SecurityFocus Newsletter #219

SecurityFocus Newsletter #219
------------------------------

This Issue is Sponsored by: ISS

Protect More With Less!

Get rid of hard-to-manage firewalls, anti-virus, content-filtering and
anti-spam products. ISS' single-engine Proventia? M Series automatically
blocks all forms of attack and eliminates the need for legacy, standalone
security technologies. See Demo.
http://www.securityfocus.com/sponsor/ISS_sf-news_031020
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Incident Response Tools For Unix, Part Two: File-System Tools
     2. Transparent, Bridging Firewall Devices
     3. Disclosure Plan Won't Help
     4. Too Many Hacks
     5. CCIA Report is Bad Medicine
     6. The Flaw of Security Through Diversification
     7. Counterpoint: Linux vs. Windows Viruses
II. BUGTRAQ SUMMARY
     1. Rit Research Labs TinyWeb Server Remote Denial of Service Vu...
     2. Microsoft Windows RPCSS Multi-thread Race Condition Vulnerab...
     3. HP Tru64 CDE dtmailpr Unspecified Privileged Access Vulnerab...
     4. Gallery index.php Remote File Include Vulnerability
     5. Hummingbird CyberDOCS Path Disclosure Vulnerability
     6. IRCnet IRCD Local Buffer Overflow Vulnerability
     7. mIRC DCC SEND Buffer Overflow Vulnerability
     8. mIRC IRC URL Buffer Overflow Vulnerability
     9. Multiple myPHPCalendar File Include Vulnerabilities
     10. WinSyslog Long Syslog Message Remote Denial Of Service Vulne...
     11. Apache Mod_Throttle Module Local Shared Memory Corruption Vu...
     12. WrenSoft Zoom Search Engine Cross-Site Scripting Vulnerabili...
     13. Apache Tomcat Non-HTTP Request Denial Of Service Vulnerabili...
     14. AOL Instant Messenger Getfile Screenname Buffer Overrun Vuln...
     15. Microsoft Messenger Service Buffer Overrun Vulnerability
     16. Microsoft ListBox/ComboBox Control User32.dll Function Buffe...
     17. Microsoft Windows Help And Support Center URI Handler Buffer...
     18. DBMail IMAP Service SQL Injection Vulnerability
     19. Microsoft ActiveX Authenticode Verification Bypass Vulnerabi...
     20. Sun Solaris SysInfo System Call Kernel Memory Reading Vulner...
     21. Microsoft Exchange Server 5.5 Outlook Web Access Cross-Site ...
     22. Microsoft Windows 2000 TroubleShooter ActiveX Control Buffer...
     23. Linksys BEFSX41 EtherFast Router Log Viewer Denial Of Servic...
     24. Microsoft Word Macro Name Handler Buffer Overflow Vulnerabil...
     25. Sun Solaris Pipe Function Unspecified Kernel Race Condition ...
     26. Planet WGSD-1020 Switch Undocumented Administrative User Una...
     27. Microsoft Exchange Server Buffer Overflow Vulnerability
     28. RealOne Player Temporary File Default Browser Script Executi...
     29. Macromedia ColdFusion MX  SQL Error Message Cross-Site Scrip...
     30. Bajie HTTP Server Example Scripts And Servlets Cross-Site Sc...
III. SECURITYFOCUS NEWS ARTICLES
     1. Senators propose Patriot Act limitations
     2. Prosecutors admit error in whistleblower conviction
     3. Teen charged in cyber stock scam
     4. Spam inspires musos to song
     5. NetScreen firms firewalls against app attacks
     6. Teen computer whiz cleared in Houston hacking
IV. SECURITYFOCUS TOP 6 TOOLS
     1. Webmin Usermonitor v0.11a
     2. radmind v1.2.0
     3. w3pw v1.10
     4. testmail v3.1.5
     5. Steghide v0.5.1
     6. NISCA v2.5
V. SECURITYJOBS LIST SUMMARY
     1. Security openings with Ernst and Young LLP (Thread)
     2. Senior Security Engineer   Silicon Valley CA (Thread)
     3. Qwest Staff IT Security Engineer position available ... (Thread)
     4. Security Consultant (Thread)
     5. Manager, Security Consultants (Thread)
     6. Security Policy & Requirements Person Sought (Wash D... (Thread)
     7. Qwest Infosec SW Support position available in multi... (Thread)
     8. Federal Security Delivery Lead needed - Fairfax, VA (Thread)
     9. New Articles @ SecurityFocus (Thread)
     10. Managed Security Services Practice Leader (Thread)
     11. Product Manager position - Cupertino, CA (Thread)
     12. Technical Manager, Systems Security, AOL (Thread)
     13. Qwest seeks Desktop Security Engineer for Denver ope... (Thread)
     14. Looking for an opportunity in Dallas, TX. (Thread)
     15. 7 Requirements in the Mid Atlantic (Thread)
     16. Job Posting - Information Security Analyst (Thread)
     17. Pre-Sales Security Engineer needed for the West Coas... (Thread)
     18. Online degrees (Thread)
     19. How do Employers feel about online Degrees (Thread)
     20. Intrusion Detection Engineer (Thread)
     21. active clearance question and job search (Thread)
     22. Multiple security positions in Germany (Thread)
     23. Seeking INFOSEC Position in the Colorado Area (Thread)
     24. job posting (Thread)
     25. System Security Analyst - Wichita, KS (Thread)
VI. INCIDENTS LIST SUMMARY
     1. FYI - different ISAPI .ida exploit (Thread)
     2. Proxy attackers/hijackers (Thread)
     3. [Dshield] Proxy attackers/hijackers (Thread)
     4. New Rootkit? (Thread)
     5. New Article: Incident Response Tools For Unix, Part ... (Thread)
     6. Article Announcement: CCIA Report is Bad Medicine (Thread)
     7. Exchange/Microsoft SMTP Authenticated User spam? (Thread)
     8. strange windows behaviour. (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
     1. procmail again (Thread)
     2. Question (Thread)
     3. question about the new sendmail prescan bug (Thread)
     4. sendmail bugs (Thread)
     5. lame citrix bug, anyone think of anything interestin... (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
     1. RPC Scan Issues (Thread)
     2. group policy question (Thread)
     3. Win2003 RPC failure after Hotfix (Thread)
     4. USB memory supporting NTFS? (Thread)
     5. automating reboot (was RE: RPC Scan Issues) (Thread)
     6. question re: continued RPC vulnerability (Thread)
     7. Article Announcement: The Flaw of Security Through D... (Thread)
     8. Blocking and allowing ActiveX (Thread)
     9. Article Announcement: CCIA Report is Bad Medicine (Thread)
     10. Windows 2000 Server hardening (Thread)
     11. SecurityFocus Microsoft Newsletter #158 (Thread)
     12. Guest Feature Announcement: Counterpoint: Linux vs. ... (Thread)
IX. SUN FOCUS LIST SUMMARY
     1. Solaris 9 ssh (Thread)
     2. Prevent remote User login (Thread)
     3. New SecurityFocus articles (Thread)
     4. Administrivia: Your response requested (Thread)
     5. Account Lockout in Solaris 8 (Thread)
X. LINUX FOCUS LIST SUMMARY
     1. Synflooding a Linux (Thread)
     2. Administrivia: Your Response Requested (Thread)
     3. New articles on the SecurityFocus site (Thread)
     4. curious port activity (Thread)
XI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Incident Response Tools For Unix, Part Two: File-System Tools
By Holt Sorenson

This article is the second in a three-part series on tools that are useful
during incident response and investigation after a compromise has occurred
on a OpenBSD, Linux, or Solaris system. This installment will focus on
file system tools.

http://www.securityfocus.com/infocus/1738

2. Transparent, Bridging Firewall Devices
By Matthew Tanase

This article examines the concept of a transparent or bridging firewall
which sits hidden in-line with the network it protects.

http://www.securityfocus.com/infocus/1737

3. Disclosure Plan Won't Help
By Mark Rasch

Encouraging publicly-traded companies to disclose their cyber security
efforts would only force them to choose between providing vague and
useless platitudes, or
specific and dangerous details.

http://www.securityfocus.com/columnists/192

4. Too Many Hacks
By Hal Flynn

The open-source community should abandon its piecemeal approach to
securing Linux-- and soon.

http://www.securityfocus.com/columnists/191

5. CCIA Report is Bad Medicine
By  Tim Mullen

The proposed cure for the Internet's security woes might help Microsoft
competitors, but it would only make our security problems worse.

http://www.securityfocus.com/columnists/190

6. The Flaw of Security Through Diversification
by Mark Burnett

In the recent CCIA paper at
http://www.ccianet.org/papers/cyberinsecurity.pdf the authors Geer,
Pfleeger, Schneier, Quarterman, Metzger, Bace, and Gutmann introduce the
concept of "risk diversification as a primary defense against aggregated
risk when that risk cannot otherwise be addressed."

http://www.securityfocus.com/guest/23184

7. Counterpoint: Linux vs. Windows Viruses
by Thor Larholm

The debate over which Operating System is the most secure is an age-old
debate, which is filled with a vigor and passion similar to those debating
their religious beliefs. However, in the end it all boils down to reliable
management, adherence to policies and procedures and proper use.

http://www.securityfocus.com/guest/23028


II. BUGTRAQ SUMMARY
-------------------
1. Rit Research Labs TinyWeb Server Remote Denial of Service Vu...
BugTraq ID: 8810
Remote: Yes
Date Published: Oct 10 2003
Relevant URL: http://www.securityfocus.com/bid/8810
Summary:
TinyWeb is a small web server daemon available for the Microsoft Windows
operating system.

A vulnerability has been reported in the software that may allow a remote
attacker to cause a denial of service condition in the server.  The issue
presents itself when an attacker sends a malformed HTTP GET request to the
server for: /cgi-bin/.%00./dddd.html.  This request may cause the software
to consume an excessive amount of CPU cycles leading to a crash or hang.

Successful exploitation of this issue may allow an attacker to cause the
software to act in an unstable manner leading to a crash or hang.

TinyWeb version 1.9 has been reported to be prone to this issue, however
other versions may be vulnerable as well.

2. Microsoft Windows RPCSS Multi-thread Race Condition Vulnerab...
BugTraq ID: 8811
Remote: Yes
Date Published: Oct 10 2003
Relevant URL: http://www.securityfocus.com/bid/8811
Summary:
It has been reported that a multi-threaded race condition in the RPCSS
service of Microsoft Windows exists.  Because of this, it may be possible
for an attacker to mount denial of service attacks.  This condition is
reported to exist when the service is handling multiple RPC requests.  In
particular, if two threads are processing the same request, one thread may
free a packet while the other thread is still processing the packet.  This
could result in memory corruption.  Certain factors such as network
latency, CPU, and the state of memory on the vulnerable system may make it
difficult to reliably reproduce the condition, though it may be possible
under some circumstances to corrupt memory in a manner sufficient to
execute arbitrary code.  Code execution has been deemed unlikely.

However, it has been reported by a reliable source that this problem can
cause a denial of service on fully patched Windows XP Service Pack 1
systems (including the patches supplied in MS03-039).  Additionally, it
has been indicated that the vendor has been notified of this issue.

New information has been obtained from a reliable source, confirming that
the exploitation of this issue will trigger a denial of service on fully
patched Windows 2000 systems.

It is unknown what impact this attack has on Windows 2003.

3. HP Tru64 CDE dtmailpr Unspecified Privileged Access Vulnerab...
BugTraq ID: 8813
Remote: Yes
Date Published: Oct 10 2003
Relevant URL: http://www.securityfocus.com/bid/8813
Summary:
Tru64 is a UNIX Operating System variant distributed and maintained by HP.

A problem has been identified in dtmailpr that may allow authenticated
attackers to gain unauthorized privileged access to remote  systems.

It has been reported by HP that an issue in the Common Desktop Environment
suite distributed with Tru64 contains a vulnerability that could be
exploited by a remote attacker to gain unauthorized remote privileged
access. Specific information about this vulnerability is not currently
available.

It is not known if this issue affects CDE on other platforms. Specific
information about this vulnerability is also not currently available.

4. Gallery index.php Remote File Include Vulnerability
BugTraq ID: 8814
Remote: Yes
Date Published: Oct 11 2003
Relevant URL: http://www.securityfocus.com/bid/8814
Summary:
Gallery is a web application designed to allow users to manage images on
their web site, such as creating photo albums. Gallery is written in the
PHP script language.

It has been reported that Gallery is prone to a remote file include
vulnerability. The problem occurs when handling the GALLERY_BASEDIR URI
parameter, used to specify the base directory for requests to the
index.php script. Specifically, the gallery application fails to verify
the origin of the location specified by the parameter. As a result, an
attacker may be capable of hosting a malicious PHP script file using the
naming convention util.php, and have the file included into the PHP code
executed by the web server.

Successful exploitation of this issue could ultimately allow for the
execution or arbitrary code on the remote system.

**Update: The vendor has reported that this vulnerability can only be
exploited in  'configuration mode' on unix based systems. Windows users
are reported prone to this vulnerability at all times.

5. Hummingbird CyberDOCS Path Disclosure Vulnerability
BugTraq ID: 8816
Remote: Yes
Date Published: Oct 11 2003
Relevant URL: http://www.securityfocus.com/bid/8816
Summary:
Hummingbird CyberDOCS (DM) is document management software, designed to
run on Microsoft Windows server platforms in conjunction with a SQL
database.

Hummingbird CyberDOCS has been reported prone to a path disclosure
vulnerability. An attacker could potentially access sensitive path
information by making a request to the cyberdocs.asp or loginact.asp
scripts without supplying parameters. This will effectively return an
error page containing the installation directory of the application.

Access to this information could aid an attacker in launching future
attacks.

6. IRCnet IRCD Local Buffer Overflow Vulnerability
BugTraq ID: 8817
Remote: Yes
Date Published: Oct 13 2003
Relevant URL: http://www.securityfocus.com/bid/8817
Summary:
IRCnet IRCD is an IRC implementation that is available for a number of
platforms including Linux/Unix variants.

IRCnet IRCD has been reported prone to a buffer overflow vulnerability
that may be exploited by local users. The issue likely presents itself due
to a lack of sufficient bounds checking performed on user-supplied data
before it is copied into a reserved buffer in memory. Supplied data that
exceeds the size of the affected buffer may overrun its bounds and corrupt
adjacent memory. This issue may be exploited to crash the affected server.
Although unconfirmed, due to the nature of this vulnerability it has been
conjectured that a local attacker may also leverage this condition to
potentially have arbitrary instructions executed in the context of the
affected server.

This vulnerability has been reported to affect all versions of IRCnet IRCD
in the 2.10 development tree up to and including 2.10.3p3.

7. mIRC DCC SEND Buffer Overflow Vulnerability
BugTraq ID: 8818
Remote: Yes
Date Published: Oct 13 2003
Relevant URL: http://www.securityfocus.com/bid/8818
Summary:
mIRC is a chat client for the IRC protocol, designed for Microsoft Windows
based operating systems.

A vulnerability has been reported to exist in mIRC that may allow a remote
attacker to crash a vulnerable mIRC client. The condition is most likely
present due to insufficient boundary checking performed on 'DCC SEND'
requests.

It has been reported that when received, a malicious 'DDC SEND' request
can trigger a fatal error and cause an affected mIRC client to crash. The
'DCC SEND' request can be sent to a channel or a specific targeted user.
Although unconfirmed, due to the nature of this vulnerability it has been
conjectured that a remote attacker may potentially lever this issue to
have arbitrary code executed in the context of the affected mIRC client.

mIRC versions 6.1 and 6.11 have been reported to be prone to this issue,
however other versions may be affected as well.

8. mIRC IRC URL Buffer Overflow Vulnerability
BugTraq ID: 8819
Remote: Yes
Date Published: Oct 13 2003
Relevant URL: http://www.securityfocus.com/bid/8819
Summary:
mIRC is a chat client for the IRC protocol, designed for Microsoft Windows
based operating systems. When mIRC is installed it registers a handler for
a 'irc://' type of URL. Through these means, mIRC is invoked when a 'IRC
URL' is followed.

mIRC has been reported prone to a buffer overflow vulnerability when
handling malicious 'IRC URLs'. Specifically when a IRC URL of >998 bytes
is clicked by a user running a vulnerable version of mIRC.

The issue likely presents itself due to a lack of sufficient boundary
checks performed when IRC URL data is being copied into an insufficient
buffer in memory. Data that exceeds the size of the reserved buffer will
overrun its bounds and corrupt adjacent memory. Because memory adjacent to
the affected buffer is used to store a saved instruction pointer, an
attacker may influence execution flow of the affected client into attacker
controlled memory. This may ultimately allow the attacker to execute
arbitrary instructions in the context of the user running the affected
client.

mIRC version 6.1 has been reported to be prone to this issue, however
other versions may be affected as well.

9. Multiple myPHPCalendar File Include Vulnerabilities
BugTraq ID: 8820
Remote: Yes
Date Published: Oct 13 2003
Relevant URL: http://www.securityfocus.com/bid/8820
Summary:
myPHPCalendar is online event planning/calendar software implemented in
PHP.

myPHPCalendar has been reported prone to multiple file include
vulnerabilities. These issues present themselves due to a lack of
sufficient sanitization performed on user-supplied values for the
'cal_dir' URI parameter.

A remote attacker may exploit these conditions to include arbitrary
external PHP scripts and have the code contained within executed in the
context of the web server.

It should be noted that although this vulnerability has been reported to
exist in  myPHPCalendar 10192000 Build 1 Beta, others versions may also be
affected.

10. WinSyslog Long Syslog Message Remote Denial Of Service Vulne...
BugTraq ID: 8821
Remote: Yes
Date Published: Oct 14 2003
Relevant URL: http://www.securityfocus.com/bid/8821
Summary:
WinSyslog is a server that logs system events.  It is available for
Microsoft Windows operating systems.

WinSyslog is prone to a remotely exploitable denial of service
vulnerability.  This occurs when the program receives multiple excessive
syslog messages via the port it listens on (10514/UDP by default).  An
exploit script was provided with the disclosure of this vulnerability that
floods the server with incrementally larger syslog messages, triggering
the condition.

This is also reported to cause system instability, which is likely due to
resource exhaustion.  It is not known if this vulnerability is due to a
more serious issue such as a boundary condition error.

This vulnerability was reported to affect WinSyslog 4.21 SP1.  Other
versions may also be affected.

11. Apache Mod_Throttle Module Local Shared Memory Corruption Vu...
BugTraq ID: 8822
Remote: No
Date Published: Oct 14 2003
Relevant URL: http://www.securityfocus.com/bid/8822
Summary:
The mod_throttle Apache module is an application developed by sert.com. It
is designed to reduce the load used when handling specified server
requests. mod_throttle is available for the BSD, Linux, and Solaris
operating systems.

The mod_throttle Apache module is said to be prone to a vulnerability that
could allow for local privilege elevation. The problem occurs due to the
mod_throttle module incorrectly storing critical data within shared memory
that is accessible by a user with 'apache' privileges. As a result, an
attacker may be capable of corrupting memory pointers and a data file
located in a shared memory segment. These pointers may have previously
pointed to internal module procedures or may point to critical data
required to unload the module while Apache is terminating.

This could ultimately lead to privilege elevation during the startup or
shutdown procedures of Apache, ultimately allowing for an attacker to gain
root privileges.

To successfully exploit this issue, it has been reported that an attacker
must somehow cause Apache to reload its configuration file. As a result,
this vulnerability may be exploited in conjunction with the issue
described in BID 5884. Other methods of loading the configuration file may
also be used.

12. WrenSoft Zoom Search Engine Cross-Site Scripting Vulnerabili...
BugTraq ID: 8823
Remote: Yes
Date Published: Oct 14 2003
Relevant URL: http://www.securityfocus.com/bid/8823
Summary:
WrenSoft Zoom Search Engine is a search utility that allows users to add a
search engine to websites.

A vulnerability has been reported to exist in the search module of the
software that may allow a remote attacker to execute HTML or script in a
user's browser.

The problem is reported to exist due to a lack of sanitization of
user-supplied input by the software. HTML and script code will be rendered
in a user's browser, therefore making it possible for an attacker to a
construct a malicious link containing HTML or script code that may be
rendered in a user's browser upon visiting that link. This attack would
occur in the security context of the vulnerable site.

Successful exploitation of this vulnerability may allow an attacker to
steal cookie-based authentication credentials. Other attacks may well be
possible.

WrenSoft Zoom Search Engine Version 2.0 - Build: 1018 has been listed as a
vulnerable package, however other versions may be affected as well.

13. Apache Tomcat Non-HTTP Request Denial Of Service Vulnerabili...
BugTraq ID: 8824
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8824
Summary:
Tomcat is a web server and JSP/Servlet container that is developed by
Apache as part of the Jakarta project.

Apache Tomcat 4 has been reported prone to a remotely triggered denial of
service vulnerability when handling undisclosed non-HTTP request types.

It has been reported that when certain specific non-HTTP request types are
handled by the Tomcat HTTP connector the Tomcat server will reject
subsequent requests on the affected port until the service is restarted.

A remote attacker may exploit this condition to deliberately prevent the
affected server from handling requests, effectively denying service to
legitimate users.

It should be noted that this vulnerability has been reported for Tomcat
4.0.x versions.

14. AOL Instant Messenger Getfile Screenname Buffer Overrun Vuln...
BugTraq ID: 8825
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8825
Summary:
AOL Instant Messenger (AIM) is an instant messaging client that is
available for a number of platforms, including Microsoft Windows.

AIM is prone to a remotely exploitable buffer overrun vulnerability.

When AIM is installed, a protocol handler for AIM URIs is also installed
so that the client may be invoked from within a web page.  A vulnerability
has been reported that is exposed through the AIM URI handler.
Specifically this issue is due to insufficient bounds checking of the
screenname parameter when it is specified in a "getfile" operation.  This
could permit an attacker to corrupt memory with attacker-supplied values,
allowing for control of execution flow by corrupting variables such as an
instruction pointer.

Attackers may exploit this by enticing a user of the client to follow a
maliciously constructed AIM URI (using the AIM protocol handler) that
performs a "getfile" operation with an overly long value as the
screenname.  It is reported that this condition can be reproduced by
supplying a screenname that is 1130 characters or more in length.

15. Microsoft Messenger Service Buffer Overrun Vulnerability
BugTraq ID: 8826
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8826
Summary:
Microsoft Messenger Service is a Windows service that is responsible for
sending and receiving "net send" messages.  The service also handles any
messages that are sent via the Alerter service between client and server
systems.  The Microsoft Messenger Service is not related to MSN Messenger.

Microsoft Messenger Service is prone to a remotely exploitable buffer
overrun vulnerability.  This is due to a boundary condition error in the
service that may allow for memory corruption.  While the service does
attempt to validate that messages are of an acceptable length, it is
reported that after performing bounds checking, the service will replace
instances of the 0x14 character in the message body with a CR/LF (Carriage
Return/Line-feed) sequence, without accounting for the fact that each
CR/LF sequence requires 2 bytes.  In this manner, a particularly malformed
message may potentially corrupt adjacent regions of process memory.

Exploitation could result in a denial of service or in execution of
malicious code in Local System context, potentially allowing for full
system compromise.

The service is exposed via NetBIOS (ports 137-139) and RPC (port 135).

16. Microsoft ListBox/ComboBox Control User32.dll Function Buffe...
BugTraq ID: 8827
Remote: No
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8827
Summary:
A ComboBox control is a class used to display a drop-down list of
predefined values, as well as a field that takes user-supplied input. A
ListBox control is a similar class, however it is designed to simply
display a list of predefined values and allow a user to select a single
one.

Microsoft has reported the existence of a local buffer overrun
vulnerability in an undisclosed User32.dll library function. Both the
ComboBox and ListBox controls invoke this User32.dll function when
handling windows messaging events. The function is said to perform
insufficient sanity checks when handling specific data located within
these Windows messages. In particular, it is possible to trigger this
issue by sending a specially crafted LB_DIR message to a ListBox or a
CB_DIR message to a ComboBox. The attacker will have to specify a long
pathname for either message to cause the condition to occur. This will
reportedly cause an exception during a wcscpy call (which is a string copy
function).

This issue poses a security risk when a privileged application is
implementing the use of these affected control classes and is running in
the environment of an unprivileged user. An attacker could effectively
transmit a malicious windows message containing excessive data designed to
trigger the buffer overrun and control the execution flow of the target
program. This could ultimately allow a user with interactive local system
access to gain administrative privileges.

Microsoft has also reported that this issue affects the Utility Manager
application, designed to manage various accessibility utilities found on a
system. This application runs with administrative privileges by default on
Windows 2000 systems and is affected by this issue. As a result, this
program would likely be the target of choice for an attacking user. It
should be noted however, that the scope of this vulnerability is not
limited to the Utility Manager, as any third-party program implementing
the use of the affected controls will be vulnerable.

Finally, Microsoft has stated that the XP and 2003 versions of the Utility
Manager application are not exploitable to gain elevated privileges, as
they are invoked with the privileges of the current user.

17. Microsoft Windows Help And Support Center URI Handler Buffer...
BugTraq ID: 8828
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8828
Summary:
Microsoft Windows contains a Help and Support Center (HSC) facility that
provides help on several topics such as Windows features and hardware
support. The HSC also contains a URI handler that allows pages to be
opened through an 'hcp://' prefix.

A buffer overflow vulnerability has been reported to affect the Help and
Support Center for Microsoft Windows systems.  The issue exists in
helpsvc.exe, which is started by the svchost.exe process.

The issue has been reported to present itself due to a lack of sufficient
bounds checking performed when handling 'hcp://' URI links. This could
allow an unusually long string supplied to the HSC through the URI handler
to overrun the bounds of a reserved buffer in memory.

An attacker may deliberately trigger this issue to corrupt stack memory
adjacent to the affected buffer with attacker-supplied values. This could
allow for corruption of an instruction pointer or SEH (Structured
Exception Handler).  Ultimately the attacker may influence program
execution flow into attacker-controlled memory leading to the execution of
arbitrary code on the system in the local computer security context.

This vulnerability could be exploited by including a malformed link using
'hcp://' prefixes in a web page or through HTML email.  It is also
possible to exploit this issue locally to gain elevated privileges.

It should be noted, the vendor has stated that although the vulnerable
code is present on all supported operating systems, attack vectors that
could lead to an exploitable issue are believed to only be present on
Windows XP and Windows Server 2003 systems. This is because the HCP
protocol is not supported on all other supported Windows operating
systems.

Additionally this vulnerability may be related to the issue reported in
BID 6802.

18. DBMail IMAP Service SQL Injection Vulnerability
BugTraq ID: 8829
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8829
Summary:
dbmail is a set of applications used for storing and retrieving e-mail
messages from a database.  dbmail supports MySQL or PostgreSQL databases.

A vulnerability has been reported to exist in dbmail IMAP service that may
allow a remote attacker to inject malicious SQL syntax into database
queries. The source of this issue is insufficient sanitization of
user-supplied input.

The problem is reported to exist in various parameters such as username
and password. It has been reported that the vulnerable parameters are not
sanitized for user-supplied input before it is included in the database. A
remote attacker may exploit this issue to influence SQL query logic while
attempting to authenticate to the server.

A malicious user may influence database queries in order to view or modify
sensitive information, potentially compromising the software or the
database.

dbmail versions 1.1 and prior have been reported to be prone to this
issue, however other versions may be affected as well.

19. Microsoft ActiveX Authenticode Verification Bypass Vulnerabi...
BugTraq ID: 8830
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8830
Summary:
Authenticode is a component that allows for the verification of ActiveX
controls.  When a web page attempts to install an ActiveX control,
Authenticode verifies the publisher of a signed control and prompts the
user whether or not to install the control.

A problem exists that could allow Authenticode to be bypassed by ActiveX
controls.

Under certain low memory conditions, an ActiveX control may be installed
without Authenticode prompting the user.  This could allow a malicious
ActiveX control embedded in a web page or HTML e-mail to install and
execute on the vulnerable system.  The control would be executed in the
security context of the current user.

20. Sun Solaris SysInfo System Call Kernel Memory Reading Vulner...
BugTraq ID: 8831
Remote: No
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8831
Summary:
Solaris is the UNIX operating system distributed and maintained by Sun
Microsystems.  It is available for the Sparc and Intel architectures.

A problem has been reported in the Solaris sysinfo system call.  Because
of this, an attacker may be able to gain access to potentially sensitive
information.

The problem is in the ability of a local user to read kernel information.
A flaw in sysinfo gives users the ability to read sections of kernel
memory.  It is not known what ability the user has in reading specific
segments, or if this problem can be manipulated to read target locations.
However, memory dumps gained from this problem may contain sensitive
information such as password credentials.

It should be noted that this vulnerability only permits the reading of
kernel memory.  It has been reported by Sun that this issue does not allow
local users to write to kernel memory space through this issue.

21. Microsoft Exchange Server 5.5 Outlook Web Access Cross-Site ...
BugTraq ID: 8832
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8832
Summary:
Microsoft Exchange Server 5.5 is an e-mail and directory server offered by
Microsoft.  Outlook Web Access is a service provided by Exchange server
that allows users to access their Exchange mailbox via the web.

A vulnerability has been reported to be present in the software that may
allow remote attackers to execute HTML or script code in the browser of a
user running the vulnerable version of the software.

The problem is reported to exist due to improper handling of user-supplied
data in the Compose New Message form of Outlook Web Access.  HTML and
script code will be rendered in a user's browser, therefore making it
possible for an attacker to a construct a malicious link containing HTML
or script code that may be rendered in a user's browser upon visiting that
link. This attack would occur in the security context of the user.

Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.

22. Microsoft Windows 2000 TroubleShooter ActiveX Control Buffer...
BugTraq ID: 8833
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8833
Summary:
A vulnerability has been discovered in the Microsoft TroubleShooter
ActiveX control.  Because of this, it may be possible for a remote
attacker to execute arbitrary with the privileges of a client user.

The issue is due to insufficient bounds checking of data supplied via the
RunQuery2 method by the ActiveX control.  By viewing an HTML document that
invokes the control in a malicious manner, an attacker could potentially
force the execution of arbitrary instructions with the privileges of the
user viewing the document.

It should be noted that this vulnerability could be exploited through one
of several means, such as the viewing of a web page through a browser,
through HTML e-mail, and other programs that may invoke ActiveX controls.
It should be noted that the control is also marked as "Safe For
Scripting", so the user may not be prompted when the control is invoked.

This vulnerability affects only Windows 2000 systems, which included the
TroubleShooter ActiveX control (tshoot.ocx) in default installations.

23. Linksys BEFSX41 EtherFast Router Log Viewer Denial Of Servic...
BugTraq ID: 8834
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8834
Summary:
Linksys Instant Broadband EtherFast Cable/DSL Firewall Router with 4-Port
Switch/VPN Endpoint is a hardware router targeted at home and small office
users.

Linksys BEFSX41 EtherFast Routers are prone to a denial of service.  This
issue is exposed via the log viewer in the web administrative interface.
By submitting an invalid value for the "Log_Page_Num" parameter, it is
possible to trigger this condition, causing the router to be unresponsive.
The log viewer is implemented via Group.cgi.  The following example was
provided to demonstrate the issue:

http://192.168.1.1/Group.cgi?Log_Page_Num=1111111111&LogClear=0

While exploitation does require a logged in administrative user to submit
a request to the log viewer with malformed parameters, it is possible that
the admin could be tricked into visiting a malicious URI that exploits the
issue.  The URI could be embedded in an image tag in a web page that the
administrative user visits.  Due to the router being at a predictable
address and many router commands being submitted via HTTP GET requests, it
may also be possible to use this type of attack to trick a logged
administrative user into executing other router commands.  This has not
been confirmed.

24. Microsoft Word Macro Name Handler Buffer Overflow Vulnerabil...
BugTraq ID: 8835
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8835
Summary:
Microsoft Word is text document editing software that is distributed as
part of Microsoft Office suite.

Microsoft Word has been reported prone to a buffer overflow vulnerability.

The issue has been reported to present itself due to a lack of sufficient
bounds checking performed in macro name handler routines. It has been
reported that when a macro is saved, its information, including Unicode
internal and external macro names and their corresponding string size are
stored in internal structures that are embedded into an associated word
document. When these macro-names are processed, the name is copied into an
internal reserved buffer in memory that is a fixed size to accommodate a
256 Unicode character macro name.

The procedures that copy the macro name into the reserved buffers have
been reported to lack boundary checking conditional statements. As a
result of this vulnerability, an attacker may construct a malicious word
document and modify macro name string sizes so that they exceed the size
of the reserved buffer in memory. When an unsuspecting user opens this
Word document, memory corruption will occur, likely causing Word to fail.

It is not currently known if this vulnerability may be exploited to
execute arbitrary code.

Microsoft Word that ships with Office XP has not been reported prone to
this issue.

25. Sun Solaris Pipe Function Unspecified Kernel Race Condition ...
BugTraq ID: 8836
Remote: No
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8836
Summary:
Solaris is the UNIX operating system distributed and maintained by Sun
Microsystems. It is available for the Sparc and Intel architectures.

A problem has been reported in the Solaris pipe function and STREAMS
routines. Because of this, an attacker may be able to crash vulnerable
systems.

The problem is a race condition in these utilities.  Under some
circumstances, a local user can use the pipe function and STREAMS routines
maliciously to cause a race condition in the kernel.  In doing so, it is
possible to cause the system to become unstable and crash.

Precise details pertaining to the vulnerable components and means of
exploitation are not available.  This BID will be updated when more
information becomes available.

26. Planet WGSD-1020 Switch Undocumented Administrative User Una...
BugTraq ID: 8837
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8837
Summary:
Planet WGSD-1020 is a switching device, including gigabit network support.
It includes SNMP and web-based management features.

It has been reported that the Planet WGSD-1020 device includes an
undocumented default administrative user. The user can be accessed by
supplying the username 'superuser' and the password 'planet'. This will
effectively grant administrator access to the device.

It should be noted that, although this user is said to be undocumented, it
has also be reported that it is possible to disable the user in the switch
configuration file.

This issue is said to affect devices running all firmware versions.

27. Microsoft Exchange Server Buffer Overflow Vulnerability
BugTraq ID: 8838
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8838
Summary:
Microsoft has announced that Exchange Server is affected by a remotely
exploitable buffer overflow condition.  The overflow can be triggered
remotely  by unauthenticated SMTP clients.

Microsoft has stated that remote code execution is possible on hosts
running Exchange 2000 Server.  Servers running Exchange Server 5.5 are
vulnerable to a denial of service attack.

A remote user may connect to the SMTP port of the server and issue an
unusually large extended verb request.  On an Exchange Server 5.5 system,
this would result in a denial of service due to memory exhaustion.

On a system running Exchange 2000 Server, this unusually large request
would result in an internal buffer being overrun.  Execution of arbitrary
code in the security context of the Exchange service may be possible.

It is important to note that the SMTP services on Windows NT, 2000, XP,
and 2003 are not affected by this issue, unless a vulnerable version of
Exchange has been installed on the system.

28. RealOne Player Temporary File Default Browser Script Executi...
BugTraq ID: 8839
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8839
Summary:
RealOne Player is a media player that is available for a number of
platforms including Microsoft Windows and MacOS systems.

It has been reported that RealOne Player is vulnerable to an issue in the
handling of temporary files.  Because of this, an attacker may be able to
perform unauthorized actions in a user's web browser.

Specific details pertaining to this issue are not currently available.  It
is known that under some circumstances, it is possible to write to
temporary files before they are loaded in the default browser on a system.
Data written to these files could include arbitrary URLs, as well as
script code.

It is conjectured that this problem may be permit a loaded file to execute
script through the default browser in the local security zone, thus making
it possible to carry out actions on the local system on behalf of the
RealOne Player user.  However, this has not been confirmed by Real or
Symantec.

29. Macromedia ColdFusion MX  SQL Error Message Cross-Site Scrip...
BugTraq ID: 8840
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8840
Summary:
ColdFusion MX is the application server for developing and hosting
infrastructure distributed by Macromedia. It is available as a standalone
product for Unix, Linux, and Microsoft Operating Systems.

A vulnerability has been reported to exist in the software that may allow
a remote attacker to execute HTML or script code in the browser of a user
running the vulnerable version of ColdFusion MX.

The problem is due to a lack of sanitization of user-supplied input by the
software.  Although unconfirmed, it has been reported to occur when the
software displays error messages generated by the underlying database.
Therefore making it possible for an attacker to construct a malicious link
containing HTML or script code that may be rendered in a user's browser
upon visiting that link. This attack would occur in the security context
of the vulnerable site.

Successful exploitation of this vulnerability may allow an attacker to
steal cookie-based authentication credentials. Other attacks are also
possible.

Macromedia ColdFusion MX version 6.0 was reported to be vulnerable to this
issue, however other versions may be affected as well.

30. Bajie HTTP Server Example Scripts And Servlets Cross-Site Sc...
BugTraq ID: 8841
Remote: Yes
Date Published: Oct 16 2003
Relevant URL: http://www.securityfocus.com/bid/8841
Summary:
Bajie HTTP Web Server is a Java web server.  It is available for Microsoft
Windows and Unix and Linux variants.

Demonstration scripts and servlets that are distributed as part of Bajie
HTTP Server have been reported prone to multiple cross-site scripting
vulnerabilities. These demonstration scripts and servlets are likely not
supposed to be published for external access, but rather supposed to act
as a demonstration of the functionality contained in the Bajie HTTP
server.

It has been reported that a remote attacker may construct a malicious link
containing script and HTML code to any one of the vulnerable demonstration
scripts or servlets on the affected server. If this link is followed the
code contained therein will be rendered in the browser of the user who
followed the link. Code execution will occur in the context of the
vulnerable script running on the Bajie HTTP Server.

A remote attacker may exploit this vulnerability to steal cookie based
authentication tokens. Other attacks are also possible.

It should be noted that although this vulnerability has been reported to
affect Bajie HTTP server version 0.95zxv4, previous versions that are
bundled with the same demonstration scripts are also likely vulnerable.


III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Senators propose Patriot Act limitations
By: Kevin Poulsen

In 2001, the Senate approved USA-PATRIOT 98 to 1. Now proposed legislation
with bipartisan support would undo some of their own work.

http://www.securityfocus.com/news/7245

2. Prosecutors admit error in whistleblower conviction
By: Kevin Poulsen

Federal officials will ask a court to set aside the conviction of a man
who served 16 months in federal prison for blowing the whistle on an
ex-employer's cybersecurity holes.

http://www.securityfocus.com/news/7202

3. Teen charged in cyber stock scam
By: Kevin Poulsen

Trader allegedly hacked a brokerage account to dump worthless Cisco
options.

http://www.securityfocus.com/news/7177

4. Spam inspires musos to song
By: John Leyden, The Register

http://www.securityfocus.com/news/7253

5. NetScreen firms firewalls against app attacks
By: John Leyden, The Register

http://www.securityfocus.com/news/7252

6. Teen computer whiz cleared in Houston hacking
By: , The Associated Press

http://www.securityfocus.com/news/7242


IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Webmin Usermonitor v0.11a
By: Alexander Gehrig <[email protected]>
Relevant URL: http://www.gehrigal.net/projects/webmin_usermonitor/
Platforms: AIX, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD, SCO,
Solaris, SunOS, UNIX
Summary:

Webmin Usermonitor is a Webmin module that allows you to view all user
connections to the system which are based on Telnet, SSH, or Samba. It is
able to kill a user's connection or send a message to the user.

2. radmind v1.2.0
By: UMich RSUG
Relevant URL: http://rsug.itd.umich.edu/software/radmind
Platforms: FreeBSD, Linux, MacOS, OpenBSD, Solaris, SunOS, UNIX
Summary:

radmind is a suite of Unix command-line tools and a server designed to
remotely administer the file systems of multiple Unix machines. At its
core, radmind operates as a tripwire. It is able to detect changes to any
managed filesystem object, e.g. files, directories, links, etc. However,
radmind goes further than just integrity checking: once a change is
detected, radmind can optionally reverse the change. Each managed machine
may have its own loadset composed of multiple, layered overloads. This
allows, for example, the operating system to be described separately from
applications. Loadsets are stored on a remote server. By updating a
loadset on the server, changes can be pushed to managed machines.

3. w3pw v1.10
By: Thomas Seifert
Relevant URL: http://w3pw.sourceforge.net/
Platforms: Os Independent
Summary:

w3pw is a Web based password wallet manager written in PHP. The encrypted
information is stored in a MySQL database.

4. testmail v3.1.5
By: c.kruk
Relevant URL: http://strony.wp.pl/wp/c_kruk/
Platforms: Perl (any system supporting perl)
Summary:

testmail is a Perl script that checks email availability at the POP3
server, filters it according to defined rules, and--depending on the
selected method--gets the messages to the local mailbox and/or removes it
from the server. It uses Perl libnet module and helps you escape from
spam.

5. Steghide v0.5.1
By: Stefan Hetzl
Relevant URL: http://steghide.sourceforge.net
Platforms: AIX, BSDI, Digital UNIX/Alpha, FreeBSD, HP-UX, IRIX, Linux,
NetBSD, OpenBSD, SCO, Solaris, SunOS, True64 UNIX, Ultrix, UNIX, Unixware,
Windows 95/98, Windows NT
Summary:

Steghide is steganography program which hides bits of a data file in some
of the least significant bits of another file in such a way that the
existence of the data file is not visible and cannot be proven. Steghide
is designed to be portable and configurable and features hiding data in
bmp, wav and au files, blowfish encryption, MD5 hashing of passphrases to
blowfish keys, and pseudo-random distribution of hidden bits in the
container data.

6. NISCA v2.5
By: Brett Baugh
Relevant URL: http://nisca.sourceforge.net/
Platforms: POSIX
Summary:

NISCA (Network Interface Statistics Collection Agent) is a more flexible
PHP4-based MRTG replacement. It supports both SNMP and reading localhost's
/proc/net/dev device file directly for statistics gathering. It uses MySQL
to store collected data in, and stores statistics for bytes transferred,
packets transferred, transfer errors, and dropped packets separated into a
per interface incoming and outgoing set. It generates both graphs and a
textual report table using the data from any timeframe contained in the
database. The entire package runs using PHP4; it uses the CGI binary
version of PHP for stats collection (running in the background as a
"daemon") and either the CGI or Apache module versions to generate the GUI
form and reports. It can also import existing MRTG logfiles.


V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Security openings with Ernst and Young LLP (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341729

2. Senior Security Engineer   Silicon Valley CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341726

3. Qwest Staff IT Security Engineer position available ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341723

4. Security Consultant (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341593

5. Manager, Security Consultants (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341591

6. Security Policy & Requirements Person Sought (Wash D... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341590

7. Qwest Infosec SW Support position available in multi... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341550

8. Federal Security Delivery Lead needed - Fairfax, VA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341549

9. New Articles @ SecurityFocus (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341509

10. Managed Security Services Practice Leader (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341505

11. Product Manager position - Cupertino, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341372

12. Technical Manager, Systems Security, AOL (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341363

13. Qwest seeks Desktop Security Engineer for Denver ope... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341361

14. Looking for an opportunity in Dallas, TX. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341359

15. 7 Requirements in the Mid Atlantic (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341278

16. Job Posting - Information Security Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341277

17. Pre-Sales Security Engineer needed for the West Coas... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341276

18. Online degrees (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341275

19. How do Employers feel about online Degrees (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341182

20. Intrusion Detection Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341181

21. active clearance question and job search (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341179

22. Multiple security positions in Germany (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341177

23. Seeking INFOSEC Position in the Colorado Area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341174

24. job posting (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341134

25. System Security Analyst - Wichita, KS (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/341104


VI. INCIDENTS LIST SUMMARY
--------------------------
1. FYI - different ISAPI .ida exploit (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/341704

2. Proxy attackers/hijackers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/341703

3. [Dshield] Proxy attackers/hijackers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/341679

4. New Rootkit? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/341678

5. New Article: Incident Response Tools For Unix, Part ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/341519

6. Article Announcement: CCIA Report is Bad Medicine (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/341356

7. Exchange/Microsoft SMTP Authenticated User spam? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/341303

8. strange windows behaviour. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/341187


VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. procmail again (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/341675

2. Question (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/341669

3. question about the new sendmail prescan bug (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/341462

4. sendmail bugs (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/341229

5. lame citrix bug, anyone think of anything interestin... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/341200


VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. RPC Scan Issues (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341738

2. group policy question (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341736

3. Win2003 RPC failure after Hotfix (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341624

4. USB memory supporting NTFS? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341623

5. automating reboot (was RE: RPC Scan Issues) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341621

6. question re: continued RPC vulnerability (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341577

7. Article Announcement: The Flaw of Security Through D... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341507

8. Blocking and allowing ActiveX (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341471

9. Article Announcement: CCIA Report is Bad Medicine (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341349

10. Windows 2000 Server hardening (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341333

11. SecurityFocus Microsoft Newsletter #158 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341129

12. Guest Feature Announcement: Counterpoint: Linux vs. ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/341092


IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Solaris 9 ssh (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/341673

2. Prevent remote User login (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/341581

3. New SecurityFocus articles (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/341511

4. Administrivia: Your response requested (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/341506

5. Account Lockout in Solaris 8 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/341414


X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Synflooding a Linux (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/341718

2. Administrivia: Your Response Requested (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/341508

3. New articles on the SecurityFocus site (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/341504

4. curious port activity (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/341168


XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: ISS

Protect More With Less!

Get rid of hard-to-manage firewalls, anti-virus, content-filtering and
anti-spam products. ISS' single-engine Proventia? M Series automatically
blocks all forms of attack and eliminates the need for legacy, standalone
security technologies. See Demo.
http://www.securityfocus.com/sponsor/ISS_sf-news_031020
------------------------------------------------------------------------