SecurityFocus Newsletter #218
Kelly Martin <[email protected]> Mon, 13 Oct 2003 13:56:48 -0600 (MDT)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #218
------------------------------
This Issue is sponsored by: Clearsight Networks
FREE Whitepaper: Better Management for Network Security
Looking for a better way to manage your IP security?
Learn how Solsoft can help you:
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console
Download our FREE whitepaper at:
http://www.securityfocus.com/sponsor/ClearSightNetworks_sf-news_031013
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Demonstrating ROI for Penetration Testing (Part Four)
2. SPECIAL ANNOUNCEMENT - RSS feeds
II. BUGTRAQ SUMMARY
1. OpenSSL ASN.1 Parsing Vulnerabilities
2. Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
3. HP Unspecified Local Socket Implementation Denial of Service...
4. Silly Poker Local HOME Environment Variable Buffer Overrun V...
5. Invision Power Board Insecure Permissions Vulnerability
6. IBM AIX GetIPNodeByName API Socket Management Vulnerability
7. Multiple DCP-Portal SQL Injection Vulnerabilities
8. Atrise Everyfind search Cross-Site Scripting Vulnerability
9. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
10. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
11. MPNews PRO Directory Traversal Information Disclosure Vulner...
12. Mutant Penguin MPWeb PRO Directory Traversal Vulnerability
13. OpenSSL SSLv2 Client_Master_Key Remote Denial Of Service Vul...
14. Microsoft Windows PostThreadMessage() Arbitrary Process Kill...
15. FreeBSD Kernel ProcFS Handler UIO_Offset Integer Overflow Vu...
16. FreeBSD Kernel Readv() Integer Overflow Vulnerability
17. FortiGate Firewall Web Filter Logs HTML Injection Vulnerabil...
18. Inter7 VPopMail Configuration File Insecure Default Permissi...
19. Cisco CatOS Password Prompt Unauthorized Remote Command Exec...
20. EarthStation 5 Search Service Remote File Deletion Vulnerabi...
21. Cisco PIX ICMP Echo Request Network Address Translation Pool...
22. Cisco LEAP Password Disclosure Weakness
23. Multiple Wordpress Blog.Header.PHP SQL Injection Vulnerabili...
24. Sun Cobalt RaQ Message.CGI Cross-Site Scripting Vulnerabilit...
25. Microsoft Internet Explorer Absolute Position Block Denial O...
26. Conectiva Vixie-Cron Package Potential Denial Of Service Vul...
27. SquirrelMail CSS JavaScript Expression MSIE Script Code Inje...
28. Microsoft Word Malformed Document Denial of Service Vulnerab...
29. Netscreen ScreenOS DHCP Packet Buffer Padding Information Le...
30. Divine Content Server Error Page Cross-Site Scripting Vulner...
31. PHP-Nuke mailattach.php Remote File Upload Vulnerability
32. Conexant AccessRunner DSL Console Authentication Bypass Vuln...
33. EternalMart Multiple Remote File Include Vulnerabilities
34. GuppY Cross-Site Scripting Vulnerability
35. GuppY Remote File Access Vulnerability
36. XShisen '-KCONV' Local Buffer Overflow Vulnerability
37. PrimeBase SQL Database Server Insecure Installation Temporar...
38. PrimeBase SQL Database Server Insecure Default Binary Permis...
39. JBoss HSQLDB Remote Command Injection Vulnerability
40. PHP Prayer Board SQL Injection Vulnerability
41. PHP Prayer Board Cross-Site Scripting Vulnerability
42. XShisen 'XSHISENLIB' Local Buffer Overflow Vulnerability
43. File Sharing Software Easy File Sharing Web Server Informati...
44. SuSE Linux SuSEWM Configuration File Insecure Temporary File...
45. SuSE Linux JavaRunt Configuration File Insecure Temporary Fi...
46. SLocate User-Supplied Database Heap Overflow Vulnerability
47. MiniHTTPServer File-Sharing for NET Forum HTML Injection Vul...
48. MiniHTTPServer WebForums Forum HTML Injection Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Teen charged in cyber stock scam
2. Brits pound OpenSSL bugs
3. Car shoppers' credit details exposed in bulk
4. Microsoft to improve Windows security
5. Bio-terror kit going cheap ... from the Pentagon
6. Popular PC game stolen by hackers before release
IV. SECURITYFOCUS TOP 6 TOOLS
1. OTPW v1.3
2. Devil-Linux v1.0-RC1
3. High Level Firewall Language v0.60.1
4. NetMRG v0.10
5. afick v1.2-0
6. vnStat v1.2
V. SECURITYJOBS LIST SUMMARY
1. How do Employers feel about online Degrees (Thread)
2. Job in KSA (Thread)
3. Sr SW Eng Windows Domain Controller Silicon Valley C... (Thread)
4. experienced e-security specialists (Thread)
5. Information Security Analyst $55-$65K base Nashville... (Thread)
6. Security Operations Manager - NYC Financial Service... (Thread)
7. Entry Level Pen Testing Engineers - NYC $60-$80K ba... (Thread)
8. SW Vulnerability Detection Engineer Silicon Valley ... (Thread)
9. Manager of Security Policy and Management Needed!! (Thread)
10. Looking for former EDS, Booz Allen reps in Fed (Thread)
11. Security Systems Architect-TN (Thread)
12. Security Implementation Project Manager (Thread)
13. Federal Bus/Dev Manager (100k base, 200k+ at plan) (Thread)
14. Federal Sales Director for IPS (115 base-220 plan) (Thread)
15. Junior White Hats and Pen Testers NYC $60K-$80K (Thread)
16. Fwd: Midatlantic Sales Position/ Commercial Accounts... (Thread)
17. Product Support Manager, Sunnyvale, CA (Thread)
18. Pre Sales Engineer- Virginia (Thread)
19. InfoSec Masters Student w/ 8 years LAN/WAN @ Securit... (Thread)
20. Hong Kong - Looking for a grey hat for conferences e... (Thread)
21. Resume: Wash DC - Network Security Engineer / Analys... (Thread)
22. IDS Engineers Needed - Washington DC Area (Thread)
23. Security Solutions - Business Development - London (Thread)
24. Senior Systems Security Engineer Position in New Orl... (Thread)
25. AOL Incident Response in Northern VA (Thread)
26. Network Security Engineering Supervisor - Seattle, W... (Thread)
27. Software Engineer / Application Designer available (Thread)
28. Permanent Security Supervisor position in Pittsburgh... (Thread)
29. Managerial position wanted - Sacramento/CA/US (Thread)
30. Seeking computer forensics position (Thread)
31. Sr. SQA Engineer - Santa Monica, CA. (Thread)
32. DITSCAP or NIACAP Expert Needed! (Thread)
33. Lead Software Engineer - LDAP (Thread)
34. Senior IT Auditor - Grand Rapids,Michigan (Thread)
35. Senior IT Auditor - Atlanta, Georgia (Thread)
36. Sr CISSP InfoSec Engineer looking for opening (Thread)
37. Security Consulting Sales/Business Development - San... (Thread)
38. Information Security Specialist - Livingston, NJ (Thread)
39. Security Engineer w/ACTIVE Secret Clearance (Thread)
40. Ernst and Young's Advanced Security Centers (Thread)
41. Security Engineer with ACTIVE Secret Clearance (Thread)
42. PKI Windows Security Specialist - Bloomington, IL (Thread)
43. Security Analyst (Thread)
44. System Security Engineer III vacancy (Thread)
45. UK Sales Manger vacancy (Thread)
46. Principle Research Scientist - Trusted Computing (d... (Thread)
VI. INCIDENTS LIST SUMMARY
1. cron exploit? (Thread)
2. strange windows behaviour. (Thread)
3. Administrivia: strange windows behaviour. (Thread)
4. Spamming, 'hidden' mail server (Thread)
5. tcp 17888 (Thread)
6. P2P applications scanning? Trojan? Malicious users... (Thread)
7. FW: [INFRAGARD-ATLANTA] DoS on cisco.com (Thread)
8. BIND 9.2.1 crashes (Thread)
9. AW: BIND 9.2.1 crashes (Thread)
10. Strange packets from Verisign Sitefinder (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Bug in Microsoft Word (Thread)
2. Why this wont work (Thread)
3. overwriting .dtors using gcc 3 (Thread)
4. Why doesnt work? (Thread)
5. MS03-035 (Thread)
6. Allchin bug p-o-c. (Thread)
7. Tiny Windows 2000 Reverse Connect (Thread)
8. I've found the Allchin bug. (Thread)
9. The joys of impurity (was: MOSDEF, InlineEgg) (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Tool for 026/ 039 (Thread)
2. Windows 2000 Server hardening (Thread)
3. SecurityFocus Microsoft Newsletter #157 (Thread)
4. MS03-040 MS Internet Explorer Cumulative Patch (Thread)
5. Wasn't someone looking for a Group Policy collection... (Thread)
6. R: Registry Settings for Group Policy Security Optio... (Thread)
7. Article Announcement: Linux vs. Windows Viruses (Thread)
IX. SUN FOCUS LIST SUMMARY
1. sunscreen vpn (Thread)
X. LINUX FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2003-10-03 to 2003-10-10.
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Demonstrating ROI for Penetration Testing (Part Four)
By Marcia Wilson
The last article in this series discusses the Penetration Testing process
and makes final assertions about how ROSI (Return on Security Investment)
can be shown.
http://www.securityfocus.com/infocus/1736
2. SPECIAL ANNOUNCEMENT
SecurityFocus is pleased to announce the relaunch of our RSS feeds.
http://www.securityfocus.com/rss/index.shtml
II. BUGTRAQ SUMMARY
-------------------
1. OpenSSL ASN.1 Parsing Vulnerabilities
BugTraq ID: 8732
Remote: Yes
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8732
Summary:
Multiple vulnerabilities were reported in the ASN.1 parsing code in
OpenSSL. OpenSSL does not directly implement ASN.1 but does use ASN.1
objects in X.509 certificates and various other cryptographic elements.
The following issues were reported:
Two flaws in the ASN.1 parser could lead to denial of service attacks.
The first bug may be exploited to cause an out of bounds read operation to
occur, most likely resulting in a denial of service. This can be
triggered by a malformed or unusual ASN.1 tag value. The second of the
described bugs occurs if an application is configured to ignore public key
decode errors (specifically the
X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY error). This is reportedly
not a common configuration in production setups but some applications may
ignore decode errors for debugging reasons. As a result, the impact and
exposure will vary depending on the targeted application and some
applications may be more vulnerable to attacks than others. Remote
attackers can exploit this issue with a maliciously crafted SSL client
certificate. CAN-2003-0543 and CAN-2003-0544 correspond to these two
denial of service issues. The issues are reported to exist in SSLeay and
OpenSSL versions prior to 0.9.7c or 0.9.6k.
Another vulnerability related to ASN.1 parsing was reported in OpenSSL
0.9.7. ASN.1 encodings that are rejected by the parser due to being
invalid may potentially trigger a memory management error. In particular,
a double free may result due to an ASN.1 structure (ASN1_TYPE) being
deallocated incorrectly. This reportedly could be leveraged to corrupt
stack memory. In this manner, sensitive stack variables such as
instruction pointers could be overwritten with attacker-supplied values.
The issue could be exploited by remote attacks via a maliciously crafted
SSL client certificate. This issue has been assigned CVE name
CAN-2003-0545.
An additional weakness was reported that may aid in exploitation of these
issues. In some circumstances, a client may force a server to parse a
client certificate when one has not been specifically requested. This
could even occur with server implementations that don't enable client
authentication.
Any applications which use the OpenSSL ASN.1 library to handle external
data may present an attack vector for these vulnerabilities.
These issues are pending further analysis and will be separated into
individual BIDs when analysis is complete.
It should be noted that only the k8, k9, and k91 images for Catalyst 6500
series switches and 7200 series Routers of the 12.2SX and 12.2SY release
trains are affected.
2. Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
BugTraq ID: 8734
Remote: Yes
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8734
Summary:
Gamespy 3D is a Microsoft Windows based application used to find game
servers for various games. The software also has a built in IRC client
for chat and file sharing.
A vulnerability has been reported to exist in the Gamespy 3D IRC client
that may allow a remote attacker to gain unauthorized access by executing
arbitrary code on a vulnerable system. The condition is present due to
insufficient boundary checking.
It has been reported that during the connection process the IRC client
sends USER and NICK requests to the IRC server to receive the user
information. This process may lead to a buffer overflow condition if the
server responds to the request with a string that is larger than or equal
to 262 bytes. An attacker may leverage the issue by exploiting an
unbounded memory copy operation to overwrite the saved return address/base
pointer, causing the affected procedure to return to an address of their
choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
Gamespy 3D versions 2.63015 and prior have been reported to be prone to
this issue, however other versions may be affected as well.
3. HP Unspecified Local Socket Implementation Denial of Service...
BugTraq ID: 8735
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8735
Summary:
HP has announced the existence of an unspecified local vulnerability
relating to programs implementing sockets; denial of service attacks
possible. Although unconfirmed, this issue may be a result of memory
leakage when handling multiple sockets or possibly due to insufficient
sanity checks, allowing an attacker to exhaust socket resources.
It has been reported that an attacker may exploit this issue to crash an
affected system
The precise details of this vulnerability are currently unknown, however
this BID will be updated as further information is made available.
4. Silly Poker Local HOME Environment Variable Buffer Overrun V...
BugTraq ID: 8736
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8736
Summary:
Silly Poker is a simple poker card game developed for the Linux operating
system. It has been reported that on the Debian Linux distribution, the
sillypoker binary is installed setgid games by default.
*** It should be noted that new details released suggest that the
sillypoker binary is in fact not installed setgid games on Debian systems.
As such, the impact of this issue may be greatly limited.
A local buffer overrun vulnerability has been reported for Silly Poker.
The problem occurs due to insufficient bounds checking when handling
user-supplied data. As a result, an attacker may be capable of controlling
the execution flow of the sillypoker program and effectively executing
arbitrary code with elevated privileges.
Exploiting this condition may allow an attacker to gain group 'games'
privileges which could be used to modify sensitive information or could be
used to leverage attacks against other previously inaccessible utilities.
5. Invision Power Board Insecure Permissions Vulnerability
BugTraq ID: 8737
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8737
Summary:
Invision Power Board is web forum software. It is implemented in PHP and
is available for Unix and Linux variants and Microsoft Windows operating
systems.
Invision Power Board has been reported prone to a configuration issue that
could allow attackers with local interactive access to modify Invision
Power Board '.php' source files. The issue has been reported to present
itself because Invision Power Board does not correctly set permissions on
folders during the installation process. Specifically all folders are
created with group write permissions. Any local user who is a member of
the same group as Invision Power Board may make modifications to Invision
Power Board source files.
A local attacker may exploit this condition to execute arbitrary code with
the privileges of the web server.
It should be noted that although this vulnerability has been reported to
affect Invision Power Board versions 1.1.1 and 1.1.2, other versions might
also be affected.
6. IBM AIX GetIPNodeByName API Socket Management Vulnerability
BugTraq ID: 8738
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8738
Summary:
AIX is the Unix operating system distributed and maintained by IBM.
A problem has been reported in the socket handling of IBM AIX. Because of
this, an attacker may be able to crash an application on a vulnerable
system.
The problem is in the management of sockets that use the GetIPNodeByName
function. Under some circumstances, this function does not properly close
sockets during operation. This may allow an attacker to open a large
amount of sockets in services using the function, resulting in a denial of
service.
7. Multiple DCP-Portal SQL Injection Vulnerabilities
BugTraq ID: 8739
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8739
Summary:
DCP-Portal is a web portal system implemented in PHP that uses a MySQL
backend database. The development cycle for this product has been
temporarily suspended.
Multiple SQL Injection vulnerabilities have been discovered that affect
DCP-Portal scripts. These issues are likely due to a lack of sufficient
sanitization performed on user supplied URI parameters. Attacks have been
demonstrated that inject partial SQL queries, as values for URI
parameters, in a manner that influences DCP-Portal SQL query logic to the
attackers benefit. The 'password' URI parameter associated with the
'advertiser.php' script and the 'email' URI parameter associated with the
'lostpassword.php' script has been demonstrated as vulnerable.
An attacker may exploit these conditions to disclose DCP-Portal
credentials, reset user passwords, or perform a denial of service type
attack via email spamming.
Although this issue has been reported to affect DCP-Portal version 5.5,
prior versions may also be affected.
8. Atrise Everyfind search Cross-Site Scripting Vulnerability
BugTraq ID: 8740
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8740
Summary:
Atrise Everyfind is a search utility that allows users to add a search
engine to websites and documents.
A vulnerability has been reported to exist in the search module of the
software that may allow a remote attacker to execute HTML or script in a
user's browser. This issue exists due to insufficient sanitization of
user input.
The problem is reported to exist due to a lack of sanitization of
user-supplied input by the software. HTML and script code will be rendered
in a user's browser, therefore making it possible for an attacker to a
construct a malicious link containing HTML or script code that may be
rendered in a user's browser upon visiting that link. This attack would
occur in the security context of the vulnerable site.
Successful exploitation of this vulnerability may allow an attacker to
steal cookie-based authentication credentials. Other attacks may well be
possible.
Atrise Everyfind 5.02 has been listed as a vulnerable package, however
other versions may be affected as well.
9. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
BugTraq ID: 8742
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8742
Summary:
IBM DB2 is a commercial relational database implementation that is
available for a number of operating systems including Microsoft Windows
and Unix/Linux variants.
IBM DB2 includes the LOAD command, which allows for data located in files,
pipes or devices to be stored within a database table. It has been
discovered that the application fails to carry out sufficient bounds
checking when handling the LOAD command.
An attacker with 'Connect' privileges could exploit this vulnerability
remotely, likely by passing excessive data as an argument to the LOAD
command. This would allow for sensitive stack variables adjacent to the
affected memory buffer to be overrun. An attacker could leverage this
memory corruption to influence the execution flow of IBM DB2, possibly
redirecting execution into a malicious payload.
All code executed in this manner will be run with the privileges of the
IBM DB2 process. This is typically the 'Administrators' group on Microsoft
Windows environments and either the 'db2as' or 'db2inst1' users on Linux
systems.
It should be noted that IBM has confirmed that the affected code is shared
amongst IBM DB2 v7 and v8, making both vulnerable to this condition.
10. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
BugTraq ID: 8743
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8743
Summary:
DB2 is the database implementation maintained and distributed by IBM. It
is available for the UNIX, Linux, and Microsoft Windows platforms.
A problem in IBM DB2 has been reported when specific queries are passed to
the INVOKE stored procedure. Because of this, an attacker may be able to
gain unauthorized access to system resources.
The problem is in the checking of bounds on the INVOKE stored procedure.
By passing a maliciously crafted string to the procedure, it is possible
to overwrite sensitive regions of stack memory. An attacker could take
advantage of this issue to execute code at an arbitrary location in memory
with the privileges of the database process.
This problem has been reported to occur in version 7.2 for Microsoft
Windows only.
11. MPNews PRO Directory Traversal Information Disclosure Vulner...
BugTraq ID: 8744
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8744
Summary:
MPNews PRO is a news server available for the Microsoft Windows operating
system.
It has been reported that MPNews PRO is prone to an information disclosure
vulnerability. The problem is believed to occur due to MPNews PRO failing
to sufficiently filter specific dot-dot-slash sequences (../).
Specifically, making a request for a file prefixed by a sequence of
"./../" may cause the request to be interpreted outside of the web root.
As a result, an attacker may be capable of viewing the contents of
arbitrary files on the local system.
Access to these files my expose sensitive information to the attacker that
could potentially be used in launching further attacks against the target
system.
12. Mutant Penguin MPWeb PRO Directory Traversal Vulnerability
BugTraq ID: 8745
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8745
Summary:
Mutant Penguin MPWeb PRO is a Microsoft Windows based web server. It
allows users to create and host dynamic web sites.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to traverse outside the server root directory in order
to access sensitive server readable files. The issue presents itself due
to insufficient sanitization of user-supplied input and may allow an
attacker to access unauthorized information by issuing '/./../' character
sequences.
This vulnerability may be successfully exploited to gain sensitive
information about a vulnerable host that could be used to launch further
attacks against the system.
MPWeb PRO version 1.1.2 has been reported to be affected by this issue,
however other versions may be vulnerable as well.
13. OpenSSL SSLv2 Client_Master_Key Remote Denial Of Service Vul...
BugTraq ID: 8746
Remote: Yes
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8746
Summary:
OpenSSL is an open source implementation of the SSL protocol.
OpenSSL SSLv2 has been reported prone to a remotely triggered denial of
service when processing a specially crafted malicious CLIENT_MASTER_KEY
message.
It has been reported that a remote attacker may use a maliciously crafted
CLIENT_MASTER_KEY message to influence the execution flow of a vulnerable
service implementing SSLv2 into a die() procedure. This will effectively
cause the affected process to abort, denying service to legitimate users.
An attacker may flood an affected service with malicious CLIENT_MASTER_KEY
messages, persistently denying service for legitimate users. Other attacks
may also be possible. The impact and exposure may vary depending on the
particular applications that use vulnerable OpenSSL libraries.
This vulnerability is not reported to be present in OpenSSL versions
greater than 0.9.6f of the 0.9.6 series of releases, because the use of
the die() procedure is no longer implemented. It is not known whether the
0.9.7 series is also affected.
14. Microsoft Windows PostThreadMessage() Arbitrary Process Kill...
BugTraq ID: 8747
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8747
Summary:
The Microsoft Windows operating system includes a wide variety of API
function calls. One such call is the PostThreadMessage() function, which
can be used to send a variety of messages to a specified thread. This
function will fail if the specified thread does not include a message
queue. A queue will only be created if the thread has issued a Win32 USER
or GDI function call.
Included in the various messages that can be sent to a process are the
WM_QUIT, WM_DESTROY, and WM_CLOSE messages. These messages are
specifically designed to notify a process that it should subsequently be
terminated.
It has been discovered that processes sent these messages fail to
sufficiently verify their origin, and proceed to terminate. As a result,
an unprivileged program running with the privileges of any local user may
be capable of sending one of the three messages to an arbitrary process
and cause it to terminate. This will occur no matter what security level
the target process may be running at. As mentioned above, the targeted
process must include a message queue at the time of exploitation.
This vulnerability could be exploited by a local attacker to disable
various security-related software designed to limit a local users ability
to carry out various actions. Other processes may also be targeted.
15. FreeBSD Kernel ProcFS Handler UIO_Offset Integer Overflow Vu...
BugTraq ID: 8748
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8748
Summary:
All versions of the FreeBSD kernel have been reported prone to an integer
overflow vulnerability. The issue presents itself in the procfs handling
procedures, and has been reported to be due to a lack of sufficient sanity
checks performed on 'uio' offset parameters.
It has been reported that a local attacker may exploit this condition
because it is possible to indirectly influence the value for the 'uio'
offset. Ultimately an attacker may trigger an integer overflow or
underflow condition. This may result in a read attempt from non-resident
kernel memory, triggering a kernel panic and effectively denying service
to legitimate users. A local attacker may also exploit this issue to
disclose potentially sensitive data stored in regions of memory that would
otherwise be restricted.
This issue has been reported to be exploitable on systems that have procfs
enabled.
16. FreeBSD Kernel Readv() Integer Overflow Vulnerability
BugTraq ID: 8749
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8749
Summary:
A local vulnerability has been discovered within the FreeBSD kernel. The
problem occurs within the readv() system call, which is used to read data
and scatter it into an arbitrary number of buffers specified by an
argument.
When a file is accessed by a system call in FreeBSD, such as open() or
dup2(), the reference counter (f_count) for that file is incremented using
the fhold() function and when access is complete the counter is
decremented by fdrop().
It has been discovered that the readv() system call fails to call the
fdrop() function after a specific procedure had previously triggered a
call to fhold(). As a result, by triggering a large number of calls to
fhold() in a call to readv(), it may be possible to cause the f_count
integer value to wrap.
It has been reported that this integer overflow can be triggered by
supplying an overly large iovcnt variable in a call to readv(). As a
result, an attacker may potentially be capable of trigger kernel memory
corruption. This could ultimately result in a system panic or could
possibly be leveraged to elevate local privileges to that of the root
user.
17. FortiGate Firewall Web Filter Logs HTML Injection Vulnerabil...
BugTraq ID: 8750
Remote: Yes
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8750
Summary:
FortiGate are a series of commercial firewall appliances which run an
embedded operating system entitled FortiOS.
The FortiGate web interface is prone to an HTML injection vulnerability.
Denied requests are logged into a web filter log which is viewable through
the web administrative interface. HTML and script code will not be
sanitized when these requests are logged. To exploit this issue, the
attacker must construct for a resource that will be denied by the
firewall, based on the defined policies of the targeted firewall.
Malicious could then be embedded in the request, which will be logged as
part of the request.
An attacker could exploit this to cause hostile code to be rendered in the
browser of an administrative user who views the logs. This could result
in theft of cookie-based authentication credentials from the firewall
administrator, potentially allowing for firewall compromise. Since the
attacker can control how the logs will be rendered to the administrator,
it is also possible to spoof or conceal log entries.
This issue reportedly exists in FortiOS releases prior to 2.50MR4.
18. Inter7 VPopMail Configuration File Insecure Default Permissi...
BugTraq ID: 8751
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8751
Summary:
vpopmail is a freely available, open source virtual domain handling
software package. It is available for the Unix and Linux operating
systems.
A problem has been identified in the default configuration of vpopmail.
Because of this, an attacker may be able to gain access to potentially
sensitive information.
The problem is in the creation of the configuration file. When vpopmail
is compiled with MySQL support, authentication data is stored in the
/etc/vpopmail.conf file. This file is created with world-readable
permissions, which may reveal sensitive information such as authentication
credentials for the database. An attacker could use these credentials to
potentially gain access to the database as the vpopmail database user.
This problem has been reported on Gentoo Linux, but may affect other
operating systems.
19. Cisco CatOS Password Prompt Unauthorized Remote Command Exec...
BugTraq ID: 8752
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8752
Summary:
It has been alleged that it is possible for remote attackers to execute
arbitrary commands without proper authorization. Reportedly it is
possible to execute shell commands from the password prompt on a device
running a vulnerable version of CatOS. The attacker must be able to
connect to a vulnerable device via telnet, though it has not been ruled
out that other remote administrative services such as SSH do not also
present attack vectors.
The discoverer of this vulnerability has stated that it is possible to
exploit this issue by submitting a shell command to the password prompt,
followed by a space and a question mark.
Symantec has not been able to confirm the existence of the vulnerability,
which if of a very serious nature. However, the author of the report
insists that the issue is legitimate. This BID will be updated or retired
based on any follow-up information that becomes available.
This issue has been reported in CatOS versions 5.4(2) and 5.5(2) on Cisco
Catalyst 6509 switches. Other devices and CatOS versions may also be
similarly affected.
Cisco has replied to this issue stating that it cannot be used to execute
commands, retrieve information from the device, or reveal information
about traffic processed by the device. Details are available to
registered Cisco users at:
http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCdr87435
Since this issue cannot be exploited to compromise any security properties
on the device, this BID will be retired.
20. EarthStation 5 Search Service Remote File Deletion Vulnerabi...
BugTraq ID: 8753
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8753
Summary:
EarthStation 5 is a peer-to-peer file sharing application for Microsoft
Windows platform.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to delete arbitrary files on a vulnerable system. The
problem is reported to be caused by the software's "Search Service" packet
handler.
It has been reported that the vulnerability presents itself when an
attacker sends packet 0Ch and sub-function 07h to a client running the
vulnerable version of the software. This may allow the attacker to delete
any files shared by the vulnerable host. An attacker may also delete
sensitive files on the host by using a relative path such as
"..\..\..\WINDOWS\NOTEPAD.EXE". This attack would occur in the context of
the user running the vulnerable software.
Successful exploitation of this issue may allow a remote attacker to
delete arbitrary files on a vulnerable system, which could lead to a
denial of service.
It has also been reported that the software is prone to other denial of
service and buffer overflow vulnerabilities, however explicit details have
not been specified.
EarthStation 5 build 1266 and 2180 have been reported to be vulnerable to
this issue, however other versions may be affected as well.
21. Cisco PIX ICMP Echo Request Network Address Translation Pool...
BugTraq ID: 8754
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8754
Summary:
A problem has been reported in Cisco PIX network firewalls when global IP
address pools are exposed to ICMP traffic. This may result in a denial of
service to network resources.
The problem is in the handling of ICMP echo requests. When a pool of
addresses is dedicated to the task of network address translation, the
Cisco PIX behavior dictates that traffic received for a specific address
means that the address is in use.
However, ICMP echo traffic floods for addresses in the Network Address
Translation (NAT) pool keeps the addresses in an active state, whether or
not the addresses are actually in use. Because of this, it is possible
for a remote system to flood the host with requests for addresses in the
pool, exhausting the pool of NAT addresses, and preventing traffic from
crossing the PIX to external points.
22. Cisco LEAP Password Disclosure Weakness
BugTraq ID: 8755
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8755
Summary:
Cisco LEAP is a mutual authentication algorithm based on Extensible
Authentication Protocol (EAP). LEAP is used with wireless networks and
relies on user's logon password for authentication.
Weaknesses in the Cisco LEAP protocol been reported to exist in the
software that may allow a remote attacker to gain access to user passwords
shared by the client and the network. This problem may allow an attacker
to brute force user passwords by employing dictionary attacks.
Successful exploitation of this weakness may allow a remote attacker to
steal authentication information, potentially allowing for unauthorized
network access.
23. Multiple Wordpress Blog.Header.PHP SQL Injection Vulnerabili...
BugTraq ID: 8756
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8756
Summary:
Wordpress allows users to generate news pages and weblogs dynamically. It
uses PHP and a MySQL database to generate dynamic pages.
Wordpress has been reported prone to multiple SQL injection
vulnerabilities. The issues have been reported to exist in the
blog.header.php script. A lack of sufficient sanitization performed on
'cat' and 'order_by' URI parameters, may allow an attacker to inject
malicious SQL code and thereby influence legitimate Wordpress SQL queries.
Exploitation of this issue may be hindered because quotations, backslash
or space characters cannot be used by the attacker when supplying
malicious SQL data.
Ultimately an attacker may exploit this vulnerability to insert SQL code
into Wordpress SQL requests and have the SQL code executed by the
underlying database server. These requests could include adding, deleting,
and modifying data. Additionally, this may allow a remote attacker to
exploit vulnerabilities that exist in the underlying database.
This vulnerability has been reported to affect all versions of Wordpress
prior to the CVS release dated October 1st 2003.
24. Sun Cobalt RaQ Message.CGI Cross-Site Scripting Vulnerabilit...
BugTraq ID: 8757
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8757
Summary:
RaQ is a server appliance originally developed by Cobalt. It is now
distributed and maintained by Sun Microsystems.
A problem with message.cgi script used by Cobalt RaQ appliances could lead
to cross-site scripting. This could result in attacks attempting to steal
authentication information.
The problem is in the handling of input by the message.cgi script. Due to
insufficient sanitizing of input, it is possible to render arbitrary
script code through the vulnerable script on Cobalt RaQ systems. The
attacker must pass the malicious input through the info variable.
25. Microsoft Internet Explorer Absolute Position Block Denial O...
BugTraq ID: 8758
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8758
Summary:
A problem has been reported in Microsoft Internet Explorer when absolute
positioning is used. Because of this, it may be possible to deny service
to users of the browser.
When variables are created using the absolute position within a page and
an absolute positioned block is opened after an absolute positioned tag,
previously opened, hasn't been closed properly, the browser becomes
unstable. The issue may be due to memory corruption, though this is
conjecture and has not been confirmed. However, it is known that this
issue can reliably reproduce a denial of service attack.
This problem has also been reported to affect Microsoft Outlook, which may
indicate a problem in the HTML interpreting engine used by both products.
It has been reported that the exploit code for this issue may also cause
Eudora to crash. This may simply be due to Internet Explorer being set to
render HTML content for Eudora. This BID will be updated when more
information becomes available.
26. Conectiva Vixie-Cron Package Potential Denial Of Service Vul...
BugTraq ID: 8759
Remote: No
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8759
Summary:
Vixie cron is an implementation of the popular UNIX program that runs
user-specified programs at periodic scheduled times.
The Conectiva Vixie-Cron package has been reported prone to a potential
denial of service vulnerability. The issue was introduced in a previous
Vixie-Cron package update that was designed to address the vulnerability
described in BID 2687. This package was found to introduce a problem
whilst using cron.allow and cron.deny, to control access to the crontab
application. It has been reported that if these files contain more than
one user the crontab program will fail.
A local attacker, who has the ability to write data into cron.allow and
cron.deny files, may instigate an efficient denial of service against the
crontab program.
Conectiva has addressed this issue by releasing an updated package; all
users are advised to apply the applicable packages as soon as possible.
27. SquirrelMail CSS JavaScript Expression MSIE Script Code Inje...
BugTraq ID: 8760
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8760
Summary:
SquirrelMail may not filter some instances of hostile HTML that will
successfully render in Internet Explorer. In particular, examples of HTML
injection attacks were published which may not be filtered by webmail
systems or other web applications that could allow Cascading Style-sheets
(CSS) to be referenced. Internet Explorer will evaluate JavaScript
expressions included in CSS, which could potentially present an attack
vector against software that does not account for this behavior when
attempting to sanitize user-supplied input script code. It is not known
if this is exclusive to JavaScript expressions, other client-side
scripting languages may allow for similar attacks.
This could potentially allow for execution of HTML and script code in the
context of a user of the web mail system that receives a malicious e-mail.
Webmail sessions could be compromised. Other attacks are also possible.
The researcher who discovered this issue tested SquirrelMail 1.4, which
was found to be vulnerable. The issue appears to be addressed as of
SquirrelMail 1.4.2, though this has not been confirmed. It is also not
known if other web browser implementations will exhibit similar behavior
when confronted with JavaScript expressions in CSS.
28. Microsoft Word Malformed Document Denial of Service Vulnerab...
BugTraq ID: 8761
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8761
Summary:
Microsoft Word is a word processing software that is part of the Microsoft
Office suite and other Microsoft products.
A vulnerability has been reported to exist in Microsoft Word that may
allow an attacker to cause a denial of service condition in the software.
The problem may present itself if an attacker modifies a Word document and
corrupts its memory structure. If opened by a user, the malformed
document may cause the vulnerable software to crash. The software appears
to crash on a divide by zero operation, but there is also a possibility
that this could be exploited to corrupt process memory. Though
unconfirmed, this could result in execution of arbitrary code.
29. Netscreen ScreenOS DHCP Packet Buffer Padding Information Le...
BugTraq ID: 8762
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8762
Summary:
NetScreen is a line of Internet security appliances integrating firewall,
VPN and traffic management features. ScreenOS is the software used to
manage and configure the firewall. NetScreen supports Microsoft Windows
95, 98, ME, NT and 2000 clients.
A vulnerability has been discovered in Netscreen ScreenOS when the
associated device is acting as a DHCP server. Appliances that are not
hosting DHCP services are not affected by this issue.
The problem specifically lies in that fact that the application fails to
re-initialize or zero out a specific memory buffer prior to using the
memory to generate DHCP response packets. It has been discovered that this
buffer may have previously been used to store HTTP management session
information.
An attacker could exploit this issue by making a DHCP request and
recording the sensitive data located within the packet. This could
ultimately expose encoded authentication credentials to the attacker that
could be used to launch further attacks against the appliance.
30. Divine Content Server Error Page Cross-Site Scripting Vulner...
BugTraq ID: 8763
Remote: Yes
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8763
Summary:
Divine Content Server is a content management system for Web sites,
portals and extranets.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to execute HTML or script code in the browser of a user
running the vulnerable version of Content Server.
The problem is reported to exist in 'pagename' attribute in the error page
of the software and is due to a lack of sanitization of user-supplied
input by the software. HTML and script code will be rendered in a user's
browser, therefore making it possible for an attacker to a construct a
malicious link containing HTML or script code that may be rendered in a
user's browser upon visiting that link. This attack would occur in the
security context of the vulnerable site.
Successful exploitation of this vulnerability may allow an attacker to
steal cookie-based authentication credentials. Other attacks may well be
possible.
Divine Content Server version 5.0 may be vulnerable to this issue, however
this information cannot be confirmed at the moment.
31. PHP-Nuke mailattach.php Remote File Upload Vulnerability
BugTraq ID: 8764
Remote: Yes
Date Published: Oct 04 2003
Relevant URL: http://www.securityfocus.com/bid/8764
Summary:
PHP-Nuke is a popular web based Portal system. It allows users to create
accounts and contribute content to the site.
Due to a lack of input validation, the mailattach.php script could allow
an attacker to upload arbitrary files to any location on the system
accessible by the webserver.
By prepending the file name with directory traversal characters (../) an
attacker could save malicious files to the system or potentially overwrite
sensitive files.
This vulnerability was reported to affect PHP-Nuke on Windows platforms
only.
32. Conexant AccessRunner DSL Console Authentication Bypass Vuln...
BugTraq ID: 8765
Remote: Unknown
Date Published: Oct 04 2003
Relevant URL: http://www.securityfocus.com/bid/8765
Summary:
The Conexant AccessRunner DSL Console is the interface for administering
and configuring the DSL device.
The Conexant AccessRunner DSL Console is vulnerable to an authentication
bypass issue.
Reportedly, when the device prompts a user for a password, an attacker can
bypass the authentication by simply entering an invalid password. When
the screen displaying the incorrect password message is displayed, the
attacker simply has to press the 'Enter' key to gain access to the
console.
** The discoverer of this issue has reported that it may not be present in
some devices. There is currently no known reason for why some devices are
vulnerable while others are not. This record will be updated if and when
further details become available.
33. EternalMart Multiple Remote File Include Vulnerabilities
BugTraq ID: 8767
Remote: Yes
Date Published: Oct 04 2003
Relevant URL: http://www.securityfocus.com/bid/8767
Summary:
EternalMart Mailing List Manager and Guestbook are written in PHP.
Both applications use the same auth.php module which is prone to a remote
file include vulnerability. Additionally, the Mailing List Manager
email_email_func.php script is also prone to a remote file include issue.
By influencing the path of the that these modules include files, a remote
attacker can cause arbitrary PHP code to be executed on the vulnerable
webserver.
34. GuppY Cross-Site Scripting Vulnerability
BugTraq ID: 8768
Remote: Yes
Date Published: Oct 05 2003
Relevant URL: http://www.securityfocus.com/bid/8768
Summary:
GuppY is a free suite of PHP scripts for creating an online portal.
GuppY has reported to be prone to a cross-site scripting vulnerability in
the postguest.php module.
The issue presents itself due to a lack of sufficient sanitization
performed by functions in the postguest.php script on user-influenced
'style' URI parameter. It has been reported that a remote attacker may
construct a malicious link to the script and supply arbitrary HTML code as
a value for the 'style' URI parameter. If this link is followed, the
content of the 'style' parameter will be rendered in the browser of the
user who followed the link.
This could permit the theft of cookie authentication credentials; other
attacks may also be possible.
This vulnerability was reported to affect GuppY 2.4p3, however, earlier
versions may also be vulnerable.
35. GuppY Remote File Access Vulnerability
BugTraq ID: 8769
Remote: Yes
Date Published: Oct 05 2003
Relevant URL: http://www.securityfocus.com/bid/8769
Summary:
GuppY is a free suite of PHP scripts for creating an online portal.
GuppY is reported to be prone to a remote file access issue.
Due to insufficient access validation controls in the timymsg.php script,
a remote attacker is able to access files on the server. Exploitation
could allow the remote user to read or write to files through the 'action'
parameter of the tinymsg.php script. It does not appear that files
outside the webroot could be accessed in this manner.
This vulnerability was reported to affect GuppY 2.4p3, however, earlier
versions may also be vulnerable.
36. XShisen '-KCONV' Local Buffer Overflow Vulnerability
BugTraq ID: 8770
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8770
Summary:
XShisen is a puzzle game that is played with 144 mahjong pieces. The
software runs on the Linux platform and a Microsoft Windows binary is
available as well.
It has been reported that XShisen is prone to a buffer overflow issue that
may allow an attacker to gain unauthorized access to a host running the
vulnerable software.
The problem is present due to improper handling of user-supplied data from
'-KCONV' command line parameter. A buffer overflow condition may be
caused by supplying more than 100 bytes of data. The conditions are
present due to insufficient boundary checking. An attacker may leverage
the issues by exploiting an unbounded memory copy operation to overwrite
the saved return address/base pointer, causing the affected procedures to
return to an address of their choice.
Successful exploitation may allow an attacker to ultimately execute
arbitrary code in the context of the user who is running the vulnerable
software in order to gain unauthorized access to a system.
XShisen version 1.51 has been reported to be prone to these issue however
other versions may be affected as well.
37. PrimeBase SQL Database Server Insecure Installation Temporar...
BugTraq ID: 8771
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8771
Summary:
PrimeBase SQL Database Server is a database implementation that is
available for Unix/Linux variants as well as Microsoft Windows platforms.
PrimeBase SQL Database Server is reported to create temporary files in an
insecure manner during installation. A malicious local user could take
advantage of this issue to cause files to be corrupted during the initial
database installation. In particular, the following temporary file is
created during installation:
/tmp/PrimeBase.log
If a local attacker can anticipate the installation of PrimeBase, this
issue can be exploited by creating a symbolic link in place of the
temporary file that points to another file on the system. When the
PrimeBase database is installed by root, the file pointed to by the
symbolic link will be corrupted.
Exploitation could result in destruction of data. A potential for
privilege escalation attacks also exists if files can be corrupted with
custom data.
This issue was reported for PrimeBase running on Unix/Linux variants.
38. PrimeBase SQL Database Server Insecure Default Binary Permis...
BugTraq ID: 8772
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8772
Summary:
PrimeBase SQL Database Server is a database implementation that is
available for Unix/Linux variants as well as Microsoft Windows platforms.
The PrimeBase SQL Database Server binary is installed with world-writeable
permissions by default. This binary is typically installed as
/usr/local/primebase. A local attacker could take advantage of this issue
to execute arbitrary code by replacing or modifying the binary,
potentially allowing for privilege escalation. If the binary is modified
or replaced, it will be executed when the database is restarted.
This issue was reported for PrimeBase running on Unix/Linux variants.
39. JBoss HSQLDB Remote Command Injection Vulnerability
BugTraq ID: 8773
Remote: Yes
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8773
Summary:
JBoss is a freely available, open source Java Application server. It is
distributed and maintained by JBoss Group and is available for a number of
platforms including Microsoft Windows and Unix/Linux variants.
A remote command injection vulnerability has been reported in JBoss. The
issue is reportedly exposed via the HSQLDB component, which is a SQL
database server that manages JMS connections. A number of unspecified
flaws cause this condition, including programming errors in the sun.*
classes, logic errors in the org.apache.* classes of the JDK and the
default configuration settings. As a result, it is possible to pass
commands to the HSQLDB component via the port it listens on. It should be
noted that the port may vary between versions, by default it is 1701/TCP
for version 3.2.1 and 1476/TCP for 3.0.8.
It has been reported that this issue could be exploited to mount a number
of attacks, including execution of database commands, denial of service
attacks, log manipulation, information disclosure and execution of
operating system commands on some supported platforms.
This issue is reported to exist with JBoss 3.2.1/3.0.8 on any Java
1.4.x-enabled platforms. Other versions may be similarly affected.
The consequences may vary depending on the capabilities of the underlying
operating system, but it is believed that this could be exploited to
execute arbitrary operating system commands on Windows 2000 and XP
systems.
40. PHP Prayer Board SQL Injection Vulnerability
BugTraq ID: 8774
Remote: Yes
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8774
Summary:
PHP Prayer board is web based community bulletin board software
implemented in PHP.
PHP Prayer board has been reported prone to an SQL Injection
vulnerability. The issue has been reported to present itself due to a lack
of sufficient sanitization performed on user-supplied data. It has been
reported that an attacker may submit form data or URI parameters
containing malicious SQL code to the pages 'prayerboard.php' and
'prayerboard_db.php', in order to influence PHP Prayer board SQL query
logic.
Ultimately, an attacker may exploit this vulnerability to insert SQL code
into PHP Prayer board SQL requests and have the SQL code executed by the
underlying database server. These requests could include adding, deleting,
and modifying data. Additionally, this vulnerability may allow a remote
attacker to exploit vulnerabilities that exist in the underlying database.
This vulnerability has been reported to affect PHP Prayer board up to and
including version 0.51.
41. PHP Prayer Board Cross-Site Scripting Vulnerability
BugTraq ID: 8775
Remote: Yes
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8775
Summary:
PHP Prayer board is web based community bulletin board software
implemented in PHP.
PHP Prayer Board has been reported prone to a cross-site scripting
vulnerability.
The issue presents itself due to a lack of sufficient sanitization
performed by functions in the 'prayerboard.php' and 'prayerboard_db.php'
scripts on user-influenced form data and URI parameters. It has been
reported that a remote attacker may construct a malicious link to the
vulnerable script and supply arbitrary HTML code as URI parameters. If
this link is followed, malicious HTML code will be rendered in the browser
of the user who followed the link. Additionally it has been conjectured
that form fields may be used to inject arbitrary HTML code into
dynamically generated pages.
This could permit the theft of cookie authentication credentials; other
attacks may also be possible.
42. XShisen 'XSHISENLIB' Local Buffer Overflow Vulnerability
BugTraq ID: 8776
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8776
Summary:
XShisen is a puzzle game that is played with 144 mahjong pieces. The
software runs on the Linux platform and a Microsoft Windows binary is
available as well.
It has been reported that XShisen is prone to a buffer overflow issue that
may allow an attacker to gain unauthorized access to a host running the
vulnerable software.
The problem present in 'XSHISENLIB' envrionment variable is due to
improper handling of user-supplied data. A buffer overflow condition may
be caused by supplying more than 100 bytes of data. The conditions are
present due to insufficient boundary checking. An attacker may leverage
the issues by exploiting an unbounded memory copy operation to overwrite
the saved return address/base pointer, causing the affected procedures to
return to an address of their choice.
Successful exploitation may allow an attacker to ultimately execute
arbitrary code in the context of the user who is running the vulnerable
software in order to gain unauthorized access to a system.
XShisen version 1.51 has been reported to be prone to these issue however
other versions may be affected as well.
43. File Sharing Software Easy File Sharing Web Server Informati...
BugTraq ID: 8777
Remote: Yes
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8777
Summary:
File Sharing Software Easy File Sharing Web Server is an application
designed to provide peer-to-peer file sharing functionality for Microsoft
Windows platforms.
Easy File Sharing Web Server has been reported prone to an information
disclosure vulnerability. The issue presents itself due to insecure
default permissions set on folders that contain Easy File Sharing Web
Server log and configuration files. It has been reported that a remote
attacker may make a HTTP request for affected log and configuration files
and disclose potentially sensitive information contained therein.
Although this vulnerability has been reported to affect Easy File Sharing
Web Server version 1.2, previous versions may also be affected.
44. SuSE Linux SuSEWM Configuration File Insecure Temporary File...
BugTraq ID: 8778
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8778
Summary:
SuSEConfig is a component of the SuSE Linux operating system. It is
designed to be a standardized configuration tool to SuSE operating
systems.
A problem exists in the SuSEWM configuration file used by SuSEConfig.
Because of this, it may be possible for a local attacker to gain elevated
privileges.
The problem is in the handling of temporary files. When the configuration
file is executed by SuSEConfig, the predictable temporary file
/tmp/susewm.$$ is created, where $$ signifies an arbitrary value.
Improper file creation checks make it possible for an attacker to
symbolically link a predicted file name to a sensitive system file. Upon
execution of SuSEConfig, the contents of the file at the end of the
symbolic link will be modified.
The reported impact is privilege escalation, though the method through
which this is gained is unclear. This BID will be further updated as more
information becomes available.
45. SuSE Linux JavaRunt Configuration File Insecure Temporary Fi...
BugTraq ID: 8779
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8779
Summary:
SuSEConfig is a component of the SuSE Linux operating system. It is
designed to be a standardized configuration tool to SuSE operating
systems.
A problem exists in the JavaRunt configuration file used by SuSEConfig.
Because of this, it may be possible for a local attacker to gain elevated
privileges.
The problem is in the handling of temporary files. When the configuration
file is executed by SuSEConfig, the predictable temporary file
/tmp/.java_wrapper is created. Improper file creation checks make it
possible for an attacker to symbolically link the predicted file name to a
sensitive system file. Upon execution of SuSEConfig, the contents of the
file at the end of the symbolic link will be corrupted, potentially with
attacker-supplied data. Exploitation could permit privilege escalation.
The reported impact is privilege escalation, though the method through
which this is gained is unclear. This BID will be further updated as more
information becomes available.
46. SLocate User-Supplied Database Heap Overflow Vulnerability
BugTraq ID: 8780
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8780
Summary:
slocate is the Secure Locate program. It is available for various UNIX and
Linux operating systems, and is maintained by public domain.
It has been reported that a vulnerability exists in the handling of
user-supplied databases by slocate. Because of this, an attacker may be
able to gain elevated privileges.
The problem is a heap-based off-by-one condition. Because of this, it is
possible for an attacker to potentially overwrite memory management
structures with attacker-supplied values. This could allow an attacker to
execute code with the privileges of the slocate program, typically
installed with setgid privileges of the slocate group.
This problem may be related to the issue identified in Bugtraq ID 7629.
47. MiniHTTPServer File-Sharing for NET Forum HTML Injection Vul...
BugTraq ID: 8781
Remote: Yes
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8781
Summary:
MiniHTTPServer File-Sharing for NET is a commercially available web server
mainly designed for file sharing. It is available for Microsoft Windows
operating systems.
File Sharing for NET has been reported prone to a HTML Injection
Vulnerability. The issue has been reported to exist in the Forum that
ships with the product. A malicious remote attacker may use the "Subject:"
and "Your message:" fields when creating a new forum post to inject
arbitrary HTML into dynamically generated content. This issue is due to a
lack of sufficient sanitization performed on the affected form fields.
An attacker may exploit this vulnerability to execute arbitrary HTML and
script code in the browser of an unsuspecting user who views the malicious
forum post. Code execution will occur in the context of the vulnerable
site. This issue may be exploited to steal cookie based credentials.
Other attacks are also possible.
It should be noted that although this vulnerability has been reported to
affect MiniHTTPServer File-Sharing for NET version 1.5, previous versions
might also be affected.
48. MiniHTTPServer WebForums Forum HTML Injection Vulnerability
BugTraq ID: 8782
Remote: Yes
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8782
Summary:
MiniHTTPServer WebForums Server is a commercially-available HTTP server.
It is available for the Microsoft Windows platform.
MiniHTTPServer WebForums Forum has been reported prone to a HTML Injection
Vulnerability. A malicious remote attacker may use the "Subject:" field
when creating a new forum post to inject arbitrary HTML into dynamically
generated content. This issue is due to a lack of sufficient sanitization
performed on the affected form field.
An attacker may exploit this vulnerability to execute arbitrary HTML and
script code in the browser of an unsuspecting user who views the malicious
forum post. Code execution will occur in the context of the vulnerable
site. This issue may be exploited to steal cookie based credential. Other
attacks are also possible.
It should be noted that although this vulnerability has been reported to
affect MiniHTTPServer WebForums Forum version 1.5, previous versions might
also be affected.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Teen charged in cyber stock scam
By: Kevin Poulsen
Trader allegedly hacked a brokerage account to dump worthless Cisco
options.
http://www.securityfocus.com/news/7177
2. Brits pound OpenSSL bugs
By: Kevin Poulsen
U.K.-funded security research discovers holes in the package's
implementation of Abstract Syntax Notation One.
http://www.securityfocus.com/news/7103
3. Car shoppers' credit details exposed in bulk
By: Kevin Poulsen
Consumers who submitted online credit applications to any of 150 different
automotive dealerships around the U.S. had their personal financial
information exposed on a publicly-accessible website.
http://www.securityfocus.com/news/7067
4. Microsoft to improve Windows security
By: Ted Bridis, The Associated Press
http://www.securityfocus.com/news/7180
5. Bio-terror kit going cheap ... from the Pentagon
By: Drew Cullen, The Register
http://www.securityfocus.com/news/7161
6. Popular PC game stolen by hackers before release
By: Peter Svensson, The Associated Press
http://www.securityfocus.com/news/7160
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. OTPW v1.3
By: Markus Kuhn
Relevant URL: http://www.cl.cam.ac.uk/~mgk25/otpw.html
Platforms: POSIX
Summary:
OTPW is a one-time password authentication module for POSIX systems. Its
security concept is optimized for users who prefer printed paper password
lists over portable electronics. In this mode of operation, it provides
better protection against some attacks than other schemes (e.g. S/KEY). It
provides a library that can be linked with any application that performs
interactive logins. A PAM wrapper is included for simple installation
under Linux.
2. Devil-Linux v1.0-RC1
By: Heiko Zuerker <[email protected]>
Relevant URL: http://www.devil-linux.org/download.htm
Platforms: Linux
Summary:
Devil-Linux is a special Linux distribution which is used for
firewalls/routers. The goal of Devil-Linux is to have a small,
customizable, and secure Linux system. Configuration is saved on a floppy
disk, and it has several optional packages.
3. High Level Firewall Language v0.60.1
By: Renaud Deraison <deraison at hlfl.org>
Relevant URL: http://www.hlfl.org/
Platforms: UNIX
Summary:
High Level Firewall Language permits writing firewalling rules using a
high-level language, and transforms them into rules for real software like
ipfilter, ipchains, or Cisco firewalls.
4. NetMRG v0.10
By: Brady Alleman
Relevant URL: http://www.netmrg.net/
Platforms: Linux
Summary:
NetMRG is a network monitoring, reporting, and graphing system. Using
MySQL, PHP, C++, pthreads, and RRDTOOL, it is capable of monitoring
thousands of variables on five-minute intervals. Graph templating allows
network admins to begin monitoring devices with minimal overhead. NetMRG
is also capable of responding to programmable events, such as variables
exceeding accepted tolerances. It can accommodate server hosting and
Internet service provider environments with different users allowed to
view only their own equipment's graphs.
5. afick v1.2-0
By: Gerbier Eric
Relevant URL: http://afick.sourceforge.net/
Platforms: Os Independent
Summary:
afick is another file integrity checker, designed to be fast and fully
portable between Unix and Windows platforms. It works by first creating a
database that represents a snapshot of the most essential parts of your
computer system. You can then run the script to discover all modifications
made since the snapshot was taken (i.e. files added, changed, or removed).
The configuration syntax is very close to that of aide or tripwire, and a
graphical interface is provided.
6. vnStat v1.2
By: Vergo
Relevant URL: http://torus.lnet.lut.fi/vnstat/
Platforms: Linux
Summary:
vnStat is a console-base network traffic monitor that keeps a log of daily
and monthly network traffic for the selected interface. However, it isn't
a packet sniffer. The traffic information is analyzed from the /proc
-filesystem, so that vnStat can be used without root permissions.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. How do Employers feel about online Degrees (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340993
2. Job in KSA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340991
3. Sr SW Eng Windows Domain Controller Silicon Valley C... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340867
4. experienced e-security specialists (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340866
5. Information Security Analyst $55-$65K base Nashville... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340863
6. Security Operations Manager - NYC Financial Service... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340862
7. Entry Level Pen Testing Engineers - NYC $60-$80K ba... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340860
8. SW Vulnerability Detection Engineer Silicon Valley ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340859
9. Manager of Security Policy and Management Needed!! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340816
10. Looking for former EDS, Booz Allen reps in Fed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340815
11. Security Systems Architect-TN (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340814
12. Security Implementation Project Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340813
13. Federal Bus/Dev Manager (100k base, 200k+ at plan) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340810
14. Federal Sales Director for IPS (115 base-220 plan) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340809
15. Junior White Hats and Pen Testers NYC $60K-$80K (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340807
16. Fwd: Midatlantic Sales Position/ Commercial Accounts... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340806
17. Product Support Manager, Sunnyvale, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340804
18. Pre Sales Engineer- Virginia (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340693
19. InfoSec Masters Student w/ 8 years LAN/WAN @ Securit... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340654
20. Hong Kong - Looking for a grey hat for conferences e... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340653
21. Resume: Wash DC - Network Security Engineer / Analys... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340652
22. IDS Engineers Needed - Washington DC Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340650
23. Security Solutions - Business Development - London (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340648
24. Senior Systems Security Engineer Position in New Orl... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340643
25. AOL Incident Response in Northern VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340575
26. Network Security Engineering Supervisor - Seattle, W... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340572
27. Software Engineer / Application Designer available (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340569
28. Permanent Security Supervisor position in Pittsburgh... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340557
29. Managerial position wanted - Sacramento/CA/US (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340534
30. Seeking computer forensics position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340530
31. Sr. SQA Engineer - Santa Monica, CA. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340424
32. DITSCAP or NIACAP Expert Needed! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340422
33. Lead Software Engineer - LDAP (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340327
34. Senior IT Auditor - Grand Rapids,Michigan (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340326
35. Senior IT Auditor - Atlanta, Georgia (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340325
36. Sr CISSP InfoSec Engineer looking for opening (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340324
37. Security Consulting Sales/Business Development - San... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340323
38. Information Security Specialist - Livingston, NJ (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340235
39. Security Engineer w/ACTIVE Secret Clearance (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340227
40. Ernst and Young's Advanced Security Centers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340226
41. Security Engineer with ACTIVE Secret Clearance (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340213
42. PKI Windows Security Specialist - Bloomington, IL (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340211
43. Security Analyst (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340208
44. System Security Engineer III vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340171
45. UK Sales Manger vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340170
46. Principle Research Scientist - Trusted Computing (d... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/340169
VI. INCIDENTS LIST SUMMARY
--------------------------
1. cron exploit? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340982
2. strange windows behaviour. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340923
3. Administrivia: strange windows behaviour. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340892
4. Spamming, 'hidden' mail server (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340885
5. tcp 17888 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340675
6. P2P applications scanning? Trojan? Malicious users... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340621
7. FW: [INFRAGARD-ATLANTA] DoS on cisco.com (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340551
8. BIND 9.2.1 crashes (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340510
9. AW: BIND 9.2.1 crashes (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340390
10. Strange packets from Verisign Sitefinder (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/340387
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Bug in Microsoft Word (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340794
2. Why this wont work (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340793
3. overwriting .dtors using gcc 3 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340792
4. Why doesnt work? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340791
5. MS03-035 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340715
6. Allchin bug p-o-c. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340613
7. Tiny Windows 2000 Reverse Connect (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340612
8. I've found the Allchin bug. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340609
9. The joys of impurity (was: MOSDEF, InlineEgg) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/340448
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Tool for 026/ 039 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340615
2. Windows 2000 Server hardening (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340614
3. SecurityFocus Microsoft Newsletter #157 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340419
4. MS03-040 MS Internet Explorer Cumulative Patch (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340349
5. Wasn't someone looking for a Group Policy collection... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340330
6. R: Registry Settings for Group Policy Security Optio... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340104
7. Article Announcement: Linux vs. Windows Viruses (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340103
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. sunscreen vpn (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/340616
X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2003-10-03 to 2003-10-10.
XI. SPONSOR INFORMATION
-----------------------
This Issue is sponsored by: Clearsight Networks
FREE Whitepaper: Better Management for Network Security
Looking for a better way to manage your IP security?
Learn how Solsoft can help you:
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console
Download our FREE whitepaper at:
http://www.securityfocus.com/sponsor/ClearSightNetworks_sf-news_031013
------------------------------------------------------------------------