php scripts. These issues could permit remote attackers to
inject malicious SQL syntax into database queries, potentially allowing
unauthorized access to sensitive information or other consequences.
Weaknesses in the Geeklog implementation have also been reported, such as
incorrect proxy logging and inadequate facilities for denying access by
IP.
Some of these issues may be related to previously documented
vulnerabilities in Geeklog. These issues are currently pending further
analysis. New BIDs will be created and existing BIDs updated where it is
appropriate when analysis is complete.
10. OmniCom winShadow Server Login Denial of Service Vulnerabili...
BugTraq ID: 8719
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8719
Summary:
OmniCom winShadow is a remote desktop tool designed for Microsoft Windows
platform. The software can be used to access remote systems through the
Internet or local area networks.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to cause a denial of service condition in the winShadow
server. The issue may present itself when an attacker sends long string
values to the server for user name and password during the login process.
This issue may cause the software to behave in an unstable manner leading
to a crash.
Successful exploitation of this issue may allow an attacker to cause the
software to crash or hang. It is not known if this condition may also be
exploited to execute arbitrary code.
OmniCom winShadow version 2.0 has been reported to be prone to this issue,
however other versions may be affected as well.
11. OmniCom winShadow hostname Buffer Overflow Vulnerability
BugTraq ID: 8720
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8720
Summary:
OmniCom winShadow is a remote desktop tool designed for Microsoft Windows
platform. The software can be used to access remote systems through the
Internet or local area networks.
A vulnerability has been reported to exist in the winShadow client that
may allow a remote attacker to gain unauthorized access to a vulnerable
system by executing arbitrary code on a vulnerable system. The condition
is present due to insufficient boundary checking.
It has been reported that winShadow saves hostnames in host files saved as
*.osh. The process responsible for reading hostnames from these files may
be prone to a buffer overflow condition if an attacker is able to pass an
extra 250 bytes in the hostname parameter. An attacker may leverage the
issue by exploiting an unbounded memory copy operation to overwrite the
saved return address/base pointer, causing the affected procedure to
return to an address of their choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
OmniCom winShadow version 2.0 has been reported to be prone to this issue,
however other versions may be affected as well.
12. Megacomputing Personal-WebServer Professional Remote Directo...
BugTraq ID: 8721
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8721
Summary:
Megacomputing Personal-WebServer Professional is a commercially-available
web server for personal websites. It is available for the Microsoft
Windows platform.
A problem has been identified in the handling of requests for files
outside of the web server root. Because of this, an attacker may be able
to gain unauthorized access to sensitive information.
The problem is in the handling of directory traversal requests. By
placing a request for a specific file outside the web root directory using
dot-dot-slash (../) or dot-dot-backslash (..\) requests, it is possible
for a user to gain unauthorized access with read permissions of the web
server process.
13. A-Cart MSG Cross-Site Scripting Vulnerability
BugTraq ID: 8722
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8722
Summary:
Alan Ward's A-Cart is a web based shopping cart application. It is
implemented in ASP, and designed for use with Microsoft Access under
Microsoft Windows based servers.
A-Cart has been reported prone to a cross-site scripting vulnerability.
The issue presents itself likely due to a lack of sufficient sanitization
performed on data contained in the 'msg' URI parameter that is passed to
signin.asp.
An attacker could exploit this condition to render arbitrary HTML in the
browser of a victim, stealing cookie authentication credentials or
performing other nefarious acts.
14. Megacomputing Personal-WebServer Professional Denial Of Serv...
BugTraq ID: 8723
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8723
Summary:
Megacomputing Personal-WebServer Professional is a commercially-available
web server for personal websites. It is available for the Microsoft
Windows platform.
A problem has been identified in the handling of requests of excessive
length by Megacomputing Personal-WebServer Professional. Because of this,
an attacker may be able to deny service to legitimate users of an affected
web server.
The problem is in the handling of strings of 255 or more bytes. By
placing a request for a URI of the previously mentioned length, it is
possible to crash the server. This condition may be due to a boundary
condition error, potentially resulting in memory corruption. If this is
the case, there is a possibility that this issue could be taken advantage
of to execute arbitrary code with the privileges of the web server
process. However, this theory has not yet been proven.
15. Webfs HTTP Server Information Disclosure Vulnerability
BugTraq ID: 8724
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8724
Summary:
WebFS is a simple web server that serves static content. It is available
for Linux and Unix variant operating environments.
An information disclosure vulnerability has been discovered in Webfs HTTP
server. The problem occurs due to insufficient sanitization of
user-supplied hostnames when accessing virtual hosts. Specifically,
placing dot-dot (..) sequences within a requested hostname can effectively
trigger this issue.
An attacker exploiting this issue may be capable of viewing the contents
of directories and files outside of the established web root. This issue
may only exist if the server has been configured to use virtual hosting.
16. Apache2 MOD_CGI STDERR Denial Of Service Vulnerability
BugTraq ID: 8725
Remote: No
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8725
Summary:
Apache HTTP Server is an open-source web server designed to run on a
number of different platforms.
Apache2 has been reported prone to a denial-of-service vulnerability. The
issue has been reported to present itself when a CGI script outputs 4k or
greater of data to STDERR. If this condition occurs the execution of the
script will reportedly pause indefinitely due to a locked write() call in
mod_cgi. Because Apache2 is waiting for further input from the malicious
CGI application, the httpd process may hang. When the maximum connection
limit is reached, Apache will no longer service requests, effectively
denying service to legitimate users.
This issue has been reported to affect Apache 2.0.47. Previous versions
may also be affected.
17. WebFS Long Pathname Buffer Overrun Vulnerability
BugTraq ID: 8726
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8726
Summary:
WebFS is a simple web server that serves static content. It is available
for Linux and Unix variant operating environments.
It has been discovered that WebFS is prone to a buffer overrun
vulnerability when handling path names of excessive length. As a result,
an attacker may be capable of triggering the condition and overwriting
sensitive memory with malicious data. This could ultimately allow for the
execution of arbitrary code with the privileges of the WebFS HTTP server.
It should be noted that for this condition to occur, an attacker must have
the ability to create directories on the affected system. This may be
accomplished by obtaining legitimate credentials, which allow for such
access, or possibly through the exploitation of another unrelated
vulnerability such as that described in BID 8724.
18. Sun Solaris Serial Console Excessive Output Data Denial of S...
BugTraq ID: 8727
Remote: Yes
Date Published: Sep 26 2003
Relevant URL: http://www.securityfocus.com/bid/8727
Summary:
Sun Solaris Serial Console has been reported prone to a denial of service
condition when handling excessive quantities of output data.
The issue occurs under undisclosed circumstances, however it has been
reported that the issue will only occur on Sun systems that use the 'su'
driver for serial console.
It has been conjectured that an attacker who has access to the Sun Solaris
serial console, may exploit this issue to trigger a kernel panic or system
hang.
19. mIRC USERHOST Buffer Overflow Vulnerability
BugTraq ID: 8728
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8728
Summary:
mIRC is a chat client for the IRC protocol, designed for Microsoft Windows
based operating systems.
A vulnerability has been reported to exist in the mIRC client that may
allow a remote attacker to gain unauthorized access by executing arbitrary
code on a vulnerable system. The condition is present due to insufficient
boundary checking.
It has been reported that during the connection process mIRC client sends
a USERHOST request to the server to receive the user's host information.
This process may lead to a buffer overflow condition if the server
responds to the request with a string that is larger than 110 bytes. An
attacker may leverage the issue by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing the
affected procedure to return to an address of their choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
mIRC versions 6.01 to 6.1 have been reported to be prone to this issue,
however other versions may be affected as well.
20. Mah-Jong MJ-Player Server Flag Local Buffer Overflow Vulnera...
BugTraq ID: 8729
Remote: No
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8729
Summary:
Mah-Jong is a freely available, open source implementation of the Mah-Jong
game. It is available for the Linux platform.
A problem in the handling of large requests supplied with certain flags
has been reported in Maj-Jong. Because of this, it may be possible for a
local attacker to gain elevated privileges.
The problem is in the handling of long parameters by mj-player. When
supplying a long parameter with the server flag (--server), a boundary
condition error occurs. This is due to insufficient bounds checking
during a strcpy() operation where the user-supplied server string is
copied into an internal buffer. As this program is typically installed
with privileges, it is possible for a user with local access to a system
with the vulnerable program installed to execute code with elevated
privileges.
This vulnerability may be related to the issues described that were
addressed in Debian Security Advisory DSA 378-1 and described in BID 8557.
If this is the case, this BID will be updated accordingly.
21. Half-Life Invalid Command Error Response Format String Vulne...
BugTraq ID: 8730
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8730
Summary:
The Half-Life client is a component of the Half-Life game distributed by
Valve Software. It is available for Microsoft Windows operating systems.
A vulnerability has been reported for the Half-Life client. The problem
occurs when displaying error messages triggered by invalid commands.
Typically, when an invalid command is issued in a client console, the
command is sent to the server and an error message containing the command
is returned. This error is then displayed within the client console.
It has been reported that one of the functions used to display the error
information fails to sufficiently define format specifiers for the invalid
command. As a result, a format specifier embedded within the command will
be interpreted by the erroneous function call.
This vulnerability could theoretically be exploited to execute arbitrary
code with the privileges of the Half-Life client. This may be accomplished
via a malicious Half-Life server, or possibly a script file loaded and
executed by the victim.
22. Sun SAM-FS File System Deadlock Denial of Service Vulnerabil...
BugTraq ID: 8731
Remote: No
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8731
Summary:
Storage and Archive Manager File System (SAM-FS) is a file system designed
for high capacity and high-speed servers.
A bug in the Sun SAM-FS file system implementation may make it possible to
trigger a local denial of service on some Solaris systems. The problem is
said to occur when applications create large files and subsequently
truncate to a non-zero file. When this occurs, a deadlock in the file
system may occur, effectively rendering the system unusable.
The deadlock specifically occurs between a call to the fsflush() and
sam_update_filsys() functions.
It should be noted that this vulnerability might also affect systems
implementing the QFS file system.
23. OpenSSL ASN.1 Parsing Vulnerabilities
BugTraq ID: 8732
Remote: Yes
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8732
Summary:
Multiple vulnerabilities were reported in the ASN.1 parsing code in
OpenSSL. OpenSSL does not directly implement ASN.1 but does use ASN.1
objects in X.509 certificates and various other cryptographic elements.
The following issues were reported:
Two flaws in the ASN.1 parser could lead to denial of service attacks.
The first bug may be exploited to cause an out of bounds read operation to
occur, most likely resulting in a denial of service. This can be
triggered by a malformed or unusual ASN.1 tag value. The second of the
described bugs occurs if an application is configured to ignore public key
decode errors (specifically the
X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY error). This is reportedly
not a common configuration in production setups but some applications may
ignore decode errors for debugging reasons. As a result, the impact and
exposure will vary depending on the targeted application and some
applications may be more vulnerable to attacks than others. Remote
attackers can exploit this issue with a maliciously crafted SSL client
certificate. CAN-2003-0543 and CAN-2003-0544 correspond to these two
denial of service issues. The issues are reported to exist in SSLeay and
OpenSSL versions prior to 0.9.7c or 0.9.6k.
Another vulnerability related to ASN.1 parsing was reported in OpenSSL
0.9.7. ASN.1 encodings that are rejected by the parser due to being
invalid may potentially trigger a memory management error. In particular,
a double free may result due to an ASN.1 structure (ASN1_TYPE) being
deallocated incorrectly. This reportedly could be leveraged to corrupt
stack memory. In this manner, sensitive stack variables such as
instruction pointers could be overwritten with attacker-supplied values.
The issue could be exploited by remote attacks via a maliciously crafted
SSL client certificate. This issue has been assigned CVE name
CAN-2003-0545.
An additional weakness was reported that may aid in exploitation of these
issues. In some circumstances, a client may force a server to parse a
client certificate when one has not been specifically requested. This
could even occur with server implementations that don't enable client
authentication.
Any applications which use the OpenSSL ASN.1 library to handle external
data may present an attack vector for these vulnerabilities.
These issues are pending further analysis and will be separated into
individual BIDs when analysis is complete.
24. Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
BugTraq ID: 8734
Remote: Yes
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8734
Summary:
Gamespy 3D is a Microsoft Windows based application used to find game
servers for various games. The software also has a built in IRC client
for chat and file sharing.
A vulnerability has been reported to exist in the Gamespy 3D IRC client
that may allow a remote attacker to gain unauthorized access by executing
arbitrary code on a vulnerable system. The condition is present due to
insufficient boundary checking.
It has been reported that during the connection process the IRC client
sends USER and NICK requests to the IRC server to receive the user
information. This process may lead to a buffer overflow condition if the
server responds to the request with a string that is larger than or equal
to 262 bytes. An attacker may leverage the issue by exploiting an
unbounded memory copy operation to overwrite the saved return address/base
pointer, causing the affected procedure to return to an address of their
choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
Gamespy 3D versions 2.63015 and prior have been reported to be prone to
this issue, however other versions may be affected as well.
25. HP Unspecified Local Socket Implementation Denial of Service...
BugTraq ID: 8735
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8735
Summary:
HP has announced the existence of an unspecified local vulnerability
relating to programs implementing sockets; denial of service attacks
possible. Although unconfirmed, this issue may be a result of memory
leakage when handling multiple sockets or possibly due to insufficient
sanity checks, allowing an attacker to exhaust socket resources.
It has been reported that an attacker may exploit this issue to crash an
affected system
The precise details of this vulnerability are currently unknown, however
this BID will be updated as further information is made available.
26. Silly Poker Local HOME Environment Variable Buffer Overrun V...
BugTraq ID: 8736
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8736
Summary:
Silly Poker is a simple poker card game developed for the Linux operating
system. It has been reported that on the Debian Linux distribution, the
sillypoker binary is installed setgid games by default.
*** It should be noted that new details released suggest that the
sillypoker binary is in fact not installed setgid games on Debian systems.
As such, the impact of this issue may be greatly limited.
A local buffer overrun vulnerability has been reported for Silly Poker.
The problem occurs due to insufficient bounds checking when handling
user-supplied data. As a result, an attacker may be capable of controlling
the execution flow of the sillypoker program and effectively executing
arbitrary code with elevated privileges.
Exploiting this condition may allow an attacker to gain group 'games'
privileges which could be used to modify sensitive information or could be
used to leverage attacks against other previously inaccessible utilities.
27. Invision Power Board Insecure Permissions Vulnerability
BugTraq ID: 8737
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8737
Summary:
Invision Power Board is web forum software. It is implemented in PHP and
is available for Unix and Linux variants and Microsoft Windows operating
systems.
Invision Power Board has been reported prone to a configuration issue that
could allow attackers with local interactive access to modify Invision
Power Board '.php' source files. The issue has been reported to present
itself because Invision Power Board does not correctly set permissions on
folders during the installation process. Specifically all folders are
created with group write permissions. Any local user who is a member of
the same group as Invision Power Board may make modifications to Invision
Power Board source files.
A local attacker may exploit this condition to execute arbitrary code with
the privileges of the web server.
It should be noted that although this vulnerability has been reported to
affect Invision Power Board versions 1.1.1 and 1.1.2, other versions might
also be affected.
28. IBM AIX GetIPNodeByName API Socket Management Vulnerability
BugTraq ID: 8738
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8738
Summary:
AIX is the Unix operating system distributed and maintained by IBM.
A problem has been reported in the socket handling of IBM AIX. Because of
this, an attacker may be able to crash an application on a vulnerable
system.
The problem is in the management of sockets that use the GetIPNodeByName
function. Under some circumstances, this function does not properly close
sockets during operation. This may allow an attacker to open a large
amount of sockets in services using the function, resulting in a denial of
service.
29. Multiple DCP-Portal SQL Injection Vulnerabilities
BugTraq ID: 8739
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8739
Summary:
DCP-Portal is a web portal system implemented in PHP that uses a MySQL
backend database. The development cycle for this product has been
temporarily suspended.
Multiple SQL Injection vulnerabilities have been discovered that affect
DCP-Portal scripts. These issues are likely due to a lack of sufficient
sanitization performed on user supplied URI parameters. Attacks have been
demonstrated that inject partial SQL queries, as values for URI
parameters, in a manner that influences DCP-Portal SQL query logic to the
attackers benefit. The 'password' URI parameter associated with the
'advertiser.php' script and the 'email' URI parameter associated with the
'lostpassword.php' script has been demonstrated as vulnerable.
An attacker may exploit these conditions to disclose DCP-Portal
credentials, reset user passwords, or perform a denial of service type
attack via email spamming.
Although this issue has been reported to affect DCP-Portal version 5.5,
prior versions may also be affected.
30. Atrise Everyfind search Cross-Site Scripting Vulnerability
BugTraq ID: 8740
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8740
Summary:
Atrise Everyfind is a search utility that allows users to add a search
engine to websites and documents.
A vulnerability has been reported to exist in the search module of the
software that may allow a remote attacker to execute HTML or script in a
user's browser. This issue exists due to insufficient sanitization of
user input.
The problem is reported to exist due to a lack of sanitization of
user-supplied input by the software. HTML and script code will be rendered
in a user's browser, therefore making it possible for an attacker to a
construct a malicious link containing HTML or script code that may be
rendered in a user's browser upon visiting that link. This attack would
occur in the security context of the vulnerable site.
Successful exploitation of this vulnerability may allow an attacker to
steal cookie-based authentication credentials. Other attacks may well be
possible.
Atrise Everyfind 5.02 has been listed as a vulnerable package, however
other versions may be affected as well.
31. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
BugTraq ID: 8742
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8742
Summary:
IBM DB2 is a commercial relational database implementation that is
available for a number of operating systems including Microsoft Windows
and Unix/Linux variants.
IBM DB2 includes the LOAD command, which allows for data located in files,
pipes or devices to be stored within a database table. It has been
discovered that the application fails to carry out sufficient bounds
checking when handling the LOAD command.
An attacker with 'Connect' privileges could exploit this vulnerability
remotely, likely by passing excessive data as an argument to the LOAD
command. This would allow for sensitive stack variables adjacent to the
affected memory buffer to be overrun. An attacker could leverage this
memory corruption to influence the execution flow of IBM DB2, possibly
redirecting execution into a malicious payload.
All code executed in this manner will be run with the privileges of the
IBM DB2 process. This is typically the 'Administrators' group on Microsoft
Windows environments and either the 'db2as' or 'db2inst1' users on Linux
systems.
It should be noted that IBM has confirmed that the affected code is shared
amongst IBM DB2 v7 and v8, making both vulnerable to this condition.
32. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
BugTraq ID: 8743
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8743
Summary:
DB2 is the database implementation maintained and distributed by IBM. It
is available for the UNIX, Linux, and Microsoft Windows platforms.
A problem in IBM DB2 has been reported when specific queries are passed to
the INVOKE stored procedure. Because of this, an attacker may be able to
gain unauthorized access to system resources.
The problem is in the checking of bounds on the INVOKE stored procedure.
By passing a maliciously crafted string to the procedure, it is possible
to overwrite sensitive regions of stack memory. An attacker could take
advantage of this issue to execute code at an arbitrary location in memory
with the privileges of the database process.
This problem has been reported to occur in version 7.2 for Microsoft
Windows only.
33. MPNews PRO Directory Traversal Information Disclosure Vulner...
BugTraq ID: 8744
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8744
Summary:
MPNews PRO is a news server available for the Microsoft Windows operating
system.
It has been reported that MPNews PRO is prone to an information disclosure
vulnerability. The problem is believed to occur due to MPNews PRO failing
to sufficiently filter specific dot-dot-slash sequences (../).
Specifically, making a request for a file prefixed by a sequence of
"./../" may cause the request to be interpreted outside of the web root.
As a result, an attacker may be capable of viewing the contents of
arbitrary files on the local system.
Access to these files my expose sensitive information to the attacker that
could potentially be used in launching further attacks against the target
system.
34. Mutant Penguin MPWeb PRO Directory Traversal Vulnerability
BugTraq ID: 8745
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8745
Summary:
Mutant Penguin MPWeb PRO is a Microsoft Windows based web server. It
allows users to create and host dynamic web sites.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to traverse outside the server root directory in order
to access sensitive server readable files. The issue presents itself due
to insufficient sanitization of user-supplied input and may allow an
attacker to access unauthorized information by issuing '/./../' character
sequences.
This vulnerability may be successfully exploited to gain sensitive
information about a vulnerable host that could be used to launch further
attacks against the system.
MPWeb PRO version 1.1.2 has been reported to be affected by this issue,
however other versions may be vulnerable as well.
35. OpenSSL SSLv2 Client_Master_Key Remote Denial Of Service Vul...
BugTraq ID: 8746
Remote: Yes
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8746
Summary:
OpenSSL is an open source implementation of the SSL protocol.
OpenSSL SSLv2 has been reported prone to a remotely triggered denial of
service when processing a specially crafted malicious CLIENT_MASTER_KEY
message.
It has been reported that a remote attacker may use a maliciously crafted
CLIENT_MASTER_KEY message to influence the execution flow of a vulnerable
service implementing SSLv2 into a die() procedure. This will effectively
cause the affected process to abort, denying service to legitimate users.
An attacker may flood an affected service with malicious CLIENT_MASTER_KEY
messages, persistently denying service for legitimate users. Other attacks
may also be possible. The impact and exposure may vary depending on the
particular applications that use vulnerable OpenSSL libraries.
This vulnerability is not reported to be present in OpenSSL versions
greater than 0.9.6f of the 0.9.6 series of releases, because the use of
the die() procedure is no longer implemented. It is not known whether the
0.9.7 series is also affected.
36. Microsoft Windows PostThreadMessage() Arbitrary Process Kill...
BugTraq ID: 8747
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8747
Summary:
The Microsoft Windows operating system includes a wide variety of API
function calls. One such call is the PostThreadMessage() function, which
can be used to send a variety of messages to a specified thread. This
function will fail if the specified thread does not include a message
queue. A queue will only be created if the thread has issued a Win32 USER
or GDI function call.
Included in the various messages that can be sent to a process are the
WM_QUIT, WM_DESTROY, and WM_CLOSE messages. These messages are
specifically designed to notify a process that it should subsequently be
terminated.
It has been discovered that processes sent these messages fail to
sufficiently verify their origin, and proceed to terminate. As a result,
an unprivileged program running with the privileges of any local user may
be capable of sending one of the three messages to an arbitrary process
and cause it to terminate. This will occur no matter what security level
the target process may be running at. As mentioned above, the targeted
process must include a message queue at the time of exploitation.
This vulnerability could be exploited by a local attacker to disable
various security-related software designed to limit a local users ability
to carry out various actions. Other processes may also be targeted.
37. FreeBSD Kernel ProcFS Handler UIO_Offset Integer Overflow Vu...
BugTraq ID: 8748
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8748
Summary:
All versions of the FreeBSD kernel have been reported prone to an integer
overflow vulnerability. The issue presents itself in the procfs handling
procedures, and has been reported to be due to a lack of sufficient sanity
checks performed on 'uio' offset parameters.
It has been reported that a local attacker may exploit this condition
because it is possible to indirectly influence the value for the 'uio'
offset. Ultimately an attacker may trigger an integer overflow or
underflow condition. This may result in a read attempt from non-resident
kernel memory, triggering a kernel panic and effectively denying service
to legitimate users. A local attacker may also exploit this issue to
disclose potentially sensitive data stored in regions of memory that would
otherwise be restricted.
This issue has been reported to be exploitable on systems that have procfs
enabled.
38. FreeBSD Kernel Readv() Integer Overflow Vulnerability
BugTraq ID: 8749
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8749
Summary:
A local vulnerability has been discovered within the FreeBSD kernel. The
problem occurs within the readv() system call, which is used to read data
and scatter it into an arbitrary number of buffers specified by an
argument.
When a file is accessed by a system call in FreeBSD, such as open() or
dup2(), the reference counter (f_count) for that file is incremented using
the fhold() function and when access is complete the counter is
decremented by fdrop().
It has been discovered that the readv() system call fails to call the
fdrop() function after a specific procedure had previously triggered a
call to fhold(). As a result, by triggering a large number of calls to
fhold() in a call to readv(), it may be possible to cause the f_count
integer value to wrap.
It has been reported that this integer overflow can be triggered by
supplying an overly large iovcnt variable in a call to readv(). As a
result, an attacker may potentially be capable of trigger kernel memory
corruption. This could ultimately result in a system panic or could
possibly be leveraged to elevate local privileges to that of the root
user.
39. FortiGate Firewall Web Filter Logs HTML Injection Vulnerabil...
BugTraq ID: 8750
Remote: Yes
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8750
Summary:
FortiGate are a series of commercial firewall appliances which run an
embedded operating system entitled FortiOS.
The FortiGate web interface is prone to an HTML injection vulnerability.
Denied requests are logged into a web filter log which is viewable through
the web administrative interface. HTML and script code will not be
sanitized when these requests are logged. To exploit this issue, the
attacker must construct for a resource that will be denied by the
firewall, based on the defined policies of the targeted firewall.
Malicious could then be embedded in the request, which will be logged as
part of the request.
An attacker could exploit this to cause hostile code to be rendered in the
browser of an administrative user who views the logs. This could result
in theft of cookie-based authentication credentials from the firewall
administrator, potentially allowing for firewall compromise. Since the
attacker can control how the logs will be rendered to the administrator,
it is also possible to spoof or conceal log entries.
This issue reportedly exists in FortiOS releases prior to 2.50MR4.
40. Inter7 VPopMail Configuration File Insecure Default Permissi...
BugTraq ID: 8751
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8751
Summary:
vpopmail is a freely available, open source virtual domain handling
software package. It is available for the Unix and Linux operating
systems.
A problem has been identified in the default configuration of vpopmail.
Because of this, an attacker may be able to gain access to potentially
sensitive information.
The problem is in the creation of the configuration file. When vpopmail
is compiled with MySQL support, authentication data is stored in the
/etc/vpopmail.conf file. This file is created with world-readable
permissions, which may reveal sensitive information such as authentication
credentials for the database. An attacker could use these credentials to
potentially gain access to the database as the vpopmail database user.
This problem has been reported on Gentoo Linux, but may affect other
operating systems.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Brits pound OpenSSL bugs
By: Kevin Poulsen
U.K.-funded security research discovers holes in the package's
implementation of Abstract Syntax Notation One.
http://www.securityfocus.com/news/7103
2. Car shoppers' credit details exposed in bulk
By: Kevin Poulsen
Consumers who submitted online credit applications to any of 150 different
automotive dealerships around the U.S. had their personal financial
information exposed on a publicly-accessible website.
http://www.securityfocus.com/news/7067
3. Accused AOL phisher spammed the FBI
By: Kevin Poulsen
Fraudulent e-mail asked an FBI computer crime agent for his credit card
number. Charges have been filed.
http://www.securityfocus.com/news/7018
4. US cableco seeks to quash RIAA subpoenas
By: Drew Cullen, The Register
http://www.securityfocus.com/news/7148
5. Following legal threat, VeriSign agrees to suspend Site Find...
By: Anick Jesdanun, The Associated Press
http://www.securityfocus.com/news/7137
6. Trojan hijacks web browsers
By: John Leyden, The Register
http://www.securityfocus.com/news/7133
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. pmacct v0.5.1
By: Paolo Lucente
Relevant URL: http://www.ba.cnr.it/~paolo/pmacct/
Platforms: Linux, OpenBSD
Summary:
pmacct is a network tool to gather IP traffic information (source address,
bytes counter, and number of packets). Data is stored in an in-memory
table whose content could be retrieved by a client program via a local
stream-oriented connection. Gathering packets off the wire is done using
the pcap library and one or more network interfaces in promiscuous mode.
2. screen-scraper v1.1.5
By: ekiwi
Relevant URL: http://www.screen-scraper.com/screen-scraper/
Platforms: Os Independent
Summary:
screen-scraper is a tool for extracting data from Web sites. It consists
of a proxy server that allows the contents of HTTP and HTTPS requests to
be viewed, and an engine that can be configured to extract information
from Web sites using special patterns and regular expressions. It handes
authentication, redirects, and cookies, and contains an embedded scripting
engine that allows extracted data to be manipulated, written out to a
file, or inserted into a database. It can be used with PHP, Java, or any
COM-friendly language such as Visual Basic or Active Server Pages.
3. Scapy v0.9.15
By: Philippe Biondi
Relevant URL: http://www.cartel-securite.fr/pbiondi/scapy.html
Platforms: Linux, POSIX
Summary:
Scapy is a powerful interactive packet manipulation tool, packet
generator, network scanner, network discovery tool, and packet sniffer. It
provides classes to interactively create packets or sets of packets,
manipulate them, send them over the wire, sniff other packets from the
wire, match answers and replies, and more. Interaction is provided by the
Python interpreter, so Python programming structures can be used (such as
variables, loops, and functions). Report modules are possible and easy to
make. It is intended to do about the same things as ttlscan, nmap, hping,
queso, p0f, xprobe, arping, arp-sk/arpspoof, firewalk, irpas, tethereal,
and tcpdump.
4. phpOpenTracker v1.3.0
By: Sebastian Bergmann
Relevant URL: http://www.phpopentracker.de/
Platforms: N/A
Summary:
phpOpenTracker is a framework solution for the analysis of Web site
traffic and visitor behaviour. It features a logging engine that, either
invoked as a Web bug by an HTML image tag or embedded with two lines of
code into your PHP application, logs each request to a Web site into a
database. One installation can track an arbitrary number of Web sites.
Through its API, you can easily access the gathered data and perform
complex operations on it (for instance, the analysis of your visitors'
click paths).
5. NSA Security-enhanced Linux v2003100110
By: National Security Agency
Relevant URL: http://www.nsa.gov/selinux/
Platforms: Linux
Summary:
NSA Security-enhanced Linux is a set of patches to the Linux kernel and
some utilities to incorporate a strong, flexible mandatory access control
architecture into the major subsystems of the kernel. It provides a
mechanism to enforce the separation of information based on
confidentiality and integrity requirements, which allows threats of
tampering and bypassing of application security mechanisms to be addressed
and enables the confinement of damage that can be caused by malicious or
flawed applications. It includes a set of sample security policy
configuration files designed to meet common, general-purpose security
goals.
6. NuFW v0.5.1
By: regit
Relevant URL: http://www.nufw.org
Platforms: Linux, POSIX
Summary:
NuFW is a set of daemons providing filtering of packets at the user level.
On the client side, users have to run a client that sends authentication
packets to the gateway. On the server side, the gateway associates userids
to packets, thus enabling the possibility to filter packets on a user
basis. Furthermore, the server architecture is done to use external
authentication source such as an LDAP server.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Senior IT Auditor - Atlanta, Georgia (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340325
2. Sr CISSP InfoSec Engineer looking for opening (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340324
3. Security Consulting Sales/Business Development - San... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340323
4. Information Security Specialist - Livingston, NJ (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340235
5. Security Engineer w/ACTIVE Secret Clearance (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340227
6. Ernst and Young's Advanced Security Centers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340226
7. Security Engineer with ACTIVE Secret Clearance (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340213
8. PKI Windows Security Specialist - Bloomington, IL (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340211
9. Security Analyst (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340208
10. System Security Engineer III vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340171
11. UK Sales Manger vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340170
12. Principle Research Scientist - Trusted Computing (d... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340169
13. *** Product Marketing Manager, Bay Area, CA *** (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340060
14. Remediation - QA Position Open (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340059
15. Information Security Analyst Nashville TN $55K - $... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340058
16. *** Technical Marketing Engineer, Bay Area, CA *** (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340057
17. Junior security position sought - two years' NOC exp... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339915
18. Repost: Resume for Unix/Network Security Guru (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339914
19. Resume for Unix/Network Security Guru (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339861
20. Needed Network Security Professionals (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339808
21. Position Available: Director of Business Continuity ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339807
22. Regional Sales Manager(s) - Security Software - IL, ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339806
23. Security Consulting Sales/Business Development - Ral... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339804
24. Infosec Strategy/Arch/Policy (BC, Canada) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339800
25. Technical Marketing Engineer - Neoteris - Sunnyvale,... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339799
26. Product Manager - Neoteris - Sunnyvale, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339796
27. Hello, could you post thes positions. thanks Herb (... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339713
28. ISSM/ISSO Position - Reston, VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339712
29. Sr. IDS Manager/Engineer - Bethesda, MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339711
30. Security Analyst position open at Apple (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339710
31. Recent Graduate looking for a security position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339709
32. System Security Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339708
33. Mgr. Network Security Operations - NYC $120-$130K b... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339673
34. Looking for a position as a security researcher (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339651
35. New Articles @ SecurityFocus (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339581
36. Security Pre Sales Engineer New York (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339554
37. Hiring Security Consultant - So. Cal or Chicago Pref... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339553
38. Full time positions in Miami and Chicago (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339552
39. Security Consultant - Orange County or Chicago Prefe... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339551
40. TS/SCi Sr. Level Network Security Architect/Implemen... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339550
41. Sr. Forensics Specialist with Verizon Wireless (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339509
42. Manager of Info Security with Verizon Wireless (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339506
43. Who is hiring top security researchers? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339505
44. Engineer Available, Dallas/Fort Worth Texas (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/339502
VI. INCIDENTS LIST SUMMARY
--------------------------
1. BIND 9.2.1 crashes (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340319
2. Strange packets from Verisign Sitefinder (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340100
3. cron exploit? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339943
4. Repository of virus/worm propagation methods? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339855
5. Help in flood (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339830
6. Possible variant of Blaster/Nachi/Welchia? (more) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/339512
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Bug in Microsoft Word (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340191
2. Problem with sample buffer overflow exploit solved (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340149
3. Fake frame overwriting (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339847
4. sample buffer overflow exploit problem (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339763
5. NISSC SSL/TLS Test suite? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339762
6. Is this PHP code secure from CSS ? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339761
7. Format string bug in Half-Life client, but is it rea... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339617
8. Format string bug in Half-Life client, but is it rea... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339548
9. MPlayer buffer overflow (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339547
10. Possible Apache directory rules bypass / override (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/339545
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Wasn't someone looking for a Group Policy collection... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340330
2. R: Registry Settings for Group Policy Security Optio... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340104
3. Article Announcement: Linux vs. Windows Viruses (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340103
4. windows ce exploits (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340102
5. New exploit circulating for IE vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339998
6. Registry Settings for Group Policy Security Options (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339997
7. IPsec vs any personal software firewall (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339820
8. SecurityFocus Microsoft Newsletter #156 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339667
9. IPsec vs any personal software firewall (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339664
10. Article Announcement: Lost in Translation (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339522
11. Blocking and allowing ActiveX (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339483
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Password expiration in Solaris (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/339520
X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2003-09-29 to 2003-10-06.
XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored By: ClearSight Networks
Do you want see what your networked applications look like without having
to decode packets? Tired of the three window text decodes?
ClearSight Networks has introduced a visual network analyzer that shows
you your network problems from an application perspective. It is easy-to-
use, visual, and quickly pinpoints problems. Download a full working
Trial Demo for free and see the difference.
Click here to get more information and a free product download.
http://www.securityfocus.com/sponsor/ClearSightNetworks_sf-news_031006
------------------------------------------------------------------------